11 ms·

The Rise of Fully Homomorphic Encryption

285 points by yarapavan 4y ago

husamia 4y ago
>• Opportunities will exist for new data-licensing revenue models that do not risk confidential data disclosure. for health data, this is a game changer in so many ways
motohagiography 4y ago
Non-technical comment to consider the conseqeunces of FHE. This is not to diminish the amazing work that has gone into FHE, and the theoretical use cases for FHE in a few fields I've worked in are significant. The challenge I found in working with people who want the data is that they really do just want the data. Examples include government agencies who used made up in-house encryption schemes to get their data sharing plan past their legal privacy and security gates and then there was a secret key a small cadre had who could unscramble it after it was distributed in the sector, researchers rejecting synthesized data for uncontrolled test environments because "it was too hard," when really they just wanted the data sets outside the legal controls on it, rejecting differential privacy queries because they didn't want to come up with or specify their queries first based on metadata and again just wanted the data, rejecting identifying the individuals with access to millions of peoples health information data because as institutions they felt entitled to it, banks and payment firms rejecting zero knowledge proofs of user attributes because it violated KYC, and these are just a few. There has been a concerted effort to squeeze the data toothpaste out of the tube when it comes to health information and other types, and so I am ambivalent about FHE use cases because its primary use case is side stepping rules that protect the privacy of data subjects. The question I would have is, if data synthesis, legal risk-based de-identification, differential privacy, and cryptographic tokenization protocols were insufficient, what technical improvement in actual accountability does FHE offer to data subjects, and given the size of the data sets this facilitates, what are the consequences of its failure modes? Given the entire history of cryptography is defined by one party convincing their targets that a given scheme provides them security, the way that FHE scales to giving data collectors impunity "because it's encrypted!" seems like it is vulnerable to every criticism leveled at blockchains, where just because it's encrypted doesn't mean it isn't laundering.
- RandomLensman 4y ago
  Setting aside issues about knowing where the data originates, such encrypted data is really really difficult to use if no-one is providing a way to link the possible calculations performed to observables. If all you have are encrypted inputs and outputs, it is unclear what is being modelled, for example. I don't think FHE is primarily aimed at privacy use cases anyway, more at ways of cooperating etc. where transparency could be detrimental to some or all parties.
- bawolff 4y ago
  The whole cloud provider using FHE usecase always seemed a bit utopian to me. As you say, most of the time they dont want to provide user privacy, they want your data. Maybe i could imagine some sort of B2B case where there are strong requirements working out, but i struggle imagining it for consumer use cases. Not to mention, if you are outsourcing data computation, presumably its a lot of computation or you would do it yourself, so the overhead seems extra important in that case. The most convincing case i've heard is blockchain stuff - where everything is distributed to non trusted parties. (Normally i hate bitcoin hype, but maybe FHE would let you do something interesting with it)
  - Dunny97 4y ago
    [dead]
    - bawolff 4y ago
      I dont know what you are doing, but if you are using FHE explicitly for its post quantumness, you are doing something wrong as there are much much better choices if you need post-quantum versions of traditional primitives.
  - vesinisa 4y ago
    Yeah, I don't think this will work on commercial scale exactly for the same reasons as blockchain is useless for anything outside the illegal niches where you need to avoid the legal banking system. You may let people store homomorphic data on your servers and even run your algorithms on that data, but you have no way of handling customer complaints or fine-tuning / debugging your service because you can not understand ANY of the customer data you are storing. Similarly, blockchain sounds like a good idea until you need to reverse a transaction: https://www.pcmag.com/news/cryptocom-sues-woman-after-accidentally-sending-her-105-million https://www.pcmag.com/news/cryptocom-sues-woman-after-accide...
bawolff 4y ago
This feels more like a press release than an actually insightful article. Would practical FHE be interesting? Sure. Is it happening? Doesn't seem like it is any time soon.
- shishy 4y ago
  I don't think it was just a press release, the linked PDF had a nice overview of how we got here and some advances in the last decade. Decent little review type article with some hyperbole! I think the title maybe a little too optimistic / vague by saying it's "near" without indicating what else is needed to get there / when it might happen ;).
  - bawolff 4y ago
    The byline is "Mache Creeger, Cornami Inc.". Cornami is a company that sells FHE accelerator chips. Many of the talking points seem to be very similar to the Cornami website, such as the over-emphasis on post quantum crypto despite being very irrelavent in context.
    - shishy 4y ago
      Somehow missed it, read before caffeine, good call
- hinkley 4y ago
  Doesn’t fully homomorphic encryption have the Tux Image problem cited in block cypher discussions? With a symmetric cipher, I could figure out the blood type of every employee pretty easily. With an asymmetric cipher, I could figure out everyone who has my blood type, and the blood types of anyone who reveals that information. If the point is to filter data when you aren’t allowed to know what the data is, then the act of being in the filter or not reveals some of that information. It’s just a game of twenty questions.
  - bawolff 4y ago
    I think you are mixing it up with order-preserving encryption and other stuff related to encrypted databases. In the FHE model, the assumption usually is - you have some data, someone else does some encrypted calculations, you get the encrypted answer back, you decrypt the answer and read it. The adversary cannot play 20 questions because they only calculate the encrypted answers, they are not allowed to see what the answers are.
gumby 4y ago
This article skips over the elephant in the room, via a couple of casual references to “performance”. You did some experiments with HE in 2019 and it involves orders of magnitude slowdown — thousands of times slower than regular computation. I don’t see this speeding up either.
- api 4y ago
