GPU and CPU Parallelization of Honest-but-Curious Secure

Two-Party ComputationNathaniel Husted, Steve Myers, abhi shelat, Paul Grubbs

Alice and Bob want to compute a public function of their private inputs.

Secure Two-party Computation

Disease Database

Alice Bob

Secure Two-party Computation

F(X,Y)

Alice Bob

=> Alice & Bob

X Y

Alice provides X. Bob provides Y. F(X,Y) is correctly calculated without Bob learning X and Alice learning Y.

Yao’s Garbled Circuits [Yao1986]

XOR 1

AND 2

AND 3

OR 4

XOR 0X

OUTPUTS

Y

0

F(X,Y)

I’m going to discuss the current fastest solution for processing Yao’s Garbled Circuits.

Yao’s Garbled Circuits [Yao1986]

XOR 1

AND 2

AND 3

OR 4

XOR 0X

OUTPUTS

Y

0

F(X,Y) = X + Y

Wires in Yao’s Garbled Circuits [Yao1986]• Alice must use random labels () for wire values instead of 0’s and 1’s.

Label 0 () Wire 0 ()Label 1 ()

Yao’s Garbled Circuits [Yao1986]

XOR 1

AND 2

AND 3

OR 4

XOR 0

OUTPUTS

Label 0 = 0xF1F1 Label 1 = 0xABAB

0x43210x9932

0x67530x9B3F

0x12120x1234

0x93FA0x8843

0xFFCC0x1203

0xCC1C0x1112

X

Y

0

0x1103

0xBA81

F(X,Y) = X + Y

Encrypting Gates in Yao’s Garbled Circuits [Yao1986]

Gate 2 ()AND𝑊 0

𝑊 1

𝑊 2

AND GATE

Output

Encrypting Gates in Yao’s Garbled Circuits [Yao1986]• Notation shortcut: =

Gate 2 ()AND𝑊 0

𝑊 1

𝑊 2

AND GATE

Output

Garbling Gates in Yao’s Garbled Circuits [Yao1986]

Gate 2 ()AND𝑊 0

𝑊 1

𝑊 2

AND GATEEncrypted Entry

0,0

0,1

1,0

1,1

Garbling Gates in Yao’s Garbled Circuits [Yao1986]

Gate 2 ()AND𝑊 0

𝑊 1

𝑊 2

AND GATEEncrypted Entry

0,0

0,1

1,0

1,1

Garbling Gates in Yao’s Garbled Circuits [Yao1986]

Gate 2 ()AND𝑊 0

𝑊 1

𝑊 2

AND GATEEncrypted Entry

0,0

0,1

1,0

1,1

Yao’s Garbled Circuits [Yao1986]

XOR 1

AND 2

AND 3

OR 4

XOR 0

OUTPUTS

Label 0 = 0xF1F1 Label 1 = 0xABAB

0x43210x9932

0x67530x9B3F

0x12120x1234

0x93FA0x8843

0xFFCC0x1203

0xCC1C0x1112

X

Y

0

0x1103

0xBA81

F(X,Y) = X + Y

OR GATE

Output

Alice sends the generated circuit to Bob.• Alice sends ALL garbled truth tables to Bob.

XOR GATEEncrypted Entry

0,0

0,1

1,0

1,1

XOR GATEEncrypted Entry

0,0

0,1

1,0

1,1

AND GATEEncrypted Entry

0,0

0,1

1,0

1,1

OR GATEEncrypted Entry

0,0

0,1

1,0

1,1

Sent over the network…BOB

ALICE

AND GATE

Encrypted Entry

0,0

0,1

1,0

1,1

Bob evaluates the circuit.• Evaluation is the reverse of generation.

Gate 3 ()AND𝑊 0

𝑊 1

𝑊 2

𝜆2❑=? ?= ??

= 0xCC1C

= 0x1234 = 0x0

= 0x1

AND GATEEncrypted Entry

0,0

0,1

1,0

1,1

Bob evaluates the circuit.• Evaluation is the reverse of generation.

Gate 3 ()AND𝑊 0

𝑊 1

𝑊 2

𝜆2❑=? ?= ??

