On the security of the "Free-XOR" technique

  • Authors:

  • Seung Geol Choi;Jonathan Katz;Ranjit Kumaresan;Hong-Sheng Zhou

  • Affiliations:

  • Dept. of Computer Science, University of Maryland, College Park, MD;Dept. of Computer Science, University of Maryland, College Park, MD;Dept. of Computer Science, University of Maryland, College Park, MD;Dept. of Computer Science, University of Maryland, College Park, MD

  • Venue:
  • TCC'12 Proceedings of the 9th international conference on Theory of Cryptography
  • Year:
  • 2012

Quantified Score

Hi-index 0.00

Visualization

Abstract

Yao's garbled-circuit approach enables constant-round secure two-party computation of any function. In Yao's original construction, each gate in the circuit requires the parties to perform a constant number of encryptions/decryptions and to send/receive a constant number of ciphertexts. Kolesnikov and Schneider (ICALP 2008) proposed an improvement that allows XOR gates to be evaluated "for free," incurring no cryptographic operations and zero communication. Their "free-XOR" technique has proven very popular, and has been shown to improve performance of garbled-circuit protocols by up to a factor of 4. Kolesnikov and Schneider proved security of their approach in the random oracle model, and claimed that (an unspecified variant of) correlation robustness suffices; this claim has been repeated in subsequent work, and similar ideas have since been used in other contexts. We show that the free-XOR technique cannot be proven secure based on correlation robustness alone; somewhat surprisingly, some form of circular security is also required. We propose an appropriate definition of security for hash functions capturing the necessary requirements, and prove security of the free-XOR approach when instantiated with any hash function satisfying our definition. Our results do not impact the security of the free-XOR technique in practice, or imply an error in the free-XOR work, but instead pin down the assumptions needed to prove security.