2 ms·

How can the data be sent in an encrypted manner that can then be useful without the server having a copy of the private keys used to encrypt the data itself?

nemo1618 7y ago
Surprisingly, there are a few ways in which you can perform operations on encrypted data: https://en.wikipedia.org/wiki/Homomorphic_encryption https://en.wikipedia.org/wiki/Homomorphic_encryption However, the best techniques we have for doing so are many orders of magnitude slower than their un-encrypted counterparts, so it's not feasible today.
ddtaylor 7y ago
Homomorphic Encryption
- arthurcolle 7y ago
  Does this actually work today? I was tangentially involved in some 'zero protocol'/zcash-related projects a few years back and the lack of ability to communicate and transfer information while being able to perform computation on it was a major drawback to most of the interesting ideas in the space. Are they actually using this in this intended federated learning plan? If so that's a truly major innovation.
  - CyanTas 7y ago
    Fully homomorphic encryption, in which you can do arbitrary computation on encrypted data, is still quite slow. But partially homomorphic decryption, in which you can add encrypted values together but not multiply (or vice versa), is quite efficient. And since the secure aggregation protocol only needs to add together encrypted values to get an average, it only needs partially homomorphic encryption properties.
    - ddtaylor 7y ago
      I believe there is also a proof that says any partially homomorphic system can be reworked into a FHE.
      - CyanTas 7y ago
        You're thinking of "somewhat homomorphic encryption", which is homomorphic encryption that can support both addition/OR and multiplication/AND, but only in circuits of a limited depth. The original FHE paper did indeed prove that you can rework any "somewhat homomorphic" system into a fully homomorphic one. Partially homomorphic encryption is different because it really only enables one of those two types of operations. For example, Pallier encryption has the property that Enc(A) + Enc(B) = Enc(A+B), but there's no way to go from Enc(A) and Enc(B) to Enc(A×B).
        ddtaylor 7y ago
        Thanks for the clarification.

nemo1618 7y ago

Surprisingly, there are a few ways in which you can perform operations on encrypted data: https://en.wikipedia.org/wiki/Homomorphic_encryption https://en.wikipedia.org/wiki/Homomorphic_encryption However, the best techniques we have for doing so are many orders of magnitude slower than their un-encrypted counterparts, so it's not feasible today.

ddtaylor 7y ago

Homomorphic Encryption

arthurcolle 7y ago
Does this actually work today? I was tangentially involved in some 'zero protocol'/zcash-related projects a few years back and the lack of ability to communicate and transfer information while being able to perform computation on it was a major drawback to most of the interesting ideas in the space. Are they actually using this in this intended federated learning plan? If so that's a truly major innovation.
- CyanTas 7y ago
  Fully homomorphic encryption, in which you can do arbitrary computation on encrypted data, is still quite slow. But partially homomorphic decryption, in which you can add encrypted values together but not multiply (or vice versa), is quite efficient. And since the secure aggregation protocol only needs to add together encrypted values to get an average, it only needs partially homomorphic encryption properties.
  - ddtaylor 7y ago
    I believe there is also a proof that says any partially homomorphic system can be reworked into a FHE.
    - CyanTas 7y ago
      You're thinking of "somewhat homomorphic encryption", which is homomorphic encryption that can support both addition/OR and multiplication/AND, but only in circuits of a limited depth. The original FHE paper did indeed prove that you can rework any "somewhat homomorphic" system into a fully homomorphic one. Partially homomorphic encryption is different because it really only enables one of those two types of operations. For example, Pallier encryption has the property that Enc(A) + Enc(B) = Enc(A+B), but there's no way to go from Enc(A) and Enc(B) to Enc(A×B).
      - ddtaylor 7y ago
        Thanks for the clarification.