Functional Encryption

Unlike traditional public-key encryption where possession of a secret key reveals the entire plaintext, FE issues function-specific secret keys. Each key SK_f is associated with a function f. When applied to a ciphertext encrypting message x, decryption outputs f(x) and nothing else about x.

• Example: A key might reveal only whether an encrypted transaction amount exceeds $10,000, without disclosing the exact amount, sender, or recipient.
• Mechanism: The key generation authority uses the master secret key to derive SK_f, embedding the function's logic directly into the cryptographic key material.

An extension of FE where a function key can compute over multiple independently encrypted data sources. A decryptor holding SK_f can evaluate f(x1, x2, ..., xn) from n separate ciphertexts without any party revealing their private input.

• Fraud Analytics Application: Multiple banks can encrypt their transaction ledgers. An auditor with a single function key computes the aggregate number of suspicious transactions across all banks without seeing any individual bank's raw ledger.
• Core Property: Inputs remain encrypted under different public keys, yet the function evaluation spans all of them jointly.

Functional Encryption is deeply connected to the cryptographic holy grail of indistinguishability obfuscation (iO). In fact, a construction for general-purpose FE implies the existence of iO and vice versa.

• Theoretical Foundation: General FE for all polynomial-sized circuits was proven possible using iO and other standard assumptions, though practical constructions remain an active research area.
• Practical FE: Current efficient schemes are limited to specific function families, such as inner-product predicates or quadratic polynomials, which are sufficient for many privacy-preserving analytics tasks.

Attribute-Based Encryption (ABE) is a special case of Functional Encryption where the function f is a boolean predicate that evaluates an access policy against a set of attributes.

• Ciphertext-Policy ABE: The ciphertext embeds the access policy (e.g., 'Fraud Department AND Level 4 Clearance'). A user's key is associated with their attributes. Decryption succeeds only if the attributes satisfy the policy.
• Key-Policy ABE: The key embeds the policy, and the ciphertext carries descriptive attributes. This maps directly to FE where f_policy(attributes) returns the plaintext if the policy is satisfied, or null otherwise.

A critical security property of FE is collusion resistance. Multiple users holding different function keys (SK_f1, SK_f2) cannot combine their keys to learn more than the union of their individual function outputs.

• Attack Scenario: Without collusion resistance, a user with a key for 'average transaction value' and another with a key for 'transaction count' could collude to recover individual transaction amounts.
• Cryptographic Enforcement: The master secret key generation process mathematically binds each function key to its specific computation, preventing algebraic combination attacks. This is the central technical challenge in constructing secure FE schemes.

In the standard FE model, a single central authority holds the master secret key and generates all function keys, creating a key escrow problem. Decentralized FE removes this single point of trust.

• Multi-Authority FE: Multiple independent authorities each hold a share of the master secret. A function key is generated through a distributed protocol requiring cooperation from a threshold of authorities.
• Fraud Consortium Use Case: A consortium of financial institutions can jointly manage the key generation process, ensuring no single bank can unilaterally authorize decryption of another bank's encrypted transaction data.