CRYPTOGRAPHY

Editors: Alfred John Menezes, [email protected] | Douglas Stebila, [email protected]

Computing on Encrypted Data

Nigel Smart | KU Leuven and Zama

The ability to compute on encrypted data is fast becoming a practical reality. We discuss the progress in
four technologies which enable this: Trusted Execution Environments, Fully Homomorphic Encryption,
Multi-Party Computation and Zero-Knowledge Proofs.

T raditionally, cryptography has

been used to secure data while
we move them from one location to
another. For example, consider the
use of the Enigma machine during
World War II or the now ubiquitous
use of Transport Layer Security to
secure Internet traffic. This is often

©SHUTTERSTOCK.COM/ZINETRON
called securing data in transit. A
more modern idea has also been to
secure data while they are sitting in
one location. Here, one can think of
the (almost) ubiquitous use of hard
disk encryption on company lap-
tops and smartphones. We call such and federated learning. On the other Trusted Execution
methods ways of securing the data hand, COED technologies have a Environments
when they are at rest. wider application than simply ensur- The simplest form of COED tech-
However, these two forms of ing the privacy of users. As COED nology is that of trusted execu-
securing data, when they are in tran- technologies become more widely tion environments (TEEs), such
sit and when they are at rest, do not used and deployed, in this article, we as Intel’s SGX or TDX technology
secure data when they have their explore what they are and how they or ARM’s TrustZone technology.
highest value: namely, when we are can be used in applications. Here, data are encrypted when they
actually using them. There is now COED technologies use some are outside of the microprocessor.
a series of technologies that aim to form of encryption to maintain the When the data enter the micropro-
secure data while they are “in use”: security of the data. However, the cessor, the data are decrypted, and
methods to perform what has been encryption method is used in a way computations within the micropro-
dubbed computing on encrypted data that enables computation to be per- cessor happen on the unencrypted
(COED). Such COED techniques formed on the data while they remain data. Then, when the data leave the
form one part of what have been in encrypted form. Here, we use the processor, the data are reencrypted
called privacy-enhancing technologies term encryption quite loosely as, tech- for storage. Thus, the only place the
(PETs). PETs are, however, a very nically speaking, the encryption may data are unencrypted is when they
wide class of techniques, which can not actually be encryption as one is are within the hardware itself. This
include statistical methods such as used to the term usually being used; technology allows arbitrary pro-
differential privacy, synthetic data, for example, we also think of secret grams to be run on the encrypted
sharing used in multi-party computa- data. Complexity comes from ensur-
Digital Object Identifier 10.1109/MSEC.2023.3279517
tion (MPC) discussed later as a form ing that only valid programs are exe-
Date of current version: 16 July 2023 of “encryption.” cuted on the data, that is, that the

