Garbling Techniques David Evans www.cs.virginia.edu/evans Summer School on Secure Computation University of Notre Dame 9 May 2016

Collaborators Samee Zahur (UVA) Mike Rosulek (Oregon State)

Recap: Garbled Table x a b a1 b0 Ea1,b0 (x0) a0 b1 Ea0,b1 (x0) a0 or a1 b0 or b1 Inputs Output x a b a1 b0 Ea1,b0 (x0) a0 b1 Ea0,b1 (x0) Ea1,b1 (x1) Ea0,b0 (x0) AND x

This Lecture 2 ciphertexts (AND) 0 ciphertexts (XOR) What to use for E Inputs Output x a b a1 b0 Ea1,b0 (x0) a0 b1 Ea0,b1 (x0) Ea1,b1 (x1) Ea0,b0 (x0) 2 ciphertexts (AND) 0 ciphertexts (XOR) What to use for E Open Research Questions

Garbling is a fundamental primitive Formalizing Garbling (CCS 2012) Garbling is a fundamental primitive

Garble Encode Evaluate Decode f garbled circuit F encoding info e garbled input X garbled output Y z decoding info d x

garbled circuit F Evaluate Y Garble Encode X Decode f e z x d Correctness property:

garbled circuit F Evaluate Y Garble Encode X Decode f e f(x) x d Security properties:

garbled circuit F Evaluate Y Garble Encode X Decode f e f(x) x d Security properties Privacy: F, X, and d leak reveals nothing beyond f(x) Obliviousness: F, X reveals nothing (new) Authenticity: given F, X, hard to find Y’ such that: Decode(Y’, d) ∉ { f(x), error }

garbled circuit F Evaluate Y Garble Encode X Decode f e f(x) x d Cost of Garbling Storage and Bandwidth: large functions: dominated by size of F small functions: encode also matters Computation: Garble, Evaluate Encode, Decode

FOCS 1982 Yao’s Garbling Scheme? FOCS 1986

FOCS 1982 Yao’s Garbling Scheme? FOCS 1986 Neither paper (or any other by Yao) actually describes Yao’s Garbled Circuits

Simple Garbling x a b a1 b0 Ea1,b0 (x0) a0 b1 Ea0,b1 (x0) Ea1,b1 (x1) Inputs Output x a b a1 b0 Ea1,b0 (x0) a0 b1 Ea0,b1 (x0) Ea1,b1 (x1) Ea0,b0 (x0)

Simple Garbling Ea1,b0 (x0) Ea0,b1 (x0) Ea1,b1 (x1) Ea0,b0 (x0)

Simple Garbling Ea1,b0 (x0) Ea0,b1 (x0) Ea1,b1 (x1) Ea0,b0 (x0) Try all four, can tell valid encryption output

Single Hash Garbling Ea1,b0 (x0) Ea0,b1 (x0) Ea1,b1 (x1) Ea0,b0 (x0)

Single Hash Garbling Ea1,b0 (x0) Ea0,b1 (x0) Ea1,b1 (x1) Ea0,b0 (x0) How can the evaluator know which row to decrypt?

Point-and-Permute Select random bit for each wire: rw ra = 0, rb = 0 Select random bit for each wire: rw Set last bit of w0 to rw, w1 to ¬ra Enca0,,b0,(c0) Enca0,,b1(c0) Enca0,,b0(c0) Enca1,b1(c1) Beaver, Micali and Rogaway [STOC 1990]

Point-and-Permute Select random bit for each wire: rw ra = 1, rb = 1 Select random bit for each wire: rw Set last bit of w0 to rw, w1 to ¬ra Order table canonically: 00/01/10/11 Enca1,,b1,(c1) Enca1,,b0(c0) Enca0,,b1(c0) Enca0,b0(c0) Beaver, Micali and Rogaway [STOC 1990]

Point-and-Permute Enca1,,b1,(c1) Enca1,,b0(c0) Enca0,,b1(c0) ra = 1, rb = 1 Encoding garble table entries: Enca1,,b1,(c1) Enca1,,b0(c0) Enca0,,b1(c0) Enca0,b0(c0) Output wire label Input wire labels (with selection bits) Beaver, Micali and Rogaway [STOC 1990]

garbled circuit F Evaluate Y Garble Encode X Decode f e f(x) x d

garbled circuit F Evaluate Y Garble Encode X Decode f e f(x) x d Compute: 4 hashes per gate Compute: 1 hash per gate Bandwidth: 4 ciphertexts per gate

Garbled Row Reduction Naor, Pinkas and Sumner [1999]

