15 ms·
IBM completes successful field trials on Fully Homomorphic Encryption
- unstatusthequo 6y agoJust in time for the EARN IT Act. :P
- suizi 6y agoEven if it worked, I wouldn't want the government scanning through data for whatever they decided was subversive or suspicious through undefined filters and unaccountable agencies.
- sebmellen 6y agoI found the comment at the bottom of the page from the "Ibmresearch" user helpful in understanding FHE. To quote his TLDR: > TLDR Huge polynomials are what are operated on instead of plaintext values by hiding the real data in the polynomials with intentional noise to make it infeasible to extract the real data without the decryption key that knows how to remove it. All operators are bootstrapped from addition and multiplication and elegant modulus trickery. Noise is managed at each operation because the noise compounds with every logic operation you do. The result of an operation chain or circuit be it one operation or infinitely many, therefore, has some noise but can be decrypted by the person with the encryption key. The decryption effectively drops all the noise and hones in on the bits that matter. The person doing the computation is doing a lot of adds and multiplies on big polynomials so they cant understand what you are really trying to do.
- skissane 6y ago> Above, we can see charts indicating the additional compute power and memory resources required to operate on FHE-encrypted machine-learning models—roughly 40 to 50 times the compute and 10 to 20 times the RAM that would be required to do the same work on unencrypted models Are those multiplicative factors specific to machine learning tasks, or is it the same for general purpose computation? In other words, is there something about the structure of machine learning tasks which makes them more suited for FHE than other computing tasks?
- mebr 6y agoRe your last question, I don't think so. It's just an attractive application, hidding neural network weights is valuable in some settings, for instance.
- pgo 6y agoIts less about structure and more about use cases. In my opinion there are only two major uses of data collection by organizations - Machine learning training data and targeted advertisements. A federated fully homomorphic system will allow these companies to train their models without invading personal privacy. It will also allow organizations to train models collaboratively in a privacy preserving way, which if you think about it has lot of consequences.
- rocqua 6y agoset intersection is a big one. If you want to share data on common customers, without revealing who your unique customers are, you need set intersection.
- dodobirdlord 6y ago> In other words, is there something about the structure of machine learning tasks which makes them more suited for FHE than other computing tasks? Yes, FHE is not (currently) good at general-purpose computing. Complex conditional logic for example is a non-starter because every branch has to be evaluated. But tensor multiplication is well supported with existing FHE schemes, and many kinds of machine learning tasks consist of non-conditional tensor multiplications.
- skissane 6y ago> Complex conditional logic for example is a non-starter because every branch has to be evaluated Is overcoming this limitation of FHE anywhere on the horizon?
- dodobirdlord 6y ago
- bfuclusion 6y agoSomeone please correct me if I'm wrong, wouldn't this still be vulnerable to side channel or pattern analysis attacks? Also, how can all operations on a DB like projection, and equality be represented by addition and multiplication? Are we in the peano arithmetic space here? Can somebody break it down from me?
- kmeisthax 6y agoYou answered your own question accidentally: side-channel attacks are not possible in this model of computation because everything is represented as addition and multiplication. The homomorphic ciphertext doesn't tell you when it's done, you sort of just do all the operations you're told and hand back the answer gaining no knowledge about the computation you just did. That's not to say that a badly-designed usage of homomorphic computation can't introduce a timing channel, though. If there's a point in time where the result is handed back to the client, they inspect it, and then conditionally send more computations, you might be able to infer something with either the client's timing or if they happened to send back more computations or not. However, that assumes that we'd be able to trace multiple API requests associated with the same data set (as opposed to unrelated computations), and that we know enough about the computations we're being told to do to infer a timing channel from them. That's why I use the qualifying term "badly-designed", which in practice will probably be most uses of this technology.
- bfuclusion 6y agoSo basically I tell you to do a bunch of stuff and give it back, and you have no idea if the computation is a partial application/full application etc. Neat. Next question: if my previous statement is correct it seems that it may push a lot of the work back onto the client, otherwise I don't get how a server couldn't figure out relationships from access patterns on blocks. This would limit the utility of the server right?
