IBM Claims Breakthrough In Analysis of Encrypted Data 199
An anonymous reader writes "An IBM researcher has solved a thorny mathematical problem that has confounded scientists since the invention of public-key encryption several decades ago. The breakthrough, called 'privacy homomorphism,' or 'fully homomorphic encryption,' makes possible the deep and unlimited analysis of encrypted information — data that has been intentionally scrambled — without sacrificing confidentiality." Reader ElasticVapor writes that the solution IBM claims "might better enable a cloud computing vendor to perform computations on clients' data at their request, such as analyzing sales patterns, without exposing the original data. Other potential applications include enabling filters to identify spam, even in encrypted email, or protecting information contained in electronic medical records."
First post! (Score:5, Funny)
Re: (Score:2)
Yeah (Score:3, Insightful)
Right, because we've already figured out everything about cloud computing and it's a totally stable environment ready to be deployed in every company around the globe. Time to take it to the next step.
But what if it took... a TRILLION times longer? (Score:3, Insightful)
Yeah, you can perform calculations on encrypted data without unencrypting it. But it's just a LITTLE slow. The first step is just showing it can be done, but it's a very long way from useful.
Re:But what if it took... a TRILLION times longer? (Score:4, Informative)
I read the paper and my guess is that a TRILLION is actually an understatement. It looks to me like it might be almost INFINITELY slower. In other words, completely impractical and only of theoretical value.
However, now that the first step has been taken, it's possible that someone will come up with an improvement that makes the idea practical someday.
Re: (Score:2)
Re: (Score:2)
You think companies give a shit? Never mind the gross anthropomorphization of property, what about the monthly (so it seems) cases of workers losing laptops with unencrypted information--credit card numbers and social security numbers. Since when have most institutions ever bothered to secure their data?
No More Privacy (Score:5, Insightful)
"perform computations on clients' data at their request, such as analyzing sales patterns"
Or without their request.
Since it's close to being slashdotted... (Score:5, Informative)
Re: (Score:3, Insightful)
Or without their request.
The NSA figured that out a long time ago.
Re: (Score:3, Informative)
If they really figured it out, then sure they can analyze without your request, but they can't decrypt the results without your key. So you still have the same privacy. BTW, this is the entire point of this process.
Re: (Score:2)
I wonder if this would make possible the following:
Here is Encrypt(www.slashdot.org), please compute Encrypt(DNSLookup(www.slashdot.org)) so that I can then Decrypt(Encrypt(DNSLookup(www.slashdot.org))) to produce 216.34.181.48.
Re:No More Privacy (Score:4, Interesting)
TFA doesn't seem clear on this point, but what the name of the technique implies is that you can perform the operation, but neither the inputs nor the outputs are ever decrypted. So if you can't see the question, and you can't see the answer, then why would you perform the operation other than at the request of someone who can (i.e. the client)?
That said, I'd like to know a lot more about this before I'd want to trust it. For this to work, I'd think a lot of the data's structure must be preserved. Maybe you can't detect that structure from the encrypted data, but you can probably infer a lot about it by analyzing the algorithms your clients ask you to apply (especially if they're your algorithms - i.e. software-as-a-service type stuff). I'm impressed if this doesn't create vulnerabilities.
Also I suspect this is fundamentally divorced from public key techniques. If I'm able to encrypt values of my choosing and perform operations of my choosing on encrypted values, I'm pretty sure I can work backward to extract the cleartext from the encrypted data the client provides...
here's why this is important. (Score:3, Informative)
TFA doesn't seem clear on this point, but what the name of the technique implies is that you can perform the operation, but neither the inputs nor the outputs are ever decrypted. So if you can't see the question, and you can't see the answer, then why would you perform the operation other than at the request of someone who can (i.e. the client)?
Example, I want the total sales figures for all the left handed employees. I cobble together the appropriate SQL processing request send it to my cloud server which rummages throught the data base summing up the figures for some subset of the fields. It sends me back just the sum, encypted. It never knows which employees it was selecting nor any of their sales figures or even the sum. It just has the encrypted result that it sends to me all processed.
otherwise I'd have to pull every encrypted record of
Re: (Score:2)
You should allow observers and party representatives to watch the counting of the votes.
