> ## Content Index > Fetch the complete content index at: https://coti.io/blog/llms.txt > Use this file to discover other available public pages before exploring further. # Garbled Circuits Explained: How They Work and How They Compare to FHE and ZK - URL: https://coti.io/blog/garbled-circuits-explained/ - Published: 2026-10-08T18:39:27.000Z - Updated: 2026-10-08T18:39:27.000Z - Author: Antonio - Tags: Privacy Garbled circuits, explained in one line: they let two parties compute a result from private inputs, such as whose number is bigger, while each party learns only the result. The computation is written as a circuit of logic gates, one party scrambles (garbles) every gate with random keys, and the other evaluates the scrambled circuit without ever seeing the real values inside it. This guide walks through how that works, step by step, where the idea came from, how it compares with fully homomorphic encryption (FHE), zero-knowledge proofs, other multi-party computation and trusted hardware, and how COTI uses it on-chain, limits included. *Current as of October 8, 2026.* ## The Short Answer **What garbled circuits do** - Let two (or more) parties compute a function on private inputs - Each party learns the output, and nothing about the other's input beyond what the output itself reveals **Where they come from** - Andrew Yao's work on secure computation, starting with a 1982 paper **The trade-off** - Fast to evaluate, but data-heavy: a garbled circuit has to be sent to the evaluator, grows with the computation, and is used once **Where COTI fits** - COTI's network, live on mainnet since March 2025, uses garbled circuits run by separate garbler and executor nodes to compute on encrypted data, which works as long as those nodes don't collude ## Where the Idea Comes From The problem that started it all is usually told as a puzzle. In Andrew Yao's 1982 paper [Protocols for secure computations](https://doi.org/10.1109/SFCS.1982.38?ref=coti.io), presented at the IEEE FOCS conference, two millionaires want to know which of them is richer without finding out anything else about each other's wealth, as the textbook [A Pragmatic Introduction to Secure Multi-Party Computation](https://securecomputation.org/docs/ch1-introduction.pdf?ref=coti.io) recounts. The garbled-circuit technique for solving problems like this is rooted in Yao's work, though its history is untidy. The same textbook, by David Evans, Vladimir Kolesnikov and Mike Rosulek (2018), says Yao introduced the garbled circuits protocol in a series of talks in the following years rather than in a formal publication. Formal proofs came much later. The textbook credits Lindell and Pinkas (2009) with the first formal account, and Bellare, Hoang and Rogaway's [Foundations of Garbled Circuits](https://eprint.iacr.org/2012/265?ref=coti.io) (2012) treated garbling as a cryptographic primitive in its own right. Despite the name, nothing here is a physical circuit. The circuit is just a way of writing a computation as a chain of simple logic gates. Ethereum co-founder Vitalik Buterin, in his 2020 [primer](https://vitalik.eth.limo/general/2020/03/21/garbled.html?ref=coti.io), called garbled circuits "a quite old, and surprisingly simple, cryptographic primitive". ## How Garbled Circuits Work, Step by Step Take the millionaires again. Alice and Bob want to know who has more, without revealing their amounts. One of them plays the garbler, the other the evaluator. 1. **Write the computation as gates.** The question of whether Alice's number is bigger than Bob's becomes a Boolean circuit: a network of AND, XOR and similar gates, each taking bits in and putting a bit out. 2. **The garbler scrambles every gate.** For every wire, the garbler picks two random labels, one standing for 0 and one for 1\. Each gate's truth table is then encrypted so that the right pair of input labels unlocks exactly one output label, and the rows are shuffled so their order gives nothing away. The garbler then sends these encrypted tables to the evaluator. 3. **Inputs are handed over as labels.