10 ms·
Intel Demos Chip to Compute with Encrypted Data
- esseph 8mo agoEverything about this in my head screams "bad idea". If you need to trust the encryption and trust the hardware itself, it may not be suitable for your environment/ threat model.
- gruez 8mo ago>If you need to trust the encryption and trust the hardware itself, it may not be suitable for your environment/ threat model. Are we reading the same article? It's talking about homorphic encryption, ie. doing mathematical operations on already encrypted data, without being aware of its cleartext contents. It's not related to SGX or other trusted computing technologies.
- esseph 8mo agoI updated another comment above, but FHE is also being advertised for use for securing crypto transactions and smart contracts. "We believe that just like the internet went from zero encryption with HTTP to encrypting data in transit with HTTPS, the next natural step will be to use FHE to enable end-to-end encryption by default in every application, something we call HTTPZ"
- cwmma 8mo agoIn theory you only need to trust the hardware to be correct, since it doesn't have the decryption key the worst it can do is give you a wrong answer. In theory.
- esseph 8mo agoBut can you trust the hardware encryption to not be backdoored, by design? That's my point, this sounds like a way to create a backdoor for at-rest data.
- cassonmars 8mo agoYou can if the manufacturer has a track record that refutes the notion, and especially if they have verifiable hardware matching publicly disclosed circuit designs. But this is Intel, with their track record, I wouldn't trust it even if the schematics were public. Intel ME not being disable-able by consumers, while being entirely omitted for certain classes of government buyers tells me everything I need to know.
- bilekas 8mo ago> That's my point, this sounds like a way to create a backdoor for at-rest data. I get the feeling honestly it seems more expensive and more effort to backdoor it..
- jayd16 8mo agoBy design, you don't trust it. You never hand out the keys so there's no secret to back door. The task is never unencrypted, at rest or otherwise.
- anon291 8mo agoWell yeah... You do the initial encryption yourself by whatever means you trust
- rjmunro 7mo agoThere is no hardware encryption or decryption. I encrypt some data and keep the key. I send the encrypted data to you (probably some cloud provider). I tell you to do some operations on the data. I don't tell you the key or what the data is or what the operations mean. You send the results back to me. I use the key to decrypt them. You have helped me with my compute task, but the data you have is totally meaningless without the key, and only I have the key. It's hard to believe that it's possible to make encryption where this can do useful work, but it is.
- u1hcw9nx 8mo agoIn FHE the hardware running it don't know the secrets. That's the point. First you encrypt the data. Then you send it to hardware to compute, get result back and decrypt it.
- Foobar8568 8mo agoBut you leak all type of information and and the retrieve either leak even more data or you'll end up with transferring a god knows amount of data or your encryption is trivially broken or spend days/month/years to unencrypt.
- bilekas 8mo agoI don't know how you got these ideas but when you crack it, do make sure to write a post about it. Can't wait for that writeup.
- Foobar8568 8mo agoLWE estimator isn't a proxy for this?
- anon291 8mo agoMath literacy needs to become standard for computer scientists. These takes are so bad
- Foobar8568 8mo agoOr reading papers on the subjects, and playing with implementing FHE search.
- spicymaki 8mo agoYeah it pretty clear that many people in the HN community have no idea what this is and yet they have takes. It makes me wonder...
- numpad0 8mo agoIt is a bad idea but not in the way you think. FHE hardware don't decrypt data on-chip. It's like using the Diffie-Hellman key exchange for general computation. The data and operations stay encrypted at any given moment while outside your client device. The textbook example application of FHE is phone book search. The server "multiply" the whole phonebook database file with your encrypted query, and sends back the whole database file to you every time regardless of queries. When you decrypt the file with the key used to encrypt the query, the database is all corrupt and garbled except for the rows matching the query, thereby causing the search to have practically occurred. The only information that exists in the clear are query and the size of entire database. Sounds fantastically energy-efficient, no? That's the problem with FHE, not risks of backdooring.
- esseph 8mo agoSo one of the potential use cases mentioned is for secure data transfer. So here's my question: Could FHE hardware be used to extremely quickly and reliably secure something like a database connection? I looked through Gemini, and it says the following: "Zama are building libraries that use FHE accelerators to allow "Confidential Smart Contracts" or private AI queries. You could send a highly sensitive health query to an AI, and the AI hardware would process it and send the answer back without the AI company ever knowing what you asked." https://www.zama.org/ https://www.zama.org/ Which is why I ask. Because if you have a backdoor into the hardware, as either a corporation or a government, then you can get access to those "very sensitive and fully secured communications". They also discuss a crypto / smart contracts use case, and advertise " securing L1 or L2".
- deleted 7mo ago[deleted]
- zvqcMMV6Zcr 8mo ago> Heracles, which sped up FHE computing tasks as much as 5,000-fold compared to a top-of the-line Intel server CPU. That is nice speed-up compared to generic hardware but everyone probably wants to know how much slower it is than performing same operations on plain text data? I am sure 50% penalty is acceptable, 95% is probably not.
- corysama 8mo agoThere are applications that are currently doing this without hardware support and accepting much worse than 95% performance loss to do so. This hardware won’t make the technique attractive for ALL computation. But, it could dramatically increase the range of applications.
- bobbiechen 8mo agoAgreed. When I was working on TEEs/confidential computing, just about everyone agreed that FHE was conceptually attractive (trust the math instead of trusting a hardware vendor) but the overhead of FHE was so insanely high. Think 1000x slowdowns turning your hour-long batch job into something that takes over a month to run instead.
- deleted 8mo ago[deleted]
- patchnull 8mo ago[flagged]
- tromp 8mo ago10,000x to 100,000x / 5,000x = 2 to 10x, not 20 to 100x.
- Foobar8568 8mo agoNow we know why Intel more or less abandonned SEAL and rejected GPU requests.
- freedomben 8mo agoPerhaps it's a cynical way to look at it, but in the days of the war on general purpose computing, and locked-down devices, I have to consider the news in terms of how it could be used against the users and device owners. I don't know enough to provide useful analysis so I won't try, but instead pose as questions to the much smarter people who might have some interesting thoughts to share. There are two, non-exclusive paths I'm thinking at the moment: 1. DRM: Might this enable a next level of DRM? 2. Hardware attestation: Might this enable a deeper level of hardware attestation?
- gruez 8mo agoSee: https://news.ycombinator.com/item?id=47323743 https://news.ycombinator.com/item?id=47323743 It's not related to DRM or trusted computing.
- inetknght 8mo agoNot yet.
- gruez 8mo agoWhat does that even mean? A: "Intel/AMD is adding instructions to accelerate AES" B: "Might this enable a next level of DRM? Might this enable a deeper level of hardware attestation?" A: "wtf are you talking about? It's just instructions to make certain types of computations faster, it has nothing to do with DRM or hardware attestation." B: "Not yet." I'm sure in some way it probably helps DRM or hardware attestation to some extent, but not any more than say, 3nm process node helps DRM or hardware attestation by making it faster.
- fc417fc802 8mo agoIf this were similar to SGX (which is what I initially assumed) then "not yet" is a perfectly reasonable position to take. However it's actually homomorphic encryption implemented in hardware thus not relevant to DRM (AFAIK). That said, the unfortunate reality is that the same constructs that underpin DRM are also required to build a secure system. The only difference is who controls the root of trust. As such the problems with DRM (and hardware ownership more generally) are political as opposed to technical in nature.
- deleted 8mo ago[deleted]
- mmaunder 8mo agoSomeone explain how you'd create a vector embedding using homomorphically encrypted data, without decrypting it. Seems like a catch 22. You don't get to know the semantic meaning, but need the semantic meaning to position it in high dimensional space. I guess the point I'm making is that sure, you can sell compute for FHE, but you quickly run up against a hard limit on any value added SaaS you can provide the customer. This feels like a solution that's being shoehorned in because cloud providers really really really want to have a customer use their data center, when in truth the best solution would be a secure facility for the customer so that applications can actually understand the data they're working with.
