PIR Wednesday — August 19 2026 Weekly Update

TL;DR

1. Applebaum–Ishai–Shechter (CRYPTO 2026) initiate arithmetic PIR (APIR) and prove single-server code-based PIR cannot beat n download cost — then break the two published code-based PIR schemes (ISIT'20, ISIT'24) "within a few minutes on a standard workstation." A field-shaping negative result, presented this week at CRYPTO.
2. Ghoshal–Ishai–Jain–Sun (ePrint 2026/1630) built a quasipolynomial distinguisher for Classic McEliece out of a failed attempt to construct doubly-efficient PIR from locally decodable codes. PIR research is now generating cryptanalysis of a NIST-standardized PQ cryptosystem.
3. Chen–Ishai–Jain–Mour–Rosen–Xing (ePrint 2026/1480) deliver the first benchmarked doubly-efficient secret-key PIR: 4.2× storage overhead on a 37 GB database, <600 KB server reads per query. SK-PIR moves from existence proof to engineering artifact.
4. UC-secure Updatable VPIR (ePrint 2026/1651) — first universally-composable definition of verifiable PIR, plus database updates with access control.
5. TCHES 2026 GPU DPF-PIR (Tan et al., Wuhan) — 8.2–9.4× throughput over prior GPU state-of-the-art on RTX 4090; pipelined variant needs 99% less memory.
6. Kohaku SDK is shipping: ethereum/kohaku (398 stars) released @kohaku-eth/railgun, tornado-cash, and privacy-pools plugin alphas on Aug 8, with operational ERC-4337 mempool relaying. Private writes are going live; private reads (the PIR side) remain the stated next phase.

Lead Story — CRYPTO 2026: Arithmetic PIR and the Death of Code-Based Single-Server PIR

Paper: "On Arithmetic Private Information Retrieval: Why Code-Based PIR (Usually) Fails" Authors: Benny Applebaum (TAU), Yuval Ishai (Technion/AWS), Shahar Shechter (TAU) ePrint: https://eprint.iacr.org/2026/1224 (received June 10 2026; major revision of a CRYPTO 2026 publication) Venue: CRYPTO 2026, Santa Barbara, August 17–20 2026 — the IACR flagship is running this week; Shechter presented the paper there (the Aug 12 vault update flagged this window; CRYPTO, not EUROCRYPT, is the Santa Barbara conference).

The paper defines arithmetic PIR (APIR): the database is a vector of field elements and the scheme makes only black-box use of the field — the natural model for MPC/FHE backends where field operations are the native instruction set.

Why it matters for this library: - It removes a tempting shortcut. Code-based PIR was attractive as a PQ-friendly, lattice-free alternative to LWE-based CPIR. That door is now formally closed for single servers — the two realistic PQ paths are lattice CPIR and DPF-style arithmetized constructions. - The DPF arithmetization result is the quiet positive story: DPF-based PIR (the substrate of Piano, ChalametPIR, and the GPU-PIR line) survives in richer algebraic settings, including with secret-key preprocessing. - It's the second consecutive flagship-conference PIR result (after Henzinger–Ragavan at EUROCRYPT 2026, see PIR Wednesday — August 12 2026 Weekly Update) — PIR theory is having its best run since the late 1990s.

PIR Bites Back: the McEliece Connection

Paper: "Quasipolynomial Cryptanalysis of the McEliece Cryptosystem (or: PIR Meets McEliece)" Authors: Ashrujit Ghoshal (IIT Madras), Yuval Ishai (Technion/AWS), Aayush Jain (CMU), Nuozhou Sun (CMU) ePrint: https://eprint.iacr.org/2026/1630 (received Aug 7 2026)

A classical quasipolynomial-time (n^{O(log n)}) distinguisher for Goppa–McEliece public keys in the Classic McEliece regime (m = Θ(log n), t = Θ(n/log n)). It applies to all Classic McEliece parameter sets considered in the NIST process, yields improved concrete attack estimates (not yet practical), and extends heuristically to a message-recovery attack.

