Practical multivariate quadratic FHE – how does it compare to other FHEs? Came across this startup claiming practical FHE and then their blog post going into some additional details on it.

It was my understanding that practical FHE is still years/decades off. They said back in September 2015 that they would publish the details of their FHE cipher which they call “KFHE”, but it appears that the details still have not been released (as of June 2016). They have released the source code for their KFHE implementation, however. From it, it appears they are using multivariate quadratic FHE. 

What is multivariate quadratic FHE and what is unique about this FHE compared to previous attempts? How does this hardness assumption compare to others that have been previously used in building FHE?
I've spoken to the CEO a couple times. They've contracted some prominent French cryptographers to vet their cryptosystem, but no security analysis or whitepaper has been released. 

Their KFHE scheme is different than previous schemes because it uses a different hardness assumption that leads to better performance and smaller keys. Previous FHE schemes used hardness assumptions based on ideal lattices, but their scheme uses a different assumption based on the hardness of solving a system of quadratic equations in many variables. Whether their construction truly is a practical general-purpose FHE scheme is not clear, since perf numbers for general circuits are not available (as far as I know).

Schemes based on solving systems of multivariate quadratic equations have some nice properties, including the aforementioned performance benefits as well as conjectured resistance to quantum attacks, but have proven extremely difficult to get right. Many schemes based on these assumptions have been severely broken. However, there exist cryptosystems from this family that are widely believed to be secure.

The homomorphic properties of their scheme are used to build a kind of multi-user searchable encryption in their main product, Kodex. A user allows other users to search on their documents by homomorphically sharing document search keys. I don't know all the details, but my guess is this specific 'share' operation can be done efficiently because they avoid evaluating a circuit and just do stuff directly.

As with all shiny new things in cryptography, caution is called for. Editorializing a bit, I see little reason to believe this is snake oil. [Indeed, if they were only looking for a rubber stamp from Faugere and Perret it seems like something would have been made public already.] However, perfectly honest and forthright people have built many, many broken cryptosystems, so I recommend taking any claims with a moderately-sized grain of salt until given reason to do otherwise.