3 ms·

It's a side-channel attack on the encryption, not a break of homomorphic encryption: “We weren’t able to crack homomorphic encryption using mathematical tools,

It's a side-channel attack on the encryption, not a break of homomorphic encryption: “We weren’t able to crack homomorphic encryption using mathematical tools,” says Aydin Aysu, senior author of a paper on the work and an assistant professor of computer engineering at North Carolina State University. “Instead, we used side-channel attacks. Basically, by monitoring power consumption in a device that is encoding data for homomorphic encryption, we are able to read the data as it is being encrypted. This demonstrates that even next generation encryption technologies need protection against side-channel attacks.”

schoen 5y ago
It feels plausible to me that homomorphic encryption would be especially vulnerable to side-channel attacks because its schemes are so computation-heavy. I don't have a clear mental model for this, but it feels like there would be a lot of opportunities for attackers to detect data dependencies at the beginning of the process (if they have access to observe a relevant channel).
- karulont 5y ago
  The encryption is data dependent. The homomorphic computation itself cannot be data dependent. Homomorphic encryption says that even if you see all the intermediate encrypted values, you will not know what the encrypted input or output value is. So side-channels do not matter for the computationally heavy evaluation part. In this paper they attacked the encryption part.
  - schoen 5y ago
    Sorry, I meant the initial preparation of the encrypted data. I believe that this step is also typically rather computationally heavy, although maybe less so than the later computation over the encrypted data.
azinman2 5y ago
In which case you could also say the same thing about RSA encryption, or really anything. It’s a pretty silly argument to make as rowhammer im sure could also “break” homomorphic encryption. Homomorphic encryption is really about the utility when it leaves the device, not at the encryption stage.
- ChrisLomont 5y ago
  >It’s a pretty silly argument to make as rowhammer im sure could also “break” homomorphic encryption. There's no reason rowhammer should be able to break homomorphic encryption. Homomorphic encryption means at no point is the data on the machine unencrypted, so there is nothing to leak from RAM. >Homomorphic encryption is really about the utility when it leaves the device, not at the encryption stage. ??? This make no sense. Homomorphic encryption is used for a device to do computations on encrypted data without the device knowing what the encrypted data is. For example, computing the square of an integer that is homorphically encrypted would not tell the device doing the computation what the original number is or what the square is. Encrypted data comes in, stays encrypted at all times, an algorithm does some operations on the encrypted data, and encrypted data is then sent out. This paper and attack are not about the encryption stage. The attack is on the operating on homomorphic data.
  - joshuamorton 5y ago
    FTA: >Our proposed attack targets the Gaussian sampling in the SEAL’s encryption phase It's literally about stealing the data from the encryptor, which is usually a trusted machine.
    - azinman2 5y ago
      Exactly. Power consumption side channel attacks do nothing for devices operating on already encrypted data, because if it did, it would mean homomorphic encryption is fundamentally broken. The side channel attack is on the original encryptor.
  - CoastalCoder 5y ago

schoen 5y ago

It feels plausible to me that homomorphic encryption would be especially vulnerable to side-channel attacks because its schemes are so computation-heavy. I don't have a clear mental model for this, but it feels like there would be a lot of opportunities for attackers to detect data dependencies at the beginning of the process (if they have access to observe a relevant channel).

karulont 5y ago
The encryption is data dependent. The homomorphic computation itself cannot be data dependent. Homomorphic encryption says that even if you see all the intermediate encrypted values, you will not know what the encrypted input or output value is. So side-channels do not matter for the computationally heavy evaluation part. In this paper they attacked the encryption part.
- schoen 5y ago
  Sorry, I meant the initial preparation of the encrypted data. I believe that this step is also typically rather computationally heavy, although maybe less so than the later computation over the encrypted data.

azinman2 5y ago

In which case you could also say the same thing about RSA encryption, or really anything. It’s a pretty silly argument to make as rowhammer im sure could also “break” homomorphic encryption. Homomorphic encryption is really about the utility when it leaves the device, not at the encryption stage.

ChrisLomont 5y ago
>It’s a pretty silly argument to make as rowhammer im sure could also “break” homomorphic encryption. There's no reason rowhammer should be able to break homomorphic encryption. Homomorphic encryption means at no point is the data on the machine unencrypted, so there is nothing to leak from RAM. >Homomorphic encryption is really about the utility when it leaves the device, not at the encryption stage. ??? This make no sense. Homomorphic encryption is used for a device to do computations on encrypted data without the device knowing what the encrypted data is. For example, computing the square of an integer that is homorphically encrypted would not tell the device doing the computation what the original number is or what the square is. Encrypted data comes in, stays encrypted at all times, an algorithm does some operations on the encrypted data, and encrypted data is then sent out. This paper and attack are not about the encryption stage. The attack is on the operating on homomorphic data.
- joshuamorton 5y ago
  FTA: >Our proposed attack targets the Gaussian sampling in the SEAL’s encryption phase It's literally about stealing the data from the encryptor, which is usually a trusted machine.
  - azinman2 5y ago
    Exactly. Power consumption side channel attacks do nothing for devices operating on already encrypted data, because if it did, it would mean homomorphic encryption is fundamentally broken. The side channel attack is on the original encryptor.
- CoastalCoder 5y ago