Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

TFHE: Fast Fully-Homomorphic Encryption Over the Torus

tfhe.github.io

Post reply on HN
Print view View original

41–50 of 98 posts

Re: TFHE: Fast Fully-Homomorphic Encryption Over the Torus

#41

Post by yorwba »

mSparks43 wrote: post #25
striking wrote: post #17

Earlier quoted context omitted.

Homomorphic programs are designed to run without knowledge of the key. You have to process every piece of data in basically the same way. So I'm not entirely sure where you think the side-channel attack would arise.

because the simple fact you can process the data and examine the output reveals untold quantities of information about the key. the known plaintext attack breaks pretty much every crypto system, mix that with statistical analysis of this "processing" and I'm sure whatever is in the cloud will surrender its secrets pretty quick. And all that risk for what benefit? none of this processing will ever be faster than doing…

> And all that risk for what benefit? none of this processing will ever be faster than doing the processing in place.

The benefit comes into play when you mix data from different sources that don't trust each other (to the point where they would never agree to one of them doing the processing in place). Homomorphic encryption allows combining the data without ever revealing it to the one doing the computation.

Re: TFHE: Fast Fully-Homomorphic Encryption Over the Torus

#42

Post by lkowalcz »

sandGorgon wrote: post #39
lkowalcz wrote: post #34

Earlier quoted context omitted.

Worth pointing out that Numerai actually doesn't use encryption in any standard sense (including structure-preserving encryption), but instead seems to be using some heuristic method of obfuscating their data. Their (closed-source) method of obfuscating their data apparently does have the property that it preserves the structure of the data, but calling it "structure-preserving encryption" is misleading imo since it…

Interesting. Any insight into what specific algorithms these are ? I would love to play around with my own data this way. It wouldn't be a simple hash or something, would it ?

I suspect they might just be anonymizing their features (removing any labels), then normalizing them to [0,1].

Re: TFHE: Fast Fully-Homomorphic Encryption Over the Torus

#43

Post by striking »

mSparks43 wrote: post #25
striking wrote: post #17

Earlier quoted context omitted.

Homomorphic programs are designed to run without knowledge of the key. You have to process every piece of data in basically the same way. So I'm not entirely sure where you think the side-channel attack would arise.

because the simple fact you can process the data and examine the output reveals untold quantities of information about the key. the known plaintext attack breaks pretty much every crypto system, mix that with statistical analysis of this "processing" and I'm sure whatever is in the cloud will surrender its secrets pretty quick. And all that risk for what benefit? none of this processing will ever be faster than doing…

You can examine the output and so on, but that's not a side-channel attack, which is what I was responding to.

And yes, it is a malleable cryptosystem, but that doesn't imply you can learn the key from an input/output pair, nor does it imply you can read the input given to you. It just means you can change the output in a way that can still be decrypted by the same key.

Usually people use padding and IVs and such to prevent that, but this system is made to allow computation with it instead.

Certainly there may be some flaw that we can't see yet, but to say you're "sure" some secrets will be quickly surrendered seems foolhardy.

> And all that risk for what benefit?

It's very interesting from a theoretical perspective, and it's good to know that if you need to carry out computation on devices you don't trust, it is at least possible to prevent your input and output from being stolen.

This is already a 30x increase in efficiency from the last generation. It may never be faster, but there's always a chance someone will find other reasons to use it.

Re: TFHE: Fast Fully-Homomorphic Encryption Over the Torus

#44

Post by proofofstake »

lkowalcz wrote: post #34
proofofstake wrote: post #29

Earlier quoted context omitted.

Yes, but not to the same degree. Numerai uses structure-preserving encryption / neural encryption. This allows people to use any existing machine learning algorithm on the data. For fully homomorphic encryption you would need specialized algorithms. These are way more difficult to design. They also run slower.

Worth pointing out that Numerai actually doesn't use encryption in any standard sense (including structure-preserving encryption), but instead seems to be using some heuristic method of obfuscating their data. Their (closed-source) method of obfuscating their data apparently does have the property that it preserves the structure of the data, but calling it "structure-preserving encryption" is misleading imo since it…

They switched from structure-preserving encryption to neural encryption (using a neural net's layer activations).

