Uploaded byhubx
PDF, PPTX695 views

Introduction to Homomorphic Encryption

The document explains homomorphic encryption, highlighting its ability to perform operations on encrypted data without decryption, which enhances privacy in various applications such as medical records and spam filtering. It discusses different types of homomorphisms and compares various encryption schemes, emphasizing the importance of selecting an appropriate scheme for specific applications. Practical examples illustrate how homomorphic encryption can facilitate secure computations while maintaining data privacy.

Embed presentation

Download as PDF, PPTX
Introduction to Homomorphic Encryption Hubert Hesse Christoph Matthies Robert Lehmann 1 @hubx @chrisma0 @rlehmann 2013
operation(plain) What is that? 2
operation(plain) == decrypt(operation'(encrypt(plain))) What is that? 3
operation(plain) == decrypt(operation'(encrypt(plain))) i.e. outputs of operations on encrypted data are still usable What is that? 4
July 2013: Change in "De-Mail-Gesetz" defining De-Mail as secure [1] ● Needs to be decrypted by provider to "check for viruses" ● (Secret) key on server of provider ○ Server becomes juicy target ● Homomorphic encryption ○ Can check without decryption [1] http://www.spiegel.de/netzwelt/netzpolitik/de-mail-bundestag-erklaert-bundes-mail-per-gesetz-als-sicher-a-895361.html Current context 5
● Medical records ○ Analyze disease / treatment without disclosing them ○ Search for DNA markers without revealing DNA ○ "Digitale Krankenakte" ● Spam filtering ○ Blacklisting encrypted mails ○ Third parties can scan your PGP traffic Use cases Doing something without knowing what6
Homomorphism groups (P, ⊕) and (C, ⊗) relation f : P → C f is a group homomorphism in P and C, if: ∀ a,b ∈ P: f(a ⊕ b) = f(a) ⊗ f(b) Especially: ∀ a,b ∈ P: a ⊕ b = f-1 ( f(a) ⊗ f(b) ) 7
be aware, mapping from one operation to another Examples groups (R, +) and (R* , ×) function: R → R exp(x+y) = exp(x) × exp(y) 10x+y = 10x × 10y ln(a×b) = ln(a) + ln(b) 8
In RSA, multiplication is (accidentally) a homomorphism Practical example 9
Imagine width = 7 height = 3 10
what's the area? Imagine width = 7 height = 3 11
area solver™ Enter the cloud width = 7 height = 3 12
Enter the cloud width = 7 height = 3 privacy privacy area solver™ 13
Enter the cloud width = 7 height = 3 privacy privacy area solver™ RSA to the rescue 14
private key (47, 143) public key (23, 143) public key (23, 143) private key (47, 143) Select p=11,q=13 p*q=143=N φ(N)=φ(143)=(p-1)*(q-1)=120 select e w/ gcd(e,120)=1, e=23 Calculate e*d ≡ 1 mod φ(N): e*d+k*φ(N)=1=gcd(e,φ(N)) =23*d+k*120=1=gcd(23,120) d=47, k=-9 15 the justified sinner, flickr (CC BY-NC-SA 2.0)
wait, RSA? Encryption in RSA ≡ Homomorphic property 16
width = 7 height = 3 private public encrypt private key := (47, 143) public key := (23, 143) 17
width = 7 height = 3 encrypt private public cw ≡ widthe mod N cw ≡ 723 mod 143 cw = 2 ch ≡ heighte mod N ch ≡ 323 mod 143 ch = 126 private key := (47, 143) public key := (23, 143) 18
width = 7 height = 3 encrypt width = 2 height = 126 private public private key := (47, 143) public key := (23, 143) 19
width = 7 height = 3 private public width = 2 height = 126 area solver private key := (47, 143) public key := (23, 143) 20
width = 7 height = 3 private public width = 2 height = 126 area = 252 area solver private key := (47, 143) public key := (23, 143) 21
width = 7 height = 3 private public width = 2 height = 126 area = 252 private key := (47, 143) public key := (23, 143) 22
width = 7 height = 3 private public width = 2 height = 126 area = 252 area = decrypt(252) = 21 private key := (47, 143) public key := (23, 143) decrypt area = 21 area ≡ cipherd mod N ≡ 25247 mod 143 = 21 23
width = 7 height = 3 private public width = 2 height = 126 area = 252 area = decrypt(252) = 21 = 7 x 3 private key := (47, 143) public key := (23, 143) decrypt area = 21 (sanity check) 24
● RSA allows only multiplication ○ Other operations on ciphertext (e.g. +) break decryption ● Other schemes allow different operations (e.g. + and -) ● Algebra homomorphisms allows x and + ○ Much more powerful Different homomorphisms circumference calculation correct: 3*2 + 7*2 = 20 encrypted: 2*2 + 2*126 = 256 decryption: 25647 mod 143 = 42 42 ≠ 20 ⚡ f: A→B alg. hom. ⇔ ∀k∈K; x,y∈A: • f(k*x)=k*f(x) • f(x+y)=f(x)+f(y) • f(x*y)=f(x)*f(y) 25
● RSA allows only multiplication ○ Other operations on ciphertext (e.g. +) break decryption ● Other schemes allow different operations (e.g. + and -) ● Algebra homomorphisms allows x and + ○ Much more powerful Different homomorphisms circumference calculation correct: 3*2 + 7*2 = 20 encrypted: 2*2 + 2*126 = 256 decryption: 25647 mod 143 = 42 42 ≠ 20 ⚡ f: A→B alg. hom. ⇔ ∀k∈K; x,y∈A: • f(k*x)=k*f(x) • f(x+y)=f(x)+f(y) • f(x*y)=f(x)*f(y) Need to select appropriate homomorphic encryption scheme for application 26
