Garbled Circuits Research Articles

FastGarble: an optimised garbled circuit construction framework

FastGarble: an optimised garbled circuit construction framework

FastGarble: an optimised garbled circuit construction framework

The emerging field of cryptography, Secure Computation, can be used to solve a number of distributed computing applications without loss of privacy of sensitive/private data. The applications can b...

Oblivious Inspection: On the Confrontation between System Security and Data Privacy at Domain Boundaries

In this work, we introduce the system boundary security vs. privacy dilemma, where border devices (e.g., firewall devices) require unencrypted data inspection to prevent data exfiltration or unauthorized data accesses, but unencrypted data inspection violates data privacy. To shortcut this problem, we present Oblivious Inspection, a novel approach based on garbled circuits to perform a stateful application-aware inspection of encrypted network traffic in a privacy-preserving way. We also showcase an inspection algorithm for Fast Healthcare Interoperability Resources (FHIR) standard compliant packets along with its performance results. The results point out the importance of the inspection function being aligned with the underlying garbled circuit protocol. In this line, mandatory encryption algorithms for TLS 1.3 have been analysed observing that packets encrypted using Chacha20 can be filtered up to 17 and 25 times faster compared with AES128-GCM and AES256-GCM, respectively. All together, this approach penalizes performance to align system security and data privacy, but it could be appropriate for those scenarios where this performance degradation can be justified by the sensibility of the involved data such as healthcare scenarios.

Optimizing Privacy-Preserving Outsourced Convolutional Neural Network Predictions

Convolutional neural networks (CNN) is a popular architecture in machine learning for its predictive power, notably in computer vision and medical image analysis. Its great predictive power requires extensive computation, which encourages model owners to host the prediction service in a cloud platform. This article proposes a CNN prediction scheme that preserves privacy in the outsourced setting, i.e., the model-hosting server cannot learn the query, (intermediate) results, and the model. Similar to SecureML (S&#x0026;P&#x2019;17), a representative work that provides model privacy, we employ two non-colluding servers with secret sharing and triplet generation to minimize the usage of heavyweight cryptography. We made the following optimizations for both overall latency and accuracy. 1) We adopt asynchronous computation and SIMD for offline triplet generation and parallelizable online computation. 2) As MiniONN (CCS&#x2019;17) and its improvement by the generic EzPC compiler (EuroS&#x0026;P&#x2019;19), we use a garbled circuit for the non-polynomial ReLU activation to keep the same accuracy as the underlying network (instead of approximating it in SecureML prediction). 3) For the pooling in CNN, we employ (linear) average-pooling, which achieves almost the same accuracy as the (non-linear, and hence less efficient) max-pooling exhibited by MiniONN and EzPC. Considering both offline and online costs, our experiments on the MNIST dataset show a latency reduction of <inline-formula><tex-math notation="LaTeX">$122\times$</tex-math><alternatives><mml:math><mml:mrow><mml:mn>122</mml:mn><mml:mo>&#x00D7;</mml:mo></mml:mrow></mml:math><inline-graphic xlink:href="wang-ieq1-3029899.gif"/></alternatives></inline-formula>, <inline-formula><tex-math notation="LaTeX">$14.63\times$</tex-math><alternatives><mml:math><mml:mrow><mml:mn>14</mml:mn><mml:mo>.</mml:mo><mml:mn>63</mml:mn><mml:mo>&#x00D7;</mml:mo></mml:mrow></mml:math><inline-graphic xlink:href="wang-ieq2-3029899.gif"/></alternatives></inline-formula>, and <inline-formula><tex-math notation="LaTeX">$36.69\times$</tex-math><alternatives><mml:math><mml:mrow><mml:mn>36</mml:mn><mml:mo>.</mml:mo><mml:mn>69</mml:mn><mml:mo>&#x00D7;</mml:mo></mml:mrow></mml:math><inline-graphic xlink:href="wang-ieq3-3029899.gif"/></alternatives></inline-formula> compared to SecureML, MiniONN, and EzPC; and a reduction of communication costs by <inline-formula><tex-math notation="LaTeX">$1.09\times$</tex-math><alternatives><mml:math><mml:mrow><mml:mn>1</mml:mn><mml:mo>.</mml:mo><mml:mn>09</mml:mn><mml:mo>&#x00D7;</mml:mo></mml:mrow></mml:math><inline-graphic xlink:href="wang-ieq4-3029899.gif"/></alternatives></inline-formula>, <inline-formula><tex-math notation="LaTeX">$36.69\times$</tex-math><alternatives><mml:math><mml:mrow><mml:mn>36</mml:mn><mml:mo>.</mml:mo><mml:mn>69</mml:mn><mml:mo>&#x00D7;</mml:mo></mml:mrow></mml:math><inline-graphic xlink:href="wang-ieq5-3029899.gif"/></alternatives></inline-formula>, and <inline-formula><tex-math notation="LaTeX">$31.32\times$</tex-math><alternatives><mml:math><mml:mrow><mml:mn>31</mml:mn><mml:mo>.</mml:mo><mml:mn>32</mml:mn><mml:mo>&#x00D7;</mml:mo></mml:mrow></mml:math><inline-graphic xlink:href="wang-ieq6-3029899.gif"/></alternatives></inline-formula>, respectively. On the CIFAR dataset, our scheme achieves a lower latency by <inline-formula><tex-math notation="LaTeX">$7.14\times$</tex-math><alternatives><mml:math><mml:mrow><mml:mn>7</mml:mn><mml:mo>.</mml:mo><mml:mn>14</mml:mn><mml:mo>&#x00D7;</mml:mo></mml:mrow></mml:math><inline-graphic xlink:href="wang-ieq7-3029899.gif"/></alternatives></inline-formula> and <inline-formula><tex-math notation="LaTeX">$3.48\times$</tex-math><alternatives><mml:math><mml:mrow><mml:mn>3</mml:mn><mml:mo>.</mml:mo><mml:mn>48</mml:mn><mml:mo>&#x00D7;</mml:mo></mml:mrow></mml:math><inline-graphic xlink:href="wang-ieq8-3029899.gif"/></alternatives></inline-formula> and lower communication costs by <inline-formula><tex-math notation="LaTeX">$13.88\times$</tex-math><alternatives><mml:math><mml:mrow><mml:mn>13</mml:mn><mml:mo>.</mml:mo><mml:mn>88</mml:mn><mml:mo>&#x00D7;</mml:mo></mml:mrow></mml:math><inline-graphic xlink:href="wang-ieq9-3029899.gif"/></alternatives></inline-formula> and <inline-formula><tex-math notation="LaTeX">$77.46\times$</tex-math><alternatives><mml:math><mml:mrow><mml:mn>77</mml:mn><mml:mo>.</mml:mo><mml:mn>46</mml:mn><mml:mo>&#x00D7;</mml:mo></mml:mrow></mml:math><inline-graphic xlink:href="wang-ieq10-3029899.gif"/></alternatives></inline-formula> when compared with MiniONN and EzPC, respectively.

