Making Fully Homomorphic Encryption Accessible to All
Total Page:16
File Type:pdf, Size:1020Kb
Research Collection Conference Paper Marble: Making fully homomorphic encryption accessible to all Author(s): Viand, Alexander; Shafagh, Hossein Publication Date: 2018 Permanent Link: https://doi.org/10.3929/ethz-b-000307502 Originally published in: http://doi.org/10.1145/3267973.3267978 Rights / License: Creative Commons Attribution 4.0 International This page was generated automatically upon download from the ETH Zurich Research Collection. For more information please consult the Terms of use. ETH Library Session 2 WAHC’18, October 19, 2018, Toronto, ON, Canada Marble: Making Fully Homomorphic Encryption Accessible to All Alexander Viand Hossein Shafagh Department of Computer Science Department of Computer Science ETH Zurich, Switzerland ETH Zurich, Switzerland [email protected] [email protected] ABSTRACT that require outsourcing storage and computation from client de- With the recent explosion of data breaches and data misuse cases, vices to powerful servers in the cloud. However, outsourcing puts there is more demand than ever for secure system designs that user data at risk and threatens privacy. This can be resolved by fundamentally tackle today’s data trust models. One promising encrypting user data on the client side with efficient symmetric alternative to today’s trust model is true end-to-end encryption key-based schemes, e.g., AES-CTR, before sending it to the cloud. without however compromising user experience nor data utility. However, this leaves the abundant computation resources on the Fully homomorphic encryption (FHE) provides a powerful tool in cloud unused and introduces significant application latencies, as the empowering users with more control over their data, while still user has to download large segments of the ever growing datasets benefiting from computing services of remote services, though locally, to perform computations on top, e.g., data analytics. By without trusting them with plaintext data. However, due to the leveraging fully homomorphic encryption (FHE), the user can out- complexity of fully homomorphic encryption, it has remained re- source arbitrary computations on their encrypted data to a remote served exclusively for a small group of domain experts. With our server without revealing the plaintext data nor trusting the cloud system Marble, we make FHE accessible to the broader community with encryption keys. With FHE the server learns neither the inputs, of researchers and developers. Marble takes away the complexity outputs, nor intermediate results of the computation. of setup and configuration associated with FHE schemes. It pro- FHE is a young research field and poses a high barrier of entry, vides a familiar programming environment. Marble allows rapid specifically for non-cryptographers. The broader research commu- feasibility assessment and development of FHE-based applications. nity and developers make the common assumption that real-world More importantly, Marble benchmarks the overall performance FHE-based applications are either infeasible or impractical due to a of an FHE-based application, as part of the feasibility assessment. significant slowdown of several orders of magnitude. For instance, With real-world application case-studies, we show the practicality that operations taking nanoseconds on a modern CPU operating of Marble. on plaintext data can take several seconds to minutes on FHE- encrypted data. It is however less known that despite this slowdown, CCS CONCEPTS there are scenarios where FHE can be practical or near-practical. For instance, Wang et al. show a system to privately outsource • Security and privacy → Public key (asymmetric) techniques; feature-extraction to the cloud using FHE [40]. Their solution out- Management and querying of encrypted data; performs local computation for reasonably sized images, even with the overhead of FHE. Çetin et al. present an auto-completion system KEYWORDS that uses FHE [7] and achieves latencies of roughly one second. Encrypted Applications; Homomorphic Encryption Schemes Estimating the overhead required for FHE in a given application is hard for developers outside of the cryptography research commu- ACM Reference Format: Alexander Viand and Hossein Shafagh. 