System Plaintext operation Cipher operation RSA × × Paillier +, − m×k, m+k ×, ÷ ck , c×gk ElGamal × m×k, mk × c×k, ck Goldwasser-Micali ⊕ × Benaloh +, − ×, ÷ Naccache-Stern +, − m×k ×, ÷ ck Sander-Young-Yung × + Okamoto-Uchiyama +, − m×k, m+k ×, ÷ ck , c+e(k) Boneh-Goh-Nissim Paillier (+, −, m×k, m+k) × (once) Paillier bilinear pairing US 7'995'750 / ROT13 + + 27
● Operations on ciphertext accumulate "noise" ○ Addition adds noise, multiplication multiplies it ○ Noise gets too high → decryption fails ● These "limited" algebra homomorphism schemes: Somewhat Homomorphic Encryption Schemes (simplified)Pollution 28 Bob August, flickr (CC BY-NC-SA 2.0)
● Using small N in RSA and large inputs ○ When output larger than RSA-modulus, decryption fails Pollution Calculate area of square using RSA 10*15=150 Encryption: c_w ≡ 1023 mod 143 ≡ 43 c_h = 1523 mod 143 = 20 c_a = 43*20 = 860 Decryption: a ≡ 86047 mod 143 (≡ 150 mod 143) ≡ 7 7 ≠ 150 ⚡ Example 15 10 29
Beyond + and × Every program can be expressed in terms of a digital circuit. * * referentially transparent, ie. w/o side effects, today() is not ref. transparent 30 Tristan Nitot, flickr (CC BY-NC-SA 2.0)
Beyond + and × Every digital circuit can be expressed in terms of AND, OR, and NOT. 31
Beyond + and × Every digital circuit can be expressed in terms of AND, OR, and NOT. (remember Disjunctive Normal Forms?) 32
Beyond + and × Every digital circuit can be expressed in terms of AND, OR, and XOR. XOR(x, 1) = NOT(x) NOT(AND(NOT(x), NOT(y))) = !(!x & !y) = OR(x, y) 33
With ∧ and ⊕ we can represent any operation Fully homomorphic encryptionFully homomorphic encryption 34 Duane Romanell, flickr (CC BY-NC-ND 2.0)Duane Romanell, flickr (CC BY-NC-ND 2.0)
Circuit Encryption ● Assume homomorphic enc: ○ 0-bits → even ints ○ 1-bits → odd ints ○ ⊕ → + ○ ∧ → × ○ Define: ∘ = (a + b) + ( a x b) (Logical OR) ⊕ { OR = (a ∧ b) ∧ (a ⊕ b) } (+ random r * secret p mod p!) { simple truth tables } 35
Circuit Encryption ● Single Bit Adder ○ A,B: inputs, Cin : carry-in, S: sum, Cout : carry-out Toy example S = ((A ⊕ B) ⊕ C) Cout = (A ∧ B) v ((A ⊕ B) ∧ Cin )36
S = ((A ⊕ B) ⊕ C) Cout = (A ∧ B) v ((A ⊕ B) ∧ Cin ) S = ((A + B) + C) Cout = (A × B) ∘ ((A+B) × Cin ) Circuit Encryption Toy example map operators 37
A B Cin S Cout 1 0 1 0 1 3 4 7 ? ?encrypted Circuit Encryption Toy example - calc. S S = ((A + B) + C) S = ((3 + 4) + 7) = ? apply 38
A B Cin S Cout 1 0 1 0 1 3 4 7 14 ?encrypted Circuit Encryption Toy example - calc. S S = ((A + B) + C) S = ((3 + 4) + 7) = 14 ≙ 0 39
A B Cin S Cout 1 0 1 0 1 3 4 7 14 649 Circuit Encryption Toy example - calc. Cout Cout = (A × B) ∘ ((A + B) × Cin ) Cout = (3 × 4) ∘ ((3 + 4) × 7) = 12 ∘ 49 = (12 + 49) + (12 * 49) = 61 + 588 = 649 ≙ 1 ∘ = (a + b) + (a x b) apply 40
Circuit Encryption ● Assume homomorphic enc: ○ 0-bits → even ints ○ 1-bits → odd ints ○ ⊕ → + ○ ∧ → × ○ Define: ∘ = (a + b) + ( a x b) (Logical OR) ⊕ { OR = (a ∧ b) ∧ (a ⊕ b) } (actually mod a secret p) { simple truth tables } 41
Circuit Enc. ● Encrypted Memory Access ● Example ¬ao ∧ ¬a1 ∧ m0 ao ∧ ¬a1 ∧ m1 ¬ao ∧ a1 ∧ m2 ao ∧ a1 ∧ m3 m0 m1 m2 m3 a0 a1 1 x x x 0 0 x 1 x x 1 0 x x 1 x 0 1 x x x 1 1 1 42
Encrypted Memory Access ● row3 = ao ∧ a1 ∧ m3 row2 = ¬ao ∧ a1 ∧ m2 row1 = ao ∧ ¬a1 ∧ m1 row0 = ¬ao ∧ ¬a1 ∧ m0 c = row0 ∨row1 ∨row2 ∨row3 [1] M Brenner, J Wiebelitz, G von Voigt. Secret program execution in the cloud applying homomorphic encryption. 201143
● row3 = ao ∧ a1 ∧ m3 row2 = ¬ao ∧ a1 ∧ m2 row1 = ao ∧ ¬a1 ∧ m1 row0 = ¬ao ∧ ¬a1 ∧ m0 c = row0 ∨row1 ∨row2 ∨row3 m = {1, 0, 1, 0} a = 01 Encrypted Memory Access 44
● row3 = ao ∧ a1 ∧ m3 row2 = ¬ao ∧ a1 ∧ m2 row1 = ao ∧ ¬a1 ∧ m1 row0 = ¬ao ∧ ¬a1 ∧ m0 c = row0 ∨row1 ∨row2 ∨row3 m = {1, 0, 1, 0} a = 01 Encrypted Memory Access 45
● row3 = ao ∧ a1 ∧ 0 row2 = ¬ao ∧ a1 ∧ 1 row1 = ao ∧ ¬a1 ∧ 0 row0 = ¬ao ∧ ¬a1 ∧ 1 c = row0 ∨row1 ∨row2 ∨row3 m = {1, 0, 1, 0} a = 01 Encrypted Memory Access 46
● row3 = ao ∧ a1 ∧ 0 row2 = ¬ao ∧ a1 ∧ 1 row1 = ao ∧ ¬a1 ∧ 0 row0 = ¬ao ∧ ¬a1 ∧ 1 c = row0 ∨row1 ∨row2 ∨row3 m = {1, 0, 1, 0} a = 01 Encrypted Memory Access 47
● row3 = 0 ∧ 1 ∧ 0 row2 = 1 ∧ 1 ∧ 1 row1 = 0 ∧ 0 ∧ 0 row0 = 1 ∧ 0 ∧ 1 c = row0 ∨row1 ∨row2 ∨row3 m = {1, 0, 1, 0} a = 01 Encrypted Memory Access 48
● row3 = 0 ∧ 1 ∧ 0 = 0 row2 = 1 ∧ 1 ∧ 1 = 1 row1 = 0 ∧ 0 ∧ 0 = 0 row0 = 1 ∧ 0 ∧ 1 = 0 c = row0 ∨row1 ∨row2 ∨row3 m = {1, 0, 1, 0} a = 01 Encrypted Memory Access 49
● row3 = 0 ∧ 1 ∧ 0 = 0 row2 = 1 ∧ 1 ∧ 1 = 1 row1 = 0 ∧ 0 ∧ 0 = 0 row0 = 1 ∧ 0 ∧ 1 = 0 c = 0∨0∨1∨0 = 1 m = {1, 0, 1, 0} Encrypted Memory Access a = 01 50
