AWS re:Inforce 2024 - Explorations of cryptography research (SEC204-INT)

Summary

在亚马逊网络服务(AWS)的一次活动中，Peter O'Donnell介绍了三位密码学专家：Hugo Krawczyk、Tal Rabin和Shai Halevi，他们分别在HMAC算法、同态加密和多方计算等领域有杰出贡献。他们分享了在AWS的工作经历，以及如何将先进的密码学技术应用于实践，提高云服务的安全性和隐私保护。讨论的主题包括阈下密码学、安全多方计算以及加密计算等前沿技术，并强调了这些技术在保护数据、提高系统安全性方面的重要性。

Takeaways

• 😀 亚马逊网络服务（AWS）非常重视数据保护，其云服务的安全性和隐私性是客户最关心的问题之一。
• 🔒 Peter O'Donnell作为AWS的主要解决方案架构师，强调了密码学在保护数据中的基础作用，包括数据静态和传输中的加密以及身份验证。
• 🤖 AWS发明了Nitro系统，设计了耐用的S3服务，但这些并非Peter O'Donnell的工作，他强调了团队合作的重要性。
• 🌟 Hugo Krawczyk、Tal Rabin和Shai Halevi三位密码学家加入了AWS，他们分别在HMAC算法、同态加密和多方计算等领域有着杰出的贡献。
• 🔐 密码学家们希望将过去30年的先进密码学技术应用到实践中，提高AWS客户的安全和隐私保护水平。
• 🛡️ 阈下密码学、安全多方计算和加密计算是AWS正在研究和应用的先进技术，它们可以增强云服务的安全性并启用新的服务。
• 🔗 同态加密允许在加密数据上进行计算而无需解密，这为保护数据隐私提供了新的途径。
• 🤝 安全多方计算允许多个参与者共同计算某个函数的结果，而不会暴露各自的输入数据，这对于广告分析等领域非常有用。
• 🔑 阈下密码学通过将密钥分割存储在多个服务器上，消除了单点故障的风险，同时提高了系统的可用性和安全性。
• 🔍 AWS正在考虑将阈下密码学应用于其身份访问管理（IAM）系统，以增强其安全性。
• 🔄 密码学家们呼吁客户反馈，以了解他们的需求和痛点，从而更好地应用密码学技术解决实际问题。

Q & A

什么是门限密码学？

门限密码学是一种高级技术，旨在消除与密钥相关的单点故障。例如，在签名方案中，密钥可以分成随机的两个数字分别存储在不同的服务器上，从而消除单点故障。这种技术提高了安全性，同时外部签名保持不变。

什么是同态加密？

同态加密是一种允许在加密形式下处理数据的加密技术，无需解密数据或拥有解密密钥。它可以用于私密查询机器学习模型或私密集合交集等应用。

AWS的安全愿景是什么？

AWS的安全愿景是通过最新的密码学技术提高客户的安全性，包括硬化基础设施和启用新的服务。传统加密虽然在存储和传输数据时很好，但对于某些应用来说还不够，因此需要新的技术。

为什么选择AWS？

AWS非常关注客户，并致力于提高安全性和隐私保护。AWS的规模和愿景使其成为将高级密码技术付诸实践的理想场所。

什么是安全多方计算？

安全多方计算是一种允许多个参与方在不暴露自己数据的情况下，协作计算某些功能的协议。参与方只学习到计算结果而不会泄露输入数据的其他信息。

AWS在密码学研究中的贡献有哪些？

AWS参与了多个密码学项目，包括Kuiper卫星项目的密钥协商设计，以及端到端安全性系统的设计。这些项目旨在提高客户数据的安全性。

为什么密码学证明重要？

设计密码学系统、协议并不容易，很容易设计错误。密码学系统的安全性通常通过数学证明来验证，而不是通过模拟或测试。这些证明确保了系统的安全性。

量子计算对现有密码系统的影响是什么？

量子计算机可能破解现有基于因数分解或离散对数假设的密码系统。因此，需要发展基于不同假设的后量子密码学系统，以确保未来的安全性。

什么是密码计算？

密码计算是指在不查看明文数据的情况下处理数据的能力。示例包括同态加密和分布式计算，每个参与方只能看到无意义的比特，但整体上可以处理数据。

门限密码学如何提高系统可用性？

门限密码学通过将密钥分割成多个部分存储在不同服务器上，不仅消除了单点故障，还提高了系统的可用性。例如，如果密钥被分割成三部分，任何两部分就可以生成签名，从而增加了容错性和可用性。

