KORD: Breaking the Key-Generation Bottleneck in Dealerless FSS via Protocol--Hardware Co-Design

KORD: Breaking the Key-Generation Bottleneck in Dealerless FSS via Protocol–Hardware Co-Design Yijing Peng†‡ , Lin Liu†‡∗ , Yujie Xue† , Shaojing Fu† , Shaoqing Li†‡ , Yaohua Wang†‡ , Rongmao Chen† , Yang Guo†‡

arXiv:2608.30379v1 [cs.CR] 31 Aug 2026

† College of Computer Science and Technology, National University of Defense Technology, Changsha, China ‡ Key Laboratory of Advanced Microprocessor Chips and Systems, National University of Defense Technology, Changsha, China of the whole system, and the inherent dealer dependency also brings unavoidable trust risks, single-point failures and deployment restrictions, which greatly limit the practical applicability and security of FSS privacy-preserving systems. To tackle such problems, researchers also propose dealer-free deployment schemes [15], [20], [54]. Floram [15] pioneers a work where the FSS key could be generated without a dealer, then proposes the first dealer-less Distribution Point Function (DPF). After that, Half-tree further optimizes the DPF and then present a dealer-less Distribution Comparison Function (DCF). Unfortunately, neither of them can support arithmeticshared inputs or outputs which limits their applications, such as privacy-preserving machine learning inference or training [14], [21]. Most recently, Xing et al. [54] proposed a 2PC FSS scheme which can generate FSS keys for DPF and DCF without a dealer, supporting both arithmetic-shared inputs and outputs. The key limits of this work lie in two aspects: • Linearly growing communication. At the heart of every FSS key is a GGM tree [18], a binary tree of pseudorandom seeds expanded one level per bit of the ℓ-bit input, where each level publishes a small correction word computed jointly from both parties’ secret seeds. A dealerless protocol must therefore run an interactive at every level, so communication and interaction rounds grow linearly with ℓ, which its own evaluation places at seconds per key over a WAN [54]. • Full-tree expansion. Since the hidden point is secretshared, neither party knows which path of the tree is the special one, so the Gen algorithm must expand the full GGM tree of 2ℓ leaves for every key (Algorithm 2 of [54]); generation computation therefore grows exponentially with the input width, even when communication is discounted. Both costs recur for every one of the millions of keys an application consumes, making key generation the major bottleneck of dealerless FSS deployment. To address these challenges, we propose KORD, a protocol– hardware co-design that confines the joint key-generation state of the 2PC to a pair of special-purpose chips, which establish a common root of trust during a one-time setup. Moreover, each chip reconstructs the key’s parameters inside its security boundary and expands only the special path, reducing per-key computation from exponential to linear in ℓ. Since different keys have independent seed chains, KORD introduces a cross-key

Abstract—Function secret sharing (FSS) has become a core primitive in privacy-preserving computation. However, each FSS invocation requires a fresh pair of function keys generated by a trusted dealer , expands the system’s trust boundary and hinders practical deployment. Existing dealerless protocols eliminate this dependency, but incur substantial communication and a number of interaction rounds that grows linearly with the input bit-width, making key generation a major bottleneck. This paper present KORD, a protocol–hardware co-design that dramatically reduces the cost of dealerless FSS key generation. At its core is a pair of special-purpose chips that establish a common root of trust through mutual attestation and, within it, reconstruct FSS keys—eliminating the need for a dealer. This root of trust further forms a security boundary within which KORD restructures the generation protocol, collapsing the interaction of prior dealerless protocols into a single round, independent of GGM depth. A cross-key scheduling scheme then interleaves independent GGM-tree traversals, sustaining high computational throughput. KORD reduces per-key-generation communication by 7,633–70,274× over the state-of-the-art distributed FSS protocol across a comprehensive suite of FSS building blocks. Post-route analysis projects 12.75 million 32-bit DPF keys per second at 204 MHz using 21.5K LUTs, with 99.8% AES lane utilization. On private ResNet-18 inference, KORD cuts the share of end-to-end time spent on key generation from over 96% to 11.9%.

I. I NTRODUCTION Function Secret Sharing (FSS) has recently become an increasingly prevalent and powerful privacy-preserving computing technique, which has been extensively adopted in secure two-party computation (2PC) and various real-world privacysensitive scenarios [21], [25], [48] due to its outstanding online efficiency and low communication overhead [7], [8], [17]. Similar to mainstream preprocessing-based 2PC frameworks, FSS-based secure computation decouples the entire computing process into two independent stages, i.e, an offline preprocessing stage and an online evaluation stage. The offline stage performs all heavy cryptographic computation to generate input-independent correlated randomness, i.e., a key pair. The production of which usually relies on a trusted dealer. The online stage only executes lightweight computing operations based on the pre-generated randomness, effectively reducing online interaction latency and communication pressure. Despite the remarkable efficiency advantages, the dealerbased conventional FSS-based 2PC protocols weaken the system’s security guarantees. The secure generation and synchronization of such paired keys become the core bottleneck ∗ Corresponding author: Liu Lin (liulin16@nudt.edu.cn)

1

scheduling fabric that interleaves many in-flight keys, filling TABLE I N OTATION . one key’s dependency bubbles with another’s ready work and raising lane utilization from 8.3% to 99.8% in cycle-accurate Symbol Meaning λ security parameter (128 throughout) RTL simulation. ℓ, ℓout input and output bit width of a gate The contributions of this work can be summarized as follows. α, β hidden point and payload of a key • We propose KORD, a new protocol–hardware co-design P0 , P 1 ; C 0 , C 1 the two parties and their KORD chips ⟨x⟩b Pb ’s additive share of x that generates FSS keys without any dealer, reducing perkb Pb ’s FSS key share key communication to a fixed single round, independent G length-doubling PRG (fixed-key AES) of the input length, while cutting per-key computation sjb , tjb level-j seed and control bit of Pb CW j , CW V correction word and value correction word from exponential full-tree expansion to a linear walk of j Kch shared root seed (master, set at pairing) the special path. kr , kp Kch subkeys: root derivation; KORD-mac channel • We introduce a cross-key scheduling design that interKotp session keystream secret (default channel) leaves independent GGM traversals through a single ctr monotonic message / per-key counter W, M fabric lanes and in-flight key slots shared AES lane array, raising lane utilization from 8.3% to 99.8% in cycle-accurate RTL simulation, a saturation behavior confirmed on silicon. instantiated with fixed-key AES [37]. Traversal begins with an • We implement KORD end-to-end and validate it on independent root seed s0b and control bit t0b = b for each party. a physical ZCU102 board, where 60 keys reproduce At level j, the generator expands both parties’ level-(j − 1) the golden stream bit-exactly, every fail-closed attack seeds and publishes the correction word class is rejected, and the online path runs bit-exact past   α α L R R 214 MHz. Across nine FSS building blocks, KORD CW j = s0 j ⊕ s1 j , tL 0 ⊕ t1 ⊕ αj ⊕ 1, t0 ⊕ t1 ⊕ αj , (3) reduces per-operation key-generation communication by 7,633–70,274× over the state-of-the-art dealerless proto- where αj is the j-th bit of α and αj selects the child off the col [54]; the synthesized fabric projects 12.75 million evaluation path. Each party applies CW j exactly when its DPF-32 keys/s; and on private ResNet-18 inference, the control bit is set. Off the path, the parties’ seeds and control key-generation share of end-to-end time falls from over bits coincide and cancel in Eq. (1); on the path, they diverge. The final correction word maps this divergence to shares of 96% to 11.9%. the payload: II. BACKGROUND AND T HREAT M ODEL
ℓ CW ℓ+1 = (−1)t1 β − Convert(sℓ0 ) + Convert(sℓ1 ) , (4) A. FSS, DPF/DCF, and the GGM Construction Table I summarizes the notation used throughout the paper. where Convert is a pseudorandom map from seeds to G. AVDCF A two-party FSS scheme [8], [17] for a function family key additionally includes one value correction word CW j per F = {f : {0, 1}ℓ → G} over an Abelian group G consists level, derived from the same joint seed state [8]; its correctness of two algorithms, (Gen, Eval). The key-generation algorithm lemma appears in the anonymous supplementary material. A DPF key share occupies λ + ℓ(λ + 2) + ℓout bits, while a Gen(1λ , fˆ) produces a key pair (k0 , k1 ), while Eval(b, kb , x) DCF key share adds one ℓout -bit value correction word per level denotes the local evaluation performed by party Pb . Correctness [4], [8]. Two structural properties determine key-generation requires cost. (P1) Depth-serial expansion: level j consumes the seed Eval(0, k0 , x) + Eval(1, k1 , x) = f (x) for all x ∈ {0, 1}ℓ . produced at level j − 1, making each key a serial chain of (1) ℓ dependent AES calls and creating a hardware latency wall. Security requires the distribution of either key in isolation to (P2) One-time keys: α is bound to the fresh mask of the value be simulatable given only the public parameters (λ, ℓ, G). consumed by the gate; reusing one key for two inputs therefore Distributed point functions (DPFs) [8], [17] and distributed breaks hiding. Keys are consumable objects, so any key source comparison functions (DCFs) [4], [8] instantiate FSS for point must sustain the workload’s full gate rate. and comparison functions, respectively: In the online phase, each gate requires one local evaluation ( ( and one round to open a masked value using one or two ring β, x = α, β, x < α, < elements [8], [9], [22]. All remaining costs arise during key fα,β (x) = fα,β (x) = 0, otherwise, 0, otherwise. generation. In a dealerless design, key generation also incurs (2) the cryptographic interaction required to construct Eq. (3) from Here, α ∈ {0, 1}ℓ is the hidden point and β ∈ G is the payload; both parties’ seed chains at every level. throughout this paper, G = Z2ℓout . Equality and point lookup reduce to DPF evaluation, whereas comparison, ReLU, and B. Threat Model and Security Boundary truncation reduce to DCF evaluation [4], [22]. Parties and corruption model. P0 and P1 execute a twoBoth primitives use a binary GGM tree [18] of depth ℓ. party computation under the semi-honest model, which is also A length-doubling PRG, G(s) = (sL , tL , sR , tR ), advances assumed by the dealerless baseline. All analyses and reported each party by one level for every input bit and is typically results use this model. Malicious parties are outside our scope;

2

extending KORD to this setting, for example by batching MACs only within this boundary. All inter-site traffic is authenticated over key requests, remains future work. ciphertext, and each party exchanges only its own input shares System components. Each party’s machine contains one and resulting key share with its local chip. Each chip is trusted special-purpose KORD chip: C0 at P0 and C1 at P1 . The to perform exactly three functions: authenticate and decrypt chips load no executable code and accept only the protocol’s requests; reconstruct (α, β) and expand it into standard key fixed message format. Neither chip has a network interface; shares; and emit those shares while zeroizing all intermediate instead, the host stacks relay an end-to-end logical channel state. The minimality argument treats each of these functions whose messages are processed by the secure-channel units. as necessary. Adversary capabilities. We consider three adversarial Cross-party trust. P0 must trust the chip deployed at P1 ’s positions. First, a semi-honest party observes its own inputs site, and P1 must symmetrically trust the chip at P0 ’s site. and shares, the key shares emitted by its chip, and the protocol Because each chip reconstructs the complete (α, β) and holds transcript; the simulation-based analysis requires this view to Kch , compromising either chip exposes both parties’ keys reveal nothing further. Second, the inter-site network, including and masks associated with that pairing. This exposure is the all relay software, is semi-honest in the default deployment, inherent cost of the minimal-hardware-root approach. Under matching the model of the parties and of the dealerless baseline: our model, the trusted component is vulnerable only to physical it may read every message but delivers faithfully. Confidentiality compromise, whereas the dealer it replaces is also exposed against this path rests on the one-time session keystream; online. A party that cannot audit or attest the remote chip has integrity is an assumption rather than an enforcement, since no recourse within this model. a keystream mask is malleable. The hardened KORD-mac III. M OTIVATION deployment removes exactly this assumption: the network may drop, modify, reorder, or replay messages, the secure A. FSS Requires an Application-Rate Key Stream channel rather than the transport provides integrity and replay FSS shifts online nonlinear computation into the consumpprotection, and a network adversary cannot cause a chip to tion of one-time key material. Each comparison, lookup, ReLU, accept a forged, modified, replayed, or cross-substituted frame truncation, or oblivious access consumes one or more fresh (Section VI). Each host handles its own party’s plaintext and, key pairs, and independent operations cannot reuse them. like the party itself, is assumed semi-honest. Consequently, Large private-inference and query workloads therefore create share modification by a host constitutes a protocol deviation a sustained key stream rather than a finite startup batch. and is outside the model. Third, a physical adversary that opens In the dealerless ResNet-18 workload evaluated later, key either chip defeats the scheme. Pairing-time attestation prevents generation accounts for at least 96.9% of end-to-end time; device substitution at deployment but does not protect against the full workload model and baseline methodology appear in invasive attacks during the device’s lifetime. Section VII-C. Trust anchors. A one-time attested pairing at deployment Correctness alone is consequently insufficient for a deployestablishes the system secrets. The chips mutually attest [13], able key source. It must satisfy three system requirements: [24] and agree on a shared root seed Kch , the session keystream (1) no dealer; (2) a number of per-key interaction rounds secret Kotp that encrypts every inter-site message in the default independent of the input bit-width ℓ; and (3) a key-supply channel, and initial monotonic counters ctr . Thereafter, both rate that matches application demand. The first two govern chips apply the same domain-separated key schedule to derive deployment and network scalability, while the third determines identical material from Kch without further communication. whether key generation remains off the application’s critical The channel subkey kp encrypts and authenticates every inter- path. site message using AES-GCM in the hardened KORD-mac deployment. The root subkey kr , combined with a per-key B. Existing Key Sources Trade Trust for Communication Deployed FSS systems follow three routes (Figure 1). A counter advanced in lockstep, derives the two DPF/DCF root seeds s00 and s01 . Domain separation keeps kp and kr compu- trusted dealer [22] samples both keys centrally, enabling low tationally independent. Root expansion uses the fixed, public interaction and centralized acceleration. The dealer, however, AES-MMO convention; FSS security relies on the secrecy of observes the joint key-generation state and becomes an adthe roots rather than the expander. After pairing, the hosts ditional trusted principal and single point of compromise. observe only protocol messages. We model attestation as an Dealerless 2PC [15], [54] removes that principal by computing imported provisioning primitive based on symmetric pre-shared GGM correction words jointly, but existing protocols emulate master keys. Certificate chains, measured boot, and physical this computation level by level. Their interaction rounds entropy are assumptions rather than mechanisms established therefore grow with GGM depth, and their communication by KORD; accordingly, the model provides attestable pairing grows as Θ(λℓ) per key, limiting the attainable key-supply rate rather than a complete certificate-backed attestation protocol. over a network. Security boundary. The security boundary comprises the A third route accelerates the local kernels of either design two chips and the logical channel connecting them; the parties, with CPUs, GPUs, or AES datapaths [21], [25], [53]. Existing hosts, and physical network remain outside. Plaintext copies of acceleration improves the execution of a route, but does not (α, β), the seed chains used in Eq. (3), and the root seed exist change its trust and interaction structure: it changes neither

