5 ms·

You answered your own question accidentally: side-channel attacks are not possible in this model of computation because everything is represented as addition an

You answered your own question accidentally: side-channel attacks are not possible in this model of computation because everything is represented as addition and multiplication. The homomorphic ciphertext doesn't tell you when it's done, you sort of just do all the operations you're told and hand back the answer gaining no knowledge about the computation you just did. That's not to say that a badly-designed usage of homomorphic computation can't introduce a timing channel, though. If there's a point in time where the result is handed back to the client, they inspect it, and then conditionally send more computations, you might be able to infer something with either the client's timing or if they happened to send back more computations or not. However, that assumes that we'd be able to trace multiple API requests associated with the same data set (as opposed to unrelated computations), and that we know enough about the computations we're being told to do to infer a timing channel from them. That's why I use the qualifying term "badly-designed", which in practice will probably be most uses of this technology.

bfuclusion 6y ago
So basically I tell you to do a bunch of stuff and give it back, and you have no idea if the computation is a partial application/full application etc. Neat. Next question: if my previous statement is correct it seems that it may push a lot of the work back onto the client, otherwise I don't get how a server couldn't figure out relationships from access patterns on blocks. This would limit the utility of the server right?
- dodobirdlord 6y ago
  Yea, fully homomorphic querying of a database necessarily requires reading all of the data, or you could glean information from the access pattern.
  - josh2600 6y ago
    You can get a lot of the benefit of a linear scan using a technique like oblivious RAM but I’m not convinced it’s possible to build such a system without using a Secure Enclave. There are some papers that purport to implement this but once you’re dancing in the realm of Secure Enclave’s you’re out on a different limb. I don’t think it’s possible for a circuit to operate over a large set quickly and use a fully homomorphic pure software design.
    - Ar-Curunir 6y ago
      With some minor interaction between client and server, you can use ORAM in conjunction with FHE to enable sub linear database scans. It’s not practical for deployments, but is probably feasible for implementations
      - josh2600 6y ago
        I’m not convinced you can do ORAM without a Secure Enclave. If you’re already using an enclave, you don’t need FHE.

bfuclusion 6y ago

So basically I tell you to do a bunch of stuff and give it back, and you have no idea if the computation is a partial application/full application etc. Neat. Next question: if my previous statement is correct it seems that it may push a lot of the work back onto the client, otherwise I don't get how a server couldn't figure out relationships from access patterns on blocks. This would limit the utility of the server right?

dodobirdlord 6y ago
Yea, fully homomorphic querying of a database necessarily requires reading all of the data, or you could glean information from the access pattern.
- josh2600 6y ago
  You can get a lot of the benefit of a linear scan using a technique like oblivious RAM but I’m not convinced it’s possible to build such a system without using a Secure Enclave. There are some papers that purport to implement this but once you’re dancing in the realm of Secure Enclave’s you’re out on a different limb. I don’t think it’s possible for a circuit to operate over a large set quickly and use a fully homomorphic pure software design.
  - Ar-Curunir 6y ago
    With some minor interaction between client and server, you can use ORAM in conjunction with FHE to enable sub linear database scans. It’s not practical for deployments, but is probably feasible for implementations
    - josh2600 6y ago
      I’m not convinced you can do ORAM without a Secure Enclave. If you’re already using an enclave, you don’t need FHE.