. Vladimir Kolesnikov . . Payman Mohassel Mike Rosulek . - PowerPoint PPT Presentation

fle XOR : flexible garbling for XOR gates that beats free- XOR . � Vladimir Kolesnikov ≫ . . Payman Mohassel ≫ � Mike Rosulek ≫ ◮ . .

background 1 . . .

Enc A C B Enc A C B Enc A C B Enc A C B . background: garbled circuit . false: A 0 true: A 1 . . . false: C 0 true: C 1 false: B 0 true: B 1 . .

background: garbled circuit . Enc A 0 , B 0 ( C 0 ) Enc A 0 , B 1 ( C 1 ) Enc A 1 , B 0 ( C 1 ) Enc A 1 , B 1 ( C 0 ) false: A 0 true: A 1 . . . . false: C 0 true: C 1 false: B 0 true: B 1 . .

background: garbled circuit . Enc A 0 , B 0 ( C 0 ) Enc A 0 , B 1 ( C 1 ) Enc A 1 , B 0 ( C 1 ) Enc A 1 , B 1 ( C 0 ) false: A 0 true: A 1 . . . . false: C 0 true: C 1 false: B 0 true: B 1 . .

background: row reduction . . .

n C Dec A B . Fix one of the ciphertexts to be all zeroes n , not uniform Corresponding wire label must be Dec Only 3 ciphertexts needed for garbled gate More advanced technique reduces size to 2 ciphertexts background: row reduction Enc A 0 , B 0 ( C 0 ) Enc A 0 , B 1 ( C 0 ) Enc A 1 , B 0 ( C 0 ) Enc A 1 , B 1 ( C 1 ) false: A 0 . true: A 1 . . . . false: C 0 true: C 1 false: B 0 true: B 1 . Garbled row reduction [NaorPinkasSumner99,PinkasSchneiderSmartWilliams09] . . . .

n C Dec A B . n , not uniform Corresponding wire label must be Dec Only 3 ciphertexts needed for garbled gate More advanced technique reduces size to 2 ciphertexts background: row reduction Enc A 0 , B 0 ( C 0 ) 0 n Enc A 0 , B 1 ( C 0 ) Enc A 1 , B 0 ( C 0 ) Enc A 1 , B 1 ( C 1 ) false: A 0 . true: A 1 . . . . false: C 0 true: C 1 false: B 0 true: B 1 . Garbled row reduction [NaorPinkasSumner99,PinkasSchneiderSmartWilliams09] . ◮ Fix one of the ciphertexts to be all zeroes . . .

Only 3 ciphertexts needed for garbled gate More advanced technique reduces size to 2 ciphertexts background: row reduction Enc A 0 , B 0 ( C 0 ) 0 n C 0 := Dec A 0 , B 0 (0 n ) Enc A 0 , B 1 ( C 0 ) Enc A 1 , B 0 ( C 0 ) Enc A 1 , B 1 ( C 1 ) false: A 0 . true: A 1 . . . . . false: C 0 true: C 1 false: B 0 true: B 1 . Garbled row reduction [NaorPinkasSumner99,PinkasSchneiderSmartWilliams09] . ◮ Fix one of the ciphertexts to be all zeroes ◮ Corresponding wire label must be Dec (0 n ) , not uniform . . .

background: row reduction Enc A 0 , B 1 ( C 0 ) C 0 := Dec A 0 , B 0 (0 n ) Enc A 1 , B 0 ( C 0 ) Enc A 1 , B 1 ( C 1 ) false: A 0 . true: A 1 . . . . . . false: C 0 true: C 1 false: B 0 true: B 1 . Garbled row reduction [NaorPinkasSumner99,PinkasSchneiderSmartWilliams09] . ◮ Fix one of the ciphertexts to be all zeroes ◮ Corresponding wire label must be Dec (0 n ) , not uniform ◮ Only 3 ciphertexts needed for garbled gate ◮ More advanced technique reduces size to 2 ciphertexts . . .

background: offsets & free XOR . . .

all wires have same (secret) offset wire labels for XOR gate satisfy C A B compute output wire label by XOR’ing input wire labels (no crypto!) . Free XOR optimization [KolesnikovSchneider08] : . . background: offsets & free XOR false: A 0 true: A 1 offset: A 0 ⊕ A 1 false: C 0 . . . . true: C 1 offset: C 0 ⊕ C 1 false: B 0 . true: B 1 offset: B 0 ⊕ B 1 . Definition . Offset of a wire = XOR of its two wire labels . . .

all wires have same (secret) offset wire labels for XOR gate satisfy C A B compute output wire label by XOR’ing input wire labels (no crypto!) . Free XOR optimization [KolesnikovSchneider08] : . . background: offsets & free XOR false: A true: A ⊕ ∆ A offset: ∆ A false: C . . . . true: C ⊕ ∆ C offset: ∆ C false: B . true: B ⊕ ∆ B offset: ∆ B . Definition . Offset of a wire = XOR of its two wire labels . . .

wire labels for XOR gate satisfy C A B compute output wire label by XOR’ing input wire labels (no crypto!) background: offsets & free XOR false: A true: A ⊕ ∆ offset: ∆ false: C . . . . true: C ⊕ ∆ offset: ∆ false: B . true: B ⊕ ∆ offset: ∆ . Definition . Offset of a wire = XOR of its two wire labels . . Free XOR optimization [KolesnikovSchneider08] : . ◮ all wires have same (secret) offset ∆ . . .

