When using Homomorphic Encryption you need to compile your application to a circuit. This means that for branches you need to evaluate both sides and multiply by a bit (like a multiplexor). This way you preserve privacy at the price of heavy computation on the server side.
This means that for branches you need to evaluate both sides
Not true in general, since you can reuse the multiplexor multiple times during the evaluation, to produce essentially a circuit-wise least-common-multiple of the two sides of the branch. Eg, if one side performs two multiplications, and the other a multiplication and a division, you only need to evaluate a division and two multiplications, not a division and three multiplications. So "evaluate both sides" is a worst-case upper bound on the amount of computation.
Comments
When using Homomorphic Encryption you need to compile your application to a circuit. This means that for branches you need to evaluate both sides and multiply by a bit (like a multiplexor). This way you preserve privacy at the price of heavy computation on the server side.
+1, and some compilers already exist to do that for you. See, e.g., Google's compiler (which I work on). https://github.com/google/fully-homomorphic-encryption
Not true in general, since you can reuse the multiplexor multiple times during the evaluation, to produce essentially a circuit-wise least-common-multiple of the two sides of the branch. Eg, if one side performs two multiplications, and the other a multiplication and a division, you only need to evaluate a division and two multiplications, not a division and three multiplications. So "evaluate both sides" is a worst-case upper bound on the amount of computation.
Loops are still a pain in the ass, though.