9 ms·

Homomorphic encryption

106 points by azujus 7y ago

rch 7y ago
I've run into a few people working on this over the last five years or so, but they've been a bit cagey about discussing their use cases and customers. Any public applications outside of blockchain?
- Iv 7y ago
  Online voting. That's the big one.
- rhindi 7y ago
  There are as many usecases as there is sensitive data! Some of the obvious ones are automated medical diagnosis, genomics, biometric authentication, fraud detection, etc. What has prevented those usecases from happening at scale is the performance of homomorphic schemes
- throwawaywego 7y ago
  Cloud Computing. Use the compute from a big company, without that company possibly knowing what they are computing on. Machine Learning. Apply neural networks to encrypted data and avoid privacy issues.
- motohagiography 7y ago
  When I encountered FHE as a potential solution, it was in designing authentication and payment tokens. Use case was you need to be able to verify that the output of a program was also a proof of the integrity of that program. E.g. I receive a payment token from you, and I can verify that this token was produced by a program I could verify as being the "real," program, personalized to your identity, on a device also personalized to your identity, that you physically hold and verify yourself to. Pretty good* with a chip/pin combination, but on a mobile general purpose computer with lots of other code on it, Hard problem. With some handwaving, FHE would ostensibly have enabled the secure personalization of the program and the signing of those token outputs. It was a variation on: https://en.wikipedia.org/wiki/Direct_Anonymous_Attestation https://en.wikipedia.org/wiki/Direct_Anonymous_Attestation as well. FHE was the DRM holy grail where suddenly you can "tokenize," information. Other applications are in selling and metering software use. In the case of health information, the ability to open up data sets to researchers to query and analyze without the risk of losing control of the data is huge. We know that de-identification of data is (information theoretically) impossible, but an ideal FHE scheme would facilitate queries against data that would mitigate much of the risk associated with it. The other use case is in highly regulated environments where there are legal firewalls between lines of business. Basically wherever there is a use case for de-identification, FHE is a potential solution in that domain. In that regulatory case, it's sort of ironic that it's a solution for, "ok, we won't commit a crime, but we need the hypothetical output of that crime, so let's use cryptography to facilitate that outcome without explicitly breaking the law whose effect is to prevent this outcome." Perhaps that's why people working in it seem so cagey.
Iv 7y ago
Seriously one of the most important area of mathematics for democracies in an online world. Homomorphic encryption promises a hidden and verifiable online voting system that does not rely on trusting third party.
- solidasparagus 7y ago
  How does computation on encrypted data relate to voting systems?
  - jl2718 7y ago
    It’s possible that OP meant multiparty computation.
  - gnarula94 7y ago
    Homomorphic encryption would allow tallying the ballots without decrypting them. Helios [1], for instance uses an homomorphic scheme. There are alternatives to it though which preserve voter privacy but allow vote tallying. Shuffling is one of them. Cothority [2] implements an e-voting scheme based on Neff Shuffles 1. https://heliosvoting.org/ https://heliosvoting.org/ 2. https://github.com/dedis/cothority/tree/master/evoting https://github.com/dedis/cothority/tree/master/evoting P.S. I contributed to the latter
- rfugger 7y ago
  Any political voting system will need a trusted third party to run the voter registration/identity system, so I doubt the lack of practical homomorphic encryption is blocking this. There are other voter-verifiable systems that don't rely on HE for trustworthy counting: https://www.chaum.com/publications/AccessibleVoterVerifiability.pdf https://www.chaum.com/publications/AccessibleVoterVerifiabil... The major problem with online voting is that people can be coerced into voting against their wishes outside the watchful eye of election authorities. This may be worth the increase in voting ease, but it's where the real debate is.
  - dark_glass 7y ago
doctorpangloss 7y ago
The technology for all this progress was a huge discovery in 2009. But what if it is a dead end, that nothing originating from that discovery will ever be practical? Like wouldn't it be preposterous if someone said, "Here Craig Gentry, take $1 billion to run enough computers for the current FHE schemes. What is the snazziest demo you can run?"
- rhindi 7y ago
  Some of the newer schemes are much faster. The recent progress feels like deep learning in 2010, right before everyone realized it worked
  - poz 7y ago
    > The recent progress feels like deep learning in 2010, right before everyone realized it worked Does it work, though?
    - throwawaywego 7y ago
      https://www.microsoft.com/en-us/research/publication/cryptonets-applying-neural-networks-to-encrypted-data-with-high-throughput-and-accuracy/ https://www.microsoft.com/en-us/research/publication/crypton... (2016) > We demonstrate CryptoNets on the MNIST optical character recognition tasks. CryptoNets achieve 99% accuracy and can make more than 51000 predictions per hour on a single PC. Therefore, they allow high throughput, accurate, and private predictions.
