Intro to Privacy-Enhancing Technologies (PETs)

Intro to Privacy-Enhancing Technologies (PETs)

Speaker: Harshal Shah

Conference: BSidesSF 2025 — April 26-27, 2025, San Francisco

YouTube: https://www.youtube.com/watch?v=DdodFE2hi2k

Reading time: ~7 minutes

TL;DR

Harshal Shah, a senior software engineer, delivered a practical primer on Privacy-Enhancing Technologies (PETs) — a family of cryptographic techniques including Fully Homomorphic Encryption (FHE) and Secure Multi-Party Computation (MPC) that allow computation on data without ever exposing the underlying plaintext. These technologies, once considered purely academic, are already deployed by Apple, Google, Microsoft, and others, and are increasingly relevant to organizations navigating data collaboration under regulatory constraints like GDPR.

Introduction

"Data is the new oil" has been a tech industry cliché for years, but the friction points around actually using that data — especially when it requires sharing across organizational or jurisdictional boundaries — remain largely unsolved. Regulations like GDPR restrict cross-border data transfers. Competing companies can't share training data. Healthcare providers can't collaborate on patient records. In each case, the traditional answer has been either to not share the data or to accept the privacy risk of sharing it in plaintext.

Privacy-Enhancing Technologies offer a third path: compute on the data without ever seeing it. At BSidesSF 2025, Harshal Shah walked the audience through what PETs actually are, how they work at an intuitive level, and where they are already being deployed in production. The talk came with a useful corrective to a widespread misconception: despite their origins in academic cryptography papers from the 1980s, PETs are not purely theoretical. They are in your phone, your browser, and your cloud provider's infrastructure right now.

The Problem PETs Solve: Collaboration Without Trust

▶ Watch: Why PETs Exist (03:10)

Shah began by framing the core threat model. When two or more parties want to compute something together, several failure modes exist: one party might try to learn more information than they're entitled to ("semi-honest" adversaries), one might deviate from the protocol entirely and send garbage values, or a subset of parties might collude to take over the computation. These aren't theoretical threats — they're precisely the concerns that prompted a U.S. executive order in 2023 calling explicitly for the development and deployment of privacy-enhancing technologies.

To illustrate why this matters, Shah used an election analogy. Suppose 18 voters want to determine which of two candidates received more than half the votes, but there is no trusted election officer to collect and tally ballots privately. The naive approach — having everyone share their votes with a central party — requires trusting that party completely. The PET approach: encrypt the votes using a special encryption scheme that preserves additive properties, have each voter submit their encrypted ballot to a shared tally, add the encrypted values together, and decrypt only the final sum. No individual vote is ever revealed; the only output is whether the sum crosses the threshold.

This example previews a key mathematical property at the heart of two major PET categories: the ability to perform meaningful computation on encrypted data without decrypting it.

Fully Homomorphic Encryption: Computing on Ciphertext

▶ Watch: FHE Explained (11:25)

Fully Homomorphic Encryption (FHE) is an encryption scheme that supports arbitrary computation on ciphertext — not just additions, but multiplications, subtractions, divisions, and ultimately any function that can be decomposed into those primitives. The core use case Shah highlighted: a client with sensitive data wants to offload computation to a third-party server without revealing the input.

The classic example is oblivious database lookup. An advertiser wants to know how much a specific customer spent at a retailer. The trivial approaches both fail on privacy grounds: sending the customer ID in plaintext tells the retailer who the advertiser is querying, while sending the entire database to the advertiser leaks all customer records. With FHE, the advertiser encrypts the customer ID, sends the ciphertext to the retailer, the retailer performs a lookup computation on its own database using the encrypted query, and returns an encrypted result. The advertiser decrypts the result and learns only the spend amount. The retailer never learns what was queried; the advertiser never sees the full database.

Shah addressed the obvious objection: production AI workloads are not just additions and multiplications. Neural network inference involves nonlinear activation functions, large matrix operations, and enormous parameter counts. His response: any computable function can in principle be transformed into circuits of additions and multiplications. The transformation is not free — it adds computational overhead — but the gap is narrowing fast. "From the past couple of years, we've seen at least 2x or 3x performance boosts," Shah noted. Hardware-specific acceleration is emerging, with companies designing chipsets optimized for FHE operations. Training large language models under FHE is not feasible today, but inference under FHE is increasingly practical.

Real-world deployments Shah cited: Google and Microsoft use FHE for password breach checking — verifying whether a user's password appears in a known breach dataset without revealing the password to the service or the breach database to the user. Apple deployed a privacy-preserving caller ID lookup using homomorphic encryption. IBM has production FHE use cases as well.