Garbled Row Reduction Naor, Pinkas and Sumner [1999]

Garbled Row Reduction Naor, Pinkas and Sumner [1999]

Compute: 4 hashes per gate Compute: 1 hash per gate Garble Encode Evaluate Decode f garbled circuit F e X Y f(x) d x Basic Scheme Compute: 4 hashes per gate Compute: 1 hash per gate Bandwidth: 4 ciphertexts per gate Garbled Row Reduction

Compute: 4 hashes per gate Compute: 1 hash per gate Garble Encode Evaluate Decode f garbled circuit F e X Y f(x) d x Basic Scheme Compute: 4 hashes per gate Compute: 1 hash per gate Bandwidth: 4 ciphertexts per gate Garbled Row Reduction Bandwidth: 3 ciphertexts per gate

Free-XOR Global generator secret Kolesnikov and Schneider [ICALP 2008]

Free-XOR Global generator secret Kolesnikov and Schneider [2008]

Free-XOR Global generator secret Kolesnikov and Schneider [2008]

Free-XOR XOR are free! No ciphertexts or encryption needed. Global generator secret XOR are free! No ciphertexts or encryption needed. Kolesnikov and Schneider [2008]

Security Assumptions for Free-XOR ICALP 2008 TCC 2012 Proved secure in Random Oracle model Speculated that Correlation Robustness was sufficient Correlation Robustness is not enough Proved secure with related-key and circularity assumption

4 1 3 Garbled Row Reduction Point-and-Permute Free XOR Basic Odd (AND) Generator Encryptions (H) 4 Evaluator Encryptions (H) 1 Ciphertexts Transmitted 3 Even (XOR)

Double Garbled Row Reduction (GRR2) EA0,B0 (C0) EA0,B1 (C1) EA1,B0 (C0) EA1,B1 (C0) Instead of learning output directly, need to do more work to find it Pinkas, Schneider, Smart, Williams 2009

GRR2 Pinkas, Schneider, Smart, Williams 2009

GRR2 Pinkas, Schneider, Smart, Williams 2009

GRR2 Pinkas, Schneider, Smart, Williams 2009

GRR2 C0 = P(0) C1 = P(1) Pinkas, Schneider, Smart, Williams 2009

GRR2 P(5) P(6) Garbled table: C0 = P(0) C1 = P(1) Pinkas, Schneider, Smart, Williams 2009

GRR2 P(5) P(6) Incompatible with free-XOR Garbled table: C0 = P(0) Pinkas, Schneider, Smart, Williams 2009

4 4+ 1 1+ 3 2 Basic Point-and-Permute GRR-1 Free XOR + GRR-1 + PnP Odd (AND) Generator Encryptions (H) 4 4+ Evaluator Encryptions (H) 1 1+ Ciphertexts Transmitted 3 2 Even (XOR)

FleXOR GRR-2 Gates Free-XOR Gates Single Ciphertext to Convert S Kolesnikov, Mohassel, Rosulek 2014

4 4+ 1 1+ 3 2 {0, 1, 2} Free XOR + GRR-1 + PnP GRR-2 FleXOR Basic Odd (AND) Generator Encryptions (H) 4 4+ Evaluator Encryptions (H) 1 1+ Ciphertexts Transmitted 3 2 Even (XOR) {0, 1, 2}

What cost should we be focusing on? Basic Free XOR + GRR-1 + PnP GRR-2 FleXOR Odd (AND) Generator Encryptions (H) 4 4+ Evaluator Encryptions (H) 1 1+ Ciphertexts Transmitted 3 2 Even (XOR) {0, 1, 2} What cost should we be focusing on?

cost to garble AES circuit (36K gates, 6660 AND) [HEKM 2011] Cost of Garbling HA,B(C) Garbling/evaluating time per gate ~2000/1000 ns (including network) SHA-256(A || B || gateID) ⊕ C

Cost of Garbling HA,B(C) SHA-256(A || B || gateID) ⊕ C ~2000/1000 ns Garbling/evaluating time per gate SHA-256(A || B || gateID) ⊕ C ~2000/1000 ns Actual computation cost: 12 cycles/byte ⇝ 200ns/50ns AES(kconst, K ) ⊕ K ⊕ C where K =2A⊕ 4B ⊕ gateID ~ 15/7 ns “Fixed-key AES” using AES-NI Bellare, Hoang, Keelveedhi, Rogaway 2013

cost to garble AES circuit (36K gates, 6660 AND) [HEKM 2011] Cost of Garbling HA,B(C) Garbling/evaluating time per gate SHA-256(A || B || gateID) ⊕ C ~2000/1000 ns Actual computation cost: 12 cycles/byte ⇝ 200ns/50ns AES(kconst, K ) ⊕ K ⊕ C where K =2A⊕ 4B ⊕ gateID ~ 15/7 ns Time to transmit 80-bits at 1Gbps: 80ns “Fixed-key AES” using AES-NI Bellare, Hoang, Keelveedhi, Rogaway 2013

