Functional encryption
 | |
| General | |
|---|---|
| Designers | Amit Sahai, Brent Waters, Dan Boneh, Shafi Goldwasser, Yael Kalai |
| Derived from | Public-key encryption |
| Related to | Homomorphic encryption |
Functional encryption (FE) is a generalization of public-key encryption in which possessing a secret key allows one to learn a function of what the ciphertext is encrypting.
Formal definition
More precisely, a functional encryption scheme for a given functionality [math]\displaystyle{ f }[/math] consists of the following four algorithms:
- [math]\displaystyle{ (\text{pk}, \text{msk}) \leftarrow \textsf{Setup}(1^\lambda) }[/math]: creates a public key [math]\displaystyle{ \text{pk} }[/math] and a master secret key [math]\displaystyle{ \text{msk} }[/math].
- [math]\displaystyle{ \text{sk} \leftarrow \textsf{Keygen}(\text{msk}, f) }[/math]: uses the master secret key to generate a new secret key [math]\displaystyle{ \text{sk} }[/math] for the function [math]\displaystyle{ f }[/math].
- [math]\displaystyle{ c \leftarrow \textsf{Enc}(\text{pk}, x) }[/math]: uses the public key to encrypt a message [math]\displaystyle{ x }[/math].
- [math]\displaystyle{ y \leftarrow \textsf{Dec}(\text{sk}, c) }[/math]: uses secret key to calculate [math]\displaystyle{ y = f(x) }[/math] where [math]\displaystyle{ x }[/math] is the value that [math]\displaystyle{ c }[/math] encrypts.
The security of FE requires that any information an adversary learns from an encryption of [math]\displaystyle{ x }[/math] is revealed by [math]\displaystyle{ f(x) }[/math]. Formally, this is defined by simulation.[1]
Applications
Functional encryption generalizes several existing primitives including Identity-based encryption (IBE) and attribute-based encryption (ABE). In the IBE case, define [math]\displaystyle{ F(k,x) }[/math] to be equal to [math]\displaystyle{ x }[/math] when [math]\displaystyle{ k }[/math] corresponds to an identity that is allowed to decrypt, and [math]\displaystyle{ \perp }[/math] otherwise. Similarly, in the ABE case, define [math]\displaystyle{ F(k, x) = x }[/math] when [math]\displaystyle{ k }[/math] encodes attributes with permission to decrypt and [math]\displaystyle{ \perp }[/math] otherwise.
History
Functional encryption was proposed by Amit Sahai and Brent Waters in 2005[2] and formalized by Dan Boneh, Amit Sahai and Brent Waters in 2010.[3] Until recently, however, most instantiations of Functional Encryption supported only limited function classes such as boolean formulae. In 2012, several researchers developed Functional Encryption schemes that support arbitrary functions.[1][4][5][6]
References
- ↑ 1.0 1.1 Goldwasser, Shafi; Kalai, Yael; Ada Popa, Raluca; Vaikuntanathan, Vinod; Zeldovich, Nickolai (2013) (in en). Reusable garbled circuits and succinct functional encryption - Stoc 13 Proceedings of the 2013 ACM Symposium on Theory of Computing. New York, NY, USA: ACM. pp. 555–564. ISBN 978-1-4503-2029-0. https://books.google.com/books?id=w-39uAEACAAJ&pg=PA555.
- ↑ Amit Sahai; Brent Waters (2005). "Advances in Cryptology". in Ronald Cramer (in en). EUROCRYPT 2005: 24th Annual International Conference on the Theory and Applications of Cryptographic Techniques, Proceedings. Springer. pp. 457–473. ISBN 978-3-540-25910-7. https://books.google.com/books?id=HrCI4ZyuZL0C.
- ↑ Boneh, Dan; Amit Sahai; Brent Waters (2011). "Functional Encryption: Definitions and Challenges". Proceedings of Theory of Cryptography Conference (TCC) 2011. http://eprint.iacr.org/2010/543.pdf.
- ↑ Gorbunov, Sergey; Hoeteck Wee; Vinod Vaikuntanathan (2013). "Attribute-Based Encryption for Circuits". Proceedings of STOC.
- ↑ Sahai, Amit; Brent Waters (2012). "Attribute-Based Encryption for Circuits from Multilinear Maps". http://eprint.iacr.org/2012/592.pdf.
- ↑ Goldwasser, Shafi; Yael Kalai; Raluca Ada Popa; Vinod Vaikuntanathan; Nickolai Zeldovich (2013). "Advances in Cryptology – CRYPTO 2013". 8043. 536–553. doi:10.1007/978-3-642-40084-1_30. ISBN 978-3-642-40083-4.
 |  |