Outlines

00:00

😀 欢迎致辞与数据保护讨论

Peter O’Donnell作为亚马逊网络服务（AWS）的首席解决方案架构师，欢迎与会者并强调了数据保护的重要性。他提到了加密技术的基础性作用，包括数据静态和传输中的保护，以及软件和服务器连接的认证。随后，他介绍了三位密码学家Hugo Krawczyk、Tal Rabin和Shai Halevi，他们在密码学领域有着数十年的合作经验，并且加入了AWS，带来了前沿的密码学研究成果。

05:02

🔐 密码学研究与AWS的合作愿景

三位密码学家分享了他们加入AWS的动机和愿景。他们曾在IBM研究院开始职业生涯，后共同创立了与加密货币Algorand相关的基金会。他们希望将30多年的研究成果转化为实践，提高安全性和隐私保护。AWS以其客户为中心的导向和影响力吸引了他们，他们相信AWS愿意并有远见将这些先进的技术应用起来。

10:02

🛡️ 先进密码技术的应用与展望

讨论了在AWS上应用先进密码技术的重要性，包括阈下密码学、安全多方计算和加密计算等。这些技术可以提高云服务的安全性，允许在数据加密的情况下进行数据处理，同时促进用户间的安全协作。特别提到了同态加密，允许在加密数据上进行计算而无需解密，以及分布式计算的概念。

15:04

🔑 阈下密码学与密钥管理

Tal Rabin解释了阈下密码学的目标是消除与密钥相关的单点故障。通过将密钥分割成多个部分并分布存储，即使部分密钥泄露，整个系统的安全性也不会受到影响。这种方法不仅提高了安全性，还增加了系统的可用性，允许在部分密钥丢失的情况下恢复或并行签名。

20:07

🔒 密码学在身份认证和广告领域的应用

讨论了密码学在身份认证和广告领域的应用。在身份认证方面，AWS的IAM系统将引入阈下密码学来增强安全性。在广告领域，介绍了安全多方计算的应用，允许广告商和发布者在不泄露各自数据的情况下，共同计算广告投放的效果。

25:08

🔎 同态加密与隐私保护

Shai Halevi讨论了同态加密技术，它允许在数据加密的情况下进行数据处理，提高了存储在数据库中的敏感数据的隐私保护。AWS正在与行业伙伴合作，评估这项技术的能力，并探索如何将其应用于现有的工作负载，例如图片匹配服务，以实现端到端的加密处理。

30:09

🚀 硬件加速与密码学的未来

讨论了硬件加速在密码学计算中的重要性，它有助于降低部署密码学工作负载的成本，使得客户可以在不牺牲性能或延迟的情况下部署这些工作负载。同时，提到了系统工程的重要性，包括如何将工作负载路由到具有加速器的主机上。

35:14

🌌 后量子密码学与亚马逊的前瞻性研究

讨论了后量子密码学（PQ）的重要性和当前的研究进展。强调了NIST举办的后量子加密签名方案竞赛，以及选定的候选方案。提到了量子计算机对现有加密算法的潜在威胁，以及如何通过混合方案结合传统密码学和后量子密码学来准备未来的安全挑战。

📢 客户反馈的重要性与未来展望

强调了客户反馈在AWS研究和产品开发中的重要性。鼓励客户分享他们在使用AWS服务时遇到的问题，以及他们希望密码学技术如何帮助解决这些问题。同时，提到了AWS的一些现有服务，如Amazon Clean Room，已经开始整合密码学技术，并邀请客户参与讨论和提供反馈。

Keywords

💡加密

加密是将数据转换为一种形式，以防止未授权的用户访问或理解的过程。在视频中，加密是保护数据的核心主题，涉及到数据存储和传输的安全性。例如，Peter O’Donnell提到了为AWS客户提供静态和传输中的加密服务，以及通过加密来识别和确保软件和服务器连接的安全。

💡解决方案架构师

解决方案架构师是一种专业角色，负责设计和实施解决方案以满足客户需求。在视频中，Peter O’Donnell自我介绍为AWS的首席解决方案架构师，他与一些最大和最具挑战性的客户合作，强调了他在提供加密和安全解决方案方面的专业知识。

💡Nitro系统

Nitro系统是AWS开发的一种技术，用于提高其云服务的性能和安全性。视频中提到'We invented the Nitro System'，指的是AWS通过创新技术提升了其服务的安全性和效率，尽管这不是Peter O’Donnell个人的工作，但作为解决方案架构师，他是这些创新技术的一部分。

💡S3

S3是Amazon Web Services提供的一种可扩展的云存储服务。在视频中，Peter O’Donnell提到S3被设计为具有持久性，意味着它能够可靠地存储数据并确保数据的长期可用性。这与加密和数据保护的主题密切相关。