3

Wall 1: trust

(1) No dealer Accelerate a route

D

Dealerless 2PC

faster local kernels; same trust and interaction

1

1

KORD 2

2 × 3 ×

(2) Depth-independent interaction

( , ) only inside

( , )

Wall 2: communication

One-round generation

P1

exchange once

× ( )

depth-serial levels idle the AES pipeline

(3) Application-rate key supply

one key: 8.31% utilization (RTL)

Fig. 1. Design space for FSS key sources. Dealer-based and dealerless-2PC routes trade among no dealer, depth-independent interaction, and applicationrate key supply. Accelerating a route does not change its trust or interaction structure. KORD targets all three under a minimal hardware root. The trilemma is descriptive, not an impossibility result.

C1

no principal ever plays dealer roots derived in lockstep; encrypted shares cross once

C0

F0

F1

C1

4--16 B per party per key

Wall 3: compute

3

C0

joint view = the key material

P0

3

paired chips

relocate

CWs by OT: ( ) rounds, ( ) bits per key

Trusted dealer 1 × 2

In-chip reconstruction

the Gen holder sees every ( , )

Cross-key fabric

interleave

independent keys fill one another's bubbles M keys: 99.84%; keys/s = fmax W/(c )

Fig. 2. KORD design overview. Each wall identified in this section (left) maps to the KORD mechanism that removes it (right): relocate the joint view into paired chips, exchange once over the network, and interleave independent keys through a shared array (Sections IV and V).

who holds the joint key-generation state nor whether the parties interact at every level. The cost is substantial in practice. At ℓ = 16, our reproduction of the state-of-the-art dealerless DPF generator [54] transfers roughly 80 KB per party across hundreds of messages; the complete formulas, reproduction procedure, and extrapolation policy appear in Section VII-A. These routes define the descriptive trilemma in Figure 1; they do not establish a formal impossibility result.

its next level until the AES pipeline returns the previous result. In cycle-accurate RTL simulation, an isolated key occupies KORD’s pipelined AES lanes in only 8.31% of issue cycles. Replicating complete engines can increase throughput, but scales area and state storage with the number of replicas. Observation 3: independent keys expose cross-key parallelism. The dependence is unavoidable within one key, but different keys have independent seed chains. Interleaving multiple GGM traversals through a shared array can fill C. Structural Causes and Architectural Implications one key’s dependency bubbles with another key’s ready The tradeoff above has a structural cause. Resolving it moves work. The architecture should therefore optimize sustained the bottleneck from communication into computation and yields key-supply throughput rather than only single-key latency. Design Requirement 3: the architecture must exploit cross-key three requirements for the architecture (Figure 2). Observation 1: the joint view couples trust and com- parallelism to sustain the application’s key-consumption rate. These observations yield three requirements: confine the joint munication. A DPF/DCF generator forms each correction word from the joint view of both parties’ seed chains. This view to a minimal protected boundary, make per-key interaction joint key-generation state is sensitive because it determines independent of GGM depth, and exploit cross-key parallelism to the complete function. Giving it to an independent principal overcome serial GGM dependence. The following architecture creates a dealer; emulating access to it between the parties realizes these requirements through protocol–hardware cothrough existing 2PC constructions creates per-level interaction. design. Faster OT, AES, or PRG implementations reduce the cost of IV. T HE KORD A RCHITECTURE AND C ORE D ESIGN each step but do not change where the joint state resides or how many levels require interaction. A minimal protected, A. Key Design Goals KORD must generate FSS keys without a dealer. At no special-purpose boundary offers a third location for this state. phase may any single machine hold the point–payload pair Design Requirement 1: joint key-generation state must remain (α, β) or both keys. KORD must also emit keys bit-identical inside a minimal protected boundary. Design Requirement to a dealer’s so that evaluation and every higher software layer 2: the number of per-key network interaction rounds must be run unchanged. Its goals map one-to-one to the three walls in independent of the GGM depth ℓ. Figure 2; Section V implements them in hardware: Observation 2: relocating generation exposes a compute wall. Confining the joint view to hardware removes the level• In-chip reconstruction (wall 1, trust). The parties hold only by-level network emulation, but the protected boundary then additive shares of (α, β); the pair may be reconstructed inherits a depth-serial GGM traversal. Level j expands the only where neither party, nor any other machine, can seed produced at level j − 1, so an isolated key cannot issue observe it, so no principal ever plays dealer.

4

Algorithm 1 KORD one-round DPF key generation (semi- Algorithm 2 KORD one-round DCF key generation (semihonest); red marks the single network round. honest); step 1 folds in the shared admission of Algorithm 1. Require: each party Pb holds ⟨α⟩b , ⟨β⟩b ; the paired chips Require: as in Algorithm 1, with the DCF mode and widths bound in the authenticated header fields hold the session keystream secret Kotp , the Kch -derived Ensure: each Pb obtains its standard DCF key share kb subkeys kp , kr , and matching counters ctr 1: run steps 1–6 of Algorithm 1 unchanged: submit shares, Ensure: each Pb obtains its standard DPF key share kb encrypt Fb , exchange in the single round, forward, bind 1: Pb (host): write the share pair (⟨α⟩b , ⟨β⟩b ) into the local counters (KORD-mac: verify fail-closed), decrypt and chip Cb ; a party’s own input crosses only its own local reconstruct (α, β) interface, never the network in plaintext 2: Cb : derive the roots (s00 , s01 ) ← KDF(kr , ctr ); t00 ← 0, 2: Cb : encrypt Fb ← (⟨α⟩b ∥ ⟨β⟩b ) ⊕ KS(Kotp , ctr b ) with the t01 ← 1; Vα ← 0 one-time session keystream (KORD-mac: Fb ← AEkp (·) 3: for j = 1 to ℓ do with mode, widths, and ctr b bound as authenticated header L R R ′ j−1 4: expand (sL fields); return the ciphertext Fb to the host; the channel b′ , vb′ , sb′ , vb′ ) ← G (sb′ ) for both chains ′ b ∈ {0, 1}, four PRG calls per chain, the value lanes secrets never leave the chips, so no host can open a frame v L , v R feeding the per-level value corrections; Keep/Lose 3: P0 ↔ P1 (the single round): P0 sends F0 to P1 while P1 from bit αj sends F1 to P0 ; only ciphertext crosses the network 5: form the seed correction CW j from the Lose-side 4: Pb (host): forward the received peer frame into Cb , so seeds by Eq. (3) each chip holds both F0 and F1 6: form the valuej−1 correction 5: Cb : bind each frame to the lockstep counter ctr b (KORD CW Vj ← (−1)t1 convert(v1Lose ) − convert(v0Lose ) mac: verify both tags under kp and both transported  counters; any failure aborts fail-closed, with no decryption − Vα + 1[Lose=L] β ; and no engine dispatch) update the running Vα by the recurrence of [4] 6: Cb : decrypt both frames; reconstruct α ← ⟨α⟩0 + ⟨α⟩1 , 7: advance both seed chains along the path to α β ← ⟨β⟩0 + ⟨β⟩1 ; the pair now exists, and only here 8: end for 7: Cb : derive the roots (s00 , s01 ) ← KDF(kr , ctr ), identical in 9: compute the final correction CW ℓ+1 ← ℓ  both chips by lockstep, so the roots are never transmitted; (−1)t1 convert(sℓ1 ) − convert(sℓ0 ) − Vα t00 ← 0, t01 ← 1 10: Cb : ctr ← ctr + 1; assemble kb ← 8: for j = 1 to ℓ do (s0b , {CW j , CW Vj }ℓj=1 , CW ℓ+1 ); zeroize (α, β), Vα , and j−1 9: expand G(sj−1 all seeds 0 ) and G(s1 ) with the fixed public PRG; form CW j by Eq. (3) 11: return kb to Pb only, over the local interface 10: advance both seed chains along the path to α 11: end for 12: compute CW ℓ+1 by Eq. (4); the loop is the algorithm’s only Θ(ℓ) stage, depth-serial within a key; independent parties. One simultaneous exchange of the two share messages is both necessary and sufficient. After the exchange, each chip keys interleave through it in hardware 13: Cb : ctr ← ctr + 1; assemble kb ← holds bit-identical inputs, independently computes the same correction-word stream, and emits only its own party’s key 0 (sb , CW 1 , . . . , CW ℓ+1 ); zeroize (α, β) and all seeds (Figure 4). This design eliminates the Θ(ℓ) rounds of oblivious14: return kb to Pb only, over the local interface transfer interaction. Each chip performs the same expansion as a dealer, so its cost matches the dealer’s. Prerequisite: attested pairing. Generation assumes that the • One-round generation (wall 2, communication). A key two chips already share Kch . KORD establishes this secret once, must cost a single exchange of fixed-size encrypted outside the per-key path, using the secure-initialization protocol messages, with no dependence of the round count on of PPMLAC [56] unchanged. Domain-separated KDFs then the bit width ℓ. yield k , k , and zeroed counters. Both sides of that protocol r p • Cross-key supply (wall 3, compute). The chip inherits contribute entropy, so a host can neither bias nor replay the the dealer’s depth-serial GGM expansion; by interleaving seed, and no host ever holds any derived secret. independent keys through one array it must still supply The exchange. The parties hold the bind point and payload keys at the rate the online phase consumes them. as additive shares, α = α0 +α1 and β = β0 +β1 . Neither party B. One-Round Key Generation knows α or β. Each party Pb submits its share pair to its own A DPF/DCF key pair is a deterministic function of three chip over the local interface, exposing only its own input. The inputs: the reconstructed (α, β), the two roots s00 , s01 , and the chip encrypts the pair into one ciphertext frame that is exactly PRG. Once paired, both chips derive identical roots from Kch the two share fields, Fb = (⟨α⟩b ∥ ⟨β⟩b ) ⊕ KS(Kotp , ctr b ): through kr and a per-key counter. They also share the fixed 2⌈ℓ/8⌉ bytes, or 4/8/16 B at ℓ = 16/32/64, with no per-frame public AES-MMO convention. The share pair is therefore the nonce or tag. The FSS mode and widths are public session only per-key input that a chip lacks, and it must come from both parameters fixed at pairing, and freshness comes from the

5

Nothing else crosses the network for that key. Algorithms 1 and 2 give the DPF and DCF bodies both chips then execute. In both algorithms, every step after the single exchange is local, the expansion loop is the unchanged dealer core [8], and the DCF value corrections follow [4]. Each chip emits its own party’s key share kb over the local interface, which is the party’s own protocol output, and advances its per-key counter. The counters remain matched as long as both chips accept the same message sequence. A network that makes the sequences diverge yields unusable keys, not leaked ones. From the algorithms to the hardware. The one-round property and the hardware boundary coincide. Steps 1, 3, and 4 (submit, exchange, forward) constitute the software’s entire role. Software holds no secret beyond the party’s own shares and emitted key share; every remaining step touches a secret and executes in hardware. The mapping onto the datapath is one-to-one, using the step numbers in Algorithm 1. Steps 2 and 5–6 map to the SCU and reconstruction zone, step 7 to the root-derivation unit, the loop in steps 8–12 to the fabric, and step 13 to the assembler and counter commit (Section V-B). The host may batch submissions and keep many keys in flight because each message is bound to its lockstep counter (under KORD-mac the counter is authenticated associated data, and the chip rejects misordered frames fail-closed). Within the hardware, the loop’s only data dependency is confined to one key. The fabric converts this property into throughput. Evaluation. The emitted keys are standard DPF/DCF key shares in the ordinary BGI-style layout [8]. They are bit-exact and interchangeable with dealer-generated keys, so the existing online stack runs unchanged on KORD with the same binaries and key semantics (verified in Section VII-C). Each party evaluates locally. The PRG is instantiated as fixed-key AES-128 in Matyas– Meyer–Oseas (MMO) mode [2], the standard choice for hardware FSS pipelines [1], [19], [25]. This PRG is functionally equivalent to, but not bit-compatible with, software stacks that default to per-node re-keyed AES. Interoperability therefore fixes the convention at pairing time. We validated the convention end-to-end. The RTL, our reference software, and the LLAMA stack under the MMO switch produce identical keys (101,334 field checks, zero mismatches). KORD-generated keys also drive a private ResNet-18 inference whose 1,000 unmasked logits exactly match the validated reference. This is a convention check under rebuilt binaries, separate from the end-to-end deployment run.