● c = row0 ∘row1 ∘row2 ∘row3 row3 = 0 ∧ 1 ∧ 0 = 0 row2 = 1 ∧ 1 ∧ 1 = 1 row1 = 0 ∧ 0 ∧ 0 = 0 row0 = 1 ∧ 0 ∧ 1 = 0 row3 = (ao × a1 × 6) row2 = (ao + 1) × a1 × 9 row1 = (ao × (a1 + 1) × 4 row0 = (ao + 1) × (a1 + 1) × 5 ¬a0 ¬a1 → → → → c = 0∨0∨1∨0 = 1 m = {1, 0, 1, 0} m = {5, 4, 9, 6} a = {8, 3}a = 01 Encrypted Memory Access 0-bits → even ints 1-bits → odd ints ⊕ → + ∧ → × 51
● c = row0 ∘row1 ∘row2 ∘row3 row3 = 0 ∧ 1 ∧ 0 = 0 row2 = 1 ∧ 1 ∧ 1 = 1 row1 = 0 ∧ 0 ∧ 0 = 0 row0 = 1 ∧ 0 ∧ 1 = 0 row3 = (ao × a1 × 6) row2 = (ao + 1) × a1 × 9 row1 = (ao × (a1 + 1) × 4 row0 = (ao + 1) × (a1 + 1) × 5 ¬a0 ¬a1 → → → → c = 0∨0∨1∨0 = 1 m = {1, 0, 1, 0} m = {5, 4, 9, 6} a = {8, 3}a = 01 Encrypted Memory Access 52
● c = row0 ∘row1 ∘row2 ∘row3 row3 = 0 ∧ 1 ∧ 0 = 0 row2 = 1 ∧ 1 ∧ 1 = 1 row1 = 0 ∧ 0 ∧ 0 = 0 row0 = 1 ∧ 0 ∧ 1 = 0 row3 = (8 × 3 × 6) row2 = (8 + 1) × 3 × 9 row1 = (8 × (3 + 1) × 4 row0 = (8 + 1) × (3 + 1) × 5 ¬a0 ¬a1 → → → → c = 0∨0∨1∨0 = 1 m = {1, 0, 1, 0} m = {5, 4, 9, 6} a = {8, 3}a = 01 Encrypted Memory Access 53
● c = row0 ∘row1 ∘row2 ∘row3 row3 = 0 ∧ 1 ∧ 0 = 0 row2 = 1 ∧ 1 ∧ 1 = 1 row1 = 0 ∧ 0 ∧ 0 = 0 row0 = 1 ∧ 0 ∧ 1 = 0 row3 = (8 × 3 × 6) = 144 row2 = (8 + 1) × 3 × 9 = 243 row1 = (8 × (3 + 1) × 4 = 128 row0 = (8 + 1) × (3 + 1) × 5 = 180 ¬a0 ¬a1 → → → → c = 0∨0∨1∨0 = 1 m = {1, 0, 1, 0} m = {5, 4, 9, 6} a = {8, 3}a = 01 Encrypted Memory Access 54
● c = 180∘128∘243∘144 = 826087619 ≙ 1 row3 = 0 ∧ 1 ∧ 0 = 0 row2 = 1 ∧ 1 ∧ 1 = 1 row1 = 0 ∧ 0 ∧ 0 = 0 row0 = 1 ∧ 0 ∧ 1 = 0 row3 = (8 × 3 × 6) = 144 row2 = (8 + 1) × 3 × 9 = 243 row1 = (8 × (3 + 1) × 4 = 128 row0 = (8 + 1) × (3 + 1) × 5 = 180 ¬a0 ¬a1 → → → → c = 0∨0∨1∨0 = 1 m = {1, 0, 1, 0} m = {5, 4, 9, 6} a = {8, 3}a = 01 Encrypted Memory Access 55
Fully homomorphic encryption ● "Holy Grail" of cryptography ● First proposed within a year of RSA development ○ 1979 ○ Idea due to weird homomorphic property of RSA ● for more than 30 years: unclear whether FHE even possible ○ During that time: best one = Boneh-Goh-Nissim (remember the area solver example) (the one where only one multiplication was possible) 56
"fully homomorphic encryption" Google trends 1000 patents 200 patents 57
Gentry's approach ● 2009: Craig Gentry shows fully homomorphic encryption in his doctoral thesis ● Employs somewhat homomorphic encryption scheme using ideal lattices ● Scheme is bootstrappable ○ can evaluate its own decryption circuit ● Through recursive self-embedding, leads to FHE ○ ciphertexts are reencrypted, eliminating noise (based on "shortest lattice vector" problem used in cryptography, which is NP-hard) 58
Gentry's approachGentry's approach @ł€¶ħæſðđŋæſþðøđł«»¢„ 0101100101000101111 @ł€¶ħæſðđŋæſþðøđł«»¢„ ³½¬³½¬[¬¼]²′³}³¬½¼¬³²³] qebrgibfvjkadfnvarskdjhfq þø»«ĸ@ł½{µ„þøþ@↓ðħþ plaintext ciphertext refreshed ciphertext ciphertext secret key encryption of secret key 59 catechism, flickr (CC BY-NC-SA 2.0)
https://www.youtube.com/watch?v=Y1TxCiOuoYY60
[...] a simple string search using homomorphic encryption is about a trillion times slower than without encryption. [1] Issues 1 000 000 000 000x 61 [1] CryptDB: A practical encrypted relational DBMS, RA Popa, N Zeldovich, H Balakrishnan, 2011
62
Fully hom. enc. IRL ● HELib by Shai Halevi (2013) ○ Implementation of Brakerski-Gentry-Vaikuntanathan[1] scheme ○ Using many optimizations in literature[2][3] for speed ○ Does not implement bootstrapping (yet) [1] Zvika Brakerski, Craig Gentry, Vinod Vaikuntanathan: (Leveled) fully homomorphic encryption without bootstrapping. ITCS 201 [2] Nigel P. Smart, Frederik Vercauteren: Fully Homomorphic SIMD Operations. IACR Cryptology ePrint Archive 2011: 133 (2011) [3] Craig Gentry and Shai Halevi and Nigel P. Smart Homomorphic Evaluation of the AES Circuit, CRYPTO 2012 Performance Modulus Time for addition (ms) Time for multiplication (ms) 257 0.7 39 8209 0.7 38 65537 2.9 177 Even numbers < 65537, 80 Bits of security 63
Visions of a fully homomorphic cryptosystem have been dancing in cryptographers' heads for thirty years. [...] It will be years before a sufficient number of cryptographers examine the algorithm that we can have any confidence that the scheme is secure. [1] —Bruce Schneier, cryptographer, April 2013 Criticism “ “ 64 [1] Homomorphic Encryption Breakthrough, Schneier on Security, Bruce Schneier https://www.schneier. com/blog/archives/2009/07/homomorphic_enc.html
Last few years 65
● ○ ■ ○ ● ● ™ ○ Conclusion 66
Conclusion — Halevi, 2012 “ “ 67 [1] Recent Advances in Homomorphic Encryption, presentation by Shai Halevi, IBM Research, Feb. 13, 2012, http://n csail.mit.edu/sys-security/FHE.pptx
Thanks for listening Questions? 68
Source: http://www.google.com/patents/US7995750