= 0xCC1C

= 0x1234 = 0x0

= 0x1

AND GATEEncrypted Entry

0,0

0,1

1,0

1,1ENTRY TO DECODE

Bob evaluates the circuit.• Evaluation is the reverse of generation.

Gate 3 ()AND𝑊 0

𝑊 1

𝑊 2

𝜆2❑=? ?= ??

= 0xCC1C

= 0x1234 = 0x0

= 0x1

AND GATEEncrypted Entry

0,0

0,1

1,0

1,1

ENTRY TO DECODE

Other security models for Yao’s Garbled Circuits• Malicious-Leaks-A-Bit [Huang2013]

• Benefits:• Attacker can analyze results and lie in the protocol.• Only requires one extra Generation and Evaluation.

• Drawbacks:• Leaks 1-bit of output.

• Fully Malicious [Lindell2013]• Benefits:

• Leaks no information to the attacker.• Drawbacks

• Requires Alice generate between 60 – 130 circuits. Bob must evaluate ~1/2 and verify the rest.

• NOTE: Our methods can work with either of these models!

Brief survey of garbled circuit systems

CPU Based?

GPUBased?

OT Extension?

Parallel? Bottleneck Security Model

Our Work Yes* Yes Yes* Yes Communication Honest-but-curious,malicious leaks a bit,(Fully Malicious)

Huang et al. Yes No Yes No Processing Honest-but-curious, malicious leaks a bit

Kreuter et al.[Kreuter2013]

Yes No Yes Super computers Communication Fully Malicious

Frederiksen et al. [Frederiksen201]

No Yes Yes* Single GPUs Communication Fully Malicious

Contributions to Garbled Circuit Optimization1. A method for accurately comparing garbled circuit systems with

very different circuit formats.2. A method for generating all gates in a circuit at once.3. A method for reducing the number of calculations for each gate

garbling.4. A scalable generation method that can be combined with other

best-in-class implementations.

Fast Garbled Circuit Processing With GPUs• GPUs are highly parallel Single Instruction Multiple Data (SIMD)

processors.• We can use every “core” on the GPU to process a gate. • But the SIMD parallelism requires protocol modifications.

• The Free XOR Technique [Kolesnikov2008]

Label 0 ()

Generating all gates at once allows high through-put but requires protocol modification.

Gate 0 ()XOR

Label 1 () =

=

𝜆20=𝜆00⨁ 𝜆10

𝜆21=𝜆00⨁ 𝜆10⨁𝑅

: Randomly Generated Constant

Gate 2 ()AND

• Our modified Free XOR technique

Label 0 ()

Generating all gates at once allows high through-put but requires protocol modification.

Gate 0 ()XOR

Label 1 () =

=

𝜆20

𝜆21=𝜆20⨁𝑅

: Randomly Generated Constant

XOR Offset Gate 2 ()AND

Benefits of increased Throughput

Benchmarking Machines

Name CPU GPU

Tie (DARPA) Tesla K200.71 Ghz

EC2 (Amazon) Tesla S20501.15 Ghz

Kreuter et al. Xenon E55062.13 Ghz

Garbling Truth Tables in practice

Gate 2 ()AND𝑊 0

𝑊 1

𝑊 2

AND GATE GARBLED TRUTH TABLEEncrypted Entry

0,0 SHA1

0,1 SHA1

1,0

1,1 SHA1

Reducing calculations required per-gate provided benefits over other GPU systems.

• But recall there are three wires for every gate in the circuit…

SHA1 CountsRandom Wire Label (per wire) 1 SHA1

Garbled Truth Table 4 SHA1

XOR Offset 0 SHA1

Inputs and Outputs of SHA1

1 2 3 … 15 16

A B C D E

Buckets holding inputs:

Buckets holding algorithm state:

4

Pre-computing SHA1 intermediate values

Seed Seed Seed … 0x0 … Wire ID Wire ID

Inputs for random wire values:Seed

Pre-computing SHA1 intermediate values

Seed Seed Seed … 0x0 … Wire ID Wire ID

Buckets holding inputs:Seed

Only buckets used during the first 14 rounds.

