Is Porticor's "homomorphic" key encryption something that can really be done or is it just marketing hype?

Question

Porticor has an interesting file encryption offering for encrypting and decrypting files in an MySQL database quickly.

They are an Amazon AWS (Amazon Web Service) Partner Network technology partner and their product is available in the AWS Marketplace.

It seems similar to Gazzang's zNcrypt.

Porticor has been touting for a while that it will be offering homomorphic key management. That sounds very interesting and appealing, but it seems to be taking them a long time to roll it out.

Is it theoretically feasible for them to implement this, or is it just marketing hype? I'm beginning to wonder.

Answer 1

The details are very sparse as to what they are actually doing. So, I'll speculate. Below are some claims and what I think they are doing.

The master key (in its plain unencrypted form) will be literally nowhere in the cloud, yet completely usable for split-key encryption.

Typically this is done using some sort of secret sharing, which doesn't necessarily mean homomorphic encryption (HE). That said, there are some advantages with using HE. Under typical secret sharing, the secret must be reconstructed at some point. With HE, that is no longer the case. Encryption and Decryption can be done homomorphically (see this and this). Timing results of both are promising and could be considered practical, especially for the first link.

we only have an encrypted form of the master keys. In more technical words, the Porticor product will perform split-key encryption with a partially homomorphically encrypted master key.

This leads me to believe they are doing something similar to the two links above. They store an encrypted version of the master key and their management key (similar to the safe deposit box they describe), and use those to encrypt/decrypt data. Most likely they are doing something similar to the first link as the result of that encryption/decryption is plaintext where the result of the 2nd link is not plaintext but the plaintext encrypted with the homomorphic key.

Assuming I am correct (who knows though as they don't publish the details yet), I would say it is practical. Look at the timing results in that paper. At the same time, it is somewhat marketing hype. Sure "The master key (in its plain unencrypted form) will be literally nowhere in the cloud, yet completely usable for split-key encryption" but the data must be decrypted at some point and can be stolen at that point in time. Also, I'm not sure I'd trust my data being protected by such new techniques yet. The field of homomorphic encryption is such an unstable field right now.

Answer 2

Here’s is a crypto analysis on Porticor system.

From my point of view the system is almost useless in a cloud environment because its security can only be proved on a semi-honest model, witch means you have to trust Porticor and your cloud provider… not very likely in a post-NSA era.

I'm not an cryptographer, but I've implemented a PHE schema used on financial data. I could be wrong, but IMHO there is no need to use homomorphic encryption techniques to build a key management system like this.

Answer 3

From the link , they clearly say, they do, partially Homomorphic encryption only. which is feasible from long back .

It seems similar to Gazzang's zNcrypt.

Although both Gazzang and porticor try to solve same problem of Key Management for cloud based applications , Gazzang literally stores all user keys in their hardened MySQL server and provides Key Management as Sw-as-a-Service, So here user needs to "trust" Gazzang.

Where as porticor uses split key technology, the master key in unencrypted form is stored neither with them nor in the cloud , relatively this is much better i feel. They use a combination of encrypted master key and specific keys and homomorphically compute bigger key to encrypted and decrypt data ,although its not clear for me how exactly it works either from their white paper or analysis paper.

Answer 4

Porticor's Homomorphic Key management paper1 is now released. So that answers the theoretical feasibility question.

The other commenters are correct when they say - the mathematical technique used is Partially Homomorphic Encryption (PHE). Porticor applies this to encryption keys, in order to encrypt the keys in the cloud, rather than the masses of data.

A technical analysis and proof is paper2

An extension of the technique beyond the "semi-honest" model, so it still guarantees security even in cases where the attacker has subverted code on some of the participating servers, is paper3.

All documents are available online, the first and third are actually from the USA patent office.

In summary, the second (analysis) document contains a series of proofs (mathematically rigorous) that support the method. They

1. show the approach is rigorous in the semi-honest model

2. describe a concrete construction of the protocol based on El-Gamal as the Partially Homomorphic Encryption system

3. describe secure protocols for creating "appliances" in the cloud that can participate in secure key management

4. describe secure protocols for creating new storage objects and protected items (which could be specific keys or secret phrases)

5. analyze these protocols in the semi-honest model and rigorously prove that they are secure

6. notes that the approach can be extended to the malicious model: the "protocol enables its compilation so that is secure even in the malicious model. This can be done with quite reasonable performance overhead, using the same cryptographic primitives". This construction is not provided paper2, but it is available in paper3.

So, in sum, the answers to the questions raised above are:

A. yes, it is feasible and indeed efficient and concretely implemented. B. it works for both semi-honest and "malicious" threat models. C. because it is based on partially homomorphic encryption, it is quite efficient

Of course, fully homomorphic encryption would be even more secure but slower performance. The protocol offers a good balance between performance and security. This is now based on several years of experience with the implementation.