** The garbler sends the labels for its own input bits. The evaluator gets the labels for its own bits through oblivious transfer, an idea first proposed by Michael Rabin, used here in a form where the evaluator receives the label it needs while the garbler never learns which one it took. 4. **The evaluator works through the circuit and decodes the output.** Holding one label per input wire, the evaluator decrypts one row of each gate, which gives it the label for the next wire, and so on to the end. Every label it sees looks like random data. Only the output wires come with decoding information from the garbler, which turns the final labels into a real answer, such as Alice being the richer one. According to the Evans, Kolesnikov and Rosulek [textbook](https://securecomputation.org/docs/ch3-fundamentalprotocols.pdf?ref=coti.io), the evaluator obtains no other information. ![Four-step diagram titled How a garbled circuit works: 1 write it as gates, 2 the garbler scrambles every gate, 3 inputs are handed over as labels with oblivious transfer, 4 the evaluator evaluates and decodes, with a banner saying each garbled circuit is used once and bigger computations mean more data to send](https://coti.io/blog/content/images/2026/10/garbled-circuits-explained_ASSET_2.webp) The garbled circuits protocol in four steps. Sources: Evans, Kolesnikov and Rosulek (2018), Goldwasser et al. (IACR ePrint 2012/733). As of October 8, 2026. ### What made it practical Early garbling needed four encrypted rows for every gate. Among several improvements, two mattered most, as the textbook's [implementation chapter](https://securecomputation.org/docs/ch4-implementationtechniques.pdf?ref=coti.io) explains: - **Free XOR**, introduced by Kolesnikov and Schneider in 2008, lets XOR gates be evaluated with no encrypted table at all. - **Half-gates**, from Zahur, Rosulek and Evans ([IACR ePrint 2014/756](https://eprint.iacr.org/2014/756?ref=coti.io)), garble each AND gate with two ciphertexts and XOR gates with none. That is why circuit designers try to use as few AND gates as possible: AND gates are where the cost is. ### The limits - **Security depends on the threat model.** The basic protocol protects against parties who follow the rules but try to learn extra information, known as semi-honest or honest-but-curious parties. Protecting against parties who actively cheat needs extra techniques, which add cost. - **Each garbled circuit is used once.** A 2013 paper on [reusable garbled circuits](https://eprint.iacr.org/2012/733?ref=coti.io) (IACR ePrint 2012/733) notes that known constructions offer no security if the same garbled circuit is used on multiple inputs. - **Data grows with the computation.** Every AND gate means ciphertexts to send, so a bigger computation means a bigger garbled circuit to move from garbler to evaluator. ## Garbled Circuits vs FHE, Zero-Knowledge Proofs, MPC and TEEs These five terms often get mixed up because they all protect data in some way. They solve different problems. The definitions below come from the US National Institute of Standards and Technology's [Privacy-Enhancing Cryptography project](https://csrc.nist.gov/projects/pec?ref=coti.io) unless noted. **Garbled circuits** (per the Evans, Kolesnikov and Rosulek textbook) - What it does: two or more parties compute a function on private inputs, learning only the output - What you rely on: in the classic two-party case, the threat model you choose (semi-honest or malicious). In multi-node setups, a limit on how many nodes collude - Main cost: data to send, which grows with the size of the computation **Multi-party computation (MPC)** - What it does: NIST describes it as jointly computing a function over inputs distributed across several parties, without each party revealing their input - How it relates: garbled circuits are one way to do MPC. The Evans, Kolesnikov and Rosulek textbook calls Yao's garbled circuits protocol the most widely known MPC technique, and other approaches split data into secret shares instead - What you rely on: a limit on how many parties are corrupt **Fully homomorphic encryption (FHE)** - What it does: computing over encrypted data without learning the plaintext input or output, in NIST's wording. One party can do the work on data it can't read - Origin: the first scheme was proposed by Craig Gentry in 2009, building on lattice-based cryptography (per the