Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

TFHE: Fast Fully-Homomorphic Encryption Over the Torus

tfhe.github.io

Post reply on HN
Print view View original

21–30 of 98 posts

Re: TFHE: Fast Fully-Homomorphic Encryption Over the Torus

#21

Post by lisper »

tveita wrote: post #19
tome wrote: post #5

What operations can I do homomorphically with this library? The page says "With the cloud-keyset, the library can evaluate a net-list of binary gates homomorphically at a rate of about 50 gates per second per core, without decrypting its input. It suffices to provide the sequence of gates, as well as ciphertexts of the input bits. And the library computes ciphertexts of the output bits." but what does "evaluating a n…

"The library supports the homomorphic evaluation of the 10 binary gates (And, Or, Xor, Nand, Nor, etc…), as well as the negation and the Mux gate." So you'd program it by designing a digital circuit using AND, OR, and NOT gates, somewhat similar to how you would make a circuit with physical components. You have millions, maybe billions of these gates in your CPU, each capable of doing millions of calculations for eac…

It's fast relative to the previous state of the art in homomorphic encryption. But the path to practical applications is always paved with incremental improvements.

Re: TFHE: Fast Fully-Homomorphic Encryption Over the Torus

#22

Post by rocqua »

striking wrote: post #17
mSparks43 wrote: post #15

Earlier quoted context omitted.

have to say, i'm extremely skeptical of homomorphic encryption. it just screams side channel attacks. so skeptical i dont have the energy to find them, better to wait until something with monetary value is cruising around the internet using it.

Homomorphic programs are designed to run without knowledge of the key. You have to process every piece of data in basically the same way. So I'm not entirely sure where you think the side-channel attack would arise.

My first guess would be conditionals, but I'd guess there is no real branching in the execution of operations on data. Another would be evaluating comparisons, but those aren't very easy to do in bitwise terms, and you can't read the output either.

Re: TFHE: Fast Fully-Homomorphic Encryption Over the Torus

#23

Post by simcop2387 »

tveita wrote: post #19
tome wrote: post #5

What operations can I do homomorphically with this library? The page says "With the cloud-keyset, the library can evaluate a net-list of binary gates homomorphically at a rate of about 50 gates per second per core, without decrypting its input. It suffices to provide the sequence of gates, as well as ciphertexts of the input bits. And the library computes ciphertexts of the output bits." but what does "evaluating a n…

"The library supports the homomorphic evaluation of the 10 binary gates (And, Or, Xor, Nand, Nor, etc…), as well as the negation and the Mux gate." So you'd program it by designing a digital circuit using AND, OR, and NOT gates, somewhat similar to how you would make a circuit with physical components. You have millions, maybe billions of these gates in your CPU, each capable of doing millions of calculations for eac…

I wonder then how implementable this is in an FPGA for accelerating the whole thing? This could be a killer use of the FPGA instances on AWS and similar cloud services.

Re: TFHE: Fast Fully-Homomorphic Encryption Over the Torus

#24

Post by modalduality »

skybrian wrote: post #14
tome wrote: post #5

What operations can I do homomorphically with this library? The page says "With the cloud-keyset, the library can evaluate a net-list of binary gates homomorphically at a rate of about 50 gates per second per core, without decrypting its input. It suffices to provide the sequence of gates, as well as ciphertexts of the input bits. And the library computes ciphertexts of the output bits." but what does "evaluating a n…

I haven't studied this much, but to speculate, it sounds like each gate is a boolean expression (AND, OR, XOR, NOT). So this lets you compute boolean functions on bits. I don't see a way to compute a loop, though, other than perhaps to unroll it and send lots of instructions. Also, 50ms per bit operation, though apparently an improvement, sounds extremely inefficient compared to normal programming.

In general it's much easier to reason about Boolean circuits because they always have an answer, unlike arbitrary programs that may never halt, for example, so you see a lot of theoretic results focusing on Boolean circuits (sometimes with limitations on the depth) instead.