compute output wire label by XOR’ing input wire labels (no crypto!) background: offsets & free XOR false: A true: A ⊕ ∆ offset: ∆ false: A ⊕ B . . . . true: A ⊕ B ⊕ ∆ offset: ∆ false: B . true: B ⊕ ∆ offset: ∆ . Definition . Offset of a wire = XOR of its two wire labels . . Free XOR optimization [KolesnikovSchneider08] : . ◮ all wires have same (secret) offset ∆ ◮ wire labels for XOR gate satisfy C = A ⊕ B . . .

background: offsets & free XOR false: A true: A ⊕ ∆ offset: ∆ false: A ⊕ B . . . . true: A ⊕ B ⊕ ∆ offset: ∆ false: B . true: B ⊕ ∆ offset: ∆ . Definition . Offset of a wire = XOR of its two wire labels . . Free XOR optimization [KolesnikovSchneider08] : . ◮ all wires have same (secret) offset ∆ ◮ wire labels for XOR gate satisfy C = A ⊕ B ◮ compute output wire label by XOR’ing input wire labels (no crypto!) . . .

Hint: yes! . Motivating Question . Can we overcome these limitations, while retaining Free XOR’s benefits (as much as possible)? . free XOR . Free XOR limitations: . . 1. Requires strong circularity hardness assumption [ChoiKatzKumaresanZhou12] 2. Incompatible with 4-to-2 row reduction [PinkasSchneiderSmartWilliams09] . . .

Hint: yes! free XOR . Free XOR limitations: . . 1. Requires strong circularity hardness assumption [ChoiKatzKumaresanZhou12] 2. Incompatible with 4-to-2 row reduction [PinkasSchneiderSmartWilliams09] . . Motivating Question . Can we overcome these limitations, while retaining Free XOR’s benefits (as much as possible)? . . .

free XOR . Free XOR limitations: . . 1. Requires strong circularity hardness assumption [ChoiKatzKumaresanZhou12] 2. Incompatible with 4-to-2 row reduction [PinkasSchneiderSmartWilliams09] . . Motivating Question . Can we overcome these limitations, while retaining Free XOR’s benefits (as much as possible)? Hint: yes! . . .

fleXOR garbling 2 . . .

: each “adjustment” requires 1 ciphertext Enc A A n A A A Dec A Enc A A A C . . . . . Enc B B n B Dec B Enc B B B C , then use free XOR apply row reduction if C , no need to “adjust” first wire at all! A garble XOR gate using 0, 1, or 2 ciphertexts depending on how many of are distinct A B C fleXOR garbling false: A true: A ⊕ ∆ A offset: ∆ A false: . . . . true: . false: B offset: ∆ C true: B ⊕ ∆ B offset: ∆ B . Flexible XOR (fleXOR) technique [this work] : . ◮ “adjust” offsets of both input wires to ∆ C . . .

: each “adjustment” requires 1 ciphertext Enc A A n A A A Dec A Enc A A A C . . . . . Enc B B n B Dec B Enc B B B C , then use free XOR apply row reduction if C , no need to “adjust” first wire at all! A garble XOR gate using 0, 1, or 2 ciphertexts depending on how many of are distinct A B C fleXOR garbling false: A false: A ∗ A ∗ ⊕ ∆ C ?? true: A ⊕ ∆ A true: offset: ∆ A offset: ∆ C false: . . . . . . . . true: . false: B false: B ∗ offset: ∆ C B ∗ ⊕ ∆ C ?? true: B ⊕ ∆ B true: offset: ∆ B offset: ∆ C . Flexible XOR (fleXOR) technique [this work] : . ◮ “adjust” offsets of both input wires to ∆ C . . .

: each “adjustment” requires 1 ciphertext Enc A A n A A Dec A A Enc A A A C . . . . . Enc B B n B Dec B Enc B B B C apply row reduction if C , no need to “adjust” first wire at all! A garble XOR gate using 0, 1, or 2 ciphertexts depending on how many of are distinct A B C fleXOR garbling false: A false: A ∗ A ∗ ⊕ ∆ C ?? true: A ⊕ ∆ A true: A ∗ ⊕ B ∗ offset: ∆ A offset: ∆ C false: . . . . . . . . A ∗ ⊕ B ∗ ⊕ ∆ C true: . false: B false: B ∗ offset: ∆ C B ∗ ⊕ ∆ C ?? true: B ⊕ ∆ B true: offset: ∆ B offset: ∆ C . Flexible XOR (fleXOR) technique [this work] : . ◮ “adjust” offsets of both input wires to ∆ C , then use free XOR . . .

: each “adjustment” requires 1 ciphertext n A A Dec A A . . . . Enc B B n B Dec B Enc B B B C apply row reduction if C , no need to “adjust” first wire at all! A garble XOR gate using 0, 1, or 2 ciphertexts depending on how many of are distinct A B C fleXOR garbling Enc A ( A ∗ ) Enc A ⊕ ∆ A ( A ∗ ⊕ ∆ C ) false: A false: A ∗ A ∗ ⊕ ∆ C true: A ⊕ ∆ A true: A ∗ ⊕ B ∗ offset: ∆ A offset: ∆ C false: . . . . . . . A ∗ ⊕ B ∗ ⊕ ∆ C true: . false: B false: B ∗ offset: ∆ C B ∗ ⊕ ∆ C true: B ⊕ ∆ B true: offset: ∆ B offset: ∆ C . Flexible XOR (fleXOR) technique [this work] : . ◮ “adjust” offsets of both input wires to ∆ C , then use free XOR . . .