A new approach to practical function-private inner product encryption

Abstract

Functional encryption (FE) is a novel paradigm supporting restricted decryption keys for a function f that allow one to learn f(xj) from the encryptions of messages xj. A natural and practical security requirement for FE is to keep not only messages x1,…,xq, but also functions f1,…fq, excluding inevitable information {fi(xj)}i,j∈[q], confidential from encryption and decryption keys for any polynomial a priori unknown number q, where fi and xj are adaptively chosen by adversaries. This security requirement is called full function privacy. In this paper, we focus on function-private FE for inner product functionality in the private key setting (referred to as inner product encryption (IPE)). To the best of our knowledge, only two approaches have been proposed for fully function-private IPE schemes in the private key setting. One is to employ a general transformation from (non-function-private) FE for general circuits (Brakerski and Segev, 2015 [20]). This approach requires computationally intensive cryptography tools, such as indistinguishability obfuscation (for non-function-private FE for general circuits), meaning it is inefficient. The other approach is more practical. It directly constructs an IPE scheme by using dual-pairing vector spaces (DPVS) (Bishop et al., 2015 [21], Datta et al., 2016 [22], and Tomida et al., 2016 [32]).We present a novel approach for practical function-private IPE schemes that does not employ DPVS, but instead uses generalizations of the Brakerski-Segev transformation. Our generalizations of the Brakerski-Segev transformation are easily combinable with existing (non-function-private) IPE schemes, as well as (non-function-private) FE schemes for general circuits on several levels of security. The proposed IPE scheme achieves better performance compared to the schemes proposed by Bishop et al. and Datta et al. The proposed IPE scheme preserves the same security level as previous schemes under the same complexity assumptions. Compared to the scheme proposed by Tomida et al., our scheme has comparable performance in terms of the size of ciphertext and decryption keys, but superior performance in terms of the size of the master key.