Early on it was thought that considering circuits instead of regular programs could result in "polynomial with advice" algorithms for NP-complete problems, but results such as the Karp-Lipton theorem have shown this to be unlikely.

Re: TFHE: Fast Fully-Homomorphic Encryption Over the Torus

#25

Post by mSparks43 »

striking wrote: post #17
mSparks43 wrote: post #15

Earlier quoted context omitted.

have to say, i'm extremely skeptical of homomorphic encryption. it just screams side channel attacks. so skeptical i dont have the energy to find them, better to wait until something with monetary value is cruising around the internet using it.

Homomorphic programs are designed to run without knowledge of the key. You have to process every piece of data in basically the same way. So I'm not entirely sure where you think the side-channel attack would arise.

because the simple fact you can process the data and examine the output reveals untold quantities of information about the key.

the known plaintext attack breaks pretty much every crypto system, mix that with statistical analysis of this "processing" and I'm sure whatever is in the cloud will surrender its secrets pretty quick.

And all that risk for what benefit? none of this processing will ever be faster than doing the processing in place.

Re: TFHE: Fast Fully-Homomorphic Encryption Over the Torus

#26

Post by michwill »

That's a seriously cool thing to have in the toolbox!

Does it produce only encrypted output, or can it optionally produce unencrypted results also? Can it optionally use public data as an input?

Also I am guessing if it could be accelerated on GPUs. I worked with a guy who accelerated a standard FFT on CUDA 100..1000 times for scientific computations (and later NVidia copied his code, lol). I wonder if something similar can be done here

Re: TFHE: Fast Fully-Homomorphic Encryption Over the Torus

#27

Post by proofofstake »

saganus wrote: post #6

This looks very interesting! However, not being an expert on FHE, is there a way to leverage this on current RDBMS systems for example? It says the library can evaluate binary gates. If we would like to run a SQL query for example, how do we translate it to a series of gates? Is it possible? Or is this so low level that we basically would need to build our own "processor" with binary gates and then build the rest of…

https://www.youtube.com/watch?v=xsaXMUelOEA "CryptDB: Processing Queries on an Encrypted Database - Microsoft Research"

Re: TFHE: Fast Fully-Homomorphic Encryption Over the Torus

#28

Post by SilasX »

striking wrote: post #16
EGreg wrote: post #3

Is this available now? Can we do fast homomorphic encryption baby??

"Each binary gate takes about 20 milliseconds single-core time to evaluate" So yes, for varying definitions of "fast".

If you equate a binary gate operation with an instruction, then that's 50 instructions per second, which compares to UNIVAC's 2000 IPS (0.002 MIPS).

https://en.wikipedia.org/wiki/Instructions_per_second#Timeli...

Of course, an op on a single bit is still far short of a CPU instruction, AIUI.

You gotta start somewhere though!

Re: TFHE: Fast Fully-Homomorphic Encryption Over the Torus

#29

Post by proofofstake »

sandGorgon wrote: post #10

Will this be useful for machine learning in the same way as this ? https://medium.com/numerai/encrypted-data-for-efficient-mark...

Yes, but not to the same degree. Numerai uses structure-preserving encryption / neural encryption. This allows people to use any existing machine learning algorithm on the data. For fully homomorphic encryption you would need specialized algorithms. These are way more difficult to design. They also run slower.

Re: TFHE: Fast Fully-Homomorphic Encryption Over the Torus

#30

Post by hmottestad »

michwill wrote: post #26

That's a seriously cool thing to have in the toolbox! Does it produce only encrypted output, or can it optionally produce unencrypted results also? Can it optionally use public data as an input? Also I am guessing if it could be accelerated on GPUs. I worked with a guy who accelerated a standard FFT on CUDA 100..1000 times for scientific computations (and later NVidia copied his code, lol). I wonder if something simi…

The point is to be able to give encrypted data to a third party and have them do operations on that data (ex. sum all the values) and give you an encrypted result back.

tldr. computations in the cloud with encrypted, private data

Post reply on HN