More Related Content

PPTX
Secure and privacy-preserving data transmission and processing using homomorp...
byDefCamp
 
PDF
Distributed Machine Learning with Apache Mahout
bySuneel Marthi
 
PPT
Logic Design - Chapter 3: Boolean Algebra
byGouda Mando
 
PPTX
Image Cryptography and Steganography
byMohammad Amin Amjadi
 
PDF
Ky-thuat-bien-doi-vi-phan-de-tim-nguyen-ham
byVui Lên Bạn Nhé
 
PDF
Some examples of the 64-bit code errors
byPVS-Studio
 
PDF
Program Language - Fall 2013
byYun-Yan Chi
 
PDF
01 derivadas
byklorofila
 
Secure and privacy-preserving data transmission and processing using homomorp...
byDefCamp
 
Distributed Machine Learning with Apache Mahout
bySuneel Marthi
 
Logic Design - Chapter 3: Boolean Algebra
byGouda Mando
 
Image Cryptography and Steganography
byMohammad Amin Amjadi
 
Ky-thuat-bien-doi-vi-phan-de-tim-nguyen-ham
byVui Lên Bạn Nhé
 
Some examples of the 64-bit code errors
byPVS-Studio
 
Program Language - Fall 2013
byYun-Yan Chi
 
01 derivadas
byklorofila
 

What's hot

DOC
Hw #2
byAbdo Khalaf
 
PDF
ASFWS 2012 - Hash-flooding DoS reloaded: attacks and defenses par Jean-Philip...
byCyber Security Alliance
 
PDF
Integral table
byAnkitcos0
 
PDF
138191 rvsp lecture notes
byAhmed Tayeh
 
PDF
Single page-integral-table
byMonique Anderson
 
PDF
Single page-integral-table
byWeverson Luiz Pereira
 
PDF
Derivative of an exponential function
byNadeem Uddin
 
PDF
数学カフェ 確率・統計・機械学習回 「速習 確率・統計」
byKen'ichi Matsui
 
PDF
Gems of GameplayKit. UA Mobile 2017.
byUA Mobile
 
PDF
「ベータ分布の謎に迫る」第6回 プログラマのための数学勉強会 LT資料
byKen'ichi Matsui
 
PDF
Microsoft Word Hw#3
bykkkseld
 
PPTX
Bresenham's line drawing algorithm
byMani Kanth
 
PDF
SOAL RANGKAIAN LOGIKA
byAfrilio Franseda
 
PDF
Артём Акуляков - F# for Data Analysis
bySpbDotNet Community
 
PDF
Elementos finitos
byjd
 
PPTX
adders/subtractors, multiplexers, intro to ISA
byi i
 
PDF
Derivadas
byCEU Benito Juarez
 
PDF
Integral table
byzzzubair
 
PDF
Integral table
byAntonio Alanya
 
PDF
Machine Learning Introduction
byAkira Sosa
 
Hw #2
byAbdo Khalaf
 
ASFWS 2012 - Hash-flooding DoS reloaded: attacks and defenses par Jean-Philip...
byCyber Security Alliance
 
Integral table
byAnkitcos0
 
138191 rvsp lecture notes
byAhmed Tayeh
 
Single page-integral-table
byMonique Anderson
 
Single page-integral-table
byWeverson Luiz Pereira
 
Derivative of an exponential function
byNadeem Uddin
 
数学カフェ 確率・統計・機械学習回 「速習 確率・統計」
byKen'ichi Matsui
 
Gems of GameplayKit. UA Mobile 2017.
byUA Mobile
 
「ベータ分布の謎に迫る」第6回 プログラマのための数学勉強会 LT資料
byKen'ichi Matsui
 
Microsoft Word Hw#3
bykkkseld
 
Bresenham's line drawing algorithm
byMani Kanth
 
SOAL RANGKAIAN LOGIKA
byAfrilio Franseda
 
Артём Акуляков - F# for Data Analysis
bySpbDotNet Community
 
Elementos finitos
byjd
 
adders/subtractors, multiplexers, intro to ISA
byi i
 
Derivadas
byCEU Benito Juarez
 
Integral table
byzzzubair
 
Integral table
byAntonio Alanya
 
Machine Learning Introduction
byAkira Sosa
 

Similar to Introduction to Homomorphic Encryption

PDF
IHE-Columbia-Theory- diploma Seminar.pdf
bycatanonymous47
 
PPTX
Computing on Encrypted Data
byNew York Technology Council
 
PPTX
lec20111111111111111111111111111111111111.pptx
byssuser8cd160
 
PPTX
lec20111111111111111111111111111111111111.pptx
byssuser8cd160
 
PPTX
Homomorphic Encryption
byGöktuğ Serez
 
PDF
Js2517181724
byIJERA Editor
 
PDF
Js2517181724
byIJERA Editor
 
PPT
Chiffremtn asymetriqye AES Introduction.ppt
byMayouf3
 
PDF
Modern Cryptography
byJames McGivern
 
PPTX
Cryptography
byChristian Bokhove
 
PDF
10 RSA
bySam Bowne
 
PPTX
6-PKCpartII-Encryptionandsignatures.pptx
byfarouqalfuhidi
 
PDF
Sasha Romijn - Everything I always wanted to know about crypto, but never tho...
byCodemotion
 
