GARBLED CIRCUITS & SECURE TWO-PARTY COMPUTATION Payman Mohassel Yahoo Labs

History of Garbled Circuits 1982: First oral presentation  [Andrew Yao] 1987: First written account  [GMW] (public-key) 1990: First use of term ``Garbled circuits”  [BMR] (symmetric-key) 1994: First abstraction as a primitive  [FKN] (minimal model for sec. comp.) 1999: First PRF-based construction  [NPS] (PP-auctions) 2004: First implementation  [MNPS] (Fairplay) 2004: First proof of 2PC based on garbled circuits  [LP] (double-encryption)

Eval( ) 𝐺𝐶 𝐺𝐼𝑥 𝐺𝐼𝑦 A Garbling Scheme 𝒚 𝒙 𝒇(𝒙,𝒚) seed 𝐶 𝑥,𝑦 =𝑓(𝑥,𝑦) 𝑇𝑇 𝐺 𝐼 𝑥 𝐺𝑂 Eval( ) 𝐺 𝐼 𝑦 𝑇𝑇 𝐺𝑂 𝒇(𝒙,𝒚)

Basic Properties Privacy: Knowing 𝐺 𝐼 𝑥 , 𝐺 𝐼 𝑦 , and 𝐺𝐶 does no leak any info Output Authenticity: Cannot compute another valid output 𝐺𝐶 𝐺𝐶 𝑇𝑇 𝐺 𝐼 𝑥 𝐺 𝐼 𝑥 𝒇(𝒙,𝒚) 𝐺 𝐼 𝑦 𝐺 𝐼 𝑦 𝐺𝐶 𝐺 𝐼 𝑥 𝐺𝑂‘ 𝐺 𝐼 𝑦

Many Applications Emerged as a powerful building block! Secure multi-party computation Zero-knowledge proofs Verifiable computation Homomorphic encryption One-time programs Circular-secure encryption Functional encryption ... Emerged as a powerful building block!

Secure Multiparty Computation (MPC) Correctness: honest parties learn the correct output Privacy: Nothing but the final output is leaked Fairness, Output Delivery, … P2, x2 P1, x1 P3, x3 P4, x4 P5, x5 Parties learn only f(x1,…,xn)

Applications of MPC Data mining Electronic Voting Auctions Exchanges/financial analysis Location privacy Genomic computation Electronic commerce Healthcare When there is IP, NDA, user consent involved When you need to distribute trust

Secure Two-Party Computation (2PC) 𝐶 𝑥,𝑦 =𝑓(𝑥,𝑦) 𝐺𝐶←𝐺𝑎𝑟𝑏(𝐶,𝑠𝑑) 𝐺 𝐼 𝑥 𝐺𝐶 𝑇𝑇 𝐺 𝐼 𝑥 ←𝐺𝐼𝑛(𝑥,𝑠𝑑) 𝒙 𝒚 Garbler Evaluator 𝐺 𝐼 𝑦 Oblivious Transfer 𝒇(𝒙,𝒚)

Yao’s Garbled Circuit Protocol First secure computation protocol Efficient and simple Implementations Fairplay, 2004 TASTY, 2010 FastGarble, 2011 SCAPI, 2013 JustGarble, 2013 … Circuits with millions of gates in less than a second

Research Directions Garbling Constructions Secure 2PC Functionality & Security Properties Secure 2PC

Basic Garbling/Evaluation Evaluate Garble 𝑘 0 1 , 𝑘 1 1   AND 𝑘 0 3 , 𝑘 1 3 AND   𝑘 0 2 , 𝑘 1 2   𝑐 0,0 =𝐸 𝑘 0 1 , 𝑘 0 2 ( 𝑘 0 3 ) 𝑐 0,1 =𝐸 𝑘 0 1 , 𝑘 1 2 ( 𝑘 0 3 ) 𝐷𝑒 𝑐 𝑘 𝑎 1 , 𝑘 𝑏 2 𝑐 𝑎,𝑏 = 𝑘 𝑎&𝑏 3 𝑐 1,0 =𝐸 𝑘 1 1 , 𝑘 0 2 ( 𝑘 0 3 ) 𝑐 1,1 =𝐸 𝑘 1 1 , 𝑘 1 2 ( 𝑘 1 3 )

Constructions (Efficiency) 1990: Point-and-Permute  [BMR] 1999: 3-row reduction  [NPS] 2008: Free-XOR  [KS] 2009: 2-row reduction  [PSSW] 2013: Fixed-key block-cipher  [BHKR] 2014: FleXor  [KMR] 2014: Privacy-free garbling  [KNO] 2015: HalfGates  [ZRE] (2-row non-XORs, and 0-row XORs) How low can we get? Lower bounds? Fresh ideas for garbling needed?

Constructions (Security) Weak Assumptions PRF  double-encryption LPN  Free-XOR Correlation-robustness  row reduction techniques Correlation-robustness  FleXor Strong Assumptions Circular-security  Free-XOR Circular-security  Half-Gates Ideal-permutation  Fixed-key block-cipher RO  Adaptive security Can we achieve these using weak assumptions?

Standard Security Properties Input privacy Needed in most applications (not in ZK application) Function privacy Private function evaluation Output authentication Malicious 2PC, dual-execution, verifiable comp., server-aided comp., ZK Adaptive privacy Verifiable comp, offline/online batch execution, …

New Security Properties? Only a subset of properties (e.g. privacy-free garbling) Leaky privacy (e.g. leak a few bits, protect/leak certain functions) Tunable security! (tunable privacy, authenticity, …) Leveled privacy (inputs with different sensitivity levels)

Functionality? Standard ones Garble, encode inputs, evaluate, authenticate outputs Circuit property enforcing (with Rosulek and Kolesnikov) Checking circuit properties Topology, depth, input size, gate types Useful in limiting malicious behavior Input property enforcing Unique input identifier (for input consistency) Enforcing input formats Enforce relation between inputs in multiple executions (beyond equality) Output property enforcing Enforcing output format

⋮ 𝑃 1 Malicious 2PC 𝒙 Open Evaluate Majority 𝐺 𝐶 1 𝑥 𝐺 𝐶 1 𝑥 𝐺 𝐶 2 Are all inputs the same? Open Evaluate Majority 𝐺 𝐶 1 𝑥 𝐺 𝐶 1 𝑥 𝐺 𝐶 2 𝐺 𝐶 2 𝑧 2 𝒙 𝐺 𝐶 3 𝐺 𝐶 3 1−2 −Ω 𝑠 𝑠𝑒𝑐𝑢𝑟𝑖𝑡𝑦 𝑠≥40 ⋮ 𝑃 1 𝐺 𝐶 4 𝑧 4 𝐺 𝐶 4 𝑧=𝑓(𝑥,𝑦) 𝐺 𝐶 5 𝐺 𝐶 5 𝐺 𝐶 6 𝑧 6 𝑥 𝐺 𝐶 6 Is the output correct? 𝑧

Secure 2PC Malicious security RAM programs 2PC with relaxed security Cut-and-choose (state of the art: Lindell 2013) Abstracting out cut-and-choose (joint work with Seny Kamara) A new paradigm? Lower bounds for cut-and-choose? RAM programs Optimizing ORAM for 2PC ([WCS]: Circuit-ORAMs) Implementation framework (SCVM) Extending cut-and-choose to RAM programs ([AHMR]) Lots of interesting questions 2PC with relaxed security Covert security, leaky 2PC, one-sided security Restricting leakage functions

Questions?