×M keys in flight

chip Cb : local Gen, identical in C0 and C1 (s00 , s10 ) KDF(kr , ctr), lockstep with peer s00 Keep

Lose

level j = 1. . , serial

party-1 chain

1 G

Keep

Lose

s0

OT

s10

no per-level messages

s1

2

4 5

identical inputs identical CW stream

CWj

3 bit j picks Keep

level : convert leaf seeds, fold in kb

CW + 1

roots derived, never sent

(sb0 , CW1. . + 1 ); zeroize ( , ) and all seeds

per-chip cost = dealer's

chip C1 b (identical)

party-0 chain

Fig. 3. After one exchange, each chip runs the identical local Gen over both parties’ seed chains (4-leaf tree shown). The chips derive the roots in lockstep 1 Expand each level with the public from (kr , ctr ) and never transmit them. ⃝ 2 XOR the two Lose-side seeds into CW j (Eq. (3)). ⃝ 3 AES-MMO G. ⃝ 4 Convert the Advance along the path to α; its bit selects the Keep child. ⃝ 5 Assemble and return only the leaf seeds into the final correction (Eq. (4)). ⃝ party’s own key. Levels are depth-serial within a key. No oblivious transfer or per-level message crosses between the chips. Kch (paired once) kr , kp , ctr

chip C0 encrypt

P0 host

0,

0

F0 (ciphertext)

F1

5 verify tags; fail-closed , sum of shares roots KDF(kr , ctr) GGM CWs; ctr+1; zeroize

6

k0

P1 host

1

1 2

F0

3

F1

2

1

F1 (ciphertext)

one round: ciphertext only

4

chip C1

1,

4

encrypt

F0

5 verify tags; fail-closed , sum of shares roots KDF(kr , ctr) GGM CWs; ctr+1; zeroize

k1

6

trusted boundary time trusted boundary Fb : encrypted frame, 2 /8 B (KORD-mac: +36); solid = network, dashed = local

1 Each party submits its Fig. 4. The one-round exchange in time order. ⃝ 2 The chip returns own share pair to its own chip over the local interface. ⃝ the encrypted frame Fb ; only this ciphertext ever leaves the trust boundary. 3 The hosts exchange F0 , F1 , the protocol’s only network round. ⃝ 4 Each ⃝ 5 Both chips verify, host forwards the peer’s frame back into its own chip. ⃝ 6 Each chip emits its own party’s key. Solid reconstruct, and expand alone. ⃝ arrows cross the network; dashed arrows are local host–chip transfers. Red dashed lines mark the trust boundaries.

counters both chips advance in lockstep; we set ℓout = ℓ C. Design Rationale throughout, and aggregate network traffic per key is the two Transmitting bound shares. KORD’s default deployment frames together. The hardened KORD-mac deployment instead transmits (α, β) shares even though some protocols allow wraps the same fields in per-message authenticated encryption one party to choose the mask under an FSS key. A selfunder kp , [nonce 12 | ctr 8 | ct 2⌈ℓ/8⌉ | tag 16], a fixed 36- chosen-mask deployment would reduce even KORD’s residual byte envelope (40/44/52 B) with mode and widths as associated communication to nearly zero. Three properties motivate the data; under it the SCU authenticates both messages before any default. Generality: in our workloads the bound point is a further processing, fail-closed: no decryption and no engine joint secret existing only as two shares (a DORAM index, dispatch (Section V-A). The hosts exchange the two messages in a compiled program’s wire mask). No party may know α. one simultaneous round, after which each chip holds {F0 , F1 }. The shares must be combined, and the reconstruction zone

6

is the one place where this can occur without re-creating a observable engine state (the 20/20 negative-trial evidence is in dealer. Compatibility: the chip consumes true shares and emits Section VI). The default channel replaces the GHASH/verify standard key shares, making KORD a drop-in key source. Self- stage with the session-keystream XOR and is a strict subset chosen masks instead change the protocol semantics around of the same hardware, so the SCU figures of Section VII-E every FSS gate. Model-aligned accounting: the default channel upper-bound the default channel’s cost; the engine and fabric assumes exactly the semi-honest setting of the parties and of behind the SCU are channel-agnostic. The remaining secrets the baseline, so the headline comparison is like-for-like; the never cross the boundary. The per-key roots are derived on-chip hardened KORD-mac tier prices the malicious-network upgrade from Kch through kr , and the pairing step establishes Kotp at a fixed 36 bytes per message. Self-chosen-mask protocols and the KORD-mac channel key kp . Replay protection requires can reduce key-generation communication under KORD to the sender to maintain a monotonic counter. essentially zero. Two consequences follow. First, the GGM fabric is realizable Shared-root-seed derivation. The one-round property de- only inside the trust boundary: its interleaved expansion state pends on never transmitting the per-key roots. This design is, level by level, the key material itself, so the same cross-key is sound for two reasons. (i) The root seed is created at pipeline built outside the boundary would be the dealer with attested pairing and resides only inside the two trust boundaries, extra steps. Second, KORD is not a generic AES accelerator. so the derivation has an empty network view. (ii) Both Hosts already have AES throughput; the boundary instead chips run the same deterministic derivation, making their protects the joint view of both parties’ seed chains to which roots identical by construction. Indistinguishability from ideal that throughput is applied. randomness then reduces to the pseudorandomness of the derivation function, the assumption class on which FSS security B. Datapath and Dataflow rests. The corresponding simulation step is the chip segment Figure 5 shows the host software, the trust boundary, and of the composition in the supplementary material. The KORD-mac deployment. KORD’s default channel rests every hardware module traversed by a key. The host side on the two assumptions stated in Section II-B: a semi-honest contains an unchanged FSS application and a driver that network path and a one-shot session keystream. KORD- accesses the chip through four memory-mapped operations. mac drops both. It wraps every message in per-message Inside the boundary, the key passes through the register authenticated encryption under the pairing-derived subkey interface and the SCU. The SCU contains one AES-GCM core kp , a fixed 36-byte envelope per frame (40/44/52 B at with its GHASH, an FSM that authenticates the two messages ℓ = 16/32/64), and in exchange tolerates a fully malicious serially, and the replay check. The remaining modules are network at O(λ + ℓ) communication. The prototype’s secure- the register-level reconstruction zone; the root-derivation unit, channel unit implements this hardened tier (Section V-A). Every which converts (kr , ctr ) into the two roots in lockstep with headline number uses the default deployment; the anonymous the peer chip; the template pool; the GGM fabric, comprising a key-slot file of M in-flight keys, an FCFS scheduler, W supplementary material details KORD-mac. AES-MMO lanes, and the correction-word unit; and the key V. H ARDWARE A RCHITECTURE AND I MPLEMENTATION assembler. Plaintext (α, β) exists only in the hatched zone, and All cycle-level results reported here come from cycle- every orange element acts only for DCF keys. 1 The driver writes the key’s type parameters, DPF dataflow. ⃝ accurate simulation of the same RTL synthesized in Section VIIcounter, and the two encrypted frames, and starts the operation. E. 2 The SCU authenticates F0 then F1 , each tag checked over ⃝ A. Realizing the Security Boundary the associated data (mode, bin , bout , ctr ) and the counter against The boundary of Section II-B is enforced by three mecha- the replay high-water mark. Any failure ends the flow with no 3 Only on double authentication nisms: a single message interface, fail-closed authentication, decryption and no dispatch. ⃝ and special-purpose datapaths that execute no loaded code. The does the reconstruction zone latch α ← ⟨α⟩0 + ⟨α⟩1 , β ← 4 trusted perimeter contains the hardware inside the message ⟨β⟩0 +⟨β⟩1 (registers, not SRAM, zeroized once consumed). ⃝ interface: the SCU, reconstruction zone, fabric, and assembler. The root-derivation unit supplies (s00 , s01 ) from (kr , ctr ). The 5 Nothing outside this perimeter is trusted with the counterparty’s key enters a free slot at level zero with its mode bit clear. ⃝ material. The system is therefore dealerless under a minimal Each cycle, the scheduler grants the oldest slot whose previous hardware root, not trust-free. The root is small, special-purpose, level has returned and issues the next complete level. A DPF and auditable, but it remains a root. level requires c = 4 AES-MMO calls: the L/R seed lanes of 6 The four lanes expand with equal latency and The SCU is the sole message interface. Every key crosses the both chains. ⃝ 7 The correction-word unit reads boundary in the fixed ciphertext-frame layout of Section IV-B; return in the same cycle. ⃝ under KORD-mac the FSS mode and widths ride as associated the path bit αj , forms CW j by Eq. (3), and writes exactly two data, authenticated but not hidden, adding no per-message bytes. corrected child seeds back to the slot; after the last level it forms 8 The assembler serializes The prototype’s SCU implements the hardened KORD-mac the final correction by Eq. (4). ⃝ channel (per-message AES-GCM) and is fail-closed: authenti- (s0b , CW 1 , . . . , CW ℓ+1 ) in statically provisioned SRAM with cation failure yields no decryption, no fabric dispatch, and no no heap or residue. The key leaves through the SCU egress

7

into the key window, where the host collects its own party’s key classes, whose hidden points are drawn in lockstep from share and nothing else. the seed stream before any request. A transmitted-share request DCF dataflow. A DCF key walks the same eight stations with takes the direct-generation path. Bind updates only payloadits mode bit set. This bit changes exactly three components, dependent corrections: the single final correction word for DPF, 4 the slot arms its independent of ℓ, and also the per-level value corrections for all orange in Figure 5. At admission ⃝, 5 the level uses DCF, linear in ℓ. The prototype does not implement binding. We running value accumulator Vα . At issue ⃝, c = 8 lanes instead of four. The VL /VR value lanes of both therefore withdraw the previously modeled bind-versus-expand chains fire alongside L/R, carrying the value-correction chain ratios; the verified path is direct generation. The prototype 7 the unit runs its value path verifies the direct-generation path end-to-end. It co-simulates of Algorithm 2. At extraction ⃝, 60 keys through the SCU, reconstruction, fabric, and assembler. after the seed path, forming CW Vj with the sign fixed by tj−1 1 and folding the level into Vα , which resides in the slot. The It records 4,540 checks and 60/60 authenticated messages with final correction is the converted level-ℓ seeds minus Vα , and zero errors. The co-simulation implements both chips’ identical the assembler appends the value corrections to the key layout. local generation in one engine. A two-chip deployment runs the same computation independently at each site. No other chip component distinguishes DPF from DCF. The template pool holds derived-mask trees (trees whose hidden points the chips draw in lockstep from the seed stream, E. The Wall, Measured on the RTL In hardware, per-key utilization is bounded by the RTL not from any party’s input), pre-expanded during idle cycles. Their contents never leave the boundary, and their only public latency. One expansion level takes Leff = 12 cycles: 11 cycles attributes are the type parameters bound as associated data, so of AES-lane pipeline latency plus one cycle of scheduling a message cannot be replayed against a different template. The turnaround. A single key therefore occupies the array at direction of the datapath never reverses: no unit downstream 1/Leff = 8.31% (measured in cycle-accurate RTL simulation, of the SCU can emit data except through the SCU egress, and not modeled), the remaining issue slots being dependency the reconstruction zone is written by the SCU and read by the bubbles (Figure 6). This floor applies to the simulated c = W configurations: DPF W = 4 and unified W = 8. With c < W , fabric only. the same law gives the DPF-only W = 8 engine a 4.17% floor C. Host Integration: Software–Hardware Co-Design and a knee at M ∗ = W Leff /c = 24. All utilization figures The chip exposes four memory-mapped operations to its below therefore refer to the simulated c/W = 1 pair. Every host (left half of Figure 5): provision at pairing time, submit reported utilization comes from an engine whose outputs match one key’s two messages, poll status, and collect the emitted a software oracle bit-for-bit: 108,276 checked values for the key stream. These operations and their encrypted messages are DPF engine and 226,920 for the unified DPF/DCF engine, with the entire host-visible surface of the trusted base. The division zero errors. The AES core also passes the FIPS-197 knownof labor follows the trust split. Host software performs all answer tests. flexible work that touches no secret beyond its own party’s: assembling and relaying messages, batching submissions to F. Cross-Key Interleaving: W Lanes, FCFS, M Slots The fabric fills each dependency bubble with a ready level keep M keys in flight, retrying after transport failure, and passing collected keys to the unchanged FSS stack. The chip from another key. Figure 6 shows its organization, one lane’s performs every step that touches a secret beyond the party’s microarchitecture, and the cycle-by-cycle schedule. The W own: authentication, reconstruction, expansion, and emission. AES lanes accept one block per cycle (initiation interval 1). A driver that corrupts, reorders, or replays ciphertext frames is The M key slots hold each key’s current seed pair, level counter, indistinguishable to the chips from the malicious network and and correction-word accumulator. Each cycle, a first-come-firstis rejected fail-closed. A driver that alters its party’s plaintext served scheduler issues the oldest slot whose next level is ready. shares before encryption deviates from the protocol, which the When a key stalls on its own dependency, another ready key semi-honest host assumption excludes. No cryptography in the fills its bubble (Figure 6d). Utilization therefore depends on the number of independent chains in flight, not on the latency chip can detect this deviation. The prototype implements this interface as an AXI4-Lite of one chain. Saturation has a closed form. The array is full when M ∗ = register window on the ZCU102, with Linux on the processing system as the host. Bit-exact comparison against the engine W ·Leff /c keys are in flight, where c is the number of AES calls regression’s golden vectors verifies the interface, including the per level. The swept configurations have M ∗ = 12. Past this knee, the saturated rate is keys/s = fmax W/(cℓ), with no L fail-closed negative trials. term. Pipeline depth moves the knee rather than the throughput D. Two Phases: Batch Generation, Constant-Time Bind frontier. AES latency thus sets the number of in-flight keys The datapath uses a split execution model. During the required for saturation, not the output rate. Figure 7 sweeps M offline phase, the fabric batch-expands GGM trees at full in cycle-accurate RTL simulation: at the knee M = M ∗ the utilization and off the critical path. The bind path is narrow by array reaches 96.67% (pipeline utilization, not to be conflated construction because a BGI key’s correction words depend on with the numerically adjacent key-generation time share ≥ every bit of α. Templates therefore serve only derived-mask 96.9% of Section VII-C), and four slots of headroom close

