Functional encryption (FE) is a generalization of public-key encryption in which possessing a secret key allows one to learn a function of what the ciphertext is encrypting.
Formal definition More precisely, a functional encryption scheme for a given functionality f {\displaystyle f} consists of the following four algorithms:
( pk , msk ) ← Setup ( 1 λ ) {\displaystyle ({\text{pk}},{\text{msk}})\leftarrow {\textsf {Setup}}(1^{\lambda })} : creates a public key pk {\displaystyle {\text{pk}}} and a master secret key msk {\displaystyle {\text{msk}}} .
sk ← Keygen ( msk , f ) {\displaystyle {\text{sk}}\leftarrow {\textsf {Keygen}}({\text{msk}},f)} : uses the master secret key to generate a new secret key sk {\displaystyle {\text{sk}}} for the function f {\displaystyle f} .
c ← Enc ( pk , x ) {\displaystyle c\leftarrow {\textsf {Enc}}({\text{pk}},x)} : uses the public key to encrypt a message x {\displaystyle x} .
y ← Dec ( sk , c ) {\displaystyle y\leftarrow {\textsf {Dec}}({\text{sk}},c)} : uses secret key to calculate y = f ( x ) {\displaystyle y=f(x)} where x {\displaystyle x} is the value that c {\displaystyle c} encrypts. The security of FE requires that any information an adversary learns from an encryption of x {\displaystyle x} is revealed by f ( x ) {\displaystyle f(x)} . Formally, this is defined by simulation.
Applications Functional encryption generalizes several existing primitives including Identity-based encryption (IBE) and attribute-based encryption (ABE). In the IBE case, define F ( k , x ) {\displaystyle F(k,x)} to be equal to x {\displaystyle x} when k {\displaystyle k} corresponds to an identity that is allowed to decrypt, and ⊥ {\displaystyle \perp } otherwise. Similarly, in the ABE case, define F ( k , x ) = x {\displaystyle F(k,x)=x} when k {\displaystyle k} encodes attributes with permission to decrypt and ⊥ {\displaystyle \perp } otherwise.
History Functional encryption was proposed by Amit Sahai and Brent Waters in 2005 and formalized by Dan Boneh, Amit Sahai and Brent Waters in 2010. Until recently, however, most instantiations of Functional Encryption supported only limited function classes such as boolean formulae. In 2012, several researchers developed Functional Encryption schemes that support arbitrary functions.
References
