ZKPodcast: Exploring FHE with Flavio Bergamaschi from IBM Research

Transcript

[Music] welcome to zero knowledge a podcast where we talk about the latest in zero knowledge research and the decentralized web the show is hosted by me Anna and me Fredrik this week we are sitting with Flavio burgum a ski from IBM research where he acts as a senior research scientists this week we're gonna be primarily talking about FA cheese so welcome to the show Flavio thank you now we've talked a little bit about FA cheese in

the past but I think this is going to be a very interesting episode because it's gonna give us a chance to kind of catch up with what's been happening in the f AG research space I don't think we've ever really talked about you know I had a fundamental level sort of what it is or what the current state of Technology is or even its development over time I think we talked a little bit about this in the preamble of like there are there seems to be a lot of preconception about what fully homomorphic encryption is is capable of doing or not capable of doing and it'll be interesting to dig into all these things let's see what's status quo is totally alright so I I like to start

all these conversations about fully homomorphic encryption fhe for short with a question that that I asked the audience typically when I'm presenting so imagine what you could do if you could compute unencrypted data without ever decrypting it right so if the data was always encrypted what are the things that you don't do today that you would be able to do with this technology what are the kinds of answers that you get sometimes oh there's several but but I guess and two people actually realize what it brings to the table in terms of privacy

and confidentiality and everything you see that people will be more inclined to share information because that information is never in the clear and also that people can compute on that without leaking the information so you might have data breaches in everything else but the data is being always encrypted is less of a risk and this seems super relevant right now as we see the need for more kind of shared data in order to map the goings-on in the world and yet now there's a lot of concern that like how could you actually keep any of that private it's necessary

that we compute all of these things on mass and yet yeah we don't necessarily have it feels like we don't yet have the tools to do this in a way that will be beneficial to the individual or fair to the individual maybe that's another the main thing is that these days people carry less about privacy and confidentiality individual power I think of generality that today they instead of before there is a lot of a social sharing of pretty much everything and with this technology it may be may be possible to do this to achieve a lot without having to give away so much

about your life about what you do about where you go or not in the we've had some discussions on this and show in the past and I think it's an interesting sort of people have gotten accustomed to a certain lifestyle and to some degree fixing it like increasing privacy means going back and like taking things away from someone but going back almost never works so you need to find new solutions to to let people do what they want to do but still improve so things like actually still preserving their privacy before we dig it super deep into things I still want to know you're at IBM

Research why is IBM interested in this and what does a research scientist at IBM do right so IBM actually invented this technology about 10 almost 11 years ago and when it was invented it kind of solved a question that people had had or more than a decade on how you could perform complex computation on encrypted data but at that time it was very slow terribly slow so they they one of the quotes at that time was people said oh this is fantastic mathematics and

everything else but not in my lifetime no not in my lifetime was the Oh No well now right with all the advances in algorithmic and in collaboration across the world it's at least speeded that's practical for certain use cases right and this is one of the points that are we focused now because becoming practical in terms of performance algorithmics and news and so on you can start putting that into to the market it's still not as early days as it was in 2009 but it is it is that inflection

point where things are fast enough for applications that require privacy and confidentiality but going back to that question from Frederick like IBM research maybe it's good for us to understand a little bit more like what is the goal of IBM research is it to explore certain sort of theoretical threads to see if there's applications or was there already some IBM project that prompted this well when it started it was more theoretical and has been evolved with funding grants for us to advance the technology and now we are

actually looking at core designing what becomes an asset with clients and with the users and this is an important thing because like I asked imagine what you could do if you could compute unencrypted data without decrypting it so we need to talk to clients to understand better the use cases we have a plethora of use cases but those were related to what we know right so if I offer you a tech knowledge that allowed you to do things that you were not able to do before but only you know what you were not able to do before and then it's this code design so IBM research typically will do research in very

advanced areas will also try to bring this emerging technologies try to emerge them and validate whether those theoretical advances and so on are actually useful or not for everyday usage it's a very very long game it is it is a long game but it's a kind of things that when you get to that inflection point it becomes a very short game and you have to play it quickly because it becomes when he gets to the inflection point it gets to infection but for everybody right everybody out there that's doing homework encryption is also in this inflection point of

