Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

The Rise of Fully Homomorphic Encryption

queue.acm.org

Post reply on HN
Print view View original

71–80 of 132 posts

Re: The Rise of Fully Homomorphic Encryption

#71

Post by bawolff »

Dunny97 wrote: post #18
bawolff wrote: post #5

Earlier quoted context omitted.

The whole cloud provider using FHE usecase always seemed a bit utopian to me. As you say, most of the time they dont want to provide user privacy, they want your data. Maybe i could imagine some sort of B2B case where there are strong requirements working out, but i struggle imagining it for consumer use cases. Not to mention, if you are outsourcing data computation, presumably its a lot of computation or you would d…

[dead]

I dont know what you are doing, but if you are using FHE explicitly for its post quantumness, you are doing something wrong as there are much much better choices if you need post-quantum versions of traditional primitives.

Re: The Rise of Fully Homomorphic Encryption

#72

Post by bawolff »

v4dok wrote: post #14
bawolff wrote: post #11

Earlier quoted context omitted.

> FHE gives you NO guarantee about the code that is running on the encrypted data. I can run a leaky AI model or a SELECT * on encrypted data and still get the output. What I can do (and that's assuming there is open-sourced, auditable code) is to make sure that anyone with hypervisor access on that machine cannot dump my data out during processing. I might be misunderstanding but i think this is misleading. Any code…

Depends on what do you mean by "person running the code" If by person you mean the admin of the machine, then yes. If by person you mean the developer of the FHE-based application, then "maybe" If by person you mean the analyst who would in the end order an AI python model to be executed through the FHE-based software on a machine. Then no, that person will in the end get back human-readable results. Be that a model,…

What i mean, is the only person who can learn anything about the data, is the entity who posesses the decryption key.

In any sane deployment of FHE the key holder is the person who owns the data, not the app developer and not the person "running" the program.

Re: The Rise of Fully Homomorphic Encryption

#73

Post by coldtea »

carrotcypher wrote: post #60
coldtea wrote: post #40

Earlier quoted context omitted.

The code decrypts the data at some point (for use, presentation, etc). If the code is crappy, insecure, etc. then the data will be exposed, and the data being encrypted wont help at all...

Decrypted on the local computer, not the untrusted remote computer as it were.

If the same company makes the software at the local end, there's still code there than can expose the data or the encryption key...

Re: The Rise of Fully Homomorphic Encryption

#74

Post by hinkley »

wazoox wrote: post #65

I've just watched a presentation about Cosmian ( https://cosmian.com/ ) and their solution boasts using FHE, at a significant price though: computations and queries are about 1000 slower than on unencrypted data according to their CTO. I was quite impressed that it even works at all, though :)

Don’t those sorts of differences suggest that perhaps enclave decryption would be as fast and support more functionality?

Re: The Rise of Fully Homomorphic Encryption

#75

Post by bawolff »

v4dok wrote: post #70
vesinisa wrote: post #33

Earlier quoted context omitted.

Sorry but I still fail to see how that would be a problem, since the output of the program (e.g. the ML model parameters) would themselves not be intelligible to you. To make _any_ (non-cryptanalytical) inference on the plaintext of the homomorphically encrypted data _necessarily_ requires that the attacker at some points can access or execute some classical code on the plaintext. This would obviously violate the "fu…

Close. The first part is fair. A more real-life example. I am a pharma company and I want to execute a query on some hospital data. The hospital doesn't want to give me the data in plaintext but they are fine with me getting some aggregate insights from their data that are not PII. Now lets assume I decide to do that using FHE. I can now compute my query on the encrypted hospital data and I never see the plaintext da…

This example is confusing because its unclear who the trusted parties are and who you are trying to protect the data from. Quite frankly this feels like you are mostly pointing out that FHE wont work if you use it incorrectly . Normal encryption won't work either if you give the bad guy your key.

> But every FHE vendor I've seen blur that difference by not specifying what kind of attacks they protect against when they talk about "protecting privacy".

Agree with you here. FHE is an impractical technology at this stage. I'm pretty sure all commercial FHE vendors are borderline scammers, and have a loose relationship with the truth.

Re: The Rise of Fully Homomorphic Encryption

#76

Post by hinkley »

bawolff wrote: post #4

This feels more like a press release than an actually insightful article. Would practical FHE be interesting? Sure. Is it happening? Doesn't seem like it is any time soon.

Doesn’t fully homomorphic encryption have the Tux Image problem cited in block cypher discussions?

With a symmetric cipher, I could figure out the blood type of every employee pretty easily. With an asymmetric cipher, I could figure out everyone who has my blood type, and the blood types of anyone who reveals that information.

If the point is to filter data when you aren’t allowed to know what the data is, then the act of being in the filter or not reveals some of that information. It’s just a game of twenty questions.

Re: The Rise of Fully Homomorphic Encryption

#77

Post by bawolff »

m1ghtym0 wrote: post #19

> Today, conventional wisdom suggests that an additional performance acceleration of at least another 1 million times would be required to make FHE operate at commercially viable speeds. At the moment, Cornami is the only commercial chip company to announce a forthcoming product that can meet and exceed that performance level. Is there any comparison performance benchmark for these Cornami chips on real world algorit…

Keep in mind that this article was written by Cornami, so i would take any assertions about cornami solving all the problems with a huge heaping of salt.

Re: The Rise of Fully Homomorphic Encryption

#78

Post by bawolff »

hinkley wrote: post #76
bawolff wrote: post #4

This feels more like a press release than an actually insightful article. Would practical FHE be interesting? Sure. Is it happening? Doesn't seem like it is any time soon.

Doesn’t fully homomorphic encryption have the Tux Image problem cited in block cypher discussions? With a symmetric cipher, I could figure out the blood type of every employee pretty easily. With an asymmetric cipher, I could figure out everyone who has my blood type, and the blood types of anyone who reveals that information. If the point is to filter data when you aren’t allowed to know what the data is, then the a…

I think you are mixing it up with order-preserving encryption and other stuff related to encrypted databases.

In the FHE model, the assumption usually is - you have some data, someone else does some encrypted calculations, you get the encrypted answer back, you decrypt the answer and read it. The adversary cannot play 20 questions because they only calculate the encrypted answers, they are not allowed to see what the answers are.

Re: The Rise of Fully Homomorphic Encryption

#79

Post by anonporridge »

Spiral is an interesting use case of FME for database fetching that just popped up, https://usespiral.com/

General FME computation is obviously not likely to be practical or cost effective any time soon, but there may be some specific use cases, like querying a database, where hiding the information you want to know from the server is advantageous. There are adversarial environments where knowing the information your adversary is interested in provides a competitive edge.

I'm curious to dig more into their implementation.

Re: The Rise of Fully Homomorphic Encryption

#80

Post by rhindi »

johnbender wrote: post #62
awesomeMilou wrote: post #59

Great write up on the state of the field, but when I checked last, the current problem is performance. I didn't see much on that in the article. A few years ago there were papers on evaluating simple logic circuits in an FHE context and it took 2h hours for what was basicially 5-6 NOR gates.

Fwiw we have at least some reason to hope in this general context that between clever systems work and tightening theoretical bounds via additional assumptions and clever reasoning we might get to practical implementations for some applications. As (maybe weak) evidence the progress on practical implementations of PCPs/SNARGs https://dl.acm.org/doi/pdf/10.1145/2641562

It’s much much faster now, and performance is improving 10x every couple of year. With the current trend, FHE will be applicable to 80% of usecases by 2025
Post reply on HN