Cloud pulls crypto agendas
What a great monthly publication CACM is. In the 15 years that I’ve been a member of the ACM, this must be the time that I’m getting the most out of CACM (now in soft-copy as well for extra convenience). In recent issues, CACM has featured interesting crypto papers with a Cloud spin.
In the March issue, I dug into Craig Gentry’s paper on homomorphic encryption. In today’s Clouds, we cannot separate delegation of processing from delegation of cleartext access. Enter homomorphic crypto and, voila, we no longer need to question a Cloud provider’s aptitude to handle sensitive information. With this crypto, one can tap off-the-shelf public compute resources to do the Navier-Stokes for a new wing or process the interception tracks from some military sightings, yet without ever revealing a thing. In practice, however, I doubt that there are that many Cloud use cases begging for homomorphic crypto … once I take away those that belong in private Clouds anyhow (e.g., for SLA reasons) and those that can be simply dealt with via anonymization (e.g., for medical records), tokenization (e.g., for select PII elements), and simple tests for equality (for which standard crypto suffices). Regardless, this is one of those jaw-dropping results well worthy of a you-must-be-kidding-me reaction. I give Gentry plenty kudos for making his material highly accessible and engaging. In the pile of security papers that I have read over the years, Alice has never looked so good and crafty!
In the April Issue, I’m reading Sergey Yekhanin’s article on crypto protocols that protect the privacy of queries to public databases. It’s not an identity challenge. Rather, it’s about disguising the intention of a query or a set of queries. In the age of real-time analytics, it’s not far fetched that a database provider or a data aggregator in the Cloud manages to detect and then leverage mounting interest in a particular topic. Counter to that, the discipline of private information retrieval makes it hard or impossible to infer a subject’s intention at the expense of some communication and/or data overhead.
In both cases, I’m eager to see how these research results will be reduced to practice. The Cloud can dress up as transformational technology capable to pull through some powerful ideas.