[PPT] - Practical Secure Two-Party Computation and Applications Thomas PowerPoint Presentation

SLIDE 1

Practical Secure Two-Party Computation and Applications

Thomas Schneider Estonian Winter School in Computer Science 2016

SLIDE 2

Overview Lecture 1: Introduction to Secure Two-Party Computation Lecture 2: Private Set Intersection Lecture 3: Tools and Applications Lecture 4: Hardware-assisted Cryptographic Protocols

2

SLIDE 3

The Engineering Cryptographic Protocols Group (ENCRYPTO)

3

Info: http://encrypto.de Thomas  Schneider Daniel Demmler Ágnes Kiss Michael Zohner

SLIDE 4

Interested in Practical Secure Computation?

4

We have an open, fully funded position as Ph.D. Student / Research Assistant in Engineering Scalable Secure Computation http://encrypto.de/jobs

Darmstadt

30km south of FRA
150,000 inhabitants (5.8 Mio in Frankfurt/Rhine-Main Metro Area)
40,000 students

TU Darmstadt

Ranked #1 for IT security research in Germany (#5 in Europe)
Among Top 5 universiKes for computer science in Germany

SLIDE 5

Practical Secure Two-Party Computation and Applications

Lecture 1: Introduction Estonian Winter School in Computer Science 2016

SLIDE 6

The Web of Services

6

Our life moves into the web... ... and so does our data.

SLIDE 7

How were web services used yesterday?

7

“heart disease”

http://www.google.de attacker can eavesdrop 

r modify communication

heart disease

SLIDE 8

How should web services be used today?

8

“heart disease”

secure channel  protects communication  against external attackers

heart disease

https://www.google.de HTTPS per default since 01/2010 02/2011 11/2012

SLIDE 9

Data breaches happen every day...

9

June 2, 2011: Google attacked from China 

Computer hackers in China broke into the Gmail accounts of several hundred people, including senior US government officials, military personnel and political activists.

November 29, 2010: New WikiLeaks Publication 

WikiLeaks releases US State Department communiqués that offer an extraordinary look at the inner workings, and sharp elbows of diplomacy.

... from outsiders ... or insiders ... or malware.

October 16, 2012: Espionage Malware MiniFlame 

Kaspersky Labs discover that MiniFlame is most likely a targeted cyberweapon to conduct in-depth surveillance and cyber-espionage.

SLIDE 10

How could web services be used tomorrow?

10

heart disease encrypted query encrypted response

➪ Privacy-Preserving Web Services

httpp://www.google.de sensitive data remains encrypted

process  under  encryption

SLIDE 11

Privacy-Preserving Medical Diagnostics Services  give health recommendations without direct access to patient’s data. Privacy-Preserving Cloud Computing Services  allow to store and process data at untrusted service providers. Privacy-Preserving Face Recognition Services  detect criminals without allowing to trace honest citizens.

Vision: Privacy-Preserving Web Services

process sensitive data without any data leakage, e.g.,

11

SLIDE 12

Is this possible at all?

12

Andrew Chi-Chi Yao 1986:  Any efficiently computable function  can be evaluated securely.

➪ Secure Computation

SLIDE 13

Secure Two-Party Computation

13

All Lectures: Semi-Honest (Passive) Adversaries

f

f(x,y) x y

SLIDE 14

Secure Two-Party Computation

compute arbitrary function f
n private data x, y
without trusted third party
reveal nothing but result z = f(x,y)

14

Client C Server S private data x private data y z = f(x, y) public function f(·, ·)

Example: Yao’s Millionaires’ Problem

x = $2 Mio y = $1 Mio true

S2PC

Is C richer? x > y

SLIDE 15

DNA Searching [Troncoso-PastorizaKC07], ... Auctions [NaorPS99], ... Remote Diagnostics [BrickellPSW07], ... Biometric Identification [ErkinFGKLT09], ... Medical Diagnostics [BarniFKLSS09], ... Secure Two-Party Computation

15

SLIDE 16

Oblivious Transfer (OT)

16

1-out-of-2 OT is an essential building block for secure computation.