8

KORD chip Cb : trusted, fixed-function (minimal hardware root)

message regs key window

=?

kp kr hwm

poll status 1 submit {F0 , F1 }

register interface

CTRL / STATUS

AES-CTR GHASH

relay + batch

MMIO window (AXI4-Lite)

tags

0

pass

1 0

>?

1

ctr vs hwm

+

kr ctr

+

j

md

V

trees

5

level-serial state rides in the slot

7

R VL VR L R VL VR

AES

8 key assembler

CW / V-CW unit CWj V ,+

grant age FIFO: oldest ready, 1 level / cycle

AES (s) s

write-back: two corrected child seeds

kb

DPF: 4 seed lanes; DCF: all 8

sb0

j : pick Lose

c stg

FCFS sched. M slots, one in-flight key each

pre-expanded, idle cycles

AES-MMO lanes (W)

lane 0: seed s seeds, j, md

fixed-function FSMs no loaded code, no DRAM secrets never leave the boundary

bind 6

key-slot file (M) seeds

KDF (AES-MMO)

template pool ( , )

GGM fabric

the trusted base

root derivation

4

regs only; zeroized after use

fail: abort, no decrypt

provision (pairing) collect kb

3 reconstruction zone

convert

+

CW stream

V-CWj

KORD driver

F0 , F1

s00 , s10

2 SCU (secure channel)

s L, s R

FSS application

M:1

host Pb (software)

( 1)t

CW1 CW + 1 [V-CW1. . ] SRAM, statically provisioned

own party's key only

key window

Fig. 5. The complete KORD hardware organization. The host software stack is on the left, with four memory-mapped operations as its entire view of the chip. The red dashed trust boundary encloses every hardware element on the key path. Wedged boxes are clocked registers, trapezoids are muxes, ⊕ denotes XOR, and the D-shaped gate is the fail-closed dispatch AND. This gate remains closed unless both tags verify and the counter advances. Circled numbers 1–8 trace one key’s dataflow. Orange elements (value lanes, the Vα slot field, and the value-correction path) act only for DCF keys. Plaintext (α, β) exists only in the hatched reconstruction zone. The gray dashed panel is the semi-honest software side.

the remainder: M ≥ 16 sustains 99.84%. At M = M ∗ , the national reduction folds a level’s lane outputs into a correction scheduler has no redundant slots. A phase collision between word and remains unpipelined in the current design. Pipelining two ready keys therefore wastes an issue slot that FCFS cannot it would raise fmax and, by the saturation law, require more recover. Four additional slots, requiring a few hundred bytes slots without reducing rate. of state, eliminate this loss. The analytical model tracks the One datapath for DPF and DCF. DCF generation adds measured curve within 0.3% at every swept point, so the closed a value-correction-word chain, but unifying DPF and DCF form can provision the fabric. under one scheduler does not require a second datapath. PostStorage: The implemented in-flight state is 52.6 B per key, route, the unified engine uses +0.96% LUTs over a DCFso the saturated working set at M = 16 is 0.82 KiB. The only datapath (20,654 vs 20,457) at −0.25% fmax (154.6 vs analytical model allocates 64 B/key; the implementation uses 154.9 MHz). Replacing two separate engines, one DPF and one DCF, saves about half the resources: 50.8% of LUTs and less because keys stream out without a landing buffer. 50.3% of BRAMs (41,997 LUT/1,173 RAMB18 for the pair vs G. Calibers, the Frequency Limit, and One Datapath 20,654/583 unified). All figures are ZCU102 place-and-route We report two absolute quantities. First, cross-key interleav- estimates (synthesis-estimated, not board measurements). The ing raises utilization of the same hardware from 8.31% to scheduler already treats levels as independent issue units. A 99.84%. Second, at equal throughput, a purely data-parallel DCF level uses c = 8 AES calls instead of 4, and the saturation design with Leff independent single-chain engines would law accounts for this difference through c.

require 12 copies of the AES array to match one interleaved fabric and its 0.82 KiB of slot state. The fabric therefore delivers ≈ 12× the throughput per unit of AES area; the baseline area is an arithmetic extrapolation, not a synthesized design. We do not report speed-up as a headline result. The measured 12.01× saturation speed-up is bounded by Leff by construction and only validates the model against the RTL. The AES lanes do not limit frequency. Synthesized alone against a tight 2.5 ns target, both lanes close timing with positive slack. Their WNS-extrapolated frequencies are 409.0 MHz for the DPF lane and 420.2 MHz for the unified-FSS lane. In contrast, the full engines’ 204.0 and 154.6 MHz values are WNS-extrapolated fmax figures under fmax = 1000/(period − WNS), not timing-closure frequencies. The frequency gap comes from the correction-word extraction logic. This combi-

VI. S ECURITY A NALYSIS Under the threat model of Section II-B, KORD is dealerless under a minimal hardware root: no principal ever plays dealer. The anonymous supplementary material gives the full proofs. Qualitative analysis. For each party P ∈ {A, B}, the joint view of an adversary controlling P (semi-honest), the host at P ’s site, and the network (semi-honest by default; malicious under KORD-mac) is computationally simulatable from P ’s own shares (αP , βP ), the public template parameters, the message count, and message timing. The view is thus computationally independent of the true (α, β) and the honest party’s shares; even the delivered key share is simulated from single-share FSS pseudorandomness (Lemma B.3). The proof composes three simulators: pairing (authenticated key

9

11-stage pipeline, II = 1

k2 j j

s 0 , s 1 ; j; mode; V

k3

s0j , s1j ; j; mode; V

kM

s0j , s1j ; j; mode; V

grant (W)

CW (E)

R1 R2 R3

KL KR K VL K VR

public

R10 R11

(a) cross-key interleaving 100

MMO:

EK(s) s

seeds: write-back (E)

out demux: child seed value block

write-back: two corrected seeds +V (S)

value blocks

IS

t=0

EX

t=1

t = 12 DN IS

(d) M independent keys, FCFS-interleaved IS

t=0

EX IS

t=1

EX EX IS

t=2

CW unit (S)

0

j1 waits Leff = 12 cyc.

(c)

lane idle 11 of 12 cycles 8.31% DN EX EX

50 DPF (W = 4) model DCF unified (W = 8)

8.31%

t = 12 IS

16 0

issue frontier

1

2

4

8 12 16 in-flight keys M

(b) law vs RTL

1.0

M 16: 99.84%

M * = 12: 96.67%

wire B/key

(c) one key, depth-serial

k1 k2 k3

input reg: s ¬3 domain sel.

model RTL (%)

AES-MMO lanes (W) issue

AES-array util. (%)

k1j

s 0 , s 1 ; j; mode; V j

feed-forward s

FCFS scheduler --- grants the oldest ready level; 1 level / cycle

slots (M)

CW / V-CW unit --- Keep/Lose, corrections, final mux

GGM fabric

k1

(b) one AES-MMO lane

0 1

AES-128 rounds ×11

(a) fabric organization admit: ( , ), s 0 , s 0 (N)

32

0.0 0.5 1.0

64

max dev. 0.3%

0.5

1

4 16 in-flight keys M

DPF, = 16

DCF, = 32

DCF, = 64

mixed stream

4B

8B

16 B

4 16 B

key-stream progress

64

; one round/key; set by public type parameters only

Fig. 7. (a) Utilization of the shared AES array vs in-flight keys M , cycleaccurate RTL simulation (DPF W = 4 and unified DCF W = 8, both c/W = 1, so the saturation law predicts one curve and the RTL confirms it): single chain 8.31%; knee M ∗ = 12 reaches 96.67%; M ≥ 16 sustains 99.84%. (b) The closed-form law deviates from the RTL by at most 0.3% at every M . (c) The exchange segment’s observable surface: wire bytes per key are the fixed 2⌈ℓ/8⌉-byte frame (KORD-mac: +36 B) and one round, set by the public type parameters alone (design values; message-level observables only, physical side channels not empirically evaluated).

saturation knee M * = W Leff /c = 12: 96.67%; M 16: 99.84% keys/s = fmax W/(c ) --- independent of the pipeline depth L

Fig. 6. The GGM fabric. (a) Organization: the FCFS scheduler grants one ready level per cycle from the M key slots into the W -lane AES-MMO array; the correction-word unit consumes the returning blocks and writes two corrected seeds (plus Vα ) back. (b) One AES-MMO lane: domain-key select, the 11-round AES pipeline (initiation interval 1), the MMO feed-forward XOR, and the output demux. (c),(d) The schedule, cycle by cycle (rows: keys; columns: GGM levels; IS = issuing, EX = in the lanes, DN = level done). One key is depth-serial: j1 waits Leff = 12 cycles after j0 , idling the lane 11 of every 12 cycles (8.31%); with M independent keys the issue frontier (red dashed) launches a different ready key every cycle, so at the knee M ∗ = 12 the keys tile one Leff span exactly.

establishment and attestation, imported as primitives); the touches only request-independent templates (Section V-D); exchange (fixed-length ciphertexts of uniformly distributed only reconstruction, binding, and emission touch secrets; the share strings, Figure 7c—one keystream block per (counter, verified direct-generation path stays inside the same boundary. direction) message makes the default channel information- Minimal denotes the three-segment decomposition, not a proved theoretic given counter freshness, while KORD-mac reduces to minimum: KORD relocates rather than eliminates trust and authenticated encryption plus counter freshness); and the chip retains the stated cross-party cost. (an ideal functionality for reconstruction, template binding, and The network and the boundary. The default tier assumes root-seed derivation—the stated hardware-root assumption— integrity: relays may read everything but deliver faithfully, whose emitted shares are individually pseudorandom). The confidentiality is the keystream’s, and a keystream mask is claim is bounded in two ways: it is conditional on the malleable, so a tampering relay falls outside the model rather trusted-chip abstraction, so minimality denotes the bounded than being defeated by the channel. KORD-mac enforces decomposition, not a proved lower bound; and across requests it: the chips accept no unauthenticated message from any it reduces to multi-instance PRF security of the derivation source, and the SCU is fail-closed—a failed message yields no from Kch , since single-key FSS security does not cover the decryption, no engine dispatch, and no observable engine state. correlated stream. All 20 negative trials (tampered tag, tampered ciphertext, wrong Against a dealer in a box. No principal sees plaintext: a channel key, replay) fail with zero engine-input leakage (20/20), dealer—software with an operator and an update channel— and the replay guard advances its high-water mark only after handles every (α, β) in the clear; KORD’s plaintext exists only a message proves authentic and fresh. Neither tier enforces in a register-level zone, zeroized after use. The trusted object availability: a network that withholds a request from one chip is the special-purpose hardware and authenticated channel desynchronizes the counters, and the affected key pairs become of Section V-A—34,199 LUT and 663 RAMB18 (synthesis- unusable rather than leaked; this is out of scope, with counter estimated, Section VII-E)—rather than a general-purpose stack. re-alignment a host-visible resynchronization step. Direction: Little of its work is input-dependent: batch GGM expansion distinct per-direction subkeys and keystreams (the direction is

