New Ways to Garble Circuits

Abstract

A garbling scheme transforms a circuit C into a garbled circuit C-hat, along with a pair of short keys (k^(i)_0 , k^(i)_1) for each input bit x[i], such that the program, garbled program and input keys (C, C-hat, {k^(i)_x[i]}) can be used to recover the output z = C(x) while revealing nothing else about the input x. A main objective in the research of garbling schemes is reducing the size of the garbling material (C-hat, {k^(i)_x[i]}). On the one hand, theoretical schemes using the heavy tools of attribute-based encryption (ABE) and fully homomorphic encryption (FHE), or indistinguishable obfuscation (iO) can achieve constant size, independent of |C|. On the other hand, practically oriented schemes using only symmetric key cryptography all have sizes Ω(λ · |C|). Motivated by the gap in between, this thesis explores new ways of leveraging light-weight techniques from public-key cryptography to construct communication efficient garbling schemes. In particular, our explorations are centered around two primitives, linearly homomorphic encryption (LHE) and homomorphic secret sharing (HSS). In Part I, we apply LHE techniques to construct communication efficient garbling schemes that specialize for arithmetic operation gates over a modulus R or bounded integers. We define the (succinctness) rate of such schemes to be the per-gate garbling size normalized by log R or the range of bounded integers. Our results include:• rate-O(1) arithmetic garbling over bounded integers, and • rate-O(λ_DCR) mixed garbling over Z_R and Boolean gates for any modulus R. In Part II, we apply HSS techniques to construct communication efficient Boolean garbling schemes. Our results lead to a unified framework for garbling arbitrary Boolean gates (as truth tables) with 1-bit per output wire in garbling size. Consequences of this framework include: • standard Boolean garbling with 1-bit per gate; • rate-O(1) arithmetic garbling over Z_R for any modulus R. All of the mentioned results were achieved for the first time without using FHE or iO.