> Just a few months ago this package was released by Louis Aslett at Oxford http://www.louisaslett.com/HomomorphicEncryption/. Louis helped me use his package to do Fan and Vercauteren homomorphic encryption on my dataset. Because the ciphertexts are polynomials it's not too easy for an average data scientist to use the data. That's why I came up with more chill ways of encrypting Numerai's data that the article mentions like order-preserving encryption. There's a security vs easy of use trade off, for sure. But homomorphic encryption is a real thing.

https://www.reddit.com/r/MachineLearning/comments/3zvuge/enc...

Louis Aslett authored https://arxiv.org/abs/1508.06574

Re: TFHE: Fast Fully-Homomorphic Encryption Over the Torus

#45

Post by schoen »

rocqua wrote: post #22
striking wrote: post #17

Earlier quoted context omitted.

Homomorphic programs are designed to run without knowledge of the key. You have to process every piece of data in basically the same way. So I'm not entirely sure where you think the side-channel attack would arise.

My first guess would be conditionals, but I'd guess there is no real branching in the execution of operations on data. Another would be evaluating comparisons, but those aren't very easy to do in bitwise terms, and you can't read the output either.

But the thing about this setting is that you don't possess the secrets, so you can't reveal the secrets by noticing how long things take.

An analogy to think about might be blind signatures. In blind signatures you sign a blinded token and then the other party can unblind it to get a valid signature from you over a message whose content you don't know. This is classical public-key cryptography. In that case there is a secret key, and a timing attack against someone who can observe the signature creation might reveal that key. The connection between the blinded and unblinded message is also meant to be secret, and a timing attack against someone performing the blinding or unblinding operations might also reveal that relationship.

However, there is no timing attack that the signer can perform against itself to reveal the relationship between the blinded and unblinded messages, and there is no timing attack that the other party can perform against itself to reveal the secret key.

I think this analogy holds up for most purposes (indeed, blind signatures can be viewed as an extremely specific, narrow kind of homomorphic encryption), but I'd be happy to hear corrections if someone can see a way that it doesn't.

Re: TFHE: Fast Fully-Homomorphic Encryption Over the Torus

#46

Post by lkowalcz »

proofofstake wrote: post #44
lkowalcz wrote: post #34

Earlier quoted context omitted.

Worth pointing out that Numerai actually doesn't use encryption in any standard sense (including structure-preserving encryption), but instead seems to be using some heuristic method of obfuscating their data. Their (closed-source) method of obfuscating their data apparently does have the property that it preserves the structure of the data, but calling it "structure-preserving encryption" is misleading imo since it…

They switched from structure-preserving encryption to neural encryption (using a neural net's layer activations). > Just a few months ago this package was released by Louis Aslett at Oxford http://www.louisaslett.com/HomomorphicEncryption/ . Louis helped me use his package to do Fan and Vercauteren homomorphic encryption on my dataset. Because the ciphertexts are polynomials it's not too easy for an average data scie…

Thanks for that link! I was never able to find any details from someone who works for Numerai (or claims to at least)

I still don't think it's fair to market their method as comparable to Aslett's scheme or "standard" notions of homormorphic/order preserving encryption, no matter how "chill" they are :)

Re: TFHE: Fast Fully-Homomorphic Encryption Over the Torus

#47

Post by dllthomas »

tveita wrote: post #19
tome wrote: post #5

What operations can I do homomorphically with this library? The page says "With the cloud-keyset, the library can evaluate a net-list of binary gates homomorphically at a rate of about 50 gates per second per core, without decrypting its input. It suffices to provide the sequence of gates, as well as ciphertexts of the input bits. And the library computes ciphertexts of the output bits." but what does "evaluating a n…

"The library supports the homomorphic evaluation of the 10 binary gates (And, Or, Xor, Nand, Nor, etc…), as well as the negation and the Mux gate." So you'd program it by designing a digital circuit using AND, OR, and NOT gates, somewhat similar to how you would make a circuit with physical components. You have millions, maybe billions of these gates in your CPU, each capable of doing millions of calculations for eac…

Why would we expect to need a full modern CPU? An 8080 had thousands, and that's still general purpose. Something built for a specific task might well be substantially smaller. Still slow, but possibly realistic for some tasks.

