Ad Adapti tive e Garb rbled ed Ci Circuits ts with th Near - - PowerPoint PPT Presentation

Ad Adapti tive e Garb rbled ed Ci Circuits ts with th Ne Near Op Optima mal On Online C Comp mplexi xity

Sanjam Garg Akshayaram Srinivasan

University of California, Berkeley

Eurocrypt 2018

Garbled Circuits

[Yao 86, Applebaum-Ishai-Kushilevitz 04, Bellare-Hoang-Rogaway 12]

! " ! GarbleCkt + + # GarbleInp # $ ! " + # $ Eval !(#)

Security

!, #

• Toss a coin (
• If ( = 0:
• Generate !

", # $ honestly.

• Else:
• Generate !

", # $ as the

• utput of )*+(!(#)).

! ", # $

Selective: Adaptive:

!

• Toss a coin (
• If ( = 0:
• Generate !

" honestly.

• Generate #

$ honestly.

• Else:
• Generate !

" as the output

• f )*+(1|/|).
• Generate #

$ as the output

• f )*+ ! #

.

! " Guess ( # # $ Guess (

Offline Online

Why is Adaptive security important?

[Bellare-Hoang-Rogaway 12]

Online/Offline 2PC

[Lindell-Ben Riva 14]

One-Time Programs

[Goldwasser-Kalai-Rothblum 08]

Verifiable Computation

[Gennaro-Gentry-Parno 10]

Adaptive, Compact FE

[Ananth-Sahai 16]

Efficiency of these applications depend

• n the online

complexity

Prior Work

• 1. Random Oracle Model [BHR12]
• 2. Incur an exponential loss in security [BGG+14]
• 3. Online cost grows with circuit width or depth

[HJOSW16,JW16,JKKKPW17] Lower Bound: Applebaum et al. showed that online cost must ≥ 2 + +. Can we construct adaptive garbling scheme with better online complexity?

Our Result

Theorem: Assuming either CDH/Factoring/LWE, there exists a construction of adaptive garbled circuits with:

• Near Optimal Online Cost: 2 + + + 4567(8)
• Polynomial security loss
• Standard Model

Construction

Alternate View of a Boolean Circuit

9: 9; 9< #: #; #< #: #; #< )!: )!; )!< 9: 9; 9<

Garbling the Database – Use a One-time Pad

#: ⊕ >

:

)!: >

:, > ;, > ?

)!; >

;, > <, > @

)!< >

?, > @, > A

#; ⊕ >

; #< ⊕ > < 9: ⊕ > ?

9; ⊕ >

@ 9< ⊕ > A

Garbling Step Circuits

#: ⊕ >

:

)!: B >

:, > ;, > ?

)!; B >

;, > <, > @

)!< B >

?, > @, > A

#; ⊕ >

; #< ⊕ > <

Access the database via Laconic OT

Updatable Laconic Oblivious Transfer

[Cho-Dottling-Garg-Gupta-Miao-Polychroniadou 17]

CDEℎ Database D ℎ GHDI(ℎ, *, +J, +:) K>*LH(ℎ, *, () MN ℎ′ +P[R] ≔ UVD6GHDI(W, MN) Theorem[CDG+16,DG17,BLSV18,DGHM18]: Assuming CDH/Factoring/LWE, there exists a construction of updatable laconic OT.

Using Laconic OT to access the database

#: ⊕ >

:

)!: B >

:, > ;, > ?

#; ⊕ >

; #< ⊕ > <

ℎ′ GHDI 9: ⊕ >

?

ℎ )!; B >

;, > <, > @

K>*LH

Garbling Step Circuits

#: ⊕ >

:

)!: B >

:, > ;, > ?

)!; B >

;, > <, > @

)!< B >

?, > @, > A

#; ⊕ >

; #< ⊕ > <

Access the database via Laconic OT

# $ = (#:⊕ >

:, #; ⊕ > ;, #< ⊕ > <, > A, {6D(R,bc}) ! "

Adaptive Security Proof

Simulated Distribution

>

:

)!:′ B >

?

)!; B ′ >

@

)!< B ′ >

A

>

;

>

<

>

?

>

@

>

A

Hybrid Argument

Real World: Ideal World: Hyb 1: Hyb 2: Hyb 3: . . .

Going from Real World to Hyb 1

Real World: Hyb 1: Intermediate:

Some More Details about the Proof

• How to garble a step circuit in the “brown” mode in the offline

phase?

• Guess the output of these gates!
• Logarithmic number of step circuits in “brown” mode.
• A combinatorial pebbling argument. (See our paper)
• Optimal strategy for a pebbling game => Sequence of hybrids

Conclusion

• We gave a construction of adaptive garbled circuits with near optimal
• nline complexity from standard cryptographic assumptions.
• In a follow-up work [Garg-Ostrovsky-S], we give a construction of

adaptive garbled RAM with near optimal online complexity under the same assumptions.

• Open questions:
• Improving the assumptions?
• Concrete efficiency?

Th Than ank you

• u!