Practical Privacy-Preserving K-means Clustering

AbstractClustering is a common technique for data analysis, which aims to partition data into similar groups. When the data comes from different sources, it is highly desirable to maintain the privacy of each database. In this work, we study a popular clustering algorithm (K-means) and adapt it to the privacypreserving context.Specifically, to construct our privacy-preserving clustering algorithm, we first propose an efficient batched Euclidean squared distance computation protocol in the amortizing setting, when one needs to compute the distance from the same point to other points. Furthermore, we construct a customized garbled circuit for computing the minimum value among shared values.We believe these new constructions may be of independent interest. We implement and evaluate our protocols to demonstrate their practicality and show that they are able to train datasets that are much larger and faster than in the previous work. The numerical results also show that the proposed protocol achieve almost the same accuracy compared to a K-means plain-text clustering algorithm.

Lightweight privacy-Preserving data classification

Internal attacks are of a huge concern, because they are usually delicately masqueraded under harmless-looking activities, which are very difficult to detect. Machine learning techniques have been successfully applied to identify insider threats. However, they may violate user privacy since they can legally access user’s sensitive information. To preserve user privacy, encryption algorithms have been lately exploited as a powerful tool, to hide private data in a multiple-party collaboration. A combination of encryption and data mining techniques raises high computational complexity. Hence, in order to improve the system’s performance while securing both user’s private data and the classifier, we propose a new secure data analysis protocol, namely SmartClass, by adopting the garbled circuit technique to speed-up the system performance. We developed an efficient encryption step that exploits the additive homomorphism and best properties of the binary Elliptic Curve Cryptography (ECC) algorithm, while keeping the protocol highly secure. We implemented the proposed system and study its effectiveness. Experimental results show the proposed approach is very promising.

