Adaptive Security of Yao\u27s Garbled Circuits

Abstract

A garbling scheme is used to garble a circuit $C$ and an input $x$ in a way that reveals the output $C(x)$ but hides everything else. Yao\u27s construction from the 80\u27s is known to achieve selective security, where the adversary chooses the circuit $C$ and the input $x$ in one shot. It has remained as an open problem whether the construction also achieves adaptive security, where the adversary can choose the input $x$ after seeing the garbled version of the circuit $C$. A recent work of Hemenway et al. (CRYPTO \u2716) modifies Yao\u27s construction and shows that the resulting scheme is adaptively secure. This is done by encrypting the garbled circuit from Yao\u27s construction with a special type of ``somewhere equivocal encryption\u27\u27 and giving the key together with the garbled input. The efficiency of the scheme and the security loss of the reduction is captured by a certain pebbling game over the circuit. In this work we prove that Yao\u27s construction itself is already adaptively secure, where the security loss can be captured by the same pebbling game. For example, we show that for circuits of depth $d$, the security loss of our reduction is $2^{O(d)}$, meaning that Yao\u27s construction is adaptively secure for NC1 circuits without requiring complexity leveraging. Our technique is inspired by the ``nested hybrids\u27\u27 of Fuchsbauer et al. (Asiacrypt \u2714, CRYPTO \u2715) and relies on a careful sequence of hybrids where each hybrid involves some limited guessing about the adversary\u27s adaptive choices. Although it doesn\u27t match the parameters achieved by Hemenway et al. in their full generality, the main advantage of our work is to prove the security of Yao\u27s construction as is, without any additional encryption layer