Secure Multi-Party Computation: Distributing the Secret

▶ Watch: MPC and Secret Sharing (19:50)

Where FHE offloads computation to a single (untrusted) server, Secure Multi-Party Computation (MPC) distributes computation across multiple parties such that no single party learns any other party's input. The foundational primitive is secret sharing: a secret value is split into multiple "shares" that individually reveal nothing about the original value. Only a threshold number of shares, recombined, can reconstruct the secret.

Shah illustrated this with a two-party addition example: Party A has input X, Party B has input 3, and both want to compute the sum without revealing their inputs. Each party secret-shares their value and exchanges shares. Addition is a cheap local operation in MPC; multiplication requires a round of communication between parties. The output is a secret-shared encoding of 8, which can then be reconstructed by either party, just one party, or neither — depending on what the protocol requires.

The scheme generalizes to T-of-N secret sharing: any T out of N parties can reconstruct the secret, making the system resilient to the unavailability or compromise of individual nodes. This availability property turns out to be practically important for one of Shah's most concrete use cases: cryptocurrency custody wallets.

A standard wallet stores a private key on a single device — a notorious single point of failure. With MPC-based key custody, the private key is never stored whole anywhere; it is split into shares distributed across multiple servers or wallet providers (one of which may be the user's own device). When a signature is needed, the parties run a threshold signature protocol that generates the signature without ever reconstructing the full key. If one server is hacked or goes offline, the key is neither compromised nor inaccessible — the remaining T parties can still produce valid signatures. Companies including Zengo have deployed this architecture since at least 2018.

MPC is also being applied to synthetic data generation (enabling joint training on combined datasets across organizations that cannot share raw data under GDPR), and to secure model inference (where the model weights are secret-shared across multiple servers so that even the inference provider cannot extract the proprietary model).

Choosing Between FHE and MPC

▶ Watch: Q&A — When to Use MPC vs. FHE (34:00)

An audience question prompted a crisp practical heuristic from Shah. FHE is the right tool when the client cannot or does not want to be interactive during computation — it can offload work to a server and decrypt results later. MPC is the right tool when the parties are willing to exchange a few rounds of messages and want to stay in the loop during computation. "Think about FHE for latency, think about MPC for interaction," Shah summarized.

For organizations unsure where to start: Shah noted that industry adoption has followed the pattern of FHE first, with Apple, Google, Microsoft, and IBM all having production FHE deployments. MPC adoption is growing but somewhat slower. His advice — echoed by the Q&A discussion — was to think of PETs not as a replacement for plaintext computation when plaintext is acceptable, but as the only option when sharing plaintext is legally or competitively prohibited. "The comparison is either you don't get anything, or you use PET solutions to do something."

One audience member raised the concern of "privacy washing" — companies deploying PETs while still acting against user interests. Shah acknowledged the risk is real: PETs can be used to analyze data in ways users would not consent to if they understood what was happening. He argued that consent frameworks remain essential and that PETs cannot substitute for meaningful user agency.

Notable Quotes

"Privacy-enhancing technologies are not new. The genesis of them started in the 1980s. One of the popular misconceptions is that they are purely academic and have never seen the light of day — but this is in fact not true."

— Harshal Shah, ▶ 05:45

"Think about FHE for latency; think about MPC. Any application can be broken down or transformed into trivial operations — additions, subtractions, multiplications — and that's why FHE can work in practice."

— Harshal Shah, ▶ 16:30

"The comparison is not PETs versus non-PET scenarios in a vacuum. If there is an option where you can do things in plaintext, go for it — it would definitely be 10 times faster. But the real comparison is: what if you can't? What if there are geographical restrictions, regulations where you can't get that data? Then the comparison is either you don't get anything, or you use PET solutions."

— Harshal Shah, ▶ 35:20

Key Takeaways

• PETs are in production today. Apple uses homomorphic encryption for caller ID lookup. Google and Microsoft use FHE for password breach checking. Zengo deployed MPC-based wallet custody in 2018. The "purely academic" characterization is outdated.

• FHE enables computation on encrypted data without decryption. Its primary use case is offloading computation to an untrusted server when the client cannot or does not want to remain interactive. Additions and subtractions are cheap; multiplications are more expensive but improving rapidly with hardware acceleration.

• MPC distributes computation across multiple parties using secret sharing, so no individual party ever holds the complete secret. It is the right choice for collaborative computation where all parties need to participate, and it enables T-of-N threshold schemes that improve both security and availability.

• MPC-based key custody eliminates the single point of failure in cryptocurrency wallets by splitting private keys into shares that never need to be recombined — signatures are generated directly from the shares via threshold signature protocols.

• The FHE vs. MPC choice maps roughly to latency tolerance vs. interactivity: FHE for asynchronous offloading, MPC for interactive multi-party workflows.

• Consent matters even with PETs. Privacy-enhancing technologies prevent one party from learning another's raw data, but they do not prevent parties from using computations in ways users have not consented to. PETs are a tool, not a policy.