Non-Interactive Secure Computation Based on Cut-and-Choose

Transcription

1 Non-Interactive Secure Computation Based on Cut-and-Choose Arash Afshar, Payman Mohassel, Benny Pinkas, and Ben Riva May 14, 2014 Afshar, Mohassel, Pinkas, and Riva Non-Interactive Secure Computation Based on Cut-and-Choose May 14, / 29

2 Overview The Big Picture Secure Two Party Computation (2PC) In presence of malicious/active adversaries. Afshar, Mohassel, Pinkas, and Riva Non-Interactive Secure Computation Based on Cut-and-Choose May 14, / 29

3 Overview The Big Picture Secure Two Party Computation (2PC) In presence of malicious/active adversaries. Non-interactive computation A single message is sent and a single message received. First Message Second Message Afshar, Mohassel, Pinkas, and Riva Non-Interactive Secure Computation Based on Cut-and-Choose May 14, / 29

4 Overview The Big Picture Secure Two Party Computation (2PC) In presence of malicious/active adversaries. Non-interactive computation A single message is sent and a single message received. Practical 6.4 seconds for AES circuit evaluation on a common laptop. Afshar, Mohassel, Pinkas, and Riva Non-Interactive Secure Computation Based on Cut-and-Choose May 14, / 29

5 Overview Motivation Alice Online/Bob offline General private computation. Asynchronous communications (i.e. ). Example usecases: Private Set Intersection DNA ancestry computation... Afshar, Mohassel, Pinkas, and Riva Non-Interactive Secure Computation Based on Cut-and-Choose May 14, / 29

6 Overview Motivation Alice offline/bob online General private computation. Asynchronous communications (i.e. ). Example usecases: Private Set Intersection DNA ancestry computation... Afshar, Mohassel, Pinkas, and Riva Non-Interactive Secure Computation Based on Cut-and-Choose May 14, / 29

7 Overview Motivation Alice offline/bob online General private computation. Asynchronous communications (i.e. ). Example usecases: Private Set Intersection DNA ancestry computation... Afshar, Mohassel, Pinkas, and Riva Non-Interactive Secure Computation Based on Cut-and-Choose May 14, / 29

8 Overview Motivation Alice offline/bob online General private computation. Asynchronous communications (i.e. ). Example usecases: Private Set Intersection DNA ancestry computation... Afshar, Mohassel, Pinkas, and Riva Non-Interactive Secure Computation Based on Cut-and-Choose May 14, / 29

9 Overview Motivation Alice Online/Bob offline General private computation. Asynchronous communications (i.e. ). Example usecases: Private Set Intersection DNA ancestry computation... Afshar, Mohassel, Pinkas, and Riva Non-Interactive Secure Computation Based on Cut-and-Choose May 14, / 29

10 Overview Motivation Alice Online/Bob offline General private computation. Asynchronous communications (i.e. ). Example usecases: Private Set Intersection DNA ancestry computation... Afshar, Mohassel, Pinkas, and Riva Non-Interactive Secure Computation Based on Cut-and-Choose May 14, / 29

11 2PC Approaches Outline 1 Overview 2 2PC Approaches Security Definition Semi-honest Malicious 3 Protocol Afshar, Mohassel, Pinkas, and Riva Non-Interactive Secure Computation Based on Cut-and-Choose May 14, / 29

12 2PC Approaches Security Definition Security of 2PC Malicious adversary: might deviate from the protocol Computationally bounded adversary. Security is proved by simulation in Real/Ideal-world paradigm. If an attack can be launched in Real-world, then, Ideal-world will be compromised. Real World Ideal World Afshar, Mohassel, Pinkas, and Riva Non-Interactive Secure Computation Based on Cut-and-Choose May 14, / 29

13 2PC Approaches Semi-honest 2PC Using Yao (Non-interactive) Semi-honest setting. Easy to change to NISC. Afshar, Mohassel, Pinkas, and Riva Non-Interactive Secure Computation Based on Cut-and-Choose May 14, / 29

14 2PC Approaches Semi-honest 2PC Using Yao (Non-interactive) Semi-honest setting. Easy to change to NISC. Fix terminology of the roles. Afshar, Mohassel, Pinkas, and Riva Non-Interactive Secure Computation Based on Cut-and-Choose May 14, / 29

