TY - JOUR
T1 - Encoding functions with constant online rate, or how to compress garbled circuit keys
AU - Applebaum, Benny
AU - Ishai, Yuval
AU - Kushilevitz, Eyal
AU - Waters, Brent
N1 - Publisher Copyright:
© 2015 Society for Industrial and Applied Mathematics.
PY - 2015
Y1 - 2015
N2 - Randomized encodings of functions can be used to replace a "complex" function f(x) by a "simpler" randomized mapping f (x;r) whose output distribution on an input x encodes the value of f(x) and hides any other information about x. One desirable feature of randomized encodings is low online complexity. That is, the goal is to obtain a randomized encoding f of f in which most of the output can be precomputed and published before seeing the input x. When the input x is available, it remains to publish only a short string x, where the online complexity of computing x is independent of (and is typically much smaller than) the complexity of computing f. Yao's garbled circuit construction gives rise to such randomized encodings in which the online part x consists of n encryption keys of length κ each, where n = |x| and κ is a security parameter. Thus, the online rate |x|/|x| of this encoding is proportional to the security parameter κ. In this paper, we show that the online rate can be dramatically improved. Specifically, we show how to encode any polynomial-time computable function f : {0, 1}n → {0, 1}m(n) with online rate of 1 + o(1) and with nearly linear online computation. More concretely, the online part x consists of an n-bit string and a single encryption key. These constructions can be based on the decisional Diffie- Hellman (DDH) assumption, the learning with errors (LWE) assumption, or the RSA assumption. We also present a variant of this result which applies to arithmetic formulas, where the encoding only makes use of arithmetic operations, as well as several negative results which complement our positive results. Our positive results can lead to efficiency improvements in most contexts where randomized encodings of functions are used. We demonstrate this by presenting several concrete applications. These include protocols for secure multiparty computation and for noninteractive verifiable computation in the preprocessing model which achieve, for the first time, an optimal online communication complexity, as well as noninteractive zero-knowledge proofs which simultaneously minimize the online communication and the prover's online computation.
AB - Randomized encodings of functions can be used to replace a "complex" function f(x) by a "simpler" randomized mapping f (x;r) whose output distribution on an input x encodes the value of f(x) and hides any other information about x. One desirable feature of randomized encodings is low online complexity. That is, the goal is to obtain a randomized encoding f of f in which most of the output can be precomputed and published before seeing the input x. When the input x is available, it remains to publish only a short string x, where the online complexity of computing x is independent of (and is typically much smaller than) the complexity of computing f. Yao's garbled circuit construction gives rise to such randomized encodings in which the online part x consists of n encryption keys of length κ each, where n = |x| and κ is a security parameter. Thus, the online rate |x|/|x| of this encoding is proportional to the security parameter κ. In this paper, we show that the online rate can be dramatically improved. Specifically, we show how to encode any polynomial-time computable function f : {0, 1}n → {0, 1}m(n) with online rate of 1 + o(1) and with nearly linear online computation. More concretely, the online part x consists of an n-bit string and a single encryption key. These constructions can be based on the decisional Diffie- Hellman (DDH) assumption, the learning with errors (LWE) assumption, or the RSA assumption. We also present a variant of this result which applies to arithmetic formulas, where the encoding only makes use of arithmetic operations, as well as several negative results which complement our positive results. Our positive results can lead to efficiency improvements in most contexts where randomized encodings of functions are used. We demonstrate this by presenting several concrete applications. These include protocols for secure multiparty computation and for noninteractive verifiable computation in the preprocessing model which achieve, for the first time, an optimal online communication complexity, as well as noninteractive zero-knowledge proofs which simultaneously minimize the online communication and the prover's online computation.
KW - Cryptography
KW - Garbled circuits
KW - Randomized encodings
KW - Secure multiparty computation
KW - Verifiable computation
UR - http://www.scopus.com/inward/record.url?scp=84928718035&partnerID=8YFLogxK
U2 - 10.1137/130929643
DO - 10.1137/130929643
M3 - ???researchoutput.researchoutputtypes.contributiontojournal.article???
AN - SCOPUS:84928718035
SN - 0097-5397
VL - 44
SP - 433
EP - 466
JO - SIAM Journal on Computing
JF - SIAM Journal on Computing
IS - 2
ER -