The vault-relevant detail is the origin: the attack came from a failed attempt to construct doubly-efficient PIR from algebraic locally decodable codes, and "can be intuitively explained from the PIR perspective." The LDC–PIR–McEliece triangle has been productive in both directions — LDC techniques built PIR candidates, and the failure mode of those candidates doubles as a cryptanalytic lens on Goppa codes.

Cross-link: HQC (the code-based KEM that succeeded McEliece in the NIST process) and the PQC section's migration files. If the quasipolynomial distinguisher tightens further, the code-based leg of PQC (HQC's security rationale is cousin to McEliece's) inherits the scrutiny. Ishai's authorship on both this and the APIR paper makes him the pivotal researcher of this fortnight.

Secret-Key PIR Gets Practical (ePrint 2026/1480)

Paper: "Doubly-Efficient Secret-Key PIR with Low Storage Overhead" Authors: Caicai Chen (Bocconi/Bending Spoons), Yuval Ishai, Aayush Jain (CMU), Tamer Mour (IIAI), Alon Rosen (Bocconi), Chaoping Xing (SJTU) ePrint: https://eprint.iacr.org/2026/1480 (received Jul 20 2026 — in the gap window before the Aug 12 update, now catalogued)

The Aug 12 update recorded SK-PIR foundations (Bitansky–Mazor from OWFs; Chen et al. STOC'26 from LPN). This paper is the engineering counterpart:

• First doubly-efficient SK-PIR with constant storage overhead — asymptotically approaching 1× in natural regimes (best prior: k/polylog(k) server work at constant storage).
• k^{o(1)} communication and online server work.
• Built on the permuted-code blueprint (Boyle–Ishai–Pass–Wootters / Canetti–Holmgren–Richelson, TCC 2017), instantiated with new t-smooth locally decodable codes: a concatenated-curves local decoder for Reed–Muller, plus curve-lifted codes with attractive concrete efficiency.
• Benchmarked: a representative instantiation encodes a 37 GB database of 18-bit records with 4.2× storage overhead, server reads <600 KB per query, with extensive cryptanalysis of the underlying assumptions.

Deployment reading: SK-PIR's model (client does one-time preprocessing with a secret key; server answers from an encoded DB) maps naturally onto wallet ↔ RPC-provider relationships — the exact Ethereum private-reads scenario this section tracks. A 4.2× storage overhead is within the range RPC providers already spend on replicas. The remaining barriers are the offline client work and the assumption novelty (permuted-code/LDC assumptions, not yet battle-tested like LWE).

Other New Papers (Aug 5–19 window)

Single-Server Verifiable PIR with Updates, UC-Secure (ePrint 2026/1651, Aug 10)

First universally composable definition of verifiable PIR (ideal VPIR functionality), motivated by showing how game-based VPIR properties fail under sequential and concurrent composition when PIR is a building block in a larger app. Two realizations: trivial PIR and VeriSimplePIR. Also introduces Updatable VPIR (UVPIR): database updates authorized by permissioned clients, responses bound to a specific database version — constructed black-box from any VPIR.

This merges three previously separate frontier threads (verifiability, updates, composable security) into one formalism — directly relevant to using PIR inside wallets and agent stacks rather than as a standalone query box.

Updatable OKVS + PIR for Multi-Key Searchable Encryption (ePrint 2026/1590, Aug 12)

Introduces UOKVS (updatable oblivious key-value store with fine-grained access control), including the first oblivious-insertion analysis for Cuckoo hashing. Application: multi-key searchable encryption without data replication across authorized users — 0.6 s WAN queries for keywords matching 100 documents on a 24M-entry Enron dataset, using FrodoPIR as the backend, at 3.1× storage overhead. Notable as a rare paper that benchmarks against Brave's deployment-oriented FrodoPIR rather than the SimplePIR family.