technology so we've had we had Luca to fail on I guess a few months ago a few weeks ago a few months ago and he's also somebody who's in IBM research working in his case on a sahjhan ease I'm curious a little bit like would you ever be working with Luca do you have different groups that focus on these different topics how does that work we have different groups that focus on different topics but we all collaborate we all talk to each other so it's not like you go back to your shed at the back of the garden you do everything and

come back out of it whether a new innovation it doesn't work like that anymore right so collaboration is the key got it and we actually collaborate a lot with certain with other researchers in IBM but other researchers in other institutions some of our competitors are also our collaborators on the algorithmic pointer it's it's not like someone man does it hidden and comes back with something ugly it doesn't work that way it's it's a lot more collaboration these days that was actually a question that I had was about whether or not there was sort of a competitiveness between maybe IBM

research and I don't know like Intel research or these other groups that will be looking into things I wonder does it does it have it all like echoes of Bell Labs or like Xerox PARC kind of vibe these research these in like corporate research departments well I didn't I wasn't at work when Bell Labs was doing what they were doing right at the beginning right so but I read a lot about them so it is it is somewhat different than it was before but not that much right because within the corporations we collaborate internally in IBM we also publish the work that we

do and other people like Intel Microsoft and the academics and the universities and so on they also publish their work and we share which are information so we publish our given our people use and they might enhance it and then we see those enhancements similarly if they come up with some new ideas we collaborate so they the community now has become a lot more amicable to collaboration let's put this way but also fierce competitors there is a kind of if a tricky scenario right certain things we collaborate a lot and certain things we compete a lot so we

are collaborating on the standards for homework encryption so it's a consortium which is a it's a consortium which is ad-hoc everybody that is doing homework and creatures at all perhaps we should standardize these otherwise everybody's going to different directions and if you if a product come out of it how people can be sure that it's that follow certain standards so we have been a busy trying for the last few years trying to together it is it is a hard thing to standardize in terms of because each one had their own implementation so on but now we are converging to certain schemes and we are looking for which body which

standard body to join or to propose a standards for sounds a little bit like the same may be slightly later in stage than the zero knowledge proof community which is also trying to work towards creating standards for things like circuits and how to express these different constraint systems of zero knowledge proof if everyone comes up with their own method and none of the tools are interoperable you can't you know create approved with one library and verify it with another or anything like that and if it was standardized then you'd have a lot more cross collaboration that sounds true and we we are in that phase right so we recognize

that there needs to be a standard and as as a group we are trying to come up with that and identify at what level that interpreter should occur yeah so focusing in a little bit more on FA cheese what's your research in this and you know how did you become interested in it well I've I've started kind of working with it back in 2014 so or so when our colleagues in yoktan were doing the most of the research around fhe and we were looking at options to accelerate that and since then I've been devoting

time to it and more recently when I say more recently it's in 2017 half mid 2017 or so on we start entering what we call a new a new phase in the development because back in 2009 when people when a colleague of ours invented fhe then we start what we call the plausibility faced let's check whether this is plausible or not right and from 2012 ish onwards we started the improvement phase which is okay it's plausible how can we make it go a little faster right and

that we have been working on this improvement phase but back in 2018 around the industry everybody started the usability phase which is when you start making their technology more robust use a footballer use a buh-bye normal users you don't need to be a mathematician or a cryptographer to write you still need the help of those with being focused on the standards part very much and the serviceability so if there's a lot of software engineering work going right now and so I be involved since 2014 in different phases of this and now I lead

the team well we have a team and we we all work together in making this more usable technology what were you doing before IBM Oh before IBM had several past life as have real I I am a physicist and before that before IBM I worked a lot on high performance computing and radar technology and so on so I want to get to that point of answering the question what could one do but I think

to get there we have to first answer what fhe is actually are as we said earlier we about it a little bit on the show before but we've never really defined it I think in any sort of fundamental level so fully homomorphic encryption you know I understand the word fully and I understand the word Christian what's the thing in between and how does it link together I guess starting at you know that your explanation from before computing on encrypted data I think that that's a a good summary but if we dig one level deeper you know what what does fhe mean right so in 2009 when Craig Gentry an IBM researcher invented fhe until then