Efficient Server-Aided Secure Two-Party Computation in Heterogeneous Mobile Cloud Computing

With the ubiquity of mobile devices and rapid development of cloud computing, mobile cloud computing (MCC) has been considered as an essential computation setting to support complicated, scalable and flexible mobile applications by overcoming the physical limitations of mobile devices with the aid of cloud. In the MCC setting, since many mobile applications (e.g., map apps) interacting with cloud server and application server need to perform computation with the private data of users, it is important to realize secure computation for MCC. In this article, we propose an efficient server-aided secure two-party computation (2PC) protocol for MCC. This is the first work that considers collusion between a malicious garbled circuit evaluator and a semi-honest server while ensuring privacy and correctness. Also, it can guarantee fairness when collusion does not exist. The security analysis shows that our protocol can securely compute any function f(x, y) against different types of adversaries in the malicious model. Also, the experimental performance analysis shows that this work outperforms the previous works for at least 10 times with the same security level.

SIFO: Secure Computational Infrastructure Using FPGA Overlays

Secure Function Evaluation (SFE) has received recent attention due to the massive collection and mining of personal data, but remains impractical due to its large computational cost. Garbled Circuits (GC) is a protocol for implementing SFE which can evaluate any function that can be expressed as a Boolean circuit and obtain the result while keeping each party’s input private. Recent advances have led to a surge of garbled circuit implementations in software for a variety of different tasks. However, these implementations are inefficient, and therefore GC is not widely used, especially for large problems. This research investigates, implements, and evaluates secure computation generation using a heterogeneous computing platform featuring FPGAs. We have designed and implemented SIFO: secure computational infrastructure using FPGA overlays. Unlike traditional FPGA design, a coarse-grained overlay architecture is adopted which supports mapping SFE problems that are too large to map to a single FPGA. Host tools provided include SFE problem generator, parser, and automatic host code generation. Our design allows repurposing an FPGA to evaluate different SFE tasks without the need for reprogramming and fully explores the parallelism for any GC problem. Our system demonstrates an order of magnitude speedup compared with an existing software platform.

Practical card-based implementations of Yao's millionaire protocol

Yao's millionaire protocol enables Alice and Bob to know whether or not Bob is richer than Alice by using a public-key cryptosystem without revealing the actual amounts of their properties. In this paper, we present simple and practical implementations of Yao's millionaire protocol using a physical deck of playing cards; we straightforwardly implement the idea behind Yao's millionaire protocol so that even non-experts can easily understand their correctness and secrecy. Our implementations are based partially on the previous card-based scheme proposed by Nakai, Tokushige, Misawa, Iwamoto, and Ohta; their scheme admits players' private actions on a sequence of cards called Private Permutation (PP), implying that a malicious player could make an active attack (for example, he/she could exchange some of the cards stealthily when doing such a private action). By contrast, our implementations rely on a familiar shuffling operation called a random cut, and hence, they can be conducted completely publicly so as to avoid any active attack. More specifically, we present two card-based implementations of Yao's millionaire protocol; one uses a two-colored deck of cards (which consists of black and red cards), and the other uses a standard deck of playing cards. Furthermore, we also provide card-based protocols that rely on a logical circuit representing the comparison.

A Secure High-Order Lanczos-Based Orthogonal Tensor SVD for Big Data Reduction in Cloud Environment

Singular value decomposition (SVD) has been applied to cyber security and cyber forensics since it can reduce data. However, SVD is hard to reduce high-order big data because it is designed for only matrix data initially. Reducing high-order big data is desired for cyber security applications, and is a very challenging issue. In this paper, we propose a novel orthogonal tensor SVD method using big data techniques for high-order big data (naturally represented as tensors) reduction, which can be extensively used in big data applications of cyber security and cyber forensics. More specifically, we first present a high-order lanczos-based orthogonal tensor SVD algorithm to reduce high-order data. Then, for utilizing the incomparable benefits of cloud, we develop a secure orthogonal tensor SVD method to outsource the computation task of the orthogonal tensor SVD algorithm to cloud. The secure orthogonal tensor SVD method can protect data security from untrusted cloud by applying garbled circuits to the orthogonal tensor SVD algorithm. This is, to our best knowledge, the first work to address high-order big data reduction by employing cloud computing. Finally, we analyze the security and efficiency of our proposed orthogonal tensor SVD on synthetic dataset and real network intrusion detection dataset, and the results demonstrate that our proposed method is very promising for big data reduction.