Requirement #0 of democratic elections: elections do not just have to be fair, they have to be seen as fair.
Electronic voting systems fail that requirement.
You can have simple scalable solutions like paper based voting that are easily understandable (esp on how easy and hard it is to cheat) and thus satisfy requirement #0.
So it makes no sense to me to use electronic voting systems unless you
Re:No More Privacy (Score:5, Informative)
Everything remains encrypted throughout the process, including the output. Only the client can read the results. That is the point.
Re: (Score:3, Informative)
TFA is skimp on this but after bit of Googling around I understand a little more, see also http://en.wikipedia.org/wiki/Homomorphic_encryption [wikipedia.org].
The point being that those who provide the encrypted data must encrypt it in a special way to allow the homomorphic properties to be taken advantage of.
Re: (Score:2)
Re:No, misleading headline (Score:3, Informative)
Re: (Score:2)
http://en.wikipedia.org/wiki/Homomorphic_encryption [wikipedia.org]
Using such a scheme, one could homomorphically evaluate any circuit, effectively allowing the construction of programs which may be run on encryptions of their inputs to produce an encryption of their output. Since such a program never decrypts its input, it could be run by an untrusted party without revealing it
Re: (Score:2)
Re: (Score:2)
I'd like to know what sort of "analysis" can be done without the client's permission. Can they find out how many times the word "and" occurs (without reading the message) for example?
Yes, but the answer would be encrypted, and only the client could decrypt it.
Basically can they do any sort of content analysis? If they're saying they can filter spam, then it's not at all a stretch to assume that they can "read" your data as well. What's the point of encryption then?
They could filter spam, and come up with a
Re: (Score:2)
So if the answer to "how many times does 'and' occur" is 3, then they can try the analysis on a file encrypted with client's public key that they know has 3 occurrences of "and", and if it matches the (encrypted) result sent to the client, then they know that about the client's file.
OK, I know that's probably wrong; I would imagine that the answer is salted somehow so that two output files with the same result from different inputs won't match.
Fully homomorphic encryption using ideal lattices (Score:5, Informative)
Re: (Score:2)
If they can analyze the data... (Score:2, Insightful)
then that form of encryption is useless for highly sensitive information.
It's as simple as that.
BAD summary (Score:5, Informative)
You can not analyze the data. You can perform calculations on it without knowing what it is. So, for instance, you could encrypt all your tax info, send it to a company that processes the encrypted data without decrypting it, and sends you back your encrypted tax return, without ever having seen any of your financial detail.
Re: (Score:2)
How is it possible for them to calculate the tax return if they do not analyze the data?
Re: (Score:2)
That's the breakthrough. They add (as a made up example) E47F109A and FA619B05, coming up with 191AA7FC. They have no idea that, when decrypted with your key, those values are 51, 49, and 100 respectively. How is that possible? You'll have to read the paper, because I can't explain it :)
Re: (Score:3, Informative)
Actually, imagine being able to add two numbers together without knowing what those two numbers were and returning the total that you STILL don't know what the number is, but you have the cyphertext for it. You still need the key to decrypt the total.
Example in plaintext:
4 + 5 = 9
Example encypted (oversimplified):
D32JFS3 + 234DSF31 = 42SDF23
So the third party would receive D32JFS3 and 234DSF31 (not knowing they meant 4 and 5) and he would return 42SDF23 (not knowing it was 9)
The ablility to add two peices
Re:BAD summary (Score:4, Insightful)
My problem with this is that you'd have to expose the structure of your data, if not its contents. Using your example, the cyphertext might look like: "QEDD32JFS3234DSF31". You'd have to tell the analyzer that integer A starts at index 3 and integer B starts at index 10. That information alone could help the analyzer crack your encryption.
Re: (Score:3, Interesting)
The ablility to add two peices of cyphertext to get some (still unknonw) peice of cyphertext does not increase the "breakability" of the encryption because, just like the rosetta stone, you really need pairs of plaintext and cyphertext to do any real analysis
Nope, absolutely not ... assuming the processor at least knows that the encrypted data represents integers, then he could simply do the following, using your values above :-
D32JFS3 / D32JFS3 = XXXXXXX (he has now established the encrypted data for the v
Re:BAD summary (Score:4, Insightful)
Nope, absolutely not ... assuming the processor at least knows that the encrypted data represents integers, then he could simply do the following, using your values above :-
D32JFS3 / D32JFS3 = XXXXXXX (he has now established the encrypted data for the value 1).
