Secure two-party computations in ANSI C

Abstract

The practical application of Secure Two-Party Computation is hindered by the difficulty to implement secure computation protocols. While recent work has proposed very simple programming languages which can be used to specify secure computations, it is still difficult for practitioners to use them, and cumbersome to translate existing source code into this format. Similarly, the manual construction of two-party computation protocols, in particular ones based on the approach of garbled circuits, is labor intensive and error-prone.The central contribution of the current paper is a tool which achieves Secure Two-Party Computation for ANSI C. Our work is based on a combination of model checking techniques and two-party computation based on garbled circuits.Our key insight is a nonstandard use of the bit-precise model checker CBMC which enables us to translate C programs into equivalent Boolean circuits. To this end, we modify the standard CBMC translation from programs into Boolean formulas whose variables correspond to the memory bits manipulated by the program. As CBMC attempts to minimize the size of the formulas, the circuits obtained by our tool chain are also size efficient; to improve the efficiency of the garbled circuit evaluation, we perform optimizations on the circuits. Experimental results with the new tool CBMC-GC demonstrate the practical usefulness of our approach.

A Fast and Verified Software Stack for Secure Function Evaluation

“…Holzer et al [39] present a compiler that uses the bounded modelchecker CBMC to translate ANSI C programs into Boolean circuits. The circuits can be used as inputs to the secure computation framework of Huang et al [40].…”

Automatic Protocol Selection in Secure Two-Party Computations

“…Frameworks for secure two-party computation are either based on garbled circuits (e.g., Fairplay [4,39], FastGC [24], VMCrypt [38], and CBMC-GC [21]) or homomorphic encryption (e.g., VIFF [12]). The L1 framework [55] allows to describe secure computation protocols that employ both techniques, garbled circuits and homomorphic encryption.…”

“…For his outputs, he is given a mapping that allows him to decrypt the output keys into plain output values. For Yao's garbled circuits protocol we use the following optimizations and instantiations that are implemented in FastGC [24] (which is used in many recent works such as [22,23,21,45,46]) and VMCrypt [38]: For OT we use OT extensions of [26] with the OT protocol of [42] for the base OTs. For garbled circuits we use free XOR gates [34], garbled row reduction [43,51], and pipelining [24].…”

“…A number of protocols compete for the best performance in this model. Recently, the garbled circuit implementation FastGC [24] has been used in several privacy-preserving applications, including [22,23,21,45,46], but still garbled circuits have some inherent limitations, e.g., due to the large circuit size of some functionalities such as multiplication. In this paper we propose a different approach.…”

More efficient oblivious transfer and extensions for faster secure computation

“…Indeed, many held the opinion that secure computation will never be practical since carrying out cryptographic operations for every gate in a circuit computing the function (which is the way many protocols work) will never be fast enough to be of use. Due to many works that pushed secure computation further towards practical applications, e.g., [6,7,10,15,17,25,28,35,[41][42][43]50,57], this conjecture has proven to be wrong and it is possible to carry out secure computation of complex functions at speeds that five years ago would have been unconceivable. For example, in FastGC [28] it was shown that AES can be securely computed with 0.2 seconds of preprocessing time and just 0.008 seconds of online computation.…”