On compiling Boolean circuits optimized for secure multi-party computation

Abstract

Secure multi-party computation (MPC) allows two or more distrusting parties to jointly evaluate a function over private inputs. For a long time considered to be a purely theoretical concept, MPC transitioned into a practical and powerful tool to build privacy-enhancing technologies. However, the practicality of MPC is hindered by the difficulty to implement applications on top of the underlying cryptographic protocols. This is because the manual construction of efficient applications, which need to be represented as Boolean or arithmetic circuits, is a complex, error-prone, and time-consuming task. To facilitate the development of further privacy-enhancing technology, multiple compilers have been proposed that create circuits for MPC. Yet, almost all presented compilers only support domain specific languages or provide very limited optimization methods. In this work (this is an extended and revised version of the paper ‘Secure Two-party Computations in ANSI C’ (Holzer et al., in: ACM CCS, 2012) that reflects the progress in secure computation and describes the current optimization tool chain of CBMC-GC) we describe our compiler CBMC-GC that implements a complete tool chain from ANSI C to circuit. Moreover, we give a comprehensive overview of circuit minimization techniques, which we have identified and adapted for the creation of efficient circuits for MPC. With the help of these techniques, our compilation approach allows for a high level of abstraction from the cryptographic primitives used in MPC protocols, as well as the complex design of digital circuits. By using the model checker CBMC as a compiler frontend, we illustrate the link between MPC, formal methods, and digital logic design. Our experimental results illustrate the effectiveness of the implemented optimizations techniques for various example applications. In particular, compared with other state-of-the-art compilers, we show that CBMC-GC compiles circuits from the same source code that are up to four times smaller.

Code example: Hamming distance computation

The Hamming distance between two bit strings is the number of pairwise different bits. This number can be computed by XOR-ing the input bit strings and then counting the number of bits. An exemplary implementation is given in Listing 3 that computes the distance between two bit-strings of length 160 bits, which are split over five unsigned integers. In Line 7 the number of ones in a string of 32 bits is computed. This task is also known as population count. In the following paragraphs we describe three different implementations.

The first implementation is given in Listing 4. In this naïve approach, each bit is extracted using bit shifts and the logical AND operator & before being aggregated.

A variant of this implementation is given in Listing 5. Here, the bit string of length 32 is first split into chunks of 8 bits (unsigned char). The ones set in each chunk are then counted as described above.

Finally, in Listing 6 the best known implementation optimized for a CPU with 32 bit registers and slow multiplication is given. This implementation uses only 14 instructions.