you could when you say computer encrypted data it means can you perform the basic mathematical operations which are basically multiplications and sums on encrypted data without decrypting it until then you could do one or the other within this what we call the same scheme which basically limited to some extent what you can actually do right by being able to do both sums and multiplications reading the same scheme allows you to perform complex computation because you can use those as your building blocks so

if you think of a machine learning what's the machine learning language that you can do you can do some some multiplications and now you build everything else on top of that basic capability right with that you can think of a matrix computation you can taking what people call polynomial valuation and with polynomial value a ssin you can approximate functionality mathematical functionality which basically you can build very complex operations is the ability to do both addition and multiplication in this encrypted kind of black box is that the fully part is that why you say fully homomorphic because

you can do both at the same time or is the fully does that mean something else the fully means that plus something else okay so for you you can add and multiply plus plus the ability to have arbitrary depth of computation meaning that you can keep doing additions multiplications almost forever that's the fully part cool the partial homework encryption is either one or the other got it right and there is another one which is the somewhat that is related to being able to do just a

certain number of multiplications and additions before you can't decrypt anymore or the before before you can make sense of it cut it so it doesn't have the depth that you just described I guess that's right yes well but there is enough depth so we most of the applications that we have built to date did not require the infinite depth and the infinite depth or so is not because it's infinite is because when you you perform up to a certain depth and then you perform on an operation that's called bootstrap which basically means that Rick crypts everything to the top and you can keep doing it and you recruit to the top again and you keep

doing it so this is the fully fully homomorphic encryption part okay that's the fully yes so I think that if I understand it correctly that essentially means that you can do it on any sort of arbitrary computation so I can essentially express any arbitrary program to compute over the state all right if I have it fully whereas if I'm limited in depth I'm limited in what I what my program can do is that right you were limited all day on the algorithm of your program yeah yes the number of operational steps but we can combine that with protocols if you have two parties computing the server part computing the cloud there the client

you could potentially perform the computation up to a certain I will send it back to you you decrypt recruit and send it back to be computed again so it's all it all has to do with them one of the characteristics of data computation like that we kind of skipped a bit which has to do with whenever you encrypt a message something right you are basically hiding that in a lot of clutter and a lot of noise that's what we call so and your message is hidden in this fuzzy noise whenever you perform an addition that noise adds up but whenever

you perform a multiplication that noise multiplies right so and if this noise grows too big you can't decrypt the result anymore you can't actually see anything of the result so the techniques that are involved or some techniques that are involved to reduce the noise as you go along but there is only so much you can reduce and then you have to stop the computation that you're doing so there are certain circuits as one nation before that allows you to perform the computation that you need to do for instance logistic regression for machine

learning we can do that without requiring this recruitin or this bootstrapping so it can be quite complex computation that one can do before you need to bootstrap or to recruit and some of the more neural network related scenarios you needs to perform a bootstrapping so this leads me to the the middle word homomorphic right just means that it morphs to something that is the same it's properly preserving but it is exactly what is it preserving homomorphic when wince when operations have

morphic characteristics let's just forget about encryption for a moment right so if you have a value to values value a and value B and you have a function f so you can compute F of a that's one thing and you can compute F of B as a separate thing and then you can operate those two by multiplying or by adding them together now if this have homomorphic properties it means that the same F of a plus F of B equates to the F of a plus B and that's that's word it

comes from so if I can perform that operation that way it means that what I'm doing separately represents the same thing as if it was done together so if that function is an encryption function I can say that the encryption of the value a operated with the encryption of value B is equals the encryption of a plus bleach and and that is how you perform this computation on encrypted data that represents the same result at the end does this mean does this sort of like open up an opportunity for this

idea of like parallel parallelization this idea of doing things at the same time because the sizes would be is that way actually maybe this is completely off but are the are the sizes of the outcomes the same is that when you say a plus B or is it more like the outcome no the outcome the actual the actual out code if I have an encryption of a1 plus encryption of 2 that is the same as the encryption of 1 plus 2 okay right this is this is one part all right now regarding parallelization this is

