Functional encryption

Functional encryption is a type of public-key encryption in which a the decryption of a ciphertext is possible if and only if the plaintext satisfies some functional relation. Functional encryption generalizes several existing primitives including Identity-Based encryption and Attribute-Based Encryption.

Functional encryption was proposed by Sahai and Waters in 2005 and formalized by Boneh, Sahai and Waters in 2010. Until recently, however, most instantiations of Functional Encryption supported only limited function classes such as boolean formulae. In 2012, several researchers developed Functional Encryption schemes that support arbitrary functions.

Background

Functional Encryption is a new vision of public key encryption. Traditionally, we view encryption as a mechanism for a user, Alice, to confidentially encode a data to a target recipient Bob. Alice encrypts the data under the recipients public key such that only Bob, with knowledge of his private key, can decrypt it.

However, in some applications, it may be necessary to share data according to an encryption policy without prior knowledge of who will be receiving the data. Suppose an informant needs to encrypt a message for anyone in a police department's internal affairs office or anyone who is undercover and in the central office -- even though she may not know which officers fit this criteria. The informant will want to encrypt the review with the access policy.

In this system, only users with attributes (credentials) that match this policy should be able to decrypt the document. Traditionally this sort of access control was implemented using a trusted server. With Functional Encryption, however, it is possible to represent the user's access policy using some arbitrary function $f()$ that takes as input an associated ciphertext tag $x$ (that e.g., contains information about the ciphertext). A private key generator subsequently embeds the description of $f()$ into a secret key, which is given to the user. Functional encryption schemes guarantee that the user may decrypt the ciphertext if an only if when $f(x)$ evaluates to 1.

One realization of Functional Encryption is Attribute Based Encryption (ABE). In these schemes, the function $f()$ is a boolean formula over a set of attributes (e.g., Secret OR Top_Secret AND CIA_Agent). Users obtain keys for specific formulae from a trusted party known as a private key generator. Ciphertexts are encrypted with attributes such that the ciphertext can only be decrypted when the attributes satisfy the policy embedded in the user's key.