    - rhindi 7y ago
      It’s starting to, yes, in particular for machine learning. There is a yearly competition called iDash where people show the performances of their homomorphic schemes. This year should be very interesting
- rhacker 7y ago
  If they keep that name it will be a dead end.
- 7y ago
crdrost 7y ago
To address the inevitable “what is this useful for” questions, my go-to example is cryptographic voting mechanisms. The idea is that you segment a large integer into a couple of different bins by its bitwise representation. So you have a 60-bit integer and you segment it into four 15-bit bins. You use one of those to randomize what the encrypted versions are going to be, and you use the other three for different vote tallies of three candidates for some office. You can then hand people three numbers each corresponding to a different candidate, and ask them to commit to one as their vote. Public authorities can then aggregate votes which they cannot actually see, and we don't decrypt until we get to some large enough context where your vote has been anonymized among ten thousand others, and you can check that the random seeds have been properly added, or other such things. This also allows you to create a big online database where anybody can see their vote was counted, but nobody can figure out who someone else voted for. There is a slight difficulty in that you cannot see directly what your numbers are actually voting for, so that the machines you are using to vote with need to be able to decrypt a ballot for you and then immediately destroy it, to verify that it was what you thought it was, so that you can trust that your three numbers do not all happen to vote for the same person because if someone tried that on any scale that could affect an election, even if they only poison 1% of ballots in a 500 person district, if everyone burns one to test the system then the fraud gets discovered at least once with 99.3% certainty. But the point is that all of these other issues can be handled “out-of-band” once you protect the important stuff.
- compsciphd 7y ago
  I'd think there's a simpler way to accomplish what you said above (though in both cases, any voting mechanism that lets the voter verify their vote after the fact also runs into the problem of people complaining about encouraging vote buying). i.e. imagine every polling place would output to you (after you voted) a random number in the 128 bit space. the votes are recorded with this random number. we can verify after polls closed that the voting machine has an appropriate number of votes (i.e. not more or less than people who came through the booths) all these vote data is aggregated into public record. you can look up after the fact your random number and see that it matched who you voted for. No encryption needed (beyond the technology that goes into making a secure rng)
ktta 7y ago
A very casual (layman's?) introduction intro to Homomorphic Encryption - https://news.ycombinator.com/item?id=13450015 https://news.ycombinator.com/item?id=13450015
KenoFischer 7y ago
There is a decent size effort to build a system that runs (a restricted, but hopefully useful subset of) Julia programs fully homomorphically (as well as supporting various sort of secure multiparty computation protocols). At JuliaCon two years ago, the Galois folks talked about their initial prototype of this work: https://www.youtube.com/watch?v=_KLlMg6jKQg https://www.youtube.com/watch?v=_KLlMg6jKQg (fun to watch even if you don't care about julia to see FHE "in action"). This effort was recently funded with the goal of extending the prototype into a full robust system, so I'm hoping for some good news here over the next couple of years.
Nightshaxx 7y ago
My school is working on this right now. Seriously awesome.
buzzdenver 7y ago
For a layman like me it sounds really cool, almost like magic. Consider a trivial operation like finding a maximum value in a list. How is that supposed to work on encrypted values while simultaneously providing strong encryption? So something like adding N to everything in the list is not an acceptable encryption.
- tonmoy 7y ago
  Today is the first time I heard of Homomorphic Encryption so I have 0 knowledge about this. But just to show this is not magic, you can provide N*N number of lists where each list has totally different results and then get the max index for each list as a return. Since you know what original list was the right one, you can keep that result and discard rest
  - buzzdenver 7y ago
    Not sure I'm following you. Would you transmit in plain text N-1 random lists along with the real one? I would not consider that encryption. I guess one brute force way to do it is making encryption unnecessary. For an input of N bits, have the results calculated/returned for all 2^N possibilities. Does not sound very practical.
- jayavanth 7y ago
  You can do polynomial approximation to get a compatible function
- MrQuincle 7y ago
  Just like a Laplace transform maps differential equations into algebraic equations and convolution into multiplication - or Fourier for that matter - it's not so hard to imagine that there are encryption maps (that are hard to invert) but where something like a sum operation becomes a feasible operation in the encrypted domain. A max operation can similarly have an equivalent operation in the encrypted space. I guess your concern is that the output is "one of the encrypted input" values and hence identified, although not decrypted. Subsequently, all the input values would be fed into the "max" module and their complete order can be determined by the one running the homeomorphic server. In that case we will need to have an output where all inputs are returned. Perhaps a map with indices and values (all encrypted) as input and as output would be sufficient.
