hesela.devHistory independence
History independence limits what a stored representation reveals about prior operations beyond the abstract state permitted by its security model.
Observation model: Weak history independence considers one inspection; strong history independence considers repeated inspections. The protected representation and permitted observations must be specified. [1]
Different guarantees: Hiding a remote access trace does not automatically hide history after client compromise. In vORAM+HIRB, the HIRB structure is history independent but the combined system permits bounded recent-history leakage; its secure-deletion guarantee is separate. The model assumes an honest-but-curious server and locally erasable client memory. [2]
Relations
Limitations
- A property proved for one layer does not automatically cover the physical flash layout beneath it. [1]
Citations
- Chen and Sion. HiFlash: A History Independent Flash Device. arXiv:1511.05180v1 (2015), sections II, IV and VI.
- Roche, Aviv and Choi. A Practical Oblivious Map Data Structure with Secure Deletion and History Independence. arXiv:1505.07391v2, sections 1.2-1.3 and 3.