10

in the KDF domain), so a reflected or cross-substituted frame decrypts to garbage or fails authentication. Persistence: counters and pairing secrets must reside in rollback-protected storage (the FPGA prototype implements only in-session monotonicity). A rollback is a security failure, not only a correctness one— a reused keystream pad leaks the XOR of two messages, and re-derived roots break the one-time-key guarantee—so KORD requires transactional persistence with counter commit before emission, idempotent re-emission, and one recovery rule: an advanced counter is never rolled back; the lagging chip advances past skipped roots without emitting keys. Side channels. The register-level, zeroize-after-use design of the reconstruction zone is a by-construction mitigation only; we have performed no empirical side-channel evaluation and make no claim of leakage freedom.

width R = 64, the smallest its reference binaries support; and the trusted-dealer LLAMA stack [22] anchors the end-to-end comparison. Workloads. We use nine FSS building blocks at ℓ ∈ {8, 16, 18} (localhost, median of three), private ResNet-18 [23] on ImageNet (ℓ = 32, scale 10) over a 1 Gbps LAN, the baseline paper’s own 40 Mbps, 100 ms-RTT WAN setting, and distributed ORAM at d = 16. Provenance and calibers. Every number carries one of three labels: measured (re-run artifacts), formula-extrapolated (a baseline’s own complexity formula beyond its code’s range), or synthesis-estimated (KORD values from the platform above). KORD’s message sizes come from frozen byte-level accounting, and we never place KORD’s model latency in a speed-up ratio against a measured value; before timing, we removed one unconditional debug print from the baseline’s timing VII. E VALUATION region, affecting neither logic nor byte counts. The dealerless We evaluate KORD against deployed key sources, from baseline is reported under two calibers: caliber A, its own per-operation cost to full-system key supply. communication formula (9ℓ+5 rounds and 18λℓ+5λ+13ℓ+2 bits per DPF key, 16ℓ + 7 rounds per DCF key, λ = 128), A. Experimental Setup and Methodology a lower bound favorable to the baseline; and caliber B, our Synthesis platform. All hardware figures target a single reproduced measurement (79.6 KB per party per DPF key and Xilinx Zynq UltraScale+ MPSoC ZCU102 board, device 276.8 KB per DCF key at ℓ = 16). The artifact crashes above XCZU9EG-2FFVB1156, using Vivado 2022.2. Each engine, ℓ = 18, so all wider figures are labeled extrapolations (A by the secure-channel unit, and the full online path are synthesized formula, B by a linear fit whose ratio to A is stable on the and placed-and-routed out-of-context against a common timing measured grid). Party-side EvalAll traffic is not modeled, since target; fmax is extrapolated from the post-route worst negative KORD changes generation, not evaluation. slack as fmax = 1000/(period − WNS), and power is a Plan. Sections VII-B–VII-E answer, in turn: per-operation vectorless estimate at default switching activity. These area, cost across the nine building blocks and its scaling with ℓ; RAMB18, and power figures are synthesis estimates; nothing system-level impact on private ResNet-18; behavior beyond has been taped out. the LAN, on the WAN and for distributed ORAM; and the Board validation. The same online-path design—secure- silicon cost and key rate of the synthesized engines. channel unit, reconstruction zone, and unified engine behind an AXI4-Lite window—is programmed onto the board and B. Building Blocks and Input-Width Scaling Table II reports per-operation generation cost for the nine exercised on silicon. We drive the AXI window through the processing system’s JTAG debug-access port rather than a host FSS building blocks used by a private-inference and lookup operating system: psu_init configures the PS clocking and stack. One operation may consume several primitive keys, and the M_AXI_HPM0_FPD master, the bitstream is loaded over each column totals the block’s complete key complement. We JTAG, and the register reads and writes that submit a key and use ℓ ∈ {8, 16, 18}, the widest range supported by the baseline collect its output are issued over the debug link. Because this code. KORD reduces per-key communication by 7,633× to register path never touches off-chip DRAM, board validation 70,274× (caliber B) and reduces interaction from 154–38,659 needs no operating system, storage, or working memory. Board one-way messages to a single round. KORD’s own key message fmax is measured by retuning the PL clock in place across is 2–512 bytes. KORD’s generation latency across all these 100–250 MHz—each setting confirmed by reading back the cells is 0.45–5.49 µs. This synthesis-estimated model value clock divider—and re-running the golden vectors; saturated shows only that generation keeps pace; it is not a speed-up. throughput and lane utilization are measured with an on-chip The baseline’s measured localhost generation time is 37.8 ms– 7.14 s. request generator that keeps the engine’s in-flight slots full. A second dealerless reference, MP-SPDZ (semi-honest 2PC, RTL and software references. Key correctness is established in Vivado xsim against a C++ golden model linked to dishonest majority), is compared on its offline (key-generation) our fss-ref reference implementation, and the same golden axis. Its preprocessing communication exceeds KORD’s by vectors are replayed on the board. All baseline numbers re- 434× to 263,940×. A batched comparison still amortizes to run published artifacts as genuine two-party deployments on 1,535 B/op, 384× KORD’s message at ℓ = 8. Every MP-SPDZ the same host. The dealerless generator of Xing et al. [54] is number uses ring width R = 64, the smallest supported by its recompiled and run as two simultaneous processes on localhost, reference binaries. reading the framework’s own byte and round counters (median One cell is inconsistent with the baseline’s trend. Its paper of three); MP-SPDZ [27] is its semi2k offline phase at ring prints 1.151 MB for the ℓ = 18 approximation gadget, breaking

11

TABLE II P ER - OPERATION GENERATION COST ACROSS NINE FSS BUILDING BLOCKS AT ℓ ∈ {8, 16, 18}; EACH COLUMN TOTALS THE BLOCK ’ S FULL KEY COMPLEMENT, PER PARTY PER OPERATION . X ING [54] AND MP-SPDZ [27] COLUMNS ARE MEASURED ( LOCALHOST, MEDIAN OF 3); KORD COLUMNS ARE A SYNTHESIS - ESTIMATED MESSAGE / CYCLE MODEL , AND THE RATIO IS CALIBER B (X ING /KORD). Xing dealerless (measured) BB

MP-SPDZ off. (R = 64)

KORD (model)

ℓ

Comm. (B)

Msgs

Gen (ms)

Comm. (B)

Rnds

Comm. (B)

Ratio

EQ 8 EQ 16 CMP 8 CMP 16 CMP 18 PriLUT 8 Approx 8 Approx 18

46,283 79,628 281,098 545,272 611,496 9,596,288 1,179,844 1,511,278†

154 298 551 1,079 1,211 38,659 4,151 4,811

37.8 69.6 123.6 274.0 385.0 7,142.8 804.7 960.7

8,425 8,425 7,393 7,393 7,393 – – –

18 18 18 18 18 – – –

2 4 4 8 12 512 100 198

23,142× 19,907× 70,274× 68,159× 50,958× 18,743× 11,798× 7,633×

Aggregate wire traffic sums both parties’ volumes; for KORD, it is twice the printed per-party value, and the hardened KORD-mac tier adds a fixed 36 B per message. Xing’s Msgs column counts one-way messages; MP-SPDZ’s Rnds is its reported offline round count. Rows are a representative subset of the 9 × 3 grid covering both ratio endpoints (7,633×, 70,274×); the omitted blocks (Mod, TR, Ctn, DigDec, PubLUT) fall between them, with Mod matching CMP on every cost column. MP-SPDZ offline cost is identical at every ℓ of a block because it is set by ring width (F5). “–” marks blocks with no faithful semi2k microbenchmark (F2). One-time OT setup is amortized across a block’s keys (F1). † denotes an artifact measurement. The baseline’s paper prints 1.151 MB, breaking its own monotone trend, attributed to a digit transposition (E1).

12

interaction (msgs/key)

keygen share (%)

keygen time (s)

keygen comm. (B/key)

its own monotone trend (1.180 MB at ℓ = 8, 1.445 MB at ℓ = 16), while the artifact measures 1,511,278 B. We (a) communication (b) interaction 106 attribute the printed value to a digit transposition and report 103 105 our measurement. 104 Input-width scaling. The input-width sweep isolates asymp102 measured ( 18) Xing DPF Xing DCF extrap. B (fit) 103 KORD extrap. A (formula) totic scaling. Across the measured grid (ℓ ∈ {8, . . . , 18}) the 101 102 baseline’s key-generation communication is strictly linear in 101 ℓ: 4,168.2 B/bit for DPF and 16,500.7 B/bit for DCF, with 100 8 18 32 64 8 18 32 64 maximum residuals of 0.00% and 0.01%; the one-way message input width (bits) input width (bits) count is twice the formula rounds for DPF and 33ℓ + 9 for (c) ResNet-18 keygen wall clock (d) share, LAN DCF. When both calibers are extrapolated to production widths Dealer (meas.) cal. B cal. A KORD 96.9% 99.9% 100 (Figure 8, shaded region), per-key DPF communication exceeds 6.29 d 106 82.6% KORD’s by 1,169× (caliber A) to 18,290× (caliber B) at 21,720 2.54 h 104 50% ℓ = 32. The DCF gap at this width is 1,132× to 67,611×; 50 364 102 54.3 at ℓ = 64, it reaches 1,146× (A) to 66,807× (B). KORD’s 10.2 s 11.8% 1.5 message remains nearly flat (4 → 16 B), and its round count 100 0 LAN 1 Gbps WAN 40 Mbps Dlr A B KORD remains one. We report the baseline’s generation latency only as a lower bound (≥ 147.7–701.7 ms across the extrapolated widths). Its Gen protocol expands the full GGM tree per key, requiring Fig. 8. (a),(b) Input-width scaling of per-key generation: communication Θ(2ℓ ) PRG evaluations under Algorithm 2. Any latency figure and interaction for DPF and DCF vs. ℓ. Baseline measured up to ℓ = 18 (filled); the shaded region is caliber B (linear fit, open circles) and caliber omits this cost and is therefore a lower bound by construction. A (complexity formula, open squares); KORD is flat at 2⌈ℓ/8⌉ B and one Direct comparison on the baseline’s own tables. Table III round. (c),(d) The ResNet-18 key-stream experiment: key-generation wallreproduces the baseline’s key-generation measurements (its clock time on the LAN (1 Gbps) and the baseline’s own 40 Mbps WAN setting (log scale), and key generation’s share of end-to-end time on the LAN. Tables II and III) and adds KORD under the identical network Hatched bars are extrapolated lower bounds with the baseline’s generation settings, on the generation axis alone. Two effects separate. compute and tree memory excluded (favorable to the baseline). The dealer Generation communication collapses from the baseline’s 0.046– bar is measured, whereas KORD bars are synthesis-estimated model totals. No dealer deployment is defined for the WAN scenario. KORD is the only 9.6 MB per operation to KORD’s 2–198 B, a 7,633×– deployment below the 50% line: the online phase re-dominates. 72,500× reduction, because KORD publishes one correctionword share per level instead of an interactive OT transcript. Generation latency collapses because KORD is a single round: there. Online evaluation is excluded by construction: KORD the baseline’s Θ(ℓ)-round protocol costs 0.05–2.16 s on the emits standard keys, so the parties’ Eval phase is bit-identical LAN and 1.3–326 s on the WAN and grows with both ℓ to the baseline’s and to a dealer’s. and protocol complexity, whereas KORD’s one RTT pins its latency near 0.05 ms and 20 ms regardless of protocol, C. End-to-End: Private ResNet-18 yielding 1,000×–43,140× (LAN) and 64×–16,312× (WAN) We test system-level impact using one private ResNet-18 reductions. The WAN gap widens with protocol complexity inference on ImageNet with ℓ = 32 and scale 10. All three precisely because round count, not bytes, drives the baseline deployments compute the same result. KORD’s keys drive the

TABLE III D IRECT REPRODUCTION OF THE BASELINE ’ S OWN KEY- GENERATION MEASUREMENTS [54] ( ITS TABLES II AND III), RESTRICTED TO THE GENERATION AXIS THAT KORD CHANGES . T HE TWO UPPER ROWS ARE THE DPF/DCF PRIMITIVES ; THE LOWER BLOCK IS ITS FSS BUILDING BLOCKS . X ING COLUMNS ARE ITS PAPER ’ S REPORTED VALUES , MEASURED ON AWS C5.9 XLARGE AT 3.6 GH Z OVER THE SAME TWO LINKS IT USES : A 10 G BPS /0.05 MS LAN AND A 40 M BPS /20 MS WAN. O NLINE EVALUATION IS NOT COMPARED : KORD EMITS STANDARD KEYS , SO ITS E VAL IS BIT- IDENTICAL TO THE BASELINE ’ S . KORD FIGURES ARE FOR KORD’ S OWN ENVIRONMENT (S ECTION VII-A): A SINGLE - ROUND PROTOCOL WHOSE GENERATION LATENCY IS ONE RTT PLUS A 0.34–5.49 µ S FABRIC EXPANSION ( SYNTHESIS - ESTIMATED , BOARD - CONFIRMED RATE LAW, S ECTION VII-E) PLUS A 2–512 B TRANSFER . B ECAUSE ONE RTT DOMINATES , KORD’ S GENERATION LATENCY IS PINNED NEAR 0.05 MS (LAN) AND 20 MS (WAN) INDEPENDENT OF PROTOCOL AND ℓ; THE REDUCTION COLUMNS ARE AGAINST THESE . † A RTIFACT MEASUREMENT; THE BASELINE ’ S PAPER PRINTS 1.151 MB, A DIGIT TRANSPOSITION BREAKING ITS OWN TREND (E1). Gen, Xing (s)