15 2PC Approaches Semi-honest 2PC Using Yao (Non-interactive) Semi-honest setting. Easy to change to NISC. Fix terminology of the roles. 2 message, universally composable OT [PVW08]. Afshar, Mohassel, Pinkas, and Riva Non-Interactive Secure Computation Based on Cut-and-Choose May 14, / 29

16 2PC Approaches Semi-honest 2PC Using Yao (Non-interactive) Semi-honest setting. Easy to change to NISC. Fix terminology of the roles. 2 message, universally composable OT [PVW08]. First Message Sends his inputs as OT inputs. Inputs as OT Afshar, Mohassel, Pinkas, and Riva Non-Interactive Secure Computation Based on Cut-and-Choose May 14, / 29

17 2PC Approaches Semi-honest 2PC Using Yao (Non-interactive) Semi-honest setting. Easy to change to NISC. Fix terminology of the roles. 2 message, universally composable OT [PVW08]. First Message Sends his inputs as OT inputs. Second Message Sends his garbled inputs. Sends the garbled circuit. Sends OT answers corresponding to the Receiver s input. Inputs as OT OT Answers, Garbled Inputs, Afshar, Mohassel, Pinkas, and Riva Non-Interactive Secure Computation Based on Cut-and-Choose May 14, / 29

18 2PC Approaches Semi-honest 2PC Using Yao (Non-interactive) Semi-honest setting. Easy to change to NISC. Fix terminology of the roles. 2 message, universally composable OT [PVW08]. First Message Sends his inputs as OT inputs. Second Message Sends his garbled inputs. Sends the garbled circuit. Sends OT answers corresponding to the Receiver s input. Receiver Evaluates the circuit. Inputs as OT OT Answers, Garbled Inputs, Afshar, Mohassel, Pinkas, and Riva Non-Interactive Secure Computation Based on Cut-and-Choose May 14, / 29

19 2PC Approaches Malicious Malicious 2PC Approaches (constant round approaches) Not so easy! Interactive Non-interactive Not Practical Asymptotically Efficient Highly Practical Afshar, Mohassel, Pinkas, and Riva Non-Interactive Secure Computation Based on Cut-and-Choose May 14, / 29

20 2PC Approaches Malicious Malicious 2PC Approaches (constant round approaches) Not so easy! A spectrum of approaches! Interactive Non-interactive Not Practical Yao+ZKP Yao+ZKP Asymptotically Efficient Highly Practical Afshar, Mohassel, Pinkas, and Riva Non-Interactive Secure Computation Based on Cut-and-Choose May 14, / 29

21 2PC Approaches Malicious Malicious 2PC Approaches (constant round approaches) Not so easy! A spectrum of approaches! Interactive Non-interactive Not Practical Yao+ZKP Yao+ZKP Asymptotically Efficient MPC-in-the-head [IKO + 11] MPC-in-the-head [IKO + 11] Highly Practical Afshar, Mohassel, Pinkas, and Riva Non-Interactive Secure Computation Based on Cut-and-Choose May 14, / 29

22 2PC Approaches Malicious Malicious 2PC Approaches (constant round approaches) Not so easy! A spectrum of approaches! Interactive Non-interactive Not Practical Yao+ZKP Yao+ZKP Asymptotically Efficient MPC-in-the-head [IKO + 11] MPC-in-the-head [IKO + 11] Highly Practical Cut-and-Choose [Lin13] Afshar, Mohassel, Pinkas, and Riva Non-Interactive Secure Computation Based on Cut-and-Choose May 14, / 29

23 2PC Approaches Malicious Malicious 2PC Approaches (constant round approaches) Not so easy! A spectrum of approaches! Can we make Cut-and-Choose 2PC non-interactive? Interactive Non-interactive Not Practical Yao+ZKP Yao+ZKP Asymptotically Efficient MPC-in-the-head [IKO + 11] MPC-in-the-head [IKO + 11] Highly Practical Cut-and-Choose [Lin13] Our Approach! Afshar, Mohassel, Pinkas, and Riva Non-Interactive Secure Computation Based on Cut-and-Choose May 14, / 29

24 Outline 1 Overview 2 2PC Approaches 3 Protocol Contributions Implementation Afshar, Mohassel, Pinkas, and Riva Non-Interactive Secure Computation Based on Cut-and-Choose May 14, / 29

25 Contributions Contributions Practical NISC with small overhead based on Cut-and-Choose 2PC As efficient as the state of the art [Lin13]. First implementation of NISC. Afshar, Mohassel, Pinkas, and Riva Non-Interactive Secure Computation Based on Cut-and-Choose May 14, / 29

