Securing Yao’s Garbled Circuit Construction Against Active Adversaries

Securing Yao’s Garbled Circuit ConstructionAgainst Active AdversariesMehmet S.Kiraz and Berry SchoenmakersDept.of Mathematics and Computing Science,TU EindhovenP.O.Box513,5600MB Eindhoven,The Netherlandsm.kiraz@tue.nl,berry@win.tue.nlAbstract.We propose a new two-party computation protocol using Yao’s garbled circuits,which is secure in the case of malicious behavior.To illustrate the need for the new protocol,wefirst discuss security issues of three existing protocols for secure two-party computationusing garbled circuits,in the case of malicious behavior.Thefirst is a protocol by Pinkas(Eurocrypt2003),and the other two are the committed-input scheme and the k-leaked model,both presented by Mohassel and Franklin(PKC2006).We address securityflaws in allschemes,which allow leaking of information on the private inputs.In the k-leaked modelleaking of some information is permitted if a participant is cheating,but then the honestparticipant should be aware of it.We show that this is not the case.After discussing thesesecurity issues of the known schemes,we describe our new protocol.It is based on theprotocol by Pinkas,and the correction of theflaw of the scheme by Pinkas makes our protocolnot only more secure,but also more efficient.We provide a detailed informal security analysisof our new protocol.Keywords:Secure two-party computation,Yao’s garbled circuit,active adversary1IntroductionIn secure two-party computation we have two participants who are interested in evaluating a public function f(x,y)where x and y are their respective private inputs.They want to know the value f(x,y)without disclosing more information about their inputs than is implied by the output. We consider Yao’s garbled circuit approach in which one of the participants,Bob,constructs the garbled circuit by assigning two random(garbled)bit strings to all the wires which are represented by0and1respectively and sends it to the other participant,Alice.Before Alice can evaluate the circuit she needs to learn her corresponding garbled input string.To do so,they run a1-out-of-2 oblivious transfer(OT21)for Alice to receive her input in garbled form.Alice then evaluates the garbled circuit and sends Bob’s output back.They both translate the garbled output strings for their output wires into output bits.Malicious behavior is a fundamental problem in secure two-party computation.The main difficulty in secure two-party computation is to construct an efficient and a simple protocol to achieve security against malicious behavior.Some of the literature on this subject also deals with fairness. Fairness simply means that whenever a malicious party quits a protocol he/she should not gain any(considerable)advantage of it.In this paper we will not discuss fairness,but focus on obtaining a protocol which is secure against malicious users.Although there are a number of papers[7,6,4] which discuss the issues of secure two-party computation,we show that so far there is no secure two-party protocol against malicious parties using garbled circuits which has an exponentially small cheating probability.Yao’s garbled circuit approach originally dealt with passive adversaries(honest-but-curious par-ticipants)[9,10].Thefirst implemented application for secure two-party computation using Yao’s garbled circuit technique is Fairplay[7]by Malkhi et al.,which also deals with active adversaries.It uses a basic cut-and-choose approach,called the1-out-of-m technique.However it has aflaw regarding the use of oblivious transfer which was discussed and solved by Kiraz and Schoenmakers in[2].Pinkas[6]presented a more advanced protocol against malicious behavior which uses the m/2-out-of-m cut-and-choose technique to achieve exponentially small cheating probability.The m/2-out-of-m technique can be described briefly as follows:Bob constructs m garbled circuits and sends them to Alice.Alice chooses m/2circuits randomly for evaluation and tells Bob to open the remaining ones.She verifies whether the remaining circuits are correctly prepared.If so,they run OT21in order for Alice to receive her garbled input values for the chosen circuits.Bob then sends his garbled input values to Alice so that she can evaluate the chosen m/2circuits and compute her and Bob’s garbled output values.She sends the output value of only one of the chosen m/2circuits to Bob but this circuit should be correctly chosen with high probability,not revealing illegitimate information to Bob.To do this,both Alice and Bob run a procedure where Alice generates called a majority circuit that outputs a circuit index of one of the chosen m/2circuits.Finally,she sends only the output values of the chosen circuit of the specified index.Theflaw with the use of