In Pursuit of Cryptography's Holy Grail

For the last 40 years, the world has been chasing the holy grail of cryptography — practical homomorphic encryption. Indiana Jones for math dorks? Hardly.

If encryption is a vault protecting your sensitive data, traditional practice requires taking the data out of the vault every time it needs to be used or processed — when users perform a search, apply analytics, etc. This leaves the data exposed and vulnerable to a breach. Homomorphic encryption allows these critical actions to take place within the vault, eliminating the need for data exposure at any point.

If we ignore the need to protect data while it's being processed (in use), it really doesn't matter how secure the data is on the way to the vault (in transit) or while stored in the vault (at rest): an attacker can simply patiently wait until the data is completely exposed during use to steal it. In the data security landscape, data in use has become the point of least resistance for an attacker. Homomorphic encryption can ensure this final piece of the data security puzzle is solved by eliminating the data-in-use security gap.

Sometimes thought of as esoteric mathematics with little practical relevance, homomorphic encryption has been the subject of much study and pursuit in the academic, government, and commercial spaces in the last four decades. Simply put, homomorphic encryption allows operations to be performed on ciphertext as if it were plaintext; this enables applications to perform actions on critical data inside the vault of encryption. It provides the security of encryption while keeping data usable, allowing functions to be performed on the data in its encrypted state. This eliminates both the extra effort and exposure gap required by today's standard practice (decrypt, use, encrypt again).

Until recently, homomorphic encryption had been considered too computationally impractical. In its initial form, it was painfully slow (think around a million times longer for processing), bulky, and expensive to implement, which left most working around and, in some cases, ignoring the vulnerabilities of data in use completely. This is changing, however, as homomorphic encryption is finally moving from the realm of the theoretical to the commercially practical.  

In the commercial world, many powerful horizontal use cases centered around securely using both encrypted and unencrypted data are uniquely addressed by homomorphic encryption. These include secure data processing in the cloud, risk reduction/elimination under various compliance regulations such as the EU's General Data Protection Regulation, protection of the most sensitive "crown jewel" data assets of an organization at every point in the processing life cycle, and a host of powerful unexpected applications such as third-party risk and secure data monetization.

In the realm of third-party risk, homomorphic encryption can enable data sharing while eliminating the need to hand over entire data sets. Imagine being able allow trusted third parties to perform encrypted search on a data set held by the data owner containing sensitive information such as personally identifiable information (PII) or financial data without the risk of incidental exposure to information beyond the scope of relevance. This protects both the data owner and the data consumer from potential compliance/regulatory concerns and, since the full data set now never has to leave the owner's possession, it also prevents trickle-down exposure due to data mishandling by the third party or other affiliates with whom the owner may need to share the information.

There is also clear broad applicability in the area of secure data monetization. Organizations across industries are sitting on troves of existing data assets that could become sources of additional revenue if they had the ability to provide secure search and analytic access without increasing their own organizational risk. Homomorphic encryption can be used to ensure that searchers can obtain information without revealing their interests, a factor that could be advantageous in the financial (think know-your-customer and anti-money laundering efforts) and healthcare fields (query patient data without exposing PII or other sensitive indicators), among others.

With numerous possible applications, the paradigm-shifting potential of practical homomorphic encryption will continue to spur pursuit in the academic and commercial spaces alike. Without question, homomorphic encryption is a game changer — it's been pursued for nearly four decades with good reason. The significance of its potential impact on the broader data security market is moving it from a term recognized within niche circles to a required part of an enterprise's security arsenal. 

Related Content: