4 ms·
> all it lets you do is put encrypted inputs into a program and get encrypted outputs back. Indeed. > the real holy grail is program obfuscation Why so? FHE
by 3np 5y ago
> all it lets you do is put encrypted inputs into a program and get encrypted outputs back.
Indeed.
> the real holy grail is program obfuscation
Why so? FHE is a way stronger fundamental improvement that enables a completely different way to compute on individual data without compromising privacy and secrecy, in a trustless way that TEEs/SGX can't.
- sterlind 5y agoprogram obfuscation could trivially implement FHE. the obfuscated program would simply: 1. decrypt the inputs using its embedded private key. 2. do the computation. 3. encrypt the outputs and return them. I'm not saying SGX is the holy grail, it's as compromised as Intel. I'm saying that an actual cryptographic primitive, like SGX but actually trustless and made of math instead of hardware, is.
- sa1 5y agoWouldn’t the decrypted inputs be readable in memory?
- dataflow 5y agoI think what they meant was that the secrets would be in a form that the black box would consider decrypted-equivalent (i.e. able to perform computation on), but that wouldn't be plaintext to an outsider.
- sa1 5y agoyeah, but it isn't equivalent to FHE, and doesn't seem as strong a guarantee.
- faeyanpiraat 5y agoThere is a difference between an array of encrypted numbers (which fhe requires if I understand it correctly), and a completely encrypted bitstream (where the data could be put to hide the fact that it is a number array)
- sterlind 5y agoit's actually stronger than FHE, which is what I was saying. virtual black-box obfuscation would mean that an attacker could only observe the outputs and the inputs - all intermediate states and data, such as the decrypted inputs or the decryption key or logic - would themselves be encrypted. it's like having FHE with an output decryptor circuit at the end. unfortunately VBB was shown to be impossible, but indistinguishability obfuscation - producing a program that's indistinguishable from any other program that produces the same outputs for the same inputs - is possible, as recently demonstrated. iO is weaker but still useful. imagine that I have a program that looks like "return input == secret". with iO, you couldn't recover the value of "secret" from the program, since "return Hash(input) == HashedSecret" is equivalent to the original, and iO guarantees that all alternate implementations of a function are indistinguishable.
- sa1 5y agoI really want to understand this. Let's say my focus is on retrieving the input, not the secret. I do not want the people who are running the program to know my input. I do not want the program to know my input. Does indistinguishability obfuscation help with that?
- sterlind 5y agoif you want the users of the program to know the output, but you want to keep the input a secret, you could use functional encryption (another special case of iO.) users can compute a function of the input without being able to decrypt the input or learn anything else about it. if you want the output to be encrypted too (even potentially with a different key), you can use vanilla FHE.
- sa1 5y agoThanks, the latter is what I would desire.
- 3np 5y ago> I'm saying that an actual cryptographic primitive, like SGX but actually trustless and made of math instead of hardware, is. Does this exist, even in theory?
- sanxiyn 5y agoThere is a proposal: https://arxiv.org/abs/2008.09317 https://arxiv.org/abs/2008.09317
- Ar-Curunir 5y agoObfuscation implies FHE, but we the converse is not (necessarily) true. In fact the only realizable notion of obfuscation, indistinguishablity obfuscation, is so “weak” that it can exist even if things like symmetric encryption don’t.