Practical applications of homomorphic encryption algorithms?

Question

It appears there there were interesting things going on in cryptography: the first homomorphic encryption scheme appeared recently (explanation, HT). Roughly sp

Answer 1

With this you can execute an arbitrary non-recursive circuit of bounded depth, so given a logarithmic key length you can execute an NC1 algorithm (basically a feed-forward Boolean circuit).

So, how can you use this?

Lets look at Map/Reducing a circuit and reduction scheme over a set of inputs.

First the data:

We probably don't want the client to have to have encrypted all of the data we are going to search, so you can provide an encrypted 1 and an encrypted 0 to the server, and let it use the ring structure to construct arbitrary encrypted integers for us, or we can just use those directly as bits. That way the server can provide some or all of the data that we are searching through. For integers it can construct them by peasant arithmetic (double or double and add 1 for each bit), for bits it just provides the appropriate encrypted bit.

We can mix and match boolean and integer values in our designs, obtaining an if/then/else (that requires evaluating both branches SIMD style) by evaluating cond * then + (1 - cond) * else using 1 as true and 0 as false in cond, so you can get away with using the built in arithmetic of your ring to make your circuits more shallow.

On the other hand, we may have pre-encrypted some data as well, but since you'll have to keep recycling the same key set to use it, this becomes seriously tricky to get right.

So, now we have server provided data. Now, encrypt the stuff you don't want the server to know, like what it is you are searching for, and have them feed that into the circuit at the right points as well, say as an extra input to your map function.

We should be able to map an arbitrary NC1-like circuit over each input to extract a field, multiply some values, and generally map it into a form that you can reduce cheaply.

Then reduce those fragments using more small circuits, such as for a simple monoid that has a nicely size-bounded result. (i.e. you map to obtain a bit that indicates if you found a match, and then you reduce by counting those bits with a small adder circuit)

Since you only need to construct the circuit logically and simulate its execution on these encrypted bits in the homomorphic ring, you could probably implement it relatively quickly using a small DSL, i.e. something like Lava in Haskell, assuming you got the homomorphic encryption pieces straight.

Also, keep in mind that each gate is seriously expensive to execute.

So, to summarize,

1. Give the server an encrypted 1 and 0 and any encrypted metainfo for your map and reduce functions.
2. For each data point, encode it into your homomorphic ring, feed your map circuit both the input and the meta info to obtain a value suitable for reduction.
3. In a balanced binary tree (or other balanced arrangement to minimize tree height), apply your reduction operation to the output from your circuit and any encrypted map metainfo.
4. Hand the result over to the client for decryption