Hacker News Reader

Comment by xphos | Hacker News Reader

Does this limit the type of operation you can do. I could imagine if you were allowed decision operators you would completely defeat the encryption. This makes me think there is a a limit on some of the algorithms that you can actually run. I saw in the comments about Differential Privacy which sounds like it overcomes this issue but I am curious on what more educated people how to say about the operation sets available in a Homomorphic environment

View on HN

When using Homomorphic Encryption you need to compile your application to a circuit. This means that for branches you need to evaluate both sides and multiply by a bit (like a multiplexor). This way you preserve privacy at the price of heavy computation on the server side.

+1, and some compilers already exist to do that for you. See, e.g., Google's compiler (which I work on). https://github.com/google/fully-homomorphic-encryption

> This means that for branches you need to evaluate both sides

Not true in general, since you can reuse the multiplexor multiple times during the evaluation, to produce essentially a circuit-wise least-common-multiple of the two sides of the branch. Eg, if one side performs two multiplications, and the other a multiplication and a division, you only need to evaluate a division and two multiplications, not a division and three multiplications. So "evaluate both sides" is a worst-case upper bound on the amount of computation.

Loops are still a pain in the ass, though.

Reply on news.ycombinator.com