Clever idea but it does not work.
First, it's easy to figure out the encrypted data for the value 1: just encrypt the value 1! This is public key encryption.
Second, there are multiple ways of encrypting the value 1. This is randomized encryption.
So it's easy to learn an encryption of the value 1 (or of any value for that matter), but it won't shed any light on what values are actually encrypted, because even if you guess right (i.e. you try encrypting the value 14 and you are later given an encryption of the value 14), the encryptions won't match because there are too many different ways of encrypting the same value.
Re: (Score:2)
Second, there are multiple ways of encrypting the value 1. This is randomized encryption.
Wouldn't he still be able to value of that specific instance of that number? Given enough queries (or if they're able to figure out the data structure) couldn't this expose a lot of data, even if time consuming?
I'm not stating any of this is true, I'm just geniunely curious if it would work like that.
Re: (Score:2)
division is the solution to a multiplicative and additive identity: dividend = quotient*divisor + remainder.
Homomorphic encryption allows multiplication and addition of ciphertext, but not division, because the quotient would be encrypted. There is no algorithm to determine a quotient such that the remainder is less than the divisor (because the less than operator does not exist in homomorphic encryption), which is
Re:BAD summary (Score:5, Funny)
Re: (Score:2)
Considering that, currently, performing calculations on encrypted data takes trillions of times as long as calculations on unencrypted data, you may very well be right. But this is just a proof of concept, and the thought is, this could be useful if the processing time can be brought down.
Besides the tax example, other articles have mentioned search terms. Perhaps you don't want Google to know you are searching for 'bisexual midget porn.' Now, there's a solution! They also mention cloud computing. With a sy
Re: (Score:2, Interesting)
Re: (Score:3, Informative)
This isn't a vulnerability with existing encryption systems, it's a scheme for a different way to structure and encrypt the data to explicitly allow calculations on the data without exposing the original values.
Re: (Score:2)
Unless the analysis is also encrypted.
Re: (Score:2, Interesting)
They can perform computations on the data, but the answer is still encrypted.
Re: (Score:3, Informative)
Wait, what? (Score:2, Interesting)
Re:Wait, what? (Score:5, Informative)
The point is not to read the content, but to enable a computer to analyze the content in such a way that they can deduce statistics and patterns from it. FTFA:
computer vendors storing the confidential, electronic data of others will be able to fully analyze data on their clients' behalf without expensive interaction with the client, and without seeing any of the private data
I don't need to know that you love apples to know you definitely love the same thing as 14 other people. Lets assume that we have 20 encrypted sets of data. Lets also assume the 20 sets say basically the same thing but because of the encyrption method look nothing a like from the raw data perspective. If you go ahead and find a way to analyze the encryption enough to know that the 20 emails all contain a similar message, but not enough to actually know what the message is... well then! You could go ahead and store all of ebay's customer information and do massive amounts of data crunching for them, without ever actually seeing any data.
This is a huge problem in IT, where admins need access to the databases in order to see how the data is being stored, how the tables are working, etc etc.. but can't actually have access to the database because then they might see customer information. So you either let joe-bob admin in there and let him see all the data, or you don't. Now you can let the admin in there, they can determine anything they might want to know, but they never actually see any exact data.
No, I don't know anything about the math portion.. but thats basically what they are trying to say in the article. I think. :)
Re: (Score:2)
Yes, yes you are.
The point is not to read the content, but to enable a computer to analyze the content in such a way that they can deduce statistics and patterns from it.
I'm not crypto-geek, but aren't patterns generally the bane of encryption?
Re: (Score:2)
Unfortunately, as a non-cryptogeek (as I said), I have no idea WTF that says. It says that the program never decrypts the data. I got that much. That doesn't say anything about patterns and statistics, that TFS mentions.
It seems that if you can determine how often things show up in encrypted data (the "statistics" part), you're already revealing information.
Re: (Score:2)
Implausible. Changing just one bit results in an 'avalanche effect' in good ciphers, so quite a lot of bits will be changed.
