1. Gate Evaluation Secret Sharing and Secure Two-Party Computation
Vladimir Kolesnikov
University of Toronto

2. Secure Function Evaluation
One-Round
f: D1 £ D2  D3
Input: y 2 D2
Input: x 2 D1 …
f(x,y)
f(x,y) ?

3. SFE Models Semi-honest Malicious Both players follow the protocol
Observe communication, try to learn additional info
Malicious
Players can freely cheat
Solutions can be obtained by “compilation” of a semi-honest protocol

4. Approaches to SFE SFE for specific functions
Greater Than, Auctions, Voting
SFE for arbitrary functions
Functions given as a circuit, branching program, etc.
This work: SFE of any boolean formula

5. Oblivious Transfer (OT)
Input: secrets s0, s1
Input: b sb
Learn:
Learn: nothing

6. Reduction of SFE to OT OT is a fundamental primitive
Rabin ’81, Kilian ‘88
Unconditional reductions are possible
OT is implementable under a variety of computational and physical assumptions

7. Previous Work Yao’s Garbled circuit Sander, Young and Yung ’99
Kilian ’88 + Cleve ’90 (also CFIK ’03)
Based on Permutation Branching Programs
Ishai and Kushilevitz ’00, ’02
Based on Branching Programs

8. Secure Gate Evaluation
x 2 {0,1}
y 2 {0,1}
G(x,y) ?
s0’,s0’’  G(0,0)
s0’,s1’’  G(0,1)
s1’,s0’’  G(1,0)
s1’,s1’’  G(1,1)
sy’’
OT (x, (s0’,s1’))
sx’,sy’’
G(x,y) ?

9. Composition Gate Evaluation Secret Sharing (GESS) s00 s01 s10 s11… …
x 2 {0,1}
y 2 {0,1} …
s03,s04  s’G1(0,0) s00
s03,s14  s’G1(0,1) s01
s13,s04  s’G1(1,0) s10
s13,s14  s’G1(1,1) s11 I
s00 s01 s10 s11
Gate Evaluation Secret Sharing (GESS)

10. GESS for Gates with Binary Inputs
Wire 1
Wire 2
Output wire
s00 b R0
R0 © s00
R1 © s10
s01
s10 1 R1
R0 © s01
R1 © s11 :b
s11
Permute if b=1
b 2R {0,1}
Reconstruction:
(c r, r0 r1)  r © rc
Exponential growth with depth 
For OR and AND gates either left or right columns of wire 2 are equal!

11. GESS for AND/OR gates
Key: view secrets as being equal, except for one column of blocks.
share column-wise. 
(1)
(2)
(4)
(1)
(3)
(4)
n blocks of size k
example: n = 3
 2R ( {1..n+1}  {1..n+1})
Shares have the same block equality properties

12. GESS Performance Given a boolean formula F Previous best
Cost ¼  di2 ( di – depth of leaf i)
F is balanced  quazilinear in |F|
Rebalance F to log depth (Bonet-Buss, Spira)
Previous best
exponential in depth directly for circuits
quadratic in |F| via Branching Programs

13. GESS Performance Cost of SFE of boolean NC1 circuit of depth d
This work O(2d d2)
Previous best (2d 2d1/2)
(Kilian-Cleve, Cramer-Fehr-Ishai-Kushilevitz ‘03)

14. Other results Lower Bounds New Efficient Protocol for GT
Generalization of Yao’s Garbled Circuit

15. Lower Bounds When secrets are independent H(Ai) + H(Bj) ¸ 3 H(S)
Wire 1
Wire 2
Output wire
S00 A0 B0
S01 1
S10 A1 B1
S11
When secrets are independent
H(Ai) + H(Bj) ¸ 3 H(S)