another property that certain implementations have which allows you to pack data in a ciphertext so what is the ciphertext ciphertext is take up a value and you encrypt that value the result is a ciphertext is your messages your values hidden in this noise so this is your cipher text because the way the cipher taxes construct you could consider that as a ciphertext can have several elements inside encoded inside all right and if you have several elements encoded inside these ciphertexts

whenever you do an operation between two ciphertext you do them element wise so I can put the value 1 the value 10 the value 15 all in the same ciphertext and you know know the ciphertext I have other values in the corresponding elements whenever I multiply or whenever I add two ciphertext those happen element wise so the first element of the first cipher text with the first element of the second market and this does allow for paralyzation as long as you can turn your problem into a vector solution which mathematically all we tend to say

so is logically it has kind of property that I'm not sure how many people remember that in school which called single instruction multiple data you have multiple data being operated in a single instruction so that's when you then you get that I don't know if they teach that in schools anymore but yes I don't know if they teach in schools but Sims at least is like in engineering and like oh I want to optimize something let me see if there's some simple instructions somewhere I can exploit to make everything faster that's exactly the same and we we got to very good at exploiting that are taking a problem and kind of converting the input data

the way that it can be resolved in a same-day way the other interesting aspect of a full commercial encryption is if everything is encrypted if all the intermediate values are encrypted and everything end conditional variables in your code are encrypted how do you branch because you can test you can test whether variable is true or if the variable is false to make a decision so you end up having to execute all the paths in your code right which basically means that you start designing this decode with less of those branches because those cost a lot right and try

to make them more like a circuit yeah that makes sense and usually especially if you're not very careful you can very easily have an explosion of pads in a program where it's yes increases exponentially oh no oh yeah we have been true to that because as part of the grants that we have for working home of encryption we have one from the US government to to construct a to chain for secure computation or mosque encryption being one of them so the idea is at the higher level the programmer can specify the security constraints of the application

and code in a normal way with some annotations and then this to chain will do the compiler version the company intermediate language and everything to convert it down to homework encryption code so as part of this program we are giving what they call challenges challenges our use cases a given use case that you have to so the best way you can with the technology that you have with the algorithm is to have when the theory that you have and some of the solutions are radio explanation right good today right but we know how to move this forward and take advantage of some

of the techniques that like the seemly operations or packing of more information but we don't we we can't do that at the program level we expect the programmer will write any problem and then the compiler has is the one that has to fix it up today is a cryptographer helping the application write to understand so we have to understand what's the business case what is your algorithm ok so what if we manipulate the data in this form that will make it easier for the commercial encryption to achieve performance before we move on and maybe this gets too complicated to explain I don't know but I'm curious what was the innovation like what was this step that you know was

taken in 2009 that actually managed to achieve bringing together addition and multiplication under one roof right so it wasn't like it isn't someone that woke that woke up and they just said oh this I'm gonna solve it so this is building on a lot of research and that had happened before that was happening at the time and the final step was to understand how to work with lattices that would accept the property for both multiplications and additions within the same with the same scheme alright so

that that was the tricky part but there was a lot researchers around the world were collaborating and Craig when he wrote his PhD thesis actually was based on all the research that other people did but cannot got that far enough right so he was able to combine different things and come up with them with the solution that would work and the since then there have been a lot of improvements and different solutions that accomplished accomplished you say can we can we actually talk about what lattice how do you say it is is it like lattice based cryptography is that the way you word that we're gonna need it

we're gonna need a big one costs just actually good to hear maybe we should we should absolutely do that we have touched on lattice base crypto before especially there are some you know quantum secure algorithms that depend on some of this right does that mean that yes you know the fhe is Quantum's a year it is that means that fhe I like to say that is quantum resistant it's the appropriate way to the best of our knowledge today there is no quantum algorithm that can break commercial encryption with any less complexity than