- dodobirdlord 6y agoYea, fully homomorphic querying of a database necessarily requires reading all of the data, or you could glean information from the access pattern.
- ackbar03 6y agoThe extra computational power requirement is still pretty large... The math behind it doesn't seem to be anything new, there's a reason why these solutions aren't very commonplace yet
- RcouF1uZ4gsC 6y ago> roughly 40 to 50 times the compute and 10 to 20 times the RAM that would be required to do the same work on unencrypted models Too bad Moore's Law is dead, otherwise it would have been possible to run everything we run now in 10-12 years using Fully Homomorphic Encryption for the same cost!
- bawolff 6y ago40 to 50 times is still orders of magnitude greater than FHE used to be. If we keep up the trend (big if) this is actually quite promising
- unnouinceput 6y agoEvery year the number of people saying Moore's Law is dead doubles!
- giomasce 6y agoTo me the practical problem with FHE is that, if it costs 20 times doing the equivalent non-encrypted computations, it is cheaper to do it on your premises rather than rent 20x the same computational power from a cloud host, unless the cloud host is able to provide computational power at 1/20 of the cost it has for you (which seems too much to me).
- giomasce 6y agoThe comment by "Ibmresearcher" says that: > Once one can do multiplication and addition all other operations can be bootstrapped from there so you can indeed do anything a Turing complete computer can do. This is apparently iterated on many articles about FHE, but it seems false to me: to do Turing-complete stuff you also need comparisons, and the ability to change your flow depending on comparisons. But clearly you cannot do that with FHE, otherwise you could extract the encrypted content, one bit at a time. My understanding is that an FHE computer can only execute a fixed net of additions and multiplications (or whatever operations they've got). So you can emulate an "if" clause by computing both branches and then selecting one of the two multiplying by 0 and 1 appropriately; you can do bounded "for" loops always executing the maximal number of times, but you can't do unbounded loops, therefore bye bye Turing completeness. Of course there are a lot of interesting algorithms that can be executed without being Turing complete, but the general statement is false. Am I missing anything?
- _trampeltier 6y agoCode might finaly look like with movfuscator (MOV on a intel processor is also turing complete).
- giomasce 6y agoNo, it can't. FHE cannot emulate the whole MOV, especially the features that make it Turing-complete.
- jchw 6y agoThe reason why Intel mov is so powerful is because the mnemonic actually maps to tons of different things. In particular conditionals are accomplished using indirect memory accesses.
- SilasX 6y agoMovfuscator only works because x86's MOV is like the Swiss Army knife of move instructions. It doesn't just copy bits from one location to another, but has parameters for conditionality and arithmetic, which is what allows it to be so general. That still doesn't address the parent's confusion (that I share) of how you get Turing-completeness just from addition and multiplication.
- forty 6y ago> With SEV enabled, an operator who has root privilege on a host system can't inspect or meaningfully alter the contents of RAM in use by a virtual machine running on that system. Is that true? I would like to know more on what kind of garanties SEV gives / how it works high level, any resources you can recommend? I assume that at least when the VM is being launched, the sysadmin can mess up with the VM?
- hannob 6y agoIt is true if you assume SEV has no sidechannel vulnerabilities and that noone can uncap your CPU and read out the cryptographic material with an electron microscope. Which both are probably untrue assumptions :-)
- yalogin 6y agoIs there a recent breakthrough in FHE? The last I checked its no where near practical.
- vbezhenar 6y agoIMO a more practical approach would be to use ordinary encryption inside a CPU, so it wouldn't be possible to extract any data without extremely advanced methods. Rough description: CPU have secure memory which contains a private key. Also CPU have certificate with corresponding public key. That certificate is signed by Intel. Hosting provider publishes an API which allows remote user to communicate with that secure CPU, basically just transmitting encrypted stream to and from CPU. When you're starting your communication, you establish an encrypted link between your machine and target CPU, located in a data center. You can check authenticity of that CPU by checking certificate signature. Then you're sending any code you would like to execute (encrypted by session key). CPU executes that code. It encrypts RAM in process, so it's not possible to read its contents. And sends back some information (again, encrypted) which you're interested in. So you have computing resources which are protected from anyone except very few who could extract private key from secure chip. I think that this kind of protection should be enough for many uses. And it would not compromise on performance. The only real world issue would be side channel attacks.