&lt;italic&gt;pRide&lt;/italic&gt;: Privacy-Preserving Ride Matching Over Road Networks for Online Ride-Hailing Service

An online ride-hailing (ORH) service, such as Uber and Didi Chuxing, can provide on-demand transportation service to users via mobile phones, which brings great convenience to people's daily lives. Along with the convenience, high privacy concerns are also raised when using an ORH service since users and drivers must share their real-time locations with the ORH server, which results in the leakage of the mobility patterns and additional privacy of users and drivers. In this paper, we propose a privacy-preserving ride-matching scheme, called pRide, for ORH service. pRide allows an ORH server to efficiently match rider and drivers based on their distances in the road network without revealing the location privacy of riders and drivers. Specifically, we make use of the road network embedding technique together with cryptographic primitives and design a scheme to securely and efficiently estimate the shortest distances between riders and drivers in road networks approximately. Moreover, by incorporating garbled circuits, the proposed scheme is able to output the nearest driver around a rider. We implement the scheme and evaluate it on the representative real-world datasets. The theoretical analysis and experimental results demonstrate that pRide achieves an efficient, secure, and yet accurate ride matching for ORH service.

SecureNN: 3-Party Secure Computation for Neural Network Training

Abstract Neural Networks (NN) provide a powerful method for machine learning training and inference. To effectively train, it is desirable for multiple parties to combine their data – however, doing so conflicts with data privacy. In this work, we provide novel three-party secure computation protocols for various NN building blocks such as matrix multiplication, convolutions, Rectified Linear Units, Maxpool, normalization and so on. This enables us to construct three-party secure protocols for training and inference of several NN architectures such that no single party learns any information about the data. Experimentally, we implement our system over Amazon EC2 servers in different settings. Our work advances the state-of-the-art of secure computation for neural networks in three ways: 1. Scalability: We are the first work to provide neural network training on Convolutional Neural Networks (CNNs) that have an accuracy of &gt; 99% on the MNIST dataset; 2. Performance: For secure inference, our system outperforms prior 2 and 3-server works (SecureML, MiniONN, Chameleon, Gazelle) by 6×-113× (with larger gains obtained in more complex networks). Our total execution times are 2 − 4× faster than even just the online times of these works. For secure training, compared to the only prior work (SecureML) that considered a much smaller fully connected network, our protocols are 79× and 7× faster than their 2 and 3-server protocols. In the WAN setting, these improvements are more dramatic and we obtain an improvement of 553×! 3. Security: Our protocols provide two kinds of security: full security (privacy and correctness) against one semi-honest corruption and the notion of privacy against one malicious corruption [Araki et al. CCS’16]. All prior works only provide semi-honest security and ours is the first system to provide any security against malicious adversaries for the secure computation of complex algorithms such as neural network inference and training. Our gains come from a significant improvement in communication through the elimination of expensive garbled circuits and oblivious transfer protocols.

Universal gates on garbled circuit construction

SummaryEfficient garbled circuit construction can lead to more practical secure computation protocols. Garbled circuit construction has been considered as a separate goal for optimization as efficiency of the secure computation protocol is directly related to the efficiency of garbled circuit construction. Various optimizations such as, point‐and‐permute technique, free‐XOR, garbled row reduction, and dual‐key cipher are proved to make the garbled circuit construction efficient. In this paper, we propose garbled circuit construction with the universal gates; for demonstration purpose, we have considered NOR gates and shown optimization on circuit construction in two models. By the use of single type of gate, the gate array in the circuit representation is eliminated and a constant value is used in protocols. In addition, we have reduced the number of rows in garbled table to two rows per gate with two or zero encryption calls during garbled circuit construction and two or zero decryption calls during evaluation of garbled circuit.

MEG: Memory and Energy Efficient Garbled Circuit Evaluation on Smartphones

Garbled circuits are general tools that allow two parties to compute any function without disclosing their respective inputs. Applications of this technique vary from distributed privacy-preserving machine learning tasks to secure outsourced authentication. Unfortunately, the energy cost of garbled circuit evaluation protocols is substantial. This limits the applicability of garbled circuits in scenarios that involve battery-operated devices, such as Internet-of-Things (IoT) devices and smartphones. In this paper, we propose MEG, a Memory- and Energy-efficient Garbled circuit evaluation mechanism. MEG utilizes batch data transmission and multi-threading to reduce memory and energy consumption. We implement MEG on an Android smartphone and compare its performance and energy consumption with state-of-the-art techniques using two garbled circuits of widely different sizes (AES-128 and 256-bit edit distance). Our results show that, compared with “plain” garbled circuit evaluation, MEG decreases memory consumption by more than 90%. When compared with current pipelined garbled circuit evaluation techniques, MEG’s energy usage was 42% lower for AES-128 and 23% lower for EDT-256. Furthermore, our multi-thread implementation of MEG decreased circuit evaluation time by up to 56.7% for AES-128, and by up to 13.5% for EDT-256, compared with state-of-the-art pipelining techniques.