same textbook) - Main cost: heavy computation. In 2018, the Evans, Kolesnikov and Rosulek textbook described FHE systems as thousands of times slower than multi-party computation in typical applications. FHE has improved since then, so check current benchmarks **Zero-knowledge proofs (ZK)** - What it does: proving knowledge of a secret solution to a problem without revealing the solution, per NIST. It proves that something is true rather than computing on other people's private data - Origin: Goldwasser, Micali and Rackoff introduced the idea in a 1985 paper, [The knowledge complexity of interactive proof-systems](https://doi.org/10.1145/22145.22178?ref=coti.io) - Where you'll see it: Ethereum's own [zero-knowledge proofs page](https://ethereum.org/zero-knowledge-proofs/?ref=coti.io) covers its use in scaling and privacy **Trusted execution environments (TEEs)** - What it does: runs code inside an area or enclave protected by a system processor, per NIST's [glossary](https://csrc.nist.gov/glossary/term/trusted%5Fexecution%5Fenvironment?ref=coti.io) - What you rely on: the hardware and its maker, rather than mathematics alone (our read) **Our take:** if you need to prove a fact without revealing the data, reach for zero-knowledge proofs. If one party must compute on data it can never see, FHE fits. If several parties each hold private inputs and want a joint answer, garbled circuits and other MPC are built for that. Real systems often combine them. ## How COTI Uses Garbled Circuits COTI's network applies the same idea at blockchain scale. COTI's V2 mainnet [went live on March 26, 2025](https://cotinetwork.medium.com/coti-v2-mainnet-is-now-live-a-new-era-for-web3-privacy-begins-f2a8631852e4?ref=coti.io), and according to COTI's [architecture documentation](https://docs.coti.io/coti-documentation/how-coti-works/introduction/coti-architecture?ref=coti.io), the network separates the roles from the step-by-step example above: - **Garblers** generate garbled circuits ahead of time, and a manager stores them for later use. - **Two executors** evaluate them, processing blocks in a multi-party computation setup. - **Users** encrypt their inputs locally with a per-user key that the network issues to them, and results come back encrypted under that key, per COTI's [key documentation](https://docs.coti.io/coti-documentation/how-coti-works/advanced-topics/aes-keys?ref=coti.io). The network's own key is split using threshold cryptography so that no single node can reconstruct it. COTI's [garbled circuits documentation](https://docs.coti.io/coti-documentation/how-coti-works/advanced-topics/garbled-circuits?ref=coti.io) states the trust assumption plainly: "COTI V2 is predicated on the fact that a threshold of the network nodes operate faithfully." In other words, privacy depends on the nodes that hold key shares not colluding. ### What the gcVM research paper says COTI says its network runs on gcVM, the garbled-circuit virtual machine developed by Soda Labs ([COTI, August 3, 2026](https://cotinetwork.medium.com/operator-defined-privacy-inside-the-cryptography-that-powers-coti-7c88c12f68ed?ref=coti.io)), and that its garbled circuits implementation was built in partnership with Soda Labs. Soda Labs describes the design in [gcVM: Publicly Auditable MPC via Garbled Circuits](https://eprint.iacr.org/2026/170?ref=coti.io), a preprint posted to IACR ePrint in February 2026 by Avishay Yanai, Meital Levy, Hila Dahari-Garbian and Mike Rosulek (Rosulek is also at Oregon State University, and is a co-author of the textbook cited above). The paper itself doesn't name COTI. It describes gcVM as deployed on a public testnet and scheduled for mainnet after a security audit, so its figures come from that proof of concept, not from measurements of COTI's mainnet. Three things stand out: - **Measured speed.** The proof of concept, running on cloud instances in one AWS region, processed 100,000 confidential token transfers at an average of about 56 confidential transactions per second, peaking at about 83\. The authors project about 500 with further optimisation. - **Comparison basis.** The authors compare this with an estimate of 2 to 3 confidential transactions per second for an FHE-based design, which they derive from published FHE benchmarks rather than a side-by-side test. - **Trust assumptions.