thorized licensed use limited to: INDIAN INSTITUTE OF TECHNOLOGY BHILAI. Downloaded on July 31,2023 at 17:11:14 UTC from IEEE Xplore. Restrictions apply.
94 July/August 2023 Copublished by the IEEE Computer and Reliability Societies  1540-7993/23©2023IEEE
 data owner authorizes the hardware of a processor. Nowadays, the Ad- is a limit as to the complexity of the
to execute the programs it wants to vanced Encryption Standard en- function one can compute with such
be executed and not the other ones. cryption (the modern replacement operations. For example, one may
TEEs are a relatively simple solu- for DES) of data entering and exit- be only able to compute a function
tion to deploy for privacy-preserving ing a processor is fast compared to of degree 1,024. Gentry’s key insight
computations that has resulted in the time it takes to actually get the was that if the algorithm used by the
a number of companies market- data in and out in the first place! In- decryptor is simple enough, then
ing solutions in this space. As well stead of processing data via trusted one can turn an SHE scheme into an
as the main larger companies, there hardware, Rivest et al. introduced FHE scheme using a process known
are smaller companies offering spe- the idea of using encryption on as bootstrapping.
cific tailored solutions to various use standard processors to process data. Current commercial applica-
cases using TEEs: for example, Cape They considered a form of encryp- tions divide into those that use
Privacy, Cosmian, and Anjuna. tion that they called privacy homo- bootstrapping, and hence use an
A potential problem for TEE morphisms but that we now call fully FHE scheme, and those that do
technology is inherent in the design homomorphic encryption (FHE). They not, and hence use an SHE scheme.
of modern processors. To achieve imagined an encryption scheme Those that use SHE are usually tar-
efficiency, modern processors imple- that would encrypt data but that geting very specific applications,
ment various techniques to improve would allow a third party to take where the function being computed
performance: for example, deep pipe- two ciphertexts, encrypting, say, x is particularly simple. The reason
lines, out-of-order execution, specula- and y and allowing the third party to for using SHE as opposed to FHE
tive execution, and so forth. Each of create a ciphertext encrypting the is that, until recently, computing
these creates power (or timing) sig- sum x + y and another procedure the bootstrapping operation was
nals that an external observer can use allowing the third party to encrypt costly. In the last few years, a new
to “see” what is happening inside the the product x*y. More precisely, in form of FHE has come along, called
processor. Thus, as the TEE technol- FHE, there exist two publicly com- Torus-FHE (TFHE),3 which has an
ogy executes the program internally putable functions, Add and Mult, efficient bootstrapping operation.
on the data in the clear, the external with the following properties: Indeed, the bootstrapping opera-
observer can deduce information tion with TFHE is so fast that one
about the data hidden within the Dec (Mult (Enc(x), Enc(y))) = x * y can execute thousands of boot-
hardware. This creates a form of side Dec (Add (Enc(x), Enc(y))) = x + y. strapping operations per second. In
channel, which has been exploited addition, during the bootstrapping
in the laboratory to extract infor- Once one can perform addi- operation, one can execute a lookup
mation from inside the TEE. These tions and multiplications, the third table evaluation for free. This
are not just theoretical exploits; in party can then compute any arbi- lookup table needs to be relatively
2022, such attacks were shown to trary function on the encrypted small, but it can be any lookup table
be possible (https://sgx.fail) on the data, obtaining an encrypted result. one wants. This so-called program-
use of SGX in the Secret Network When the final result is needed, one mable bootstrapping enables a much
(a blockchain application) and the would return the ciphertext to the richer function description, which
use of SGX in ultra-high-definition holder of the decryption key, who does not just use additions and mul-
Blu-Ray players. would then obtain the result. tiplications, again leading to huge
Such FHE schemes were a pipe performance advantages.
Homomorphic Encryption dream until 2009, when Craig SHE and FHE are already used in
Interestingly, the idea of encrypting Gentry, a Ph.D. student at Stan- a number of applications, with more
data as they enter and leave a pro- ford, came up with a construction.2 applications coming on stream. A major
cessor was suggested as a means of Gentry’s original scheme was very high-profile usage is the use of SHE
COED back in a seminal article in inefficient, but in the years that fol- within Microsoft’s Edge browser in
the 1970s, namely one by Rivest et lowed, great strides have been taken the Password Monitor (https://www.
al.1 This article considered that such that now make FHE practical. microsoft.com/en-us/research/blog/
technologies would be too slow A simplification of FHE is the password-monitor-safeguarding
since, at the time, hardware decryp- so-called somewhat homomorphic -passwords-in-microsoft-edge/).
tion via the (then) state-of-the-art encryption (SHE). In an FHE scheme, There is a range of startup companies
algorithm Data Encryption Stan- one can continue adding and multi- building products, including Crypto-
dard ( D E S) w a s particularly plying ciphertexts to one’s heart’s Lab, Desilo, Duality, Enveil, Inpher,
slow compared to the execution content. In an SHE scheme, there Ravel, Tune Insight, and Zama. In

thorized licensed use limited to: INDIAN INSTITUTE OF TECHNOLOGY BHILAI. Downloaded on July 31,2023 at 17:11:14 UTC from IEEE Xplore. Restrictions apply.
www.computer.org/security 95
 CRYPTOGRAPHY