PDF
CNIT 141: 10. RSA
bySam Bowne
 
PPT
Class3
byankitasinghbsc
 
PDF
IRJET - Multi-Key Privacy in Cloud Computing
byIRJET Journal
 
PDF
Cryptography 202
byUTD Computer Security Group
 
PDF
Ci25500508
byIJERA Editor
 
ODP
Encryption basics
byKevin OBrien
 
PPT
IDEA.ppt
byDummyAccountRahulSin
 
IHE-Columbia-Theory- diploma Seminar.pdf
bycatanonymous47
 
Computing on Encrypted Data
byNew York Technology Council
 
lec20111111111111111111111111111111111111.pptx
byssuser8cd160
 
lec20111111111111111111111111111111111111.pptx
byssuser8cd160
 
Homomorphic Encryption
byGöktuğ Serez
 
Js2517181724
byIJERA Editor
 
Js2517181724
byIJERA Editor
 
Chiffremtn asymetriqye AES Introduction.ppt
byMayouf3
 
Modern Cryptography
byJames McGivern
 
Cryptography
byChristian Bokhove
 
10 RSA
bySam Bowne
 
6-PKCpartII-Encryptionandsignatures.pptx
byfarouqalfuhidi
 
Sasha Romijn - Everything I always wanted to know about crypto, but never tho...
byCodemotion
 
CNIT 141: 10. RSA
bySam Bowne
 
Class3
byankitasinghbsc
 
IRJET - Multi-Key Privacy in Cloud Computing
byIRJET Journal
 
Cryptography 202
byUTD Computer Security Group
 
Ci25500508
byIJERA Editor
 
Encryption basics
byKevin OBrien
 
IDEA.ppt
byDummyAccountRahulSin
 

Recently uploaded

PDF
Mastering Agentic Orchestration with UiPath Maestro | Hands on Workshop
byUiPathCommunity
 
PDF
[BDD 2025 - Full-Stack Development] Digital Accessibility: Why Developers nee...
bywintari3
 
PDF
Mulesoft Meetup Online Portuguese: MCP e IA
byPedro Baroni
 
PDF
Accessibility & Inclusion: What Comes Next. Presentation of the Digital Acces...
byAssociazione Digital Days
 
PPTX
Support, Monitoring, Continuous Improvement & Scaling Agentic Automation [3/3]
byUiPathCommunity
 
PPTX
Connecting the unconnectable: Exploring LoRaWAN for IoT
byasasiraarthur
 
PDF
How Much Does It Cost to Build an eCommerce Website in 2025.pdf
byPixlogix Infotech
 
PDF
PCCC25（設立25年記念PCクラスタシンポジウム）：エヌビディア合同会社 テーマ２「NVIDIA BlueField-4 DPU」
byPC Cluster Consortium
 
PDF
Cheryl Hung, Vibe Coding Auth Without Melting Down! isaqb Software Architectu...
byCheryl Hung
 
PDF
The Necessity of Digital Forensics, the Digital Forensics Process & Laborator...
bychrstnpetwinchester
 
PDF
[BDD 2025 - Full-Stack Development] Agentic AI Architecture: Redefining Syste...
byWintari Yasmin
 
PDF
Lets Build a Serverless Function with Kiro
byChris Bingham
 
PDF
10 Best Automation QA Testing Software Tools in 2025.pdf
byRohitBhandari66
 
PDF
"DISC as GPS for team leaders: how to lead a team from storming to performing...
byFwdays
 
PDF
ODSC AI West: Agent Optimization: Beyond Context engineering
byShashikant Jagtap
 
PPTX
MuleSoft AI Series : Introduction to MCP
byMulesoftMunichMeetup
 
PDF
Crane Accident Prevention Guide: Key OSHA Regulations for Safer Operations
bySharpEagle Technology
 
PDF
Agentic Intro and Hands-on: Build your first Coded Agent
byUiPathCommunity
 
PDF
Integrating AI with Meaningful Human Collaboration
byCadabra Studio
 
PDF
MuleSoft Meetup: Dreamforce'25 Tour- Vibing With AI & Agents.pdf
byTintu Jacob Shaji
 
Mastering Agentic Orchestration with UiPath Maestro | Hands on Workshop
byUiPathCommunity
 
[BDD 2025 - Full-Stack Development] Digital Accessibility: Why Developers nee...
bywintari3
 
Mulesoft Meetup Online Portuguese: MCP e IA
byPedro Baroni
 
Accessibility & Inclusion: What Comes Next. Presentation of the Digital Acces...
byAssociazione Digital Days
 
Support, Monitoring, Continuous Improvement & Scaling Agentic Automation [3/3]
byUiPathCommunity
 
Connecting the unconnectable: Exploring LoRaWAN for IoT
byasasiraarthur
 
How Much Does It Cost to Build an eCommerce Website in 2025.pdf
byPixlogix Infotech
 
PCCC25（設立25年記念PCクラスタシンポジウム）：エヌビディア合同会社 テーマ２「NVIDIA BlueField-4 DPU」
byPC Cluster Consortium
 
Cheryl Hung, Vibe Coding Auth Without Melting Down! isaqb Software Architectu...
byCheryl Hung
 
The Necessity of Digital Forensics, the Digital Forensics Process & Laborator...
bychrstnpetwinchester
 
[BDD 2025 - Full-Stack Development] Agentic AI Architecture: Redefining Syste...
byWintari Yasmin
 
Lets Build a Serverless Function with Kiro
byChris Bingham
 
10 Best Automation QA Testing Software Tools in 2025.pdf
byRohitBhandari66
 
"DISC as GPS for team leaders: how to lead a team from storming to performing...
byFwdays
 
ODSC AI West: Agent Optimization: Beyond Context engineering
byShashikant Jagtap
 
MuleSoft AI Series : Introduction to MCP
byMulesoftMunichMeetup
 
Crane Accident Prevention Guide: Key OSHA Regulations for Safer Operations
bySharpEagle Technology
 
Agentic Intro and Hands-on: Build your first Coded Agent
byUiPathCommunity
 
Integrating AI with Meaningful Human Collaboration
byCadabra Studio
 
MuleSoft Meetup: Dreamforce'25 Tour- Vibing With AI & Agents.pdf
byTintu Jacob Shaji
 

