As of right now, the current-day state-of-the-art fully-homomorphic schemes impose roughly a billion-factor overhead on operations, but this is quickly decreasing (in the past 4 years, we've already knocked off three orders of magnitude). But I am personally convinced that an efficient scheme would likely revolutionize privacy in computing. Exciting stuff, especially with recent events.
Unfortunately, I don't expect an efficient scheme to be widely-used for at least 15-25 years. For one, even if a super-efficient FHE scheme was published tomorrow, it'd probably take at least 6-10 years of powerful, sustained cryptanalysis for the community to trust it. Add the time to discover such a scheme (if even possible...) and you have quite a while. But still, the potential is amazing.
Even so, for the use cases suggested (e.g. search engines), it'd still be a vast improvement on what we currently have – even if it later turns out to be flawed.
There's a bunch of data on a server, including, say, encrypted names. Users accessing the server have a key to decrypt those names, but they also need to be able to search for and sort names. Decrypting all the names and searching/sorting would be one option, but with enough names, it becomes very, very slow. Another option is having a big index that you decrypt for searching/sorting. This is kind of unwieldy as well, even if it's faster than decrypting everything piece by piece.
Perhaps the right homomorphic encryption techniques could also be used, although you'd have to account for substring searching in the case of names: finding "David" searching for "Dav".
I actually did this once at a company I worked for. Both the management and the employees ended up unhappy.
(the typical, and more secure, version of this includes public key encryption between each participant)
1. Employees paid less than the average 2. Employees paid equal to or more than the average 3. Management.
Reactions are:
1. Unhappy: Being paid less than average 2. Happy: Being paid more than average 3. Unhappy: Half of their employees now know they are being paid less and are unhappy.
Uncaught TypeError: Cannot read property 'length' of undefined BigInt.js:1
expand BigInt.js:1
powMod BigInt.js:1
decryptRecAns paillier.js:70
getConsensus distribute.js:94Are negative numbers not yet supported?
editted to add: Or indeed decimal numbers.
Natural numbers only then?
Still seems cool even if how it works is a mystery to me.
Is it possible to use homomorphic encryption to create a network of "dump pipes" for exchanging data?
Tor is slow because data has to hop from peer to peer until it hits its destination. What if the "nodes" between you and the recipient ran on a single machine? Clients would simply send a homomorphically encrypted program to a central server which merely executed it. The programs and the data exchanged could be completely transparent, you could even give law enforcement access, and assuming:
1. the homomorphic encryption is secure
2. your data passes through enough trustworthy peers
3. there are enough nodes involved for plausible deniability
...it would not be possible to identify the path data takes as it is routed around.
Or am I missing something?
Traffic can be anonamised hopping it around many peers (assuming that a critical mass of them are not observed, which seems entirely likely these days).
If you sent a request to a single machine, which routed it between processes, eventually decoding the request, you are saying that the machine would not know what user made that request, and it could return the result via the same chain. But because both ends and the processing are observed, traffic analysis would yield which client asked for the file trivially. Rather like if the enemy controlled every node on your darknet, they could trivially know who you were and what you were doing.
The strength of the network is lots of nodes and lots of hops, in the hope that you will pass through enough uncontrolled ones that traffic can't be resolved. While what you suggest might, possibly reduce the risk from a compromised node in a multihop chain, it would not defeat traffic analysis, which is the major problem. Better just to inject fake traffic.
And of course, the standard onion-encryption would be applied. The data on one end would be different than on the other or at any point in between. Padding to prevent size attacks, etc. (Everything Tor already does, I believe.)
The homomorphic-encryption would just allow you to 'outsource' your cryptography, routing and buffering mechanisms to a remote host, making data transfer between each individual 'identity' much faster without jeopardizing anonymity.
In retrospect homomorphic encryption may have little to do with this particular idea, I'm not a CS wizard or anything.
For anonymization systems, care must be taken: being able to manipulate encrypted data could very well create information leaks.
There have been some interesting theoretical uses of the Pallier cryptosystem in private information retrieval systems, though.