  To make it fast I think we'll need custom silicon. I wonder how many stealth startups exist working on FHE chips?
  - v4dok 4y ago
    I wouldn't hold my breath on this. Reducing it by x40 AND making sure that hardware is not leaky.
    - MauranKilom 4y ago
      Wait, how would hardware be possibly leaky? The encryption/decryption can leak data, sure, but that's unrelated to FHE. If your hardware can leak info about the plaintext on the side processing the encrypted data, then you could do the same in software anyway, and the FHE scheme itself is clearly broken...
      - deleted 4y ago
        [deleted]
      - angry_octet 4y ago
        It's clear v4dok doesn't understand how FHE works, maybe due to confusion with enclaves like SGX. The hardware isn't able to leak the plaintext because it doesn't have the key; it executes on the ciphertext.
    - Ar-Curunir 4y ago
      The hardware is not relevant if it's simply being used as an accelerator. FHE reveals no information about the underlying data, so the privacy leakage is the same, no matter if you're running the FHE code on ENIAC or on a modern supercomputer.
v4dok 4y ago
I am still amazed by the amount of people that still mix security and encryption in-use with privacy. And truth is the whole privacy/security industry is doing nothing to change that. Take this for example "Valuable insights through AI (artificial intelligence), big data, and analytics can be extracted from data—even from multiple and different sources—all without exposing the data, secret decryption keys, or, if need be, the underlying evaluation code." FHE gives you NO guarantee about the code that is running on the encrypted data. I can run a leaky AI model or a SELECT * on encrypted data and still get the output. What I can do (and that's assuming there is open-sourced, auditable code) is to make sure that anyone with hypervisor access on that machine cannot dump my data out during processing. A very powerful concept for remote processing, supply chain security, and overall reducing trust; but completely unrelated to privacy.
- bawolff 4y ago
  > FHE gives you NO guarantee about the code that is running on the encrypted data. I can run a leaky AI model or a SELECT * on encrypted data and still get the output. What I can do (and that's assuming there is open-sourced, auditable code) is to make sure that anyone with hypervisor access on that machine cannot dump my data out during processing. I might be misunderstanding but i think this is misleading. Any code can be run, but the person running the code cannot see the results (or any side effects), so they cannot leak data.
  - v4dok 4y ago
    Depends on what do you mean by "person running the code" If by person you mean the admin of the machine, then yes. If by person you mean the developer of the FHE-based application, then "maybe" If by person you mean the analyst who would in the end order an AI python model to be executed through the FHE-based software on a machine. Then no, that person will in the end get back human-readable results. Be that a model, or a table from an SQL DB running in FHE
    - vesinisa 4y ago
      The way I have understood FHE is that any algorithm that would operate on the data would, by definition, be unable to produce any result that was intelligible to anyone except the person holding the original key. At no point during the execution of an FHE algorithm is the data decrypted. The amazing thing is exactly that the code running on the data does not understand the data it is consuming nor the data that it is producing. Maybe someone who has actually studied homomorphic encryption can chime in.
arunkant 4y ago
Healthcare is stuck in pre 2000 IT technologies because of privacy concerns. I hope that with FHE, Heathcare providers can move to cloud technologies without fear of losing privacy
- m1ghtym0 4y ago
  They can today with other PETs like confidential computing. But change takes time and a lot of education when it's based on new types of technology.
- adgjlsfhk1 4y ago
  fhe doesn't solve this at all. if the problem takes little enough power do be run with the, you can run it without cloud compute or fhe easily.
  - m1ghtym0 4y ago
    Well, it's not about compute power and whether you can run things on-prem. It's about sharing, synchronizing, and collaborating on data. That's where PETs open up new opportunities.
m1ghtym0 4y ago
> Today, conventional wisdom suggests that an additional performance acceleration of at least another 1 million times would be required to make FHE operate at commercially viable speeds. At the moment, Cornami is the only commercial chip company to announce a forthcoming product that can meet and exceed that performance level. Is there any comparison performance benchmark for these Cornami chips on real world algorithms? The data given by https://cornami.com/fully-homomorphic-encryption-fhe/ https://cornami.com/fully-homomorphic-encryption-fhe/ doesn't really help me.
- carrotcypher 4y ago
  If no one answers here, might try on the FHE.org discord, loads of researchers there who probably wrote a paper on exactly that.
  - m1ghtym0 4y ago
    thanks! will try there
  - nominusllc 4y ago
    Any chance of an IRC or Matrix bridge?
  - gnramires 4y ago
    The subreddit /r/crypto is good quality as well (some researchers there).
- bawolff 4y ago
  Keep in mind that this article was written by Cornami, so i would take any assertions about cornami solving all the problems with a huge heaping of salt.
  - SV_BubbleTime 4y ago
    What an amazing coincidence.
  - 4y ago
Dunny97 4y ago
[dead]
- Ar-Curunir 4y ago
  This has nothing to do with FHE...
zacchj 4y ago
If you want to see a practical use case of Fully Homomorphic Encryption (FHE) with Machine Learning. > https://www.zama.ai/post/titanic-competition-with-privacy-preserving-machine-learning-using-concrete-ml https://www.zama.ai/post/titanic-competition-with-privacy-pr... Its main ambition is to show that FHE can be used for protecting data when using a Machine Learning model to predict outcomes without degrading its performance. Disclaimer: I'm working at Zama (cited in the article posted).
- limbicsystem 4y ago
  Or this! https://pubmed.ncbi.nlm.nih.gov/30641309/ https://pubmed.ncbi.nlm.nih.gov/30641309/
  - zacchj 4y ago
    There is also use cases listed here: > https://fhe.org/fhe-use-cases https://fhe.org/fhe-use-cases Also anyone can contribute and add resources as it lives on an open source github repo.
deleted 4y ago
[deleted]
bsaul 4y ago
Wait, has any quantum computers performed a real computation faster than a normal computer one yet ?
- krastanov 4y ago