OT in Fairplay,as presented in[2],also exists in the protocol by Pinkas, and in other protocols that use OT as a building block,but can befixed as described in[2]. However,in this paper we address a newflaw in the protocol by Pinkas concerning the majority circuit computation.Recently,Mohassel and Franklin[4]presented the committed-input scheme for secure two-party computation using garbled circuits with malicious behavior.We show that this scheme has aflaw. In the same paper[4]they also presented the k-leaked model,which permits leaking of some extra bits of information to a malicious party to achieve a simpler protocol and improve the efficiency. However,we show that whenever a participant cheats(and thereby gains extra bits of information), the honest participant does not notice that cheating has occurred.Lindell and Pinkas recently gave a simulation-based proof of security for the garbled circuit con-struction for the passive case[3].But,so far there is no formal proof of security for the garbled circuit for the malicious case.Our ContributionsThe main goal of this paper is to present a secure two-party protocol against malicious behavior using garbled circuits,that has an exponentially small cheating probability.To design it we will take the most advanced protocol of Pinkas as a basis.We present an alternative solution for the flawed majority circuit computation in the protocol by Pinkas.Moreover,this correction makes our protocol more efficient than the original protocol,since the majority circuit computation in our new protocol does not require an additional interactive procedure,as is the case in the protocol by Pinkas.Besides our new protocol,the other contributions of this paper are the descriptions of the newflaws found in the existing two-party protocols using garbled circuits,that are the motivation for the design of a new protocol.Outline of the PaperThe rest of the paper is organized as follows.In Section2,we discuss the majority circuit in the protocol by Pinkas and demonstrate a problem in the majority circuit computation in his protocol. In this section,we also discuss theflaws with the committed-input scheme and the k-leaked model. We end this section by introducing a modification to deal with the majority circuit computation.In Section3,we present our new secure two-party protocol in the case of malicious behavior.Section 4analyzes the security of our secure two-party protocol.In Section5,we discuss its complexity. Finally,Section6concludes the paper.2Problem DescriptionIn this section,we start by sketching the reason why the majority circuit is computed in the protocol by Pinkas[6]and then show theflaw in his protocol.We continue by discussing theflawsin the committed-input scheme and the k-leaked model[4].Finally,we present the modification of the garbled circuit such that we can remove the procedure of the majority circuit computation in[6],which will be used later in our new protocol.2.1Majority Circuit ComputationTo show the need of majority circuit and theflaw wefirst give a brief description of the protocol by Pinkas[6]where we focus on the majority circuit computation.For preliminaries on garbled circuits we refer to Appendix A.In the beginning of the protocol,Bob sends the garbled circuits GC j for j∈{1,...,m}to Alice. Alice then chooses a random set U⊂{1,...,m}of size m/2.The indices j∈U show the circuits GC j that will be evaluated and the indices j/∈U the circuits GC j that will be opened.Note that opening the circuits means verifying if Bob has constructed these circuits correctly.After Alice evaluates the circuits GC j for j∈U,she learns a set of output values for each of Bob’s output wires.It is not secure for her to send all the output values of the chosen circuits GC j where j∈U to Bob,since he might compute illegitimate information.For example,Bob could have constructed m−1circuits that compute the function f(x,y)and a single circuit which simply outputs Alice’s input values.Since Alice evaluates m/2out of m circuits,the probability would be1/2that this single circuit is selected by Alice.Therefore,Bob receives the outputs of the incorrect circuit from Alice with high probability at the end of the evaluation.Pinkas proposed the following procedure to remove this problem by considering Bob’s cheating: The goal is tofind a circuit GC r for r∈U which is’most likely to be correct’.This means that the outcome of each i-th output wire of GC r agrees with the majority of the outcomes of the i-th output wires of all circuits GC j for j∈U.After that,Bob receives only the output of the circuit GC r and with high probability this circuit computes correct output,which means that he learns no information.To obtain this GC r,Alice constructs a new circuit called the majority circuit which