|
|
IBM develops crypto-peeking tech
Author: Gareth HalfacreePublished: 26th June 2009
IBM's Charles Lickel likens homomorphic encryption to performing "flawless neurosurgery while blindfolded."
As reported over on TechRadar, IBM researcher Craig Gentry has figured out a way to analyse and process encrypted data without actually decrypting it first – ensuring total data security at all points.
The technique, known as homomorphic encryption, allows encrypted data to be worked with in the same way as unencrypted data – with the exception that the original clear-text data is never at risk of exposure. While homomorphic encryption was first mooted around thirty years ago by cryptography giants Ron Rivest and Leonard Adleman – two of the three people behind the popular RSA public-key crypto algorithm - it's not until now that a workable implementation has been developed.
Gentry's discovery – made as a summer student at IBM's Research division while working on his PhD thesis - that ideal lattices can be used to work with encrypted data could prove to be a real boon for the burgeoning cloud computing industry, which still suffers from a concern – especially in big business – that private data is shipped to a third party over a public network. The process could also be used to detect viruses in encrypted e-mails and even to allow complete privacy when using a web search engine.
The vice president of Software Research at IBM Charles Lickel described the technique as being similar to “enabling a layperson to perform flawless neurosurgery while blindfolded, and without later remembering the episode,” which is just about the most awesome thing any IBM employee has ever said.
While it'll take a while for IBM to iron out the kinks in the new technology, it's likely that analysis of encrypted data will be a feature of most servers before too long.
Does the thought that systems can peek inside your encrypted data stores without your knowledge give you the heebie-jeebies, or are you looking forward to the day when true end-to-end encryption is a reality? Share your thoughts over in the forums.
Related
Comments (9)- Site Links:
- About
- Email Editor
- Newsletter
- Privacy
- RSS
- Score Guide
- Our Other Websites:
- Auto Express
- Channel Pro
- Computer Buyer
- Computer Shopper
- Den of Geek
All content © bit-tech.net 2000-2010
© Copyright Dennis Publishing Limited licensed by Felden
As a simple example, you could do this with a very simple but very weak encryption algorithm and very poor data efficiency (encrypted files would be larger than plaintext) - pick a large number as your key (k). Then to encrypt, E(x) = x * k + a random integer between 0 and (k-1). Because an attacker doesn't know k, he can't decrypt. The use of the random number prevents an attacker deducing k by factoring E(x). To decrypt, just round down E(x)/k to give an integer, x. This is flawed because the encryption is ludicrously weak, and also because if you encrypt two equal plaintexts there is no way to predict which will give a higher value after encryption, so sorting would not preserve the order of equal values, but it is an illustration.
I don't know what sort of operations you'd want to perform on encrypted data, but I guess sorting might be one of them. Addition and subtraction might be another. In any event, it will entail a different encryption algorithm to the usual suspects (RSA, AES etc.).
I look forward to reading about this in more detail.
Hmm, sounds like an episode of Dollhouse.
Agreed, now my head hurts.... thanks
I build fundraising systems for some of the big name charities and you have to be clever to work around the FACT!! that you cannot search within encypted data without either A) compromising your encryption methods or B) decrypting everthing before you search.
Any technique that allows basic manipulation (even sorting) poses a potential risk of exposing the contents or content distribution of your encrypted data.
It also has it's flaws, as you will see here: http://portal.acm.org/citation.cfm?doid=1536414.1536440
I understood your first post. It was very clear, actually. Thanks!
It's your FACT!!s that are being challenged by this man's discovery.
To do this as an example, if you were the only one that could decrypt information from your bank. Homorphic encryption would allow you to pass this encrypted data on to a third party and they could for example add up all the debits and credits returning you a balance. But they would do this purely with the encrypted information from your bank and return the answer to you encrypted in the same way. They would never need (or be able to) to decrypt and see the actual amounts of money you transacted.
Obviously this is a limited example, but you can imagine the possibilities for third parties processing your personal information without ever having access to its actual details.