7 ms·

This is one of the current 'tech' trends that I'm following, the idea of homomorphic encryption is really cool. I feel like there is a lot of real world applica

This is one of the current 'tech' trends that I'm following, the idea of homomorphic encryption is really cool. I feel like there is a lot of real world applications for it, but I have failed to find them yet.

Yhippa 8y ago
One of the big ones is internet searches. Also processing PII/HIPAA data.
- soberhoff 8y ago
  How does this affect internet searches?
  - mcbits 8y ago
    Potentially a search engine could provide results without knowing the actual query, although that would make it difficult to identify new trends or determine which results are/aren't being clicked, so it probably wouldn't be competitive as a general purpose search engine.
    - betterunix2 8y ago
      It would also be completely impractical, since the search engine would necessarily have to perform some sort of scan of its entire database to respond to every query (otherwise it would, in fact, learn something about the query).
      - heavenlyblue 8y ago
        Unless the database is also encrypted and provides the same homomorphism against reverse index queries.
        soberhoff 8y ago
        If the database was encrypted, you would need a different encrypted database for every user - again impractical.
        betterunix2 8y ago
        In which case you are no longer talking about FHE. With FHE the server receives a ciphertext query and produces a ciphertext output, without ever seeing any plaintexts (not even the result of a reverse index query).
jerf 8y ago
I really want to sarcastically say "blockchain homomorphic encryption", but, well, it's not necessarily a terrible idea, honestly. One can imagine some combination of the primitives in which you could prove that you added here the same amount you subtracted from there, that neither total is below zero, but for which the number actually transferred is encrypted. The current use case for something like BitCoin is often security focused, but there's also simply a privacy concern that could be addressed there.
- deleted 8y ago
  [deleted]
- ersiees 8y ago
  I think this is what zcash already does.
  - yarrel 8y ago
    zCash uses zk-SNARKs for secret transactions. Which are awesome. But homomorphic encryption allows general-purpose computation.
    - cmrx64 8y ago
      These fully homomorphic encryption systems can do boolean circuits, which are no more powerful than the arithmetic circuits you get with zk-SNARKs (in fact, are an instance of arithmetic circuits). And with some zk-SNARKs, you get recursive composition, which lets you do arbitrarily many steps of a transition function expressed as a zk-SNARK, which is just as general purpose (albeit more involved) as applying a bunch of boolean circuits to some data.
- mhluongo 8y ago
  Hey, we're working on blockchain "somewhat homomorphic encryption" (SHE) via multiparty computation. In particular, a privacy layer for Ethereum.
  - 8y ago
srgseg 8y ago
The "Confidential Transactions" scheme for cryptocurrencies uses homomorphic encryption. The idea is that you can prove that the encrypted input and output amounts in a transaction balance to zero, without having to actually reveal what any of those amounts are. See https://people.xiph.org/~greg/confidential_values.txt https://people.xiph.org/~greg/confidential_values.txt
- tuxxy 8y ago
  CTs don't use homomorphic encryption. They use "additively homomorphic commitments" which are, essentially, cryptographic proofs.
CapacitorSet 8y ago
One of the side projects I have is [FHE-CPU](https://github.com/CapacitorSet/FHE-CPU https://github.com/CapacitorSet/FHE-CPU), an effort to make general-purpose homomorphic computation possible with a Moxie-like CPU, but it's a daunting effort to even get the basics working.
SilasX 8y ago
There are certainly real-world applications, just not with the current level of overhead that known algorithms require. The real-world use case is being able upload data to a cloud provider and do queries and computation on it without the provider ever knowing what's inside. e.g. "How much did I spend last month?"
sp332 8y ago
Cloud computing is the big one. You might want to rent some remote computer time without sending plaintext data to a third party. Homomorphic encryption lets you upload encrypted data and instructions for a third party to operate on it without having to decrypt it first. Edit: Try Greg Egan's book Permutation City.
- tfha 8y ago
  If we had proper homorphic encryption, we could use regular home user machines for a cloud, airbnb style. You can't do that today because the security risks are completely unmanageable. But that all changes with homomorphic encryption. Today it's not practical, but we see advances like this every year, maybe in a decade it will be practical.
  - betterunix2 8y ago
    You need more than FHE for that; just because I cannot see what I am computing does not mean I will compute the answer correctly. There are ways this can be resolved but it pushes practicality even further back.
    - dlubarov 8y ago
      Not sure what you mean? Correct evaluation (modulo some negligible error) is part of the usual FHE definition.
      - JadeNB 8y ago
        Perhaps it’s referring to human malice rather than mathematical error: that we’d want some sort of certification that the operation performed off-site was actually the one requested?
      - tylersmith 8y ago
        You can't evaluate the correctness/trust the result without performing the computation yourself or receiving a proof of correctness, e.g. a SNARK.
deleted 8y ago
[deleted]
Untit1ed 8y ago
One of the things another team at my organisation is working on is using it so that competitors can pool their data to do better analytics over the whole corpus without actually revealing their secrets to the other company - https://www.n1analytics.com/ https://www.n1analytics.com/.
betterunix2 8y ago
The "textbook" application is spam filtering for encrypted mail.