26 Making Cut-and-Choose Practical Cut-and-Choose Components Checking circuits via Cut-and-Choose. Input consistency. Cheating Recovery. Afshar, Mohassel, Pinkas, and Riva Non-Interactive Secure Computation Based on Cut-and-Choose May 14, / 29

27 Cut-and-Choose Afshar, Mohassel, Pinkas, and Riva Non-Interactive Secure Computation Based on Cut-and-Choose May 14, / 29

28 Cut-and-Choose Construction Attack? Malicious Sender garbles different circuits. instead of Afshar, Mohassel, Pinkas, and Riva Non-Interactive Secure Computation Based on Cut-and-Choose May 14, / 29

29 Cut-and-Choose Construction Attack? Malicious Sender garbles different circuits. Cut-and-Choose Solution? Sender garbles many circuits (i.e. around Ω(t) for 2 t security). Afshar, Mohassel, Pinkas, and Riva Non-Interactive Secure Computation Based on Cut-and-Choose May 14, / 29

30 Cut-and-Choose Construction Attack? Malicious Sender garbles different circuits. Cut-and-Choose Solution? Sender garbles many circuits (i.e. around Ω(t) for 2 t security). Receiver randomly chooses half of them. C&C Choices Afshar, Mohassel, Pinkas, and Riva Non-Interactive Secure Computation Based on Cut-and-Choose May 14, / 29

31 Cut-and-Choose Construction Attack? Malicious Sender garbles different circuits. Cut-and-Choose Solution? Sender garbles many circuits (i.e. around Ω(t) for 2 t security). Receiver randomly chooses half of them. Sender opens the selected circuits. C&C Choices Opening For half Afshar, Mohassel, Pinkas, and Riva Non-Interactive Secure Computation Based on Cut-and-Choose May 14, / 29

32 Cut-and-Choose Construction Attack? Malicious Sender garbles different circuits. Cut-and-Choose Solution? Sender garbles many circuits (i.e. around Ω(t) for 2 t security). Receiver randomly chooses half of them. Sender opens the selected circuits. Receiver evaluates the other half and returns the majority result. Garbled Inputs Afshar, Mohassel, Pinkas, and Riva Non-Interactive Secure Computation Based on Cut-and-Choose May 14, / 29

33 Cut-and-Choose Overhead Cost? Adds an extra round (2 messages). At least, an overhead of 3t in computation and communication. Afshar, Mohassel, Pinkas, and Riva Non-Interactive Secure Computation Based on Cut-and-Choose May 14, / 29

34 Cut-and-Choose Overhead Cost? Adds an extra round (2 messages). At least, an overhead of 3t in computation and communication. Problem: Sender s Input Consistency Malicious Sender may send different inputs to different circuits. inp2 inp2 inp2 diff inp2 Afshar, Mohassel, Pinkas, and Riva Non-Interactive Secure Computation Based on Cut-and-Choose May 14, / 29

35 Non-interactive Cut-and-Choose Receiver s Message: Same as before C&C Choices as OT inputs Afshar, Mohassel, Pinkas, and Riva Non-Interactive Secure Computation Based on Cut-and-Choose May 14, / 29

36 Non-interactive Cut-and-Choose Receiver s Message: Same as before Sender s Response: Garbled circuits. Circuit openings and garbled inputs as OT response. C&C Choices as OT inputs OT Circuits Opennings Garbled Inputs Afshar, Mohassel, Pinkas, and Riva Non-Interactive Secure Computation Based on Cut-and-Choose May 14, / 29

37 Non-interactive Cut-and-Choose Receiver s Message: Same as before Sender s Response: Garbled circuits. Circuit openings and garbled inputs as OT response. Receiver s Computation: For each circuit Receives either the opening or the keys for evaluation C&C Choices as OT inputs OT Circuits Opennings Garbled Inputs Afshar, Mohassel, Pinkas, and Riva Non-Interactive Secure Computation Based on Cut-and-Choose May 14, / 29

38 Input Consistency Afshar, Mohassel, Pinkas, and Riva Non-Interactive Secure Computation Based on Cut-and-Choose May 14, / 29

39 Input Consistency Receiver s input consistency: Attack: Selective OT Attack. Afshar, Mohassel, Pinkas, and Riva Non-Interactive Secure Computation Based on Cut-and-Choose May 14, / 29