2018. Marble: Making Fully Ho- nity. Often, it is not apparent whether or not an application will be momorphic Encryption Accessible to All. In 6th Workshop on Encrypted practical until an FHE-based implementation is attempted. This can Computing & Applied Homomorphic Cryptography (WAHC ’18), October be a daunting task requiring a significant time investment which 19, 2018, Toronto, ON, Canada. ACM, New York, NY, USA, 12 pages. https: discourages developers and researchers from exploring FHE. For //doi.org/10.1145/3267973.3267978 instance, consider the case of a researcher in the field of biometrics- based authentication who is exploring alternative secure designs 1 INTRODUCTION that allow for reducing the trust in the storage- and computation- providers (i.e., cloud) for a biometrics-based authentication system. Maintaining user privacy in the era of cloud-computing is a com- It is desirable for her to understand the overhead of a FHE-based plex challenge. Users demand increasingly powerful applications version of her authentication algorithm without necessarily being a crypto expert. We therefore propose Marble, a high-level framework that al- lows developers without a background in FHE or cryptography to easily prototype FHE-based applications. Marble handles parame- ter choices, cryptosystem set-up, and behind-the-scenes emulation WAHC ’18, October 19, 2018, Toronto, ON, Canada © 2018 Copyright held by the owner/author(s). of binary arithmetic circuits. The framework can automatically ACM ISBN 978-1-4503-5987-0/18/10. analyze and benchmark applications to report the FHE overhead. https://doi.org/10.1145/3267973.3267978 49 Session 2 WAHC’18, October 19, 2018, Toronto, ON, Canada Our goal is to make exploring FHE more accessible, enabling have some operation (e.g., +) on the plaintexts then there is an oper- developers to quickly discover the applicability of FHE to their ation ⊕ on the ciphertexts so that Dec¹Enc¹x +yºº = Dec¹Enc¹xº ⊕ scenario. The performance of the underlying FHE scheme is an in- Enc¹yºº.A fully homomorphic encryption scheme is one that sup- herent key factor in Marble. Hence, Marble’s modular design makes ports an arbitrary mix of additions and multiplications2. the currently most promising schemes accessible. To facilitate this, There are a variety of different FHE constructions that differ the underlying cryptosystem implementation can easily be replaced in their hardness assumptions and approaches [12]. However, the as advances in FHE research are made. most important aspects for designing FHE-based applications are To realize our system, we address the following challenges: There either inherent in FHE or shared among all current schemes. For are two common approaches to computing with FHE; direct evalua- example, they generally support the plaintext space Zp , i.e., the tion of polynomial functions and binary circuit emulation for more integers modulo p 2 N, for a parameter p. general functions. (i) Choosing either of these approaches for an All current FHE schemes also have the property that ciphertexts application is non-obvious and changing it during development can degrade during computation. This is because they encrypt a value lead to large amounts of wasted effort. (ii) Different FHE implemen- m as a ciphertext c = m0 + ϵ for some small noise ϵ and a suitable tations have different setup, initialization, and parameter selection encoding m0 of the plaintext. When this noise grows too large, requirements. Depending on the library in question, a significant decryption will no longer return the correct plaintext. Different amount of ‘boiler-plate’ code and implementation-specific insight schemes adopt different noise-management techniques [4], with is required to compile, initialize, and use them. (iii) Evaluating a maximum noise threshold that derives from the parameters of FHE-based applications can be difficult since runtime varies greatly the scheme. Generally speaking, a larger noise threshold results between different machines and different FHE implementations. in slower homomorphic operations. For all schemes, additions in- Instead, a better measure for an application’s performance is to crease the noise much less than multiplications. Especially chained quantify its inherent complexity rather than merely runtime. multiplications, i.e., multiplications of already multiplied cipher- The main contribution of this work is an easy-to-use framework texts cause an explosive noise growth. This is why additions are that enables developers to write FHE-based programs as if they were computationally more efficient than multiplications. plaintext programs, automatically selects appropriate parameters, handles initialization and setup, and evaluates programs both in 2.2 Computing with FHE terms of runtime as well in terms of machine- and implementation- independent characteristics. We demonstrate the usability of our With additions and multiplications, we can compute any polynomial framework through the implementation and evaluation of several function over the encrypted data. This class includes functions example applications. We calculate the hamming distance between like the squared `2-norm and gradient descent. However, some two encrypted vectors, implement encrypted location-based ads, important functions used in programming