BitGC Made (More) Efficient

Artifacts of the Eurocrypt 2026 paper BitGC Made (More) Efficient.

C++ implementation of two BitGC garbling variants:

• fast — 5 communication bits per AND gate, free XOR.
• small — 1 communication bit per AND gate and 1 per XOR gate.

Build

Prerequisites

• Linux (Ubuntu 22.04+ recommended)
• C++17 toolchain, CMake (>= 3.16), Ninja
• Intel HEXL
• Microsoft SEAL 4.1.x installed with HEXL enabled
• emp-toolkit/emp-tool

sudo apt install -y build-essential cmake ninja-build git pkg-config \
                    libgmp-dev zlib1g-dev

Building HEXL and SEAL

# HEXL
git clone https://github.com/intel/hexl.git && cd hexl
cmake -S . -B build -GNinja \
  -DCMAKE_BUILD_TYPE=Release -DBUILD_SHARED_LIBS=ON
cmake --build build -j && sudo cmake --install build && cd ..

# SEAL v4.1.2 with HEXL (AVX2)
git clone https://github.com/microsoft/SEAL.git && cd SEAL
git checkout v4.1.2
cmake -S . -B build -GNinja \
  -DCMAKE_BUILD_TYPE=Release \
  -DSEAL_USE_INTEL_HEXL=ON \
  -DSEAL_BUILD_TESTS=OFF \
  -DSEAL_BUILD_EXAMPLES=OFF \
  -DSEAL_BUILD_BENCH=OFF \
  -DCMAKE_CXX_FLAGS_RELEASE="-O3 -DNDEBUG -mavx2"
cmake --build build -j && sudo cmake --install build && cd ..

Building this artifact

cmake -S . -B build -GNinja \
  -DCMAKE_BUILD_TYPE=Release \
  -DCMAKE_CXX_FLAGS_RELEASE="-O3 -DNDEBUG -march=native" \
  -DCMAKE_INTERPROCEDURAL_OPTIMIZATION=ON
cmake --build build -j

Usage

./build/bin/bench_bitgc_e2e [options]

Options:

--variant=fast|small      protocol variant
--circuit=<path>          Bristol-format circuit (default: circuits/aes_128.txt)
--offline-dim=<int>       log2 of N_PRG
--online-dim=<int>        log2 of N_Gate
--offline-level=<int>     offline-level data limbs
--online-level=<int>      online-level data limbs
--seed-size=<int>         number of seed ciphertexts (default: 1000)
--check=none|output|wire  correctness check level (default: wire)

Correctness demo test

Runs in seconds at low memory. Ring-dimension profile is not 128-bit secure and is intended only as a correctness check.

./build/bin/bench_bitgc_e2e --variant=fast \
  --circuit=circuits/sub64.txt --offline-dim=9 --online-dim=8 --check=wire

./build/bin/bench_bitgc_e2e --variant=small \
  --circuit=circuits/sub64.txt --offline-dim=9 --online-dim=8 --check=wire

AES-128 test with 128-bit security

Uses circuits/aes_128.txt and the variant defaults above. The default run is single-threaded and memory-intensive. Plan for roughly 120 GiB RAM for running fast variant and 200 GiB RAM for small variant.

./build/bin/bench_bitgc_e2e --variant=fast  --check=wire
./build/bin/bench_bitgc_e2e --variant=small --check=wire

--check=wire decodes every internal wire and verifies it against a plaintext evaluation. Use --check=output for a faster output-only check or --check=none to skip checking entirely.

Bristol-format circuits

circuits/ ships four examples: aes_128.txt, mult64.txt, sub64.txt, xor64.txt. Any other Bristol-format circuit can be passed via --circuit.