OT

(x0, x1) xr r

SLIDE 17

How to Measure Efficiency of a Protocol?

✓ Runtime (depends on implementation & scenario) ✓ Communication

# bits sent (important for networks with low bandwidth)
# rounds (important for networks with high latency)

? Computation

Usually: count # crypto operations, e.g.,
# modular exponentiations
# point multiplications
# hash function evaluations (SHA)
# block cipher evaluations (AES)
# One-Time Pad evaluations
But also non-cryptographic operations do matter!

17

faster

SLIDE 18

Overview of this lecture

18

Special Purpose Protocols Generic Protocols Arithmetic Circuit Boolean Circuit Homomorphic Encryption Symmetric Crypto Public Key Crypto GMW Yao OT  One-Time Pad >> >>

Part 1: Yao vs. GMW Part 2: Efficient OT Extensions

SLIDE 19

Part 1: Yao vs. GMW and Efficient Circuits

19

T. Schneider, M. Zohner:

GMW vs. Yao? Efficient secure two-party computation with low depth circuits. In FC’13.

SLIDE 20

Yao’s Garbled Circuits Protocol [Yao86]

20

Part 2: Efficient OT

Client C

Garbled

Circuit

C f(·, ·) e C e y f(x, y) = e C(e x, e y) Server S

Circuit

z . . .

xn

yn

x1

y1

y2
x2
c1
c2

Garbled Table

z . . . xn yn x1 y1 y2 x2

< < <

c1 c2

Garbled  Values

e.g., x < y private data x = x1, .., xn private data y = y1, .., yn (e x; ⊥) ← OT(x; (e x0, e x1))

Setup  Phase Online  Phase

e c0

1, e

c1

1

E(e x0

1, e

y0

1; e

cg(0,0)

1

) E(e x0

1, e

y1

1; e

cg(0,1)

1

) E(e x1

1, e

y0

1; e

cg(1,0)

1

) E(e x1

1, e

y1

1; e

cg(1,1)

1

)

SLIDE 21

Garbled Circuits [Yao86]

21

Garbled circuit

01 01 01 01 01

Conventional circuit

(Slide from Viet-Tung Hoang)

given input keys, can compute output key only keys look random

SLIDE 22

22

Garbled Gate [Yao86]

given two input keys, can compute only output key

(Slide from Viet-Tung Hoang)

A C D X Y B X X X Y

1 2 3

SLIDE 23

Overview of Efficient Garbled Circuit Constructions

23

(Slide from Payman Mohassel)

1990 Point-and-Permute [BeaverMicaliRogaway] 1999 3-row reduction [NaorPinkasSumner] 2008 Free-XOR [KolesnikovSchneider] 2009 2-row reduction [PinkasSchneiderSmartWilliams] 2012 Garbling via AES [KreuterShelatShen] 2013 Fixed-key AES [BellareHoangKeelveedhiRogaway] 2014 FleXor [KolesnikovMohasselRosulek] 2015 HalfGates [ZahurRosulekEvans]

SLIDE 24

Summary of Garbled Circuit Constructions

24

(Slide from Mike Rosulek)

size (× t) garble cost (AES) eval cost (AES) XOR AND XOR AND XOR AND Classical large 8 5 P&P 4 4 1 GRR3 3 4 1 Free XOR 3 4 1 HalfGates 2 4 2 t: symmetric security parameter, e.g., t=128

SLIDE 25

Summary: Yao - the Apple

How to eat an apple? bite-by-bite

25

+ Yao has constant #rounds

Evaluating a garbled gate requires

symmetric crypto in the online phase

SLIDE 26

a = a1 ⊕ a2

The GMW Protocol [GMW87]

26

Secret share inputs: Non-Interactive XOR gates: c1 = a1 ⊕ b1 ; c2 = a2 ⊕ b2 Interactive AND gates: Recombine outputs:

∧ ⊕ a b d c

AND

c1, b1 c2, b2 d1 d2

b = b1 ⊕ b2 d = d1 ⊕ d2

∧

SLIDE 27

AND

x1, y1 x2, y2 z1 z2

∧

Evaluating ANDs via Multiplication Triples [Beaver91]