💡同态加密

同态加密是一种允许在加密数据上进行计算的加密形式，而不需要解密密钥。Shai Halevi在视频中讨论了同态加密，举例说明了即使数据被加密，也可以在不解密的情况下处理数据，这对于保护隐私和增强云计算服务的安全性具有重要意义。

💡多方计算

多方计算是一种安全协议，允许多个参与方在不暴露各自输入的情况下共同计算某个函数。Tal Rabin在视频中提到了她的多方计算工作，强调了这种技术在保护数据隐私和促进安全协作方面的潜力。

💡阈值密码学

阈值密码学是一种技术，旨在通过将密钥分割成多个部分来消除单一故障点，从而增强安全性。Tal Rabin在视频中解释了阈值密码学的概念，并通过一个简单的例子说明了如何通过分割密钥来提高安全性，同时保持签名的外部简单性。

💡后量子密码学

后量子密码学是一类密码学技术，旨在抵抗量子计算机的攻击。在视频中，Tal Rabin讨论了后量子密码学的重要性，解释了量子计算机如何可能破坏基于传统假设的密码系统，并提到了NIST正在进行的后量子密码学算法竞赛。

💡硬件加速器

硬件加速器是一种专用硬件，用于提高特定类型计算的性能，如加密和解密操作。在视频中，讨论了硬件加速器在使加密计算更加实用和高效方面的作用，尤其是在提高同态加密等技术的性能方面。

💡IAM

IAM是AWS的Identity and Access Management服务，负责管理用户访问AWS资源的权限。在视频中，提到了IAM将引入阈值密码学来增强其系统的安全性，这表明了AWS对提高现有服务安全性的持续关注。

💡TLS 1.3

TLS 1.3是传输层安全性协议的最新版本，提供了比前一版本更强的安全性和更好的性能。Hugo在视频中提到了TLS 1.3，并强调了采用这个协议作为准备后量子密码学未来的一种方式，因为TLS 1.3包含了Hugo设计的SIGMA协议，用于密钥协商。

Highlights

亚马逊网络服务（AWS）的首席解决方案架构师Peter O'Donnell强调了数据保护的重要性，并介绍了密码学在其中的基础作用。

三位密码学家Hugo Krawczyk、Tal Rabin和Shai Halevi加入AWS，他们分别在HMAC算法、同态加密和多方计算阈值密码学方面有杰出贡献。

AWS致力于将先进的密码学技术应用到实践中，以提高客户的数据安全性和隐私保护。

介绍了加密计算的概念，即在不解密的情况下处理加密数据，例如同态加密和安全多方计算。

同态加密允许在数据加密状态下进行处理，无需解密密钥，为保护隐私提供了新的可能。

阈值密码学旨在消除与密钥相关的单点故障，通过分散存储密钥片段来增强安全性。

AWS正在探索将阈值密码学应用于IAM系统，以增强后端密钥的安全性。

安全多方计算允许多方在不泄露各自数据的情况下，共同计算某个函数的输出。

广告行业中的多党计算应用，可以在不共享数据的情况下，统计广告投放的效果。

硬件加速器在密码学计算中至关重要，有助于提高性能，降低部署成本。

AWS正在研究如何将同态加密技术应用于现有服务，如图片匹配服务，以增强数据的端到端加密。

后量子密码学（PQ）是AWS关注的一个重点领域，旨在为量子计算机可能带来的威胁做好准备。

NIST的后量子密码学竞赛旨在选择能够抵抗量子计算机攻击的加密和签名方案。

AWS提供了TLS 1.3和混合加密方案，以帮助客户准备后量子时代的安全需求。

客户反馈对于AWS的产品和服务开发至关重要，特别是密码学技术的实践应用。

AWS鼓励客户分享他们的需求和痛点，以便更好地整合密码学技术解决实际问题。

AWS Clean Room集成了密码学技术，提供了一个安全的环境，使客户能够在保护隐私的同时分析和共享数据。

AWS强调客户至上的理念，并将其作为产品和服务开发的指导原则。

Transcripts

Please welcome to the stage

Principal SA, Security, AWS, Peter O’Donnell.

[music playing]

Hi.

Really excited to have everybody here today.

Working with customers for my nine years here at Amazon Web Services,

I know very well that many of you, perhaps all of you,

are very interested in protecting your data.

And cryptography is at the basis of that for most of our customers,

providing cryptography not only at rest but in transit

but also to identify and assure software, connections to servers.

My name is Peter O’Donnell.

I’m a Principal Solutions Architect.

I’ve been here for nine years working with some of our largest

and most challenging customers.

And what I know is that when I’m in the room with you,

I’m the cryptography expert.

But the truth is, as a Solutions Architect,

I get to say we a lot.

