Two people compute a function of secrets — without showing each other the secrets
A garbled circuit lets two parties jointly compute the output of a function over their own private inputs, while learning nothing about each other’s input beyond what the output itself reveals. Not “we trust a server with both values” — neither party ever sees the other’s data, encrypted or otherwise. The technique is Andrew Yao’s: write the function as a circuit of logic gates, have one party garble every gate into an encrypted table, and have the other evaluate that table wire by wire without ever decrypting an input in the clear.
Read what garbled circuits actually are for the motivating problem — two millionaires who want to know who’s richer without either revealing their net worth — or go straight to the exact construction: wire labels, the encryption scheme for a garbled table, and how evaluation recovers the right answer without ever seeing a wrong one.
Try it right here — garble a real AND gate and evaluate it, live:
Ready.
Wire labels (128-bit, random — nothing about the bits reveals 0 vs 1)
Garbled table (4 rows garbled, then shuffled)
This is what the Garbler builds — the row order the Evaluator receives (below) has been randomly shuffled, so position leaks nothing.
Pick input bits
In a real protocol these labels would reach the Evaluator via Oblivious Transfer, not be picked from a dropdown — see why that's skipped here.
Evaluator tries all 4 rows, keeping the one with a zero tail
More on Interactive, including why nothing about a label or a shuffled ciphertext’s position reveals what it corresponds to.