Fully Homomorphic Encryption: The Road to Secure Computation

Transcript

okay so I'd love to introduce the next speaker his name is John Pacific he's a cryptographer at new cipher Thank You [Applause] hello yep my name is John Pacific I'm a oh there's no slides over here no worries I make cryptography engineer a new cipher what new cipher is we build a cryptographic infrastructure for privacy-preserving

applications and protocols whoo I'm actually not ready for this yet but I will can we get the slides up first I'll switch to the demo in a bit there are you great okay yeah I'll start again I'm Chomp stiffing I'm in cryptography engineer new cipher we work on the privacy-preserving app protocols and infrastructure for decentralized applications and things like that we have two main product offerings one is our proxy encryption Network which is something like a distributed key

management system for decentralized apps our other one is called new fhe which is a fully homomorphic encryption library and it's currently the fastest fhe library available and I'll be going more into what fhe is here in this talk is while showing off a demo oh boy this house is gonna go oh there we go so what is fully homomorphic we'll be going over what is fully homomorphic encryption solutions for an fhe based approach to secure computation the our Vanguard demo which is something I wrote a while ago and a just to be clear there is a more detailed version of this talk I've been

given time constraints so it will not cover a lot of the things in detail that originally had so if you would actually like to see a very big detailed talk on this please go watch the one I gave it ZK summit so secure computation solutions like fully homomorphic encryption are very simple relatively simple in concepts and concepts we have software based security protocols like fhe which are implemented in software and not necessarily in hardware unlike things like T's or like trusted execution environments which I don't think are that secure and also these things are also implemented usually with

you know hard mathematical problems that make things more secure so in the case of fully homomorphic encryption the most practical solutions are implemented with lattice based hard problems that's a lot of space cryptography with hard problems such as learning with errors which are also quantum resistant if you're interested in that solutions exist for both single and multiple parties so we can perform a computation as single-party or we can perform a computation with multiple parties so we can have like three parties could perform the same computation or we can have one party perform the same computation so there's different applications for each but we'll be going over the single party use case here the

function is computed directly on the ciphertext the output of the Homma morphic computation is equivalent to the computation performed on the plaintext so for example let's take a mathematical addition right so if we take two numbers and we add them together say 2 plus 2 we get 4 if we do that in the plaintext we can see the inputs to that addition function 2 & 2 and as well as the output 4 however with fully homomorphic encryption if we encrypt the two inputs 2 & 2 so now we have encrypted inputs a and B and we perform a function like addition on it we can a add a plus B and get an encrypted output C where the party who performed the computation doesn't actually know what was computed there's two keys involved in many

protocols like this there's usually the encryption key that's what you would use to encrypt data and decrypt the data as well as something called the computation key that enables the computation on that encrypted data so you can delegate who has the ability to perform this computation that's very important for your security as well this is also otherwise known as the bootstrapping key so we're gonna get into a little bit on the intricacies of fhe know some things like circuit design I'm gonna be going over a little bit of the pros and the cons associated with fhe right now because many people believe that fhe is actually impractical right now but I will show in a bit that that's not the

case anymore and that there's actually other problems that exist for us that keep us from making this a really practical thing right now but we're very very close to getting this and once we do we will be able to implement many incredible things so one of these problems is is circuit design there's some several cool things with it but branching for example if you ever used to computing something like a conditional if you do if a then B else something else right so we can't necessarily do that in fhe we need it requires pre computed values or interactivity between interested parties I'm sorry interactivity between the computing parties as you can see this in this diagram here that selection code decision branch there it's not

really possible we also have fhe compilers they're being essentially they're being researched to easily construct boolean circuits so an fhe you build circuits using boolean logic like X or nor and things like that one of our hackathon winners at youth Denver actually implemented a wasum interpreter for fhe in rust so it would compile from rust to wasum and he would interpret the wasum to perform a to just pretty much execute fhe code it's actually very very incredible so I have a link in the presentation and the slides it's for