outputs the index r after interaction between Alice and Bob.Pinkas lets Alice construct this majority circuit since this procedure is included to prevent Bob from cheating.But in the next section,we will show that this gives Alice an opportunity to cheat instead.2.2A Flaw in the Protocol by PinkasAfter the brief description of the majority circuit in Section2.1,we now point out the problem. Of all the circuits GC j for j∈U and each of Bob’s output wires,Bob knows a random bit k ij and Alice knows the value b ij⊕k ij,where b ij is the actual output bit for the i-th wire in the circuit GC j.This values are the outputs of the evaluation of the garbled circuits.Then,Alice and Bob run a procedure in which their respective private inputs are b ij⊕k ij and k ij,and whose output is an index r such that the outcome of each i-th output wire of GC r agrees with the majority of the outcomes of the i-th output wires of all the circuits GC j for j∈U.Note that with high probability at least m/4circuits compute the function f(x,y)which assures the existence of the circuit GC r with high probability.It is essential that after the procedure,Alice and Bob do not learn any more information besides r.But if Alice constructs the majority circuit,nothing prevents her from constructing a circuit which reveals some of Bob’s input values and hence some of the k i,j values.Then Alice learns Bob’s actual output bits,which should not be possible.In any case,one would need to avoid this by applying the same m/2-out-of-m technique again to remove cheating by Alice,but this would give rise to yet another majority circuit and this causes an infinite loop.2.3Flaws in the Committed-Input SchemeMohassel and Franklin[4]presented a committed-input scheme to achieve a secure two-party protocol for the malicious model.This scheme is based on the protocol by Pinkas[6]which has a genericflaw with the use of oblivious transfer which is described in[2].In this section,we address another security problem in the committed-input scheme,in which a malicious Bob can cheat using his garbled input values.The scheme uses proofs of equality of discrete-log commitments[5]as a building block to let Bob show that his inputs are consistent.The goal of the scheme is to obtain a better efficiency,by using an alternative solution for the proofs of partial knowledge method by Cramer,Damg˚ard and Schoenmakers[1],and avoid expensive zero-knowledge proofs.The overall idea of the problem is that Bob can control which circuits can be evaluated by Alice. By this,Alice may evaluate a wrong majority circuit.The garbled circuits are constructed in such a way that the commitments will be Bob’s garbled input values.He has the possibility to send some bogus values instead of garbled input values,while the proof check(of equality of the discrete-log commitments)still passes.Alice accepts the proof but she cannot evaluate the circuits that have wrong input values.See Appendix B for a more detailed description over the problem. The problem can be easilyfixed in such a way that if Alice cannot evaluate a circuit then she aborts the protocol.Besides this,we also note that in the description of the protocol,the use of a majority circuit is mentioned.Although the details of computing the majority circuit are not given in the paper[4],one should realize that when it is done in the same way as in the protocol by Pinkas,the sameflaw as described in Section2.2appears.2.4A Flaw in the k-leaked ModelIn the paper by Mohassel and Franklin[4]the k-leaked Model is presented which permits a malicious party to learn some extra information.They claim that in this way the efficiency increases substantially.In this section,we show that a party can cheat in their protocol without being noticed which should not be possible.In their construction,both parties Alice and Bob are constructor and evaluator where a party Bob constructs a single garbled circuit and sends it to Alice.Alice evaluates it and computes the output values.This work is then repeated for a constructor Alice and evaluator Bob.Finally,it is only checked whether the actual outputs are equal or not.We show that Bob can change some of his input wires.For instance,he may use an input bit0 in the oblivious transfer for obtaining the garbled value for evaluating the circuit constructed by Alice,and use1for the same wire for the circuit he constructed(and to be evaluated by Alice). Then he may learn something from the fact that the output values of the two evaluations match or not.For example,suppose Alice and Bob agreed to run the millionaires protocol.Assume that a malicious Bob constructs his garbled circuit correctly.Assume also that a malicious Bob has input B=100and an honest Alice has input A=110.A malicious Bob can send the wrong input B =101in garbled form for his”correct”circuit and can use the correct input B=101for Alice’s circuit.The output of two circuits would be the same(namely that Alice is richer)and she cannot detect that Bob cheated,so Alice would think that everything ran correctly.However,Bob learnt that Alice’s input value is bigger than101instead of only bigger than100.