AI Analysis

Abstract

RV2GC is a system designed for programmable garbled-circuit execution in a RISC-V processor, addressing the inefficiencies of traditional complete garbled processors that repeatedly traverse large, fixed circuits. It reconstructs the garbling boundary by separating public instruction scheduling and operand routing from the garbled computation. RV2GC utilizes a fixed library of RISC-V instruction circuits and persistent label-encoded state to connect independently invoked operations. Key features include a Conditional-execution Stack and protected commits, which enable secret-dependent branches, bounded loops, and secret-indexed memory access while maintaining a public instruction and memory-address sequence. Benchmarks demonstrate RV2GC's substantial runtime speedups, ranging from 12.81x to 4,043x, compared to ARM2GC. The largest instruction circuit in RV2GC is significantly smaller than complete garbled processors, though its public schedules require program-specific storage, and secret-indexed accesses involve fixed scans.

Key Highlights

• Reconstructs the garbling boundary in a RISC-V garbled processor, separating public scheduling from garbled computation.
• Utilizes a fixed library of RISC-V instruction circuits and persistent label-encoded state for continuous execution.
• Supports secret-dependent branches, bounded loops, and secret-indexed memory access under a public instruction and address schedule.
• Achieves significant runtime speedups over ARM2GC, ranging from 12.81x to 4,043x across nine benchmarks.
• The largest instruction circuit (multiplication) is 0.393% of the 4,096-byte Amber processor's gate count.

Technical Details

• Garbling boundary reconstruction separates public instruction scheduling and operand routing from garbled computation, decoupling label-encoded architectural state from individual circuit topologies.
• A fixed library of RISC-V instruction circuits provides protected operations, synthesized once from HDL.
• Persistent Execution State includes Garbled Registers and Garbled Memory (software-managed arrays of public values or protected wire labels) and a Conditional-execution Stack.
• A two-party label-state invariant is maintained across operations, enabling continuous execution without decoding intermediate secrets.
• Garbling-free instruction execution optimizes specific instruction cases (e.g., XOR/NOT, fixed shifts, long immediates, public control-flow, public-address memory) without requiring encrypted garbled tables.
• The Conditional-execution Stack carries effective protected predicates across nested conditional regions.
• Protected commits use these predicates to select candidate state updates or preserve prior values for secret-dependent execution patterns.
• Secret-dependent loops are publicly bounded, with protected liveness controlling state updates after logical termination.
• Secret-indexed memory access involves scanning a public address range, using protected equality and MUX feedback to select the correct entry.
• A program transformation tool prepares C programs by converting secret-dependent control flow and memory accesses into fixed public sequences with protected commits.
• BINSEC is used for binary-level verification to ensure control flow and memory addresses are independent of private inputs.

Implications

• Significantly improves the efficiency of programmable garbled-circuit execution by reducing repeated processor-wide netlist traversal.
• Enhances cross-program reuse by providing a fixed library of instruction circuits, potentially lowering preparation costs compared to program-specific or function-specific approaches.
• Enables secure execution of complex, long-running RISC-V programs with secret-dependent logic while maintaining public execution traces.
• Offers a more granular and flexible approach to defining the garbling boundary in secure computation systems.
• Provides a practical framework for secure computation on the RISC-V instruction set architecture.

Limitations

• Public schedules, which are program-specific, can incur significant storage costs for long-running programs (e.g., 283.35 MiB for Mini-ResNet).
• Secret-indexed memory accesses require scanning a public address range, leading to execution work that scales with the number of entries in the scanned block.
• RV2GC's communication overhead can be higher than that of function-specific circuits in certain evaluated workloads.
• Programs must be 'oblivious,' meaning their public instruction and memory-address sequences must be independent of private inputs.
• The evaluated scope is limited to the RV32 integer subset, excluding floating-point operations, atomics, and exception semantics.
• Program transformation requires identifiable public loop bounds and resolvable/consistent scan objects and extents.
• The program transformation tool employs strict checking, rejecting unresolved pointer targets and external calls.
• The system operates under a public-function, semi-honest two-party model, assuming both parties follow the protocol and relying on secure GC and oblivious transfer (OT).
• The implementation is software-based on general-purpose CPUs and does not involve a hardware accelerator.

Source: https://arxiv.org/abs/2610.39572