Revisiting Definitional Foundations of Oblivious RAM for Secure Processor Implementations

Oblivious RAM (ORAM) is a renowned technique to hide the access paŠerns of an application to an untrusted memory. According to the standard ORAM de€nition presented by Goldreich and Ostrovsky, in order for two ORAM access sequences to be computationally indistinguishable, the lengths of these sequences must be identically distributed. An artifact of this de€nition is that it does not apply to modern ORAM implementations adapted in current secure processors technology because of their arbitrary lengths of memory access sequences depending on programs’ behaviors. As a result, the ORAM timing and termination channels are not catered for in the theoretical foundations of ORAM. Œis paper conducts a €rst rigorous study of the standard ORAM de€nition in view of modern practical ORAMs (e.g., Path ORAM) and demonstrates the gap between theoretical foundations and real implementations. A formal ORAM de€nition which allows arbitrary lengths of ORAM sequences, hence incorporating timing/termination channel leakage, has been proposed. It has been shown how this de€nition is much broader than the standard ORAM de€nition and beŠer €ts the modern practical ORAM implementations. Œe proposed de€nition relaxes the constraints around the stash size and overƒow probability for Path ORAM, and essentially transforms its security argument into a performance consideration problem. Finally, to mitigate internal side channel leakages, a generic framework for dynamic resource partitioning has been proposed to achieve a balance between performance and leakage via contention on shared resources.