a normal computer it is quantum safe or quantum resistant I would say so I think we've covered the three words right fully homomorphic encryption is there anything else we have to say about the last one encryption you know the the fact that it was lattice based is news to me and that was interesting yes yes it is largest base and and also it's a public-private skin so you encrypt with one key and that you also use for certain of their computations but you can only get crypt if you have the secret key I I want to throw out a use case something that I imagined that I would use if I

had unlimited access to fully homomorphic encryption and then you can tell me how close we are to that in reality okay and the use cases are very relevant right now where there's basically doesn't exist a video conferencing software that has n to end encryption and the reason is that this server so you know every person is sending their video feed and if you did it in a p2p way then you would be sending you would be receiving maybe ten video feeds and you'd be sending one but receiving ten video feeds something like 30 megabits per second it's too much for anyone's connection so what actually is done is you send it to a central server that central server multiplex is to

gather all these video streams and sends you one so regardless of how many people are in a room you know you as a participant only send and receive one stream and eke like this server can multiplex all these different streams into one because they're not encrypted and so you can't have into an encryption in videoconferencing because you know you can't perform this basic action so people talk about various ways of solving this but one very neat way of solving it would be if I can send the server an encrypted stream and then the server can take all these ten different encrypted streams and compute a multiplexed version of that and send it out and then the participants can

decrypt it that's that's an interesting use case if it wasn't for the size of the ciphertext because the size of the ciphertext is very large and that having having different keys of encryption and computation it is it is possible but it is something that we that's only the research side right now right so we have ideas on how that can be done like I encrypt with Mikey you encrypted Bo with your key and and encrypts with her key

and and then we multiplex everything together and then we send it back for decryption the question is which key you would use for the cripton so there are ways some of these is very experiment or the moment that allows you to do that but on the home of encryption side it would be the ciphertext if we are able to encode the video in a way that we can represent on the ciphertext it would be very large size which would make it plus the computation would take some time to perform that multiplexing operation wouldn't be it wouldn't be real time wouldn't be a simple let's put this a

commercial encryption is good for applications that you can accept some delay it's not today not efficient for real time competition because the encryption/decryption takes takes a long time we have been working on acceleration and we have been looking at how to use hardware acceleration and even they go for hardware acceleration is that we can bring the overhead of Hamelin computation for certain benchmark use cases down to ten times meaning it takes 10 times longer to perform a computation homomorphic lee

then it takes to perform it without encryption what are those benchmark applications and and sort of what is it really good at would you say so the benchmark applications that we have been given are related to machine learning scenarios either regression based machine learning or convolutional neural network machine learning sonars whether we can do that with at most ten times the overhead so this would be something like training a model on encrypted data training a model on encrypted data or doing the Infernus during the actual prediction so doing the prediction on

encrypted data using regression based algorithms with a given number of variables sixteen in our case we got it down to fifty times so it's one order of magnitude it's not a thousand so I got that fifty times they the overhead now doing the training it's longer even because the doing the Train even without encryption takes longer than just the inference but the ability to train a model is important the other experiment a successful experiment that we did and that was part of the work that we did

with one of the our clients our banking clients was to retrain an existing model with new data that's encrypted the this is something that most of the people that use regression-based Albertans or machine land base ovens do is over time as your data changes your model loses the stability it's not as stable as it was before so if you're getting new data or new trends that took for the prediction that you can you take that new data in an encrypted form and retrain your model all right so this is

one thing that we will show could be done we publish a paper on that and we implemented it as a proof of concept so our next steps will be to generalize what we did and that being offered as one of these higher level functions that you can do over homomorphic encryption so you don't need to do just multiplications and additions it can actually call function that will do something more tangible is the tricky bits like what causes a lot of the extra time is it because with the video example you mentioned like the size of the data so is that the size of the data

or the complexity of the computation or maybe both like which one makes the situation worse if I had two small numbers and multiply them together would it be way slower to have two large numbers and multiply them together or would it be way slower to like multiply them twice you know what I mean it's more related to the volume so let's UPS let's abstract from the from the video scenario for a moment encryption so when I encrypt something I basically as I said I'm hiding my message my secrets in a lot of noise the way this is represented is by constructing a