You won't be able to derive any useful information from that.
Re: (Score:2)
The one-time pad is a theoretical base case that has virtually no useful applications. Even Bruce Schneier says so: http://www.schneier.com/crypto-gram-0210.html#7 [schneier.com]
Re: (Score:2)
Re: (Score:2)
Re: (Score:2)
Homomorphic encryption does not give you any such ability.
Re: (Score:2)
Re: (Score:2)
You can only see if 20 other people like apples if that plaintext data was encrypted with the same key as the plaintext data that says you like apples.
Suppose Coca-Cola and Pepsi Cola both use the same Market Research firm, which we'll call StatisticsInc. Now, companies are very jealous of market insight data, most will not work with a firm that also works with a competitor, lest someone get bribed into sharing trade secrets. What this allows if for Coca-Cola to sent a bunch of demographic data to Statist
Re: (Score:2)
If they can determine "anything they might want to know" about the data, that is exactly equivalent to having full access to the data. So if that's what this offers, for a 12 order of magnitude performance hit, I'm not impressed.
from the horses mouth (Score:5, Informative)
Just FYI this site is whole sale cut and paste ripping IBM press off.
http://www-03.ibm.com/press/us/en/pressrelease/27840.wss
Re: (Score:2, Informative)
Re: (Score:2)
Yeah, but it's kind of nice to hope that the news vendor will add some of their own analysis rather than simply regurgitating a press release. Foolishly optimistic, in most cases, but nice nonetheless.
Sacrificing confidentiality (Score:2)
I bet multi-modal reflection sorting can determine what the confidential info is.
Wikipedia to the rescue (Score:5, Informative)
Cool, but I'm half-convinced that holes will be found. The first time a new encryption scheme is put to the test, it usually fails. Still, hopefully, it'll lead to a truly secure scheme.
Re:Wikipedia to the rescue (Score:5, Insightful)
Holes are always found - no method is 100% foolproof. The question is will the holes be usable? If the level of effort to exploit the holes is high enough, we may not see them exploited for some time. But the holes are there, and they will be found.
Re: (Score:3, Informative)
Holes are always found - no method is 100% foolproof.
http://en.wikipedia.org/wiki/One-time_pad [wikipedia.org]
Re: (Score:2)
While I love the elegance of good OTP encryption, it is only as good as the security during the key exchange which is not 100% foolproof.
Re: (Score:2)
Nevertheless, OTP itself *is* foolproof. Key exchange is a whole other ball of wax.
Re: (Score:2)
Your proclamation betrays your ignorance. Provably correct methods are 100% foolproof. Very few things, however, are provably correct.
And, of course, there is the risk of an error in the proof. Possibly a negligible risk, but it can happen.
Re: (Score:2, Funny)
Can I run this homomorphism on your data? (Score:2)
f(x) = x
Re: (Score:2)
Re:Can I run this homomorphism on your data? (Score:4, Informative)
f(x) = x
No. The operations you get are addition and multiplication, that's it. Given E(x) and E(y), you can compute E(x + y) or E(xy), nothing else. And you do this without ever learning x or y. RTFWA [wikipedia.org].
The reason for the terminology is that the encryption function E is a ring homomorphism [wikipedia.org] between plaintext and ciphertext. Some operation of addition is defined on both plaintext and ciphertext such that if x and y are plaintext, f(x + y) = f(x) + f(y). (The "+" on the left is addition of plaintext, the "+" on the right is addition of ciphertext: two totally different operations.) Multiplication is similar. You don't get to apply arbitrary homomorphisms to the data, it's the (predetermined) encryption function that's the homomorphism.
Actually, I don't see any mention of subtraction -- so maybe it's really a semiring homomorphism. With an actual ring homomorphism you'd also have f(x - y) = f(x) - f(y), and some 0 element with f(0) = 0. And maybe f(1) = 1, depending on definition.
simple explanation (Score:5, Informative)
OK, it looks like a lot of people are missing the point.
What Gentry figured out was a scheme for carrying out arbitrary computations on encrypted data, producing an encrypted result. That way, you can do your computation on encrypted data in the "cloud", but only you can view the results.