27

Setup phase:  Generate multiplication triple (a1⊕a2) (b1⊕b2) = c1⊕c2 for each AND via 2 OTs: 1) P1: m0, m1 ∈R {0,1}; P2: a2 ∈R {0,1} 2) P1 and P2 run OT, where P1 inputs (m0, m1), P2 inputs a2 and gets u2=ma2 3) P1 sets b1 = m0 ⊕ m1; v1 = m0 4) P1 and P2 repeat steps 1-3 with reversed roles to obtain (a1, u1); (b2, v2) 5) Pi sets ci = (ai bi) ⊕ ui ⊕ vi Online phase:  P1 → P2: d1=x1⊕a1; e1=y1⊕b1 P1 ← P2: d2=x2⊕a2; e2=y2⊕b2 P1, P2: d=d1⊕d2; e=e1⊕e2 P1: z1=db1⊕ea1⊕c1⊕de P2: z2=db2⊕ea2⊕c2

Part 2: Efficient OTs

SLIDE 28

Summary: GMW - the Orange

How to eat an orange? 1) peel (almost all the effort)

28

2) eat (easy) Setup phase:

precompute multiplication triples for each AND

gate using 2 R-OTs and constant #rounds + no need to know function, only max. #ANDs Online phase: + evaluating circuit needs OTP operations only

2x2 bit communication per layer of AND gates

SLIDE 29

Benchmarks of an optimized GMW implementation [SZ13]

29

Runtime in seconds for 512-bit multiplication circuit (800k AND gates, depth 38) over Gigabit LAN.

SLIDE 30

Benchmarks of an optimized GMW implementation [SZ13]

30

Runtime in seconds for 512-bit multiplication circuit (800k AND gates, depth 38) over Gigabit LAN.

Interactive AND gates via Beaver’s multiplication triples 

[D. Beaver. Efficient multiparty protocols using circuit randomization. CRYPTO’91.]

setup phase: 1-out-of-4 OT

nline phase: 2 independent 2-bit messages (sent in parallel)

=> 1x network latency per layer of AND gates

SLIDE 31

Benchmarks of an optimized GMW implementation [SZ13]

31

Runtime in seconds for 512-bit multiplication circuit (800k AND gates, depth 38) over Gigabit LAN.

Use AES-based PRF for OT extensions (instead of SHA-1).

SLIDE 32

Benchmarks of an optimized GMW implementation [SZ13]

32

Runtime in seconds for 512-bit multiplication circuit (800k AND gates, depth 38) over Gigabit LAN.

Load Balancing:

Run half of the precomputed OTs in each direction (in parallel).
Run base OTs twice (in parallel).

=> Each party has exactly the same workload.

SLIDE 33

Benchmarks of an optimized GMW implementation [SZ13]

33

Runtime in seconds for 512-bit multiplication circuit (800k AND gates, depth 38) over Gigabit LAN.

Use GMP instead of NTL for base OTs.

SLIDE 34

Benchmarks of an optimized GMW implementation [SZ13]

34

Runtime in seconds for 512-bit multiplication circuit (800k AND gates, depth 38) over Gigabit LAN.

Process data in chunks of bytes (instead of bits).

SLIDE 35

Benchmarks of an optimized GMW implementation [SZ13]

35

Runtime in seconds for 512-bit multiplication circuit (800k AND gates, depth 38) over Gigabit LAN.

Use assembly implementation of OpenSSL for SHA-1  (instead of C implementation of PolarSSL).

SLIDE 36

Benchmarks of an optimized GMW implementation [SZ13]

36

Runtime in seconds for 512-bit multiplication circuit (800k AND gates, depth 38) over Gigabit LAN.

