Xxx’s Garbled Sample Clauses

Xxx’s Garbled. Circuits (YGC) Next, we give a brief introduction to Xxx’s Garbled Circuits [Yao86]. Informally, Xxx’s Garbled Circuits (YGC) are an asymmetric secure two-party computation scheme. It enables two parties with sensitive inputs (in our case, pass-strings) to compute a joint function of their inputs (in our case, an augmented version of similarity) without revealing any additional information about their inputs. One party “garbles” the function they wish to evaluate, and the other evaluates it in its garbled form. There have been many optimizations to YGC over the years [BMR90, KS08, PSSW09,KMR14,ZRE15,BMR16]. While YGC is naturally secure against a ma- licious evaluator, all known constructions share the drawback of being insecure against a malicious garbler without expensive transformations. A garbler can “mis-garble” the function, either replacing it with a different function entirely or causing an error to occur in an informative way (this is known as “selective failure”). Typically, malicious security is introduced to YGC by using the cut-and- choose transformation [LP15, Lin13, HKE13]. To achieve a 2−λ probability of cheating without detection, the parties need to exchange λ garbled circuits [Lin13].6 Some of the garbled circuits are “checked”, and the rest of them are evaluated, their outputs checked against one another for consistency. Because of the factor 6 There are techniques [LR14] that improve this number in the amortized case when many computations are done — however, this does not fit our setting. of λ computational overhead, though, cut-and-choose is expensive, and too heavy a tool for fPAKE. In Section 3.2.2, we describe how we achieve security against malicious adversaries for a lower price, without this generic transformation. Below, we summarize the garbling scheme formalization of Xxxxxxx et al. [BHR12], which is a generalization of YGC.