Garbled Circuit Visualizer

Alice

Alice holds both labels (k₀ and k₁) for every wire. She sends Bob the label matching her actual bit directly. Highlighted label = the one she sends.

Bob

Bob receives one label per wire. He cannot tell whether k₀ or k₁ he holds — they are indistinguishable random values. The color bit (LSB) reveals the bit value in this scheme.

Step 0 / 0

Active Gate

—

Bob evaluates each gate using only the labels he holds. He does not need to know the bit values — he uses labels purely as cryptographic keys to decrypt the garbled table row.

Known Wire Labels

One label per wire. Labels are random 128-bit values — indistinguishable from noise. The color bit (LSB of byte 0) encodes the bit value in this implementation: color 0 → value 0, color 1 → value 1. Bob reads this bit to learn the result.

Wire	Bit	Label (hex)

Garbled Table (active gate)

Bob picks the row using c(a)·2 + c(b), where c(x) is the color bit (LSB) of each input label. He decrypts that row with AES-Davies-Meyer using both input labels as keys. The other rows produce garbage — he can decrypt exactly one.

c(a)	c(b)	Ciphertext

Full Garbled Circuit

Alice holds both labels for every wire. Bob receives the garbled tables (all rows), but without the correct input labels he cannot decrypt any gate. This table is Alice’s private view — in the real protocol Bob never sees k₀ and k₁ side by side.

Wire Keys — k₀ = label for bit-value 0, k₁ = label for bit-value 1

Wire	k₀ (color 0)	k₁ (color 1)

Garbled Tables — each row is an AES-DM encrypted output label

Oblivious Transfer

A 3-message protocol (Chou-Orlandi 2015 over Ristretto255) that transfers exactly one of Alice’s two labels to Bob. Alice never learns Bob’s selection bit. Bob never learns the label he didn’t receive. Each of Bob’s input wires requires one OT round.

Protocol Log

Who Learns the Output?

Bob ends up holding one label per output wire. Who learns the actual bit values depends entirely on who holds the label→bit mapping.

Option 1 · Bob Learns Standard Yao

Alice provides a decoding table mapping each output label to 0 or 1. Bob translates his labels and learns the result. Alice learns nothing.

In this visualizer the color bit (LSB of each label) directly encodes the bit value, so Bob reads it without a separate decoding table — a common simplification.

Option 2 · Alice Learns

Alice does not provide the decoding table. Bob sends his output labels back to Alice. She checks which label she originally assigned to 0 vs 1 and learns the result. Bob learns nothing beyond what the output implies.

Option 3 · Both Learn

Alice publishes the decoding table so Bob can decode, then communicates the result back. Alternatively, output wires can be assigned to different parties — some decode to Alice, some to Bob.

Big-picture rule: whoever knows the output label mapping learns the output.