Introduction to Homomorphic Encryption

  • 1.
    Introduction to Homomorphic Encryption HubertHesse Christoph Matthies Robert Lehmann 1 @hubx @chrisma0 @rlehmann 2013
  • 2.
  • 3.
  • 4.
    operation(plain) == decrypt(operation'(encrypt(plain))) i.e. outputs ofoperations on encrypted data are still usable What is that? 4
  • 5.
    July 2013: Change in"De-Mail-Gesetz" defining De-Mail as secure [1] ● Needs to be decrypted by provider to "check for viruses" ● (Secret) key on server of provider ○ Server becomes juicy target ● Homomorphic encryption ○ Can check without decryption [1] http://www.spiegel.de/netzwelt/netzpolitik/de-mail-bundestag-erklaert-bundes-mail-per-gesetz-als-sicher-a-895361.html Current context 5
  • 6.
    ● Medical records ○Analyze disease / treatment without disclosing them ○ Search for DNA markers without revealing DNA ○ "Digitale Krankenakte" ● Spam filtering ○ Blacklisting encrypted mails ○ Third parties can scan your PGP traffic Use cases Doing something without knowing what6
  • 7.
    Homomorphism groups (P, ⊕)and (C, ⊗) relation f : P → C f is a group homomorphism in P and C, if: ∀ a,b ∈ P: f(a ⊕ b) = f(a) ⊗ f(b) Especially: ∀ a,b ∈ P: a ⊕ b = f-1 ( f(a) ⊗ f(b) ) 7
  • 8.
    be aware, mappingfrom one operation to another Examples groups (R, +) and (R* , ×) function: R → R exp(x+y) = exp(x) × exp(y) 10x+y = 10x × 10y ln(a×b) = ln(a) + ln(b) 8
  • 9.
    In RSA, multiplication is (accidentally) ahomomorphism Practical example 9
  • 10.
  • 11.
  • 12.
  • 13.
    Enter the cloud width= 7 height = 3 privacy privacy area solver™ 13
  • 14.
    Enter the cloud width= 7 height = 3 privacy privacy area solver™ RSA to the rescue 14
  • 15.
    private key (47, 143) publickey (23, 143) public key (23, 143) private key (47, 143) Select p=11,q=13 p*q=143=N φ(N)=φ(143)=(p-1)*(q-1)=120 select e w/ gcd(e,120)=1, e=23 Calculate e*d ≡ 1 mod φ(N): e*d+k*φ(N)=1=gcd(e,φ(N)) =23*d+k*120=1=gcd(23,120) d=47, k=-9 15 the justified sinner, flickr (CC BY-NC-SA 2.0)
  • 16.
    wait, RSA? Encryption inRSA ≡ Homomorphic property 16
  • 17.
    width = 7 height= 3 private public encrypt private key := (47, 143) public key := (23, 143) 17
  • 18.
    width = 7 height= 3 encrypt private public cw ≡ widthe mod N cw ≡ 723 mod 143 cw = 2 ch ≡ heighte mod N ch ≡ 323 mod 143 ch = 126 private key := (47, 143) public key := (23, 143) 18
  • 19.
    width = 7 height= 3 encrypt width = 2 height = 126 private public private key := (47, 143) public key := (23, 143) 19
  • 20.
    width = 7 height= 3 private public width = 2 height = 126 area solver private key := (47, 143) public key := (23, 143) 20
  • 21.
    width = 7 height= 3 private public width = 2 height = 126 area = 252 area solver private key := (47, 143) public key := (23, 143) 21
  • 22.
    width = 7 height= 3 private public width = 2 height = 126 area = 252 private key := (47, 143) public key := (23, 143) 22
  • 23.
    width = 7 height= 3 private public width = 2 height = 126 area = 252 area = decrypt(252) = 21 private key := (47, 143) public key := (23, 143) decrypt area = 21 area ≡ cipherd mod N ≡ 25247 mod 143 = 21 23
  • 24.
    width = 7 height= 3 private public width = 2 height = 126 area = 252 area = decrypt(252) = 21 = 7 x 3 private key := (47, 143) public key := (23, 143) decrypt area = 21 (sanity check) 24
  • 25.
    ● RSA allowsonly multiplication ○ Other operations on ciphertext (e.g. +) break decryption ● Other schemes allow different operations (e.g. + and -) ● Algebra homomorphisms allows x and + ○ Much more powerful Different homomorphisms circumference calculation correct: 3*2 + 7*2 = 20 encrypted: 2*2 + 2*126 = 256 decryption: 25647 mod 143 = 42 42 ≠ 20 ⚡ f: A→B alg. hom. ⇔ ∀k∈K; x,y∈A: • f(k*x)=k*f(x) • f(x+y)=f(x)+f(y) • f(x*y)=f(x)*f(y) 25
  • 26.
    ● RSA allowsonly multiplication ○ Other operations on ciphertext (e.g. +) break decryption ● Other schemes allow different operations (e.g. + and -) ● Algebra homomorphisms allows x and + ○ Much more powerful Different homomorphisms circumference calculation correct: 3*2 + 7*2 = 20 encrypted: 2*2 + 2*126 = 256 decryption: 25647 mod 143 = 42 42 ≠ 20 ⚡ f: A→B alg. hom. ⇔ ∀k∈K; x,y∈A: • f(k*x)=k*f(x) • f(x+y)=f(x)+f(y) • f(x*y)=f(x)*f(y) Need to select appropriate homomorphic encryption scheme for application 26
  • 27.