amelius 7y ago
Are these schemes theoretically resistant against quantum computing?
- rhindi 7y ago
  Yes, all the fully homomorphic schemes are lattice based and thus thought to be quantum resistant
sungju1203 7y ago
I was like WTF is "homophobic encryption" lol
tuxxy 7y ago
If anyone is interested in playing with Fully Homomorphic Encryption, we (NuCypher YC S16) built NuFHE (https://github.com/nucypher/nufhe/ https://github.com/nucypher/nufhe/). It's written in Python and has excellent documentation, so you can try building some circuits and playing around with it. It requires a GPU to run, but it's also the fastest implementation of FHE in the world (that I know of). Let me know what you think! :)
- Labo333 7y ago
  Is there some kind of interoperability with other libraries? Or does it support CPU encryption / decryption ? For example, one can expect clouds to have GPUs to perform computations but encryption and decryption are typically done by clients on various devices where portable code is expected.
  - tuxxy 7y ago
    This is mostly a research library, so we haven't put our limited effort into CPU operations yet, but it's definitely possible if someone wanted to take the time to expose it in the library.
wish5031 7y ago
If this interests you, a related concept with similar applications as HE is functional encryption: https://en.m.wikipedia.org/wiki/Functional_encryption https://en.m.wikipedia.org/wiki/Functional_encryption
- rudolph9 7y ago
  Here is a descent looking Haskell library that implements functional encryption concepts https://github.com/cpeikert/Lol https://github.com/cpeikert/Lol
bikeshaving 7y ago
Why do people always talk about arbitrary computation in relation to homomorphic encryption? What I really want is a homomorphic encryption system which allows me to arbitrarily slice and concatenate strings without knowing their contents. This would be immensely useful for implementing end-to-end encrypted collaborative editing of documents. Is homomorphic encryption there yet?
- kradroy 7y ago
  I'm dying for this. My team builds ML models on text corpora. Most of this data is sensitive. My company has very strict data privacy policies and it's a pain to even share the data with other teams in the department. I've made it part of my long-term goals to facilitate secure sharing of sensitive data across the organization. Numerical data seems to be the easiest to anonymize (randomized response, etc), but I have yet to find any techniques for text other than generating synthetic data.
  - tuxxy 7y ago
    Hi, I've been replying to other people in this thread. I work at NuCypher doing some research and cryptography engineering. I work on Proxy Re-Encryption and Fully Homomorphic Encryption. Do you mind sending me an email with your use case and needs? I'd love to have a chat with you. john@nucypher.com
    - drenvuk 7y ago
      This guy right here, this guy knows whats up. gl john.
- tuxxy 7y ago
  You can do this with a TFHE implementation, if I understand your use case correcltly. You encrypt bits and then you can operate/manipulate on those individual encrypted bits. I referenced NuFHE in a comment, but you should give it a try and see if it will do what you're wanting. See https://github.com/nucypher/nufhe/ https://github.com/nucypher/nufhe/. We also have a discord channel where you can ask questions on using it in the #nufhe channel -- https://discord.gg/rmSafk https://discord.gg/rmSafk
dustfinger 7y ago
Could a fully homomorphic cpu architecture with fully encrypted cache be immune to Spectre and similar side channel attacks? Could this be tested on an FPGA?
- tuxxy 7y ago
  Unfortunately, FHE doesn't work this way. You're operating on encrypted data, so performing some branched operations doesn't work due to the security (IND-CPA) security. IE: You have a value that you need to do `if <condition> then <statement> else <other statement>` Problematically, if that condition could work, then it would violate the confidentiality of the encrypted value, thus breaking the CPA security. Now there are some workarounds and methods to getting around this problem sometimes, but in many cases it's not possible.
  - ay 7y ago
    So any unit of work in the FHE scenario is necessarily a basic block with no branching ?
    - tuxxy 7y ago
      In most situations, yes. Like I said there are methods and exceptions, but it's complex to get into.
  - dustfinger 7y ago
    Thanks for your explanation. When I read [1]: > A cryptosystem that supports arbitrary computation on ciphertexts is known as fully homomorphic encryption (FHE). Such a scheme enables the construction of programs for any desirable functionality, which can be run on encrypted inputs to produce an encryption of the result I thought that meant the program itself could be fully encrypted, but after a second look it seems that it is just the inputs that are encrypted. Still, other areas of the wiki talk about support for boolean gates and even arbitrary gates. I don't know what to think, but it is motivating me to revisit coding theory :-) [1] https://en.m.wikipedia.org/wiki/Homomorphic_encryption#Fully_Homomorphic_Encryption https://en.m.wikipedia.org/wiki/Homomorphic_encryption#Fully...
deleted 7y ago
[deleted]