We invented the Nitro System.

We have designed S3 to be durable.

But of course that was never my work.

So it is my great privilege and pleasure to bring to the stage

three cryptographers that have worked together

for decades on cutting-edge cryptographic research

that is finally now becoming a reality.

And we’re excited to bring this innovation to you

and talk to you a little bit about their research,

what can be done with it, what is being done with it,

and what someday will be done with it.

So, let me please introduce Hugo Krawczyk, Tal Rabin and Shai Halevi.

Hugo is a cryptographer best known for co-creating the HMAC algorithm.

Shai Halevi is a cryptographer

working on advanced cryptographic techniques,

including homomorphic encryption.

And Tal Rabin is best known for her work

with multi-party computation and threshold cryptography.

All of them have received commendations and awards

over the years and are members of all of the relevant bodies in the world.

These are three of our most premier cryptographers,

and they’ve come to Amazon Web Services as of last summer.

So let’s get into it.

Thank you all for being here.

Thank you for having us.

Thank you.

All right, so let’s start at a high level,

what brought you to Amazon Web Services?

The three of us have been together for a long time, for over 20 years.

We started our career together at IBM Research,

where we mostly did theoretical work with some applications

to more things that are being run in the internet,

Hugo has a lot of work on these things.

And from IBM Research, we decided to go on a little adventure together.

Our WhatsApp group in fact is called The Adventure.

And that adventure was to start a foundation

related to a cryptocurrency called Algorand.

And we were there for three years,

but at some point we decided that we want to do something different,

that we really want to take the advanced techniques

which we’ve worked on and developed for over 30 years and to take them

and to move them into practice, that people will actually use them.

And we thought a lot of what would be a great place in order to do it,

what would be a company that also it would have a lot of impact

due to the size of the company

but also that it would be a company that would be willing

and have the vision in order to apply these things.

And we decided about AWS.

AWS is very customer-oriented and focused, and that’s the goal.

And these techniques bring more security

and more privacy for customers.

So AWS seemed like a very great place to be.

And luckily for us, AWS thought the same thing.

So here we are.

That’s right.

So let’s talk a little bit more.

We know that security is our top priority here at Amazon.

Believe me, that is not a marketing slogan, that is how we operate.

Hugo, can you tell me a little bit

more about the vision for the future here?

What are the outcomes you’re looking for?

We are trying to bring state-of-the-art

cryptographic techniques,

those that have been invented in the last 30 years

and hopefully new ones that we and others will invent.

And the idea is to use these techniques to raise the bar

for security, for our customers,

both at the level of hardening the infrastructure

but also enabling new services

that these new techniques enable

and before were not possible.

Examples of such techniques

are what we call threshold cryptography,

that we may expand on it a little bit later,

secure multi-party computation, and what we call crypto computing,

you can think of it as a computing on encrypted data.

These are technology that enables new ways

for people to interact with the cloud

and maybe most importantly to collaborate with each other.

We bring this level of defense in depth

and also helping customers

to reach their requirements and responsibilities.

Traditional encryption, while being very good

for protecting data in storage or in transit,

is not good enough for these kind of applications,

so we need new techniques.

So the idea is to bring this stuff to our customers in AWS.

That’s awesome.

Shai, Hugo mentioned this idea of cryptographic computing,

computing over cryptographic data.

Tell us more about that.

Generally, cryptographic computing refers

to the ability of processing data without ever seeing it in the clear.

One example of that is homomorphic encryption,

where data is encrypted and being processed in encrypted form

without ever decrypting it,

without even having the decryption key.

Other forms of it are distributed computing,

where each participant in that computation

only sees bits that seems meaningless when you see them in their own

but among all of them they still can process the data.

This can be used, as Hugo was saying,

both to do private outsourcing of customer’s data to the cloud,

where the cloud can process it without seeing the data in the clear,

or private collaboration, where there are multiple customers

all want to pool their resources together,

have the cloud do the processing for them,

but they don’t trust each other or the cloud

seeing their data in the clear.

Some examples that you can think of are private queries to ML models.

The cloud may have a model, you may want to query that model,

well, you may not want the cloud to see what you’re querying for.

So you can do that processing in this way.

Other examples would be still in the realm of ML.

You want to do federated learning

where multiple parties there want to collaborate

on establishing the model or on developing the model but again,

each with their own data.

Again, these techniques are useful there.

And also, Tal, I know that a lot of your work

has been around threshold cryptography.

What is threshold cryptography?

Threshold cryptography is one of these advanced techniques.

The goal of threshold cryptography

is to eliminate single points of failures in relation to keys.

For example, if you have a signature scheme,

you have a secret key which signs messages.