If E() is your encryption function, x is your data, and f() is the function you'd like to compute, homomorphic encryption gives you a function f'() such that f'(E(x)) = E(f(x)). But at no point does it actually decrypt your data.
This could be huge for secure computing.
Re: (Score:2)
If E() is your encryption function, x is your data, and f() is the function you'd like to compute, homomorphic encryption gives you a function f'() such that f'(E(x)) = E(f(x)). But at no point does it actually decrypt your data.
Got an example in C language instead?
Re: (Score:2)
Replace the = with ==. You now have it in C.
Joking aside GP was talking mathematical functions, which is quite appropriate given the context - theory underpinning cryptography.
Re: (Score:2)
Perhaps I am a bit slow and stupid, but is this not like running an encrypted virtual machine or at least could be done in some sort of encrypted virtual machine? Something where the underlying hardware and OS does not know what the processes and data are at the higher level.
Re: (Score:2)
What Gentry figured out was a scheme for carrying out arbitrary computations on encrypted data, producing an encrypted result. That way, you can do your computation on encrypted data in the "cloud", but only you can view the results
The other direction--letting the server do secure computation on the client, is also very interesting. Consider an MMORPG. One of the problems in MMORPG is cheat programs. These can be particularly troublesome in a PvP game. For example, there were programs for Dark Age of Camelot that would show you every enemy player in a large bubble around you, regardless of any obstacles blocking line of sight or the use of stealth abilities.
The obvious solution for this is that the server should only send player posit
Is it really arbitrary? (Score:2)
Isn't there some restriction on your "f" function? For example, it might be nice to compute a diff between two encrypted files, but the resulting size of the diff could reveal a lot of information and thus make the system insecure.
At first... (Score:4, Funny)
but after RTFA my suspicions may be justified:
Two fathers of modern encryption...
Not really a threat to privacy (Score:2, Interesting)
Basically, IBM has created a set of cryptographic algorithms that allow fully homomorphic encryption. If you don't want your data to be analyzed, all you have to do is use an algorithm that doesn't support it. You'd want to do that anyway, since you'd want to use algorithms that are already considered strong, such as RSA and AES. Although RSA is homomorphic in theory, in practice it is not, since padding is used to prevent other weaknesses.
Star Trek prior art (Score:2)
Fully homomorphic encryption is a bit like enabling a layperson to perform flawless neurosurgery while blindfolded, and without later remembering the episode.
Oh, I get it! It's like when Dr. McCoy reinstalled Spock's brain. McCoy was an idiot before, got the 1337 skillz, and then forgot it all.
Re: (Score:2)
Fully homomorphic encryption is a bit like enabling a layperson to perform flawless neurosurgery while blindfolded, and without later remembering the episode.
I remember the episode: Spock's Brain [memory-alpha.org].
Setec Astronomy (Score:2)
I don't suppose the researcher's name was Janik?
Homomorphism (Score:5, Insightful)
This article needs some clarification. In particular, a lot of the worried comments here show a lack of understanding of the word "homomorphic".
Here's a very simplified example of a homomorphism. I define a function
f(x) = 3x
This function is a homomorphism on numbers under addition. Its image "preserves" the addition operation. What I mean more precisely is
f(a) + f(b) = f(a + b)
That's pretty easy to verify for the function I've given.
Homomorphic encryption is interested in an encryption function f() that preserves useful computational operations. If we take my example as a very very simplified encryption then, say I have two numbers, 6, and 15, and I lack the computational power to do addtion, but I can encrypt my data with my key--3. (I'm generalizing my function to be multiplication by a key. And yes, for some reason I have the computational power to do multiplication. Humor me). I can encrypt my data, f(6) = 18 and f(15) = 45, and pass these to you, and ask you do do addtion for me. You'll do the addition, get 63, and pass this result to me, which I can then decrypt, which yields 21.
Now, my encryption here is very simple and very, very weak, but if you're willing to suspend disbelief, you'll note that the information I've allowed you to handle does not reveal either my inputs or my outputs. (In fact, with the particular numbers I've chosen, you might guess that my key is 9 instead of 3, (though relying on lucky choices or constraining myself to choices which have this property make my scheme rather useless))
If you generalize this to strong encryption and more useful computational operations, you begin to see how homomorphic encryption can be useful. One should note that, no, homomorphic encryption will not be a drop-in replacement for other forms of encryption. (Sending encrypted emails with homormorphic encryption would be unwise. An attacker can modify the data (though, if my understanding is correct, only with other data encrypted with the same key)) Homomorphic encryption simply fills a need that the other forms do not serve.