Comm., generation

KORD reduction

Protocol

ℓ

LAN

WAN

Xing KORD Gen LAN Gen WAN

ΠDPF ΠDPF ΠDCF ΠDCF

8 18 8 18

0.050 0.124 0.085 0.280

1.288 2.780 2.417 5.247

0.046 MB 0.088 MB 0.145 MB 0.310 MB

2B 6B 2B 6B

1,000× 2,480× 1,700× 5,600×

64× 139× 121× 262×

23,142× 14,661× 72,500× 51,667×

ΠEQ ΠEQ ΠCMP ΠCMP ΠTR ΠTR ΠCtn ΠCtn ΠDigDec ΠDigDec ΠPubLUT ΠPubLUT ΠApprox ΠApprox

8 18 8 18 8 18 8 18 8 18 8 18 8 18

0.050 1.277 0.046 MB 0.125 2.783 0.088 MB 0.162 4.819 0.281 MB 0.539 10.605 0.611 MB 0.108 3.127 0.182 MB 0.199 5.947 0.347 MB 0.608 18.891 1.099 MB 2.157 42.296 2.421 MB 0.130 3.821 0.203 MB 0.241 7.311 0.389 MB 0.050 1.282 0.046 MB 0.126 2.778 0.088 MB 1.071 326.247 9.596 MB 1.391 41.854 1.44† MB

2B 6B 4B 12 B 4B 8B 16 B 48 B 6B 12 B 2B 6B 100 B 198 B

1,000× 2,500× 3,240× 10,780× 2,160× 3,980× 12,160× 43,140× 2,600× 4,820× 1,000× 2,520× 21,420× 27,820×

64× 139× 241× 530× 156× 297× 945× 2,115× 191× 366× 64× 139× 16,312× 2,093×

23,142× 14,661× 70,274× 50,958× 45,537× 43,401× 68,683× 50,427× 33,822× 32,404× 23,142× 14,661× 11,798× 7,633×

online phase to a 1000/1000 bit-exact match against a cleartext reference (max |diff| = 0). The inference consumes 6,726,608 FSS trees. Of these, 5,019,112 form a DCF-equivalent lower bound, using one DCF-Gen@32 per non-linear key.

Comm.

D. Beyond the LAN: WAN and Distributed ORAM

On a wide-area link, round count dominates and the gap widens. We use the 40 Mbps application-WAN setting adopted by the baseline’s own paper. For a single DCF key at ℓ = 32 over a 100 ms round trip, the baseline-to-KORD latency ratio The baseline’s bill is computed in its favor: we exclude is 519× (caliber A) to 520× (caliber B). This round-count the second correction-word tree of truncation and public ratio is essentially flat across bandwidth and RTT and rises to division, MaxPool multiplications, all Boolean-to-arithmetic 1,031× at ℓ = 64 (Figure 10). Scaled to the ResNet-18 key stream, again granting the baseand millionaire keys, every convolution and matrix-multiply line its most favorable 519-round batched schedule, dealerless Beaver triple, and its own key-generation computation and generation takes ≥ 2.54 hours (caliber A) to ≥ 6.29 days tree-expansion memory. All of these costs are counted as (caliber B). KORD takes 10.2 s, a baseline-to-KORD ratio of zero. The accounting uses symmetric exclusions: KORD’s 898× to 53,346× at 100 ms RTT (Figure 8c). As in the LAN total also excludes host-side key-delivery I/O. Both columns case, these WAN latencies count only communication. The are therefore compute-and-input-communication models, not ℓ baseline’s Θ(2 ) tree-expansion computation and memory are delivered end-to-end measurements. Even with these exclusions, uncharged, so its figures are lower bounds. key generation on a 1 Gbps unified link is 54.3 s under the trusted-dealer LLAMA stack [22], or 82.6% of end-to-end time (measured; Figure 8c). Under the dealerless baseline, it is ≥ 363.6 s and ≥ 96.9% (caliber A). Caliber B, fit-extrapolated to ℓ = 32, raises these values to ≥ 21,720 s and ≥ 99.9%. KORD requires 1.542 s, or 11.9%. This value is a synthesisestimated serialized total with generation and transfer summed without overlap credit. It is an upper bound within a model that excludes host-side key-delivery I/O. All three deployments share the same online phase because they emit standard keys. This phase takes 11.43 s over 60.6 MB and 66 rounds (30repetition median). Key generation dominates end-to-end time under both existing routes. With KORD, the online phase again dominates at 88.1% (Figure 8d), restoring the cost profile assumed by online optimizations of the last decade.

13

latency (s, log)

100

Xing (dealerless)

KORD

(a) Key-generation latency, LAN (10 Gbps / 0.05 ms)

=8

= 16

= 18

10 1 10 2 10 3 10 4 EQ

CMP

TR

Ctn

DigDec

Approx

latency (s, log)

(b) Key-generation latency, WAN (40 Mbps / 20 ms) 102 101 100 10 1 EQ

CMP

TR

Ctn

DigDec

Approx

DigDec

Approx

comm. (B, log)

(c) Key-generation communication 105 103 101 EQ

CMP

TR

Ctn

Fig. 9. Key-generation cost across six FSS building blocks at ℓ ∈ {8, 16, 18}, Xing [54] versus KORD, on the generation axis. This mirrors the baseline’s own Figure 6—same three panels (LAN time, WAN time, communication)—but on generation rather than online evaluation: the online Eval phase is unchanged by KORD (standard keys), so an online plot would show the two systems coincide, whereas generation is what KORD restructures. Xing bars grow with ℓ and protocol complexity (Θ(ℓ) rounds); KORD’s single round pins its latency near 0.05 ms (LAN) and 20 ms (WAN) and its message at 2–198 B, independent of both. Log scale.

Compute versus communication. Table IV separates the TABLE IV R ES N ET-18 KEY GENERATION DECOMPOSED INTO COMPUTE AND two overheads the co-design attacks, across both links. GeneraCOMMUNICATION OVERHEAD , EVALUATED AGAINST THE TRUSTED - DEALER tion compute is network-independent: the trusted dealer spends LLAMA STACK [22] AND THE DEALERLESS BASELINE [54] ( CALIBERS A/B) ON BOTH THE 1 G BPS LAN AND THE 40 M BPS /100 MS WAN. 18.54 s expanding the 6.73 M GGM trees, whereas KORD’s C OMPUTE IS NETWORK - INDEPENDENT, SO IT APPEARS ONCE . T HE fabric cycle-accounts to 1.14 s—a ≥ 16.3× reduction, and a DEALERLESS BASELINE CHARGES ZERO COMPUTE ( ITS Θ(2ℓ ) TREE lower bound because the board’s measured fmax (≥ 214 MHz) EXPANSION IS UNCHARGED , IN ITS FAVOR ), SO ONLY ITS COMMUNICATION exceeds the 154.56 MHz used for the estimate (Section VII-E). IS COMPARABLE (“–”). LLAMA’ S COMPUTE IS MEASURED AND ITS KEY The dealerless baseline charges no compute at all—its Θ(2ℓ ) DISTRIBUTION IS BANDWIDTH - SCALED TO EACH LINK . KORD’ S COMPUTE IS A CYCLE - ACCOUNTED MODEL WHOSE RATE LAW AND fmax THE BOARD expansion is left uncharged in its favor—so against it KORD’s CORROBORATES AS CONSERVATIVE (S ECTION VII-E), SO EVERY compute advantage is larger still, and unquantified. Generation KORD- SIDE FACTOR IS A LOWER BOUND . communication is where the round-collapse dominates. On Overhead LLAMA Xing A Xing B KORD the LAN, KORD’s single-round 50.4 MB key stream cuts Compute (s) 18.54 – – 1.14 distribution by 88.7× against the dealer—which must ship Comm., LAN (s) 35.75 363.6 21,720 0.40 4.47 GB of key material to two remote parties—and by 902× Comm., WAN (s) 893.8 9,144 543,456 10.2 (A) to 53,896× (B) against the dealerless baseline. The gap holds on the WAN, at 87.8× against the dealer and 898× to 53,346× against the baseline, because there the baseline’s anchor, KORD’s per-access generation communication is per-key round count multiplies against the 100 ms RTT while 1,179× (caliber A) to 19,907× (caliber B) below the baseline’s. KORD stays at one round. The two axes are complementary: The supplementary material gives extrapolations to wider the hardware root removes the compute wall (≥ 16×) and address spaces (d = 20, d = 32). the single-round protocol removes the communication wall E. The Hardware (101 –104 ×), on both the LAN and the WAN. Distributed ORAM. Distributed ORAM consumes a fresh All hardware results follow the platform and provenance DPF key for every oblivious access, so key-generation cost conventions of Section VII-A. Area and power in this subrecurs per access. At address width d = 16, our measured section are synthesis-estimated (Table V); correctness, fail-

14

(b) DORAM d = 20

(a) per key, 100 ms RTT 1,031× 519×

520×

32 (A)

32 (B)

DCF (caliber)

0.0

41,997

50.3% 583

3

RDPF +RDCF

4.83

2 1

LUT

RAMB18

100

4.83 (all-DCF)

4

0

engine 40 Mbps supply link

(d) capacity line

5

1,173

50.8% 20,654

104

64

RDCF (M/s)

norm. to 2 engines

0.5

833.3 K/s

105

(c) unified engine 1.0

24×

106

share (%)

0

20.40 M/s

107

keys/s

latency vs KORD

1000 500

108

1 4.83 (all-DPF)

0

2

RDPF (M/s)

4

50

(e) SCU price

SCU 38.5%

0

TABLE V S YNTHESIZED KEY- GENERATION ENGINES ON ZCU102 (XCZU9EG-2); fmax / AREA / POWER ARE SYNTHESIS - ESTIMATED (G2), THROUGHPUT (DPF-32 KEYS / S ) IS BOARD - CONFIRMED (S ECTION VII-E). T HE UNIFIED ENGINE ISSUES ONE LEVEL PER CYCLE REGARDLESS OF MODE , SO ITS ALL -DPF AND ALL -DCF RATES ARE BOTH 4.83 M/ S AND A MIXED STREAM SATISFIES (RDPF + RDCF )/4.83 ≤ 1; THE DPF- ONLY ENGINE ’ S 4- LANE GROUPS RETIRE TWO LEVELS PER CYCLE , GIVING ITS HIGHER RATE . I TS KEYS /J VALUE IS FOR THE UNIFIED ENGINE AND DENOTES ENERGY PER DPF-32- EQUIVALENT KEY. T HE DPF- ONLY AND UNIFIED W8 TIERS ARE NOT INTERCHANGEABLE . † W16 IS A CAPACITY BOUNDARY WHERE S- BOXES PARTIALLY FOLD INTO LUT S , NOT A LINEAR - SCALING POINT (G5).

rest of online system

LUT

12.1%

BRAM

Fig. 10. Beyond the LAN, and the hardware. (a) Per-key WAN generationlatency ratio (baseline over KORD) at 100 ms RTT, a round-count ratio flat in bandwidth and RTT; caliber in parentheses, hatched = extrapolated. (b) Distributed ORAM at d = 20: modeled engine supply versus the drain of a 40 Mbps link. (c)–(e) The shared datapath, all synthesis-estimated: unified DPF/DCF engine resources normalized to two separate engines (also within +0.96% LUT of a DCF-only datapath); the unified engine’s mixed-workload capacity line between its two pure endpoints; and the SCU’s share of the online system, the hardware price of the trust boundary.

closed authentication, fmax , and saturated throughput are board-measured on a ZCU102 and reported at the end of the subsection. We first establish key correctness independently of timing. The DPF and unified DCF engines match a software oracle bit-for-bit across 108,276 and 226,920 checks with zero errors. The full online path with the secure-channel unit passes 4,540 end-to-end checks with 60/60 authentication successes.

