Abstract

Garbled circuits, a classical idea rooted in the work of A. Yao, have generally been understood as a cryptographic technique, not a cryptographic goal. Here we treat garbled circuits as a proper cryptographic primitive, giving a syntax for a “garbling scheme” and formalizing several security notions for such schemes. The most basic of our notions, “privacy”, suffices for the classical goals of two-party secure function evaluation (SFE) and private function evaluation (PFE). We provide a simple and efficient garbling scheme achieving privacy, this built from a block cipher, and we analyze its concrete security. We next consider the “authenticity” and “obliviousness” of a garbling scheme, extending the blockcipher-based protocol to achieve these ends, too. Our treatment of garbling schemes solidifies notions that have been swirling around the literature for years, and promises a more modular approach to designing and using garbling sc hemes in the future.