40 Input Consistency Receiver s input consistency: Attack: Selective OT Attack. Defense: Modified ideas of [LP11] and [SS11]. Afshar, Mohassel, Pinkas, and Riva Non-Interactive Secure Computation Based on Cut-and-Choose May 14, / 29

41 Input Consistency Receiver s input consistency: Attack: Selective OT Attack. Defense: Modified ideas of [LP11] and [SS11]. Sender s input consistency: Attack: Sender sends different inputs to different circuits. inp2 inp2 inp2 diff inp2 Afshar, Mohassel, Pinkas, and Riva Non-Interactive Secure Computation Based on Cut-and-Choose May 14, / 29

42 Input Consistency Receiver s input consistency: Attack: Selective OT Attack. Defense: Modified ideas of [LP11] and [SS11]. Sender s input consistency: Attack: Sender sends different inputs to different circuits. Interactive Defense: Different solutions with different costs! State of the art: [MR13] and [ss13] inp2 inp2 inp2 diff inp2 Afshar, Mohassel, Pinkas, and Riva Non-Interactive Secure Computation Based on Cut-and-Choose May 14, / 29

43 NISC Input Consistency Sender Commits to original values. EG 0 i,eg1 i Circ Afshar, Mohassel, Pinkas, and Riva Non-Interactive Secure Computation Based on Cut-and-Choose May 14, / 29

44 NISC Input Consistency Sender Commits to original values. Garbles 3t copies of the circuit. EG 0 i,eg1 i Circ EG 0 i,j,eg1 i,j j EG 0 i,j,eg1 i,j j Afshar, Mohassel, Pinkas, and Riva Non-Interactive Secure Computation Based on Cut-and-Choose May 14, / 29

45 NISC Input Consistency Sender Commits to original values. Garbles 3t copies of the circuit. From different seeds. EG 0 i,eg1 i Circ EG 0 i,j,eg1 i,j j seed j EG 0 i,j,eg1 i,j j seed j Afshar, Mohassel, Pinkas, and Riva Non-Interactive Secure Computation Based on Cut-and-Choose May 14, / 29

46 NISC Input Consistency Sender Commits to original values. Garbles 3t copies of the circuit. From different seeds. Generates equality proofs. EG 0 i,eg1 i equality proof 1 i,j equality proof 0 i,j Circ EG 0 i,j,eg1 i,j EG 0 i,j,eg1 i,j j seed j equality proof 0 i,j j equality proof 1 i,j seed j Afshar, Mohassel, Pinkas, and Riva Non-Interactive Secure Computation Based on Cut-and-Choose May 14, / 29

47 NISC Input Consistency enc( k 1, )=msg 1 j j Sender Commits to original values. Garbles 3t copies of the circuit. From different seeds. Generates equality proofs. enc( k 0, )=msg 0 j j EG 0 i,eg1 i equality proof 1 i,j equality proof 0 i,j Circ EG 0 i,j,eg1 i,j EG 0 i,j,eg1 i,j j seed j Hides equality proofs. equality proof 0 i,j j equality proof 1 i,j enc( k0, )=msg 0 j j seed j enc( k1, )=msg 1 j j Afshar, Mohassel, Pinkas, and Riva Non-Interactive Secure Computation Based on Cut-and-Choose May 14, / 29

48 NISC Input Consistency First Message: The same as Cut-and-Choose. C&C Choices as OT inputs Afshar, Mohassel, Pinkas, and Riva Non-Interactive Secure Computation Based on Cut-and-Choose May 14, / 29

49 NISC Input Consistency First Message: The same as Cut-and-Choose. Second Message: Garbled circuits C&C Choices as OT inputs Afshar, Mohassel, Pinkas, and Riva Non-Interactive Secure Computation Based on Cut-and-Choose May 14, / 29

50 NISC Input Consistency First Message: The same as Cut-and-Choose. Second Message: Garbled circuits Encrypted proofs of equality. C&C Choices as OT inputs, msg,, Afshar, Mohassel, Pinkas, and Riva Non-Interactive Secure Computation Based on Cut-and-Choose May 14, / 29

51 NISC Input Consistency First Message: The same as Cut-and-Choose. Second Message: Garbled circuits Encrypted proofs of equality. OT response. C&C Choices as OT inputs, msg,, OT seeds, k 0,k 1, Afshar, Mohassel, Pinkas, and Riva Non-Interactive Secure Computation Based on Cut-and-Choose May 14, / 29

