(Compact) Adaptively secure FE for attribute-weighted sums from k-Lin

Abstract

This paper presents the first adaptively simulation secure functional encryption (FE) schemes for attribute-weighted sums. In the proposed FE schemes, attributes are viewed as vectors and weight functions are arithmetic branching programs (ABP). We present two schemes with varying parameters and levels of adaptive simulation security. (a)We first present a one-slot scheme supporting a bounded number of ciphertext queries and an arbitrary polynomial number of secret key queries both before and after the ciphertext queries. This is the best possible level of security one can achieve in the adaptive simulation-based framework. The scheme also achieves indistinguishability-based adaptive security against an unbounded number of ciphertext and secret key queries.(b)Next, bootstrapping from the one-slot scheme, we present an unbounded-slot scheme that can support a bounded number of ciphertext and pre-ciphertext secret key queries while supporting an a-priori unbounded number of post-ciphertext secret key queries. Both schemes enjoy ciphertexts that do not grow with the number of appearances of the attributes within the weight functions. The schemes are built upon prime-order asymmetric bilinear groups and the security is derived under the standard (bilateral) k-Linear (k-Lin) assumption. Our work resolves an open problem posed by Abdalla et al (In: CRYPTO, Springer, New York, 2020), where they presented an unbounded-slot FE scheme for attribute-weighted sum achieving only semi-adaptive simulation security. Technically, we extend the recent adaptive security framework of Lin and Luo (In: EUROCRYPT, Springer, New York, 2020), devised to achieve compact ciphertexts in the context of indistinguishability-based payload-hiding security, to the setting of simulation-based adaptive attribute-hiding security.