  A protocol for two-party secure function evaluation (2P-SFE) aims to allow
the parties to learn the output of function $f$ of their private inputs, while
leaking nothing more. In a sense, such a protocol realizes a trusted oracle
that computes $f$ and returns the result to both parties. There have been
tremendous strides in efficiency over the past ten years, yet 2P-SFE protocols
remain impractical for most real-time, online computations, particularly on
modestly provisioned devices. Intel's Software Guard Extensions (SGX) provides
hardware-protected execution environments, called enclaves, that may be viewed
as trusted computation oracles. While SGX provides native CPU speed for secure
computation, previous side-channel and micro-architecture attacks have
demonstrated how security guarantees of enclaves can be compromised.
  In this paper, we explore a balanced approach to 2P-SFE on SGX-enabled
processors by constructing a protocol for evaluating $f$ relative to a
partitioning of $f$. This approach alleviates the burden of trust on the
enclave by allowing the protocol designer to choose which components should be
evaluated within the enclave, and which via standard cryptographic techniques.
We describe SGX-enabled SFE protocols (modeling the enclave as an oracle), and
formalize the strongest-possible notion of 2P-SFE for our setting. We prove our
protocol meets this notion when properly realized. We implement the protocol
and apply it to two practical problems: privacy-preserving queries to a
database, and a version of Dijkstra's algorithm for privacy-preserving
navigation. Our evaluation shows that our SGX-enabled SFE scheme enjoys a 38x
increase in performance over garbled-circuit-based SFE. Finally, we justify
modeling of the enclave as an oracle by implementing protections against known
side-channels.
