Dark Reading is part of the Informa Tech Division of Informa PLC

This site is operated by a business or businesses owned by Informa PLC and all copyright resides with them.Informa PLC's registered office is 5 Howick Place, London SW1P 1WG. Registered in England and Wales. Number 8860726.

Vulnerabilities / Threats

6/7/2018
10:30 AM
Connect Directly
Twitter
LinkedIn
RSS
E-Mail vvv
100%
0%

In Pursuit of Cryptography's Holy Grail

Homomorphic encryption eliminates the need for data exposure at any point - something that certainly would be welcome these days.

For the last 40 years, the world has been chasing the holy grail of cryptography — practical homomorphic encryption. Indiana Jones for math dorks? Hardly.

If encryption is a vault protecting your sensitive data, traditional practice requires taking the data out of the vault every time it needs to be used or processed — when users perform a search, apply analytics, etc. This leaves the data exposed and vulnerable to a breach. Homomorphic encryption allows these critical actions to take place within the vault, eliminating the need for data exposure at any point.

If we ignore the need to protect data while it's being processed (in use), it really doesn't matter how secure the data is on the way to the vault (in transit) or while stored in the vault (at rest): an attacker can simply patiently wait until the data is completely exposed during use to steal it. In the data security landscape, data in use has become the point of least resistance for an attacker. Homomorphic encryption can ensure this final piece of the data security puzzle is solved by eliminating the data-in-use security gap.

Sometimes thought of as esoteric mathematics with little practical relevance, homomorphic encryption has been the subject of much study and pursuit in the academic, government, and commercial spaces in the last four decades. Simply put, homomorphic encryption allows operations to be performed on ciphertext as if it were plaintext; this enables applications to perform actions on critical data inside the vault of encryption. It provides the security of encryption while keeping data usable, allowing functions to be performed on the data in its encrypted state. This eliminates both the extra effort and exposure gap required by today's standard practice (decrypt, use, encrypt again).

Until recently, homomorphic encryption had been considered too computationally impractical. In its initial form, it was painfully slow (think around a million times longer for processing), bulky, and expensive to implement, which left most working around and, in some cases, ignoring the vulnerabilities of data in use completely. This is changing, however, as homomorphic encryption is finally moving from the realm of the theoretical to the commercially practical.  

In the commercial world, many powerful horizontal use cases centered around securely using both encrypted and unencrypted data are uniquely addressed by homomorphic encryption. These include secure data processing in the cloud, risk reduction/elimination under various compliance regulations such as the EU's General Data Protection Regulation, protection of the most sensitive "crown jewel" data assets of an organization at every point in the processing life cycle, and a host of powerful unexpected applications such as third-party risk and secure data monetization.

In the realm of third-party risk, homomorphic encryption can enable data sharing while eliminating the need to hand over entire data sets. Imagine being able allow trusted third parties to perform encrypted search on a data set held by the data owner containing sensitive information such as personally identifiable information (PII) or financial data without the risk of incidental exposure to information beyond the scope of relevance. This protects both the data owner and the data consumer from potential compliance/regulatory concerns and, since the full data set now never has to leave the owner's possession, it also prevents trickle-down exposure due to data mishandling by the third party or other affiliates with whom the owner may need to share the information.

There is also clear broad applicability in the area of secure data monetization. Organizations across industries are sitting on troves of existing data assets that could become sources of additional revenue if they had the ability to provide secure search and analytic access without increasing their own organizational risk. Homomorphic encryption can be used to ensure that searchers can obtain information without revealing their interests, a factor that could be advantageous in the financial (think know-your-customer and anti-money laundering efforts) and healthcare fields (query patient data without exposing PII or other sensitive indicators), among others.

With numerous possible applications, the paradigm-shifting potential of practical homomorphic encryption will continue to spur pursuit in the academic and commercial spaces alike. Without question, homomorphic encryption is a game changer — it's been pursued for nearly four decades with good reason. The significance of its potential impact on the broader data security market is moving it from a term recognized within niche circles to a required part of an enterprise's security arsenal. 

Related Content:

Dr. Ellison Anne Williams is the Founder and CEO of Enveil. She has more than a decade of experience spearheading avant-garde efforts in the areas of large scale analytics, information security and privacy, computer network exploitation, and network modeling at the National ... View Full Bio
Comment  | 
Print  | 
More Insights
Comments
Newest First  |  Oldest First  |  Threaded View
The Cold Truth about Cyber Insurance
Chris Kennedy, CISO & VP Customer Success, AttackIQ,  11/7/2019
Why Cyber-Risk Is a C-Suite Issue
Marc Wilczek, Digital Strategist & CIO Advisor,  11/12/2019
6 Small-Business Password Managers
Curtis Franklin Jr., Senior Editor at Dark Reading,  11/8/2019
Register for Dark Reading Newsletters
White Papers
Video
Cartoon Contest
Current Issue
7 Threats & Disruptive Forces Changing the Face of Cybersecurity
This Dark Reading Tech Digest gives an in-depth look at the biggest emerging threats and disruptive forces that are changing the face of cybersecurity today.
Flash Poll
Rethinking Enterprise Data Defense
Rethinking Enterprise Data Defense
Frustrated with recurring intrusions and breaches, cybersecurity professionals are questioning some of the industrys conventional wisdom. Heres a look at what theyre thinking about.
Twitter Feed
Dark Reading - Bug Report
Bug Report
Enterprise Vulnerabilities
From DHS/US-CERT's National Vulnerability Database
CVE-2019-16863
PUBLISHED: 2019-11-14
STMicroelectronics ST33TPHF2ESPI TPM devices before 2019-09-12 allow attackers to extract the ECDSA private key via a side-channel timing attack because ECDSA scalar multiplication is mishandled, aka TPM-FAIL.
CVE-2019-18949
PUBLISHED: 2019-11-14
SnowHaze before 2.6.6 is sometimes too late to honor a per-site JavaScript blocking setting, which leads to unintended JavaScript execution via a chain of webpage redirections targeted to the user's browser configuration.
CVE-2011-1930
PUBLISHED: 2019-11-14
In klibc 1.5.20 and 1.5.21, the DHCP options written by ipconfig to /tmp/net-$DEVICE.conf are not properly escaped. This may allow a remote attacker to send a specially crafted DHCP reply which could execute arbitrary code with the privileges of any process which sources DHCP options.
CVE-2011-1145
PUBLISHED: 2019-11-14
The SQLDriverConnect() function in unixODBC before 2.2.14p2 have a possible buffer overflow condition when specifying a large value for SAVEFILE parameter in the connection string.
CVE-2011-1488
PUBLISHED: 2019-11-14
A memory leak in rsyslog before 5.7.6 was found in the way deamon processed log messages are logged when $RepeatedMsgReduction was enabled. A local attacker could use this flaw to cause a denial of the rsyslogd daemon service by crashing the service via a sequence of repeated log messages sent withi...