terms of tooling, Google is building without interacting. Namely, each parties do not deviate from the pro-
a cross-compiler that takes arbitrary party just computes tocol, then the bad parties learn no
C++ code and transforms it into a information about the good parties’
format suitable for usage within some zi = xi + yi . input data (so-called semihonest secu-
of these companies’ back ends. There rity). We then have to consider what
is still perhaps a 1,000-fold perfor- The cool thing in MPC is that happens if a subset of the bad parties
mance gap between processing data one can design protocols that enable deviates from the protocol—what
in the clear and processing them the parties to also be able to produce should happen then? The answer
securely using FHE, but this gap is sharings of the product. Thus, using depends on the protocol being used
closing. A major performance boost interaction, the parties are able to and the application.
is due to come in the next couple of compute arbitrary functions on their
years as a number of companies, for secret shared data. ■■ In the strongest situation, we
example, Chain Reaction, Cornami, The aforementioned gives would like not only the secrecy
Kioxia, Intel, Niobium, and Optaly- a simple variant of secret shar- of the good parties’ inputs to be
sys, are looking into producing hard- ing; however, in practice, one uses retained, but we would also like the
ware accelerators for some of the more complex variants that pro- good parties to still be able to com-
FHE schemes. vide additional properties, such as pute the function. This is called
the authentication of the shares, or robust MPC and is only possible
MPC weaken the requirement that all par- when there is a majority of hon-
Our third COED technology takes ties are needed to reconstruct the est parties. It is relatively hard to
a different route to enable computa- secret to a smaller subset of the par- obtain in a highly efficient manner.
tion on secret data. Instead of relying ties. We divide the parties perform- ■■ The next strongest situation again
on hardware or a com- protects the secrecy of
plex encryption scheme, SHE and FHE are already used in a the good parties, but we
in MPC, we utilize dif- would like the good par-
number of applications, with more
ferent self-interested ties to abort the com-
parties to ensure secu- applications coming on stream. putation if a bad party
rity. MPC makes a lot does something wrong.
of sense when one has a situation ing the operation into good and bad This is called security with abort.
where two (or more) companies parties with the restriction that the When such an abort happens, the
want to process functions on their number of bad parties cannot be good parties’ input data remain
joint data. The basic idea is that large enough to reconstruct the data private to those parties. In modern
each item of data is “shared” among on their own. protocols, this can be obtained
the parties. So imagine that we have Just like FHE, the idea of MPC at very little additional cost to the
three parties; then, we take each data is very old, with the early theoretical basic semihonest security men-
value x and then write it as work going back to the 1980s (see tioned previously.
Yao,4 Ben-Or et al.,5 and Chaum
x = x1 + x1 + x3. et al.6 among many, many other arti- There are a number of companies
cles). It was not until the mid-2000s, offering MPC solutions for bringing
The value xi is given to party Pi . however, that it became efficient parties’ data together in a secure man-
It is clear (assuming that the split- enough to be used in practice. The ner; these include CipherMode Labs,
ting has been done in a suitable first (and most famous) deployment Cybernetica, Inpher, Roseman Labs,
random manner) that it requires all was that used to evaluate a secure and Partisia. Even large companies
three parties to come together to auction for the Danish sugar beet are using MPC in applications; for
recover the correct value of x. Thus, industry (https://partisia.com/ example, Meta is using it to secure
we can consider secret sharing to be better-market-solutions/mpc-goes parts of its ad ecosystem (https://
a form of encryption. We write [x] -live/). Since then, the technology privacytech.fb.com/multi-party
to denote that the value x has been has improved dramatically. -computation/), and Google is
secretly shared. The security properties of MPC also investigating similar areas
Such a secret sharing scheme has are quite subtle. First, we require (https://ece.princeton.edu/events/
the nice property that, given shar- that if all the parties are honest, secure-multiparty-computation
ings [x] and [y] of two data items then the correct function will be -theory-google).
x and y, the parties can produce computed (this is called correctness). An interesting use case of MPC
a sharing [z] = [x + y] of z = x + y Second, we require that if the bad is not to bring data from different

