Swift Homomorphic Encryption

I feel like phone number lookup is the textbook example of homomorphic encryption not actually working because there's so few keys you can simply enumerate them.

I find homomorphic encryption fascinating as it can in some sense move a simulation into an inaccessible parallel universe.

Anyone interested in FHE should also be checking out <a href="https:&#x2F;&#x2F;www.zama.ai" rel="nofollow">https:&#x2F;&#x2F;www.zama.ai</a> they&#x27;ve made a ton of progress recently in making FHE practical.

This must be the first real world use case of HE. It has generally been considered too slow to do anything useful but this is an excellent use case.

This is hugely significant (long-term), that won&#x27;t be felt immediately.<p>This is a massive announcement for AI and use cases related to PII.

How does it compare to the FHE from <a href="https:&#x2F;&#x2F;zama.ai" rel="nofollow">https:&#x2F;&#x2F;zama.ai</a> ?

The name is hilarious because HME is anything but speedy -- by many orders of magnitude.<p>I think the real fix is secure enclaves, and those have proven to be difficult as well.

What is the processing that the server does on the encrypted phone number? I am not sure I understand. I always thought that this type of encryption was (roughly and imprecisely) - you send some encrypted blob to the server, it does some side effect free number crunching on the blob and returns the output blob. You decrypt the blob and everyone is happy.<p>But to return information if some number is spam it has to be either plaintext or hashed condition somewhere outside of the phone?

FHE is cool but I wonder how many use cases it actually fits. Don’t get me wrong, it gives better security guarantees for the end user but do they really care if the organization makes a promise about a secure execution environment in the cloud?<p>Also from an engineering point of view, using FHE requires a refactoring of flows and an inflexible commitment to all processing downstream. Without laws mandating it, do organizations have enough motivation to do that?

The thing that I always want to know with FHE: the gold standard of modern encryption is IND-CCA security. FHE by definition cannot meet that standard (being able to change a ciphertext to have predictable effects on the plaintext is the definition of a chosen ciphertext attack). So how close do modern FHE schemes get? ie how much security am I sacrificing to get the FHE goodness?

I don&#x27;t quite understand how the server can match the ciphertext with a value without knowing the key. How does the server determine that the ciphertext corresponds to the specific value? If the server constructs this ciphertext-value database, how does it know what algorithm to use to create ciphertext from a value and store on its side?

great to see this becoming part of mainstream tools. the question I have is, when a weakness is published in FHE, is it more like a hash function you can do some transformations on, but there is no &#x27;decryption&#x27; to recover plaintext again- or is it more like a symmetric cipher, where all your old ciphertexts can be cracked, but now your FHE data sets are no longer considered secure or private and need to be re-generated from their plaintexts with the updated version?<p>what is the failure mode of FHE and how does it recover?

If we assume that server is “evil” then the server can store both PIR encrypted and plain text phone number in the same row in the database and when this row is read, simply log plain text phone number. What do I miss here? We can send PIR request and trust server not to do the above; or we can send plain text phone number and trust server not to log it — what’s the difference?

Is there a good primer that explains the math basis of this?

I wrote some basic homomorphic encryption code for a hackathon like 8 years ago. When I interviewed for a BigTechCo [1] about a year later, the topic came up, and when I tried explaining what homomorphic encryption was to one of the interviewers, he told me that I misunderstood, because it was &quot;impossible&quot; to update encrypted data without decrypting it. I politely tried saying &quot;actually no, that&#x27;s what makes homomorphic encryption super cool&quot;, and we went back and forth; eventually I kind of gave up because I was trying to make a good impression.<p>I did actually get that job, but I found out that that interviewer actually said &quot;no&quot;, I believe because he thought I was wrong about that.<p>[1] My usual disclaimer: It&#x27;s not hard to find my work history, I don&#x27;t hide it, but I politely ask that you do not post it here directly.