4 ms·

My understanding is that fully homomorphic encryption allows proprietary logic to stay hidden by allowing a company to perform its proprietary logic on a custom

by emily37 15y ago

My understanding is that fully homomorphic encryption allows proprietary logic to stay hidden by allowing a company to perform its proprietary logic on a customer's data without seeing the data. If I have a function f and you have some data x, and you want to compute f(x), then without fully homomorphic encryption, either I have to give you my function or you have to give me your data. With fully homomorphic encryption, you can give me your encrypted data and I can use that as input to my function, so that you don't learn what my function is and I don't learn what your data is. I give you the output of the function, and you can decrypt it to learn what f(x) is without learning f.

djcapelis 15y ago
This is a much better explanation, thank you.
jjjabrams 15y ago
I'd love to f your (x)....
justincormack 15y ago
In a lot of use cases for this I also need to be able to verify you did apply f too, which may be hard. There is clearly a huge lack of trust here. Thinking of financial service applications like trading. I think the use case where I want to compute f(x) in an untrusted (eg cloud) environment is probably the real potential use case. The (slightly odd) book Translucent Databases gives some more use cases, such as working with anonymised statistics.
- aquark 15y ago
  Interesting -- how can you verify that f() was applied when by definition you don't know what the output of f() should be? If someone was trying to be dishonest then they could fake any attribute of f() that you could likely verify.
  - dexen 15y ago
    > If someone was trying to be dishonest then they could fake any attribute of f() that you could likely verify. Not necessarily. For example: you can't fake bitcoin transactions, as each one requires significant amount of comuptation. Basically faking would require exactly the same work (modulo problems with SHA1 itself, but that's another matter). This is used for other purposes as well: http://en.wikipedia.org/wiki/Proof_of_work http://en.wikipedia.org/wiki/Proof_of_work
    - aquark 15y ago
      I'm not familiar with the details of bitcoin, but in that case aren't (some of) the inputs to the function hidden not the function itself. Proof of work techniques are relying on forcing the other party to run a known function in order to prevent various attacks. If the other party can't verify the result they would be no use.

by emily37 15y ago

djcapelis 15y ago

This is a much better explanation, thank you.

jjjabrams 15y ago

I'd love to f your (x)....

justincormack 15y ago

In a lot of use cases for this I also need to be able to verify you did apply f too, which may be hard. There is clearly a huge lack of trust here. Thinking of financial service applications like trading. I think the use case where I want to compute f(x) in an untrusted (eg cloud) environment is probably the real potential use case. The (slightly odd) book Translucent Databases gives some more use cases, such as working with anonymised statistics.

aquark 15y ago
Interesting -- how can you verify that f() was applied when by definition you don't know what the output of f() should be? If someone was trying to be dishonest then they could fake any attribute of f() that you could likely verify.
- dexen 15y ago
  > If someone was trying to be dishonest then they could fake any attribute of f() that you could likely verify. Not necessarily. For example: you can't fake bitcoin transactions, as each one requires significant amount of comuptation. Basically faking would require exactly the same work (modulo problems with SHA1 itself, but that's another matter). This is used for other purposes as well: http://en.wikipedia.org/wiki/Proof_of_work http://en.wikipedia.org/wiki/Proof_of_work
  - aquark 15y ago
    I'm not familiar with the details of bitcoin, but in that case aren't (some of) the inputs to the function hidden not the function itself. Proof of work techniques are relying on forcing the other party to run a known function in order to prevent various attacks. If the other party can't verify the result they would be no use.