2

In the half-gate construction of garbled circuits, is it possible to garble multiple instances of a circuit while re-using certain input labels?

Suppose Alice and Bob would like to compute a function using garbled circuits. Alice will act as the generator and Bob the evaluator.

As usual, Alice generates the input labels for the circuit $W_A$ for her inputs, and $W_B$ for Bob's then sends the encrypted gates and her active labels $w_A$. Bob retrieves his active input labels $w_B$ using oblivious transfer and evaluates the circuit.

Now, my question:

Is it secure for Alice to generate a new garbled circuit, where her input labels $W_A$ are new labels but she reuses Bob's existing labels $W_B$ from the previous GC? Such that Bob does not need to retrieve his active labels using OT again (his input is constant), and Alice is assured that Bob's input for this next evaluation is the same as the previous evaluation.

sinu
  • 21
  • 2
  • 1
    The way I think about it is your two circuits can be essentially a single circuit, i.e., your two circuits are connected by $W_B$. Then the property you want is "streaming" where Alice garbles but Bob's allowed to evaluate as soon as some gates are done garbling, he doesn't need to wait for all gates to be done, which should be possible if your garbling scheme supports it. Streaming should be a generalization of what you want to achieve. – lamba Oct 17 '22 at 07:49
  • Ah right, framing it that way makes sense. In our context it helps to model them as different executions, but you're right in the general sense it seems indistinguishable from streaming. Thank you – sinu Oct 17 '22 at 16:16

0 Answers0