** The proof of concept used two garblers and two evaluators. It stays private and correct if at most one of the four is corrupted. Any two colluding nodes, including one garbler and one evaluator, would break privacy, and two colluding garblers or two colluding evaluators would also break correctness. The paper's headline feature, public auditability, is not in the proof of concept yet. The authors describe it as ongoing work. ### Who could see what on COTI - **Values:** balances and amounts are encrypted, and the nodes that hold key shares could only read them by colluding. - **Activity:** COTI's privacy hides values, not activity. COTI's [Privacy-on-Demand documentation](https://docs.coti.io/coti-documentation/privacy-on-demand/what-is-privacy-on-demand?ref=coti.io) says it does not automatically hide metadata such as timing, gas, which contract was called or linkage patterns. In COTI's private token standard, transfer events still show the sender and receiver addresses in the clear. - **Auditability:** public auditability, which would let anyone check the computation, is still a research goal, per the gcVM paper. ### Where it runs today - **COTI mainnet:** live since March 26, 2025. - **Privacy-on-Demand on Avalanche:** COTI [announced](https://cotinetwork.medium.com/coti-x-avalanche-privacy-built-for-business-0110b3897d00?ref=coti.io) on September 16, 2026 that Privacy-on-Demand has been added to Avalanche and that its Privacy Portal app is live on Avalanche C-Chain. COTI's developer docs still describe the Avalanche setup on the Fuji testnet as of October 8, 2026. - **Ethereum:** testnet only as of October 8, 2026\. COTI [demonstrated](https://cotinetwork.medium.com/coti-solves-the-millionaires-problem-on-ethereum-testnet-using-garbled-circuits-2e454104a41e?ref=coti.io) a Millionaires' Problem solution on the Sepolia testnet on May 7, 2026, as a preview of Privacy-on-Demand. ## Frequently Asked Questions ### Are garbled circuits the same as MPC? No, but they're closely related. Multi-party computation is the goal of computing jointly on private inputs, and garbled circuits are one of the main techniques for reaching it, often described as the most widely known one. Other MPC techniques split data into secret shares instead of garbling a circuit. ### Can a garbled circuit be reused? Not safely in the classic design. Known constructions offer no security if the same garbled circuit is used on several inputs, so systems generate a fresh garbled circuit for each computation. COTI's design does this by having garblers produce circuits ahead of time. ### Are garbled circuits faster than FHE? For many joint computations, published research points that way, but it depends on what you measure. Garbled circuits trade heavy computation for heavy communication, and FHE does the opposite. The gcVM paper's comparison with FHE (an FHE estimate built from published benchmarks, measured against its own proof of concept) is an estimate from published benchmarks, not a side-by-side test, so treat speed claims, including COTI's, with their measurement context in mind. ## Where to Go From Here Garbled circuits are one of the oldest and simplest tools for computing on private data, and their limits are well understood: a sound threat model, single-use circuits and data that grows with the computation. To see how COTI applies them, start with COTI's [architecture documentation](https://docs.coti.io/coti-documentation/how-coti-works/introduction/coti-architecture?ref=coti.io), which shows how its garblers and executors fit together. *Details checked October 8, 2026\. Research results and product status can change. Nothing here is financial or legal advice. NIST, ethereum.org and the independent researchers named are not endorsing COTI. Soda Labs is COTI's technology partner.