    System Plaintext operationCipher operation RSA × × Paillier +, − m×k, m+k ×, ÷ ck , c×gk ElGamal × m×k, mk × c×k, ck Goldwasser-Micali ⊕ × Benaloh +, − ×, ÷ Naccache-Stern +, − m×k ×, ÷ ck Sander-Young-Yung × + Okamoto-Uchiyama +, − m×k, m+k ×, ÷ ck , c+e(k) Boneh-Goh-Nissim Paillier (+, −, m×k, m+k) × (once) Paillier bilinear pairing US 7'995'750 / ROT13 + + 27
  • 28.
    ● Operations onciphertext accumulate "noise" ○ Addition adds noise, multiplication multiplies it ○ Noise gets too high → decryption fails ● These "limited" algebra homomorphism schemes: Somewhat Homomorphic Encryption Schemes (simplified)Pollution 28 Bob August, flickr (CC BY-NC-SA 2.0)
  • 29.
    ● Using smallN in RSA and large inputs ○ When output larger than RSA-modulus, decryption fails Pollution Calculate area of square using RSA 10*15=150 Encryption: c_w ≡ 1023 mod 143 ≡ 43 c_h = 1523 mod 143 = 20 c_a = 43*20 = 860 Decryption: a ≡ 86047 mod 143 (≡ 150 mod 143) ≡ 7 7 ≠ 150 ⚡ Example 15 10 29
  • 30.
    Beyond + and× Every program can be expressed in terms of a digital circuit. * * referentially transparent, ie. w/o side effects, today() is not ref. transparent 30 Tristan Nitot, flickr (CC BY-NC-SA 2.0)
  • 31.
    Beyond + and× Every digital circuit can be expressed in terms of AND, OR, and NOT. 31
  • 32.
    Beyond + and× Every digital circuit can be expressed in terms of AND, OR, and NOT. (remember Disjunctive Normal Forms?) 32
  • 33.
    Beyond + and× Every digital circuit can be expressed in terms of AND, OR, and XOR. XOR(x, 1) = NOT(x) NOT(AND(NOT(x), NOT(y))) = !(!x & !y) = OR(x, y) 33
  • 34.
    With ∧ and⊕ we can represent any operation Fully homomorphic encryptionFully homomorphic encryption 34 Duane Romanell, flickr (CC BY-NC-ND 2.0)Duane Romanell, flickr (CC BY-NC-ND 2.0)
  • 35.
    Circuit Encryption ● Assumehomomorphic enc: ○ 0-bits → even ints ○ 1-bits → odd ints ○ ⊕ → + ○ ∧ → × ○ Define: ∘ = (a + b) + ( a x b) (Logical OR) ⊕ { OR = (a ∧ b) ∧ (a ⊕ b) } (+ random r * secret p mod p!) { simple truth tables } 35
  • 36.
    Circuit Encryption ● SingleBit Adder ○ A,B: inputs, Cin : carry-in, S: sum, Cout : carry-out Toy example S = ((A ⊕ B) ⊕ C) Cout = (A ∧ B) v ((A ⊕ B) ∧ Cin )36
  • 37.
    S = ((A⊕ B) ⊕ C) Cout = (A ∧ B) v ((A ⊕ B) ∧ Cin ) S = ((A + B) + C) Cout = (A × B) ∘ ((A+B) × Cin ) Circuit Encryption Toy example map operators 37
  • 38.
    A B Cin SCout 1 0 1 0 1 3 4 7 ? ?encrypted Circuit Encryption Toy example - calc. S S = ((A + B) + C) S = ((3 + 4) + 7) = ? apply 38
  • 39.
    A B Cin SCout 1 0 1 0 1 3 4 7 14 ?encrypted Circuit Encryption Toy example - calc. S S = ((A + B) + C) S = ((3 + 4) + 7) = 14 ≙ 0 39
  • 40.
    A B Cin SCout 1 0 1 0 1 3 4 7 14 649 Circuit Encryption Toy example - calc. Cout Cout = (A × B) ∘ ((A + B) × Cin ) Cout = (3 × 4) ∘ ((3 + 4) × 7) = 12 ∘ 49 = (12 + 49) + (12 * 49) = 61 + 588 = 649 ≙ 1 ∘ = (a + b) + (a x b) apply 40
  • 41.
    Circuit Encryption ● Assumehomomorphic enc: ○ 0-bits → even ints ○ 1-bits → odd ints ○ ⊕ → + ○ ∧ → × ○ Define: ∘ = (a + b) + ( a x b) (Logical OR) ⊕ { OR = (a ∧ b) ∧ (a ⊕ b) } (actually mod a secret p) { simple truth tables } 41
  • 42.
    Circuit Enc. ● EncryptedMemory Access ● Example ¬ao ∧ ¬a1 ∧ m0 ao ∧ ¬a1 ∧ m1 ¬ao ∧ a1 ∧ m2 ao ∧ a1 ∧ m3 m0 m1 m2 m3 a0 a1 1 x x x 0 0 x 1 x x 1 0 x x 1 x 0 1 x x x 1 1 1 42
  • 43.
    Encrypted Memory Access ● row3 =ao ∧ a1 ∧ m3 row2 = ¬ao ∧ a1 ∧ m2 row1 = ao ∧ ¬a1 ∧ m1 row0 = ¬ao ∧ ¬a1 ∧ m0 c = row0 ∨row1 ∨row2 ∨row3 [1] M Brenner, J Wiebelitz, G von Voigt. Secret program execution in the cloud applying homomorphic encryption. 201143
  • 44.
    ● row3 = ao ∧ a1 ∧m3 row2 = ¬ao ∧ a1 ∧ m2 row1 = ao ∧ ¬a1 ∧ m1 row0 = ¬ao ∧ ¬a1 ∧ m0 c = row0 ∨row1 ∨row2 ∨row3 m = {1, 0, 1, 0} a = 01 Encrypted Memory Access 44
  • 45.
    ● row3 = ao ∧ a1 ∧m3 row2 = ¬ao ∧ a1 ∧ m2 row1 = ao ∧ ¬a1 ∧ m1 row0 = ¬ao ∧ ¬a1 ∧ m0 c = row0 ∨row1 ∨row2 ∨row3 m = {1, 0, 1, 0} a = 01 Encrypted Memory Access 45
  • 46.
    ● row3 = ao ∧ a1 ∧0 row2 = ¬ao ∧ a1 ∧ 1 row1 = ao ∧ ¬a1 ∧ 0 row0 = ¬ao ∧ ¬a1 ∧ 1 c = row0 ∨row1 ∨row2 ∨row3 m = {1, 0, 1, 0} a = 01 Encrypted Memory Access 46
  • 47.
    ● row3 = ao ∧ a1 ∧0 row2 = ¬ao ∧ a1 ∧ 1 row1 = ao ∧ ¬a1 ∧ 0 row0 = ¬ao ∧ ¬a1 ∧ 1 c = row0 ∨row1 ∨row2 ∨row3 m = {1, 0, 1, 0} a = 01 Encrypted Memory Access 47
  • 48.
    ● row3 = 0 ∧1 ∧ 0 row2 = 1 ∧ 1 ∧ 1 row1 = 0 ∧ 0 ∧ 0 row0 = 1 ∧ 0 ∧ 1 c = row0 ∨row1 ∨row2 ∨row3 m = {1, 0, 1, 0} a = 01 Encrypted Memory Access 48
  • 49.
    ● row3 = 0 ∧1 ∧ 0 = 0 row2 = 1 ∧ 1 ∧ 1 = 1 row1 = 0 ∧ 0 ∧ 0 = 0 row0 = 1 ∧ 0 ∧ 1 = 0 c = row0 ∨row1 ∨row2 ∨row3 m = {1, 0, 1, 0} a = 01 Encrypted Memory Access 49
  • 50.
