Worksheet: Shelf Oracle

Fix / Extend

1. Fix. A vendor offers your library a private catalog search and says the search service never learns which title a patron looked up. Using your third table and the card headed Honest scope on What It Does Not Hide, write the two questions you would put to that vendor before believing the sentence: one naming the assumption the claim rests on, and one naming the party who has to be trusted for it to hold. For each, say what answer would satisfy you and what answer would not, and say which of the two designs in your third table the vendor's answers would place them in.
2. Extend. Open One Server vs Two and, in the card headed What the numbers do not say, open the disclosure at the foot of that card. The second of its three paragraphs describes running two servers under genuinely separate control as "an organisational problem, not a technical one". A patron standing at a catalog terminal can see neither operator's records. Using that phrase and your fourth table, filled in step 8, say what such a patron could check for themselves about whether the two operators are staying apart, and what they would have to take on trust instead. Then open What It Does Not Hide, read the card headed Honest scope, and say what the one-server column asks you to believe in place of non-collusion, and what that card says this page does not prove.
3. Extend. Your observer log, recorded into the fifth table in step 9, has columns that came out identical across the three rows and a column that did not. Open What It Does Not Hide and go back to the card headed What a network observer sees; if its log is empty because the page was reloaded or a setting changed since, press the filled button — the one that queries a random book — three times again, so the two boxes under the log are on screen. Using your three recorded rows, those two boxes and the four properties in your sixth table, say which single fact about a patron's request this design keeps from a network observer, and list what it leaves that observer holding. Then pick one item from that list which a library could reduce by something other than encryption, and say what the page suggests would reduce it.
4. Extend. Open Homomorphic Selection and use the buttons in the card headed The homomorphic inner product to fold the records into the answer one at a time, then eight at a time, then the rest. Watch the running answer and the measured budget as you go. Before the record you chose has been reached, what does the page say the accumulator decrypts to — and why does the budget fall anyway? Use the page's own three-line account of why the sum does the selecting.
5. Extend. Back on The Shelf, in the card headed This run, type a string into Run seed and press Pin this seed. Read the warning the page then prints beside it. Get a classmate to pin the same string and pick the same shelf position, and compare your tiles on The Server's View with theirs. Then say, using that warning, why a real system must never let a run be pinned this way, and how this failure is related to the one you produced in step 4.
6. Extend. Do this one last, because it discards everything you measured. Open Noise Exhaustion and, in the card headed Push it until it breaks, lower the ciphertext modulus one step at a time, retrieving at each setting, until the page reports a failure code instead of your record. Record the code and the three figures the page reports with it. Then, using the note printed under those figures, say which of those three checks a real patron's own software could run for itself, and which it could not — and say why that distinction is the reason the page insists a deployment sizes its parameters in advance. The card headed The failure codes names the other three codes and what raises each.