that project itself there's also another problem project by Chris which is a more academic project called alchemy it stands for a language and compiler for fhe made easy I've also provided a paper to that it's written in high school it's pretty cool there's also various schemes that exist for different use cases here we have schemes like Kian tfhe and interoperability framework like chimera he an stands for homomorphic encryption of approximate arithmetic so essentially what approximate arithmetic is it's useful for something like machine learning where you want to compute some value and but not perform the actual like the exact thought you

want to get very close it's great for machine learning tfhe is for binary operations so that's where you do X or Noor etc chimera just allows you to transform ciphertext in between these frameworks I'd go into more detail but I'm kind of running out of time so fhe is inherently malleable meaning anybody can perform the computation on it which gives us a few security problems the highest security that we can get for it is chosen plaintext attack for fully homomorphic encryption but there exists another type of fhe called leveled homomorphic leveled fully homomorphic encryption which limits the circuit depth and prevents some arbitrary computations this enables us to actually build in ciphertext attack security and we also believe that we can use zero

knowledge proof to prove correctness to prevent malleability so well this is something we're actively researching bootstrapping is the process of how you make it a partially homomorphic encryption scheme or a somewhat Homma morphic encryption scheme into a fully homomorphic encryption scheme well the knife aichi doesn't require this assumption for bootstrapping but bootstrapping is kind of has of is a very strong assumption right now it's a it's not it's not that great no I I have a typo and that actually ciphertext are large due to this construction here one megabyte is the equivalent to 16 gigabytes and tfhe and ciphertext compression does exist where we can use

stream ciphers to compress it and then decompress it while coding by performing a stream cipher decryption in memory he and potentially only has 40 times the expansion but that's kind of we're still looking into that more performance speeds can be improved from GPUs a6 and FPGAs new fhe is a GPU based library we've improved as you can see over a hundred times over the leading implementation so i'm gonna dive into Vanguard a little bit here it's the socialist millionaires problem so if you're familiar with this it's actually pretty simple Alice and Bob are both millionaires Alice wants to know if bob has the same amount of money as her but Alice and this is the key part Alice

doesn't want to reveal how much money she has to Bob nor does Bob wants reveal how much money she has he has to Alice in essence we're essentially computing a function sorry we're essentially computing a function that computes the equivalence between the two inputs privately and in zero knowledge and outputs whether or not it was their equivalent without actually revealing that to the computing party so Vanguard what Vanguard is it was originally I originally came up with this at East Berlin in 2018 I wrote down the idea I had on a pizza box cuz I had nothing else in front of me it was not good pizza so I just threw it away afterwards for the diagram display is actually really problematic so don't

think you can take pictures of it and take it home and try to use it it's it's not worth anything Vanguard is a proof-of-concept that I'll be showing off so I'm gonna go over what vit what the demo actually does here at Vanguard first Alice will encrypt her value and then this is encrypts a secret value so Alice has a secret value she wants to know if bob has the same secret value she encrypts that value she then sends a tuple to Bob one of her encrypted secret value and her computation key so Bob can perform a computation on that value Bob creates a hum amorphic constant of his of his secret value as well be aware that this constant and is just a learning with airs problem and it's trivial which means we can easily

decrypt it so it's not encrypted at all and it should not be treated as like as an encrypted value so yeah it'd just be a way of that Bob performs a hum Orphic comparison using binary X nor logic and aggregates the result using and logic gates to prevent leakage what that means is if we simply were to you know compute and to comparison we deceive it's and we could know and guess eventually at what it is so we have to advocate those values into either a 0 or a 1 so we have to make sure that the inputs are equivalent are relatively same size and then perform the computation and then compress it or aggregate it until we either know it's just true or false Bob then sends the

encrypted an output of that computation to Alice and so it's either like an encrypted 0 or a 1 and Alice will decrypt the output to reveal the result of the encrypted comparison so I'm gonna go ahead and jump on this thing here so let me ssh into a GPU box i have on AWS and i'm actually gonna be showing