- bob1029 8mo agoMost of modern machine learning is effectively linear algebra. We can achieve semantic search over encrypted vectors if the encryption relies on similar principles.
- Chance-Device 8mo agoFHE is the future of AI. I predict local models with encrypted weights will become the norm. Both privacy preserving (insofar as anything on our devices can be) and locked down to prevent misuse. It may not be pretty but I think this is where we will end up.
- boramalper 8mo agoIf you're interested in "private AI", see Confer [0] by Moxie Marlinspike, the founder of Signal private messaging app. They go into more detail in their blog. [1] [0] https://confer.to/ https://confer.to/ [1] https://confer.to/blog/2025/12/confessions-to-a-data-lake/ https://confer.to/blog/2025/12/confessions-to-a-data-lake/
- CamperBob2 8mo agoI don't get how this can work, and Moxie (or rather his LLM) never bothers to explain. How can an LLM possibly exchange encrypted text with the user without decrypting it? The correct solution isn't yet another cloud service, but rather local models.
- boramalper 8mo agoThey explain it in Private inference [0] if you want to read about it. [0] https://confer.to/blog/2026/01/private-inference/ https://confer.to/blog/2026/01/private-inference/
- FrasiertheLion 8mo agoThe model is running in a secure enclave that spans the GPU using NVIDIA Confidential Computing: https://www.nvidia.com/en-us/data-center/solutions/confidential-computing/ https://www.nvidia.com/en-us/data-center/solutions/confident.... The connection is encrypted with a key that is only accessible inside the enclave. Within the enclave itself, DRAM and PCIe connections between the CPU and GPU are encrypted, but the CPU registers and the GPU onboard memory are plaintext. So the computation is happening on plaintext data, it’s just extremely difficult to access it from even the machine running the enclave.
- JanoMartinez 8mo agoOne thing I'm curious about is whether this could change how cloud providers handle sensitive workloads. If computation can happen directly on encrypted data, does that reduce the need for trusted environments like SGX/TEE, or does it mostly complement them?
- anon291 8mo agoIf it were as fast as a normal chip, it would obviate the need
- gigatexal 8mo agoIf they can get this shrunk down and efficient enough in a future scenario I think Apple could move back to Intel for this with their stance on encryption and things it being a pillar of their image.
- Joel_Mckay 8mo agoNot going to happen anytime soon, as the modern M4/ARM unified memory with on-chip GPU is years ahead of Intel. The software ecosystem is slowly growing to leverage this chip architecture, and due to the annoying PC RAM, SSD, and RTX GPU shenanigans it is no longer the lower value option. The PC market was made shitty enough this year, that Mid/High class Mac Pro/laptops are actually often a better value deal now (if and only if your use-case is covered software wise.) Intel does plan on a RTX + amd64 SoC soon, but still pooched the memory interface with a 30 year old mailbox kludge. Intel probably wont survive this choice without bailouts. =3
- bigyabai 8mo ago> (if and only if your use-case is covered software wise.) Judging by Nvidia's current valuation, that's a parenthetical worth ~4 trillion dollars. Apple isn't muscling AMD or Nvidia out of the datacenter anytime soon, and they're basically feeding Intel Foundry customers by dominating TSMC fab capacity. Apple's contribution to the chip shortage is so bad that even they have considered using Intel Foundry Services: https://www.macrumors.com/2025/11/28/intel-rumored-to-supply-new-mac-chip/ https://www.macrumors.com/2025/11/28/intel-rumored-to-supply... It's been 7 years of Apple Silicon and the macOS market share really hasn't shifted much. The Year Of Apple Silicon For People Whose Use-Case Is Covered Software Wise was 2019; the majority of remaining customers aren't showing any interest.
