Improved Garbled Circuit: Free XOR Gates and Applications

Kolesnikov, Vladimir; Schneider, Thomas

doi:10.1007/978-3-540-70583-3_40

Cited by 526 publications

(455 citation statements)

References 27 publications

(50 reference statements)

Supporting

Mentioning

454

Contrasting

Order By: Relevance

“…This approach asymptotically improves the solutions in [20,17], and only requires inexpensive operations in contrast to the solution of [26]. Second, we observe that the solution of [17] to the evaluator's input consistency issue can be improved by combining it with the OT extension of [21] and the Free-XOR technique of [14]. The resulting protocol requires only O(t · max(4n 2 , 8t)) inexpensive operations.…”

Section: Our Contributionsmentioning

confidence: 80%

“…We remark that our proposed solutions can be modified to work with any of the existing garbled-circuit optimization techniques of [14,5,25,6,15].…”

Section: Our Contributionsmentioning

confidence: 99%

“…Consistency of the evaluator's input is taken care of by combining the technique of [17] with the OTextension of [21] and the Free-XOR technique [14]. In a nutshell, P 2 's input is encoded using max(4n 2 , 8t) bits in a way that any leakage of less than t of the bits does not reveal meaningful information about P 2 's input.…”

Section: An Efficient 2pc For Two-output Functions With Full Securitymentioning

confidence: 99%

“…(The above description is an adaptation of the technique of [17] with the Free-XOR technique of [14], although the original protocol is the same but with garbled gates that compute the xor of the strings. )…”

Section: B3 the Technique Of [17]mentioning

confidence: 99%

“…Furthermore, recent results show how to improve both the computation and communication cost of the garbling process (e.g., getting XOR gates for free [14], reducing communication [5,25], and designing tailored circuits [6]). …”

Section: Introductionmentioning

confidence: 99%

See 4 more Smart Citations

Garbled Circuits Checking Garbled Circuits: More Efficient and Secure Two-Party Computation

Mohassel

Riva

2013

Advances in Cryptology – CRYPTO 2013

View full text Add to dashboard Cite

Applying cut-and-choose techniques to Yao's garbled circuit protocol has been a promising approach for designing efficient Two-Party Computation (2PC) with malicious and covert security, as is evident from various optimizations and software implementations in the recent years. We revisit the security and efficiency properties of this popular approach and propose alternative constructions and a new definition that are more suitable for use in practice.• We design an efficient fully-secure 2PC protocol for two-output functions that only requires O(t|C|) symmetric-key operations (with small constant factors, and ignoring factors that are independent of the circuit in use) in the Random Oracle Model, where |C| is the circuit size and t is a statistical security parameter. This is essentially the optimal complexity for protocols based on cut-and-choose, resolving a main question left open by the previous work on the subject. Our protocol utilizes novel techniques for enforcing garbler's input consistency and handling twooutput functions that are more efficient than all prior solutions.• Motivated by the goal of eliminating the all-or-nothing nature of 2PC with covert security (that privacy and correctness are fully compromised if the adversary is not caught in the challenge phase), we propose a new security definition for 2PC that strengthens the guarantees provided by the standard covert model, and offers a smoother security vs. efficiency tradeoff to protocol designers in choosing the right deterrence factor. In our new notion, correctness is always guaranteed, privacy is fully guaranteed with probability (1 − ), and with probability (i.e. the event of undetected cheating), privacy is only "partially compromised" with at most a single bit of information leaked, in case of an abort. We present two efficient 2PC constructions achieving our new notion. Both protocols are competitive with the previous covert 2PC protocols based on cut-and-choose.A distinct feature of the techniques we use in all our constructions is to check consistency of inputs and outputs using new gadgets that are themselves garbled circuits, and to verify validity of these gadgets using multi-stage cut-and-choose openings.

show abstract