polynomial right the ciphertext is represented by two polynomials not only one and the order of this polynomial to achieve the security that is needed is of the order 60,000 - more so we can do it depending on the security you can be a little less like 32,000 or so but that's the order of the polynomial now the coefficient of that polynomial can have four hundred six hundred or more bits right so there is no computer that can do six hundred bits or a thousand

bits computation today so you need to break that into a smaller representation which basically takes those six hundred bits coefficient break them in the equivalent of 54 or 64 bits coefficients but then you end up with a lot more of those right and the way you computes this operations at the lower level is actually by performing fast Fourier transforms so FFT is back again so you can see that even if I have one number let's say the number five right which is or the number

one that's only two bits when they need to represent those in this ciphertext I end up with this massive ciphertext to put the value one if I if I exploit that packing that I mentioned before I can put multiple values in there so the operations can be performed homophily and and that's where the computation goes right so that's where the additional overhead happens and the tricky in making this competition not so expensive is actually looking at the use case and see how much of that I can do I can exploit that seemly characteristic that my suffered access right the more I

can do that the better because the cost of me doing a multiplication of a one element or 16,000 elements is the same right so in the prediction scenario that we had the batch size that we using four predictions was 16,000 so I could do 16,000 predictions in tents about 10 seconds just under 10 seconds for a security level of 256 bits to do one prediction takes the same 10 seconds if I don't exploit that capability but that also means that to do if if I had another thread where I can run a

separate prediction I can do another batch of 16000 within the same ten seconds so it goes 16,000 32,000 64,000 within the same 10 seconds so what often people try to to talk about the performance of homework encryption in terms of the amortized costs I don't like that too much because unless you're doing a batch it's you're not gonna monetize anything I sort of a very basic follow-up question here on a is there a difference in terms of the timing of multiplication in addition

yes like so if you had this partial hormone morphic encryption or one of the other ones I forget what they were looks partial I want somewhat yes if you were doing just addition would that be faster if I'm doing even using a fully homomorphic encryption implementation if I'm doing only additions it's faster than if I'm doing multiplications multiplications are cost you okay but multiplications are used pretty much everything so can you are doing the inference part or the prediction part you do one matrix multiplication plus one polynomial al uation so you can but

certain types of aggregation this is an important actual question that you ask because certain type of operations like if I'm doing let's say I have a spreadsheet with values column volumes and what I'm doing is I'm doing only doing aggregation which is basically summing those in computing standard deviation of or computing averages and so on that can be done quite efficiently because now the only thing you were doing is all the columns are gonna be added and at the end you're gonna compute an average or are gonna compute the standard deviation which involves and squaring but depending what you want to hide when I

say hi this what you want to protect you can use some hybrid things like I don't need to do the division homomorphic Li if I'm not worried about how many entries I have in the database so how many how many rows I had in my in my spreadsheet yeah so there is some some interesting scenarios that people I can do one of the first times that I dug into fhg constructions was in it was in a study club that I did it was actually about Nigel smart speeds protocol which combined MPC's and FA cheese and I wondered about that combination with

other techniques you know our our fa cheese like they can be used in tandem with NPCs as we've seen but can they also be used in tandem or somehow together with like zero knowledge proof oh this technologies can be complimentary they can complement each other so if H is not the answer for everything right so it is it is a it is a nice skin and so on but whenever you deal with security you have to analyze what exactly you wants to protect what is at risk and therefore use the correct combination of technologies to to

mitigate any risk or so so let's say one one of the scenarios that's quite common these days is called co-marketing when you have different companies that may have datasets that overlap they wants to perform some some type of analysis on this dataset but they want obviously to protect the privacy of the interests in there or the the names of people or so on so you could use home mosque encryption to compute what is called the set intersect the set intersect is revealing only what is common to everybody in terms of whatever

used for that common let's say a simple example that happened before this virus scenario but people travelling to a given city will be going using a given airline there will be reserving hotels there going to be going to restaurants and so on quite often this is all disjoint right so if someone wants to do a co-marketing they're gonna say their line is gonna talk to some of the restaurants in a given City to some of the hotels and so on to understand how many of their passengers is staying at a given hotel and eat at a given a restaurant and so on because if you do that and if you have an understanding of their spending