  No "useful" computation yet, but "yes", quantum hardware has been able to sample from some programmable convoluted contrived probability distributions from which classical computer can not sample efficiently. But that is irrelevant here because: More importantly, FHE and post-quantum crypto are two completely orthogonal topics. Homomorphic is the property that (classical or quantum) computation can be performed on the encrypted (classical or quantum) data without decrypting it. Homomorphic encryption with classical data on classical computers is rather difficult and fascinating. Homomorphic encryption on quantum computers is trivially easy (if you already have a standard scalable quantum computer, which do not exist yet). "Post-quantum" is the property that a classical computer can efficiently perform encryption that can not be broken even by a quantum computer.
fudgefactorfive 4y ago
I think the killer app for FHE is an Ethereum-esque Globally distributed VM (yes eye-roll I hate Crypto/Blockchain nonsense as well). To me that was always the big interesting concept behind Ethereum, running some sort of code with persistent state. Obviously no free lunches so we gotta pay for that somehow to incentivize people to pay for power on computing equipment they aren't personally utilizing. But somehow "crypto" got caught on the literally first example of a distributed systems correctness: debit/credit of synchronized accounts. I feel FHE combined with slightly cheaper cost might enable things like community run server-less apps that have user state stored and processed by untrusted nodes with persistent state stored and accessible only by the data-owner. E.g. a simple excel-esque web app which only serves the UI while State and calculations are running on this hypothetical system at no cost to the apps creator with me paying only for exclusively my usage. They provide the code but no one but me can extract my data and the results of any computations, and for the privilege I pay the system. I miss the days of upload and forget software that just relies on client resources and so require little upfront investment from developers, I feel FHE plus distributed computing could enable this. I am aware "Web3" claims to want this future as a concept but the cost and utter lack of confidentiality (I can observe all data to and from a contract as well as the sender/receivers identity) makes it a super-niche borderline useless VM. For distributed governance sure, it's a public ballot box (the preface to the first distributed systems example, a single account with credits), but for any application/user data absolutely unacceptable.
- k__ 4y ago
  I don't know if FHE and ZKP are related, but it seems to me that privacy is a huge topic in web3 right now.
- rhindi 4y ago
  Multiple teams are working on FHE smart contracts, including us, so it’s definitely happening. Adding ZK to the mix would be awesome for scalability and indeed to avoid replicating the FHE computation
- everfree 4y ago
  I don't really follow how a customer would be able to pay for their usage of a VM globally distributed across untrusted nodes without "crypto/blockchain nonsense" involved. Where in the system would the credit card endpoint be located?
jgaa 4y ago
> FHE (fully homomorphic encryption) provides quantum-secure computing on encrypted data Today, if I understand it correctly, that means the encryption can't be broken on a computer with resources < whatever is required to calculate the square root of 16 ;)
- Ar-Curunir 4y ago
  Something is obviously not quantum-secure if it's broken on a classical computer. FHE schemes in particular are instantiated with schemes that are believed to offer both classical security and post-quantum security.
  - jgaa 4y ago
    It was a joke, built on some comments on a recent Security Now podcast, where they made fun of Quantum computing's current inability to compute the simplest things accurately, and the possibility that Quantum computing never will evolve into something that can surpass legacy computers.
skywhopper 4y ago
This is a really misleading article. It skims over lots of practical issues with FHE, such as the cost of the extra work which will severely limit its applicability, and more critically, the necessity to use the same key(!!) to encrypt/decrypt every input and output. It also conflates FHE with quantum-resistant encryption, simply because most FHE algorithms currently use lattice-based math, and a 2006 paper observed that no quantum algorithms were known that could outperform traditional computing for lattice math. Not a very strong claim, imo. It goes on to grossly overstate the extent to which current IT systems are at risk as well as the extent to which FHE would even address actual IT threats. Plus, anytime anyone claims something is “provably secure”, they are leaving out crucial parts of the system, like the interface with humans or key rotation. And then there’s the part where the author is a VP of business development at a company that makes FHE hardware. Sigh.
bskan 4y ago
awesomeMilou 4y ago
Great write up on the state of the field, but when I checked last, the current problem is performance. I didn't see much on that in the article. A few years ago there were papers on evaluating simple logic circuits in an FHE context and it took 2h hours for what was basicially 5-6 NOR gates.
- johnbender 4y ago
  Fwiw we have at least some reason to hope in this general context that between clever systems work and tightening theoretical bounds via additional assumptions and clever reasoning we might get to practical implementations for some applications. As (maybe weak) evidence the progress on practical implementations of PCPs/SNARGs https://dl.acm.org/doi/pdf/10.1145/2641562 https://dl.acm.org/doi/pdf/10.1145/2641562
  - rhindi 4y ago
    It’s much much faster now, and performance is improving 10x every couple of year. With the current trend, FHE will be applicable to 80% of usecases by 2025
- nomnoms 4y ago
  Performance is still problematic for many applications (particularly in ML). Our team has been working on making FHE more accessible to engineers via a compiler; we've found usability to be a much bigger obstacle than performance. You might be surprised to see how far performance has come! For (an admittedly small example of) matrix-vector multiplication, we can do key generation, encryption, computation, decryption, and compilation in less than 5 seconds on a MacBook [0]. [0]: https://playground.sunscreen.tech/ https://playground.sunscreen.tech/
wazoox 4y ago
I've just watched a presentation about Cosmian (https://cosmian.com/ https://cosmian.com/) and their solution boasts using FHE, at a significant price though: computations and queries are about 1000 slower than on unencrypted data according to their CTO. I was quite impressed that it even works at all, though :)
- hinkley 4y ago
  Don’t those sorts of differences suggest that perhaps enclave decryption would be as fast and support more functionality?
  - wazoox 4y ago
    Probably but the main objective is to keep data safe in the cloud while keeping everything encrypted (traffic and data), all the time.
    - hinkley 4y ago