Private Evaluation of Decision Trees using Sublinear Cost

Abstract Decision trees are widespread machine learning models used for data classification and have many applications in areas such as healthcare, remote diagnostics, spam filtering, etc. In this paper, we address the problem of privately evaluating a decision tree on private data. In this scenario, the server holds a private decision tree model and the client wants to classify its private attribute vector using the server’s private model. The goal is to obtain the classification while preserving the privacy of both – the decision tree and the client input. After the computation, only the classification result is revealed to the client, while nothing is revealed to the server. Many existing protocols require a constant number of rounds. However, some of these protocols perform as many comparisons as there are decision nodes in the entire tree and others transform the whole plaintext decision tree into an oblivious program, resulting in higher communication costs. The main idea of our novel solution is to represent the tree as an array. Then we execute only d – the depth of the tree – comparisons. Each comparison is performed using a small garbled circuit, which output secret-shares of the index of the next node. We get the inputs to the comparison by obliviously indexing the tree and the attribute vector. We implement oblivious array indexing using either garbled circuits, Oblivious Transfer or Oblivious RAM (ORAM). Using ORAM, this results in the first protocol with sub-linear cost in the size of the tree. We implemented and evaluated our solution using the different array indexing procedures mentioned above. As a result, we are not only able to provide the first protocol with sublinear cost for large trees, but also reduce the communication cost for the large real-world data set “Spambase” from 18 MB to 1[triangleright]2 MB and the computation time from 17 seconds to less than 1 second in a LAN setting, compared to the best related work.

P3

This article presents the first privacy-preserving localization method based on provably secure primitives for smart automotive systems. Using this method, a car that is lost due to unavailability of GPS can compute its location with assistance from three nearby cars, while the locations of all the participating cars including the lost car remain private. Technological enhancement of modern vehicles, especially in navigation and communication, necessitates parallel enhancement in security and privacy. Previous approaches to maintaining user location privacy suffered from one or more of the following drawbacks: trade-off between accuracy and privacy, one-sided privacy, and the need of a trusted third party that presents a single point to attack. The localization method presented here is one of the very first location-based services that eliminates all these drawbacks. Two protocols for computing the location is presented here based on two Secure Function Evaluation (SFE) techniques that allow multiple parties to jointly evaluate a function on inputs that are encrypted to maintain privacy. The first one is based on the two-party protocol named Yao’s Garbled Circuit (GC). The second one is based on the Beaver-Micali-Rogaway (BMR) protocol that allows inputs from more than two parties. The two secure localization protocols exhibit trade-offs between performance and resilience against collusion. Along with devising the protocols, we design and optimize netlists for the functions required for location computation by leveraging conventional logic synthesis tools with custom libraries optimized for SFE. Proof-of-concept implementation of the protocol shows that the complete operation can be performed within only 355ms. The fast computing time enables localization of even moving cars.

ReDCrypt

Artificial Intelligence (AI) is increasingly incorporated into the cloud business in order to improve the functionality (e.g., accuracy) of the service. The adoption of AI as a cloud service raises serious privacy concerns in applications where the risk of data leakage is not acceptable. Examples of such applications include scenarios where clients hold potentially sensitive private information such as medical records, financial data, and/or location. This article proposes ReDCrypt, the first reconfigurable hardware-accelerated framework that empowers privacy-preserving inference of deep learning models in cloud servers. ReDCrypt is well-suited for streaming (a.k.a., real-time AI) settings where clients need to dynamically analyze their data as it is collected over time without having to queue the samples to meet a certain batch size. Unlike prior work, ReDCrypt neither requires to change how AI models are trained nor relies on two non-colluding servers to perform. The privacy-preserving computation in ReDCrypt is executed using Yao’s Garbled Circuit (GC) protocol. We break down the deep learning inference task into two phases: (i) privacy-insensitive (local) computation, and (ii) privacy-sensitive (interactive) computation. We devise a high-throughput and power-efficient implementation of GC protocol on FPGA for the privacy-sensitive phase. ReDCrypt’s accompanying API provides support for seamless integration of ReDCrypt into any deep learning framework. Proof-of-concept evaluations for different DL applications demonstrate up to 57-fold higher throughput per core compared to the best prior solution with no drop in the accuracy.

