3 ms·

The other thread we had about this stated that arbitrary math is possible, but slow as heck (40 times slower or so). You can either tell it to operate on two en

The other thread we had about this stated that arbitrary math is possible, but slow as heck (40 times slower or so). You can either tell it to operate on two encrypted items ("multiply value 2 and 4 from the data") or give either operand as-is ("add 5 to value 3 in the data"). So general-purpose, apparently. Just slow.

jstanley 6y ago
Is it really only 40 times slower? I thought it was millions of times slower. If it's only 40 times slower than a modern CPU, then this technology is a lot more interesting than I thought. From a few minutes of Googling, I can't find any obvious benchmarks.
- betterunix2 6y ago
  It depends on what you are computing. In some cases it will be as fast as the insecure version (not counting encryption/decryption time). On the other hand, random access will have to be simulated by a linear scan over an array, which is asymptotically slower. Complex control flow e.g. deeply nested loops with input-dependent side effects can cause the overhead to balloon.
- onepointsixC 6y ago
  This article[1] has IBM slides which suggest 40-50x computation penalty and 10-20x RAM penalty. [1]: https://arstechnica.com/gadgets/2020/07/ibm-completes-successful-field-trials-on-fully-homomorphic-encryption/ https://arstechnica.com/gadgets/2020/07/ibm-completes-succes...
  - dowem 6y ago
    Thanks for passing on that reference @onepointsixC. Yourself and the parent poster might be interested in a webinar we posted on YouTube which talks about those slides from one of the paper authors (Flavio) and yours truly. That slide is about halfway through the video, but the whole thing is worth a watch. https://www.youtube.com/watch?v=W9G1s1t_d80&list=PL0VD16H1q5IOEQuRdgRVt1M8uQSbpVzTb&index=2 https://www.youtube.com/watch?v=W9G1s1t_d80&list=PL0VD16H1q5... We put up a cryptography playlist during the last week on youtube since it felt like people didn't have enough resources to refer to easily. We hope it helps! It includes the video walkthrough of how to get the toolkit running and run some demos.

jstanley 6y ago

Is it really only 40 times slower? I thought it was millions of times slower. If it's only 40 times slower than a modern CPU, then this technology is a lot more interesting than I thought. From a few minutes of Googling, I can't find any obvious benchmarks.

betterunix2 6y ago
It depends on what you are computing. In some cases it will be as fast as the insecure version (not counting encryption/decryption time). On the other hand, random access will have to be simulated by a linear scan over an array, which is asymptotically slower. Complex control flow e.g. deeply nested loops with input-dependent side effects can cause the overhead to balloon.
onepointsixC 6y ago
This article[1] has IBM slides which suggest 40-50x computation penalty and 10-20x RAM penalty. [1]: https://arstechnica.com/gadgets/2020/07/ibm-completes-successful-field-trials-on-fully-homomorphic-encryption/ https://arstechnica.com/gadgets/2020/07/ibm-completes-succes...
- dowem 6y ago
  Thanks for passing on that reference @onepointsixC. Yourself and the parent poster might be interested in a webinar we posted on YouTube which talks about those slides from one of the paper authors (Flavio) and yours truly. That slide is about halfway through the video, but the whole thing is worth a watch. https://www.youtube.com/watch?v=W9G1s1t_d80&list=PL0VD16H1q5IOEQuRdgRVt1M8uQSbpVzTb&index=2 https://www.youtube.com/watch?v=W9G1s1t_d80&list=PL0VD16H1q5... We put up a cryptography playlist during the last week on youtube since it felt like people didn't have enough resources to refer to easily. We hope it helps! It includes the video walkthrough of how to get the toolkit running and run some demos.