      That's certainly fair. One of the oldest classic physical security failures I know of, which really stuck with me, is "who did background checks on the janitors?" It doesn't literally have to be janitors, but there are a lot of people in your space that we assume are not threats, even though there is a lot of overlap between "hacker" and "people who work for vendors". I knew someone who was responsible for delivering backups from a secure data center to a lockbox every couple of days. Unfortunately the bank was only a few blocks from the data center so I'm not sure how much physical separation that really provided. Also this particular person would have been able to do absolutely nothing about being mugged for the disks if someone actually cared. But maybe I'm a little too paranoid. I recall once having to drop the night's deposit off from the restaurant I worked at. They were down a manager due to illness, it was on the way home, I was a figurative if no longer a literal boyscout, so the math on "shenanigans if hinkley leaves with the money" versus "shenanigans if there is no night manager in the store" apparently leaned toward me. I'm glad they trusted me but I was a nervous wreck for four blocks until that bag went into the night deposit box. Anything that can move "precious cargo" without a human failure mode is alright in my book.
anonporridge 4y ago
Spiral is an interesting use case of FME for database fetching that just popped up, https://usespiral.com/ https://usespiral.com/ General FME computation is obviously not likely to be practical or cost effective any time soon, but there may be some specific use cases, like querying a database, where hiding the information you want to know from the server is advantageous. There are adversarial environments where knowing the information your adversary is interested in provides a competitive edge. I'm curious to dig more into their implementation.
- blintz 4y ago
  Happy to answer any questions! Yeah, we're taking a narrow application (fetching from a database) and making it really practical. You can privately check a Bitcoin balance at https://btc.usespiral.com https://btc.usespiral.com or privately read Wikipedia at https://spiralwiki.com https://spiralwiki.com. Our code for the Bitcoin site is at https://github.com/spiralprivacy/clients https://github.com/spiralprivacy/clients.
aliswe 4y ago
I know its low effort, but would an anti-homomorphic encryptionist be regarded homophobic?
rogers18445 4y ago
What is the actual value proposition of HE? The purpose of encryption is to hide information, if you are able to to do any meaningful comparison between two encrypted records, you have an information leak, and encryption has failed.
- AaronFriel 4y ago
  The value proposition is that the hosting provider running your computation does not know what was computed.
- sillysaurusx 4y ago
  Imagine running an inference on a model in the cloud. Usually the cloud will have access to your model. That poses a problem if your model is highly sensitive. (Imagine the NSA wanting to run a model on North Korean servers. NK would immediately snatch up that model.) With FHE, you can theoretically avoid that. Someone can upload an encrypted model to the cloud. The cloud can do some computation on it (inference) and deliver an encrypted result. Then you can decrypt the result in the comfort of your own government^Whome. Obviously this is a bit of a stupid example, but just think of all the scenarios right now where you'd want to offload your computation on someone else, but you don't want to let them see the computation.
- pmarreck 4y ago
  There is no information leak, because the information is never decrypted. The encrypted operations are performed directly on the encrypted data and the still-encrypted result is returned to the client, to be decrypted at their convenience to view the result. That is the magic of FHE. Two identical cleartext values would likely not encrypt to the same ciphertext value (for example, you could get around that easily on the client end by simply incrementing any duplicate value by 1 before sending and then decrementing it by 1 again on return, assuming that is done undoably given the other operations happening); any comparison operation would also likely be encrypted and thus unknown to the server; so the server couldn't just linearly compare any two encrypted values to make deductions.
kebman 4y ago
Looks like some kind of ad that tries to discredit regular encryption by claiming that it's already compromised (it isn't), or that it will be very soon. But lo! Here is the knight in shining armour coming to the rescue (FHE)! Soon. Maybe.
- foolfoolz 4y ago
  fhe solves a ton of issues in sass products that don’t look great under audit. things where we sign off on audit today with fancy contracts called “data privacy agreements.” i think it will take some time (20 years?) but i expect zero knowledge for most of your data to be table stakes for saas offerings
  - autoexec 4y ago
    Saas is all about collecting, controlling, and exploiting your data though. If they can still mine your data and leverage or sell the information they get out of it that's not really "zero knowledge". I don't expect companies will stop being interested in making money at all costs in 20 years, especially where the costs are mostly to you and your privacy.
    - solveit 4y ago
      Actually saas is about providing services for money.
      - autoexec 4y ago
        Money and control is what it's about. That usually means making someone dependent on you in order to access/use their own stuff, making it hard to migrate their data away from your service, and taking every advantage of the data being collecting. I've never seen a saas product that isn't using and/or "sharing" their customer's data for their own benefit somehow. If they exist at all, they're the exception and not the rule.
        4y ago
RadixDLT 4y ago
here is a good project with HE https://github.com/deroproject/derohe https://github.com/deroproject/derohe
avmich 4y ago
> To achieve unrestricted homomorphic computation, or FHE, you must choose F to be a set of functions that is complete for all computation (e.g., Turing complete). The two functions required to achieve this goal are bit Addition (equivalent to Boolean XOR) and bit Multiplication (equivalent to Boolean AND), as the set {XOR, AND} is Turing complete. This - "set {XOR, AND} is Turing complete" - is incorrect. You need to also have "true" constant.
ravi545 4y ago
200+ Top High-Quality Dofollow Backlinks Sites List: Many People Wanted To Create Backlinks But They Don't Know That Where To Create Backlinks And Which Website Are Best For Creating Backlinks So Guys If You Are Also One Of Them Then Don't You Worry Because I Will Guide You And Will Provide You Top 200+ Best Quality Dofollow Backlinks Site List Which Will Help You To Increase Your Website Domain Authority Your Website Domain Rating Page Authority And Many More