- milkey_mouse 6y agoYou're essentially describing AMD's SEV[1] as mentioned in the article. It piggybacks on the memory encryption implemented in the Zen architecture by giving a separate key for each VM. Ostensibly, the host can't interfere or snoop in the VMs, assuming you trust AMD. I'm surprised it hasn't been more widely adopted. > protected from anyone except very few who could extract private key from secure chip The way I understand chip manufacturing it would be hard to diffuse a separate key into each chip. This means it'd only take one of those very few people to extract and leak the key (or cut out the middleman and leak it from inside AMD) to break it for everyone. > The only real world issue would be side channel attacks. This is probably a much bigger problem in practice. Spectre & related attacks have been effective against Intel SGX[2], another "trusted environment" inside a larger system. [1]: https://developer.amd.com/sev/ https://developer.amd.com/sev/ [2]: https://arstechnica.com/gadgets/2018/08/intels-sgx-blown-wide-open-by-you-guessed-it-a-speculative-execution-attack/ https://arstechnica.com/gadgets/2018/08/intels-sgx-blown-wid...
- 6y ago
- datafatmunger 6y agoI think this is exciting stuff. We're actively building prototypes around FHE concepts. Basically asking the question: "Can we make meaningful care and hospitality predictions, without ever seeing sensitive data?" We've banged out some stuff with HElib, and some other interesting implementations, but are just beginning. And we're hiring for both backend and data science positions. :) jobs@theembassies.com
- gumby 6y agoBut how much slower? At what cost?
- jellyksong 6y agoThe article claims that oblivious query, set intersection, and machine learning on private data are not possible without FHE. However, aren't they all possible either with secure MPC or hardware based enclaves e.g. AMD SEV?
- bollu 6y agoHow does secure multiparty give access to obliviousness?
- jellyksong 6y agoI was thinking MPC might work for set intersection. For oblivious query, can't you do it by sending the query directly into the remote trusted execution environment, encrypted with the TEE's public key?
- Taek 6y agoI would argue that secure enclaves do not exist in practice. You have to assume a physical device where the private key cannot be extracted and the operation cannot be observed. The threat model is much weaker than for FHE, and imo not really useful for operating in large sets of private data. MPC introduces a trust assumption. MPC is only private if some threshold of the multiple parties are honest and destroy their secrets. Though often this threshold is just one, efficient MPC often only has 3 participants total. FHE gives you a better security model than either of these, as it neither relies on physics for safety nor needs to assume any level of honesty from the person running the computation.
- Ar-Curunir 6y agoIn many MPC schemes you only need to trust yourself; as long as you keep your stuff private, nobody can learn the MPC secrets
- nullc 6y agoFHE is also not obfuscation -- you can't just decrypt the output. Makes it a lot less useful than people usually imagine.
- Jabbles 6y agoBut just 2 months ago there was an article on HN that stated: The database is a key value store prepopulated with the english names of countries and their capital cities from the continent of Europe. Selecting the country will perform a search of the matching capital. On a 2019 Macbook Pro laptop, the example searches take under 80 seconds. https://news.ycombinator.com/item?id=23435305 https://news.ycombinator.com/item?id=23435305 And today this article claims only a 40x compute cost for "machine learning"? What is the cause of the disparity?
- miohtama 6y agoMy layman guess is that the FME penalty goes up exponentially to the complexity of an operation.
- SahAssar 6y agoDoing a exact string match on 200-ish rows in 80 seconds on a modern computer is so inefficient that I have a hard time seeing any less complex but useful operations whatsoever. Perhaps I'm just not clever enough, but for now homomorphic encryption seems like it isn't useful for common, real world usecases to me.
