You (Probably) Don’t Need Fully Homomorphic Encryption

Picture this: you're a product manager or engineer in a meeting about data privacy and compliance...

‍An eager executive brings up Fully Homomorphic Encryption (FHE) and asks if it can solve your data privacy problems. What do you answer?

This situation is becoming more commonplace in the industry as FHE has captured the industry’s imagination as the “ultimate” solution to data privacy. It’s elegant, powerful, and...completely impractical for most business purposes. In contrast, there’s another privacy-enhancing technology that has not received the same level of hype or awareness: searchable encryption (SE). FHE is like a cruise liner: it has everything you could ever need, but it's slow but it's slow and expensive.

By contrast, searchable encryption (SE) is like a catamaran: sleek, efficient, fast, and purpose-built. So, before answering yes to the eager executive and jumping onto the FHE bandwagon, consider whether searchable encryption (SE) can solve your data privacy problems more effectively.

The FHE Mirage

FHE is often hailed as a silver bullet for data privacy. By encrypting data with advanced cryptography, FHE allows data to be manipulated and transformed while still encrypted. It’s a Turing-complete system, any mathematical or statistical calculation can theoretically be done on encrypted data with FHE. Whether it’s counting how many occurrences a given name appears in a dataset or applying a beauty filter to an encrypted image, you can do that with FHE without decrypting the data. Any computer program can be run on encrypted data using FHE, in theory. It sounds wonderful, but like all technology panaceas, the devil is in the details.

For FHE, that devil has two horns: performance and tooling. It can be painfully slow and difficult to use. So why would people be excited by a slow and brittle technology? Because it’s powerful. FHE offers “perfect” privacy in a world where we barely have privacy at all. When Craig Gentry first proposed FHE in 2009, it was hailed as a breakthrough. A breakthrough that was a million times too slow to be commercially viable. Impractical breakthroughs are catnip for cryptographers and engineers. In the last decade and a half, FHE has become one of the most well-studied systems for encryption. Dozens of improvements have been made to every layer of the FHE stack including custom hardware, FHE compilers, and the underlying cryptography itself.

However, despite significant progress, FHE still has too many issues with performance and tooling for most real-time, software-embeded use cases. An optimized FHE program still requires thousands of times the computing resources of an equivalent unencrypted program in the best case. This kind of overhead makes FHE impractical and out of reach, even for very simple applications. Furthermore, despite the advancements in areas like FHE compilers and the proliferation of open-source software, the developer tooling around FHE is still in the early stages and no single framework has emerged as a de facto standard suitable for general-purpose software applications. FHE is like an elephant, and nobody wants an elephant in their data center.

While FHE can support some use cases, given its computational overhead and integration complexities, it falls flat for real-time, software-driven applications. And businesses run in real time. So, while it’s exciting to dream about using FHE for a wide range of business applications, let’s get back to reality and focus on what actually works.

Introducing Searchable Encryption

While FHE captures the spotlight, more specialized tools often get overlooked. Businesses need privacy, security, and compliance, and they need real-time data in their software applications. This is where searchable encryption shines.

Imagine needing to perform a typical query across on an encrypted data set. Searchable encryption makes this possible without decrypting anything. It leverages FIPS 140-2 certified cryptographic primitives to protect data and well-studied privacy-preserving indexing schemes for search. This keeps your data secure and compliant while still allowing you to perform essential functions like keyword searches, matching, counting, range search, and basic analytics. Most importantly, it’s fast enough to use for almost any application.

‍

Searchable encryption doesn’t try to do everything—it excels at what it’s designed to do: search encrypted data. It provides a practical, accessible, and cost-effective way to secure data without sacrificing utility. Most importantly, it’s ready to use today.

Real-World Impact

Consider the real-world implications: you have a global team needing access to data while ensuring compliance with global data privacy laws like GDPR, CCPA, and HIPAA. With searchable encryption, you can confidently manage data security without fully homomorphic encryption's complexity, cost, rigidity, and performance drawbacks.

Searchable encryption can also enable third-party researchers, partners, and analysts and internal business intelligence (BI) teams to derive secure, real-time analytics on encrypted data, gaining valuable insights without compromising data privacy. With the right implementation, searchable encryption integrates seamlessly into existing systems, making it a breeze to use.

Searchable encryption enables third-party use cases previously difficult or impossible to meet, like cross-border fraud prevention, privacy-preserving  auction marketplaces, clinical trial recruitment, real-world evidence gathering, and business intelligence analytics. With the right implementation, searchable encryption integrates seamlessly into existing systems, making it a breeze to use.

Searchable encryption deserves a place in every company’s data privacy plan. It’s fast, reliable, and effective—no cruise liner required. 

So the next time an eager executive suggests fully homomorphic encryption as the solution to all your data privacy challenges, gently remind them of its less-hyped cousin—searchable encryption. It may lack the mind-blowing nature of FHE, but it more than makes up for it in real-world impact.