Live data from Hacker News

The Rise of Fully Homomorphic Encryption

queue.acm.org

111–120 of 132 posts

Re: The Rise of Fully Homomorphic Encryption

#111
post #81

Earlier quoted context omitted.

Probably but the main objective is to keep data safe in the cloud while keeping everything encrypted (traffic and data), all the time.

That's certainly fair. One of the oldest classic physical security failures I know of, which really stuck with me, is "who did background checks on the janitors?" It doesn't literally have to be janitors, but there are a lot of people in your space that we assume are not threats, even though there is a lot of overlap between "hacker" and "people who work for vendors". I knew someone who was responsible for delivering…

"Only the paranoid survive" is my motto :)

Re: The Rise of Fully Homomorphic Encryption

#112
post #70

Earlier quoted context omitted.

Sorry but I still fail to see how that would be a problem, since the output of the program (e.g. the ML model parameters) would themselves not be intelligible to you. To make _any_ (non-cryptanalytical) inference on the plaintext of the homomorphically encrypted data _necessarily_ requires that the attacker at some points can access or execute some classical code on the plaintext. This would obviously violate the "fu…

Close. The first part is fair. A more real-life example. I am a pharma company and I want to execute a query on some hospital data. The hospital doesn't want to give me the data in plaintext but they are fine with me getting some aggregate insights from their data that are not PII. Now lets assume I decide to do that using FHE. I can now compute my query on the encrypted hospital data and I never see the plaintext da…

For clarity, let's assume the hospital stores its records in plaintext. For the pharma company, the hospital encrypts the patient records with a secret key. Now they let the pharma company run their homomorphic algorithm and send the values back. Only problem is the pharma company can not read those results without having access to the key. FHE is completely redundant in this use case - the hospital could have simply run the pharma company's SQL and audited the code and outputs.

What is FHE actually good for then? Let's imagine you are a top secret agent and you get instructions to fly to Bulgaria as a part of your mission. You have other hostile agents constantly monitoring you, trying to understand your next move. But there's a problem - to buy a plane ticket to Bulgaria you need to know the name of its capital city. You can't just type it to Google, because these other agents have actually infiltrated the Google servers and can see everything you search (assume once you actually know the name of the capital, you can somehow buy the actual ticket without "them" knowing..)

Lukcily though, CloudCorp offers a public homomorphic query service for all world capitals. This service allows you to send a query for the capital of any country over an intercepted connection, and get back the result. Even if the hostile agents had infiltrated CloudCorp and were monitoring all your comms, they would not be able know which country's capital you just queried. Not even CloudCorp could do that, you are the only person who knows what you asked and what was the result.

How such service would be implemented is explained in good detail in this tutorial, completele with working code: https://github.com/homenc/HElib/tree/master/examples/BGV_cou...

P.S. The capital of Bulgaria is Sofia.

Re: The Rise of Fully Homomorphic Encryption

#113
post #65

I've just watched a presentation about Cosmian ( https://cosmian.com/ ) and their solution boasts using FHE, at a significant price though: computations and queries are about 1000 slower than on unencrypted data according to their CTO. I was quite impressed that it even works at all, though :)

There are a few companies in this space. Duality is one of the bigger ones. https://dualitytech.com/

Re: The Rise of Fully Homomorphic Encryption

#114

> Today, conventional wisdom suggests that an additional performance acceleration of at least another 1 million times would be required to make FHE operate at commercially viable speeds. At the moment, Cornami is the only commercial chip company to announce a forthcoming product that can meet and exceed that performance level. Is there any comparison performance benchmark for these Cornami chips on real world algorit…

I don't know anything about Cornami's products or where they are in the manufacturing stage. However, I do work in FHE.

To give you sense of performance, today you can multiply 2 encrypted 8192-bit values in BFV with typical (not optimal) scheme parameters in 17ms on a single core of an M1 Macbook Air. This is the most expensive operation by a wide margin. The ciphertexts for these parameters is about 0.5MB and the keys are maybe a meg or two.

The algorithm you want make fast for most schemes is the Number Theory Transform (NTT), which is basically a Fast Fourier Transform (FFT) for finite fields. This algorithm has only O(nlog(n)) operations, so the computational intensity relative to memory accesses is fairly low. This stands in contrast to something nice like matrix multiplication where matrices are O(n^2) but require O(n^3)[1] computation. Unfortunately due to Amdahl's law, you have to make not just NTT fast, but all the other boring O(n) operations schemes need to do.

If you want to make FHE fast enough to justify an ASIC, you'll have to avoid data movement and basically keep everything in on-chip SRAM. Waiting 400 clock cycles for data is a non-starter. For algorithms with bootstrapping, your bootstrapping key might be 100MB, so you'll probably want a chip with like 512MB of on-chip memory to hold various keys, ciphertexts, etc. You then need to route and fan-out that data as appropriate.

You then need to also pack a ton of compute units that can quickly do NTTs on-chip, but are also versatile to do all the other "stuff" you need to do in FHE, which might include multiplication and addition modulo some value, bit decomposition, etc. And you'll probably doing operations on multiple ciphertexts concurrently as you traverse down an arithmetic or binary circuit (FHE's computational model). Figuring out the right mix of what an ALU is and how programmable it needs to be is tricky business.