Hopefully you now also see how the article's use of the word "analysis" can be rather misleading. In particular, one of the earlier comments notes that it might be useful in allowing you to determine if different people's encrypted information is identical. By my understanding, homomorphic encryption would not allow this.
In any case, if my explanation is not enough, here [wikipedia.org]'s the wikipedia article.
Re:Homomorphism (Score:4, Informative)
Here's a very simplified example of a homomorphism. I define a function
f(x) = 3x
This function is a homomorphism on numbers under addition. Its image "preserves" the addition operation. What I mean more precisely is
f(a) + f(b) = f(a + b)
That's pretty easy to verify for the function I've given.
But examples like you gave (semigroup homomorphisms) have existed for a long time. Basic RSA has that property. The key advance here is that you have a semiring homomorphism, where it preserves two operations, one of which distributes over the other. Like multiplication and addition, or bitwise and and xor. (For those who don't follow: x*(y + z) = x*y + x*z, x & (y ^ z) = (x & y) ^ (x & z). If you don't believe the second identity, try all possibilities.)
An example of a semiring homomorphism on the reals is f(x) = -x. Then f(x + y) = -(x + y) = f(x) + f(y), and f(xy) = (-x)(-y) = xy = f(x)f(y). (Unless you believe in Time Cube.)
It seems distributivity is enough to do complicated calculations. You could simulate and and xor gates, I guess. Then you could get ~x = x ^ -1, x | y = ~(~x & ~y), etc.: all possible binary operations. That's enough to build a virtual computer right there, all operating on encrypted data.
Of course, the one running the code would be able to figure out exactly what algorithm you're using. So it's not perfect. But it's pretty cool regardless.
Re: (Score:2)
Could you just explain your sentence "Of course, the one running the code would be able to figure out exactly what algorithm you're using." I don't think it means what I (currently) think it means.
Well, to be honest I'm mostly guessing here, with no theoretical knowledge of cryptography (only knowledge of abstract algebra). If I understand correctly, there will be a one-to-one correspondence between the two binary operations on plaintext, and the two binary operations on ciphertext. That's what a homomorphism means, usually. So the processor will know the sequence of ciphertext operations, and if they know how those map to plaintext operations they'll know what they're doing to the plaintext, even
Re: (Score:2)
Thank you for the explanation. Here is a shorter explanation: using homomorphic encryption, mathematical operations on encrypted data can produce results which are themselves encrypted by the same encryption code.
OK, I don't understand (Score:2)
It has to be quite limited. Otherwise for example, lets suppose I have an integer (encrypted of course) and I have comparison and addition/subtraction and multiply/divide.
I can very easily find the encrypted values of both 0 (a-a for any a) and 1 (a/a)
I can now decrypt the data with repeated additions (or subtractions) of 1 and equality comparisons.
And, I don't see how you can prevent equality tests in the encrypted domain. You might have to calc
Re: (Score:3, Informative)
What are the operations for which this is homomorphic?
It has to be quite limited. Otherwise for example, lets suppose I have an integer (encrypted of course) and I have comparison and addition/subtraction and multiply/divide.
I can very easily find the encrypted values of both 0 (a-a for any a) and 1 (a/a)
The article neglected to mention that the underlying encryption system is randomized public key encryption. This means (A) you can easily discover encryptions of 0, encryptions of 1, and encryptions of anyt
Re: (Score:2)
So I don't see how the operations available can be as much as the usual operators on reals.
The idea seems to make the operations map to something like & and ^, so that you can recover all logical operators and make a virtual computer using them. & and ^ on the integers may not seem as powerful as * and + on integers/floating points/etc., but you can easily encode the latter as the former.
Re: (Score:2)
It doesn't prevent equality tests in a single encrypted domain. But in a single encrypted domain, two ciphertexts for the same plaintext (i.e. including an extra block for obfuscation/resolution is cheating) are the same anyways.