Single Instruction Multiple Data:  Evaluate multiple circuits in parallel (here 32). (inspired by Sharemind)

SLIDE 37

Remaining Bottlenecks in LAN Setting

37

0.8% 1.4% 98% 16% 47% 32% 3% 3% 37% 35% 7% 20% 1% 0.1% (Base OTs)

SLIDE 38

Yao vs. GMW

38

Yao GMW symmetric crypto per AND S: 4, R: 2 (online) setup: S: 6, R: 6 communication [bit] per AND S→R: 2t setup: S→R:t || R→S:t

nline: S→R:2 || R→S:2

memory per wire [bit] t 1 rounds O(1) setup: O(1) 

nline: O(ANDdepth(f))

t: symmetric security parameter

Free XOR

SLIDE 39

Efficient Circuit Constructions for Secure Computation

Circuits for secure computation:

low ANDsize (#non-XORs ⇒ communication and symmetric crypto)
low ANDdepth (#rounds in GMW’s online phase)

39

Classical circuit design:

few gates (⇒ small chip area)
low depth (⇒ high clock frequency)
E. M. Songhori, S. U. Hussain, A.-R. Sadeghi, T. Schneider, F. Koushanfar:

TinyGarble: Highly compressed and scalable sequential garbled circuits.  In IEEE S&P’15.

D. Demmler, G. Dessouky, F. Koushanfar, A.-R. Sadeghi, T. Schneider, 
S. Zeitouni: Automated Synthesis of Optimized Circuits for Secure Computation.

In ACM CCS’15.

Automatically generate optimized circuits from high-level descriptions:

SLIDE 40

Example Circuit: Addition

40

x` y` x1 y1 y2 x2 s`+1 s` s2 s1 . . .

+ + +

c2 c3 ADD

Ripple-Carry-Adder si = xi ⊕ yi ⊕ ci ci+1 = ((xi ⊕ yi) ∧ (xi ⊕ ci)) ⊕ xi [BoyarPeraltaPochuev00]  ANDsize = ℓ, ANDdepth = ℓ Ladner-Fischer-Adder [LF80] ANDsize = ℓ+1.25 ℓ log2(ℓ), ANDdepth = 1+2 log2(ℓ)

x

4 y 4

x

3 y 3

x

2 y 2

x

1 y 1

p

4,0

c

4,0

p

3,0

c

3,0

p

2,0

c

2,0

p

1,0

c

1,0

p

4,1

c

4,1

p

2,1

c

2,1

p

4,2

c

4,2

p

3,2

c

3,2

s

5

s

4

s

3

s

2

s

1

pi,0=xi⊕yi, ci,0=xi∧yi pi,j=pi,j-1∧pk,j-1 ci,j=(pi,j-1∧ck,j-1)∨ci,j-1

SLIDE 41

Example Circuits Summarized in [SchneiderZohner13]

41

Circuit Size S Depth D Addition Ripple-carry ADD/SUBℓ

RC

ℓ ℓ Ladner-Fischer ADDℓ

LF

1.25ℓ⌈log2 ℓ⌉ + ℓ 2⌈log2 ℓ⌉ + 1 LF subtraction SUBℓ

LF

1.25ℓ⌈log2 ℓ⌉ + 2ℓ 2⌈log2 ℓ⌉ + 2 Carry-save ADD(ℓ,3)

CSA

ℓ + S(ADDℓ) D(ADDℓ)+1 RC network ADD(ℓ,n)

RC

ℓn − ℓ + n − ⌈log2 n⌉ − 1 ⌈log2 n − 1⌉ + ℓ CSA network ADD(ℓ,n)

CSA

ℓn − 2ℓ + n − ⌈log2 n⌉ ⌈log2 n − 1⌉ +S(ADD

ℓ+⌈log2 n⌉ LF

) +D(ADD

ℓ+⌈log2 n⌉ LF

) Multiplication RCN school method MULℓ

RC

2ℓ2 − ℓ 2ℓ − 1 CSN school method MULℓ

CSN

2ℓ2 + 1.25ℓ⌈log2 ℓ⌉ − ℓ + 2 3⌈log2 ℓ⌉ + 4 RC squaring SQRℓ

RC

ℓ2 − ℓ 2ℓ − 3 LF squaring SQRℓ

LF

ℓ2 + 1.25ℓ⌈log2 ℓ⌉ − 1.5ℓ − 2 3⌈log2 ℓ⌉ + 3 Comparison Equality EQℓ ℓ − 1 ⌈log2 ℓ⌉ Sequential greater than GTℓ

S

ℓ ℓ D&C greater than GTℓ

DC

3ℓ − ⌈log2 ℓ⌉ − 2 ⌈log2 ℓ⌉ + 1 Selection Multiplexer MUXℓ ℓ 1

(ℓ,n) ℓ ℓ

Can trade-off larger size for better depth.

