How to Compress (Reusable) Garbled Circuits

A fundamental question about (reusable) circuit garbling schemes is: how small can the garbled circuit be? Our main result is a reusable garbling scheme which produces garbled circuits that are the same size as the original circuit plus an additive poly(λ, d) bits, where λ is the security parameter and d is the circuit depth. Save the additive poly(λ, d) factor, this is the best one could hope for. In contrast, all previous constructions of even single-use garbled circuits incurred a multiplicative poly(λ) blowup. Our techniques result in constructions of attribute-based and (single key secure) functional encryption schemes where the secret key of a depth d circuit C consists of C itself, plus poly(λ, d) additional bits. All of these constructions are based on the subexponential hardness of the learning with errors problem. We also study the dual question of how short the garbled inputs can be, relative to the original input. We demonstrate a (different) reusable circuit garbling scheme, based on multilinear maps, where the size of the garbled input is the same as that of the original input, plus a poly(λ, d) factor. Similar to the above, this also results in attribute-based and (single key secure) functional encryption schemes where the size of the ciphertext encrypting an input x is the same as that of x, plus poly(λ, d) additional bits. ∗IBM Research. Email: cbgentry@us.ibm.com. †University of Toronto. Email: sgorbunov@cs.toronto.edu. This work was partially done while visiting IBM T. J. Watson Research Center. Supported by Alexander Graham Bell Canada Graduate Scholarship (CGSD3). ‡IBM Research. Email: shaih@alum.mit.edu. §MIT and University of Toronto. Email: vinodv@csail.mit.edu. Supported by an NSERC Discovery Grant, DARPA Grant number FA8750-11-2-0225, a Connaught New Researcher Award, an Alfred P. Sloan Research Fellowship, and a Steven and Renee Finn Career Development Chair from MIT. ¶University of Toronto. Email: dhinakaran5@cs.toronto.edu.