And this key is very, very important.

But if you store it on a single server,

even if you secure that server,

there would be a mistake that an operator does

when they come to serve the server.

And by mistake they do a memory dump.

Now your key is in the clear.

And this is what we refer to when we say a single point of failure.

Threshold cryptography techniques come to eliminate this vulnerability.

And how do they do it?

Let’s say, just an example,

that you’re signing key is the number 11.

If you store it on the server, the number 11 is there.

But, since we said we wanted to eliminate this point of failure,

we will take the number 11

and we’ll split it randomly into two numbers, seven and four.

Seven and four equal 11.

But these are random numbers.

And we’ll put seven on one server

and we’ll put the four on another server.

Now you can see immediately

that I’ve eliminated the single point of failure.

Because if there is a memory dump,

say on the server that has the number four, nothing has happened.

This four has no connection to the number 11.

Somebody who sees that value still does not know

what the signing key is.

But we’ve introduced a problem.

Now we have a seven and we have a four.

How do we sign?

The purpose of this scheme was to sign.

In fact, threshold crypto also offers

the mechanism to sign from these distributed pieces.

From the seven and from the four,

each server acting on their own may be communicating somewhat.

It can generate the signature.

Now, the interesting thing is that we’ve raised the bar on security,

yet for an outsider, the signature looks exactly the same.

They don’t know what happened on the back end.

So we really are offering something that improves the security

for anybody who uses these systems,

while preserving the external simplicity of the signature

and not interrupting it.

Such a scheme, as you say,

not only would reduce the single point of failure

were there to be a compromise of one of these instances

but also there’s an availability angle to this as well, right?

A hundred percent.

I gave a very simple example

because I wanted to be able to speak about it here.

But the schemes in fact are more sophisticated.

You can take, we call this splitting of the key, splitting it into shares.

We can split these shares in a sophisticated manner.

Maybe you want two out of three pieces to create the signature.

You split it into three pieces, and any two can create the signature.

You can set the parameters whichever way you want it.

But I’m going with-

You could scale it to a large number of servers.

Whatever you want, whatever suits your system.

But let’s say we do two out of three, it does increase availability also.

Because even if one of the shares is lost, we can recover.

But also, let’s say we did two out of five.

Any two could sign in parallel.

That also increases availability in that way as well.

It’s a very versatile technique which can offer a lot of amazing features.

And of course it depends on the application of what you need.

So not just, say, disaster recovery but disaster tolerance in some way.

A hundred percent.

That’s awesome.

So we know that this idea of crypto computing over a large body of data,

but there’s also some theoretical background to this, is that right,

Hugo, this idea of proof that you can actually know

that the system is working correctly?

Yes, designing a cryptographic schemes,

systems, protocols, is not easy.

Or what I always say, it’s not very hard

but it’s much easier to design it wrong.

When do we know that actually what we design is secure?

In cryptography, there are no simulations or tests

that you can do for the security.

Actually, it’s only theoretical tools that we have.

We refer to them usually as proofs.

We proof mathematically that the system is secure,

usually in cryptography under some assumptions.

And there are ways of doing proofs by hand,

as have been done for hundreds of years,

but these days we also have automated proofs,

having machines that help us reason about these systems.

A cryptographic system that has not been proven

in most cases is an insecure system.

That’s right.

Thinking about our long-term view,

Amazon is a place for long-term thinking and long-term ownership,

tell us more about what you’re working on

right now to benefit our customers.

Should I speak? Sure.

Okay.

This mechanism of threshold cryptography,

we decided to look at various Amazon systems.

And one of the first systems that we looked at is IAM,

which is identity access management.

We looked at the back end, which holds the keys

used for authentication of all our customers.

If you’re our customers, you are using this system,

and it’s providing you assurance.

A billion requests per second IAM, every day,

doing trillions of authenticated requests.

The question is, what could we do, of course.

Amazon has an eye on security

and the systems are secure as they are,

but we wanted to offer defense in depth,

to try and find how we harden the system.

Because attackers are becoming more sophisticated,

more things can happen,

we want to really have more than one layer of security.

So we approached IAM,

and in fact they will be introducing

this threshold cryptography into their system.

They’re going to start building it soon

and hopefully it’ll be available.

And of course, again, as I said about threshold crypto, you as customers,

you won’t even know that we have done this on your behalf

and that the system really is more secure.

For you, everything is going to stay the same,

the speed, the availability, and so on.

But the system will in fact, the security will have been hardened.

And I want to say one more thing.

We’re new, we just came, and we approached these people,

but you could see the philosophy in AWS,

the enthusiasm with which this group

received what we were saying.

And the interest in doing it were really, in fact, for us,

quite amazing that it was so accepted and which was wonderful to see.