SLIDE 42

Part 2: Efficient OTs

42

G. Asharov, Y. Lindell, T. Schneider, M. Zohner:

More efficient oblivious transfer and extensions for faster secure computation. In ACM CCS’13. http://encrypto.de/code/OTExtension

SLIDE 43

Oblivious Transfer (OT)

43

1-out-of-2 OT is an essential building block for secure computation.

OT

(x0, x1) xr r

SLIDE 44

OT - Bad News

44

[ImpagliazzoRudich89]: there’s no black-box reduction from OT to OWFs 
Several OT protocols based on public-key cryptography
e.g., [NaorPinkas01] yields ~1,000 OTs per second
Since public-key crypto is expensive, OT was believed to be inefficient

SLIDE 45

A Public-Key Based OT Protocol: [NaorPinkas01]

45

input: x0, x1 input: b

utput: xb

Common input: G=<g> of prime order q t ∈R [0,q) C= gt C k ∈R [0,q) PKb = gk PK1-b = C/PKb PK0 PK1=C/PK0 r0, r1 ∈R [0,q) E0=<gr0, H((PK0)r0) ⊕ x0>  E1=<gr1, H((PK1)r1) ⊕ x1> E0, E1 Eb=<L, R> h=H(Lk)=H((PKb)rb) xb=h⊕R

SLIDE 46

OT - Good News

46

[Beaver95]: OTs can be precomputed (only OTP in online phase)
OT Extensions (similar to hybrid encryption):

use symmetric crypto to stretch few “real” OTs into longer/many OTs

[Beaver96]: OT on long strings from short seeds
[IshaiKilianNissimPetrank03]: many OTs from few OTs

[Beaver96] “real” OTs [IKNP03]

l-bit k-bit k OTs m OTs

SLIDE 47

OT Extension of [IKNP03] (1)

47

Alice inputs m pairs of ℓ-bit strings (xi,0 , xi,1)

Bob inputs m-bit string r and obtains xi,ri in i-th OT

SLIDE 48

OT Extension of [IKNP03] (2)

48

Alice and Bob perform k “real” OTs on random seeds with reverse roles

(k: security parameter)

SLIDE 49

OT Extension of [IKNP03] (3)

49

Bob generates a random m x k bit matrix T and masks his choices r
The matrix is masked with the stretched seeds of the “real” OTs

PRG: pseudo-random generator (instantiated with AES)

SLIDE 50

OT Extension of [IKNP03] (4)

50

H: correlation robust function (instantiated with hash function)

Transpose matrices V and T
Alice masks her inputs and obliviously sends them to Bob

SLIDE 51

10 % 42 % 14 % 33 % 1 %

"real" OTs H (SHA-1) PRG (AES) Transpose Misc (Snd/Rcv/XOR)

Computation Complexity of OT Extension

51

Time distribution for 10 Mio. OTs (in 21s):

Non-crypto part was bottleneck!!!

Per OT: # PRG evaluations # H evaluations 1 2 2 1

SLIDE 52

Algorithmic Optimization: Efficient Matrix Transposition

52

Naive matrix transposition performs mk load/process/store operations
[Eklundh72]’s algorithm reduces number of operations to O(m log2 k) swaps
Swap whole registers instead of bits
Transposing 10 times faster

SLIDE 53

Algorithmic Optimization: Parallelization

53

OT extension can easily be

parallelized by splitting the T matrix into sub-matrices

Since columns are independent,

OT is highly parallelizable

SLIDE 54

Communication Complexity of OT Extension

54

2ℓ Per OT: Bits sent

Yao: ℓ = k = 128 GMW: ℓ = 1, k = 128

Alice Bob Bob Alice

2k

SLIDE 55

Protocol Optimization: General OT Extension

55

Instead of generating a random T matrix, we derive it from sj,0

(similar to garbled 3-row reduction)