4 4+ 1 1+ 3 2 {0, 1, 2} Free XOR + GRR-1 + PnP GRR-2 FleXOR Basic Odd (AND) Generator Encryptions (H) 4 4+ Evaluator Encryptions (H) 1 1+ Ciphertexts Transmitted 3 2 Even (XOR) {0, 1, 2}

Half Gates Yan Huang, David Evans, and Jonathan Katz. Private Set Intersection: Are Garbled Circuits Better than Custom Protocols? [NDSS 2012]

Yan Huang, David Evans, and Jonathan Katz Yan Huang, David Evans, and Jonathan Katz. Private Set Intersection: Are Garbled Circuits Better than Custom Protocols? [NDSS 2012]

Journal of the ACM, January 1968 Yan Huang, David Evans, and Jonathan Katz. Private Set Intersection: Are Garbled Circuits Better than Custom Protocols? [NDSS 2012] swap gates, configured (by generator) to do random permutation

Generator Half Gate Known to generator (but secret to evaluator)

Generator Half Gate Known to generator (but secret to evaluator)

Generator Half Gate Known to generator (but secret to evaluator)

Swapper: “Generator Half Gate” Known to generator (but secret to evaluator) With Garbled Row Reduction: Only need to send one ciphertext!

Evaluator Half-Gate Known (semantic value) to evaluator (but secret to generator)

Evaluator Half-Gate Known (semantic value) to evaluator (but secret to generator)

Implementing Generator Half-Gates Generator knows a Evaluator Half-Gates Evaluator knows b But, we need a gate where both inputs are secret…

Half + Half = Full Secret Gate random bit selected by generator unknown known unknown “leaked”

Half + Half = Full Secret Gate random bit selected by generator unknown known unknown “leaked”

Half + Half = Full Secret Gate random bit selected by generator unknown known unknown “leaked”

Half + Half = Full Secret Gate random bit selected by generator unknown known unknown “leaked” 2 ciphertexts total! generator half gate evaluator half gate

How to leak r ⊕ b? Use r as point-and-permute bit for B (false) Evaluator has r ⊕ b on obtained wire! random bit selected by generator unknown known unknown “leaked” 2 ciphertexts total! generator half gate evaluator half gate

4 4+ 1 1+ 2 3 {0, 1, 2} FleXOR Basic Half-Gates Odd (AND) Even (XOR) Free XOR + GRR-1 + PnP FleXOR Half-Gates Odd (AND) Generator Encryptions (H) 4 4+ Evaluator Encryptions (H) 1 1+ 2 Ciphertexts Transmitted 3 Even (XOR) {0, 1, 2}

Edit distance: Levenstein distance between two 200-byte strings Zahur, Rosulek, and Evans [EuroCrypt 2015] Edit distance: Levenstein distance between two 200-byte strings AES: 1 block of encryption and key expansion, iterated 10 times Set intersection: 1024, 32-bit integers, iterated 10 times

4 1 2 3 ✓ 33% 25% 21% Free-XOR+GRR+PnP Half Gates Generator Encryptions (H) 4 Evaluator Encryptions (H) 1 2 Ciphertexts Transmitted 3 XORs Free ✓ Bandwidth 33% Execution Time (edit distance) 25% Energy 21%

Can we do better?

Optimality of Two Ciphertexts Theorem (proof in ZER15 paper): Garbling a single AND gate requires 2 ciphertexts if garbling scheme is “linear”. “linear” operations: xor, polynomial interpolation

How to Do Better? Non-linear operations Gates that are not binary – chunk-ing circuit Boolean logic Reusable ciphertexts Different security assumptions …

garbled circuit F Evaluate Y Garble Encode X Decode f e f(x) x d Security properties Privacy: F, X, and d leak reveals nothing beyond f(x) Obliviousness: F, X reveals nothing (new) Authenticity: given F, X, hard to find Y’ such that: Decode(Y’, d) ∉ { f(x), error }

Mike Rosulek, Samee Zahur David Evans evans@virginia.edu www.cs.virginia.edu/evans OblivC.org mightBeEvil.org Credits: Mike Rosulek, Samee Zahur

Not Used