Re: TFHE: Fast Fully-Homomorphic Encryption Over the Torus

#48

Post by _d4bj »

branja wrote: post #40
phkahler wrote: post #33

One interesting thing about this: You are performing known operations on unknown data. But theoretically you could simulate a generic computer whose program is encrypted data as well, thus enabling unknown operations on unknown data. However, with speeds in the ms per gate we are a long way from that being practical right now.

all the fun problems in CS are intractible

I think the OP is referring to simulating an oblivious Turing machine on the encrypted data, which itself is a Turing machine and some data.

I don't think this is known to be intractable, just really slow (for now).

Re: TFHE: Fast Fully-Homomorphic Encryption Over the Torus

#49

Post by proofofstake »

lkowalcz wrote: post #46
proofofstake wrote: post #44

Earlier quoted context omitted.

They switched from structure-preserving encryption to neural encryption (using a neural net's layer activations). > Just a few months ago this package was released by Louis Aslett at Oxford http://www.louisaslett.com/HomomorphicEncryption/ . Louis helped me use his package to do Fan and Vercauteren homomorphic encryption on my dataset. Because the ciphertexts are polynomials it's not too easy for an average data scie…

Thanks for that link! I was never able to find any details from someone who works for Numerai (or claims to at least) I still don't think it's fair to market their method as comparable to Aslett's scheme or "standard" notions of homormorphic/order preserving encryption, no matter how "chill" they are :)

Do you think neural encryption is closer to encryption? GAN-style: One network encrypts while preserving structure, another network tries to reverse engineer to the original features.

Edit: No specific sources for what Numerai is using, but in general: https://arxiv.org/abs/1610.06918 "Learning to Protect Communications with Adversarial Neural Cryptography".

Edit2: Yes, in general. I would say "yes, this is a valid form of encryption". But I do agree that their marketing was perhaps a bit too optimistic. I have no problem calling it "obfuscation" either (I just think their method of "obfuscation" is way more advanced than removing headers and normalizing within 0-1).

Re: TFHE: Fast Fully-Homomorphic Encryption Over the Torus

#50

Post by lkowalcz »

proofofstake wrote: post #49
lkowalcz wrote: post #46

Earlier quoted context omitted.

Thanks for that link! I was never able to find any details from someone who works for Numerai (or claims to at least) I still don't think it's fair to market their method as comparable to Aslett's scheme or "standard" notions of homormorphic/order preserving encryption, no matter how "chill" they are :)

Do you think neural encryption is closer to encryption? GAN-style: One network encrypts while preserving structure, another network tries to reverse engineer to the original features. Edit: No specific sources for what Numerai is using, but in general: https://arxiv.org/abs/1610.06918 "Learning to Protect Communications with Adversarial Neural Cryptography". Edit2: Yes, in general. I would say "yes, this is a valid f…

I've never heard of neural encryption before, do you have a good source for me?

From the Wikipedia page for "Neural cryptography", it seems like there's some success in using NN's for cryptanalysis, but not for constructions...

Edit: Do you mean the Google GAN experiment? (https://arxiv.org/pdf/1610.06918v1.pdf) Ahh ok, well at least for this there looks like an attempt at defining a security model (security against some other NN). I don't really believe the security model is realistic (how do we know NN's are really that effective as adversaries?), but at least there is a model, so calling that "encryption" sits somewhat better with me. I'm pretty sure this is not what's being used by Numerai since it seems like it would not result in ciphertexts with the structure necessary to perform ML operations on.

Edit2: Maybe you're right and it is more advanced. In any case, as a crypto nerd I wish they would disclose what they are actually doing / the rationale instead of tantalizingly suggesting that they have made (what would be) a breakthrough in a practical use case of advanced encryption schemes, but not saying how.

Post reply on HN