106 points by azujus 7y ago

rch 7y ago

I've run into a few people working on this over the last five years or so, but they've been a bit cagey about discussing their use cases and customers. Any public applications outside of blockchain?

Iv 7y ago
Online voting. That's the big one.
rhindi 7y ago
There are as many usecases as there is sensitive data! Some of the obvious ones are automated medical diagnosis, genomics, biometric authentication, fraud detection, etc. What has prevented those usecases from happening at scale is the performance of homomorphic schemes
throwawaywego 7y ago
Cloud Computing. Use the compute from a big company, without that company possibly knowing what they are computing on. Machine Learning. Apply neural networks to encrypted data and avoid privacy issues.
motohagiography 7y ago
When I encountered FHE as a potential solution, it was in designing authentication and payment tokens. Use case was you need to be able to verify that the output of a program was also a proof of the integrity of that program. E.g. I receive a payment token from you, and I can verify that this token was produced by a program I could verify as being the "real," program, personalized to your identity, on a device also personalized to your identity, that you physically hold and verify yourself to. Pretty good* with a chip/pin combination, but on a mobile general purpose computer with lots of other code on it, Hard problem. With some handwaving, FHE would ostensibly have enabled the secure personalization of the program and the signing of those token outputs. It was a variation on: https://en.wikipedia.org/wiki/Direct_Anonymous_Attestation https://en.wikipedia.org/wiki/Direct_Anonymous_Attestation as well. FHE was the DRM holy grail where suddenly you can "tokenize," information. Other applications are in selling and metering software use. In the case of health information, the ability to open up data sets to researchers to query and analyze without the risk of losing control of the data is huge. We know that de-identification of data is (information theoretically) impossible, but an ideal FHE scheme would facilitate queries against data that would mitigate much of the risk associated with it. The other use case is in highly regulated environments where there are legal firewalls between lines of business. Basically wherever there is a use case for de-identification, FHE is a potential solution in that domain. In that regulatory case, it's sort of ironic that it's a solution for, "ok, we won't commit a crime, but we need the hypothetical output of that crime, so let's use cryptography to facilitate that outcome without explicitly breaking the law whose effect is to prevent this outcome." Perhaps that's why people working in it seem so cagey.

