Efficient and Scalable Universal Circuits

Abstract

A universal circuit (UC) can be programmed to simulate any circuit up to a given size n by specifying its program inputs. It provides elegant solutions in various application scenarios, e.g., for private function evaluation (PFE) and for improving the flexibility of attribute-based encryption schemes. The asymptotic lower bound for the size of a UC is (n log n), and Valiant (STOC'76) provided two theoretical constructions, the so-called 2-way and 4-way UCs (i.e., recursive constructions with 2 and 4 substructures), with asymptotic sizes ∼ 5n log 2 n and ∼ 4.75n log 2 n, respectively. In this article, we present and extend our results published in (Kiss and Schneider EUROCRYPT'16) and (Günther et al. ASIACRYPT'17). We validate the practicality of Valiant's UCs by realizing the 2-way and 4-way UCs in our modular open-source implementation. We also provide an example implementation for PFE using these sizeoptimized UCs. We propose a 2/4-hybrid approach that combines the 2-way and the 4-way UCs in order to minimize the size of the resulting UC. We realize that the bottleneck in universal circuit generation and programming becomes the memory consumption of the program since the whole structure of size O(n log n) is handled by the algorithms in memory. In this work, we overcome this by designing novel scalable algorithms for the UC generation and programming. Both algorithms use only O(n) memory at any point in time. We prove the practicality of our scalable design with a scalable proof-of-concept implementation for generating Valiant's 4-way UC. We note that this can be extended to work with optimized building blocks analogously. Moreover, we substantially improve the size of our UCs by including and implementing the recent optimization of Zhao et al. (ASIACRYPT'19) that reduces the asymptotic size of the 4-way UC to ∼ 4.5n log 2 n. Furthermore, we include their optimization in the implementation of our 2/4-hybrid UC which yields the smallest UC construction known so far.

Let’s Stride Blindfolded in a Forest: Sublinear Multi-Client Decision Trees Evaluation

“…, m n−1 ) and a client/receiver inputs an index i. The client learns only m i and the server learns nothing about i. n 1 -OT can be done by using log n 2 1 -OT [35], [25]. OT extension [20], [5] "extends" a small number of base OT's requiring public-key operations to a larger number of OT's by using symmetric-key operations.…”

“…Our protocols only embed a GC-based secure comparison and a 2 1 -OT in the COT. The 2 1 -OT can be run in parallel with the GC.…”

“…The computation cost for the client/server is n/1 hash function. A COT requires a GC with t AND-gates, one 2 1 -OT with output length λ, transmissions of two λ-bit hash values, and two (λ + 1)-bit encrypted messages. The communication cost of GC with t AND-gates and OT with output length λ is 7tλ bits and 2λ bits, respectively.…”

“…According to Definition 2, the server should learn nothing about the client's attribute vector, and the client should learn nothing about the server's decision tree except the classification result. Unlike [28], [34], [2], we do not hide the fact that a decision tree evaluation is going on.…”

“…Privacy-preserving inference protects the privacy of both the client and the model owner. While generic cryptographic tools exist (e.g., [28], [34], [2]), classifier-specific solutions can be more efficient. We focus on the decision-tree classifier [9], which is widely used [24], e.g., for spam detection, multimedia protocol tunneling, and content classification.…”