= Common for all Wires

Benefits of SHA1 pre-computation

Benchmarking MachinesName GPU GPU Cores

Tie (DARPA) Tesla K200.71 Ghz

2496

EC2 (Amazon) Tesla S20501.15 Ghz

448

Current and On-Going Work• Now implement the PCF2 circuit format developed by Kreuter et al.• Working on additional circuit optimizations on top of those provided

by the PCF2 compiler.• Provide a full scale solution from honest-but-curious to fully malicious

processing.• Multiple GPUs• Super computers

• Experiments and source code are available upon request.

Questions?

Extra Slide Matter

Using GPUs we show the fastest single machine garbled circuit generator• XOR Gates: ~ 60.2 Million Gates Per Second• TT Gates: ~34.1 Million Gates Per Second

1. Alice will generate the Yao’s circuit.• Alice must construct the circuit using a series of Boolean gates with

two input wires and one output wire.• Each gate has a serial number and garbled truth table.

Gate 0 ()

AND

𝑊 0

𝑊 1

𝑊 2

Wires in Yao’s Garbled Circuits [Yao1986]• Alice must use random labels () for wire values instead of 0’s and 1’s.• Alice must use permutation bits (p-bits; ) to signify the label choice.

Label 0 () = 0xA1B2

P-bit 0 () = 0x1

Wire 0 ()Label 1 () = 0x192F

P-bit 1 () = 0x0

Encrypting Gates in Yao’s Garbled Circuits [Yao1986]• How Alice creates garbled truth tables in two steps• Step 1: Create Encrypted Truth Table

Gate 2 ()AND𝑊 0

𝑊 1

𝑊 2

AND GATE

Serial #: 2= 0xA1B2 = 0x1

= 0x192F = 0x0

= 0x428F = 0x0

= 0xADC1 = 0x1

= 0xA1B2

= 0x192F= 0x0

= 0x1

Encrypting Gates in Yao’s Garbled Circuits [Yao1986]• How Alice creates garbled truth tables in two steps• Step 1: Create Encrypted Truth Table

Gate 2 ()AND𝑊 0

𝑊 1

𝑊 2

AND GATE

Serial #: 2= 0xA1B2 = 0x1

= 0x192F = 0x0

= 0x428F = 0x0

= 0xADC1 = 0x1

= 0xA1B2

= 0x192F= 0x0

= 0x1

STEP 1 OUTPUT

Encrypting Gates in Yao’s Garbled Circuits [Yao1986]• How Alice creates garbled truth tables in two steps• Step 1: Create Encrypted Truth Table

Gate 1 ()XOR𝑊 0

𝑊 1

𝑊 2

XOR GATE

Output

Encrypting Gates in Yao’s Garbled Circuits [Yao1986]• How Alice creates garbled truth tables in two steps• Step 1: Create Encrypted Truth Table

Gate 4 ()OR𝑊 0

𝑊 1

𝑊 2

OR GATE

Output

A basic overview of the Yao’s protocol• Assumptions:• Security Model: Honest but Curious

• Process:1. Alice will generate the Yao’s circuit.2. Alice sends the generated circuit to Bob.3. Bob will use Oblivious Transfer to learn Alice’s inputs.4. Bob will evaluate the circuit.5. Bob sends the output to Alice

Yao’s Garbled Circuits under an Honest-but-Curious Security Model1. Alice generates wire labels and garbled truth tables for all wires and

gates in a circuit.2. Alice sends the garbled truth tables to Bob.3. Bob obtains Alice’s input using Oblivious Transfer.4. Bob evaluates the circuit.5. Bob sends output to Alice.

Both party can analyze data t all steps of this protocol but must perform all steps.

Bob performs Oblivious Transfer to obtain Alice’s Inputs

Oblivious TransferAlice Bob

𝑆0

𝑆1

𝑆𝑎

So how fast can we process garbled circuits?• XOR Gates: ~ 60.2 Million Gates Per Second• TT Gates: ~34.1 Million Gates Per Second