Iv 7y ago

Seriously one of the most important area of mathematics for democracies in an online world. Homomorphic encryption promises a hidden and verifiable online voting system that does not rely on trusting third party.

solidasparagus 7y ago
How does computation on encrypted data relate to voting systems?
- jl2718 7y ago
  It’s possible that OP meant multiparty computation.
- gnarula94 7y ago
  Homomorphic encryption would allow tallying the ballots without decrypting them. Helios [1], for instance uses an homomorphic scheme. There are alternatives to it though which preserve voter privacy but allow vote tallying. Shuffling is one of them. Cothority [2] implements an e-voting scheme based on Neff Shuffles 1. https://heliosvoting.org/ https://heliosvoting.org/ 2. https://github.com/dedis/cothority/tree/master/evoting https://github.com/dedis/cothority/tree/master/evoting P.S. I contributed to the latter
rfugger 7y ago
Any political voting system will need a trusted third party to run the voter registration/identity system, so I doubt the lack of practical homomorphic encryption is blocking this. There are other voter-verifiable systems that don't rely on HE for trustworthy counting: https://www.chaum.com/publications/AccessibleVoterVerifiability.pdf https://www.chaum.com/publications/AccessibleVoterVerifiabil... The major problem with online voting is that people can be coerced into voting against their wishes outside the watchful eye of election authorities. This may be worth the increase in voting ease, but it's where the real debate is.
- dark_glass 7y ago

doctorpangloss 7y ago

The technology for all this progress was a huge discovery in 2009. But what if it is a dead end, that nothing originating from that discovery will ever be practical? Like wouldn't it be preposterous if someone said, "Here Craig Gentry, take $1 billion to run enough computers for the current FHE schemes. What is the snazziest demo you can run?"

rhindi 7y ago
Some of the newer schemes are much faster. The recent progress feels like deep learning in 2010, right before everyone realized it worked
- poz 7y ago
  > The recent progress feels like deep learning in 2010, right before everyone realized it worked Does it work, though?
  - throwawaywego 7y ago
    https://www.microsoft.com/en-us/research/publication/cryptonets-applying-neural-networks-to-encrypted-data-with-high-throughput-and-accuracy/ https://www.microsoft.com/en-us/research/publication/crypton... (2016) > We demonstrate CryptoNets on the MNIST optical character recognition tasks. CryptoNets achieve 99% accuracy and can make more than 51000 predictions per hour on a single PC. Therefore, they allow high throughput, accurate, and private predictions.
  - rhindi 7y ago
    It’s starting to, yes, in particular for machine learning. There is a yearly competition called iDash where people show the performances of their homomorphic schemes. This year should be very interesting
rhacker 7y ago
If they keep that name it will be a dead end.
7y ago

crdrost 7y ago

To address the inevitable “what is this useful for” questions, my go-to example is cryptographic voting mechanisms. The idea is that you segment a large integer into a couple of different bins by its bitwise representation. So you have a 60-bit integer and you segment it into four 15-bit bins. You use one of those to randomize what the encrypted versions are going to be, and you use the other three for different vote tallies of three candidates for some office. You can then hand people three numbers each corresponding to a different candidate, and ask them to commit to one as their vote. Public authorities can then aggregate votes which they cannot actually see, and we don't decrypt until we get to some large enough context where your vote has been anonymized among ten thousand others, and you can check that the random seeds have been properly added, or other such things. This also allows you to create a big online database where anybody can see their vote was counted, but nobody can figure out who someone else voted for. There is a slight difficulty in that you cannot see directly what your numbers are actually voting for, so that the machines you are using to vote with need to be able to decrypt a ballot for you and then immediately destroy it, to verify that it was what you thought it was, so that you can trust that your three numbers do not all happen to vote for the same person because if someone tried that on any scale that could affect an election, even if they only poison 1% of ballots in a 500 person district, if everyone burns one to test the system then the fraud gets discovered at least once with 99.3% certainty. But the point is that all of these other issues can be handled “out-of-band” once you protect the important stuff.

