Hacker News Reader

Comment by SilasX | Hacker News Reader

The definition of FHE specifies arbitrary computation:

https://en.wikipedia.org/wiki/Homomorphic_encryption#Fully_H...

If it's really just addition and multiplication, it's not FHE.

Arbitrary computation can still be bounded. [1] for example cites the definition of FHE (Def. 9) as a scheme that can compute all circuits, which are fairly powerful [2].

Arbitrary computation is also, afaik, not well defined.

edit: After putting some thought into this, I feel like the idea is: Circuits can perform arbitrary computations on a limited size input, but not on an arbitrary size input. Loops are not a problem, as they are an implementation detail. Unbounded output is not possible on a touring machine that halts for all inputs of size s limited by some constant. There exists a circuit that would compute the same thing, as you can take the (binary encoded) results of the touring machine and just create a truth table from that, which describes a circuit. Circuits are interesting because they are usually limited in size.

[1] https://eprint.iacr.org/2015/1192.pdf

[2] https://en.wikipedia.org/wiki/Circuit_complexity

>Arbitrary computation is also, afaik, not well defined.

Yes it is, it's Turing-completeness.

> Yes it is, it's Turing-completeness.

While this may be a sensible interpretation, and I am willing to believe it's used in that interpretation in some fields, I have a hard time actually finding a definition of that form.

I also have a problem with using it in this way: In circuits the size of the circuit limits your input size. But given a maximum size of the input, and no size limitations on the circuit, you can construct a circuit that produces the same result as a turing machine that halts. So you can compute whatever you want (i.e. arbitrary) but you are limited by the size of your current circuit.

(Completely unhelpful but always fun to look at for words: https://books.google.com/ngrams/graph?content=arbitrary+comp... )

As gone over in the discussion above [1], you can only compute those TMs that you can unroll into a fixed size circuit, which means (at most) only the subset of TMs that halt; doing this in the general case requires a halting oracle, which is not possible. That's not arbitrary computation by any reasonable definition.

Furthermore, it adds a huge constraint to programming: you can only implement loops with iterations bounded by a constant known at compile time. (And if you derive any of those constants from the inputs at the time you're compiling it for the FHE machine to execute, you've leaked information about said inputs.)

[1] https://news.ycombinator.com/item?id=24019212

My computer is not Turing complete, yet it can do arbitrary computations.

FHE is bounded-memory Turing complete, the same as every computer on the planet.

See my cousin comment [1]: your computer does not require that you be able to determine whether your programs halt and then unroll them into a fixed-size stateless circuit, so that's a big difference.

[1] https://news.ycombinator.com/item?id=24022339

There are two solutions for this. 1) The halting problem is decidable (but untractable) for bounded machines. 2) Instead of deciding when to halt inside the machine, do it outside with continuations. Encrypted computing will always enforce time-limits thus this is not an issue.

With addition and multiplication you can do a lot. I think there is a term for circuits that can be “arithmetized”. A loop which iteration count is based on the value of the encrypted input seems to be out of scope.

I think the Wikipedia page is oversimplifying somewhat at the cost of accuracy.

Weird, feels kind of misleading just on general principle to call it "fully" when it doesn't do the full set of computations.

I found this link [1] which makes this distinction:

> Partially Homomorphic Encryption (PHE): In PHE scheme, only one type of mathematical operation is allowed on the encrypted message, i.e., either addition or multiplication operation, with unlimited number of times,

> Somewhat Homomorphic Encryption (SHE): In SHE, both addition and multiplication operation is allowed but with only a limited number of times.

> Fully Homomorphic Encryption (FHE): FHE allows a large number of different types of evaluation operations on the encrypted message with unlimited number of times.

And even then, multiplication is just repeated addition, so it still feels off to say it goes beyond partially homomorphic in the above schema. (Edit: actually, for arbitrary inputs, you can't reduce it like that, so ignore this para.)

In any case, original claim from the article that started this thread [2] is wrong.

[1] https://www.sciencedirect.com/topics/computer-science/fully-...

[2] "Since all mathematical and logical operations can be built from additive and multiplicative operations, "

Regarding [2]: Xor and And form a basis of all logical operations, while Xor on its own (or And on its own) do not. In GF(2) multiplication is xor and addition is and. So addition and multiplication are enought to build all possible circuits.

Another way to look at it is, in homomorphic encryption you have the problem that in an operation both operands are encrypted. Therefore repeated addition based on one operand is not an option.

In GF(2), addition is xor and multiplication is and.

Ah I am way too confused these days, thanks for the correction :)

Actually, Gentrys thesis abstract says this [1]:

> Such a scheme allows one to compute arbitrary functions over encrypted data without the decryption key [- i.e. ...]

My understanding is, while FHE can not implement an algorithm to solve a problem of arbitrary size input, it can apply arbitrary computations to a limited size input.

[1] https://crypto.stanford.edu/craig/

But neither your computer can if you bound your PC to always take the same amount of time to execute any problem you give it.

The issue with such a system that would allow arbitrary computation is that it would certainly allow to extract the value, which mean it would be simpler not to encrypt it in the first place :)

Reply on news.ycombinator.com