News for hackers. Stuff that matters.
Re:Intel to Build Silicon for Fully Homomorphic Encryption by glitchc on Tuesday March 09, 2021 @12:33AM (#26395740)
FHE leaks information indeed. It's proven to not be secure against a chosen ciphertext attack.
Re:Intel to Build Silicon for Fully Homomorphic Encryption by paconbork on Tuesday March 09, 2021 @01:27AM (#26396027)
It's not that straightforward. There's two types of chosen ciphertext attacks: IND-CCA1 (non-adaptive) and IND-CCA2 (adaptive).

There are in fact FHE schemes for the former such as https://www.iacr.org/archive/pkc2017/101750203/101750203.pdf

The problem comes in the adaptive case. In the distinguishing game, an adaptive adversary can have the decryption oracle decrypt any ciphertext after it receives its challenge ciphertext (besides the challenge itself, as that would be trivially defeatable). However, if the adversary receives Enc(m), they can just compute Enc(m+m) and ask the oracle to decrypt it, thus winning the game.

No FHE scheme will be IND-CCA2 secure by definition, but that doesn't mean that they "leak information" in the applications FHE is being proposed for. As long as you're not decrypting arbitrary ciphertexts for the server you just uploaded your sensitive encrypted information to, you can have your delegated computation, as a treat.

Re:Intel to Build Silicon for Fully Homomorphic Encryption by bawolff on Tuesday March 09, 2021 @12:48AM (#26395834)
Well this is unfortunate, i can't help but feel that many of the usecases for FHE are much less likely to have decryption oracles than traditional encryption would.

I'm also not sure if i would say "leak information" is the right word to describe a chosen ciphertext attack.