compsciphd 7y ago
I'd think there's a simpler way to accomplish what you said above (though in both cases, any voting mechanism that lets the voter verify their vote after the fact also runs into the problem of people complaining about encouraging vote buying). i.e. imagine every polling place would output to you (after you voted) a random number in the 128 bit space. the votes are recorded with this random number. we can verify after polls closed that the voting machine has an appropriate number of votes (i.e. not more or less than people who came through the booths) all these vote data is aggregated into public record. you can look up after the fact your random number and see that it matched who you voted for. No encryption needed (beyond the technology that goes into making a secure rng)

ktta 7y ago

A very casual (layman's?) introduction intro to Homomorphic Encryption - https://news.ycombinator.com/item?id=13450015 https://news.ycombinator.com/item?id=13450015

KenoFischer 7y ago

There is a decent size effort to build a system that runs (a restricted, but hopefully useful subset of) Julia programs fully homomorphically (as well as supporting various sort of secure multiparty computation protocols). At JuliaCon two years ago, the Galois folks talked about their initial prototype of this work: https://www.youtube.com/watch?v=_KLlMg6jKQg https://www.youtube.com/watch?v=_KLlMg6jKQg (fun to watch even if you don't care about julia to see FHE "in action"). This effort was recently funded with the goal of extending the prototype into a full robust system, so I'm hoping for some good news here over the next couple of years.

Nightshaxx 7y ago

My school is working on this right now. Seriously awesome.

buzzdenver 7y ago

For a layman like me it sounds really cool, almost like magic. Consider a trivial operation like finding a maximum value in a list. How is that supposed to work on encrypted values while simultaneously providing strong encryption? So something like adding N to everything in the list is not an acceptable encryption.

tonmoy 7y ago
Today is the first time I heard of Homomorphic Encryption so I have 0 knowledge about this. But just to show this is not magic, you can provide N*N number of lists where each list has totally different results and then get the max index for each list as a return. Since you know what original list was the right one, you can keep that result and discard rest
- buzzdenver 7y ago
  Not sure I'm following you. Would you transmit in plain text N-1 random lists along with the real one? I would not consider that encryption. I guess one brute force way to do it is making encryption unnecessary. For an input of N bits, have the results calculated/returned for all 2^N possibilities. Does not sound very practical.
jayavanth 7y ago
You can do polynomial approximation to get a compatible function
MrQuincle 7y ago
Just like a Laplace transform maps differential equations into algebraic equations and convolution into multiplication - or Fourier for that matter - it's not so hard to imagine that there are encryption maps (that are hard to invert) but where something like a sum operation becomes a feasible operation in the encrypted domain. A max operation can similarly have an equivalent operation in the encrypted space. I guess your concern is that the output is "one of the encrypted input" values and hence identified, although not decrypted. Subsequently, all the input values would be fed into the "max" module and their complete order can be determined by the one running the homeomorphic server. In that case we will need to have an output where all inputs are returned. Perhaps a map with indices and values (all encrypted) as input and as output would be sufficient.

amelius 7y ago

Are these schemes theoretically resistant against quantum computing?

rhindi 7y ago
Yes, all the fully homomorphic schemes are lattice based and thus thought to be quantum resistant

sungju1203 7y ago

I was like WTF is "homophobic encryption" lol

tuxxy 7y ago

If anyone is interested in playing with Fully Homomorphic Encryption, we (NuCypher YC S16) built NuFHE (https://github.com/nucypher/nufhe/ https://github.com/nucypher/nufhe/). It's written in Python and has excellent documentation, so you can try building some circuits and playing around with it. It requires a GPU to run, but it's also the fastest implementation of FHE in the world (that I know of). Let me know what you think! :)

