3 ms·

If you can infer information from encrypted data then it's not properly encrypted. Generally you would use a salt that would render this type of analyses useles

If you can infer information from encrypted data then it's not properly encrypted. Generally you would use a salt that would render this type of analyses useless.

theschwa 7y ago
The person who runs the model won’t be able to infer anything. The result of the model is itself encrypted, and would need to be decrypted using the original encryption key.
- garganzol 7y ago
  >would need to be decrypted using the original encryption key A small correction. Decryption is performed with a decryption (private) key which is kept in secret and only known to the data owner. In contast, encryption key is public and known to both data owner and "the person who runs the model".
LeanderK 7y ago
Maybe i misunderstood something, but they are not really inferring information. The model is still encrypted, the outsider doesn't know what's going on. Wouldn't salt destroy the homomorphic property?
- brenden2 7y ago
  Homomorphic encryption is malleable[1] in that it can, with enough information, be decrypted without knowing the private keys in some cases. For example, if you can correlate with other data it may be possible to effectively undo the encryption. This is more like anonymization (effectively a one-way hash) than encryption. If you encrypt 2 different values with the same algorithm and key, you will get the same ciphertext which reveals information about the original value (i.e., that they are the same). [1]: https://en.wikipedia.org/wiki/Malleability_(cryptography) https://en.wikipedia.org/wiki/Malleability_(cryptography)
  - ummonk 7y ago
    There is no reason to reuse the same key though...
    - brenden2 7y ago
      If you used a different key for each datum then you wouldn't be able to do this type of analyses. This analyses depends on the property of the same values producing the same ciphertext, which also mean you're leaking information.
      - ummonk 7y ago
        No it doesn’t. The model is trained on unencrypted data. It is then run on encrypted data sent by the client to generate an encrypted classification. The client then uses its decryption key to decrypt the encrypted classification. This process is possible because the model is built to commute with encryption.
  - quinquice 7y ago
    I believe that most HE algorithms (CKKS included) use some random noise, which means you cant infer equality. It's still "malleable", but not to the extent that you assert.
  - osaariki 7y ago
    This is wholly untrue. The guarantees HE gives for security of encrypted data is exactly the same as any traditional symmetric or asymmetric crypto system. HE is indeed malleable by design, but doing computation on homomorphically encrypted data gives no information on the contents of the ciphertexts. >This is more like anonymization (effectively a one-way hash) than encryption. If you encrypt 2 different values with the same algorithm and key, you will get the same ciphertext which reveals information about the original value (i.e., that they are the same). This is a misunderstanding. Homomorphic encryption schemes are randomized encryptions schemes, which means even if you encrypt the same value twice with the same encryption key you get two different ciphertexts (both look like "random data"). They just have the property that they will decrypt to the same value. This is possible because the space of ciphertexts is much larger than the space of plaintexts.
- garganzol 7y ago
  >Wouldn't salt destroy the homomorphic property? It depends on how salt is applied. If it is concatenated, the homomorphic property persists. To really destroy it, you would need to mix it up. But then you would lose the malleability, and all that would remain is an equivalence operation from the ring, but not + or *. This still can be useful for some tasks, but not for encrypted calculations or ML.
deleted 7y ago
[deleted]

If you can infer information from encrypted data then it's not properly encrypted. Generally you would use a salt that would render this type of analyses useless.

theschwa 7y ago

The person who runs the model won’t be able to infer anything. The result of the model is itself encrypted, and would need to be decrypted using the original encryption key.

garganzol 7y ago
>would need to be decrypted using the original encryption key A small correction. Decryption is performed with a decryption (private) key which is kept in secret and only known to the data owner. In contast, encryption key is public and known to both data owner and "the person who runs the model".

LeanderK 7y ago

Maybe i misunderstood something, but they are not really inferring information. The model is still encrypted, the outsider doesn't know what's going on. Wouldn't salt destroy the homomorphic property?

brenden2 7y ago
Homomorphic encryption is malleable[1] in that it can, with enough information, be decrypted without knowing the private keys in some cases. For example, if you can correlate with other data it may be possible to effectively undo the encryption. This is more like anonymization (effectively a one-way hash) than encryption. If you encrypt 2 different values with the same algorithm and key, you will get the same ciphertext which reveals information about the original value (i.e., that they are the same). [1]: https://en.wikipedia.org/wiki/Malleability_(cryptography) https://en.wikipedia.org/wiki/Malleability_(cryptography)
- ummonk 7y ago
  There is no reason to reuse the same key though...
  - brenden2 7y ago
    If you used a different key for each datum then you wouldn't be able to do this type of analyses. This analyses depends on the property of the same values producing the same ciphertext, which also mean you're leaking information.
    - ummonk 7y ago
      No it doesn’t. The model is trained on unencrypted data. It is then run on encrypted data sent by the client to generate an encrypted classification. The client then uses its decryption key to decrypt the encrypted classification. This process is possible because the model is built to commute with encryption.
- quinquice 7y ago
  I believe that most HE algorithms (CKKS included) use some random noise, which means you cant infer equality. It's still "malleable", but not to the extent that you assert.
- osaariki 7y ago
  This is wholly untrue. The guarantees HE gives for security of encrypted data is exactly the same as any traditional symmetric or asymmetric crypto system. HE is indeed malleable by design, but doing computation on homomorphically encrypted data gives no information on the contents of the ciphertexts. >This is more like anonymization (effectively a one-way hash) than encryption. If you encrypt 2 different values with the same algorithm and key, you will get the same ciphertext which reveals information about the original value (i.e., that they are the same). This is a misunderstanding. Homomorphic encryption schemes are randomized encryptions schemes, which means even if you encrypt the same value twice with the same encryption key you get two different ciphertexts (both look like "random data"). They just have the property that they will decrypt to the same value. This is possible because the space of ciphertexts is much larger than the space of plaintexts.
garganzol 7y ago
>Wouldn't salt destroy the homomorphic property? It depends on how salt is applied. If it is concatenated, the homomorphic property persists. To really destroy it, you would need to mix it up. But then you would lose the malleability, and all that would remain is an equivalence operation from the ring, but not + or *. This still can be useful for some tasks, but not for encrypted calculations or ML.

deleted 7y ago

[deleted]