4
votes
Accepted
LPN Encryption Homomorphism
$C$ is not a fixed matrix, it is the encryption randomness (given in the ciphertext). Hence, two ciphertexts with the same secret key $s$ will have different matrices $C$:
$c_1 = (C_1, C_1\cdot s \...
- 20k
2
votes
Accepted
How Cut-and-Choose can leak information?
$P_1$ garbles the circuit, so he can manipulate it (e.g. swap AND and OR gates) since $P_2$ only receives permuted encrypted truth tables.
In particular, $P_1$ could add an "if-else" gate s....
- 76
2
votes
n-Party Garbled Circuit
There is a very long line of work on multi-party garbled circuits -- too long to adequately describe in this answer. The first paper introducing multiparty garbling was:
Beaver, Micali, Rogaway: The ...
- 13.2k
1
vote
Accepted
Is it secure for A to allow B to run a garbled circuit twice with different inputs?
The goal of a garbled circuit is to let the evaluator perform the computation, without knowing the values on any wire. If you reuse a garbled circuit, you violate this guarantee.
Suppose I hold a ...
- 13.2k
1
vote
Choosing $C_0$ to make second row zero for Garbled Row Reduction (GRR3)
Depending on the point/permute bits (color bits), the 1st and 2nd ciphertexts might involve the same $C_i$ value.
For example, imagine the point/permute bits are such that the basic garbled truth ...
- 13.2k
1
vote
2-PC vs Secure function evaluation vs private function evaluation
Though I'm unaware of formal definitions, this is my understanding of the terms:
two party computations: Two parties each with private input want to calculate something based on both inputs without ...
- 11.8k
1
vote
Accepted
The reference of external values in Garbled Circuit
That PDF uses the expression "external value" to refer to a particular bit in the wire label that is used for the "point-and-permute" technique. In this video I call them "...
- 13.2k
1
vote
why the intermediate labed value should be encrypted in Garbled Circuits?
Suppose for example $w5$ is not encrypted in this diagram and I see that its value is 1 (or I see the unencrypted value 1 in the LUT for $G1$). It is the output of the AND gate $G1$ and so can only be ...
- 23.9k
Only top scored, non community-wiki answers of a minimum length are eligible