GPU and CPU Parallelization of Honest-but-Curious Secure Two-Party Computation

1. GPU and CPU Parallelization of Honest-but-Curious Secure Two-Party Computation Nathaniel Husted, Steve Myers, abhishelat, Paul Grubbs

2. Alice and Bob want to compute a public function of their private inputs. Secure Two-party Computation Disease Database Alice Bob

3. Secure Two-party Computation Alice Bob Y X => Alice & Bob F(X,Y) Alice provides X. Bob provides Y. F(X,Y) is correctly calculated without Bob learning X and Alice learning Y.

4. Yao’s Garbled Circuits [Yao1986] X XOR 0 OUTPUTS Y XOR 1 0 F(X,Y) AND 2 OR 4 AND 3

5. I’m going to discuss the current fastest solution for processing Yao’s Garbled Circuits.

6. Yao’s Garbled Circuits [Yao1986] X XOR 0 OUTPUTS Y XOR 1 0 F(X,Y) = X + Y AND 2 OR 4 AND 3

7. Wires in Yao’s Garbled Circuits [Yao1986] • Alice must use randomlabels () for wire values instead of 0’s and 1’s. Label 0 () Wire 0 () Label 1 ()

8. Yao’s Garbled Circuits [Yao1986] F(X,Y) = X + Y X XOR 0 OUTPUTS 0xCC1C Y XOR 1 Label 0 = 0xF1F1 0x1112 0x1212 Label 1 = 0xABAB 0 0x1234 AND 2 0xFFCC OR 4 0x1203 0x93FA 0x8843 0x1103 0x4321 0xBA81 AND 3 0x9932 0x6753 0x9B3F

9. Encrypting Gates in Yao’s Garbled Circuits [Yao1986] Gate 2 () AND

10. Encrypting Gates in Yao’s Garbled Circuits [Yao1986] • Notation shortcut: = Gate 2 () AND

11. Garbling Gates in Yao’s Garbled Circuits [Yao1986] Gate 2 () AND

12. Garbling Gates in Yao’s Garbled Circuits [Yao1986] Gate 2 () AND

13. Garbling Gates in Yao’s Garbled Circuits [Yao1986] Gate 2 () AND

14. Yao’s Garbled Circuits [Yao1986] F(X,Y) = X + Y X XOR 0 OUTPUTS 0xCC1C Y XOR 1 Label 0 = 0xF1F1 0x1112 0x1212 Label 1 = 0xABAB 0 0x1234 AND 2 0xFFCC OR 4 0x1203 0x93FA 0x8843 0x1103 0x4321 0xBA81 AND 3 0x9932 0x6753 0x9B3F

15. Alice sends the generated circuit to Bob. • Alice sends ALL garbled truth tables to Bob. • BOB Sent over the network… • ALICE

16. Bob evaluates the circuit. • Evaluation is the reverse of generation. Gate 3 () AND = 0xCC1C = 0x1 = ?? = 0x1234 = 0x0

17. Bob evaluates the circuit. • Evaluation is the reverse of generation. Gate 3 () AND = 0xCC1C = 0x1 ENTRY TO DECODE = ?? = 0x1234 = 0x0

18. Bob evaluates the circuit. • Evaluation is the reverse of generation. Gate 3 () AND = 0xCC1C = 0x1 ENTRY TO DECODE = ?? = 0x1234 = 0x0

19. Other security models for Yao’s Garbled Circuits • Malicious-Leaks-A-Bit [Huang2013] • Benefits: • Attacker can analyze results and lie in the protocol. • Only requires one extra Generation and Evaluation. • Drawbacks: • Leaks 1-bit of output. • Fully Malicious [Lindell2013] • Benefits: • Leaks no information to the attacker. • Drawbacks • Requires Alice generate between 60 – 130 circuits. Bob must evaluate ~1/2 and verify the rest. • NOTE: Our methods can work with either of these models!

20. Brief survey of garbled circuit systems

21. Contributions to Garbled Circuit Optimization • A method for accurately comparing garbled circuit systems with very different circuit formats. • A method for generating all gates in a circuit at once. • A method for reducing the number of calculations for each gate garbling. • A scalable generation method that can be combined with other best-in-class implementations.

22. Fast Garbled Circuit Processing With GPUs • GPUs are highly parallel Single Instruction Multiple Data (SIMD) processors. • We can use every “core” on the GPU to process a gate. • But the SIMD parallelism requires protocol modifications.