No, they are not. This is what is called randomized encryption, and in fact is the only way to make public key encryption secure. Otherwise you could do as you say, guess the plaintext for a particular ciphertext, encrypt your guess yourself (remember in public key cryptography anyo
Is the plaintext needed post-encryption? (Score:3, Informative)
A lot of respondents seem to have seized on a spurious notion of what this is all about. That isn't surprising since the Slashdot article and the press release and even the abstract are rather obscure. No sign of a preprint, but the same abstract shows up for a number of colloquiums in the last couple of months. The paper is from a proceedings, so it may itself not be especially profound.
The abstract says: "We propose a fully homomorphic encryption scheme -- i.e., a scheme that allows one to evaluate circuits over encrypted data without being able to decrypt. Our solution comes in three steps. First, we provide a general result -- that, to construct an encryption scheme that permits evaluation of arbitrary circuits, it suffices to construct an encryption scheme that can evaluate (slightly augmented versions of) its own decryption circuit; we call a scheme that can evaluate its (augmented) decryption circuit bootstrappable."
The encryption and compression literature tends to use the word "scheme" where others might say algorithm or transform. "Circuits" here is a term of art (maybe arising originally from actual physical circuits, as in the Enigma machine?)
"An encryption scheme that permits evaluation of arbitrary circuits" suggests only that the possessor of the private key can generate these arbitrary queries, not that anybody and their brother can scavenge the encrypted data. It isn't stated whether such a query also requires the plaintext. It would be pretty cool if one feature were to be able to discard the plaintext post-encryption.
The gimmick appears to be that the arbitrary circuit can include the decryption itself (the bootstrap part). Note that this feature is far more cool (assuming it works) than all the nonsense about cloud computing. Somehow the data are *arbitrarily* available to properly encoded queries without ever being exposed - even to the CPU performing the operations. This processor could be on the same machine, on some remote server, in the cloud or across the galaxy. How cool is that?
Description is nonsense (Score:2)
This is nonsense: unlimited analysis being possible is the same thing as confidentiality being sacrificed.
Maybe there is something significant and important here, but TFA doesn't provide a clue as to what it is.
Doh! (Score:2)
I downloaded the PDF paper and it says "We omit full details due to lack of space...". Doh!!!
What use is an ACM account when white papers "omit full details"?
Well I suppose they don't have to kill me as they omitted the full details... that's something at least.
Ummm... (Score:2)
Clarification on the technology (Score:5, Informative)
A few misconceptions continue to circulate here; let me try to shed some light.
First, the encryption system is apparently not practical in its current form. Maybe improvements will occur some day to make it practical, maybe not. It is still a major theoretical breakthrough because fully homomorphic encryption had often been thought to be impossible in the past. It has been a long sought goal in cryptography and it is remarkable to see it finally achieved. So in practice nobody is going to be doing spam filtering, income tax returns, or anonymous google searches any time soon.
Second, several people have gotten tripped up over an apparent weakness: if you can calculate E(X-Y) you can get an encryption of 0; if you can calculate E(X/Y) you can get an encryption of 1; and from these you could get other encryptions and potentially break the system. This idea fails for two reasons: first, it is a public-key system, so you don't need to go through all this rigamarole to get encryptions of 0, 1, or anything. In public key cryptography, anyone can encrypt data under a given key, without knowing any secrets. So it is already possible to get encryptions of known values, even without the special homomorphic properties. Second, in order for public key systems to be secure, they need to have a randomization property. In randomized encryption, there are multiple ciphertext values that encrypt the same plaintext. Basically, the encryption algorithm takes both the plaintext and a random value, and produces the ciphertext. Each different possible random value causes the same plaintext to go to a different ciphertext. The decryption algorithm nevertheless can take any of these different ciphertext values and produce the same plaintext.
This may be confusing because the most well known public key encryption system, RSA is not randomized. At the time it was invented, this aspect was not well understood. Shortly afterwards it became clear how important randomization is. Other encryption systems like ElGamal do use randomization, and RSA was adapted to allow randomization via what is called a "random padding" layer, known by the technical name PKCS-1. This adds the randomness which allows RSA to be used securely.
