This is the webpage of TFHE, a recent and quite fast FHE scheme - https://tfhe.github.io/tfhe/ . They have a (surely incomplete) list of applications. I work in a somewhat related field, and I know that current FHE schemes can be used for things like voting and computing basic statistics when the data size is smallish.

Out of that entire list, all of them are either academic projects or toolchain projects. None of them are FHE in use in an actual production system.

FHE is interesting but very early.

Because of the sheer performance challenges, and the availability of SGX as an alternative, and also the competitiveness of MPC, I think most use cases struggle to justify selecting homomorphic encryption as the best choice.

To me, who is involved in related fields but not FHE directly, it seems like practical FHE is probably 15 or more years away, even for niche use cases.

Way longer than 15 years

What are SGX and MPC? :-)

Intel SGX - allows you to run your code on a someone’s hardware fully assured that owner can’t get nor your code not your data.

MPC - Multi-Party Computations. To protect your data and algorithms, you split data and code between multiple parties in special way that prevents them from knowing what exactly was computed.

https://en.wikipedia.org/wiki/Software_Guard_Extensions

https://en.wikipedia.org/wiki/Secure_multi-party_computation

There are a few companies doing some stuff commercially - some have mentioned TFHC, sponsored by commercial entity called Inpher (https://www.inpher.io/ ) and you have others like Enveil (https://enveil.com), who are building some cool use cases for Private Information Retrieval.

Ultimately, they end up being very niche use cases that are part of a broader security strategy- we are very far away from having this be practical enough for general use cases. Deployment are also difficult because they require client side changes to adapt to the underlying cryptographic protocols.

At my place of employment, we believe the right approach is a combination of locked down execution environments (see: keystone enclave) + webassembly that expose what is effectively a compiler to choose the right cryptographic computation paths based on query planner (similar technologies that power database query engines). It’s not a one-size fits all, but there are ways that you can optimize down to a fully homomorphic operation _for a particular computational path_. If this stuff is interesting to you, we are hiring :)!

I googled and found a Brazilian bank trying it out:

https://www.darkreading.com/threat-intelligence/major-brazil...