patterns you can come up with a promotion where by yourself if you buy the ticket from me you get discount on this hotel or a voucher for this restaurant or or so on so this is the kamar Katyn scenario to do that you need to find out whether my passengers stayed at your hotel so there is the privacy part which is the people's names but I'm not interested only individual the interest for the commodities on the aggregation is on the demographics that you bring that up so you can use Homolka encryption to complete this set intersection or you could use other types of encryption that may be faster

to compute the set intersection but then you use from most encryption to compute the aggregations that you want to perform right so and this is a technical data just as an example of using let's say a yes for encrypting the keys that you're gonna search on and using hallmark encryption to encrypt the values of what you're going to be computing you so that there will be most of the cases that we expect for the future will be related to where you can combine how most encryption for certain things with other types of protection I told in one

scenario there one scenario that I like which is not that difficult to do homophily actually it's the kind of things that we used to do before we were total lockdown at home is whenever you leave home for work the first thing you would do is pick up your phone and ask a service somewhere what's the traffic like where's the nearest coffee shop and so on and when you do that you are basically giving away a lot of your privacy yeah to whatever service is performing that operation because they're collecting all that information and that can combine with your neighbors or so they started to understand your patterns of life which you may not want

people to know right so if we're able to perform that same query to a service in the morning homomorphic the service would give you their answer not knowing which answer you gave you and only you can decrypt that answer it would change the business models of a lot of people there but my job is on the privacy stuff you couldn't make that query for free anymore because the company can't sell the data anymore that has to do with one of the the fact that whenever you ask a question you are revealing intent and when you review intent you are giving away a lot of data yes

so going back to that first question that you posed to the audience this idea of like what applications could be possible with such a a tool what are the most popular applications or what applications are you currently excited about I know you've just mentioned a couple we had this sort of marketing one but maybe you can share a few more so let's look at the industry's first right so industries that are regulated and those would be the finance industry healthcare industry and so and that government because of confidentiality and oblivious queerness that my people might want to perform are the biggest candidates for

using this technology to protect the privacy and the confidentiality of of the information protecting the privacy confidentiality and mean several things a lot of the industries and companies that are very serious about it will have that data in a very segregated environment so people can't steal the data or don't exfiltrate it but they they take filtration is also one of the biggest the issues that we have because at the end of the day someone in a company that has access to confidential private data may for whatever reason take the data out of the company so any

application or any environment where the data is private and with more regulations like gdpr and others now you need there is the need for more control of that privacy are potential candidates for that so the scenario that I one of the scenarios that we focuses a lot was even within a given company different organizations in in the same institutions let's say there are institutions that provide you with retail banking with investment with insurance with health insurance and

quite often they on the hospitals that you get treated on so it's a lot of data coming from different parts of this organization that may be coming together for any operational requirement that they might have someone is actually see that data in the clear and when that happens is the that group is the weakest link for data misuse or exaggeration so being able to apply homework encryption at that layer why are we still allowing data analysts or analysts to perform the analysis that they want to do but only see the result of the analysis and not individual entries are the type of

applications that are candidates and that involves not only finance but also involves healthcare yeah so these scenarios where data analytics needs to be performed are the ones that we see as as a good candidate these days and one of the proof of concepts that we run was on analyzing transaction data to predict whether someone will be needing a loan in the next three months if you can predict that well the companies can do up cell loans that's once enough but the other one that's kind of a hidden in

there is that when you do that you are actually performing an some sort of analysis on the financial health of the individual which then could be used to provide advice on spending or all sorts of other combinations that people do like you can aggregate your credit cards to pay it in a given schedule it's so funny because even in that example that you just gave there's always two sides to it right there's the potentially positive societal impact of like finding people who maybe would need a loan suggesting that they might be in financial trouble meaning maybe we can help or we can upsell which is usually the

opposite of helping interesting and but there is also the scenarios or where for instance on the healthcare scenario let's say that you want to check yourself for some inherited condition whichever one that be right call of the eyes or color of the hair or some illness so you're going to go through some genetic screening right and then you're gonna send your your genetic material to be tested by by a lab but that's all in the open with home of encryption we could do that in a home morphic way so only you when you get