Scalable Secure Privacy-Preserving Record Linkage (PPRL) Methods Using Cloud-based Infrastructure

IntroductionBloom Filters (BFs) are a scalable solution for probabilistic privacy-preserving record linkage but BFs can be compromised. Yao’s garbled circuits (GCs) can perform secure multi-party computation to compute the similarity of two BFs without a trusted third party. The major drawback of using BFs and GCs together is poor efficiency.&#x0D; Objectives and ApproachWe evaluated the feasibility of BFs+GCs using high capacity compute engines and implementing a novel parallel processing framework in Google Cloud Compute Engines (GCCE). In the Yao’s two-party secure computation protocol, one party serves as the generator and the other party serves as the evaluator. To link data in parallel, records from both parties are divided into chunks. Linkage between every two chunks in the same block is processed by a thread. The number of threads for linkage depends on available computing resources. We tested the parallelized process in various scenarios with variations in hardware and software configurations.&#x0D; ResultsTwo synthetic datasets with 10K records were linked using BFs+GCs on 12 different software and hardware configurations which varied by: number of CPU cores (4 to 32), memory size (15GB – 28.8GB), number of threads (6-41), and chunk size (50-200 records). The minimum configuration (4 cores; 15GB memory) took 8,062.4s to complete whereas the maximum configuration (32 cores; 28.8GB memory) took 1,454.1s. Increasing the number of threads or changing the chunk size without providing more CPU cores and memory did not improve the efficiency. Efficiency is improved on average by 39.81% when the number of cores and memory on the both sides are doubled. The CPU utilization is maximized (near 100% on both sides) when the computing power of the generator is double the evaluator.&#x0D; Conclusion/ImplicationsThe PPRL runtime of BFs+GCs was greatly improved using parallel processing in a cloud-based infrastructure. A cluster of GCCEs could be leveraged to reduce the runtime of data linkage operations even further. Scalable cloud-based infrastructures can overcome the trade-off between security and efficiency, allowing computationally complex methods to be implemented.

Privacy-preserving ridge regression on distributed data

Ridge regression is a statistical method for modeling a linear relationship between a dependent variable and some explanatory values. It is a building-block that plays a major role in many learning algorithms such as recommendation systems. However, in many applications such as e-health, explanatory values contains private information owned by different patients that are not willing to share them, unless data privacy is guaranteed. In this paper, we propose a protocol for conducting privacy-preserving ridge regression (PPRR) over high-dimensional data. In our protocol, each user submits its data in an encrypted form to an evaluator and the evaluator computes a linear model of all users’ data without learning their contents. The core encryption method is equipped with homomorphic properties to enable the evaluator to perform ridge regression over encrypted data. We implement our protocol and demonstrate that it is suitable for dealing with high-dimensional data distributed among millions of users. We also compare our protocol with the state-of-the-art solutions in terms of both computation and communication costs. The results show that our protocol outperforms most existing approaches based on secure multi-party computation, garbled circuit, fully homomorphic encryption, secret-sharing, and hybrid methods.

PAL: A pseudo assembly language for optimizing secure function evaluation in mobile devices

Secure function evaluation (SFE) on mobile devices, such as smartphones, allows for the creation of compelling new privacy-preserving applications. Generating garbled circuits on smartphones to allow for executing customized functions, however, is infeasible for all but the most trivial problems due to the high memory overhead incurred. We develop a new methodology of generating garbled circuits that is memory-efficient. Using the standard language (SFDL) for describing secure functions as input, we design a new pseudo-assembly language (PAL) and a template-driven compiler, generating circuits that can be evaluated with the canonical Fairplay framework. We deploy this compiler for Android devices and demonstrate that a large new set of circuits can now be generated on smartphones, with memory overhead to generate circuits solving the set intersection problem reduced by 95.6% for the 2-set case. We show our compiler’s ability to interface with other execution systems and perform mobile phone specific optimizations on that execution system. We develop a password vault application to show how runtime generation of circuits can be used in practice. We also show that our circuit generation techniques can be used in conjunction with other SFE optimizations. These results demonstrate the feasibility of generating garbled circuits on mobile devices while maintaining the convenience of high-level function specification.