Yhippa 8y ago

One of the big ones is internet searches. Also processing PII/HIPAA data.

soberhoff 8y ago
How does this affect internet searches?
- mcbits 8y ago
  Potentially a search engine could provide results without knowing the actual query, although that would make it difficult to identify new trends or determine which results are/aren't being clicked, so it probably wouldn't be competitive as a general purpose search engine.
  - betterunix2 8y ago
    It would also be completely impractical, since the search engine would necessarily have to perform some sort of scan of its entire database to respond to every query (otherwise it would, in fact, learn something about the query).
    - heavenlyblue 8y ago
      Unless the database is also encrypted and provides the same homomorphism against reverse index queries.
      - soberhoff 8y ago
        If the database was encrypted, you would need a different encrypted database for every user - again impractical.
      - betterunix2 8y ago
        In which case you are no longer talking about FHE. With FHE the server receives a ciphertext query and produces a ciphertext output, without ever seeing any plaintexts (not even the result of a reverse index query).

jerf 8y ago

I really want to sarcastically say "blockchain homomorphic encryption", but, well, it's not necessarily a terrible idea, honestly. One can imagine some combination of the primitives in which you could prove that you added here the same amount you subtracted from there, that neither total is below zero, but for which the number actually transferred is encrypted. The current use case for something like BitCoin is often security focused, but there's also simply a privacy concern that could be addressed there.

deleted 8y ago
[deleted]
ersiees 8y ago
I think this is what zcash already does.
- yarrel 8y ago
  zCash uses zk-SNARKs for secret transactions. Which are awesome. But homomorphic encryption allows general-purpose computation.
  - cmrx64 8y ago
    These fully homomorphic encryption systems can do boolean circuits, which are no more powerful than the arithmetic circuits you get with zk-SNARKs (in fact, are an instance of arithmetic circuits). And with some zk-SNARKs, you get recursive composition, which lets you do arbitrarily many steps of a transition function expressed as a zk-SNARK, which is just as general purpose (albeit more involved) as applying a bunch of boolean circuits to some data.
mhluongo 8y ago
Hey, we're working on blockchain "somewhat homomorphic encryption" (SHE) via multiparty computation. In particular, a privacy layer for Ethereum.
- 8y ago

srgseg 8y ago

The "Confidential Transactions" scheme for cryptocurrencies uses homomorphic encryption. The idea is that you can prove that the encrypted input and output amounts in a transaction balance to zero, without having to actually reveal what any of those amounts are. See https://people.xiph.org/~greg/confidential_values.txt https://people.xiph.org/~greg/confidential_values.txt

tuxxy 8y ago
CTs don't use homomorphic encryption. They use "additively homomorphic commitments" which are, essentially, cryptographic proofs.

CapacitorSet 8y ago

One of the side projects I have is [FHE-CPU](https://github.com/CapacitorSet/FHE-CPU https://github.com/CapacitorSet/FHE-CPU), an effort to make general-purpose homomorphic computation possible with a Moxie-like CPU, but it's a daunting effort to even get the basics working.

SilasX 8y ago

There are certainly real-world applications, just not with the current level of overhead that known algorithms require. The real-world use case is being able upload data to a cloud provider and do queries and computation on it without the provider ever knowing what's inside. e.g. "How much did I spend last month?"

sp332 8y ago

Cloud computing is the big one. You might want to rent some remote computer time without sending plaintext data to a third party. Homomorphic encryption lets you upload encrypted data and instructions for a third party to operate on it without having to decrypt it first. Edit: Try Greg Egan's book Permutation City.

tfha 8y ago
If we had proper homorphic encryption, we could use regular home user machines for a cloud, airbnb style. You can't do that today because the security risks are completely unmanageable. But that all changes with homomorphic encryption. Today it's not practical, but we see advances like this every year, maybe in a decade it will be practical.
- betterunix2 8y ago
  You need more than FHE for that; just because I cannot see what I am computing does not mean I will compute the answer correctly. There are ways this can be resolved but it pushes practicality even further back.
  - dlubarov 8y ago
    Not sure what you mean? Correct evaluation (modulo some negligible error) is part of the usual FHE definition.
    - JadeNB 8y ago
      Perhaps it’s referring to human malice rather than mathematical error: that we’d want some sort of certification that the operation performed off-site was actually the one requested?
    - tylersmith 8y ago
      You can't evaluate the correctness/trust the result without performing the computation yourself or receiving a proof of correctness, e.g. a SNARK.

deleted 8y ago

[deleted]

Untit1ed 8y ago

One of the things another team at my organisation is working on is using it so that competitors can pool their data to do better analytics over the whole corpus without actually revealing their secrets to the other company - https://www.n1analytics.com/ https://www.n1analytics.com/.

betterunix2 8y ago

The "textbook" application is spam filtering for encrypted mail.