5 ms·

>It’s a pretty silly argument to make as rowhammer im sure could also “break” homomorphic encryption. There's no reason rowhammer should be able to break homom

>It’s a pretty silly argument to make as rowhammer im sure could also “break” homomorphic encryption. There's no reason rowhammer should be able to break homomorphic encryption. Homomorphic encryption means at no point is the data on the machine unencrypted, so there is nothing to leak from RAM. >Homomorphic encryption is really about the utility when it leaves the device, not at the encryption stage. ??? This make no sense. Homomorphic encryption is used for a device to do computations on encrypted data without the device knowing what the encrypted data is. For example, computing the square of an integer that is homorphically encrypted would not tell the device doing the computation what the original number is or what the square is. Encrypted data comes in, stays encrypted at all times, an algorithm does some operations on the encrypted data, and encrypted data is then sent out. This paper and attack are not about the encryption stage. The attack is on the operating on homomorphic data.

joshuamorton 5y ago
FTA: >Our proposed attack targets the Gaussian sampling in the SEAL’s encryption phase It's literally about stealing the data from the encryptor, which is usually a trusted machine.
- azinman2 5y ago
  Exactly. Power consumption side channel attacks do nothing for devices operating on already encrypted data, because if it did, it would mean homomorphic encryption is fundamentally broken. The side channel attack is on the original encryptor.
CoastalCoder 5y ago
When talking about encryption techniques, I think we usually assume that the machine performing the encryption isn't compromised. I.e., keeping a machine uncompromised is a separate area of study / endeavor. What NC State achieved is cool, but it seems a bit like saying "Homomorphic encryption is broken when you can blackmail the sysadmin."
- deleted 5y ago
  [deleted]
- olliej 5y ago
  That’s part of the rationale for homomorphic encryption, even if the device performing the operations is completely compromised it never has access to the unencrypted data, so given a theoretical perfect HE system your data would still be safe. I’m off to read this paper S I don’t understand how they are using a side channel to extract information that the operating device theoretically shouldn’t have. If there’s a measurable power usage difference over the operations that implies that the encrypted bits do leak information about what is encrypted.
  - joshuamorton 5y ago
    In a homomorphic scheme, you have a machine A (trusted), which encrypts some data and sends it to machine B (untrusted) and B then does operations on the data and returns the results to A, which decrypts. This attack is on machine A, not machine B. The "leak" happens as the data is being encrypted. They're sidechanneling a machine that has the plaintext on it.
    - olliej 5y ago
      Ah, I was super confused (as I said I hadn’t yet read the paper, I was hoping for TLDR at the time)

joshuamorton 5y ago

FTA: >Our proposed attack targets the Gaussian sampling in the SEAL’s encryption phase It's literally about stealing the data from the encryptor, which is usually a trusted machine.

azinman2 5y ago
Exactly. Power consumption side channel attacks do nothing for devices operating on already encrypted data, because if it did, it would mean homomorphic encryption is fundamentally broken. The side channel attack is on the original encryptor.

CoastalCoder 5y ago

When talking about encryption techniques, I think we usually assume that the machine performing the encryption isn't compromised. I.e., keeping a machine uncompromised is a separate area of study / endeavor. What NC State achieved is cool, but it seems a bit like saying "Homomorphic encryption is broken when you can blackmail the sysadmin."

deleted 5y ago
[deleted]
olliej 5y ago
That’s part of the rationale for homomorphic encryption, even if the device performing the operations is completely compromised it never has access to the unencrypted data, so given a theoretical perfect HE system your data would still be safe. I’m off to read this paper S I don’t understand how they are using a side channel to extract information that the operating device theoretically shouldn’t have. If there’s a measurable power usage difference over the operations that implies that the encrypted bits do leak information about what is encrypted.
- joshuamorton 5y ago
  In a homomorphic scheme, you have a machine A (trusted), which encrypts some data and sends it to machine B (untrusted) and B then does operations on the data and returns the results to A, which decrypts. This attack is on machine A, not machine B. The "leak" happens as the data is being encrypted. They're sidechanneling a machine that has the plaintext on it.
  - olliej 5y ago
    Ah, I was super confused (as I said I hadn’t yet read the paper, I was hoping for TLDR at the time)