Reduces data sent by Bob by factor 2

SLIDE 56

Specific OT Functionalities

56

Secure computation protocols often require a specific OT functionality
Yao with free XORs requires strings x0, x1 to be XOR-correlated
GMW with multiplication triples can use random strings

Correlated OT Random OT

Correlated OT: random x0 and x1 = x0 ⊕ x
Random OT: random x0 and x1

e.g., for Yao e.g., for GMW

SLIDE 57

Choose xi,0 as random output of H (modeled as RO here),

similar to garbled 3-row reduction

Compute xi,1 as xi,0 ⊕ xi to obliviously transfer XOR-correlated values 
Reduces data sent by Alice by factor 2

Specific OT Functionalities: Correlated OT (C-OT)

57

SLIDE 58

Choose xi,0 and xi,1 as random outputs of H (modeled as RO here),

similar to garbled 3-row reduction 

No data sent by Alice

Specific OT Functionalities: Random OT (R-OT)

58

SLIDE 59

Runtime in s 10 20 30 40 Orig EMT G-OT C-OT R-OT 2T 4T 14,2 14,2 14,2 14,4 29,4 30,5 30,7 2,6 5,0 10,0 10,6 13,9 14,4 20,6 Gigabit LAN WiFi 802.11g

Performance Evaluation: Original Implementation

59

C++ implementation of [SZ13] implementing OT extension of [IKNP03]
Performance for 10 Mio. OTs on 80-bit strings

Performance for 10 Mio. OTs on 80-bit strings

SLIDE 60

Runtime in s 10 20 30 40 Orig EMT G-OT C-OT R-OT 2T 4T 14,2 14,2 14,2 14,4 29,4 30,5 30,7 2,6 5,0 10,0 10,6 13,9 14,4 20,6 Gigabit LAN WiFi 802.11g

Performance Evaluation: Efficient Matrix Transposition

60

Efficient matrix transposition – improves computation
Only decreases runtime in LAN where computation is the bottleneck

Performance for 10 Mio. OTs on 80-bit strings

SLIDE 61

Runtime in s 10 20 30 40 Orig EMT G-OT C-OT R-OT 2T 4T 14,2 14,2 14,2 14,4 29,4 30,5 30,7 2,6 5,0 10,0 10,6 13,9 14,4 20,6 Gigabit LAN WiFi 802.11g

Performance Evaluation: General OT

61

Generate T matrix from seeds – improves communication Bob → Alice
Runtimes only slightly faster (bottleneck: communication Alice → Bob)

Performance for 10 Mio. OTs on 80-bit strings

SLIDE 62

Runtime in s 10 20 30 40 Orig EMT G-OT C-OT R-OT 2T 4T 14,2 14,2 14,2 14,4 29,4 30,5 30,7 2,6 5,0 10,0 10,6 13,9 14,4 20,6 Gigabit LAN WiFi 802.11g

Performance Evaluation: Correlated/Random OT

62

Correlated/Random OT – improved communication Alice → Bob
WiFi runtime faster by factor 2 (bottleneck: communication Bob → Alice)

Performance for 10 Mio. OTs on 80-bit strings

SLIDE 63

Performance Evaluation: Parallelization

63

Parallel OT extension with 2 and 4 threads – improved computation
LAN runtime decreases linear in # of threads
WiFi runtime remains the same (bottleneck: communication)

Runtime in s 10 20 30 40 Orig EMT G-OT C-OT R-OT 2T 4T 14,2 14,2 14,2 14,4 29,4 30,5 30,7 2,6 5,0 10,0 10,6 13,9 14,4 20,6 Gigabit LAN WiFi 802.11g Performance for 10 Mio. OTs on 80-bit strings

SLIDE 64

Performance Evaluation: Summary

64

OT is very efficient
Communication is the bottleneck for OT (even without using AES-NI)