thorized licensed use limited to: INDIAN INSTITUTE OF TECHNOLOGY BHILAI. Downloaded on July 31,2023 at 17:11:14 UTC from IEEE Xplore. Restrictions apply.
96 IEEE Security & Privacy July/August 2023
 parties together but to split the data schemes and the kind of identification that was input. This use of ZKPs
one party owns into many differ- schemes one uses to access buildings forms the basis of the Zcash proto-
ent shares. This means that one no and computers using secure tokens. col (https://zips.z.cash/protocol/
longer stores the data in one place, For these simple (and relatively old) protocol.pdf).
leading to a single point of failure, applications, the complexity of the ZKP finds widespread use in
but instead, one distributes the function F is quite limited. blockchains, beyond the application
data to different servers within the What has changed in the last 10 to Zcash. Indeed, ZKPs enable a key
organization (or to different cloud years is that the complexity of the feature of performance improve-
providers). Thus, an attacker needs function F that such ZKP systems ment in blockchain ecosystems. A
to compromise multiple different can support has increased dramati- set of transactions (or operations
machines to access the data. In the cally. This has led to a zoo of dif- on the blockchain) can be bundled
area of purely data storage, solutions ferent proof systems with various up and proved to be correct via a
using secret sharing for this appli- properties, for example, succinct ZKP. Then, only the small final
cation are offered by Astran and non-interactive arguments of knowl- ZKP needs to be committed to the
Fragmentix. edge (SNARKs),9 scalable trans- blockchain by the entity doing the
This idea of data splitting to parent arguments of knowledge bundling. All the validators (and
achieve enhanced security is also (STARKs),10 Bullet-Proofs,11 and external users) know that the bun-
found in the area of cryptography so on. A weaker notion of verifiable dling was done correctly due to the
called threshold cryptography, whereby computation (VC)10 enables one ZKP. However, since the proof
one secret-shares the secret keys party to prove it computed the given is small and can be cheaply veri-
associated with signing or decryp- function F(x) without keeping the fied, the cost of adding the bundle
tion operations, and then, one executes value x necessarily secret. of transactions to the blockchain is
the cryptographic operations without To see the utility of such ZKP cheaper than adding each transac-
reconstituting the key using the tech- and VC systems, consider a com- tion individually. The leading pro-
niques of MPC. This idea, again an pany outsourcing a computation to vider of such ZKPs to the blockchain
old one,7 has taken off in the last few a cloud service provider. The com- space is the company StarkWare.
years due to the need to secure the pany would like to know whether This application to blockchains
signing keys associated with crypto- the cloud provider actually com- is drawing a lot of interest. A major
currency wallets; examples include puted the function correctly, and problem is that while proof veri-
Curv (bought by PayPal in 2021), with VC technology, this can be fication times for SNARKs and
DFNS, Fireblocks, Sepior (bought by done. In particular, the “proof ” STARKs are very fast and the proof
Blockdaemon in 2022), and Unbound provided by the cloud provider is size can be relatively small, the time
Security (bought by Coinbase in quicker to verify than the computa- to generate the proof can be pro-
2022). In 2023, the U.S. National tion needed to be performed (oth- hibitively long in some applications.
Institution for Standards and Technol- erwise there would be no point in Just as in the FHE space, companies
ogy (NIST) announced a specific new outsourcing). In this application, as are also starting to look into spe-
call for cryptographic algorithms that the verifier knows x and F and sub- cific hardware accelerator engines
support such threshold cryptography sequently learns y; we do not need for speeding up the generation of
(https://csrc.nist.gov/Projects/ the zero-knowledge property and so ZKPs: for example, Chain Reaction,
threshold-cryptography). can just use a VC system. Cysic, and Ingonyama.
The zero-knowledge property
Zero-Knowledge Proofs becomes useful when you wish to Combining Together
Another old technique from the execute a function and have the One should not think that these
1980s that is coming to the fore due evaluation verified by parties who four technologies—TEE, FHE,
to its applications in cryptocurrencies you do not wish to have access to MPC, and ZKPs—should be used
and beyond is that of zero-knowledge the original data. For example, one separately and are mutually exclu-
proofs (ZKPs). Originally invented could be randomly shuffling a set sive. In practice, an application may
in the late 1980s,8 ZKPs allow one of transactions in a way such that want (and indeed need) to combine
party to prove to another that it knows one does not want the verifier to them together.
some secret data x such that y = F(x), link a specific input transaction
for a public value of y and a function with a specific output transaction, ■■ A TEE provides a strong attesta-
F, without revealing to the verifying but the verifier wants to know that tion that a specific piece of code
party anything about x. Such protocols the set that is output corresponds was executed, but it has problems
form the basis of most digital signature in a one-to-one way with the set with side-channel leakage. Thus,

thorized licensed use limited to: INDIAN INSTITUTE OF TECHNOLOGY BHILAI. Downloaded on July 31,2023 at 17:11:14 UTC from IEEE Xplore. Restrictions apply.
www.computer.org/security 97
 CRYPTOGRAPHY

