Hacker News Reader

It feels plausible to me that homomorphic encryption would be especially vulnerable to side-channel attacks because its schemes are so computation-heavy. I don't have a clear mental model for this, but it feels like there would be a lot of opportunities for attackers to detect data dependencies at the beginning of the process (if they have access to observe a relevant channel).

View on HN

The encryption is data dependent. The homomorphic computation itself cannot be data dependent. Homomorphic encryption says that even if you see all the intermediate encrypted values, you will not know what the encrypted input or output value is. So side-channels do not matter for the computationally heavy evaluation part. In this paper they attacked the encryption part.

Sorry, I meant the initial preparation of the encrypted data. I believe that this step is also typically rather computationally heavy, although maybe less so than the later computation over the encrypted data.

Reply on news.ycombinator.com