Lower Bound on the Redundancy of PIR Codes

We prove that the redundancy of a k-server PIR code of dimension s is Ω( √ s) for all k > 3. This coincides with a known upper bound of O( √ s) on the redundancy of PIR codes. Moreover, for k = 3 and k = 4, we determine the lowest possible redundancy of k-server PIR codes exactly. Similar results were proved independently byMary Wootters using a different method. Given two binary vectors u = (u1, u2, . . . , un) and v = (v1, v2, . . . , vn), we define their product uv componentwise, namely uv def = (u1v1, u2v2, . . . , unvn) (1) where u1v1, u2v2, . . . , unvn are computed in GF(2). Note that the product operation in (1) distributes over addition in Fn 2 . Thus (1) turns the vector space F n 2 into an algebra An over F2. This algebra An is unital, associative, and commutative. Given a set X ⊆ Fn 2 , we define the square of X as the set of products of the elements in X. Explicitly, X is defined as follows: X def = { uv : u, v ∈ X and u 6= v } (2) The following lemmas follow straightforwardly from the definitions in (1) and (2), along with the fact thatAn is a commutative algebra. We let 〈X〉 denote the linear span over F2 of a set X ⊆ Fn 2 . Lemma 1. |X2| 6 |X| ( |X| − 1 ) /2. Proof. If |X| = r, then X consists of the ( 2 ) vectors uv = vu for some u 6= v in X. Some of these vectors may coincide. Lemma 2. Let u, v1, v2, v3 ∈ Fn 2 . If v1v2 + v1v3 + v2v3 = 0, then (u + v1)(u + v2) + (u + v2)(u + v3) + (u + v3)(u + v1) = u Proof. Follows by straightforward verification using distributivity and commutativity in An. We now show how the foregoing lemmas can be used to establish a bound on the redundancy of binary k-server PIR codes for k > 3. These codes are defined in [1,2] as follows. Definition1. Let ei denote the binary (column) vector with 1 in position i and zeros elsewhere. We say that an s × n binary matrix G has propertyPk if for all i ∈ [s], there exist k disjoint sets of columns of G that add up to ei. A matrix that has property Pk is also said to be a k-server PIR matrix. A binary linear code C of length n and dimension s is called a k-server PIR code if there exists a generator matrix G for C with property Pk. For much more on k-server PIR codes and their applications in reducing the storage overhead of private information retrieval, see [1,2]. In particular, it is shown in [2] that, given a k-server PIR code of length s + r and dimension s, the storage overhead of any linear k-server PIR protocol can be reduced from k to (s + r)/s. Moreover, for every fixed k, there exist k-server PIR codes whose rate (and, hence, storage overhead) approaches 1 as their dimension s grows. However, exactly how fast the resulting storage overhead tends to 1 as s → ∞ was heretofore unknown. For every fixed k, Fazeli, Vardy, and Yaakobi [1,2] construct k-server PIR codes with redundancy r bounded by r 6 k √ s (