Single-Server QPIR from One-Way Functions (ePrint 2026/1524, Jul 25)

Ananth et al. observe that quantum PIR with polylogarithmic communication exists assuming only post-quantum one-way functions — by compiling Kerenidis–Wolf (STOC'03) quantum PIR with Gilboa–Ishai (EUROCRYPT'14) DPFs. A three-line observation paper, but it sets the quantum ceiling: quantum clients get polylog PIR from Minicrypt, while classical single-server PIR still appears to need public-key assumptions. Quantum networking is distant, but the asymmetry is now on record.

Exponentially Fewer-Server PIR (ePrint 2026/1515, Jul 24)

Gupta et al.: under a plausible number-theoretic conjecture (implied by the generalized repunit conjecture or Schinzel's hypothesis H), s-server PIR with communication exp(O((log n)^{1/s} (log log n)^{1-1/s})) — matching prior communication with exponentially fewer servers (2^{O(s)} → s). Resolves a Ghasemi–Kopparty open problem with k+1-nonzero-coefficient S-decoding polynomials (provably minimal sparsity); unconditional for s ≤ 15. Footnote of note: the main result "was discovered in a GPT-5.5 Pro conversation prompted by the authors" — an early high-profile instance of LLM-assisted theorem discovery in the PIR literature.

SoK: Confidential Transformer Inference and RAG (ePrint 2026/1544, Jul 28)

Systematization of confidential ML inference and — for the first time — the RAG retrieval layer, across five mechanism families (MPC, FHE, TEE, obfuscation, DP, hybrids). Findings: no family dominates (each sacrifices one of performance/utility/threat-model fit); private graph-RAG is the least-served setting; no design yet keeps a pipeline confidential from query to answer. Positions PIR (alongside SSE/ORAM) as the retrieval-layer ingredient for confidential RAG — the natural continuation of RAGtime-PIANO (ePrint 2026/231) recorded in the June 17 reference snapshot.

Hardware: GPU-Accelerated DPF-PIR at TCHES (Published Jul 17)

Paper: "GPU-Accelerated DPF-Based Private Information Retrieval for Large-Scale Database" Authors: Qingquan Tan, Chenkai Zeng, Qi Feng, Cong Peng, Weijia Wang, Debiao He (Wuhan University; Shandong University) Venue: IACR Transactions on Cryptographic Hardware and Embedded Systems (TCHES) 2026(3):933–957, DOI 10.46586/tches.v2026.i3.933-957

DPF-PIR's server cost is memory-bound; this work attacks both dominant components:

Also ≥2.27× throughput over high-performance preprocessing PIRs. Techniques: GPU-oriented DPF tree-expansion execution (fewer redundant accesses, less bank conflicts), distribution-aware database access with thread-level coalescing, CUDA reduction primitives, improved cache utilization for batches. Authors note applicability beyond queries: maliciously-secure protocols, secure LUT evaluation, and private read/write for digital currencies — the exact Ethereum use case this section tracks. This is the strongest published GPU-PIR number to date and updates the hardware frontier (GPIR, SmartPIR, IM-PIR, IVE — see PIR Implementations and Libraries).