off a little bit here of what we do and Vanguard I'm gonna go into the little bit of the server yeah how's that was good cool alright so what we do for the input is we actually do a a hash of it just so we can get the input to this way with this computation of a kind of like a similar-sized we just need it to be the same size as any input we hash it and then we compare secrets here right so this is where right here where Bob creates that value that toxic value

where he said it's unencrypted that's his unencrypted secret that he's going to compare to an encrypted secret so this encrypted secret is actually Alice who's going to send it over to Bob and perform this computation the sinker the this encrypted comparison is the output of this encrypted operation and then we just return that so let me open up over here what alice is going to send so here Alice encrypts the secret her own secret that she doesn't want her veal to Bob she performs a hash of it just so we can like I said we need those

inputs to be uniform and then she encrypts it and then sends that computation key and the encrypted secret to Bob so what Bob is going to be doing is computing on this encrypted data to be clear Bob does not know what the plaintext value is he's going to compare his secret to Alice's secret and not have any knowledge of whether or not it's the same let me just do some Python mumbo-jumbo here all right so what I'm gonna do is I'm

gonna run this server code here and so it takes us an argument a Bob secret it takes as an argument Bob secret and we're gonna go ahead and put that as my very secret secret okay so Bob is now running a you know just running his server went wanting to see if anybody can see a secret and providing a public service right so Alice is gonna try to say okay I want to I want to know if Bob has the same secret as me but I don't want to reveal I don't want to reveal the Bob that I have that secret so let's say we put in the wrong secret first so

my very secret wrong secret and it takes a while to perform the first homomorphic comparison because it actually has to compile the circuit and run it but after that we can actually run it really quickly so it finished Bob does not have the same value but doesn't know that he doesn't that's weird worded but he was essentially Bob doesn't know that Alice has the same value but he did the comparison all right so this has applications to market matching to dark markets where maybe you want to know if somebody's selling something but you don't want to reveal to them what

they're selling what you want to buy right so I'll kill this right here and I'll try it now with the correct value my very secret secret so watch it'll be much faster now Bob has the same value but doesn't know that he does see and that's it that's the that's Vanguard it's very simple it's a very simple proof of concept but it demonstrates a fully homomorphic circuits and something that you can do with fhe as well I'm I have one last slide all right so on a closing note I just want to say that recently there's been a lot of debate in

Australia on privacy and let's be clear here that the politicians involved actually know very little of privacy and what cryptography is malcolm turnbull the 29th Prime Minister of Australia said the laws of mathematics are very commendable but the only laws that apply in Australia is the law of Australia which is a little insane so yeah let's be clear this is a very big problem we as a space need to realize that decentralizing privacy is the only way towards true freedom and privacy governed privacy will never be will never work we need direct action and privacy to actually have true freedom so thank you

this is more new cipher check us out John say that's that that was definitely very interesting I guess for us who are not cryptographers and given that I feel like I can actually ask you this question can you tell us what you you know the work that you're doing how does that actually you know preserve privacy and the political freedom of the cons sure so cryptography by itself is not necessarily a political tool but it can be used as one and privacy is much more simple than everyone really thinks it is

it's about consent privacy is literally just a digital form of consent society right now I think the reason why we see so many problems with privacy now is because society at large already has problems with consent and I think that's a function of that and what we can do with cryptography is actually build applications protocols and infrastructure that require consent that makes that makes people think more about this consent and and introduce it in their own lives when we do that we're going to see large changes I think and about how we think about politics and freedom if we can just simply think better about consent and maybe even economics and I just wanted to add to that given that I was a formal lawyer is

that most of the privacy laws actually govern the collection of information of governments and organizations and it is not necessarily not there to protect the privacy of individuals so what you've raised is actually quite interesting we can think about concern issues absolutely cryptography when when cryptography when asymmetrically used it's a very violent act of aggression when the government's can and the government's and rulers and dictatorships can have privacy but the Commons can't that's a clear asymmetric form of power and it needs to be abolished thank you so much [Applause]