- Joel_Mckay 8mo ago> It's been 7 years of Apple Silicon and the macOS market share really hasn't shifted much Indeed, but a local LLM finishing in 3 days instead of 1 on a $40k GPU changes the economic decision priority for some. Apple sales grew "21.3% year-over-year as of the second quarter of 2025", but also sales flattened as supply chain pricing shocks from "AI"/tariffs hit late last year. "Judging by Nvidia's current valuation" is a bad bet with current circular investment conditions. We shall see, but as EOL drivers and OS rot hits legacy NVIDIA hardware... people are going to have to find some compromise in the next 2 years. Even AMD 9850X3D currently cost less than 64G of low end PC ddr5 memory. Odd times for sure =3
- darig 8mo ago[dead]
- newzino 8mo ago[flagged]
- bilekas 8mo agoThis is incredible work.. And makes the technology absolutely viable. However... In a world where privacy is constantly being eroded intentionally by governments and private companies, I think this will NEVER, ever reach any consumer grade hardware. My cynic could envision the technology export ban worldwide in the vein of RSA [0] . Why would any company offer the customers real out of the box e2e encryption possibilities built into their devices. DRM was mentioned by another user. This will not be used to enable privacy for the masses. https://en.wikipedia.org/wiki/Export_of_cryptography_from_the_United_States https://en.wikipedia.org/wiki/Export_of_cryptography_from_th...
- FrasiertheLion 8mo agoArguably this is less useful for consumer hardware in the first place. This is mostly useful when I don’t trust the service provider with my data but still need to use their services (casting my vote, encrypted inference, and so forth)
- bilekas 8mo agoTrue, in the case of casting a vote though for example, I would see it being used within the voting machines itself before sending off to be counted. Good application. But getting them available for customers for example say even a PCIe card or something and then that automatically encrypting everything you ever run today over an encrypted connection would be a dream.
- autoexec 8mo ago> In a world where privacy is constantly being eroded intentionally by governments and private companies, I think this will NEVER, ever reach any consumer grade hardware. Why not when government can just force companies to backdoor their hardware for them. That way users are secure most of the time except from the government (until the backdoor in intel's chips gets discovered anyway), and users have a false sense of security/privacy so people are more likely to share their secrets with corporations and the government gets to spy on people communicating more openly with each other.
- jpauline 8mo agoThis is a huge win for cybersecurity and data privacy.
- bokohut 8mo agoFirst and foremost, grateful for the ability to take and give to this HN community for what HN has done for me. With that stated I am reminded near daily when reading posts on HN of my experience, my age, and some of my now lost hair color. After nearly 3 decades of critical technology systems architecture and management involving ongoing industry audits my experience and age knows why my hair has lost some of its color. Much of that lost color comes from security management of third party systems, yes the old dreaded dependencies. Elimination of those third parties is key for one's cyber sanity and hair color yet with technology still in its infancy some cannot distinguish the forest from the trees. Nothing remains the same as progress moves forward correcting for past mistakes while learning what works and does not along that journey, technology platforms are no exception. Analogously early automobiles lacked safety features as well such as windshield wipers and seatbelts so has the passage of time proved their addition to be valued? Few people today truly understand how things work as nearly all just want the instant fix "pill" to alleviate their issues however this approach cannot work with security. True security is designed in from the foundation and such secure platforms go unseen yet we have an endless list of victims from those insecure systems which have "bolted on" security after the fact. This security change and more is coming to system designs as the entire world is now fully aware of cyber security, or in this case, the lack of it. Time, the young fail to consider it up until a single moment in their life, while the old reflect on where theirs went. After the reflection of one's time however change becomes obvious.
- bitexploder 8mo agoHow does this relate to chip based homomorphic encryption? Just curious.