some companies have utilized in transit and at rest and toward a complexity of interactive proof
MPC protocols where each party world in which data are secured systems,” SIAM J. Comput., vol. 18,
is executed on a separate TEE. while in use. The use, deployment, no. 1, pp. 186–208, Feb. 1989, doi:
■■ FHE provides communication- and marketing of these technolo- 10.1137/0218012.
efficient secure computation in gies are rapidly expanding. In the 9. N. Bitansky, R. Canetti, A. Chiesa, and
comparison with MPC, but the next 10 years, we will see the idea E. Tromer, “From extractable collision
need for a single decryption key of securing data during use becom- resistance to succinct non-interactive
may be a limiting factor in some ing as standard as assuming that our arguments of knowledge, and back
applications. Thus, one can com- Internet connection is encrypted. again,” in Proc. Innov. Theor. Com-
pute the function securely using put. Sci. Conf., 2012, pp. 326–349, doi:
FHE and then perform a threshold References 10.1145/2090236.2090263.
decryption operation using MPC. 1. R. L. Rivest, L. Adleman, and M. 10. E. Ben-Sasson, I. Bentov, Y. Horesh,
■■ In (public key) FHE, a poten- L. Dertouzos, “On data banks and and M. Riabzev, “Scalable zero
tial attack vector is for a party to privacy homomorphisms,” in Foun- knowledge with no trusted setup,”
enter an invalid ciphertext. How- dations of Secure Computation, New in Proc. Adv. Cryptology (CRYPTO),
ever, providing a ZKP with every York, NY, USA: Academic, 1978, pp. 2019, vol. 3, pp. 701–732.
input ciphertext, which proves it 169–179. 11. B. Bünz, J. Bootle, D. Boneh, A.
is a valid encryption, avoids such 2. C. Gentry, “Fully homomorphic Poelstra, P. Wuille, and G. Maxwell,
attack vectors. encryption using ideal lattices,” in “Bulletproofs: Short proofs for con-
■■ Some ZKP systems, and in par- Proc. 41st ACM Symp. Theory Comput. fidential transactions and more,”
ticular, the one used by Zcash (STOC), 2009, pp. 169–178, doi: in Proc. IEEE Symp. Secur. Privacy,
mentioned previously, require 10.1145/1536414.1536440. 2018, pp. 315–334, doi: 10.1109/
a so-called trusted setup. Such 3. I. Chillotti, N. Gama, M. Georgieva, SP.2018.00020.
trusted setups create data that are and M. Izabachène, “TFHE: Fast 12. R. Gennaro, C. Gentry, and B.
used by the ZKP system, but if the fully homomorphic encryption Parno, “Non-interactive verifiable
random values used in the trusted over the torus,” J. Cryptology, vol. computing: Outsourcing computa-
setup ever leak, then the security 33, no. 1, pp. 34–91, Jan. 2020, doi: tion to untrusted workers,” in Proc.
of the ZKP is broken. Hence, some 10.1007/s00145-019-09319-x. Adv. Cryptology (CRYPTO), 2010,
ZKP applications in the real world 4. A. C.-C. Yao, “Protocols for secure pp. 465–482.
create a trusted setup ceremony in computations,” in Proc. 23rd IEEE
which the setup algorithm is exe- Symp. Found. Comput. Sci. (FOCS), Nigel Smart is a cryptographer, a
cuted via MPC between a number 1982, pp. 160–164, doi: 10.1109/ professor at imec-COSIC, KU
of parties. The most famous exam- SFCS.1982.38. Leuven, 3001 Leuven, Belgium,
ple of such a ceremony is the one 5. M. Ben-Or, M. Shafi Goldwasser, and the chief academic officer at
performed by Zcash. and A. Wigderson, “Completeness Zama, 75002 Paris, France. His
theorems for non-cryptographic research interests include turning
Amazon Web Services (AWS) fault-tolerant distributed compu- theoretical cryptographic ideas
has recently launched its AWS tation,” in Proc. 20th ACM Symp. into practical solutions. Over the
Clean Rooms to enable AWS cus- Theory Comput. (STOC), 1988, pp. last 10 years, his work has focused
tomers to collaborate and share data 1–10, doi: 10.1145/62212.62213. on fully homomorphic encryp-
across organizations. AWS Clean 6. D. Chaum, C. Crépeau, and I. tion and multi-party computation.
Rooms claims to combine various Damgård, “Multiparty uncon- Smart received a Ph.D. in mathe-
privacy-preserving technologies, ditionally secure protocols,” in matics from the University of Kent.
including MPC and FHE, to ensure Proc. 20th ACM Symp. Theory Com- He was a founder of the startup
the security of customers’ data. put. (STOC), 1988, pp. 11–19, doi: Identum, which was bought by
10.1145/62212.62214. Trend Micro in 2008. In 2013,
7. A. De Santis, Y. Desmedt, Y. Frankel, he cofounded Unbound Secu-

C OED technologies have come

a long way since their theo-
retical conception in the 1970s and
and M. Yung, “How to share a function
securely,” in Proc. 26th ACM Symp. The-
ory Comput. (STOC), 1994, pp. 522–
rity, which was sold to Coinbase
in 2022. He is also the cofounder,
along with Kenny Paterson, of the
1980s. We are now on the cusp of 533, doi: 10.1145/195058.195405. Real World Cryptography confer-
a paradigm shift in cryptography, 8. S. Goldwasser, S. Micali, and ence series. Contact him at nigel.
away from considering secure data C. R ackof f , “ The know ledge [email protected].

thorized licensed use limited to: INDIAN INSTITUTE OF TECHNOLOGY BHILAI. Downloaded on July 31,2023 at 17:11:14 UTC from IEEE Xplore. Restrictions apply.
98 IEEE Security & Privacy July/August 2023