How to Garble Arithmetic Circuits

Abstract

Yao's garbled circuit construction transforms a boolean circuit C : {0, 1} n → {0, 1} m into a "garbled circuit"Ĉ along with n pairs of k-bit keys, one for each input bit, such thatĈ together with the n keys corresponding to an input x reveal C(x) and no additional information about x. The garbled circuit construction is a central tool for constant-round secure computation and has several other applications.Motivated by these applications, we suggest an efficient arithmetic variant of Yao's original construction. Our construction transforms an arithmetic circuit C : Z n → Z m over integers from a bounded (but possibly exponential) range into a garbled circuitĈ along with n affine functions L i : Z → Z k such thatĈ together with the n integer vectors L i (x i ) reveal C(x) and no additional information about x. The security of our construction relies on the intractability of the learning with errors (LWE) problem.

Arithmetic Cryptography

“…For example, [5] show that arithmetic garbled circuits can be constructed based on a special "key-shrinking" gadget, which can be viewed as a symmetric encryption over F with some homomorphic properties. They also provide an implementation of this gadget over the integers.…”

“…The question of garbling arithmetic circuits has been open for a long time, and only recently some partial progress has been made [5]. Still, so far there has been no fully arithmetic construction in which both the encoder and the decoder make a black-box use of F. We show that this is inherently impossible answering an open problem from [35].…”

“…Similarly, the results of [5] can be viewed as an arithmetic reduction from garbling arithmetic circuits to the design of a special symmetric encryption over F.…”

Foundations of garbled circuits

“…The conceptualization of garbling as involving a component that creates garbled circuits and another that evaluates them is found in all of these works, and in Schneider's [47,48]. A second line of definitions begins with Ishai and Kushilevitz [25] and continues with [2,3,5,6,26,27,46]. These works define various flavors of randomized encodings.…”

“…Scattered through the literature one finds computational objects other than boolean circuits that are being garbled; examples include arithmetic circuits [6], branching programs [9], circuits with lookup tables [39], DFAs [49], and ordered binary decision diagrams [33]. The range suggests, to us, that general-purpose definitions for garbling schemes ought not be tied to circuits.…”