Engine

fmax (MHz)

DPF W4 DPF W8 DPF W16† Unified W8

234.1 204.0 207.8 154.6

LUT RAMB18 12,906 21,540 72,092 20,654

Thpt keys/J (M/s) (M)

305 7.32 601 12.75 912 25.98 583 4.83

2.99 2.75 2.70 2.36

online system’s LUT and 12.1% of its BRAM (Figure 10e). These are generation rates at the fabric’s assembler boundary: a DPF-32 key share is 540 B (Section II-A), so 12.75 M shares/s is a ≈ 6.9 GB/s egress stream per chip. Sustaining that stream off-chip requires a DMA-class interface that we have not built. KORD removes generation compute as the bottleneck; provisioning a matching delivery path remains an Cross-key pipelining lifts the shared AES array from 8.31% integration task outside this prototype. single-chain utilization to 99.84% at saturation (RTL, measured On-board validation. We programmed the online-path in simulation). The headline DPF-only engine (W8) runs at design (SCU, reconstruction, and unified engine, wrapped in 204.0 MHz for 12.75 M DPF-32 keys/s on 21,540 LUT: its an AXI4-Lite window at 0xA000_0000) onto a physical 4-lane issue groups let W = 8 retire two tree levels per cycle. ZCU102 and drove it over the processing system’s debug The unified DPF/DCF engine (W8) runs at 154.6 MHz on access port, bracketing the synthesis-estimated figures above 20,654 LUT and issues one level to an 8-lane block per cycle, with silicon measurements. Four results hold on the board. independent of mode, so it supplies 4.83 M keys/s on either an (i) Correctness: 60 keys (30 DPF, 30 DCF; ℓ ∈ {16, 32, 64}) all-DPF or an all-DCF stream. A DCF level uses all eight lanes; reproduce the golden correction-word stream across 13,560 field a DPF level uses only four and idles the value lanes—the honest checks with zero mismatches, closing the chain from RTL to cost of a shared 4-domain block—so the unified engine trades silicon. (ii) Fail-closed authentication: all four attack classes of the DPF-only engine’s 2× DPF rate for one datapath serving Section VI—tampered tag, tampered ciphertext, wrong channel both functions. Mixed workloads satisfy the mode-independent key, and replay of an accepted frame—are rejected with no capacity line (RDPF + RDCF )/4.83M ≤ 1 (Figure 10d). This engine output, on hardware. (iii) Frequency: sweeping the PL per-mode rate, and the saturated utilization it assumes, are clock, the full online path runs bit-exact through 214.3 MHz board-measured (below); the lower frequency comes from the and fails by 250 MHz, so its real fmax exceeds the 147.0 MHz DCF correction-word chain. The unified path has a +0.96% WNS extrapolation by at least 1.46×. The synthesis estimates LUT overhead relative to a DCF-only datapath and saves are conservative—as expected for out-of-context timing signed roughly half the resources of running two separate engines: off at a worst-case corner—so every rate derived from them 50.8% of LUTs and 50.3% of BRAMs (Figure 10c). The is a lower bound. (iv) Throughput and utilization: an on-chip secure-channel unit, the hardware price of the trust boundary request generator that keeps the engine’s M = 16 slots full (implementing the hardened KORD-mac channel, an upper reproduces the saturated regime the rate law assumes. The bound for the default keystream channel), is 38.5% of the unified engine sustains 99.98% lane utilization and matches

15

KORD online path placed device floorplan ZCU102 (XCZU9EG-2), 51,845 leaf cells 250

SLICE row (Y)

200 150 100 50 0 0

20

40

60

SLICE column (X)

80

100

Component Unified DPF/DCF engine Secure-channel unit (AES-GCM) Reconstruction + assembler + AXI

LUT 20,654 13,152 393

RAMB18 583 80 0

Power 4.10 W 1.45 W —

Total (online path)

34,199

663

5.00 W

The engine’s eight AES-MMO lanes place as the tall vertical column bands; the SCU packs beneath them; the reconstruction zone is a thin register slice. The SCU—the hardware price of the trust boundary—is 38.5% of LUTs and 12.1% of RAMB18.

Unified DPF/DCF engine (32,132) Secure-channel unit (AES-GCM) (18,300) Reconstruction zone (420) Control / assembler / AXI glue (993)

Fig. 11. KORD online-path placed device floorplan and resource/power breakdown on ZCU102 (XCZU9EG-2, Vivado 2022.2). Left: the actual post-route

Fig. placement—each 11. KORD online-path device resource/power breakdown on ZCU102 2022.2).(additive Left: the actual post-route dot is oneplaced of 51,845 leaffloorplan cells at itsand SLICE location, colored by component. Right:(XCZU9EG-2, per-component Vivado LUT/RAMB18 to the total) and placement—each dotpower is one(Total of 51,845 cells at its SLICE location, colored by component. Right: per-component LUT/RAMB18 (additive to the total) and standalone-OOC powerleaf is the integrated online-path estimate, vectorless). Synthesis-estimated fmax is 147.0 MHz; the design is board-measured standalone-OOC power (total MHz power(Section is the integrated bit-exact through ≥ 214.3 VII-E). online-path estimate, vectorless). Synthesis-estimated fmax is 147.0 MHz; the design is board-measured bit-exact through ≥ 214.3 MHz (Section VII-E).

yields modeled supply rates that exceed network demand. The link between the parties then becomes the binding constraint its 4.83 M/sby rate within 0.1% at every width and clock; a assumed thetoonline-optimization literature.

DPF stream on it sits at 49.99% (one 8-lane block, half used), VIII. R ELATED Wthat ORK fixes the endpoint which is exactly the per-mode behavior at 4.83 M/s. The DPF-only engine, measured theprivate same inferway, FSS systems and their key sources. Non-FSS ence pays for non-linear layer online [26], [34], holds 99.98% andevery confirms its two-levels-per-cycle rate. [36], The [39];→FSS systems [21], [22], [25], [41] shift this cost into 8.31% 99.84% saturation curve, previously simulation-only, one-timeconfirmed keys. Deployed systems obtain keys from a dealer is thereby on silicon. or helper party [21], [22], [25],keys [41], for [45],0.88 [51]ResNet-18 or from a One unified engine supplies point-knowing client [3], [11], [12], [52]; neither fits an MPC inferences per second. This rate supports ≈ 10.0 concurrent pipeline, where the point is a secret-shared mask [16], [48]. online sessions. The rate is the reciprocal of a cycle-accounted KORD serves this setting, exposing masks and key shares to 1.139 s at 154.56 MHz. The DCF-family inventory spans depths no principal (Section VI). 10–32, so this accounting is finer-grained than the endpoint Dealerless key generation. Xing et al. [54], our baseline, rates in Table V. For DORAM at d = 20 the DPF-only engine follows Floram [15]; we do not treat its full-tree Gen as a lower generates 20.40 M keys/s against a 40 Mbps link that drains bound. Programmable DPFs [10], correlation generators [5], only[6],833.3 more supply thanorthe link [55], K andmessages/s, generic 2PC24× [27] remain impractical costlier canatcarry (Figure 10b). Provided that the key-delivery path inference scale (Section VII-B); GPU batching [21], [25], is provisioned to match, moving generation inside the trust [31], [38], [46], [53] accelerates a route without changing its boundary modeled supply rates that exceed network trust or yields interaction structure. demand. The link between the parties becomesroots. the binding Cryptographic hardware andthentrusted FHE constraint by the online-optimization literature. [40], ASICs assumed [28]–[30], [42], [43], HE co-design garbled-circuit accelerators [35], [44], and OT-extension W ORK acceleration [33]VIII. targetR ELATED data-parallel kernels, not the trust model. PPMLAC [56] roots secret-sharing ML in attested FSS systems and their key sources. Non-FSS private hardware; KORD adopts only its initialization. A TEE-hosted inference pays for every non-linear layer online [26], [34], dealer [13], [32], [47], [50] executes loaded code with [36], [39]; FSS systems [21], [22], [25], [41] shift this cost its attack surface [49] and remains a principal; KORD’s intospecial-purpose one-time keys. Deployed systems obtain keys from a chips load none.

along one of three edges of a deployment trilemma: they trust a dealer, incur interaction that grows with tree depth and security bound. Programmable correlation parameter, or accelerate DPFs a route[10], without changinggenerators it. A one- [5], [6], [55], and generic [27] remain impractical or costlier time, attestable pairing 2PC of two special-purpose chips enables at inference scale (Section GPUbytes. batching [21], [25], key generation in one roundVII-B); and a few Depth-serial [31], [38], [46],leaves [53] accelerates route without changing GGM expansion the hardwarea idle when processing one its key time, but interleaving trustatora interaction structure. independent keys saturates a single AES array. Thishardware design relocates than eliminates Cryptographic and rather trusted roots. FHE the trust assumption, moving it from an online to ASICs [28]–[30], [42], [43], HE co-design [40], principal garbled-circuit minimal, auditable hardware. KORD explicitly identifies the accelerators [35], [44], and OT-extension acceleration [33] operations that this hardware must be trusted to perform and target data-parallel kernels, not the trust model. PPMLAC [56] the cost of its compromise. For FSS-based deployments whose roots secret-sharing ML in attested hardware; KORD adopts bottleneck is the key stream itself, KORD is dealerless under only its initialization. A TEE-hosted dealer [13], [32], [47], a minimal hardware root.

[50] executes loaded code with its attack surface [49] and remains a principal; KORD’s special-purpose chips load none. R EFERENCES [1] M. Bellare, V. T. Hoang, S. Keelveedhi, and P. Rogaway, “Efficient garbling from a fixed-key blockcipher,” in IEEE Symposium on Security IX. 2013, C ONCLUSION and Privacy (S&P). IEEE, pp. 478–492. [2] J. Black, P. Rogaway, and T. Shrimpton, “Black-box analysis of the block-cipher-based hash-function constructions from PGV,” in Advances FSS moves the cost of2002. private computation from the online in Cryptology – CRYPTO Springer, 2002. [3] D. into Boneh, E. Boyle, H. Deployed Corrigan-Gibbs, N. Gilboa, and that Y. Ishai, phase a key stream. systems pay for stream “Lightweight techniques for private heavy hitters,” in IEEE Symposium alongonone of three edges(S&P). of a deployment Security and Privacy IEEE, 2021. trilemma: they trust a [4] E. Boyle, Chandran, N. Gilboa, D. Gupta, Y. Ishai, N. Kumar, and dealer, incurN.interaction that grows with tree depth and security M. Rathee, “Function secret sharing for mixed-mode and fixed-point parameter, or accelerate a route without changing it. A onesecure computation,” in Advances in Cryptology – EUROCRYPT 2021. time,Springer, attestable of two special-purpose chips enables 2021, pairing pp. 871–900. [5] E. Boyle, G. Couteau, Gilboa,and Y. Ishai, L. Kohl, P. Rindal, and key generation in oneN.round a few bytes. Depth-serial P. Scholl, “Efficient two-round OT extension and silent non-interactive GGM expansion leaves the hardware processing secure computation,” in Proceedings of the idle 2019 when ACM SIGSAC Confer-one Computer Communications Security (CCS). 2019, a key ence at aontime, but and interleaving independent keysACM, saturates pp. 291–308. single AES array. This design relocates rather than eliminates [6] E. Boyle, G. Couteau, N. Gilboa, Y. Ishai, L. Kohl, and P. Scholl, the trust assumption, from an online principal “Efficient pseudorandommoving correlationitgenerators: Silent OT extension and to more,” in Advances in Cryptology KORD – CRYPTOexplicitly 2019. Springer, 2019. the minimal, auditable hardware. identifies [7] E. Boyle, N. Gilboa, and Y. Ishai, “Function secret sharing,” in Advances operations that –this hardware mustSpringer, be trusted in Cryptology EUROCRYPT 2015. 2015. to perform and

dealer or helper party [21], [22], [25], [41], [45], [51] or from a point-knowing client [3], [12], [52]; neither fits an MPC IX.[11], C ONCLUSION pipeline, a secret-shared [48]. FSSwhere moves the the point cost ofisprivate computationmask from[16], the online KORD exposing systems masks and keythat shares to phaseserves into a this key setting, stream. Deployed pay for stream no principal (Section VI). the cost of its compromise. For FSS-based deployments whose Dealerless key generation. Xing et al. [54], our baseline, bottleneck is the key stream itself, KORD is dealerless under follows Floram [15]; we do not treat its full-tree Gen as a lower 16 a minimal hardware root. 16