(For example, only the values110and111are greater than101and therefore,the second bit of Alice must be 1.)Hence,different inputs might result in extra information for a malicious participant without detection.Therefore the leakage is not limited to just1bit when going from the semi-honest case to the malicious case.2.5The Modification of the Circuit to Correct the Majority ComputationIn this section,we present the modification over the circuit C f which computes the original function f and explain how Alice can compute the majority of Bob’s output wires without interaction with Bob.Before we state the solution we introduce some definitions for concepts related to the majority.Fig.1.The modification of a circuit C f to construct RC fMajority Value.Majority value for an output wire is the bit value that occurs most frequently for that wire considered over all circuits.(If the value occurs the same number of times,then let 0be the majority value.)Majority Wire.A wire is called a majority wire if its value is the majority value.Majority Circuit.A circuit is called a majority circuit if all of its wires are majority wires. Instead of permuting Bob’s output wires as in the protocol by Pinkas,Bob constructs the circuit C f with the following modification:the circuit C f is modified into a so called randomized circuit RC f in which Bob’s output wires are randomized.Let|RC f|denote the number of gates.Also, denote I A for Alice’s input wires and I B for Bob’s input wires.Similarly,O A denotes Alice’s output wires and O B for Bob’s output ly,Bob’s i-th output wire W i and the additional new input wires W i are computed by exclusive-OR which results in Bob’s new output wires W i(see Figure1).Note that the i-th additional input wire W i will be contained in the set I B and the set of randomized output wires W i will be Bob’s new output wires O B.We use the notation commit P(r;s)to refer to a perfectly binding commitment scheme generated by the party P to a value r,using a random bit string mitments to Bob’s ordered pairs OP i,j=(w0i,j,w1i,j)by Bob for his i-th output wire and for the j-th garbled circuit are denoted COP i,j=(commit B(w0i,j,w1i,j;αi,j)).Bob then converts the randomized circuit RC f into garbled randomized circuits GRC j,j=1,...,m defined byGRC j= PEG-4-Tuple i,j:1≤i≤|RC f| , OP i,j:i∈O A , COP i,j:i∈O B= t i,j:1≤i≤|RC f| , u i,j:i∈O A , v i,j:i∈O Bwhere t i,j denotes the permuted-encrypted-4-tuple i,j(note that this tuple is generated for each gate in the circuit RC f to construct the garbled circuit GRC f,for more details see Appendix A), u i,j denotes the ordered pair for Alice’s output wires I A and v i,j denotes the committed ordered pair for Bob’s randomized output wires O B.When Bob constructs the garbled circuits he chooses secretly and randomly a bit for each additional input wire.He assigns garbled input values to the additional input wires and to the additional output wires as in the original garbled circuit.In the same way as his original inputs,he then commits to them.Bob is required to prove that all garbled inputs for each circuit of the same wire are taken from the same set with the proofs of partial knowledge method in[1].Hence,he must choose the same bit b for all additional wires in the garbled circuits.This modification of the m/2-out-of-m technique assures Alice that,with high probability,at least half of the circuits compute the right function and receive the same additional input values from Bob.They do not need a procedure that computes the majority circuit using interaction with Bob like in[6],since Alice can now compute the majority output values by herself.The majority circuit is then determined as follows:after Alice evaluates the circuits GRC j for j∈U she computes garbled output values.She then matches the garbled output values with the OP i,j and gets output bits.She then computes the number of0’s and1’s for Bob’s i th output wire for each of the circuits GRC j for j∈U and chooses majority wires.She applies this to all output wires and determines a majority circuit.Note that the m/2-out-of-m technique guarantees with very high probability that there exist at least m/4correct circuits GRC j for j∈U which implies the existence of a majority circuit.3The New ProtocolIn this section we present a description of our new secure two-party protocol against active ad-versaries.Our protocol is similar to the construction of Pinkas[6].We use committing