285 points by yarapavan 4y ago

>• Opportunities will exist for new data-licensing revenue models that do not risk confidential data disclosure. for health data, this is a game changer in so many ways

motohagiography 4y ago

Non-technical comment to consider the conseqeunces of FHE. This is not to diminish the amazing work that has gone into FHE, and the theoretical use cases for FHE in a few fields I've worked in are significant. The challenge I found in working with people who want the data is that they really do just want the data. Examples include government agencies who used made up in-house encryption schemes to get their data sharing plan past their legal privacy and security gates and then there was a secret key a small cadre had who could unscramble it after it was distributed in the sector, researchers rejecting synthesized data for uncontrolled test environments because "it was too hard," when really they just wanted the data sets outside the legal controls on it, rejecting differential privacy queries because they didn't want to come up with or specify their queries first based on metadata and again just wanted the data, rejecting identifying the individuals with access to millions of peoples health information data because as institutions they felt entitled to it, banks and payment firms rejecting zero knowledge proofs of user attributes because it violated KYC, and these are just a few. There has been a concerted effort to squeeze the data toothpaste out of the tube when it comes to health information and other types, and so I am ambivalent about FHE use cases because its primary use case is side stepping rules that protect the privacy of data subjects. The question I would have is, if data synthesis, legal risk-based de-identification, differential privacy, and cryptographic tokenization protocols were insufficient, what technical improvement in actual accountability does FHE offer to data subjects, and given the size of the data sets this facilitates, what are the consequences of its failure modes? Given the entire history of cryptography is defined by one party convincing their targets that a given scheme provides them security, the way that FHE scales to giving data collectors impunity "because it's encrypted!" seems like it is vulnerable to every criticism leveled at blockchains, where just because it's encrypted doesn't mean it isn't laundering.

RandomLensman 4y ago
Setting aside issues about knowing where the data originates, such encrypted data is really really difficult to use if no-one is providing a way to link the possible calculations performed to observables. If all you have are encrypted inputs and outputs, it is unclear what is being modelled, for example. I don't think FHE is primarily aimed at privacy use cases anyway, more at ways of cooperating etc. where transparency could be detrimental to some or all parties.
bawolff 4y ago
The whole cloud provider using FHE usecase always seemed a bit utopian to me. As you say, most of the time they dont want to provide user privacy, they want your data. Maybe i could imagine some sort of B2B case where there are strong requirements working out, but i struggle imagining it for consumer use cases. Not to mention, if you are outsourcing data computation, presumably its a lot of computation or you would do it yourself, so the overhead seems extra important in that case. The most convincing case i've heard is blockchain stuff - where everything is distributed to non trusted parties. (Normally i hate bitcoin hype, but maybe FHE would let you do something interesting with it)
- Dunny97 4y ago
  [dead]
  - bawolff 4y ago
    I dont know what you are doing, but if you are using FHE explicitly for its post quantumness, you are doing something wrong as there are much much better choices if you need post-quantum versions of traditional primitives.
- vesinisa 4y ago
  Yeah, I don't think this will work on commercial scale exactly for the same reasons as blockchain is useless for anything outside the illegal niches where you need to avoid the legal banking system. You may let people store homomorphic data on your servers and even run your algorithms on that data, but you have no way of handling customer complaints or fine-tuning / debugging your service because you can not understand ANY of the customer data you are storing. Similarly, blockchain sounds like a good idea until you need to reverse a transaction: https://www.pcmag.com/news/cryptocom-sues-woman-after-accidentally-sending-her-105-million https://www.pcmag.com/news/cryptocom-sues-woman-after-accide...

bawolff 4y ago

This feels more like a press release than an actually insightful article. Would practical FHE be interesting? Sure. Is it happening? Doesn't seem like it is any time soon.

shishy 4y ago
I don't think it was just a press release, the linked PDF had a nice overview of how we got here and some advances in the last decade. Decent little review type article with some hyperbole! I think the title maybe a little too optimistic / vague by saying it's "near" without indicating what else is needed to get there / when it might happen ;).
- bawolff 4y ago
  The byline is "Mache Creeger, Cornami Inc.". Cornami is a company that sells FHE accelerator chips. Many of the talking points seem to be very similar to the Cornami website, such as the over-emphasis on post quantum crypto despite being very irrelavent in context.
  - shishy 4y ago
    Somehow missed it, read before caffeine, good call
hinkley 4y ago
Doesn’t fully homomorphic encryption have the Tux Image problem cited in block cypher discussions? With a symmetric cipher, I could figure out the blood type of every employee pretty easily. With an asymmetric cipher, I could figure out everyone who has my blood type, and the blood types of anyone who reveals that information. If the point is to filter data when you aren’t allowed to know what the data is, then the act of being in the filter or not reveals some of that information. It’s just a game of twenty questions.
- bawolff 4y ago
  I think you are mixing it up with order-preserving encryption and other stuff related to encrypted databases. In the FHE model, the assumption usually is - you have some data, someone else does some encrypted calculations, you get the encrypted answer back, you decrypt the answer and read it. The adversary cannot play 20 questions because they only calculate the encrypted answers, they are not allowed to see what the answers are.

gumby 4y ago

This article skips over the elephant in the room, via a couple of casual references to “performance”. You did some experiments with HE in 2019 and it involves orders of magnitude slowdown — thousands of times slower than regular computation. I don’t see this speeding up either.