For larger computations, maybe you stream ciphertexts in and out of DRAM in the background while you're computing other parts of the graph.

Making an FHE accelerator is neither easy nor cheap (easily a 50-100M+ investment), but I think it is possible. My SWAG is that you might be able to turn the 17ms latency into like 50-100us but with way more throughput to execute a large circuit graph(s).

[1]: Strassen algorithm git out of here

Re: The Rise of Fully Homomorphic Encryption

#115

Earlier quoted context omitted.

Actually saas is about providing services for money.

Money and control is what it's about. That usually means making someone dependent on you in order to access/use their own stuff, making it hard to migrate their data away from your service, and taking every advantage of the data being collecting. I've never seen a saas product that isn't using and/or "sharing" their customer's data for their own benefit somehow. If they exist at all, they're the exception and not the…

This is completely wrong way to view SaaS. It's just about making money, the control part is just so they can try and squeeze more money out of you. Control is not the goal. Money is.

Re: The Rise of Fully Homomorphic Encryption

#116
post #73

Earlier quoted context omitted.

Decrypted on the local computer, not the untrusted remote computer as it were.

If the same company makes the software at the local end, there's still code there than can expose the data or the encryption key...

Big assumption there.

Re: The Rise of Fully Homomorphic Encryption

#117

Earlier quoted context omitted.

Money and control is what it's about. That usually means making someone dependent on you in order to access/use their own stuff, making it hard to migrate their data away from your service, and taking every advantage of the data being collecting. I've never seen a saas product that isn't using and/or "sharing" their customer's data for their own benefit somehow. If they exist at all, they're the exception and not the…

This is completely wrong way to view SaaS. It's just about making money, the control part is just so they can try and squeeze more money out of you. Control is not the goal. Money is.

I guess that's fair... ultimately money is everything, but I do think there are absolutely companies who highly value the control aspect as well. It can give them the ability to censor, act as a gatekeeper, and nickel and dime.

Saas seems a lot more predatory and risky than most products/services. You hand over money, you hand over control, you hand over your data and all of it leaves you varying degrees of vulnerable.

I guess I shouldn't expect a pragmatic view of saas to be popular around here (some of you are likely working on your own saas projects after all), but the reasons saas is attractive for companies to offer are the same reasons that make me hesitate to use them.

Re: The Rise of Fully Homomorphic Encryption

#118

Earlier quoted context omitted.

Money and control is what it's about. That usually means making someone dependent on you in order to access/use their own stuff, making it hard to migrate their data away from your service, and taking every advantage of the data being collecting. I've never seen a saas product that isn't using and/or "sharing" their customer's data for their own benefit somehow. If they exist at all, they're the exception and not the…

This is completely wrong way to view SaaS. It's just about making money, the control part is just so they can try and squeeze more money out of you. Control is not the goal. Money is.

Money is the goal of the individual Cogs in the machine. Control is the goal of the machine itself, which uses money to incentivize (power) its Cogs. If you're a Big Tech company you essentially have endless free money to leverage compared to your Cogs. The machine itself doesn't care about money. That free money train is coming to an end though over the next decade. Or at least that's the reality I'm planning for. :)

Re: The Rise of Fully Homomorphic Encryption

#119

> Today, conventional wisdom suggests that an additional performance acceleration of at least another 1 million times would be required to make FHE operate at commercially viable speeds. At the moment, Cornami is the only commercial chip company to announce a forthcoming product that can meet and exceed that performance level. Is there any comparison performance benchmark for these Cornami chips on real world algorit…

I don't know anything about Cornami's products or where they are in the manufacturing stage. However, I do work in FHE. To give you sense of performance, today you can multiply 2 encrypted 8192-bit values in BFV with typical (not optimal) scheme parameters in 17ms on a single core of an M1 Macbook Air. This is the most expensive operation by a wide margin. The ciphertexts for these parameters is about 0.5MB and the k…

I understood about 20% of that but I really appreciate the comment.

Are there any companies doing pioneering work on this now? What aspects of FHE does your employer do? How would you say the future is looking for FHE?

Re: The Rise of Fully Homomorphic Encryption

#120
post #110
post #93

Looks like some kind of ad that tries to discredit regular encryption by claiming that it's already compromised (it isn't), or that it will be very soon. But lo! Here is the knight in shining armour coming to the rescue (FHE)! Soon. Maybe.

No, the point of FHE isn't that regular encryption is already compromised. It's that you can do processing on encrypted data while it's encrypted, without decrypting it. This opens up many more possibilities. For example, a cloud provider might store your data only in encrypted form and you can still do queries to pick out particular data or do some basic analysis, with the algorithm running on cloud computers, the r…

The article does put quite a lot of emphasis on "soon broken" encryption algorithms, so can't blame kebman for that comment. It only mentions what you pointed out almost in passing.

Also not an expert here, but if "Valuable insights through AI (artificial intelligence), big data, and analytics can be extracted from data", then you'd be a fool to believe this will protect your privacy, right? Or am I missing something? I want encryption that protects me from corporations, not encryption that protects the data corporations have from us and ups their surveillance game. I guess it's no coincidence a lot of research seems to be done by M$.

Post reply on HN