IBM Fully Homomorphic Encryption Toolkit for Linux

https://github.com/IBM/fhe-toolkit-linux

by 0xedb • 6 years ago

152 36 6 years ago

github.com

KaiserPro2• 6 years ago

What kind of operations can one actually do on the encrypted data? I'm struggling to understand what the use cases are

(I saw the one about machine learning, but thats broad and vague.)

faeyanpiraat• 6 years ago

Multiplication is certainly possible (thats why ML works with it)

daenz• 6 years ago

It has the potential to re-invent how we use compute services. A company can provide service X that is guaranteed to not be able to see the data you give it.

Personally, I think it is the most applicable to the corporate "giants" of the world: now they can feel more free to offer each other services that operate on data that would normally be considered too risky to share, like financial data or private customer data. When the data is secured through FHE, there's no risk to letting anyone else run computations on it in order to provide you with value.

mistrial9• 6 years ago

sure, but think of this.. Most people will say that listening in to a phone conversation is 'spying' and not right, and, it turns out that listening is hard, due to poor connections, accents and other noisey issues. BUT at scale, simply collecting and mapping the patterns of connection/duration over time is much more informative than most people imagine, and few object to that. Surprise.

Run the scenario you describe, and people being intrusive, rent-collecting bullies that they can be, and do you think the sole-sourcing of "giants" will be a tame and orderly affair ?

There are two directions to take that thought at least.. one is, what did previous groups do in past times that did create positive results; and second, a tech games-theory approach to de-centralization mixed with special purpose business entities, with real checks and balances.

Personally, I assume that business cannot be trusted over time to keep the consumer of services best result in mind.

llarsson• 6 years ago

The other thread we had about this stated that arbitrary math is possible, but slow as heck (40 times slower or so). You can either tell it to operate on two encrypted items ("multiply value 2 and 4 from the data") or give either operand as-is ("add 5 to value 3 in the data").

So general-purpose, apparently. Just slow.

jstanley• 6 years ago

Is it really only 40 times slower? I thought it was millions of times slower. If it's only 40 times slower than a modern CPU, then this technology is a lot more interesting than I thought.

From a few minutes of Googling, I can't find any obvious benchmarks.

Darkstryder2• 6 years ago

To give an answer a bit more technical than the others, theoretically a encryption scheme is considered fully homomorphic if it can support an arbitrary number of additions and multiplications on its inputs (bits or integers). In a lot of fully homomorphic encryption (FHE) schemes bits are represented through big matrices that are in part random and part deterministic. You can add and multiply these matrices and it will naturally add and multiply the encrypted bit inside as well, but you need the secret key to decrypt the matrix and learn if it contains a one or a zero.

From these operations (add and mul) you can create a NAND gate using the formula 1 - A * B (assuming A and B are matrices containing encrypted bits) and create any arbitrary boolean circuit from there. These circuits works on the encrypted data without the need to decrypt it.

(there is an additional step called bootstrapping that most schemes require in order to allow circuits of unlimited depth but I won’t get into that in such a short answer)

KaiserPro2• 6 years ago

Excellent, thank you!

Seeing that one can NAND things, everything makes a lot more sense.

throw0101a• 6 years ago

Perhaps:

In this paper we present an electronic voting system based on homomorphic encryption to ensure privacy, confidentiality in the voting. Our proposal offers all the advantages of the multiplicatively homomorphic encryption cryptosystems. The proposed voting scheme is suitable for multi-candidate elections as well as for elections in which contains neutral votes.

* https://ieeexplore.ieee.org/document/7492759

Others:

* Securing Data Stored in the Cloud. Using homomorphic encryption, you can secure the data that you store in the cloud while also retaining the ability to calculate and search ciphered information that you can later decrypt without compromising the integrity of the data as a whole.
* Enabling Data Analytics in Regulated Industries. Homomorphic encryption allows data to be encrypted and outsourced to commercial cloud environments for research and data-sharing purposes while protecting user or patient data privacy. […]

* https://www.venafi.com/blog/homomorphic-encryption-what-it-a...

White paper from a Microsoft crypto conference:

* http://homomorphicencryption.org/white_papers/applications_h...

betterunix25• 6 years ago

In theory any decidable function (any function that is guaranteed to terminate on any input). You need the control flow to be independent of the inputs, otherwise it would not really be "encrypted" (input-dependent control flow would reveal something about the inputs), but it is always possible to transform a (decision) function into its "input oblivious" version without too much of a performance hit. In the case of FHE, the "instruction set" is just addition and multiplication i.e. the computation is expressed as a polynomial.

Practicality is a problem. You cannot have random access without performing some kind of linear scan over an array (all of which is expressed as a polynomial), so most software will perform extremely poorly. The actual cryptosystems are reasonable in terms of performance, but still carry a significant overhead. Even for ML tasks you are probably looking at 100-1000x performance overhead.

dogma1138• 6 years ago

Can the performance overhead be latency masked down the line so you don’t have as much overhead in practice? For example compression of slow storage media like tapes technically adds overhead but in practice because the slowest part of the chain is usually reading/writing off the tape you either don’t experience any actual overhead in practice or even often experience a small speed increase unless you can massively parallelize media access with multiple heads at which point the CPU/RAM becomes the bottleneck again.

SilasX• 6 years ago

Per the discussion from Friday[1], any function that you can unroll into a (stateless) circuit.