Labo333 7y ago
Is there some kind of interoperability with other libraries? Or does it support CPU encryption / decryption ? For example, one can expect clouds to have GPUs to perform computations but encryption and decryption are typically done by clients on various devices where portable code is expected.
- tuxxy 7y ago
  This is mostly a research library, so we haven't put our limited effort into CPU operations yet, but it's definitely possible if someone wanted to take the time to expose it in the library.

wish5031 7y ago

If this interests you, a related concept with similar applications as HE is functional encryption: https://en.m.wikipedia.org/wiki/Functional_encryption https://en.m.wikipedia.org/wiki/Functional_encryption

rudolph9 7y ago
Here is a descent looking Haskell library that implements functional encryption concepts https://github.com/cpeikert/Lol https://github.com/cpeikert/Lol

bikeshaving 7y ago

Why do people always talk about arbitrary computation in relation to homomorphic encryption? What I really want is a homomorphic encryption system which allows me to arbitrarily slice and concatenate strings without knowing their contents. This would be immensely useful for implementing end-to-end encrypted collaborative editing of documents. Is homomorphic encryption there yet?

kradroy 7y ago
I'm dying for this. My team builds ML models on text corpora. Most of this data is sensitive. My company has very strict data privacy policies and it's a pain to even share the data with other teams in the department. I've made it part of my long-term goals to facilitate secure sharing of sensitive data across the organization. Numerical data seems to be the easiest to anonymize (randomized response, etc), but I have yet to find any techniques for text other than generating synthetic data.
- tuxxy 7y ago
  Hi, I've been replying to other people in this thread. I work at NuCypher doing some research and cryptography engineering. I work on Proxy Re-Encryption and Fully Homomorphic Encryption. Do you mind sending me an email with your use case and needs? I'd love to have a chat with you. john@nucypher.com
  - drenvuk 7y ago
    This guy right here, this guy knows whats up. gl john.
tuxxy 7y ago
You can do this with a TFHE implementation, if I understand your use case correcltly. You encrypt bits and then you can operate/manipulate on those individual encrypted bits. I referenced NuFHE in a comment, but you should give it a try and see if it will do what you're wanting. See https://github.com/nucypher/nufhe/ https://github.com/nucypher/nufhe/. We also have a discord channel where you can ask questions on using it in the #nufhe channel -- https://discord.gg/rmSafk https://discord.gg/rmSafk

dustfinger 7y ago

Could a fully homomorphic cpu architecture with fully encrypted cache be immune to Spectre and similar side channel attacks? Could this be tested on an FPGA?

tuxxy 7y ago
Unfortunately, FHE doesn't work this way. You're operating on encrypted data, so performing some branched operations doesn't work due to the security (IND-CPA) security. IE: You have a value that you need to do `if <condition> then <statement> else <other statement>` Problematically, if that condition could work, then it would violate the confidentiality of the encrypted value, thus breaking the CPA security. Now there are some workarounds and methods to getting around this problem sometimes, but in many cases it's not possible.
- ay 7y ago
  So any unit of work in the FHE scenario is necessarily a basic block with no branching ?
  - tuxxy 7y ago
    In most situations, yes. Like I said there are methods and exceptions, but it's complex to get into.
- dustfinger 7y ago
  Thanks for your explanation. When I read [1]: > A cryptosystem that supports arbitrary computation on ciphertexts is known as fully homomorphic encryption (FHE). Such a scheme enables the construction of programs for any desirable functionality, which can be run on encrypted inputs to produce an encryption of the result I thought that meant the program itself could be fully encrypted, but after a second look it seems that it is just the inputs that are encrypted. Still, other areas of the wiki talk about support for boolean gates and even arbitrary gates. I don't know what to think, but it is motivating me to revisit coding theory :-) [1] https://en.m.wikipedia.org/wiki/Homomorphic_encryption#Fully_Homomorphic_Encryption https://en.m.wikipedia.org/wiki/Homomorphic_encryption#Fully...

deleted 7y ago

[deleted]