    ● row3 = 0 ∧1 ∧ 0 = 0 row2 = 1 ∧ 1 ∧ 1 = 1 row1 = 0 ∧ 0 ∧ 0 = 0 row0 = 1 ∧ 0 ∧ 1 = 0 c = 0∨0∨1∨0 = 1 m = {1, 0, 1, 0} Encrypted Memory Access a = 01 50
  • 51.
    ● c = row0 ∘row1 ∘row2 ∘row3 row3 =0 ∧ 1 ∧ 0 = 0 row2 = 1 ∧ 1 ∧ 1 = 1 row1 = 0 ∧ 0 ∧ 0 = 0 row0 = 1 ∧ 0 ∧ 1 = 0 row3 = (ao × a1 × 6) row2 = (ao + 1) × a1 × 9 row1 = (ao × (a1 + 1) × 4 row0 = (ao + 1) × (a1 + 1) × 5 ¬a0 ¬a1 → → → → c = 0∨0∨1∨0 = 1 m = {1, 0, 1, 0} m = {5, 4, 9, 6} a = {8, 3}a = 01 Encrypted Memory Access 0-bits → even ints 1-bits → odd ints ⊕ → + ∧ → × 51
  • 52.
    ● c = row0 ∘row1 ∘row2 ∘row3 row3 =0 ∧ 1 ∧ 0 = 0 row2 = 1 ∧ 1 ∧ 1 = 1 row1 = 0 ∧ 0 ∧ 0 = 0 row0 = 1 ∧ 0 ∧ 1 = 0 row3 = (ao × a1 × 6) row2 = (ao + 1) × a1 × 9 row1 = (ao × (a1 + 1) × 4 row0 = (ao + 1) × (a1 + 1) × 5 ¬a0 ¬a1 → → → → c = 0∨0∨1∨0 = 1 m = {1, 0, 1, 0} m = {5, 4, 9, 6} a = {8, 3}a = 01 Encrypted Memory Access 52
  • 53.
    ● c = row0 ∘row1 ∘row2 ∘row3 row3 =0 ∧ 1 ∧ 0 = 0 row2 = 1 ∧ 1 ∧ 1 = 1 row1 = 0 ∧ 0 ∧ 0 = 0 row0 = 1 ∧ 0 ∧ 1 = 0 row3 = (8 × 3 × 6) row2 = (8 + 1) × 3 × 9 row1 = (8 × (3 + 1) × 4 row0 = (8 + 1) × (3 + 1) × 5 ¬a0 ¬a1 → → → → c = 0∨0∨1∨0 = 1 m = {1, 0, 1, 0} m = {5, 4, 9, 6} a = {8, 3}a = 01 Encrypted Memory Access 53
  • 54.
    ● c = row0 ∘row1 ∘row2 ∘row3 row3 =0 ∧ 1 ∧ 0 = 0 row2 = 1 ∧ 1 ∧ 1 = 1 row1 = 0 ∧ 0 ∧ 0 = 0 row0 = 1 ∧ 0 ∧ 1 = 0 row3 = (8 × 3 × 6) = 144 row2 = (8 + 1) × 3 × 9 = 243 row1 = (8 × (3 + 1) × 4 = 128 row0 = (8 + 1) × (3 + 1) × 5 = 180 ¬a0 ¬a1 → → → → c = 0∨0∨1∨0 = 1 m = {1, 0, 1, 0} m = {5, 4, 9, 6} a = {8, 3}a = 01 Encrypted Memory Access 54
  • 55.
    ● c = 180∘128∘243∘144 =826087619 ≙ 1 row3 = 0 ∧ 1 ∧ 0 = 0 row2 = 1 ∧ 1 ∧ 1 = 1 row1 = 0 ∧ 0 ∧ 0 = 0 row0 = 1 ∧ 0 ∧ 1 = 0 row3 = (8 × 3 × 6) = 144 row2 = (8 + 1) × 3 × 9 = 243 row1 = (8 × (3 + 1) × 4 = 128 row0 = (8 + 1) × (3 + 1) × 5 = 180 ¬a0 ¬a1 → → → → c = 0∨0∨1∨0 = 1 m = {1, 0, 1, 0} m = {5, 4, 9, 6} a = {8, 3}a = 01 Encrypted Memory Access 55
  • 56.
    Fully homomorphic encryption ●"Holy Grail" of cryptography ● First proposed within a year of RSA development ○ 1979 ○ Idea due to weird homomorphic property of RSA ● for more than 30 years: unclear whether FHE even possible ○ During that time: best one = Boneh-Goh-Nissim (remember the area solver example) (the one where only one multiplication was possible) 56
  • 57.
    "fully homomorphic encryption" Googletrends 1000 patents 200 patents 57
  • 58.
    Gentry's approach ● 2009:Craig Gentry shows fully homomorphic encryption in his doctoral thesis ● Employs somewhat homomorphic encryption scheme using ideal lattices ● Scheme is bootstrappable ○ can evaluate its own decryption circuit ● Through recursive self-embedding, leads to FHE ○ ciphertexts are reencrypted, eliminating noise (based on "shortest lattice vector" problem used in cryptography, which is NP-hard) 58
  • 59.
  • 60.
  • 61.
    [...] a simplestring search using homomorphic encryption is about a trillion times slower than without encryption. [1] Issues 1 000 000 000 000x 61 [1] CryptDB: A practical encrypted relational DBMS, RA Popa, N Zeldovich, H Balakrishnan, 2011
  • 62.
  • 63.
    Fully hom. enc.IRL ● HELib by Shai Halevi (2013) ○ Implementation of Brakerski-Gentry-Vaikuntanathan[1] scheme ○ Using many optimizations in literature[2][3] for speed ○ Does not implement bootstrapping (yet) [1] Zvika Brakerski, Craig Gentry, Vinod Vaikuntanathan: (Leveled) fully homomorphic encryption without bootstrapping. ITCS 201 [2] Nigel P. Smart, Frederik Vercauteren: Fully Homomorphic SIMD Operations. IACR Cryptology ePrint Archive 2011: 133 (2011) [3] Craig Gentry and Shai Halevi and Nigel P. Smart Homomorphic Evaluation of the AES Circuit, CRYPTO 2012 Performance Modulus Time for addition (ms) Time for multiplication (ms) 257 0.7 39 8209 0.7 38 65537 2.9 177 Even numbers < 65537, 80 Bits of security 63
  • 64.
    Visions of afully homomorphic cryptosystem have been dancing in cryptographers' heads for thirty years. [...] It will be years before a sufficient number of cryptographers examine the algorithm that we can have any confidence that the scheme is secure. [1] —Bruce Schneier, cryptographer, April 2013 Criticism “ “ 64 [1] Homomorphic Encryption Breakthrough, Schneier on Security, Bruce Schneier https://www.schneier. com/blog/archives/2009/07/homomorphic_enc.html
  • 65.
  • 66.
  • 67.
    Conclusion — Halevi, 2012 ““ 67 [1] Recent Advances in Homomorphic Encryption, presentation by Shai Halevi, IBM Research, Feb. 13, 2012, http://n csail.mit.edu/sys-security/FHE.pptx
  • 68.
  • 69.