Edit: which, AIUI, means any function where you can a) prove it halts, and b) recursion and loops are converted into loops that execute for a constant number of loops known at compile time.

[1] https://news.ycombinator.com/item?id=24007566

dowem5• 6 years ago

Hi Hackers! This is Eli (one of the authors of the toolkit). I wanted to make sure you all know you can check out the code. It is freely available on GitHub as linked by the OP. The press this weekend in places like Ars talks about trials, which we did and those were awesome, but the real story right now is the toolkits are out there for anyone to get access to the tech. I love that it was shared here. Several posts on Ycombiantor have come up as a result.

I just wanted to say that I think we packaged some cool demos in the toolkit. One is the privacy preserving search we debuted in the MacOS toolkit we put out a few weeks ago, and this one also has a fully encrypted neural network inference over credit card fraud data. If you like encryption, or like the idea of encrypted machine learning check it out! We built all the special dependencies for you, along with an integrated IDE setup to run the examples trivially. The encrypted ML example also uses a brand new, fresh out of the IBM research kitchen, encrypted machine learning library that makes it work.

This stuff is not fiction it is real and you can run it today if you want! Our toolkit is based on Docker and comes in Ubuntu, Fedora, and CentOS. You can even pull the docker images from Docker Hub. IF you want to see more of this effort show us some love on GitHub and Docker Hub by smashing that star button! Instructions are in the readme. Most people who know docker can get up to speed and running in less than 10 minutes. https://github.com/IBM/fhe-toolkit-linux/.

Monitoring the entirety of the internet for good questions and comments is not one of my superpowers. If anyone has questions get in touch with us on slack directly. The development team is here to help. Questions are great, we are trying to get together an FAQ. Hit us up on Slack here: https://app.slack.com/client/T0133ARBGBV#/. We want your feedback, questions, and ideas to help spread the word.

P.S. Thanks to user Darkstryder and throw0101a who commented below! You did some nice explanation for KaiserPros question, and shared some nice links for this community!

deknos• 6 years ago

Hi Eli, Is your toolkit source open and free? as i may use and hack on it? Is it a service or could i use it in an airgapped network?

dowem5• 6 years ago

The toolkits are absolutely free to download and use and modify. When I say free I mean both gratis (no cost) and it is MIT licensed for the code IBM provided. We would love to see community contributions. Once downloaded you do not need network connectivity or anything to use the demos or play with the code!

hedora• 6 years ago

The story yesterday said you support addition, multiplication, and enough for Turing completeness.

Surely, that means you also support equality tests. With that, it’s easy to build a lookup table, and the whole thing devolves to a glorified Caesar cipher. (With a permutation function instead of a rotation.)

What security guarantees does this library provide? What’s the attacker model? I see nothing about this on the front page of your github repo, or in the press releases.

Edit: For instance, can it tolerate chosen plaintext attacks? In a naive scheme:

If an attacker can get the cipher text for “1”, then they can compute 1+1=2, giving them the ciphertext for 2, and then, inductively, all the natural numbers.

pravus• 6 years ago

Not the author but hopefully I can shed some light on security aspects based on my current understanding.

The premise of FHE is that you send both data and code encrypted to a 3rd party system for execution and you can assume that an attacker has control of it. The attacker will see a series of seemingly random steps that mutate seemingly random data and send an encrypted response that can only be verified by the client. You don't have the answer in advance but you have a way of validating that the calculation was performed correctly as asked and the answer can be trusted. A statistical attack can be avoided since the client has the option to rotate the encryption keys without the 3rd party's knowledge although I'm not an expert so any mathematical comment is welcome.

My knowledge here is limited, but the short summary is that if done correctly FHE just looks like random execution on random data and that's what eliminates most attacks.

ihm• 6 years ago

Encryptions are randomized, not deterministic.

sangel• 6 years ago

How would you compare this toolkit to something like SEAL? Are there particular selling points or things that I should be aware as a potential user?

shiado2• 6 years ago

My only hope for homomorphic encryption is that it doesn't cause a new era of invasive DRM and anti-circumvention methods.

mmm_grayons• 6 years ago

Would you please elaborate on how you believe this might happen? I can't see how this would enable a "stronger" DRM scheme, as the video/audio/whatever would still have to be decrypted.

shiado2• 6 years ago

That's true. I stand corrected. And having just entered the term 'homomorphic encryption' into Google patents it would appear the space is not very active at all.

ColanR• 6 years ago

I don't have a great understanding of the algorithms here, but I have a question.

If I had some data encrypted with these tools, which I made public for multiple entities to process, is it possible for me to allow them to add data to the encrypted system? i.e., is there a way for multiple entities to add more data to the encrypted data (and do calculations with the encrypted contents) while only one party is able to extract the results of the whole resulting collection of data?

Darkstryder2• 6 years ago

It is possible. Encrypting a piece of data requires the public key but not the secret key. Therefore you can give your public key to all of these multiples entities, they encrypt data and do computation on it, and only you can decrypt the resulting computation using your secret key.

I have to say that a related question I have is how to get the opposite : making sure the third party only used the inputs I gave them and did not replaced them with their own, and making sure they processed these inputs through the exact program I gave them and not an altered version of it.

I have rough ideas about how one could do something like this but if anybody had a reference to literature on the topic, that would be great.

IBM Fully Homomorphic Encryption Toolkit for Linux

Related Stories