How Do You Add Two Numbers You Arent Allowed to See
got asked this at the weekend and gave a bad answer, so I went and read properly.
Hedger uses homomorphic encryption based on ElGamal over ECC. the plain version of what that buys you is this: you can perform computation on ENCRYPTED values without decrypting them first.
so a contract holding two encrypted balances can produce the encrypted sum, correctly, without ever learning either number or the total.
that sounds like a magic trick and its not. its a property of how the encryption is structured, and ElGamal has this property for multiplication, which maps onto addition in the exponent. its been known since the eighties.
why combine it with zero knowledge proofs rather than using either alone.
because homomorphic encryption tells you the maths CAN be done on hidden values. it doesnt tell you the person doing it did it honestly, or that the inputs were valid in the first place. thats what the proofs are for.
so one primitive handles confidential computation, the other handles verifiable correctness, and neither substitutes for the other. most privacy systems reach for proofs alone and pay in circuit complexity, becuse youre then proving statements about arithmetic you also had to hide.
the honest caveat: homomorphic schemes are not free. this is partially homomorphic, not the fully homomorphic encryption people write breathless articles about, and the difference is that a partial scheme supports certain operations rather than arbitrary computation. that limitation is exactly why its FAST enough to run in a browser in under two seconds.
which is the trade I'd have made too. general purpose and unusable helps nobody.
#dusk @Dusk $DUSK
got asked this at the weekend and gave a bad answer, so I went and read properly.
Hedger uses homomorphic encryption based on ElGamal over ECC. the plain version of what that buys you is this: you can perform computation on ENCRYPTED values without decrypting them first.
so a contract holding two encrypted balances can produce the encrypted sum, correctly, without ever learning either number or the total.
that sounds like a magic trick and its not. its a property of how the encryption is structured, and ElGamal has this property for multiplication, which maps onto addition in the exponent. its been known since the eighties.
why combine it with zero knowledge proofs rather than using either alone.
because homomorphic encryption tells you the maths CAN be done on hidden values. it doesnt tell you the person doing it did it honestly, or that the inputs were valid in the first place. thats what the proofs are for.
so one primitive handles confidential computation, the other handles verifiable correctness, and neither substitutes for the other. most privacy systems reach for proofs alone and pay in circuit complexity, becuse youre then proving statements about arithmetic you also had to hide.
the honest caveat: homomorphic schemes are not free. this is partially homomorphic, not the fully homomorphic encryption people write breathless articles about, and the difference is that a partial scheme supports certain operations rather than arbitrary computation. that limitation is exactly why its FAST enough to run in a browser in under two seconds.
which is the trade I'd have made too. general purpose and unusable helps nobody.
#dusk @Dusk $DUSK