Proof of Theorem 5.3

Theorem 5.3. If AHE is CPA-secure, then CPX is (m,Lctr

SN)-snapshot secure. Proof. Consider the CPX simulator S that works as follows.

Simulating ectri after the ith sequence of operations: Given LctrSN(ctr,σi) = λ,S simulates ectri as follows:

• As first step, S initializes a binary tree T0 with λ leaves where every node N is equal to

N←AHE.Enc(pk,0), where (sk,pk)← AHE.Gen(1k). It outputs ectri = (T0, ,0,pk), where

is the privacy parameter.

• for all i ≥ 1, for all j ∈ [|op_i|], the simulator S replaces every node Nin the path starting from the root and ending at the leafPi−1

t=1|σt|+jinTi−1 byN←AHE.Enc(pk,0). It outputs

It remains to show that for all probabilistic polynomial-time adversaries A, the probability that RealΣ,A(k) outputs 1 is negligibly-close to the probability that IdealΣ,A,S outputs 1. We do this using the following sequence of games:

Game0 : is the same as a RealΣ,A(k) experiment.

Game1 : is the same as Game0 except that the AHE encryption of all nodes N in the path

starting from the root and ending at the ith leaf, for the ith operation, are replaced with N←AHE.Enc(pk,0). The probabilities thatGame0 and Game1 output 1 are negligibly-close,

otherwise the IND-CPA-security ofAHE would be violated.

The Theorem follows by observing thatGame1 is exactly anIdealΣ,A,S(k) experiment.

B

HPX Proofs

B.1 Proof of Theorem 6.2

Theorem6.2. IfΣDBis(L_Sdb,Ldb_Q,Ldb_A ,Ldb_R )-secure, and∆ctris(Lctr_S ,Lctr_A ,Lctr_P )-secure, then HPX is (L_S,L_Q,L_A,L_R,L_P)-secure.

Proof. LetSDB,Sctr1 andSctr2 be the simulators guaranteed to exist by the adaptive security of ΣDB and ∆ctr and consider the HPX simulators S1 andS2 that work as follows.

Simulating PEDB: Given

L_S(DB) = Ldb_S (DB), Lctr_S (ctri) i∈[n] ,

S1 simulates PEDBby computing

EDB← S_DB(Ldb_S (DB)) and ectri ← Sctr1 (LctrS (ctri)),

for all i∈[n], and outputting

PEDB= (EDB,ectr1,· · · ,ectrn).

Simulating EQuery: GivenL_Q(DB, q) =Ldb

Q(DB, q), S1 uses

S_DB

Ldb_Q DB, q

to simulate a query on EDB. Recall that ΣDB.Query is an interactive protocol so here S1 is using

S_DB to play the role of the curator. Simulating EAdd: Given

LA(DB, u+) = Ldb_A(DB, u+), Lctr_A (ctri, a) i∈[n] , wherea∈ {−1,0,1}. S₁ first uses

S_DB

Ldb _{DB, u}+

to simulate an add to EDB. Here again, as ΣDB.Add is an interactive protocol,S1 is usingSDB to simulate the role of the curator. ThenS₁ uses

S1 ctr Lctr A (ctri, a)

to simulate an add to ectri for all i∈[n]. S1 is usingSctr1 to simulate the role of the curator. Simulating ERemove: The simulation is similar to theEAddsimulation except that instead of L_A, it usesL_R.

Simulating PHist: Given

L_P(DB, qp) = qp,Lctr_P (ctrqp,⊥) , S2 uses S_ctr2 Lctr_P (ctrqp,⊥)

to simulate a private query onectrqp. S₂ is usingS_ctr2 to simulate the role of the analyst.

It remains to show that for all probabilistic polynomial-time adversariesA, the probability that RealΣ,A(k) outputs 1 is negligibly-close to the probability that IdealΣ,A,S1,S2 outputs 1. We do

this using the following sequence of games:

Game0 : is the same as a RealΣ,A(k) experiment.

Game1 : is the same as Game0 except that EDB is replaced by the output of SDB(LdbS (DB)), the execution of ΣDB.Query is replaced by a simulated execution between

S_DB

Ldb_Q DB, q

and the adversary, the execution of ΣDB.Addis replaced by a simulated execution between

S_DB Ldb A DB, u+

and the adversary, and the execution of ΣDB.Remove is replaced by a simulated execution between

SDB

Ldb_R DB, u−

and the adversary. The probabilities that Game0 and Game1 output 1 are negligibly-close,

otherwise the (Ldb

S ,LdbQ,LdbA ,LdbR )-security of ΣDB would be violated.

Game1+i fori∈[n]: is the same asGameiexcept thatectriis replaced by the output ofSctr1 (LctrS (ctri)), the execution of ∆ctr.Addis replaced by a simulation between

S_ctr1

Lctr_A ctri, a

and the adversary, and the execution of ∆ctr.PRead, if qp ≤ i, is replaced by a simulation between

S_ctr2

Lctr_P ctrqp,⊥

and the adversary on the qpth counter. The probabilities thatGamei and Game1+i output 1 are negligibly-close, otherwise the (Lctr

S ,LctrA ,LctrP )-security of ∆ctr would be violated. The Theorem follows by observing thatGame1+n is exactly an IdealΣ,A,S1,S2(k) experiment.