- Ar-Curunir 6y agoThis isn’t true, it’s just that different kinds of operations are more or less efficient in FHE
- Ar-Curunir 6y agoI think the 40x overhead is a case of comparing throughput overhead (from what I know, FHE based secure inference protocols have poor latency, but can process many predictions in parallel, improving throughput)
- Bloggerzune 6y agoIt was incorporated in 1911 as the Computing-Tabulating-Recording Company in a consolidation of three smaller companies that made punch-card tabulators and other office products. The company assumed its present name in 1924 under the leadership of Thomas Watson, a man of considerable marketing skill who became general manager in 1914 and had gained complete control of the firm by 1924. Watson built the then-floundering company into the leading American manufacturer of punch-card tabulating systems used by governments and private businesses. He also developed a highly disciplined and competitive sales force that adapted the company’s custom-built tabulating systems to the needs of particular customers.https://www.bloggerzune.com/2020/06/whatsapp-web-scan.html?m=1 https://www.bloggerzune.com/2020/06/whatsapp-web-scan.html?m...
- blamestross 6y agoReminder, FHE not being Turing complete isn't important. Every computer ever built has a finite memory and isn't technically Turing complete.
- cs702 6y agoFully homomorphic encryption (FHE) looks to me like the WET DREAM of every business that wants to control the software and content on your hardware without ever having to decrypt sensitive code or data residing on that hardware. That's because FHE-encrypted software is locally unhackable as long as its implementation of FHE remains unbroken. Think: * FHE-encrypted mobile operating systems, applications, and data. * FHE-encrypted desktop and server operating systems, applications, and data. * FHE-encrypted "smart home" devices -- from light bulbs to dishwashers to fridges. * FHE-encrypted transportation infrastructure -- from automobiles to trains to airplanes. * FHE-encrypted industrial machinery of all kinds. If FHE ever becomes practical, we're looking at a very unhackable future. Remarkably, I've never seen this issue mentioned anywhere else before.
- dplgk 6y agoHow does that work? If the business can control it, then it's hackable.
- tyingq 6y agoI read it as "locally unhackable". Any hack would have to hit the mother ship.
- cs702 6y agoYes, exactly. FYI, I added the word "locally" to my parent comment above to make the meaning clearer.
- worewood 6y agoAs I understand it, in order to interface with a FH-encrypted software the data needs to be encrypted too. So every input needs to be sent to the mothership, encrypted there, downloaded, then computed locally, then the output is sent to the mothership, decrypted, then downloaded to present the results to the user -- which is no different than just doing the computation "in the cloud", which already is a thing. So I don't see how it brings anything new to the table. Unless the key is kept locally, which would be hackable.
- mindhash 6y agoIf this works, see a huge impact on federated learning or training of NNs in general
- bookofjoe 6y agohttps://eprint.iacr.org/2019/1113 https://eprint.iacr.org/2019/1113
- sabujp 6y agothis still isn't making sense to me, is there a simple math example of how this is even possible if encrypt(1) = a, then how can encrypt(1) + 2 ever give me the correct answer?
- wbhart 6y agoYou need encrypt(1) + encrypt(2). You would not be sent instructions to add 2. No information about what you are doing is sent, except the operations + and x. As the comments in the article state, it's actually all done with operations on polynomials with encrypted coefficients. As + and x can be done on polynomials, it all works out. The maths behind it is of course much more complicated. As for a simple maths analogy, consider adding 1 + 2. I'll encrypt your values by multiplying by 3 mod 7. So encrypt(1) = 3x1 mod 7 = 3 mod 7 and encrypt(2) = 3*2 mod 7 = 6 mod 7. Only the encrypted values are sent, along with the operations I want to perform on the values. Now this scheme is homomorphic, as I can just add the encrypted values, encrypt(1) + encrypt(2) = 3 + 6 mod 7 = 2 mod 7. That is the only computation that would be done before sending back the result. To decrypt it, I would have to divide by 2 mod 7 by 3, which gives me 3 (you can easily check that encrypt(3) = 2 mod 7). And indeed 1 + 2 = 3. So the decrypted answer is correct. Of course this scheme is too easy to crack. The FHE scheme is not.
- Ling_hk 6y agoIt’s my first day in Hacker News with this unhackable news.
- totetsu 6y agoIs anyone working on this for contact tracing? if encrypt( my_long_lat, PK ) - encrypt( your_long_lat, PK ) <= 5m; raise_alarm