That’s cool to hear.

AWS IAM, obviously one of our oldest services,

today operating at a bonkers scale.

We’ve invested a lot in this service over time.

Doctor Neha Rungta is giving a talk either later today

or tomorrow about our innovations

in proving the correctness of this system.

And so I always want to emphasize to customers,

even the old stuff, right?

Obviously, we’re creating new services every day,

really a lot of innovation there,

but the level of innovation and investment in the old stuff,

the things that will never change,

is certainly one of our main focuses here at Amazon.

Speaking about research, Hugo,

I know we’d kind of talked about an application in the contemporary area,

I know that advertisement is a critical area

where multi-party computation comes to bear.

Is that right? Yes, yes.

First, this notion of secure multi-party computation

is a type of solutions or protocols

that allow a set of parties to compute in

a collaborative way some function, and I’ll give some examples,

in a way that everyone brings their own input, their own data,

but the only thing that is learned is the output of the function.

No one learns anything about the input

except for what can be derived from the output of the function.

The idea is similar to think that if you have a trusted third party

where everyone gives their inputs

and that trusted third party computes the function

and gives out the output.

But now you don’t have that trusted party,

so you run this secure multi-party computation to achieve

that form of functionality without the trusted party.

One example, also something that we have been working in the last year,

is in the area of advertisement.

In advertisement, people run campaigns

and then they have to measure the success of these campaigns.

People have used for a long time third-party cookies,

for example, for doing that at the level of web browser,

but now it’s being discontinued.

And the advertisers need to check with different publishers

and publishers

don’t want to give all the information that they have,

and the advertisers also don’t want to give all their data.

You want to build a protocol that all the providers bring the data

and at the end you learn some statistics.

In particular, we were working on the problem

of computing two statistical functions,

frequency rich is how many users have seen an ad and frequency

is how many of them saw one time the ad, two times, three times, etc.

We are building this together with the world federation of advertisers,

which Amazon is part of it.

It’s a project with different companies.

But we built a multi-party solution for that problem

that is being implemented.

That’s an interesting angle there where,

we are going to talk about some future stuff, it’s genuinely spooky,

but this is an example of a system that’s been in place for a long time

but prevailing culture and even some pressure from stakeholders

that it really needs to become more private

and that these techniques and this advanced research

allows an existing computing capability to raise the bar

not only on security but privacy.

Shai, tell us about this idea of homomorphic encryption?

What is homomorphic and why does that improve the overall privacy angle

for things like storing sensitive data in a database?

Homomorphic encryption is a somewhat new player

in this secure computation game.

Homomorphic encryption is a specific type of encryption

that allows you to process data in an encrypted form,

as I said before, without even having the decryption key.

We speculated on the ability to do that for many years,

but the first example of encryption scheme

that actually enable that are only 15 years old.

So it’s a relatively new technology,

but it is coming into maturity these days.

We expect to have hardware acceleration

for homomorphic encryption coming up within the next year or so.

In AWS, we’re trying to see where

we can provide this technology

to our customers to improve their security posture,

to improve their privacy posture.

Right now, the thing that we’re doing internally

is a relatively large-scale study of capability together

with many industry partners, for example,

the producers of these future accelerators or parties

that have their own technology.

And we’re running studies to assess this technology

and see what we can do with them.

But again, it’s a 15-year-old technology.

Imagine inventing the transistor 15 years ago

and trying to come up with an idea of what it can do today.

This is where we are right now.

A few things that I believe are possible or will be possible soon,

checking if two pictures are pictures of the same person

when these pictures are encrypted.

Or, as I said, doing private queries to certain machine learning models.

Other things that you can do, private set intersection.

Hugo talked about advertisers.

The advertiser has a list, or the publisher has a list,

they want to see if anybody that visited this publisher site

actually bought something on the advertiser.

So each of them have a list,

they want to know who is in both lists

without revealing the list to each other.

Private information retrieval, I have a key value store,

I want to fetch a value by key

without the store being told what the key was,

these kinds of things.

Those are all possible with today’s technology,

and we’re expecting a lot more things to be possible

once these accelerators come.

We’re currently in the process of trying to see

what the technology can do and trying to take existing workloads

that AWS currently has, for example,

this picture matching service that we already have,

and enable it on encrypted data

so that the customer doesn’t need to do much.

All you need is to check the box saying,

“Well, I want this data to remain encrypted end to end”

and then the process will be run on encrypted data

instead of the plain text data.

And this idea of a one-click adoption,

of course it’s really important to our customers,

and it’s also really important for how we design services.

Make it easier to do the right thing and harder to do the wrong thing.