- bokohut 7mo agoThis share link has direct ties to my current technology designs I am developing but since the majority of systems work goes unseen many do not care as nearly all just want it to work when they need it. Design always changes over time yet many neglect to consider time within their moment of thought and thus those who fail to comprehend the long term need of such security changes. I have been fortunate to have lived and been involved in this change several times in my life and comparable too exactly this design change are the countless folks in the mid 1990's that told me no one would be buying things online as I architected and developed an online payments platform. After many decades of building secure technologies, some of which that has been acquired, this security critical technique addresses a growing problem that is impacting everyone, even those not yet connected. What you cannot see matters most!
- yalogin 8mo agoFHE is great, if we can get this to work at scale and if this can be baked into the GPU complex, we don’t need the confidential compute pipeline. Of course we will still need to manage the user keys, so the current confidential pipeline will just be replaced with something else, but hopefully managing large amounts of data will become simpler. Not sure where the tech is but it could be a game changer for security. It still doesn’t eliminate the bad corporation issue though. We still rely on code they run on the servers inside the FHE.
- bawolff 8mo ago> homomorphic encryption chip speeds operations 5,000-fold 5000 * 0 is still 0. I joke, but i think relative numbers like this are very misleading as FHE is starting from such an absurdly slow place. Still, this is pretty cool and there are probably niche applications that become possible with this, but i think this is a small enough speed up that it is still very niche.
- zvr 8mo agoFor anyone interested, the corresponding software has been released under an Open Source license: https://github.com/IntelLabs/encrypted-computing-sdk https://github.com/IntelLabs/encrypted-computing-sdk
- kittikitti 7mo agoI find it petty for Intel to describe more software-based solutions to fully homomorphic encryption (FHM) as "software cheats". This is especially since their competition, Duality Technologies, specializes more on the software side and they are certainly much smaller in size. When you have giant corporations like Intel being able to label their smaller competition's technology as "software cheats", then it becomes an incredibly toxic environment. If anyone were to do it to Intel, they would be sued for libel and slander and other anti-competitive tactics. However, I shouldn't be surprised. The industry normalizes this type of discourse. At the same time, the same giant corporations will preach about AI safety and claim you can only trust them with it. That being said, this is a great innovation by Intel. I was impressed at their technology and the thorough discussion about how this type of computing is related to GPU's and CPU's. It's especially interesting given the emergence of computational memory applications.
- sota_pop 7mo agoIs this whole concept essentially a fundamental misunderstanding of the difference between "encryption" and "encoding"? I don't mean to be pedantic and don't want to make assumptions due to my respect for the source, but I don't understand how you can meaningfully manipulate the data that has been _actually_ encrypted? Doesn't the ability to accurately manipulate it imply that you have some understanding of its underlying meaning? The article is light on algorithmic details: > "...a mathematical transformation, sort of like the Fourier transform. It encrypts data using a quantum-computer-proof algorithm..." I am assuming there is some deep learning at play here i.e. it is manipulating the data within the latent space. If this is true, then would the embedding process really be considered "encryption"? You could argue it is security through obscurity (in the sense that the latent space basis is arbitrary/learned), but it feels like two different things to me.
- subset 7mo ago(Disclaimer: I am not a cryptographer and this is a heavily simplified explanation). Homomorphic encryption is built on the foundation of 'hard problems' (e.g. the Learning with Errors Problem) - loosely, computational problems that are thought to be impossible to reverse without being in the possession of a secret key. The crux of HE is that it provides a _homomorphism_: you map from the space of plaintext to the space of cipher texts, but the mapping preserves arithmetic properties such as addition and multiplication. To be clear - this means that the server can add and multiply the cipher texts, but the plaintext result of that operation is still irreversible without the private key. To the server, it looks like random noise. I don't think it's helpful to think about this as connected to deep learning or embedding spaces. An excellent resource I'd recommend is Jeremy Kun's guide: https://www.jeremykun.com/2024/05/04/fhe-overview/ https://www.jeremykun.com/2024/05/04/fhe-overview/