23. Generating all gates at once allows high through-put but requires protocol modification. • The Free XOR Technique [Kolesnikov2008] Gate 0 () XOR Label 0 () Label 1 () = Gate 2 () AND = : Randomly Generated Constant

24. Generating all gates at once allows high through-put but requires protocol modification. • Our modified Free XOR technique Gate 0 () XOR Label 0 () Label 1 () = Gate 2 () AND = : Randomly Generated Constant

25. Benefits of increased Throughput

26. Garbling Truth Tables in practice Gate 2 () AND

27. Reducing calculations required per-gate provided benefits over other GPU systems. • But recall there are three wires for every gate in the circuit…

28. Inputs and Outputs of SHA1 Buckets holding inputs: 4 … 16 1 2 3 15 Buckets holding algorithm state: E D B A C

29. Pre-computing SHA1 intermediate values Inputs for random wire values: Seed … 0x0 … Wire ID Seed Seed Seed Wire ID

30. Pre-computing SHA1 intermediate values Buckets holding inputs: Seed … 0x0 … Wire ID Seed Seed Seed Wire ID Only buckets used during the first 14 rounds. = Common for all Wires

31. Benefits of SHA1 pre-computation

32. Current and On-Going Work • Now implement the PCF2 circuit format developed by Kreuter et al. • Working on additional circuit optimizations on top of those provided by the PCF2 compiler. • Provide a full scale solution from honest-but-curious to fully malicious processing. • Multiple GPUs • Super computers • Experiments and source code are available upon request.

33. Questions?

34. Extra Slide Matter

35. Using GPUs we show the fastest single machine garbled circuit generator • XOR Gates: ~ 60.2 Million Gates Per Second • TT Gates: ~34.1 Million Gates Per Second

36. 1. Alice will generate the Yao’s circuit. • Alice must construct the circuit using a series of Boolean gates with two input wires and one output wire. • Each gate has a serial number and garbled truth table. Gate 0 () AND

37. Wires in Yao’s Garbled Circuits [Yao1986] • Alice must use randomlabels () for wire values instead of 0’s and 1’s. • Alice must use permutation bits (p-bits; ) to signify the label choice. P-bit 0 () = 0x1 Label 0 () = 0xA1B2 Wire 0 () Label 1 () = 0x192F P-bit 1 () = 0x0

38. Encrypting Gates in Yao’s Garbled Circuits [Yao1986] • How Alice creates garbled truth tables in two steps • Step 1: Create Encrypted Truth Table Gate 2 () AND = 0xA1B2 = 0x0 = 0x192F = 0x1

39. Encrypting Gates in Yao’s Garbled Circuits [Yao1986] • How Alice creates garbled truth tables in two steps • Step 1: Create Encrypted Truth Table Gate 2 () AND = 0xA1B2 = 0x0 STEP 1 OUTPUT = 0x192F = 0x1

40. Encrypting Gates in Yao’s Garbled Circuits [Yao1986] • How Alice creates garbled truth tables in two steps • Step 1: Create Encrypted Truth Table Gate 1 () XOR

41. Encrypting Gates in Yao’s Garbled Circuits [Yao1986] • How Alice creates garbled truth tables in two steps • Step 1: Create Encrypted Truth Table Gate 4 () OR

42. A basic overview of the Yao’s protocol • Assumptions: • Security Model: Honest but Curious • Process: • Alice will generate the Yao’s circuit. • Alice sends the generated circuit to Bob. • Bob will use Oblivious Transfer to learn Alice’s inputs. • Bob will evaluate the circuit. • Bob sends the output to Alice

43. Yao’s Garbled Circuits under an Honest-but-Curious Security Model • Alice generates wire labels and garbled truth tables for all wires and gates in a circuit. • Alice sends the garbled truth tables to Bob. • Bob obtains Alice’s input using Oblivious Transfer. • Bob evaluates the circuit. • Bob sends output to Alice. Both party can analyze data t all steps of this protocol but must perform all steps.

44. Bob performs Oblivious Transfer to obtain Alice’s Inputs Oblivious Transfer Bob Alice

45. So how fast can we process garbled circuits? • XOR Gates: ~ 60.2 Million Gates Per Second • TT Gates: ~34.1 Million Gates Per Second