Functional Encryption

Unlike traditional public-key encryption which is all-or-nothing, FE issues function-specific secret keys. A key sk_f allows the holder to compute f(x) from an encryption of x, but reveals nothing else about x. This enables precise, least-privilege data access.

• Example: A key that only computes the sum of a set of encrypted numbers, not the individual values.
• Example: A key that reveals whether an encrypted email is spam, but not the email body or sender.

A single ciphertext Enc(x) can be queried by multiple parties holding different secret keys, each learning a distinct function of x. This eliminates the need to re-encrypt data for every recipient or use case.

• Efficiency: Data is encrypted once and stored.
• Flexibility: New functions can be authorized by issuing new secret keys without modifying the ciphertext.
• Contrast with HE: Homomorphic Encryption requires the evaluator to know the function at encryption time or use universal circuits; FE decouples encryption from function specification.

The standard security notion for FE is IND-CPA adapted for the functional setting. An adversary holding keys for functions f1, f2, ... cannot distinguish between encryptions of x0 and x1, provided that fi(x0) = fi(x1) for all held keys.

• Collusion Resistance: Security holds even if multiple key holders collude.
• Simulation-Based Security: A stronger notion where the adversary learns nothing beyond the function outputs, formalized via an ideal-world simulator.

A practical subclass of FE where the function is an inner product between the plaintext vector x and a vector y associated with the secret key. IPFE is built efficiently from standard assumptions like the Decisional Diffie-Hellman (DDH) or Learning With Errors (LWE) problems.

• Use Case: Computing weighted sums or linear classifiers on encrypted data.
• Use Case: Privacy-preserving biometric matching where the key vector represents a stored template.

Attribute-Based Encryption is a special case of FE where the function f evaluates a boolean formula over attributes. In Ciphertext-Policy ABE (CP-ABE), the ciphertext embeds a policy, and keys are associated with attributes. Decryption succeeds if and only if f(attributes) = true.

• Relationship: ABE reveals the plaintext if the policy is satisfied; general FE reveals an arbitrary function's output.
• Deployment: ABE is more mature and widely deployed for access control in cloud storage and IoT.

In standard FE, the function f associated with a secret key is public. Function-Hiding FE conceals f itself, so a key holder cannot determine what function they are computing. This is critical when the function represents proprietary logic or a sensitive model.

• Mechanism: Achieved through dual-system encryption or predicate encryption techniques.
• Application: A financial institution can query encrypted data with a proprietary risk model without revealing the model's parameters to the data host.

A specific instantiation of functional encryption where decryption keys are associated with attributes and ciphertexts embed access policies. A user can decrypt only if their attributes satisfy the policy.

• Key-Policy ABE (KP-ABE): Keys contain policies, ciphertexts contain attributes. Used in pay-TV and audit log systems.
• Ciphertext-Policy ABE (CP-ABE): Ciphertexts contain policies, keys contain attributes. Dominant in cloud access control.
• Enables fine-grained, cryptographically enforced role-based access without a trusted online mediator.

A construction where a secret key is derived for a vector y, and decrypting a ciphertext encrypting vector x reveals only the inner product ⟨x, y⟩ and nothing else about x.

• Serves as a building block for more complex functionalities, including machine learning inference.
• Enables privacy-preserving linear classifiers: a server can compute a prediction score without seeing the feature vector.
• Constructions exist from standard assumptions like the Decisional Diffie-Hellman (DDH) and Learning With Errors (LWE) problems.

A powerful cryptographic primitive that can transform any program into an unintelligible form while preserving its input-output behavior. iO is considered a complete primitive for functional encryption.

• A candidate iO construction can theoretically realize functional encryption for all polynomial-size circuits.
• The first viable candidate construction was proposed in 2013, sparking a revolution in theoretical cryptography.
• Current constructions rely on multilinear maps or well-founded assumptions on graded encodings, though practical efficiency remains an active research frontier.

A security enhancement where the decryption key hides the function itself, not just the plaintext. An adversary cannot determine what function a key computes.

• Critical for applications where the function is proprietary intellectual property, such as a fraud detection model.
• In standard FE, the function is considered public; function-hiding FE provides two-sided security.
• Achieved through pairing-based constructions or by combining FE with fully homomorphic encryption to blind the circuit being evaluated.

Extends FE to functions with multiple inputs encrypted under different keys. A decryptor learns f(x₁, x₂, ..., xₙ) without learning anything about the individual inputs.

• Enables privacy-preserving data aggregation across multiple mutually distrusting data owners.
• A core primitive for federated learning with encrypted model aggregation, where each client's gradient update is an encrypted input.
• Constructions are significantly more complex than single-input FE and often rely on indistinguishability obfuscation or pairing-based cryptography.

Removes the requirement for a central trusted authority to generate all keys. Instead, multiple independent authorities can issue attribute keys to users.

• Eliminates the key escrow problem inherent in traditional ABE and FE systems.
• A user's decryption key is composed of partial keys from different authorities, preventing any single authority from decrypting all ciphertexts.
• Essential for real-world multi-organizational deployments where no single entity should hold universal decryption power, such as cross-hospital medical research networks.