OT tofix theflaw in his paper which is described in[2]and replace the majority circuit computation by the modification presented in Section2.3.Before we give the description of the protocol,let us highlight the major difference in comparison with the protocol by Pinkas,which are related to(safely)computing the majority circuit.In our protocol,we need commitments twice for the computation of the majority circuit,to prevent both Alice and Bob from cheating.First of all,let us stress the importance of the committed ordered pairs COP i,j,that Bob sends (in Phase1in the protocol below)for each of his i-th output wires in the circuit GRC j.On the one hand,the COP i,j’s are necessary to prevent Bob from cheating,since Alice has to determine a majority circuit from randomized output values,and she needs to be ensured that the randomized output values that Bob sends are consistent with the actual output values.Since she can check if the committed ordered pairs were correctly prepared for the opened circuits,she knows with high probability that the randomized output values of the unopened circuits are also related to the actual output values.On the other hand,the hiding property of the commitment scheme assures Bob that Alice cannot learn the other garbled output value.Secondly,we use commitments called D j in another phase of the protocol,namely Phase5.This is because Alice has to commit to the garbled output values of all the evaluated circuits and send these commitments to Bob before he opens the committed ordered pairs.By the binding property, this ensures Bob that Alice cannot change the output values once the commitments are received. After the commitments COP i,j have been opened,Alice can determine the majority circuit GC r, and she opens only the commitment D r to Bob.Hence,the protocol that we will now describe,has Pinkas’original protocol as a basis,but is improved by using Committing OT(following[2])and by using the commitments with our modi-fication over the circuit C f as explained above.Description of our protocolLet b∈{0,1}.In Phase1,Bob prepares the garbled randomized circuits GRC j for j=1,...,m. He also generates the commitments to his garbled input values as A b i,j.He sends these circuits and the commitments to Alice.In Phase2,Committing OT is run in order for Alice to learn her garbled input values.Bob is the sender with private input w0i,j,w1i,j,and Alice is the receiver with private input b∈{0,1}.At the end of committing OT Alice receives w x ifor her input bit x i and Bob gets no information abouti,jwhich one is chosen.Also,the common output for them is commit B(w0i,j,w1i,j;δi,j)[2].In Phase3,Alice randomly chooses a set U of size m/2.She asks Bob to open the circuits GRC j for j/∈U.She also asks Bob to open the commitments commit B(w0i,j,w1i,j;δi,j)for j/∈U to check whether they are correct.In Phase4,Bob sends the sets C1j to Alice to open all the circuits and all the commitments for j/∈U so that Alice can check whether they are correct in Phase5.Note that Bob also opens the committed ordered pairs COP j,j/∈U since it is a part of the construction of GRC j.He also sends the set C2j that contains his garbled input values for the circuits GRC j,j∈U.Then Bob has to prove to Alice the consistency of the commitment per his input wire in each circuit GRC j,j∈U. This proof has to be applied since a malicious Bob might send different inputs for the circuits GRC j where j∈U.For example,for most of the circuits GRC j,j∈U Bob might use garbled input values w0i,j for his input bit1where i∈I B and therefore,when Alice evaluates the circuits GRC j,j∈U she could determine an incorrect majority circuit.Hence,Alice must be ensured that Bob uses exactly the same input in each of the circuits GRC j,j∈U.Therefore,Bob sends his inputs with a proof of consistency of the commitments A b i,j published before.The consistency proof can be done with the proofs of partial knowledge method[1]in which Bob proves that either all m/2garbled values correspond to a0input,or all m/2garbled values correspond to a1input using the commitments A b i,j without revealing his private input.In Phase5,Alice verifies the circuits and the commitments for j/∈U.She detects wrong gar-bled input values mitting OT is verified as follows:Bob opens the commitments commit B(w0i,j,w1i,j;δi,j)for i∈I A and j/∈U and Alice checks that her garbled input values w0i,j,w1i,j used in committing OT are equal to the corresponding circuit garbled input values,and thefirst garbled input value w0i,j in committing OT represents0and the second value represents w1i,j in committing OT represents1.If any of the verification fails Alice aborts the protocol.If the proof checking succeeds,she evaluates the circuits GRC j for j∈U using the set C2j that contains garbled