Remise: Authorized Anonymous Communication Systems

Remise is a two-server authorized anonymous communication system built on Distributed Oblivious RAM (DORAM). It supports both anonymous bulletin boards, where messages are publicly revealed without linking senders to posts, and anonymous communication channels, where writers selectively grant and revoke read access to authorized readers while keeping messages hidden from the servers. A key contribution of Remise is its lightweight access-control mechanism, which stores authorization credentials in secret-shared form and enables oblivious verification without revealing accessed indices, authorization tokens, or writer–reader relationships.

The artifact contains the benchmarking framework used to evaluate Remise and reproduce the performance results reported in the paper. The experiments measure the costs of authorization, auditing, and oblivious memory access under realistic network conditions, and compare Remise against PACL/Spectrum. The results show that Remise achieves substantially lower online server overhead and, beyond sufficiently large database sizes, higher throughput than PACL.

The performance of both systems is primarily determined by three components: preprocessing, auditing, and oblivious memory access. While message size affects the cost of memory access, the dominant cost in the auditing phase is Distributed Point Function (DPF) evaluation. Remise leverages built-in auditing and therefore uses standard DPFs, whereas PACL relies on verifiable DPFs (V-DPFs), which incur higher evaluation costs. Although Remise introduces additional latency because the servers generate the DPFs during execution, this overhead is amortized as the database size grows. Consequently, for larger databases, the efficiency gains from using lighter-weight DPFs outweigh the additional latency, resulting in improved throughput and overall performance.

Another variant of Remise, namely, Remise (Sabre), has an authorization based on MPF-PRF evaluation. Consequently, the audit time is independent of database size and is primarily dependent on the latency.