3 ms·
FHE leaks information indeed. It's proven to not be secure against a chosen ciphertext attack.
by glitchc 6y ago
FHE leaks information indeed. It's proven to not be secure against a chosen ciphertext attack.
- bawolff 6y agoWell this is unfortunate, i can't help but feel that many of the usecases for FHE are much less likely to have decryption oracles than traditional encryption would. I'm also not sure if i would say "leak information" is the right word to describe a chosen ciphertext attack.
- paconbork 6y agoIt's not that straightforward. There's two types of chosen ciphertext attacks: IND-CCA1 (non-adaptive) and IND-CCA2 (adaptive). There are in fact FHE schemes for the former such as https://www.iacr.org/archive/pkc2017/101750203/101750203.pdf https://www.iacr.org/archive/pkc2017/101750203/101750203.pdf The problem comes in the adaptive case. In the distinguishing game, an adaptive adversary can have the decryption oracle decrypt any ciphertext after it receives its challenge ciphertext (besides the challenge itself, as that would be trivially defeatable). However, if the adversary receives Enc(m), they can just compute Enc(m+m) and ask the oracle to decrypt it, thus winning the game. No FHE scheme will be IND-CCA2 secure by definition, but that doesn't mean that they "leak information" in the applications FHE is being proposed for. As long as you're not decrypting arbitrary ciphertexts for the server you just uploaded your sensitive encrypted information to, you can have your delegated computation, as a treat.