api 4y ago
To make it fast I think we'll need custom silicon. I wonder how many stealth startups exist working on FHE chips?
- v4dok 4y ago
  I wouldn't hold my breath on this. Reducing it by x40 AND making sure that hardware is not leaky.
  - MauranKilom 4y ago
    Wait, how would hardware be possibly leaky? The encryption/decryption can leak data, sure, but that's unrelated to FHE. If your hardware can leak info about the plaintext on the side processing the encrypted data, then you could do the same in software anyway, and the FHE scheme itself is clearly broken...
    - deleted 4y ago
      [deleted]
    - angry_octet 4y ago
      It's clear v4dok doesn't understand how FHE works, maybe due to confusion with enclaves like SGX. The hardware isn't able to leak the plaintext because it doesn't have the key; it executes on the ciphertext.
  - Ar-Curunir 4y ago
    The hardware is not relevant if it's simply being used as an accelerator. FHE reveals no information about the underlying data, so the privacy leakage is the same, no matter if you're running the FHE code on ENIAC or on a modern supercomputer.

v4dok 4y ago

I am still amazed by the amount of people that still mix security and encryption in-use with privacy. And truth is the whole privacy/security industry is doing nothing to change that. Take this for example "Valuable insights through AI (artificial intelligence), big data, and analytics can be extracted from data—even from multiple and different sources—all without exposing the data, secret decryption keys, or, if need be, the underlying evaluation code." FHE gives you NO guarantee about the code that is running on the encrypted data. I can run a leaky AI model or a SELECT * on encrypted data and still get the output. What I can do (and that's assuming there is open-sourced, auditable code) is to make sure that anyone with hypervisor access on that machine cannot dump my data out during processing. A very powerful concept for remote processing, supply chain security, and overall reducing trust; but completely unrelated to privacy.

bawolff 4y ago
> FHE gives you NO guarantee about the code that is running on the encrypted data. I can run a leaky AI model or a SELECT * on encrypted data and still get the output. What I can do (and that's assuming there is open-sourced, auditable code) is to make sure that anyone with hypervisor access on that machine cannot dump my data out during processing. I might be misunderstanding but i think this is misleading. Any code can be run, but the person running the code cannot see the results (or any side effects), so they cannot leak data.
- v4dok 4y ago
  Depends on what do you mean by "person running the code" If by person you mean the admin of the machine, then yes. If by person you mean the developer of the FHE-based application, then "maybe" If by person you mean the analyst who would in the end order an AI python model to be executed through the FHE-based software on a machine. Then no, that person will in the end get back human-readable results. Be that a model, or a table from an SQL DB running in FHE
  - vesinisa 4y ago
    The way I have understood FHE is that any algorithm that would operate on the data would, by definition, be unable to produce any result that was intelligible to anyone except the person holding the original key. At no point during the execution of an FHE algorithm is the data decrypted. The amazing thing is exactly that the code running on the data does not understand the data it is consuming nor the data that it is producing. Maybe someone who has actually studied homomorphic encryption can chime in.

arunkant 4y ago

Healthcare is stuck in pre 2000 IT technologies because of privacy concerns. I hope that with FHE, Heathcare providers can move to cloud technologies without fear of losing privacy

m1ghtym0 4y ago
They can today with other PETs like confidential computing. But change takes time and a lot of education when it's based on new types of technology.
adgjlsfhk1 4y ago
fhe doesn't solve this at all. if the problem takes little enough power do be run with the, you can run it without cloud compute or fhe easily.
- m1ghtym0 4y ago
  Well, it's not about compute power and whether you can run things on-prem. It's about sharing, synchronizing, and collaborating on data. That's where PETs open up new opportunities.

m1ghtym0 4y ago

> Today, conventional wisdom suggests that an additional performance acceleration of at least another 1 million times would be required to make FHE operate at commercially viable speeds. At the moment, Cornami is the only commercial chip company to announce a forthcoming product that can meet and exceed that performance level. Is there any comparison performance benchmark for these Cornami chips on real world algorithms? The data given by https://cornami.com/fully-homomorphic-encryption-fhe/ https://cornami.com/fully-homomorphic-encryption-fhe/ doesn't really help me.

carrotcypher 4y ago
If no one answers here, might try on the FHE.org discord, loads of researchers there who probably wrote a paper on exactly that.
- m1ghtym0 4y ago
  thanks! will try there
- nominusllc 4y ago
  Any chance of an IRC or Matrix bridge?
- gnramires 4y ago
  The subreddit /r/crypto is good quality as well (some researchers there).
bawolff 4y ago
Keep in mind that this article was written by Cornami, so i would take any assertions about cornami solving all the problems with a huge heaping of salt.
- SV_BubbleTime 4y ago
  What an amazing coincidence.
- 4y ago

Dunny97 4y ago

[dead]

Ar-Curunir 4y ago
This has nothing to do with FHE...

zacchj 4y ago

If you want to see a practical use case of Fully Homomorphic Encryption (FHE) with Machine Learning. > https://www.zama.ai/post/titanic-competition-with-privacy-preserving-machine-learning-using-concrete-ml https://www.zama.ai/post/titanic-competition-with-privacy-pr... Its main ambition is to show that FHE can be used for protecting data when using a Machine Learning model to predict outcomes without degrading its performance. Disclaimer: I'm working at Zama (cited in the article posted).

limbicsystem 4y ago
Or this! https://pubmed.ncbi.nlm.nih.gov/30641309/ https://pubmed.ncbi.nlm.nih.gov/30641309/
- zacchj 4y ago
  There is also use cases listed here: > https://fhe.org/fhe-use-cases https://fhe.org/fhe-use-cases Also anyone can contribute and add resources as it lives on an open source github repo.

deleted 4y ago

[deleted]

bsaul 4y ago

Wait, has any quantum computers performed a real computation faster than a normal computer one yet ?