52 NISC Input Consistency First Message: The same as Cut-and-Choose. Second Message: Garbled circuits Encrypted proofs of equality. OT response. Computation: Opened circuits: Checks commitments. C&C Choices as OT inputs, msg,, OT seeds, k 0,k 1, Afshar, Mohassel, Pinkas, and Riva Non-Interactive Secure Computation Based on Cut-and-Choose May 14, / 29

53 NISC Input Consistency First Message: The same as Cut-and-Choose. Second Message: Garbled circuits Encrypted proofs of equality. OT response. Computation: Opened circuits: Checks commitments. Evaluated circuits: Checks equality. C&C Choices as OT inputs, msg,, OT seeds, k 0,k 1, Afshar, Mohassel, Pinkas, and Riva Non-Interactive Secure Computation Based on Cut-and-Choose May 14, / 29

54 Cheating Recovery Afshar, Mohassel, Pinkas, and Riva Non-Interactive Secure Computation Based on Cut-and-Choose May 14, / 29

55 Cheating Recovery Goal Reducing the 3t circuit overhead to t for security of 2 t. No majority checking. At least one correct circuit. 3t t 2 t 2 t Afshar, Mohassel, Pinkas, and Riva Non-Interactive Secure Computation Based on Cut-and-Choose May 14, / 29

56 Cheating Recovery The idea: Recover Sender s input two different output wire values. Recoverable?? Afshar, Mohassel, Pinkas, and Riva Non-Interactive Secure Computation Based on Cut-and-Choose May 14, / 29

57 Cheating Recovery With t circuits, input cannot be recovered if all evaluating are the same and correct. Won t punish honest Sender. Not Recoverable Desirable! Afshar, Mohassel, Pinkas, and Riva Non-Interactive Secure Computation Based on Cut-and-Choose May 14, / 29

58 Cheating Recovery With t circuits, input cannot be recovered if all evaluating are the same and incorrect. 2 t failure probability. Not Recoverable Not Desirable! Afshar, Mohassel, Pinkas, and Riva Non-Interactive Secure Computation Based on Cut-and-Choose May 14, / 29

59 Cheating Recovery (cont.) How? Use extra malicious 2PC [Lin13], on a small circuit. Afshar, Mohassel, Pinkas, and Riva Non-Interactive Secure Computation Based on Cut-and-Choose May 14, / 29

60 Cheating Recovery (cont.) How? Use extra malicious 2PC [Lin13], on a small circuit. cost? Extra rounds for the extra 2PC. Small computation and communication overhead for the extra 2PC. Afshar, Mohassel, Pinkas, and Riva Non-Interactive Secure Computation Based on Cut-and-Choose May 14, / 29

61 NISC cheating recovery First message: Nothing! Afshar, Mohassel, Pinkas, and Riva Non-Interactive Secure Computation Based on Cut-and-Choose May 14, / 29

62 NISC cheating recovery First message: Nothing! Second message: Change input labels to ElGamal commitments. A, B EG 0, EG 1 i E, F Afshar, Mohassel, Pinkas, and Riva Non-Interactive Secure Computation Based on Cut-and-Choose May 14, / 29

63 NISC cheating recovery First message: Nothing! Second message: Change input labels to ElGamal commitments. Assume a trapdoor w. A, B EG 0, EG 1 i E, F w trapdoor Afshar, Mohassel, Pinkas, and Riva Non-Interactive Secure Computation Based on Cut-and-Choose May 14, / 29

64 NISC cheating recovery First message: Nothing! Second message: Change input labels to ElGamal commitments. Assume a trapdoor w. Recover trapdoor (partly), using output labels. A, B EG 0, EG 1 i E, F w trapdoor split w j,0 w j,1 Afshar, Mohassel, Pinkas, and Riva Non-Interactive Secure Computation Based on Cut-and-Choose May 14, / 29

65 NISC cheating recovery First message: Nothing! Second message: Change input labels to ElGamal commitments. Assume a trapdoor w. Recover trapdoor (partly), using output labels. A, B EG 0, EG 1 i E, F enc(k i,j,0 ) enc(k i,j,1 ) w trapdoor split w j,0 w j,1 blinds with k i,j,0 k i,j,1 Afshar, Mohassel, Pinkas, and Riva Non-Interactive Secure Computation Based on Cut-and-Choose May 14, / 29