back the result can decrypt the answer or your doctor depending on the trust level that people have and the other one is when you when you have multiple entities that would never share their data if now they can share their data in a secure way where only the aggregation or the results of that aggregation is revealed to the parties those are some of the the new applications that are going to be that are going to be appearing although that one sounds an awful lot like NPCs like kind of exactly like what an NPC is designed to do right

this aggregation of multiple sources with only the final with only the sort of combined results as displayed would you need to combine FA cheese with NPCs to to make that possible what you just described no I guess it depends on the application NPC is basically the the boot part computation in this sense is each party will compute a little bit of the answer and then they have to combine everything to find the final answer and as you said everybody will see what they are allowed to see for a homework encryption you could use with MPC there are sorts of techniques to do that as I said they complement each other the

scenario where I mentioned that a server might be computing part of the computation send it back to you you decrypt encrypted is somewhat kind of a multi-party computation between two two entities where there isn't much trust on one side but the scenarios where you might want to you outsource the data and the computation to are not sold trusted environment being at a multi-tenant environment or being a cloud environment are the ones that people will will be using home of encryption more which is I

have the cloud there my trust but I don't trust a cloud that much right because and this is actually one of the threat models one of the threat models is known as honest but curious it's gonna honestly perform that computation but it's gonna be looking inside and for scenarios where you have a threat model which is a lot more complex where the entity perform the computation might be dishonest then there are other protocols in combination of form or encryption that could be used to accomplish that so you might have a collection of participants some of them are honest some are dishonest s-- or some are

malicious and that we can combine other protocols for that it's more like categories of applications as opposed as a single application and I think to the point of the original question it's also not like there's the perfect answer like it is very much like what can you imagine doing with this yeah there probably are things that no one has yet imagined that's very true some of our clients came up with some Oh can we do this and the first question that some some of those are very pragmatic approaches that yeah that's a given use case perfect will make sense and some

are what you want to do but there might be a business case so this this this is the tricky part of this interaction is is not only to talk to the developers right is exposing this technology in an understandable way to the line of business because now the line of business might say oh I can combine these two piece of data never thought I could do that if I can do this oh I can discover something else right to wrap up I want to bring it back a little bit to what you mentioned you're entering this phase of usability so what are you actually building and doing to

make this usable to me the average developer right so what we are doing is we have our library is open source it's on github on homing /ag Lib and throughout last year we made four beta releases and early this year we release or someone soon we're going to release version another refresh of version 1 which is 1 0 1 but has enhancements and fixes and everything this is the github park so it's there but we have also been

working on how to make everything more consumable to developers and there are several ways of doing that one is by creating self-contained examples with little tutorials that people can can follow at different levels someone might just want to know what I can do right so I can do a query great and someone to know what happens under the covers when when they do this query so we are we are working through creating those scenarios and examples and the first one will be available in the IBM research try our tech website in a few weeks for people to to follow

there and then follow to the to the github and in parallel with that as I mentioned before there's a grant of the US government to make this as a toolkit all right so and that will become available every time something new that we do becomes usable then we will make it available for people to use this is that kind of grant work open-source as well or are there conditions no day our library so open source it's Apache Apache License cool well I get those links in the show notes so people can find them yeah as a final sort of note I wonder if someone really wants to dig

into this once you know either get involved with the research or start working on this what would your advice be to them we are right now making actually bringing what is the open sourcing to a more collaborative environment and we'll have this announced soon on where people that want to help some some some people there have been helping and we have been taking some of the collaboration that people have been given but I guess the one thing that's missing from from everybody is kind of a tutorial that brings people in right so you don't need to be a

hardcore cryptographer if if there is a tutorial that explains and the other thing is if you are willing to learn about latus crypto and the modern arithmetic and some of these things so if you're not afraid of learning then that is that is an easy way to to collaborate and learn well I hope if there's a one way to describe our audience not afraid of learning would be on top so we'll see if if anyone gets interested enough to dig in and thanks for helping us explore deeper this fully homomorphic encryption thank you very much for being on the show thank you

great and to our listeners thanks for listening thanks for listening you [Music]