Functional Encryption

The core innovation of functional encryption is that a secret key, sk_f, is generated for a specific function f. When this key is applied to a ciphertext ct encrypting data x, it decrypts only the output f(x), revealing nothing else about the plaintext x. This allows for policies like "only reveal the average salary" or "only reveal if a transaction is fraudulent," providing cryptographic enforcement of the principle of least privilege.

• Key Distinction: Contrast with Attribute-Based Encryption (ABE), which reveals the entire plaintext if attributes satisfy a policy. FE reveals only the computed result.
• Example: A cloud server holds encrypted medical records. A researcher with a key for the function "count patients with condition Y" learns only the number, not any individual's identity or other health data.

FE schemes are proven secure under rigorous indistinguishability (IND) game-based definitions. The fundamental security guarantee is that an adversary holding a set of function keys learns nothing about the encrypted plaintexts beyond what the functions' outputs already reveal.

• IND-CPA Security: For chosen-plaintext attacks, the adversary cannot distinguish between encryptions of two messages, x0 and x1, as long as for every function key they possess, f(x0) = f(x1). If the outputs differ for any key they hold, the messages are trivially distinguishable, and security is not required.
• Challenge: Designing simulation-based security definitions, which are stronger but harder to achieve, is an active area of research. Most practical constructions aim for indistinguishability.

FE architectures differ based on who holds the master secret key (MSK) and issues function keys.

• Centralized (Single-Authority) FE: A single, trusted authority generates the MSK and all function keys. This is simpler but creates a single point of trust and failure. The authority could decrypt everything or issue arbitrary keys.
• Decentralized (Multi-Authority) FE: Multiple, independent authorities contribute to the system. A function key can only be generated if a sufficient set of authorities collaborate (e.g., via threshold cryptography). This distributes trust, aligning better with enterprise and consortium settings. No single entity has full decryption power.

Inner-Product FE is a highly influential and relatively efficient class of FE for a specific, yet powerful, function family. Given an encrypted vector x and a key for a vector y, decryption reveals only the inner product <x, y>.

• Applications: This enables private weighted sums, which are foundational for statistics like averages, dot-product similarity (relevant for encrypted vector search), and linear models. For example, it can compute an encrypted user's preference score against an encrypted product vector without revealing either.
• Efficiency: IPFE schemes, often based on pairing-based cryptography, are more practical than general FE for arbitrary circuits, making them a key building block for privacy-preserving machine learning and analytics.

The most expressive form of FE allows the function f to be any polynomial-time Boolean or arithmetic circuit. A secret key is tied to the entire circuit description.

• Power and Cost: This enables arbitrary computations on encrypted data (e.g., run a full machine learning model or a complex business rule). However, the cryptographic overhead is immense, involving fully homomorphic encryption (FHE)-like techniques or multi-linear maps. Ciphertext and key sizes grow with the circuit's size and depth.
• Current State: While a theoretical milestone, general FE for large circuits remains largely impractical for production. Research focuses on optimizing for specific, useful circuit classes beyond inner products.

FE is a cornerstone technology for building privacy-preserving retrieval-augmented generation (RAG) systems. It allows a server to perform semantic search on a sensitive, encrypted knowledge base without ever decrypting it.

• Workflow: 1) Document chunks are embedded into vectors d_i and encrypted under an FE scheme. 2) A user's query is embedded into a vector q. 3) The user (or a trusted broker) generates an FE function key for the inner-product function with q. 4) The server uses this key to compute, over all encrypted d_i, the similarity scores <d_i, q> while still encrypted. It returns the top-K ciphertexts. 5) Only the user can decrypt the final retrieved chunks.
• Advantage over SSE/Homomorphic: More flexible than searchable symmetric encryption (SSE) and more efficient for similarity search than pure homomorphic encryption, as it reveals only scores/retrieved items, not intermediate computation states.