# garbled circuit vs fully homomorphic encryption

Consider an outsourced database to an untrusted cloud (think CryptDb), the question is how to compute a function $f(.)$ on the data.

I think I understand how (fully or partially) homomorphic encryption works in this situation:

1. Encrypt the input.
2. Outsource both the ciphertexts and the (public) function.
3. The cloud evaluates the functions on ciphertexts, results are also in ciphertexts.

How would garbled circuit (GC) be used in this case? Is it:

1. Garble the circuit and upload to the cloud.
2. Garble the inputs and upload to the cloud (ciphertexts).
3. The cloud evaluates the circuit. Results are in plaintext.

What are the trade-offs between these two approaches, supposing I don't care whether the results are in the clear or encrypted? It looks like both can be used to compute arbitrary functions over ciphertexts.

But if GC can be used only once (true?), is it possible to use the same garbled inputs for more than one GC, or one needs to construct a (GC,garbled input) pair for every single evaluation of the function $f(.)$?

• There are theoretical results that allow reusing garbled circuits, but they're very new. To wit: eprint.iacr.org/2012/733.pdf Oct 16 '13 at 7:00
• If nobody has given a good answer by tomorrow morning I'll put one up, I did a lot of research in this area a little bit ago. Oct 16 '13 at 7:01
• I saw this paper, but it's about combining GC, FHE and ABE to achieve FE. Still uncertain if it answers my questions.
– Anh
Oct 16 '13 at 7:45
• The output of a GC does not have to be in plaintext. If you don't want the person computing the function to know the output just have the output gates map to random values that only you know how to map those to the plaintext. Oct 16 '13 at 13:43
• In GC , are there really two separate steps to calculate garbled circuit and garbled input ? i believe they are done in one step ? May 19 '15 at 23:28