input values of Bob.and computes the garbled output values.She then commits to his output values as D j=commit A( w i,j:i∈O B ;γi,j)for j∈U and sends them to Bob.The commitments D j are generated to assure Bob that the committed values in D j are circuit output values.After Bob receives the commitments D j he opens the committed ordered pairs COP j for j∈U by sending C3j= w b i,j,αb i,j:i∈O B,b∈{0,1} for j∈U in ter Alice will check this commitment opening in Phase7.In Phase7,Alicefirst checks the opening of the commitments COP i,j for j∈U.If the check succeeds,then she determines a majority circuit GRC r for some r∈U.Note that she can determine the majority circuit GRC r without further interaction with Bob since the additional input wires that were used to randomize Bob’s output wires are all the same for the same wire in each of the circuits GRC j where j∈U.Shefinally matches her outputs with the OP i,r where i∈O A and gets f1(x,y).Bobfirst checks whether the commitments D r are correct in Phase8.He then verifies that w i,r’s are one of his garbled output values for the same i wire in the circuit GRC r which ensures Bob that w i,r is correct(since Alice cannot compute the other garbled output value).Bob then matchesthe garbled output values that are received from Alice with the corresponding OP i,r for i ∈O B and the additional wire values in terms of bits (he knows how he made them garbled).Bob finally computes his output f 2(x,y )by XORing his randomized output wire for the circuit GRC r with the corresponding additional wires.Precise Description of the New Protocol Notation:–(c,d )=commit P (m ;r )refers to a perfectly binding commitment scheme to a message m using a random number r generated by the party P ,where c is the commitment and d is the decommitment information needed to open the commitment.Typically d =(m,r ).–I A denotes Alice’s input wires and O A her output wires.Similarly,I B denotes Bob’s input wires and O B his output wires.C f is the boolean circuit which computes the function f .RC f is the randomized boolean circuit which computes the function f and |RC f |denotes the number of gates in the circuit RC f .W RC f denotes all the wires and |W RC f |denotes the number of wires in the circuit RC f .–Commitment to an ordered pair OP i,j =(w 0i,j,w 1i,j )is denoted COP i,j =(commit B (w 0i,j ,w 1i,j ;αi,j )).–Randomized circuit RC f is converted into garbled randomized circuits GRC j ,j =1,...,m defined byGRC j = PEG-4-Tuple i,j :1≤i ≤|RC f | , OP i,j :i ∈O A , COP i,j :i ∈O Bwhere PEG-4-Tuple i,j denotes the permuted-encrypted-garbled-4-tuple i,j (this is generated in the construction phase of the garbled circuit,see Appendix A for more details),OP i,j denotes the ordered pair and COP i,j denotes the committed ordered pair.Common Input:f Compute:f (x,y )=(f 1(x,y ),f 2(x,y ))AliceBob Private Input:x =x 1...x l Private Input:y =y 1...y lPhase 1-ConstructionConstruct GRC j for j =1,...,mSet A b i,j =commit B (w b i,j ;βb i,j )for i ∈I B ,b ∈{0,1},j =1,...,m←−−−−−− GRC j :j ∈{1,...,m } −−−−−−−−−−−−−−−−−−−−−−−−−−←− A b i,j :i ∈I B ,j ∈{1,...,m },b ∈{0,1} −−−−−−−−−−−−−−−−−−−−−−−−−−−−−−−−Phase 2-Oblivious Transfer Run l times in parallel,for all i ∈I APriv.Input:x iPriv.Input: w 0i,j ,w 1i,j :j =1,...,m Committing OT←→Priv.Output: w x i i,j :j =1,...,mPriv.Output: δi,j :j =1,...,m Common Output:B i,j = commit B (w 0i,j ,w 1i,j ;δi,j ):j =1,...,mPhase 3-Random SelectionU ∈R {V ⊆{1,...,m }:|V |=m/2}−U −−−−−−−−−−−−−−−−−−−−−−−−−−−−−−−−−→Phase 4-Opening and ProofC 1j = w b i,j :i ∈W RC f , αb i,j :i ∈O B , βb i,j :i ∈I B ,δb i,j :i ∈I A ,b ∈{0,1} for j /∈UC 2j = w y i i,j :i ∈I B for j ∈UOR-Proof:∀i ∈I B ∃z i ∈{0,1}∀j ∈U ∃βi,j :A zi i,j =commit B (w y i i,j ;βi,j )←−C 1j ,C 2j ,OR-Proof −−−−−−−−−−−−−−−−−−−−−−−−−−−−−−−Phase 5-Verification and Evaluation of the CircuitsCheck GRC j for j /∈UA b i,j ?=commit B (w b i,j ;βb i,j )for i ∈I B ,j /∈U,b ∈{0,1}B i,j ?=commit B (w 0i,j ,w 1i,j ;δi,j )for i ∈I A ,j /∈UVerify OR-Proof Evaluate GRC j for j ∈U ,using C 2jCompute D j =commit A ( w i,j :i ∈O B ;γj )for j ∈U−D j ,j ∈U −−−−−−−−−−−−−−−−−−−−−−−−−−−−−−−−−−→Phase 6-Opening of COP i,jC 3j = w b i,j ,αb i,j :i ∈O B ,b ∈{0,1} for j ∈U←−−C 3j ,j ∈U −−−−−−−−−−−−−−−−−−−−−−−−−−−−−−−Phase 7-Verification of COP i,j and Decision of Majority CircuitCOP b i,j?=commit B (w b i,j ;αb i,j )for i ∈O B ,j ∈U,b ∈{0,1}Determine majority circuit GRC r where r ∈U −−−−−−−−−−r, w i,r :i ∈O B ,γr −−−−−−−−−−−−−−−−−−−−−−−−−→Phase 8-Verification of the Garbled OutputD r ?=commit A ( w i,r :i ∈O B ;γr )Match w i,r with (w 0i,r ,w 1i,r )for all i ∈O A tocompute actual outputs.Private Output:f 1(x,y )Match w i,r with (w 0i,r ,w 1i,r )for all i ∈O B andapply XOR with the additional input wires tocompute actual outputs.Private Output:f 2(x,y )。