Garbled Circuits: Yao's Secure Two-Party Computation (2D)

Circuit

Gate

Real inputs (evaluator's secret)

Party A's bit

Party B's bit

Playback

Reveal speed 1.0×

Live Readout

Rows tried

0 / 4

Output bit

—

Expected

—

Match?

—

Row currently being tried

—

How it works

Every wire (A, B and the output) gets two random 32-bit "labels", one for bit 0 and one for bit 1 — the low byte of each real label is forced to a fixed checksum tag so a correct decryption is recognisable. For every combination of input bits the garbler computes cipher = hash(keyA:keyB) XOR outputKey, then shuffles the four resulting rows so their order leaks nothing about which row belongs to which input combination.

The evaluator holds only one real key per wire — the one matching the actual secret bit chosen with the A / B buttons — and walks the shuffled table trying row.cipher XOR hash(myKeyA:myKeyB) against every row until the checksum tag matches. Exactly one row decrypts; every other row stays meaningless garbage, so the evaluator learns the output bit without ever seeing the other party's input or any intermediate wire value.

Left/right columns — the two labels on each wire; the one matching the chosen real bit glows.
Center strip — the shuffled garbled table; cells turn orange as the evaluator tries them, green on the one that decrypts.
Re-garble — draws fresh random keys and a fresh shuffle, exactly like a new protocol run.

Label for bit 0 Label for bit 1 Row being tried Row that decrypted