R EFERENCES [1] M. Bellare, V. T. Hoang, S. Keelveedhi, and P. Rogaway, “Efficient garbling from a fixed-key blockcipher,” in IEEE Symposium on Security and Privacy (S&P). IEEE, 2013, pp. 478–492. [2] J. Black, P. Rogaway, and T. Shrimpton, “Black-box analysis of the block-cipher-based hash-function constructions from PGV,” in Advances in Cryptology – CRYPTO 2002. Springer, 2002. [3] D. Boneh, E. Boyle, H. Corrigan-Gibbs, N. Gilboa, and Y. Ishai, “Lightweight techniques for private heavy hitters,” in IEEE Symposium on Security and Privacy (S&P). IEEE, 2021. [4] E. Boyle, N. Chandran, N. Gilboa, D. Gupta, Y. Ishai, N. Kumar, and M. Rathee, “Function secret sharing for mixed-mode and fixed-point secure computation,” in Advances in Cryptology – EUROCRYPT 2021. Springer, 2021, pp. 871–900. [5] E. Boyle, G. Couteau, N. Gilboa, Y. Ishai, L. Kohl, P. Rindal, and P. Scholl, “Efficient two-round OT extension and silent non-interactive secure computation,” in Proceedings of the 2019 ACM SIGSAC Conference on Computer and Communications Security (CCS). ACM, 2019, pp. 291–308. [6] E. Boyle, G. Couteau, N. Gilboa, Y. Ishai, L. Kohl, and P. Scholl, “Efficient pseudorandom correlation generators: Silent OT extension and more,” in Advances in Cryptology – CRYPTO 2019. Springer, 2019. [7] E. Boyle, N. Gilboa, and Y. Ishai, “Function secret sharing,” in Advances in Cryptology – EUROCRYPT 2015. Springer, 2015. [8] E. Boyle, N. Gilboa, and Y. Ishai, “Function secret sharing: Improvements and extensions,” in Proceedings of the 2016 ACM SIGSAC Conference on Computer and Communications Security (CCS). ACM, 2016, pp. 1292–1303. [9] E. Boyle, N. Gilboa, and Y. Ishai, “Secure computation with preprocessing via function secret sharing,” in Theory of Cryptography Conference (TCC). Springer, 2019. [10] E. Boyle, N. Gilboa, Y. Ishai, and V. I. Kolobov, “Programmable distributed point functions,” in Advances in Cryptology – CRYPTO 2022. Springer, 2022, pp. 121–151. [11] B. Chor, O. Goldreich, E. Kushilevitz, and M. Sudan, “Private information retrieval,” in 36th Annual Symposium on Foundations of Computer Science (FOCS). IEEE, 1995, pp. 41–50. [12] H. Corrigan-Gibbs and D. Boneh, “Prio: Private, robust, and scalable computation of aggregate statistics,” in 14th USENIX Symposium on Networked Systems Design and Implementation (NSDI). USENIX Association, 2017, pp. 259–282. [13] V. Costan and S. Devadas, “Intel SGX explained,” Cryptology ePrint Archive, Paper 2016/086, 2016. [14] D. Demmler, T. Schneider, and M. Zohner, “ABY – a framework for efficient mixed-protocol secure two-party computation,” in Network and Distributed System Security Symposium (NDSS), 2015. [15] J. Doerner and a. shelat, “Scaling ORAM for secure computation,” in Proceedings of the 2017 ACM SIGSAC Conference on Computer and Communications Security (CCS). ACM, 2017, pp. 523–535. [16] B. H. Falk, R. Ostrovsky, M. Shtepel, and J. Zhang, “GigaDORAM: Breaking the billion address barrier,” in 32nd USENIX Security Symposium (USENIX Security). USENIX Association, 2023, pp. 3871–3888. [17] N. Gilboa and Y. Ishai, “Distributed point functions and their applications,” in Advances in Cryptology – EUROCRYPT 2014. Springer, 2014. [18] O. Goldreich, S. Goldwasser, and S. Micali, “How to construct random functions,” Journal of the ACM, vol. 33, no. 4, pp. 792–807, 1986. [19] C. Guo, J. Katz, X. Wang, and Y. Yu, “Efficient and secure multiparty computation from fixed-key block ciphers,” in IEEE Symposium on Security and Privacy (S&P). IEEE, 2020. [20] X. Guo, K. Yang, X. Wang, W. Zhang, X. Xie, J. Zhang, and Z. Liu, “Half-tree: Halving the cost of tree expansion in COT and DPF,” in Advances in Cryptology – EUROCRYPT, 2023. [21] K. Gupta, N. Jawalkar, A. Mukherjee, N. Chandran, D. Gupta, A. Panwar, and R. Sharma, “SIGMA: Secure GPT inference with function secret sharing,” Proceedings on Privacy Enhancing Technologies (PoPETs), vol. 2024, no. 4, pp. 61–79, 2024. [22] K. Gupta, D. Kumaraswamy, N. Chandran, and D. Gupta, “LLAMA: A low latency math library for secure inference,” Proceedings on Privacy Enhancing Technologies (PoPETs), vol. 2022, no. 4, pp. 274–294, 2022. [23] K. He, X. Zhang, S. Ren, and J. Sun, “Deep residual learning for image recognition,” in IEEE Conference on Computer Vision and Pattern Recognition (CVPR). IEEE, 2016, pp. 770–778.

17

[24] C. Herder, M.-D. Yu, F. Koushanfar, and S. Devadas, “Physical unclonable functions and applications: A tutorial,” Proceedings of the IEEE, vol. 102, no. 8, pp. 1126–1141, 2014. [25] N. Jawalkar, K. Gupta, A. Basu, N. Chandran, D. Gupta, and R. Sharma, “Orca: FSS-based secure training and inference with GPUs,” in IEEE Symposium on Security and Privacy (S&P). IEEE, 2024. [26] C. Juvekar, V. Vaikuntanathan, and A. Chandrakasan, “GAZELLE: A low latency framework for secure neural network inference,” in 27th USENIX Security Symposium (USENIX Security). USENIX Association, 2018, pp. 1651–1669. [27] M. Keller, “MP-SPDZ: A versatile framework for multi-party computation,” in Proceedings of the 2020 ACM SIGSAC Conference on Computer and Communications Security (CCS). ACM, 2020, pp. 1575–1590. [28] J. Kim, S. Kim, J. Choi, J. Park, D. Kim, and J. H. Ahn, “SHARP: A shortword hierarchical accelerator for robust and practical fully homomorphic encryption,” in Proceedings of the 50th Annual International Symposium on Computer Architecture (ISCA). ACM, 2023. [29] J. Kim, G. Lee, S. Kim, G. Sohn, M. Rhu, J. Kim, and J. H. Ahn, “ARK: Fully homomorphic encryption accelerator with runtime data generation and inter-operation key reuse,” in Proceedings of the 55th IEEE/ACM International Symposium on Microarchitecture (MICRO). IEEE, 2022, pp. 1237–1254. [30] S. Kim, J. Kim, M. J. Kim, W. Jung, J. Kim, M. Rhu, and J. H. Ahn, “BTS: An accelerator for bootstrappable fully homomorphic encryption,” in Proceedings of the 49th Annual International Symposium on Computer Architecture (ISCA). ACM, 2022, pp. 711–725. [31] B. Knott, S. Venkataraman, A. Hannun, S. Sengupta, M. Ibrahim, and L. van der Maaten, “CrypTen: Secure multi-party computation meets machine learning,” in Advances in Neural Information Processing Systems (NeurIPS), 2021. [32] D. Lee, D. Kohlbrenner, S. Shinde, K. Asanović, and D. Song, “Keystone: An open framework for architecting trusted execution environments,” in Proceedings of the 15th European Conference on Computer Systems (EuroSys). ACM, 2020. [33] C. Lin, K. Yang, T. Xu, L. Liang, Y. Wang, Z. Chen, R. Wang, M. Gao, and M. Li, “Ironman: Accelerating oblivious transfer extension for privacy-preserving AI with near-memory processing,” in Proceedings of the 58th IEEE/ACM International Symposium on Microarchitecture (MICRO). ACM, 2025. [34] P. Mishra, R. Lehmkuhl, A. Srinivasan, W. Zheng, and R. A. Popa, “Delphi: A cryptographic inference service for neural networks,” in 29th USENIX Security Symposium (USENIX Security). USENIX Association, 2020. [35] J. Mo, J. Gopinath, and B. Reagen, “HAAC: A hardware-software codesign to accelerate garbled circuits,” in Proceedings of the 50th Annual International Symposium on Computer Architecture (ISCA). ACM, 2023. [36] P. Mohassel and Y. Zhang, “SecureML: A system for scalable privacypreserving machine learning,” in IEEE Symposium on Security and Privacy (S&P). IEEE, 2017, pp. 19–38. [37] National Institute of Standards and Technology, “Advanced encryption standard (AES),” U.S. Department of Commerce, Tech. Rep. FIPS PUB 197, 2001. [38] L. K. L. Ng and S. S. M. Chow, “GForce: GPU-friendly oblivious and rapid neural network inference,” in 30th USENIX Security Symposium (USENIX Security). USENIX Association, 2021, pp. 2147–2164. [39] D. Rathee, M. Rathee, N. Kumar, N. Chandran, D. Gupta, A. Rastogi, and R. Sharma, “CrypTFlow2: Practical 2-party secure inference,” in Proceedings of the 2020 ACM SIGSAC Conference on Computer and Communications Security (CCS). ACM, 2020, pp. 325–342. [40] B. Reagen, W.-S. Choi, Y. Ko, V. T. Lee, H.-H. S. Lee, G.-Y. Wei, and D. Brooks, “Cheetah: Optimizing and accelerating homomorphic encryption for private inference,” in IEEE International Symposium on High-Performance Computer Architecture (HPCA). IEEE, 2021, pp. 26–39. [41] T. Ryffel, P. Tholoniat, D. Pointcheval, and F. Bach, “AriaNN: Lowinteraction privacy-preserving deep learning via function secret sharing,” Proceedings on Privacy Enhancing Technologies (PoPETs), vol. 2022, no. 1, pp. 291–316, 2022. [42] N. Samardzic, A. Feldmann, A. Krastev, S. Devadas, R. Dreslinski, C. Peikert, and D. Sanchez, “F1: A fast and programmable accelerator for fully homomorphic encryption,” in Proceedings of the 54th Annual IEEE/ACM International Symposium on Microarchitecture (MICRO). ACM, 2021, pp. 238–252.

[43] N. Samardzic, A. Feldmann, A. Krastev, N. Manohar, N. Genise, S. Devadas, K. Eldefrawy, C. Peikert, and D. Sanchez, “CraterLake: A hardware accelerator for efficient unbounded computation on encrypted data,” in Proceedings of the 49th Annual International Symposium on Computer Architecture (ISCA). ACM, 2022, pp. 173–187. [44] E. M. Songhori, S. U. Hussain, A.-R. Sadeghi, T. Schneider, and F. Koushanfar, “TinyGarble: Highly compressed and scalable sequential garbled circuits,” in IEEE Symposium on Security and Privacy (S&P). IEEE, 2015, pp. 411–428. [45] K. Storrier, A. Vadapalli, A. Lyons, and R. Henry, “Grotto: Screaming fast (2 + 1)-PC for Z2n via (2, 2)-DPFs,” in Proceedings of the 2023 ACM SIGSAC Conference on Computer and Communications Security (CCS). ACM, 2023, pp. 2143–2157. [46] S. Tan, B. Knott, Y. Tian, and D. J. Wu, “CryptGPU: Fast privacypreserving machine learning on the GPU,” in IEEE Symposium on Security and Privacy (S&P). IEEE, 2021, pp. 1021–1038. [47] F. Tramèr and D. Boneh, “Slalom: Fast, verifiable and private execution of neural networks in trusted hardware,” in International Conference on Learning Representations (ICLR), 2019. [48] A. Vadapalli, R. Henry, and I. Goldberg, “Duoram: A bandwidth-efficient distributed ORAM for 2- and 3-party computation,” in 32nd USENIX Security Symposium (USENIX Security). USENIX Association, 2023. [49] J. Van Bulck, M. Minkin, O. Weisse, D. Genkin, B. Kasikci, F. Piessens, M. Silberstein, T. F. Wenisch, Y. Yarom, and R. Strackx, “Foreshadow: Extracting the keys to the Intel SGX kingdom with transient out-of-order execution,” in 27th USENIX Security Symposium (USENIX Security). USENIX Association, 2018, pp. 991–1008. [50] S. Volos, K. Vaswani, and R. Bruno, “Graviton: Trusted execution environments on GPUs,” in 13th USENIX Symposium on Operating Systems Design and Implementation (OSDI). USENIX Association, 2018, pp. 681–696. [51] S. Wagh, “Pika: Secure computation using function secret sharing over rings,” Proceedings on Privacy Enhancing Technologies (PoPETs), vol. 2022, no. 4, pp. 351–377, 2022. [52] F. Wang, C. Yun, S. Goldwasser, V. Vaikuntanathan, and M. Zaharia, “Splinter: Practical private queries on public data,” in 14th USENIX Symposium on Networked Systems Design and Implementation (NSDI). USENIX Association, 2017. [53] J.-L. Watson, S. Wagh, and R. A. Popa, “Piranha: A GPU platform for secure computation,” in 31st USENIX Security Symposium (USENIX Security). USENIX Association, 2022, pp. 827–844. [54] P. Xing, H. Li, M. Hao, H. Chen, J. Hu, and D. Liu, “Distributed function secret sharing and applications,” in Network and Distributed System Security Symposium (NDSS), 2025. [55] K. Yang, C. Weng, X. Lan, J. Zhang, and X. Wang, “Ferret: Fast extension for correlated OT with small communication,” in Proceedings of the 2020 ACM SIGSAC Conference on Computer and Communications Security (CCS). ACM, 2020, pp. 1607–1626. [56] X. Zhou, Z. Xu, C. Wang, and M. Gao, “PPMLAC: High performance chipset architecture for secure multi-party computation,” in Proceedings of the 49th Annual International Symposium on Computer Architecture (ISCA). ACM, 2022, pp. 87–101.

18

Related documents

• Unlawful Securities Transactions and Scienter: An Emasculating Requirement#648402
• CVE-2026-14316 — HIGH 8.1#1167522
• Nanvix: A Multikernel OS Design for High-Density Serverless Deployments#10307
• Parallel implementation and performance optimization of the configuration-interaction method#624324
• Design of the PI2Puino integrated board: Gerber files#641121