Deployment: Kohaku SDK Alpha Shipping, PSE Rebrands, EthSystems Spins Out

• Repo: https://github.com/ethereum/kohaku — 398 stars, created Aug 1 2025, last push Aug 10 2026, description "Privacy-first tooling for the Ethereum ecosystem."
• Aug 8 2026 release batch (GitHub Releases API): @kohaku-eth/railgun@0.0.1-alpha.29, @kohaku-eth/tornado-cash@0.0.2-alpha.20, @kohaku-eth/privacy-pools@0.0.2-alpha.15, @kohaku-eth/plugins@0.0.1-alpha.12 — all three major shielded-pool protocols now have Kohaku plugin alphas.
• Tornado-cash plugin alone shipped alpha .14→.20 between Jul 7 and Aug 8 — weekly-cadence iteration.
• Railgun integration has operational ERC-4337 mempool relaying for private transactions (The Defiant); Tornado Cash and Privacy Pools integrations in development. The SDK routes privacy-protocol transactions through the 4337 mempool rather than protocol-specific relayers — removing a centralized-relayer dependency.
• The SDK release was announced May 25 2026 (X post id 2058896518698926103, decoded from snowflake timestamp); The Defiant covered it as "Kohaku Initiative Launches SDK for Wallet-Level Privacy Integration."
• Scope beyond shielded pools: @kohaku-eth/pq-account — a post-quantum ERC-4337 account implementation — plus multisig and hardware-wallet support.
• Wallet adopters: Ambire (production integration underway), a browser-extension experimental wallet with breadcoop, and a CLI reference wallet (kassandraoftroy/kohaku-cli). Berlin Blockchain Week showcase planned.
• Commits this window: corpus-core/colibri-stateless v2 peer-range support (Aug 10), Railgun tail-call exposure (Aug 7), legacy-key export removal in dumpState (Aug 7) — active hardening.

Important scoping note for this section: the shipping SDK covers private writes (shielded pools, 4337 relaying). The private reads path — the PIR/ORAM/Oblivious-Labs work tracked here — remains the stated Phase-1-then-endgame architecture: TEE+ORAM oblivious server now, cryptographic PIR later. The Kohaku testnet roadmap (ethereum/wallet-poc, kohaku-testnet-roadmap.md) schedules "v1: Abstraction Core with Privacy by Design" across January–August 2026 — i.e., the private-reads phase is due now, making H2 2026 the watch window for the first PIR-backed wallet feature.

PSE Rebrand and the Ethereum.org Roadmap Language

• PSE ("Privacy & Scaling Explorations") rebranded to "Privacy Stewards of Ethereum", with a stated mandate to "methodically study ORAM and PIR state-of-the-art techniques while translating research into practical wallet and browser experiences." The old privacy-scaling-explorations/pir-ethereum-data GitHub repo no longer resolves (404) — the PIR-for-Ethereum-data effort now lives under the pse.dev project pages rather than a standalone repo. Watch-list updated accordingly.
• ethereum.org/roadmap/privacy (page updated Jul 27 2026): "PIR research is progressing with active implementations being tested by infrastructure teams. The Kohaku wallet SDK is under development as an open-source reference" — PIR is now on Ethereum's official public roadmap page, positioned at the access layer between wallet software and node providers.
• EthSystems spinout (July 2026): the EF's Institutional Privacy Task Force became a for-profit building privacy infrastructure for institutions (ethsystems.org). Institutional demand (confidential EVMs, trading-position privacy) is now institutionally organized — a demand-side pull for PIR/ORAM serving that the Chainstack analysis connects to Oasis Sapphire-style confidential chains.

Updated Evidence at a Glance — New This Window

Frontier Map Updates

1. Foundations / negative results (NEW): APIR lower bound closes single-server code-based PIR. PIR theory now also exports cryptanalysis (McEliece distinguisher).
2. Secret-key PIR: foundations (Aug 12) → benchmarked constructions (2026/1480). Fastest-maturing theoretical thread.
3. IT-PIR / multi-server: fewer-server PIR (2026/1515) extends the Henzinger–Ragavan momentum; IT-APIR O(n^{1/3}) characterization from 2026/1224.
4. Verifiability + updates + composition: UC VPIR/UVPIR (2026/1651) and UOKVS (2026/1590) consolidate three threads into deployable formalisms.
5. Hardware acceleration: TCHES GPU DPF-PIR sets the new published GPU ceiling; quantum-client ceiling set by QPIR note (2026/1524).
6. Ethereum integration: Kohaku private-writes SDK shipping now; private-reads (TEE+ORAM → PIR) due in the Jan–Aug 2026 "Abstraction Core" window — watch H2 2026 for first PIR-backed feature. PSE rebrand + EthSystems spinout add institutional demand-side pull.
7. Confidential AI/RAG: SoK 2026/1544 confirms PIR as retrieval-layer ingredient; private graph-RAG flagged as most under-served.

Watchlist — Next 7–14 Days