krastanov 4y ago
No "useful" computation yet, but "yes", quantum hardware has been able to sample from some programmable convoluted contrived probability distributions from which classical computer can not sample efficiently. But that is irrelevant here because: More importantly, FHE and post-quantum crypto are two completely orthogonal topics. Homomorphic is the property that (classical or quantum) computation can be performed on the encrypted (classical or quantum) data without decrypting it. Homomorphic encryption with classical data on classical computers is rather difficult and fascinating. Homomorphic encryption on quantum computers is trivially easy (if you already have a standard scalable quantum computer, which do not exist yet). "Post-quantum" is the property that a classical computer can efficiently perform encryption that can not be broken even by a quantum computer.

fudgefactorfive 4y ago

I think the killer app for FHE is an Ethereum-esque Globally distributed VM (yes eye-roll I hate Crypto/Blockchain nonsense as well). To me that was always the big interesting concept behind Ethereum, running some sort of code with persistent state. Obviously no free lunches so we gotta pay for that somehow to incentivize people to pay for power on computing equipment they aren't personally utilizing. But somehow "crypto" got caught on the literally first example of a distributed systems correctness: debit/credit of synchronized accounts. I feel FHE combined with slightly cheaper cost might enable things like community run server-less apps that have user state stored and processed by untrusted nodes with persistent state stored and accessible only by the data-owner. E.g. a simple excel-esque web app which only serves the UI while State and calculations are running on this hypothetical system at no cost to the apps creator with me paying only for exclusively my usage. They provide the code but no one but me can extract my data and the results of any computations, and for the privilege I pay the system. I miss the days of upload and forget software that just relies on client resources and so require little upfront investment from developers, I feel FHE plus distributed computing could enable this. I am aware "Web3" claims to want this future as a concept but the cost and utter lack of confidentiality (I can observe all data to and from a contract as well as the sender/receivers identity) makes it a super-niche borderline useless VM. For distributed governance sure, it's a public ballot box (the preface to the first distributed systems example, a single account with credits), but for any application/user data absolutely unacceptable.

k__ 4y ago
I don't know if FHE and ZKP are related, but it seems to me that privacy is a huge topic in web3 right now.
rhindi 4y ago
Multiple teams are working on FHE smart contracts, including us, so it’s definitely happening. Adding ZK to the mix would be awesome for scalability and indeed to avoid replicating the FHE computation
everfree 4y ago
I don't really follow how a customer would be able to pay for their usage of a VM globally distributed across untrusted nodes without "crypto/blockchain nonsense" involved. Where in the system would the credit card endpoint be located?

jgaa 4y ago

> FHE (fully homomorphic encryption) provides quantum-secure computing on encrypted data Today, if I understand it correctly, that means the encryption can't be broken on a computer with resources < whatever is required to calculate the square root of 16 ;)

Ar-Curunir 4y ago
Something is obviously not quantum-secure if it's broken on a classical computer. FHE schemes in particular are instantiated with schemes that are believed to offer both classical security and post-quantum security.
- jgaa 4y ago
  It was a joke, built on some comments on a recent Security Now podcast, where they made fun of Quantum computing's current inability to compute the simplest things accurately, and the possibility that Quantum computing never will evolve into something that can surpass legacy computers.

skywhopper 4y ago

This is a really misleading article. It skims over lots of practical issues with FHE, such as the cost of the extra work which will severely limit its applicability, and more critically, the necessity to use the same key(!!) to encrypt/decrypt every input and output. It also conflates FHE with quantum-resistant encryption, simply because most FHE algorithms currently use lattice-based math, and a 2006 paper observed that no quantum algorithms were known that could outperform traditional computing for lattice math. Not a very strong claim, imo. It goes on to grossly overstate the extent to which current IT systems are at risk as well as the extent to which FHE would even address actual IT threats. Plus, anytime anyone claims something is “provably secure”, they are leaving out crucial parts of the system, like the interface with humans or key rotation. And then there’s the part where the author is a VP of business development at a company that makes FHE hardware. Sigh.

bskan 4y ago

awesomeMilou 4y ago

Great write up on the state of the field, but when I checked last, the current problem is performance. I didn't see much on that in the article. A few years ago there were papers on evaluating simple logic circuits in an FHE context and it took 2h hours for what was basicially 5-6 NOR gates.

johnbender 4y ago
Fwiw we have at least some reason to hope in this general context that between clever systems work and tightening theoretical bounds via additional assumptions and clever reasoning we might get to practical implementations for some applications. As (maybe weak) evidence the progress on practical implementations of PCPs/SNARGs https://dl.acm.org/doi/pdf/10.1145/2641562 https://dl.acm.org/doi/pdf/10.1145/2641562
- rhindi 4y ago
  It’s much much faster now, and performance is improving 10x every couple of year. With the current trend, FHE will be applicable to 80% of usecases by 2025
nomnoms 4y ago
Performance is still problematic for many applications (particularly in ML). Our team has been working on making FHE more accessible to engineers via a compiler; we've found usability to be a much bigger obstacle than performance. You might be surprised to see how far performance has come! For (an admittedly small example of) matrix-vector multiplication, we can do key generation, encryption, computation, decryption, and compilation in less than 5 seconds on a MacBook [0]. [0]: https://playground.sunscreen.tech/ https://playground.sunscreen.tech/

wazoox 4y ago

I've just watched a presentation about Cosmian (https://cosmian.com/ https://cosmian.com/) and their solution boasts using FHE, at a significant price though: computations and queries are about 1000 slower than on unencrypted data according to their CTO. I was quite impressed that it even works at all, though :)