66 NISC cheating recovery First message: Nothing! Second message: Change input labels to ElGamal commitments. Assume a trapdoor w. Recover trapdoor (partly), using output labels. Computation: No cheating learn one w j,b. A, B EG 0, EG 1 i E, F enc(k i,j,0 ) enc(k i,j,1 ) w trapdoor split w j,0 w j,1 blinds with k i,j,0 k i,j,1 Afshar, Mohassel, Pinkas, and Riva Non-Interactive Secure Computation Based on Cut-and-Choose May 14, / 29

67 NISC cheating recovery First message: Nothing! Second message: Change input labels to ElGamal commitments. Assume a trapdoor w. Recover trapdoor (partly), using output labels. Computation: No cheating learn one w j,b. Cheating learn both w j,b. A, B EG 0, EG 1 i E, F enc(k i,j,0 ) enc(k i,j,1 ) w trapdoor split w j,0 w j,1 blinds with k i,j,0 k i,j,1 Afshar, Mohassel, Pinkas, and Riva Non-Interactive Secure Computation Based on Cut-and-Choose May 14, / 29

68 Implementation Implementation Afshar, Mohassel, Pinkas, and Riva Non-Interactive Secure Computation Based on Cut-and-Choose May 14, / 29

69 Implementation Results Experimented on a Linux VM on a laptop 64bit, i7-4650u, 1.70GHz and 5.4GB of RAM. Used only one core. Enabled AES-NI instructions set. AES circuit (with 8,492 non-xor and 25,124 XOR gates). 6.4 seconds Libraries used: JustGarble [BHKR13], OpenSSL, RELIC-toolkit. Afshar, Mohassel, Pinkas, and Riva Non-Interactive Secure Computation Based on Cut-and-Choose May 14, / 29

70 Implementation Observations Module or part name Time(sec.) Time(sec.) AES circuit SHA256 circuit First message Second message Receiver s computation Cheating recovery < 0.01 < 0.01 Total time I/O time Figure : For t = 40 Very small Garbling time. Cheating recovery time. Bottlenecks Exponentiations (Elliptic curve multiplication) IO (used file for communications) Afshar, Mohassel, Pinkas, and Riva Non-Interactive Secure Computation Based on Cut-and-Choose May 14, / 29

71 Implementation Observations Module or part name Time(sec.) Time(sec.) AES circuit SHA256 circuit Total time I/O time Non-I/O time Figure : For t = 40 SHA256 garbled circuit size is 10 times larger. Same input size, different output size Resulting in Large increase in IO. Small increase in non-io. Afshar, Mohassel, Pinkas, and Riva Non-Interactive Secure Computation Based on Cut-and-Choose May 14, / 29

72 Implementation Thank You! Afshar, Mohassel, Pinkas, and Riva Non-Interactive Secure Computation Based on Cut-and-Choose May 14, / 29

73 Implementation References Mihir Bellare, Viet Tung Hoang, Sriram Keelveedhi, and Phillip Rogaway. Efficient garbling from a fixed-key blockcipher. In IEEE S&P, Yuval Ishai, Eyal Kushilevitz, Rafail Ostrovsky, Manoj Prabhakaran, and Amit Sahai. Efficient non-interactive secure computation. In EUROCRYPT, pages Springer-Verlag, Yehuda Lindell. Fast cut-and-choose based protocols for malicious and covert adversaries. In CRYPTO, pages 1 17, Yehuda Lindell and Benny Pinkas. Secure two-party computation via cut-and-choose oblivious transfer. In TCC, pages Springer, Payman Mohassel and Ben Riva. Garbled circuits checking garbled circuits: More efficient and secure two-party computation. In CRYPTO, pages 36 53, Chris Peikert, Vinod Vaikuntanathan, and Brent Waters. A framework for efficient and composable oblivious transfer. In CRYPTO, Abhi Shelat and Chih-Hao Shen. Two-output secure computation with malicious adversaries. In EUROCRYPT, pages Springer, abhi shelat and Chih-hao Shen. Fast two-party secure computation with minimal assumptions. In CCS, pages ACM, Afshar, Mohassel, Pinkas, and Riva Non-Interactive Secure Computation Based on Cut-and-Choose May 14, / 29

74 Implementation resources... SHA256 circuit (with 194,083 non-xor gates and 42,029 XOR gates). AES circuit (with 8,492 non-xor and 25,124 XOR gates). Afshar, Mohassel, Pinkas, and Riva Non-Interactive Secure Computation Based on Cut-and-Choose May 14, / 29