Now, I want to quickly come back to this idea of hardware acceleration.

I’m old enough to remember putting SSL accelerator cards

in my web servers 20 years ago.

Because some of this, most of this cryptography,

is predicated on hard problems that involve a lot of math.

Can you say more about the role of a hardware accelerator

in enabling adoption without compromising performance or latency?

One problem with cryptography computing,

as with any other technology, it has a real cost.

The hardware accelerator is crucial in making that cost tolerable

so that customers can deploy these workloads with the added security

or maybe deploy new workloads that were impossible before

because of security or privacy concerns

without having to pay too much.

It’s crucial, and in addition to the cryptographic techniques

that we bring there is of course

always the system engineering part of it.

Because once you have the accelerator,

well, you need to route these workloads to these hosts

that actually have the accelerator.

So there are a lot of work in front of us, but we’re getting there.

And I’m sort of optimistic that we will have news for you

within the next few years about that.

That’s awesome.

Hugo, I know you’ve also been involved in some other cryptographic

designs for other systems here at Amazon.

Tell us about the constellation.

We have been doing also work on the more traditional cryptography,

bringing our knowledge and expertise to share with Amazon teams.

We’ve been involved with problems

related to key agreement,

key management, even password protocols.

One example is a design of key agreement

for the Kuiper satellite project.

Another thing is doing end-to-end security,

where customers can back up their keys with AWS

and still keep full ownership of these keys.

And some other things, hopefully things that we will be able

to talk more in future re:Inforce meetings.

Yeah, we are doing the more advanced stuff

but not forgetting also the core basis of [INDISCERNIBLE].

And of course, if you’re a bunch of crypto nerds, as I assume you are,

my people, obviously top of mind for a lot of folks

these days is post-quantum cryptography.

What does it mean that in a possible future

that a sufficiently powerful quantum computer could come to existence,

it means that some of the hard problems,

this idea of the assumptions on which classical cryptography is predicated,

maybe stop being hard problems.

Tal, tell us about where we are with PQ?

First of all, as you said, all our cryptography is based on assumptions.

Except for a one-time pad, we don’t have a single system

where there isn’t an underlying assumption.

And if this underlying assumption is broken, then the system is broken.

For example, RSA, if we figure out how to factor numbers

on a classical machine, RSA will be broken.

So we still don’t know how to factor on the classical machine.

But we do know how to factor on a quantum computer.

Now, just so you don’t run out of here immediately and say,

“Okay, it’s broken,”

in order to break a 1024-bit RSA modulus,

which is the product of the two primes,

you need a minimum of 1024 good qubits.

Most likely you need even ten times more than that.

And currently we are not there.

I don’t want to say when we will there because I don’t know.

But there are experts that range from ten years to never.

It could be anywhere in that range.

So, given that we know that

if a quantum computer exists

RSA will be broken, what do we do?

NIST was very proactive and saw this coming

and put a competition in place for which people

designed post-quantum encryption signature schemes.

There was a competition to decide which one is the best.

What does it mean that it’s post-quantum?

It’s based on different assumptions.

It can’t be based on factoring, of course, it has to be based

on what we call some lattice assumptions.

And this competition ran for quite a few years,

and candidates were chosen about a year ago,

maybe, a little bit more.

And these are the protocols

which NSA is requiring to use,

and they have some time timeline of when to deploy them.

I want to say something, I said systems for signatures

and for encryption.

Signature and encryption are not the same

as they relate to post-quantum.

And why?

If you encrypt something today with a class,

old assumptions, factoring or discrete log,

somebody might harvest your encryption from today,

and later on when the quantum computer is available

they would be able to decrypt your message.

I don’t know, I’m not important,

my messages probably are not being harvested,

though if they would be people would be very interested at the end.

But of course, big secrets that need to last for a long time

might be harvested.

Signatures, however, are not the same.

Signatures, even if you harvest the signature

now it doesn’t help you much that you’ll be able to break it later.

So there’s a difference between encryption and signatures

when it comes to when you should be deploying post-quantum.

That’s interesting, and we of course have been investing in PQ

for a very long time here at Amazon Web Services.

Today, we have a hybrid scheme available on the TLS

endpoints for KMS, Secrets Manager, and our file transfer products.

This is important to understand the word hybrid.

Because these are new algorithms, it would be terrible

if these new algorithms introduced a classical vulnerability.

So what we have today are hybrid schemes

that use a mix of classical cryptography

and post-quantum cryptography that you can experiment with today.

Are they suitable for prod?

Conceivably.

Are they worth the latency trade off?

Maybe not today because you likely

don’t have that store and harvest threat model.

And if you do, you’ve probably got a lot

of defense and depth around that anyway.