One other point is that people are getting hung up about what "fully" homomorphic encryption covers. Exactly what operations can you do? I think the best way to think of it is to go down to the binary level. We know that in our computers, at the lowest level everything is 1's and 0's. These get combined with elementary logical operations like AND, OR, NOT, XOR, and so on. Using these primitive operations, all the complexity of modern programs can be built up.
In the case of the homomorphic encryption, it is probably best to think of the values being encrypted in binary form, as encryptions of 1's and 0's. Keep in mind the point above about randomized encryption: all the encryptions of 1 look different, as do all the encryptions of 0. You can't tell whether a given value encrypts a 1 or a 0. Given these encrypted values, you can compute AND, OR, XOR, NOT and so on with these values, and get new encrypted values as the answers. You don't know the value of the outputs, they are encrypted. Only the holder of the private key, who originally encrypted the data, could decrypt the output. But you can continue to work with these output values, do more calculations with them, and so on.
Let me give an example of how you could do an equality comparison. Suppose you have two encrypted values and want to determine if they are the same. Recall that we are working in binary, so you actually have two sequences of encrypted bits; some are encrypted 1's and some are encrypted 0's, but you can't tell which. So the first thing you compute is the XOR of corresponding bits in the two values: XOR the 1st bits of each value; XOR the 2nd bits of each value, and so on. Now if the values are equal, the results are all encryptions of 0's. If the values are different, some of the results will be encryptions of 1's. But aga
Re: (Score:2, Insightful)
You've thoroughly misunderstood what this is about, I think. AFAIK this is about performing computations on encrypted data without having to decrypt the data.
Say I have a function F that I want to run on data A to produce data B. i.e. B=F(A)
F is an expensive function to run (big computation), so I'd like to hire the performance of computation service from someone, let's call them MBI, with a huge ass-computer.
But I don't want MBI to know the data A.
So I encrypt it, and give them CryptA instead.
But applying
Re: (Score:2)
And then I could decrypt CryptB to get the B I wanted. Since MBI only ever have CryptA, function G and CryptB, I don't leak input A or output B to them (I'm not sure off the top of my head whether they can derive F from G)
They can, AFAICT. F must be expressed in terms of two binary operations that distribute (like * and +, or & and ^). The translated function G will consist of just replacing each instance of * with & and + with ^, or whatever the equivalent operations are. So you know exactly what they're doing.
I could have been wrong there, not actually a cryptographer.
Neither am I, but I'm a grad student in math, and I know my homomorphisms. :)
Re: (Score:2)
They can, AFAICT. F must be expressed in terms of two binary operations that distribute (like * and +, or & and ^). The translated function G will consist of just replacing each instance of * with & and + with ^, or whatever the equivalent operations are. So you know exactly what they're doing.
. . . I'm not so sure about this, actually. You might not know what the binary operations actually signify. You could probably gain some info in any event, but the point is it might be a lot less than you'd gain if you could decrypt the data, if the method is actually secure.
Re: (Score:2)
They not only can't look at the data, they can't look at the results of the analysis. Only you can. That's the point.
Re: (Score:3, Informative)
Re: (Score:3, Informative)
The summary is wrong. A Privacy Homomorphism allows third parties to compute calculations on the data on your behalf without decrypting either the input or the output. In other words, the cloud provider could, for example, total up your sales data without ever decrypting the individual sale information or the final total. The encrypted final total would then be given to you, and you would decrypt it to learn what it was.
At no point does a third party have access to a decrypted form of your data.
Re:Analysis can mean Disclosure of Information (Score:4, Informative)
It does now. That's the point. I don't think the wording in the article is very good. What they're doing is more like simulation of circuits (AND and XOR gates). You can construct a general purpose computer from such gates. You can run a gate-level simulation of such a machine, but your simulation would normally use unencrypted data. This breakthrough allows your simulated machine to use encrypted data, so you feed it encrypted data and you get out encrypted data. All the guy running the simulation knows is the design of the simulated hardware.
:-) And no, I never found a method that could handle both AND and XOR, so I look forward to reading more about this.
This can be taken one step further. If you simulate a programmable computer - not just a fixed algorithm - then the guy running the simulation won't even know what *algorithm* he's running in addition to not knowing what the data is since the program is just encrypted data. I've been toying with this for a while without knowing the proper name for it
Re: (Score:2)
Mod Parent "-1 Judas"