10

Since last year, IO finally seems to be within our reach. Several papers (https://eprint.iacr.org/2020/1003, https://eprint.iacr.org/2020/1024 and https://eprint.iacr.org/2020/1042) proved the existence of IO based on almost-standard assumptions. Also, we have some heuristically secure (or rather "we don't really know how to break them"-secure) IO candidates https://eprint.iacr.org/2018/756 and https://eprint.iacr.org/2020/889.

Now I'm wondering, how "bad" (in terms of efficiency) would it be, if we actually wanted to use one of them? Let's say we want to obfuscate some Boolean circuit $C$ of size $n$, what's the magnitude of $|iO(C)|$ in Landau notation (if we take $n$ to be the security parameter)? Or are there even concrete estimates on how big the blowup of the obfuscated circuit would be if we want, e.g., 128 bit security?

CryptoPerson
  • 121
  • 4

1 Answers1

1

According to Wikipedia, they are very far from being practical:

There have been attempts to implement and benchmark IO candidates. For example, as of 2017, an obfuscation of the function $x_1 ∧ x_2 ∧ ⋯ ∧ x_{32}$ at a security level of 80 bits took 23.5 minutes to produce and measured 11.6 GB, with an evaluation time of 77 ms. Additionally, an obfuscation of the Advanced Encryption Standard encryption circuit at a security level of 128 bits would measure 18 PB and have an evaluation time of about 272 years.

Pellet--Mary, Alice (26 May 2020). "Co6GC: Program Obfuscation | COSIC". www.esat.kuleuven.be. Archived from the original on 11 November 2020. Retrieved 22 August 2021.

Zaz
  • 141
  • 4