But you can search online, find our post-quantum website,

and stay up to date with everything we’re doing.

It’s a lot of really fascinating research.

Hugo, can you tell us a little bit more about the store

and harvest thing in the context of maybe the life cycle of the data?

You could imagine that encrypting a quarterly earnings report,

the durability of that cryptography has a timeline to it.

So if you could break it in six months

but it’s only secret for three months,

well, then maybe that’s not a big deal.

But you could imagine longer-term data

sets like health data that need to be safe forever.

Yes, it’s a very important point here about the post-quantum to understand

that the encrypted data is not in danger today.

We are talking about that it may be in danger in X years,

and as Tal said, people have different guesses for what X is

and how many years until we have a very powerful quantum computer

to actually break cryptography.

The data that is in danger is the data that is very sensitive

for long term

and such that the adversary is willing to harvest now.

Because in order to break it in 30 years,

you will need a ciphertext that was created now.

Only data of that high sensitivity will probably be targeted.

There is definitely a set of data that is important to protect already.

What I always like to remind ourselves

is that there are many other things that may be more risky for data

if you don’t manage the security well enough.

For example, there are voices in the industry

that want to eliminate or at least have the option

of eliminating forward security from TLS 1.3.

Forward security is an element

that provides a very, very high level of security.

So the point is that you need to follow the best practices

even with traditional cryptography not only with post-quantum.

You mentioned TLS 1.3, which is interesting,

and if I can embarrass Hugo for a second,

your SIGMA protocol is at the heart of key agreement in TLS 1.3.

But TLS 1.3, a lot of customers, I get the question a lot,

“What do I need to do about PQ? What do I do?”

The simplest answer is adopt 1.3.

When NIST finally finalizes these standards,

they’re not going to come to 1.2.

The simplest, shortest answer I can give customers

about preparing for a PQ future is adopt 1.3.

Let me make that clear.

We’ve talked a lot about our innovations

and this incredible research from my colleagues here for the long term.

But we need your help.

Almost everything we’ve built here at Amazon Web Services,

easily nine in ten, we’ve built because customers asked for it.

That’s true for Elastic Transcoder a decade ago

to things like SageMaker and Bedrock today.

Customers asked us to solve some hard problems.

Shai, tell our customers how they can help us help them.

The short answer is come tell us where it hurts.

This is a very good time to have an impact

on where do these techniques come in, what kind of problems comes you,

the customers, or maybe your customers,

encounter that makes it hurt to bring data to the cloud?

Because most likely there are cryptographic techniques

that allow you to mitigate these pain points

and do it with a reasonable price.

But as we said, we are new to AWS,

and this entire idea of crypto computing is maybe ten years old.

It’s still getting in the process of making it to mainstream computing.

So we really, really need your input on where these things have impact.

In the examples of homomorphic encryption,

what workloads do you really want to run on encrypted data?

In the context of federated learning,

where are the places where it really hurts to join the data

in order to do the learning?

All of these things, we really need your input on it.

There’s one thing that I want to say about something that already exists.

Tomorrow, there is a session in the developer session,

BAT251 if I remember correctly,

where there is one example

that already is integrated into Amazon Clean Room.

So if you want to go to that session, you’ll hear about it.

These are things that slowly start to appear in production.

But now it really is crucial for us to understand what do customers want.

When are these techniques just good to have?

When are these techniques a necessity in order

to be able to process things in the cloud?

So please find us outside here in the halls,

or if you’re watching it online, through your AWS representative.

Find us, give us feedback.

This is the time to really make an impact

on where these techniques are used.

That’s right, at Amazon we use this very particular phrase,

customer obsession.

Tal at the beginning talked about why they came here.

It’s because this is a place where we can build for our customers

and on behalf of our customers.

I want to add, in addition to the fully homomorphic, as Hugo described,

there are also techniques that are multi-party

that maybe you don’t want just to be processing on the cloud

but you need to collaborate with other organizations.

For example, maybe you’re a health organization

and you need to share data with another health organization

and you’re prohibited by HIPAA

but you still want to do some processing on the data.

These things, the multi-party computation techniques,

also help with that.

Of course, also the level of threshold cryptography,

which we said hardens the security,

gives you another layer of defense for your most sensitive keys.

We can help with those techniques as well.

That’s awesome.

At Amazon we use this phrase, day one.

We’re still just getting started.

So this feedback that we need from our customers to influence

the research and the product development,

it’s foundational to what we do here.

With that, really want to thank everybody for their time today.

We’re going to wrap up here.

Folks on the live stream, we’re going to transition to some

Q&A in the room.

But I really want to thank our panelists here.

Thank you so much, let’s do some Q&A.

[music playing]