* ## Sources - [Protocols for secure computations](https://doi.org/10.1109/SFCS.1982.38?ref=coti.io), Andrew C. Yao, FOCS 1982, accessed October 8, 2026 - [A Pragmatic Introduction to Secure Multi-Party Computation, chapter 1](https://securecomputation.org/docs/ch1-introduction.pdf?ref=coti.io), David Evans, Vladimir Kolesnikov, Mike Rosulek, published 2018, accessed October 8, 2026 - [A Pragmatic Introduction to Secure Multi-Party Computation, chapter 3](https://securecomputation.org/docs/ch3-fundamentalprotocols.pdf?ref=coti.io), David Evans, Vladimir Kolesnikov, Mike Rosulek, published 2018, accessed October 8, 2026 - [A Pragmatic Introduction to Secure Multi-Party Computation, chapter 4](https://securecomputation.org/docs/ch4-implementationtechniques.pdf?ref=coti.io), David Evans, Vladimir Kolesnikov, Mike Rosulek, published 2018, accessed October 8, 2026 - [Foundations of Garbled Circuits](https://eprint.iacr.org/2012/265?ref=coti.io), Mihir Bellare, Viet Tung Hoang, Phillip Rogaway, IACR ePrint, published 2012, accessed October 8, 2026 - [Two Halves Make a Whole: Reducing Data Transfer in Garbled Circuits using Half Gates](https://eprint.iacr.org/2014/756?ref=coti.io), Samee Zahur, Mike Rosulek, David Evans, IACR ePrint, published 2014, accessed October 8, 2026 - [Reusable Garbled Circuits and Succinct Functional Encryption](https://eprint.iacr.org/2012/733?ref=coti.io), Goldwasser, Kalai, Popa, Vaikuntanathan, Zeldovich, IACR ePrint, published 2013, accessed October 8, 2026 - [How To Exchange Secrets with Oblivious Transfer](https://eprint.iacr.org/2005/187?ref=coti.io), Michael O. Rabin, Harvard technical report, published 1981 (IACR ePrint archive copy), accessed October 8, 2026 - [The knowledge complexity of interactive proof-systems](https://doi.org/10.1145/22145.22178?ref=coti.io), Shafi Goldwasser, Silvio Micali, Charles Rackoff, STOC 1985, accessed October 8, 2026 - [A Quick Garbled Circuits Primer](https://vitalik.eth.limo/general/2020/03/21/garbled.html?ref=coti.io), Vitalik Buterin, published March 21, 2020, accessed October 8, 2026 - [Privacy-Enhancing Cryptography project](https://csrc.nist.gov/projects/pec?ref=coti.io), NIST, accessed October 8, 2026 - [Trusted execution environment (glossary)](https://csrc.nist.gov/glossary/term/trusted%5Fexecution%5Fenvironment?ref=coti.io), NIST, accessed October 8, 2026 - [Zero-knowledge proofs](https://ethereum.org/zero-knowledge-proofs/?ref=coti.io), ethereum.org, accessed October 8, 2026 - [gcVM: Publicly Auditable MPC via Garbled Circuits with Applications to Private EVM-Compatible Computation](https://eprint.iacr.org/2026/170?ref=coti.io), Avishay Yanai, Meital Levy, Hila Dahari-Garbian, Mike Rosulek, IACR ePrint, published February 2026, accessed October 8, 2026 - [COTI architecture](https://docs.coti.io/coti-documentation/how-coti-works/introduction/coti-architecture?ref=coti.io), COTI documentation, accessed October 8, 2026 - [AES keys](https://docs.coti.io/coti-documentation/how-coti-works/advanced-topics/aes-keys?ref=coti.io), COTI documentation, accessed October 8, 2026 - [What is Privacy-on-Demand](https://docs.coti.io/coti-documentation/privacy-on-demand/what-is-privacy-on-demand?ref=coti.io), COTI documentation, accessed October 8, 2026 - [Garbled circuits (advanced topics)](https://docs.coti.io/coti-documentation/how-coti-works/advanced-topics/garbled-circuits?ref=coti.io), COTI documentation, accessed October 8, 2026 - [Private ERC20](https://docs.coti.io/coti-documentation/build-on-coti/tools/contracts-library/tokens/private-erc20?ref=coti.io), COTI documentation, accessed October 8, 2026 - [Operator-Defined Privacy: Inside the Cryptography That Powers COTI](https://cotinetwork.medium.com/operator-defined-privacy-inside-the-cryptography-that-powers-coti-7c88c12f68ed?ref=coti.io), COTI, published August 3, 2026, accessed October 8, 2026 - [COTI V2 Mainnet is Now Live](https://cotinetwork.medium.com/coti-v2-mainnet-is-now-live-a-new-era-for-web3-privacy-begins-f2a8631852e4?ref=coti.io), COTI, published March 26, 2025, accessed October 8, 2026 - [COTI x Avalanche: Privacy Built for Business](https://cotinetwork.medium.com/coti-x-avalanche-privacy-built-for-business-0110b3897d00?ref=coti.io), COTI, published September 16, 2026, accessed October 8, 2026 - [COTI Solves the Millionaires' Problem on Ethereum Testnet Using Garbled Circuits](https://cotinetwork.medium.com/coti-solves-the-millionaires-problem-on-ethereum-testnet-using-garbled-circuits-2e454104a41e?ref=coti.io), COTI, published May 7, 2026, accessed October 8, 2026