5 ms·

Maybe i misunderstood something, but they are not really inferring information. The model is still encrypted, the outsider doesn't know what's going on. Wouldn'

Maybe i misunderstood something, but they are not really inferring information. The model is still encrypted, the outsider doesn't know what's going on. Wouldn't salt destroy the homomorphic property?

brenden2 7y ago
Homomorphic encryption is malleable[1] in that it can, with enough information, be decrypted without knowing the private keys in some cases. For example, if you can correlate with other data it may be possible to effectively undo the encryption. This is more like anonymization (effectively a one-way hash) than encryption. If you encrypt 2 different values with the same algorithm and key, you will get the same ciphertext which reveals information about the original value (i.e., that they are the same). [1]: https://en.wikipedia.org/wiki/Malleability_(cryptography) https://en.wikipedia.org/wiki/Malleability_(cryptography)
- ummonk 7y ago
  There is no reason to reuse the same key though...
  - brenden2 7y ago
    If you used a different key for each datum then you wouldn't be able to do this type of analyses. This analyses depends on the property of the same values producing the same ciphertext, which also mean you're leaking information.
    - ummonk 7y ago
      No it doesn’t. The model is trained on unencrypted data. It is then run on encrypted data sent by the client to generate an encrypted classification. The client then uses its decryption key to decrypt the encrypted classification. This process is possible because the model is built to commute with encryption.
- quinquice 7y ago
  I believe that most HE algorithms (CKKS included) use some random noise, which means you cant infer equality. It's still "malleable", but not to the extent that you assert.
- osaariki 7y ago
  This is wholly untrue. The guarantees HE gives for security of encrypted data is exactly the same as any traditional symmetric or asymmetric crypto system. HE is indeed malleable by design, but doing computation on homomorphically encrypted data gives no information on the contents of the ciphertexts. >This is more like anonymization (effectively a one-way hash) than encryption. If you encrypt 2 different values with the same algorithm and key, you will get the same ciphertext which reveals information about the original value (i.e., that they are the same). This is a misunderstanding. Homomorphic encryption schemes are randomized encryptions schemes, which means even if you encrypt the same value twice with the same encryption key you get two different ciphertexts (both look like "random data"). They just have the property that they will decrypt to the same value. This is possible because the space of ciphertexts is much larger than the space of plaintexts.
- garganzol 7y ago
  Homomorphic encryption is malleable. But once noise is added, there is no way to exploit malleability. The big challenge in creation of a fully homomorphic encryption scheme was to make it able to cope with added randomness. This problem remained unsolved starting from 1978 when Rivest, Shamir and Adleman noted probable possibility of such scheme up until 2008 when Craig Gentry came up with solution in his PhD thesis. Gentry's work is a fascinating read by they way. In other words, homomorphic encryption has the same security guarantees as a conventional crypto.
garganzol 7y ago
>Wouldn't salt destroy the homomorphic property? It depends on how salt is applied. If it is concatenated, the homomorphic property persists. To really destroy it, you would need to mix it up. But then you would lose the malleability, and all that would remain is an equivalence operation from the ring, but not + or *. This still can be useful for some tasks, but not for encrypted calculations or ML.

brenden2 7y ago

Homomorphic encryption is malleable[1] in that it can, with enough information, be decrypted without knowing the private keys in some cases. For example, if you can correlate with other data it may be possible to effectively undo the encryption. This is more like anonymization (effectively a one-way hash) than encryption. If you encrypt 2 different values with the same algorithm and key, you will get the same ciphertext which reveals information about the original value (i.e., that they are the same). [1]: https://en.wikipedia.org/wiki/Malleability_(cryptography) https://en.wikipedia.org/wiki/Malleability_(cryptography)

ummonk 7y ago
There is no reason to reuse the same key though...
- brenden2 7y ago
  If you used a different key for each datum then you wouldn't be able to do this type of analyses. This analyses depends on the property of the same values producing the same ciphertext, which also mean you're leaking information.
  - ummonk 7y ago
    No it doesn’t. The model is trained on unencrypted data. It is then run on encrypted data sent by the client to generate an encrypted classification. The client then uses its decryption key to decrypt the encrypted classification. This process is possible because the model is built to commute with encryption.
quinquice 7y ago
I believe that most HE algorithms (CKKS included) use some random noise, which means you cant infer equality. It's still "malleable", but not to the extent that you assert.
osaariki 7y ago
This is wholly untrue. The guarantees HE gives for security of encrypted data is exactly the same as any traditional symmetric or asymmetric crypto system. HE is indeed malleable by design, but doing computation on homomorphically encrypted data gives no information on the contents of the ciphertexts. >This is more like anonymization (effectively a one-way hash) than encryption. If you encrypt 2 different values with the same algorithm and key, you will get the same ciphertext which reveals information about the original value (i.e., that they are the same). This is a misunderstanding. Homomorphic encryption schemes are randomized encryptions schemes, which means even if you encrypt the same value twice with the same encryption key you get two different ciphertexts (both look like "random data"). They just have the property that they will decrypt to the same value. This is possible because the space of ciphertexts is much larger than the space of plaintexts.
garganzol 7y ago
Homomorphic encryption is malleable. But once noise is added, there is no way to exploit malleability. The big challenge in creation of a fully homomorphic encryption scheme was to make it able to cope with added randomness. This problem remained unsolved starting from 1978 when Rivest, Shamir and Adleman noted probable possibility of such scheme up until 2008 when Craig Gentry came up with solution in his PhD thesis. Gentry's work is a fascinating read by they way. In other words, homomorphic encryption has the same security guarantees as a conventional crypto.

garganzol 7y ago

>Wouldn't salt destroy the homomorphic property? It depends on how salt is applied. If it is concatenated, the homomorphic property persists. To really destroy it, you would need to mix it up. But then you would lose the malleability, and all that would remain is an equivalence operation from the ring, but not + or *. This still can be useful for some tasks, but not for encrypted calculations or ML.