hinkley 4y ago
Don’t those sorts of differences suggest that perhaps enclave decryption would be as fast and support more functionality?
- wazoox 4y ago
  Probably but the main objective is to keep data safe in the cloud while keeping everything encrypted (traffic and data), all the time.
  - hinkley 4y ago
    That's certainly fair. One of the oldest classic physical security failures I know of, which really stuck with me, is "who did background checks on the janitors?" It doesn't literally have to be janitors, but there are a lot of people in your space that we assume are not threats, even though there is a lot of overlap between "hacker" and "people who work for vendors". I knew someone who was responsible for delivering backups from a secure data center to a lockbox every couple of days. Unfortunately the bank was only a few blocks from the data center so I'm not sure how much physical separation that really provided. Also this particular person would have been able to do absolutely nothing about being mugged for the disks if someone actually cared. But maybe I'm a little too paranoid. I recall once having to drop the night's deposit off from the restaurant I worked at. They were down a manager due to illness, it was on the way home, I was a figurative if no longer a literal boyscout, so the math on "shenanigans if hinkley leaves with the money" versus "shenanigans if there is no night manager in the store" apparently leaned toward me. I'm glad they trusted me but I was a nervous wreck for four blocks until that bag went into the night deposit box. Anything that can move "precious cargo" without a human failure mode is alright in my book.

anonporridge 4y ago

Spiral is an interesting use case of FME for database fetching that just popped up, https://usespiral.com/ https://usespiral.com/ General FME computation is obviously not likely to be practical or cost effective any time soon, but there may be some specific use cases, like querying a database, where hiding the information you want to know from the server is advantageous. There are adversarial environments where knowing the information your adversary is interested in provides a competitive edge. I'm curious to dig more into their implementation.

blintz 4y ago
Happy to answer any questions! Yeah, we're taking a narrow application (fetching from a database) and making it really practical. You can privately check a Bitcoin balance at https://btc.usespiral.com https://btc.usespiral.com or privately read Wikipedia at https://spiralwiki.com https://spiralwiki.com. Our code for the Bitcoin site is at https://github.com/spiralprivacy/clients https://github.com/spiralprivacy/clients.

aliswe 4y ago

I know its low effort, but would an anti-homomorphic encryptionist be regarded homophobic?

rogers18445 4y ago

What is the actual value proposition of HE? The purpose of encryption is to hide information, if you are able to to do any meaningful comparison between two encrypted records, you have an information leak, and encryption has failed.

AaronFriel 4y ago
The value proposition is that the hosting provider running your computation does not know what was computed.
sillysaurusx 4y ago
Imagine running an inference on a model in the cloud. Usually the cloud will have access to your model. That poses a problem if your model is highly sensitive. (Imagine the NSA wanting to run a model on North Korean servers. NK would immediately snatch up that model.) With FHE, you can theoretically avoid that. Someone can upload an encrypted model to the cloud. The cloud can do some computation on it (inference) and deliver an encrypted result. Then you can decrypt the result in the comfort of your own government^Whome. Obviously this is a bit of a stupid example, but just think of all the scenarios right now where you'd want to offload your computation on someone else, but you don't want to let them see the computation.
pmarreck 4y ago
There is no information leak, because the information is never decrypted. The encrypted operations are performed directly on the encrypted data and the still-encrypted result is returned to the client, to be decrypted at their convenience to view the result. That is the magic of FHE. Two identical cleartext values would likely not encrypt to the same ciphertext value (for example, you could get around that easily on the client end by simply incrementing any duplicate value by 1 before sending and then decrementing it by 1 again on return, assuming that is done undoably given the other operations happening); any comparison operation would also likely be encrypted and thus unknown to the server; so the server couldn't just linearly compare any two encrypted values to make deductions.

kebman 4y ago

Looks like some kind of ad that tries to discredit regular encryption by claiming that it's already compromised (it isn't), or that it will be very soon. But lo! Here is the knight in shining armour coming to the rescue (FHE)! Soon. Maybe.

foolfoolz 4y ago
fhe solves a ton of issues in sass products that don’t look great under audit. things where we sign off on audit today with fancy contracts called “data privacy agreements.” i think it will take some time (20 years?) but i expect zero knowledge for most of your data to be table stakes for saas offerings
- autoexec 4y ago
  Saas is all about collecting, controlling, and exploiting your data though. If they can still mine your data and leverage or sell the information they get out of it that's not really "zero knowledge". I don't expect companies will stop being interested in making money at all costs in 20 years, especially where the costs are mostly to you and your privacy.
  - solveit 4y ago
    Actually saas is about providing services for money.
    - autoexec 4y ago
      Money and control is what it's about. That usually means making someone dependent on you in order to access/use their own stuff, making it hard to migrate their data away from your service, and taking every advantage of the data being collecting. I've never seen a saas product that isn't using and/or "sharing" their customer's data for their own benefit somehow. If they exist at all, they're the exception and not the rule.
      - 4y ago

RadixDLT 4y ago

here is a good project with HE https://github.com/deroproject/derohe https://github.com/deroproject/derohe

avmich 4y ago

> To achieve unrestricted homomorphic computation, or FHE, you must choose F to be a set of functions that is complete for all computation (e.g., Turing complete). The two functions required to achieve this goal are bit Addition (equivalent to Boolean XOR) and bit Multiplication (equivalent to Boolean AND), as the set {XOR, AND} is Turing complete. This - "set {XOR, AND} is Turing complete" - is incorrect. You need to also have "true" constant.

ravi545 4y ago

200+ Top High-Quality Dofollow Backlinks Sites List: Many People Wanted To Create Backlinks But They Don't Know That Where To Create Backlinks And Which Website Are Best For Creating Backlinks So Guys If You Are Also One Of Them Then Don't You Worry Because I Will Guide You And Will Provide You Top 200+ Best Quality Dofollow Backlinks Site List Which Will Help You To Increase Your Website Domain Authority Your Website Domain Rating Page Authority And Many More