Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Fully homomorphic encryption and the dawn of a private internet

bozmen.io

Post reply on HN
Print view View original

131–140 of 202 posts

Re: Fully homomorphic encryption and the dawn of a private internet

#131

Post by taeric »

ipnon wrote: post #4
blintz wrote: post #3

I say this as a lover of FHE and the wonderful cryptography around it: While it’s true that FHE schemes continue to get faster, they don’t really have hope of being comparable to plaintext speeds as long as they rely on bootstrapping. For deep, fundamental reasons, bootstrapping isn’t likely to ever be less than ~1000x overhead. When folks realized they couldn’t speed up bootstrapping much more, they started talking…

Don't you think there is a market for people who want services that have provable privacy even if it costs 1,000 times more? It's not as big a segment as Dropbox but I imagine it's there.

Honestly, no? Unless you get everyone using said services, then a market that is only viable to people trying to hide bad behavior becomes the place you look for people doing bad things?

This is a large part of why you have to convince people to hide things even if "they have nothing to hide."

Re: Fully homomorphic encryption and the dawn of a private internet

#132

Post by charles_f »

> The only way to protect data is to keep it always encrypted on servers, without the servers having the ability to decrypt.

> If FHE is a possible option, people and institutions will demand it.

I don't think that privacy is a technical problem. To take the article's example, why would Google allow you to search without spying on you? Why would chatgpt discard your training data?

GPG has been around for decades. You can relatively easily add a plug-in to use it on top of gmail. Surely the protocol is not perfect, but could have been made better much more easily than it is to improve HPE, since a lot of its clunkiness can be corrected by UX. But people never cared enough that everything they write is read by Google to encrypt it. And since Google loves reading what you write, they'll never introduce something like HPE without overwhelming adoption and requirements by others.

Re: Fully homomorphic encryption and the dawn of a private internet

#133

Post by paulgerhardt »

reliabilityguy wrote: post #81
blintz wrote: post #3

I say this as a lover of FHE and the wonderful cryptography around it: While it’s true that FHE schemes continue to get faster, they don’t really have hope of being comparable to plaintext speeds as long as they rely on bootstrapping. For deep, fundamental reasons, bootstrapping isn’t likely to ever be less than ~1000x overhead. When folks realized they couldn’t speed up bootstrapping much more, they started talking…

Even without bootstrapping FHE will never be as fast as plaintext computation: the ciphertext is about three orders of magnitude much larger than the plaintext data it encrypts, which means you have to have more memory bandwidth and more compute. You can’t bridge this gap.

That actually sounds pretty reasonable and feels almost standard at this point?

To pick one out of a dozen possible examples: I regularly read 500 word news articles from 8mb web pages with autoplaying videos, analytics beacons, and JS sludge.

That’s about 3 orders of magnitude for data and 4-5 orders of magnitude for compute.

Re: Fully homomorphic encryption and the dawn of a private internet

#134

Post by ralferoo »

Forgeties79 wrote: post #127
ralferoo wrote: post #115

Earlier quoted context omitted.

They tend to do promotions, typically only valid for 24h and only advertised on certain forums like LET, a couple of times per year - typically at least around their company anniversary date or Black Friday. There are others too, e.g. Servarica who keep their Black Friday offers running all year round.

> There are others too, e.g. Servarica who keep their Black Friday offers running all year round. I don’t understand the logic here so I’m going to assume I’m being obtuse. Doesn’t that just mean that’s their standard price? Why or how would you ever pay more?

Yeah, I kind of agree in the latter case. Black Friday deals often have lower priority support etc.

I guess with Servarica, they have their standard deals, but for Black Friday deals are generally thin margins, but still enough to cover costs. Typically every year, they have special deals that are a bit different to their previous offerings. As a result, some people prefer the previous deals, some prefer the new ones, so they keep them all going. It's a bit unusual. They've also got a few interesting deals, like start with N TB and it grows a bit every day. If you keep these more than about 3-4 years, these are probably better value for money, but I think you're paying too much in the first few years. It's interesting if your primary use case is incremental backups.

Hosthatch's deals are a bit different as they're usually preorders and at almost cost with basically minimal support, whereas they keep their normal stuff in stock and have higher support levels.

I should also add that I've not personally used Servarica, even though they look interesting - just because they only have a Canadian datacenter. I have 4 Hosthatch servers spread all over the globe so that I have more redundancy in my backups. I only buy them when they have deals, assuming I don't miss them as they're only for 24h.

