Stacked Garbling

Abstract

Secure two party computation (2PC) of arbitrary programs can be efficiently achieved using garbled circuits (GC). The bottleneck of GC efficiency is communication. It is widely believed that it is necessary to transmit the entire GC during 2PC, even for conditional branches that are not taken. This folklore belief is false. We propose a novel GC technique, stacked garbling, that eliminates the communication cost of inactive conditional branches. We extend the ideas of conditional GC evaluation explored in (Kolesnikov, Asiacrypt 18) and (Heath and Kolesnikov, Eurocrypt 20). Unlike these works, ours is for general 2PC where no player knows which conditional branch is taken. Our garbling scheme, $$\textsf {Stack}$$ , requires communication proportional to the longest execution path rather than to the entire circuit. $$\textsf {Stack}$$ is compatible with state-of-the-art techniques, such as free XOR and half-gates. $$\textsf {Stack}$$ is a garbling scheme. As such, it can be plugged into a variety of existing protocols, and the resulting round complexity is the same as that of standard GC. The approach does incur computation cost quadratic in the conditional branching factor vs linear in standard schemes, but the tradeoff is beneficial for most programs: GC computation even on weak hardware is faster than GC transmission on fast channels. We implemented $$\textsf {Stack}$$ in C++. $$\textsf {Stack}$$ reduces communication cost by approximately the branching factor: for 16 branches, communication is reduced by $$10.5{\times }$$ . In terms of wall-clock time for circuits with branching factor 16 over a 50 Mbps WAN on a laptop, $$\textsf {Stack}$$ outperforms state-of-the-art half-gates-based 2PC by more than $$4{\times }$$ .