TreePIR: Efficient Private Retrieval of Merkle Proofs via Tree Colorings with Fast Indexing and Zero Storage Overhead

TL;DR

TreePIR presents a storage-optimal private retrieval method for Merkle proofs by using a balanced ancestral coloring that partitions a Merkle tree into $h$ sub-databases, enabling private retrieval with exactly one query per sub-database and zero storage redundancy. A Divide-and-Conquer Color-Splitting Algorithm constructs feasible colorings with $O(n\log\log n)$ preprocessing time and $O(h^3)$ indexing complexity, dramatically reducing indexing overhead from the $\Omega(N)$ scale in prior batch-PIR approaches. Empirical evaluation shows TreePIR significantly outperforms Probabilistic Batch Codes across setup, indexing, computation, and communication, achieving up to 3x total storage savings and up to 8–160x faster indexing for large trees, with setup times acceptable even for trees with billions of leaves. The approach enables privacy-preserving verification in Certificate Transparency, stateless blockchain clients, and other Merkle-tree-based systems, with potential extensions to growing, sparse, and q-ary Merkle-like structures.

Abstract

A Batch Private Information Retrieval (batch-PIR) scheme allows a client to retrieve multiple data items from a database without revealing them to the storage server(s). Most existing approaches for batch-PIR are based on batch codes, in particular, probabilistic batch codes (PBC) (Angel et al. S&P'18), which incur large storage overheads. In this work, we show that \textit{zero} storage overhead is achievable for tree-shaped databases. In particular, we develop TreePIR, a novel approach tailored made for private retrieval of the set of nodes along an arbitrary root-to-leaf path in a Merkle tree with no storage redundancy. This type of trees has been widely implemented in many real-world systems such as Amazon DynamoDB, Google's Certificate Transparency, and blockchains. Tree nodes along a root-to-leaf path forms the well-known Merkle proof. TreePIR, which employs a novel tree coloring, outperforms PBC, a fundamental component in state-of-the-art batch-PIR schemes (Angel et al. S&P'18, Mughees-Ren S&P'23, Liu et al. S&P'24), in all metrics, achieving $3\times$ lower total storage and $1.5$-$2\times$ lower computation and communication costs. Most notably, TreePIR has $8$-$160\times$ lower setup time and its polylog-complexity indexing algorithm is $19$-$160\times$ faster than PBC for trees of $2^{10}$-$2^{24}$ leaves.

Figures (17)

• Figure 1: An illustration of the Probabilistic Batch Code (PBC) approach angel2018 for private retrieval of a Merkle proof $(x_3,x_6)$ in a (swapped) Merkle tree of height $h=2$. There are $1.5h = 3$ sub-databases and each tree node $x_i$ is replicated three times and stored at three sub-databases indexed by the hash functions $h_1, h_2, h_3$. To privately retrieve $(x_3,x_6)$ (the root $x_1$ is publicly known), the client must send $1.5h=3$ PIR queries to three sub-databases, one of which is useless (PIR($\perp$)) but required to guarantee the privacy.
• Figure 2: An illustration of our coloring-based approach for batch private retrieval of a Merkle proof $(x_3,x_6)$ in a (swapped) Merkle tree of height $h=2$. Each tree node $x_i$ is stored in exactly one sub-database according to its assigned color, hence incurring no storage redundancy. As the result, our scheme uses only $h=2$ sub-databases, each of which is of size half of that in PBC angel2018, and the client only computes and sends $h=2$ PIR queries.
• Figure 3: Balanced ancestral colorings of perfect binary trees $T(h)$ with $h = 1,2,3$. Nodes that are ancestor and descendant have different colors, and the color classes have sizes almost equal.
• Figure 4: Illustration of an original Merkle tree and a swapped tree, in which sibling nodes, e.g., $x_2$ and $x_3$, are swapped. A Merkle proof in the original Merkle tree (consisting of the siblings of nodes along a root-to-leaf path) forms a root-to-leaf path in the swapped tree. We henceforth only work with swapped trees.
• Figure 5: An illustration of our approach. First, the nodes of the (swapped) Merkle tree of height $h$ are partitioned into $h$ sub-databases, each corresponds to one color. The client runs $h$ PIR schemes independently on $h$ sub-databases to privately retrieve $h$ nodes of a Merkle proof. This is possible because our coloring ensures that each Merkle proof contains $h$ nodes of different colors.

Theorems & Definitions (42)

• Definition 1: batch-PIR
• Definition 2: Correctness
• Definition 3: Computational Privacy
• Definition 4: Ancestral Coloring
• Example 1
• Theorem 1
• Remark 1
• Definition 5: Color sequence
• Example 2
• Definition 6: Feasible color sequence