A very casual introduction to Fully Homomorphic Encryption (2012)(blog.cryptographyengineering.com) |
A very casual introduction to Fully Homomorphic Encryption (2012)(blog.cryptographyengineering.com) |
> Just try converting that into a circuit
Hmm. I think this article is a little behind the times. Loops are not a problem with Homomorphic encryption, as we can create circuits that work exactly like a transistor-based CPU.
In fact, I've got an implementation of one that I've been working on here: https://github.com/mmastrac/oblivious-cpu
The trick to making this work is that you may not know how long the computation is going to take, so you need to either add a set number of iterations to run (ie: clock cycles), or send back encrypted updates as you run to give your trusted computer a chance to determine when the calculation has finished.
> I mean, it’s not impossible to unroll loops (if you know the maximum number of iterations), but the resulting circuit is not likely to be practical. Moreover, this isn’t purely an issue with the use of circuits, but rather with the use of encrypted data. No matter what computational model you employ, you’re always going to have difficulty with things like control flow changes that depend on input data that the executing party can’t see.
If you want to add in interaction, then you have other far more efficient schemes for achieving such FHE, like garbled circuits
Which means it can't be used to allow an untrusted party to run your encrypted server, and have the server communicate with parties that it doesn't trust. Which is what most servers do. Unless I'm mistaken, or there has been an advance?
In general, this is only of theoretical interest, since the interpreter apply and the specialized interpreter eval_x are large, complicated programs.
Is it practical on an intel cpu ?
Do you mean that if all operations of a universal Turing machine were homomorphic then you can encryt the code with a hard-coded input and get an encrypted output?
Can you also elaborate on your server example? I don't understand what you are trying to do. (Whats an "encrypted server"?
What you'd like to be able to do, is something like encrypt the code of a tor node in such a way that it could be run by an untrusted hosting provider, without breaking the security of tor.
[1] https://www.schneier.com/books/cryptography_engineering/
http://outsourcedbits.org/2012/06/26/applying-fully-homomorp...
http://outsourcedbits.org/2012/09/29/applying-fully-homomorp...
There is another field called cryptographic program obfuscation that tries to avoid this problem, and actually create "encrypted" programs that can output useful unencrypted outputs that anyone can use. There are a lot of restrictions on that type of program. Here's another long (and very high level) blog post on that: https://blog.cryptographyengineering.com/2014/02/21/cryptogr...
https://blog.cryptographyengineering.com/2014/02/21/cryptogr... seems an interesting article.