Performance for 10 Mio. OTs on 80-bit strings Runtime in s 10 20 30 40 Orig EMT G-OT C-OT R-OT 2T 4T 14,2 14,2 14,2 14,4 29,4 30,5 30,7 2,6 5,0 10,0 10,6 13,9 14,4 20,6 Gigabit LAN WiFi 802.11g

SLIDE 65

Summary

Part 1: Yao vs. GMW

can trade-off size for depth
Yao has constant #rounds ⇒ good for high-latency networks (Internet)
GMW can precompute all crypto, good for low-latency networks (LAN)

Part 2: OT extension

send 1 ciphertext + |payload|
communication is the bottleneck

65

Bottleneck of today’s secure computation protocols is communication.

SLIDE 66

EXERCISE 1

Measure speed of crypto operations with the   “openssl speed” command and order them according to throughput:

aes-128-cbc (block cipher)
dsa2048 (public-key crypto using modular exponentiation)
ecdsap256 (public-key crypto using point multiplication on elliptic

curve)

rsa2048 (public-key crypto using modexp in RSA group)
sha256 (hash function)

66

SLIDE 67

Literature

[ALSZ13] G. Asharov, Y. Lindell, T. Schneider, M. Zohner: More efficient oblivious transfer and extensions for faster secure computation. In ACM CCS’13. [BarniFKLSS09] M. Barni, P. Failla, V. Kolesnikov, R. Lazzeretti, A.-R. Sadeghi, T. Schneider: Secure Evaluation of Private Linear Branching Programs with Medical Applications. In ESORICS’09. [Beaver91] D. Beaver: Efficient multiparty protocols using circuit randomization. In CRYPTO’91. [Beaver95] D. Beaver: Precomputing oblivious transfer. In CRYPTO’95. [BrickellPSW07] J. Brickell, D. E. Porter, V. Shmatikov, E. Witchel. Privacy-preserving remote diagnostics. In ACM CCS’07. [DDKSSZ15] D. Demmler, G. Dessouky, F. Koushanfar, A.-R. Sadeghi, T. Schneider, 

S. Zeitouni: Automated Synthesis of Optimized Circuits for Secure Computation. In ACM CCS’15.

[CHKMR12] S. G. Choi, K.-W. Hwang, J. Katz, T. Malkin, D. Rubinstein: Secure multi-party computation of Boolean circuits with applications to privacy in on-line marketplaces. In CT-RSA’12. [Eklundh72] J. O. Eklundh. A fast computer method for matrix transposing. In IEEE Transactions on Computers, 1972. [ErkinFGKLT09] Z. Erkin, M. Franz, J. Guajardo, S. Katzenbeisser, I. Lagendijk, T. Toft: Privacy-preserving face

recognition. In PETS’09.

[GMW87] O. Goldreich, S. Micali, A. Wigderson: How to play any mental game or a completeness theorem for protocols with honest majority. In STOC’87. [IKNP03] Y. Ishai, J. Kilian, K. Nissim, E. Petrank: Extending oblivious transfers efficiently. In CRYPTO’03. [ImpagliazzoRudich89] R. Impagliazzo, S. Rudich. Limits on the provable consequences of one-way permutations. In STOC’89. [NaorPinkas01] M. Naor, B. Pinkas: Efficient oblivious transfer protocols. In SODA’01. [NaorPS99] M. Naor, B. Pinkas, R. Sumner: Privacy preserving auctions and mechanism design. In EC’99. [SHSSK15] E. M. Songhori, S. U. Hussain, A.-R. Sadeghi, T. Schneider, F. Koushanfar: TinyGarble: Highly compressed and scalable sequential garbled circuits. In IEEE S&P’15. [SZ13] T. Schneider, M. Zohner: GMW vs. Yao? Efficient secure two-party computation with low depth circuits. In FC’13.  [Troncoso-PastorizaKC07] J. R. Troncoso-Pasoriza, S. Katzenbeisser, M. U. Celik: Privacy preserving error resilient DNA searching through oblivious automata. In ACM CCS’07. [Yao86] A. C. Yao. How to generate and exchange secrets. In FOCS’86.

67