GMW vs. Yao? Efficient Secure Two-Party Computation with Low Depth Circuits

Abstract

Secure two-party computation is a rapidly emerging field of research and enables a large variety of privacy-preserving applications such as mobile social networks or biometric identification. In the late eighties, two different approaches were proposed: Yao's garbled circuits and the protocol of Goldreich-Micali-Wigderson (GMW). Since then, research has mostly focused on Yao's garbled circuits as they were believed to yield better efficiency due to their constant round complexity. In this work we give several optimizations for an efficient implementation of the GMW protocol. We show that for semi-honest adversaries the optimized GMW protocol can outperform today's most efficient implementations of Yao's garbled circuits, but highly depends on a low network latency. As a first step to overcome these latency issues, we summarize depth-optimized circuit constructions for various standard tasks. As application scenario we consider privacy-preserving face recognition and show that our optimized framework is up to 100 times faster than previous works even in settings with high network latency.

Privacy-Preserving Interdomain Routing at Internet Scale

“…A SIMD circuit also consists of gates, but instead of operating on single bits, it operates on multiple bits in parallel. Thereby, the time for the load / process / store operations of a gate amortizes, which drastically speeds up the evaluation [38]. In contrast, a pipelined construction and evaluation approach would need to perform a load / process / store operation per bit of evaluation.…”

Efficient Three-Party Computation from Cut-and-Choose

“…5 In terms of communication, the SPDZ protocol requires rounds linear in the depth of the circuit, whereas our protocol is constant-round. While it is difficult to compare the impact of this without an implementation and experiments, it seems intuitive that as the latency between machines increases, the cost of each additional communication round increases as well; this intuition has been backed up by experiments in the semi-honest setting [SZ13].…”

“…To our knowledge, SPDZ's implementation experiments [DKL + 12, DPSZ12, DKL + 13] were run on a local-area network where physical broadcast is available, and thus the delay due to accounting for round-timeouts and/or running a multi-party broadcasting protocol when operating in a wide-area network environment has not been taken into account. This delay may be non-trivial depending on circumstances: Schneider and Zohner [SZ13] have shown that as the latency between machines increases, the cost of each round becomes more and more significant.…”

More efficient oblivious transfer and extensions for faster secure computation

“…However, it is possible to still do much better. The secure computation framework of [56] improved the results of FastGC [28] by a factor of 6-80, depending on the network latency. Jumping ahead, we obtain additional speedups for both secure computation frameworks [28] and [56].…”