Re: Fully homomorphic encryption and the dawn of a private internet

#135

Post by prophesi »

JohnFen wrote: post #124
ramchip wrote: post #117

Earlier quoted context omitted.

The result is encrypted. It's useful to the key holder, not to the party doing the computation.

Yes, I understand that part. The part I struggle with is how the very fact that a party without the key can do the computation on it is not an indication that the encryption is leaking information. If the encryption were airtight, then such computation shouldn't be possible. Given that cryptography experts seem to be asserting otherwise, I assume that there's something important that I'm not understanding here.

The tl;dr is that breaking FHE would mean solving lattice problems that have been studied for decades to be nontrivial to break[0].

[0] https://arxiv.org/abs/2208.08125

Re: Fully homomorphic encryption and the dawn of a private internet

#136

Post by j2kun »

perlgeek wrote: post #63

FHE might allow arbitrary computation, but I use most services because they have some data I want to use: their search index, their knowledge, their database of chemicals, my bank account transactions, whatever. So unless Google lets me encrypt their entire search index, they can still see my query at the time it interacts with the index, or else they cannot fulfill it. The other point is incentives: outside of some…

You're right about incentives, but wrong about the first part. Private lookups of a plaintext database are possible and have been for a while now (5+ years?). The problem is it often requires some nontrivial preprocessing of the plaintext database, or in the worst case a linear scan of the entire database.

Re: Fully homomorphic encryption and the dawn of a private internet

#137

Post by jmcqk6 »

shikon7 wrote: post #65
perlgeek wrote: post #63

FHE might allow arbitrary computation, but I use most services because they have some data I want to use: their search index, their knowledge, their database of chemicals, my bank account transactions, whatever. So unless Google lets me encrypt their entire search index, they can still see my query at the time it interacts with the index, or else they cannot fulfill it. The other point is incentives: outside of some…

From what I understand, only the sensitive data needs to be encrypted (e.g. your bank transactions). It is still possible to use public unencryped data in the computation, as the function you want to compute doesn't have to be encrypted.

In a world where Target can figure out a women is pregnant before she knows herself due to her shopping habits, the line that separates sensitive data is pretty ambiguous.

Re: Fully homomorphic encryption and the dawn of a private internet

#138

Post by JohnFen »

prophesi wrote: post #135
JohnFen wrote: post #124

Earlier quoted context omitted.

Yes, I understand that part. The part I struggle with is how the very fact that a party without the key can do the computation on it is not an indication that the encryption is leaking information. If the encryption were airtight, then such computation shouldn't be possible. Given that cryptography experts seem to be asserting otherwise, I assume that there's something important that I'm not understanding here.

The tl;dr is that breaking FHE would mean solving lattice problems that have been studied for decades to be nontrivial to break[0]. [0] https://arxiv.org/abs/2208.08125

I'm not talking about the possibility of breaking FHE, though.

What I don't understand is this: if I get encrypted data from someone and, without breaking that encryption, I can perform computations on it that yield a sensible result (even if the result is also encrypted with a key I don't have), then how does that not mean the encryption has been weakened? If the encryption were strong, that should not be possible.

Actually breaking the encryption is a different thing, and I wasn't questioning that.

Re: Fully homomorphic encryption and the dawn of a private internet

#139

Post by j2kun »

adamc wrote: post #126

Very cool, although I have some reservations about "... closest vector problem is believed to be NP-hard and even quantum-resistant". "Believed to be" is kind of different from "known to be".

If it makes you feel better, no cryptographic assumptions we use today are known to be NP-hard. Or maybe that makes you feel worse, not sure. But it doesn't really matter because NP-hardness is a statement about worst case inputs and cryptography needs guarantees about average case inputs since keys are generated randomly.

Re: Fully homomorphic encryption and the dawn of a private internet

#140

Post by TechDebtDevin »

paulgerhardt wrote: post #133
reliabilityguy wrote: post #81

Earlier quoted context omitted.

Even without bootstrapping FHE will never be as fast as plaintext computation: the ciphertext is about three orders of magnitude much larger than the plaintext data it encrypts, which means you have to have more memory bandwidth and more compute. You can’t bridge this gap.

That actually sounds pretty reasonable and feels almost standard at this point? To pick one out of a dozen possible examples: I regularly read 500 word news articles from 8mb web pages with autoplaying videos, analytics beacons, and JS sludge. That’s about 3 orders of magnitude for data and 4-5 orders of magnitude for compute.

I dont remember the last time I saw a news page that was <50mb
Post reply on HN