Decentralized Multi-Authority Attribute-Based Inner-Product FE: Large Universe and Unbounded

This paper presents the first decentralized multi-authority attribute-based inner product functional encryption $$(\textsf{MA}\text {-}\textsf{ABIPFE})$$ schemes supporting vectors of a priori unbounded lengths. The notion of $$\textsf{AB}\text {-}\textsf{IPFE}$$ , introduced by Abdalla et al. [ASIACRYPT 2020], combines the access control functionality of attribute-based encryption $$(\textsf{ABE})$$ with the possibility of evaluating linear functions on encrypted data. A decentralized $$\textsf{MA}\text {-}\textsf{ABIPFE}$$ defined by Agrawal et al. [TCC 2021] essentially enhances the $$\textsf{ABE}$$ component of $$\textsf{AB}\text {-}\textsf{IPFE}$$ to the decentralized multi-authority setting where several authorities can independently issue user keys involving attributes under their control. In $$\textsf{MA}\text {-}\textsf{ABIPFE}$$ for unbounded vectors $$(\textsf{MA}\text {-}\textsf{ABUIPFE})$$ , encryptors can encrypt vectors of arbitrary length under access policies of their choice whereas authorities can issue secret keys to users involving attributes under their control and vectors of arbitrary lengths. Decryption works in the same way as for $$\textsf{MA}\text {-}\textsf{ABIPFE}$$ provided the lengths of the vectors within the ciphertext and secret keys match. We present two $$\textsf{MA}\text {-}\textsf{ABUIPFE}$$ schemes supporting access policies realizable by linear secret sharing schemes $$(\textsf{LSSS})$$ , in the significantly faster prime-order bilinear groups under decisional assumptions based on the target groups which are known to be weaker compared to their counterparts based in the source groups. The proposed schemes demonstrate different trade-offs between versatility and underlying assumptions. The first scheme allows each authority to control a bounded number of attributes and is proven secure under the well-studied decisional bilinear Diffie-Hellman $$(\textsf{DBDH})$$ assumption. On the other hand, the second scheme allows authorities to control exponentially many attributes and attributes are not required to be enumerated at the setup, that is, supports large attribute universe, and is proven secure under a non-interactive q-type variant of the $$\textsf{DBDH}$$ assumption called L- $$\textsf{DBDH}$$ , similar to what was used in prior large-universe multi-authority $$\textsf{ABE}$$ $$(\textsf{MA}\text {-}\textsf{ABE})$$ construction. When compared with the only known $$\textsf{MA}\text {-}\textsf{ABIPFE}$$ scheme due to Agrawal et al. [TCC 2021], our schemes offer significantly higher efficiency while offering greater flexibility and security under weaker assumptions at the same time. Moreover, unlike Agrawal et al., our schemes can support the appearance of the same attributes within an access policy arbitrarily many times. Since efficiency and practicality are the prime focus of this work, we prove the security of our constructions in the random oracle model against static adversaries similar to prior works on $$\textsf{MA}\text {-}\textsf{ABE}$$ with similar motivations and assumptions. On the technical side, we extend the unbounded $$\textsf{IPFE}$$ techniques of Dufour-Sans and Pointcheval [ACNS 2019] to the context of $$\textsf{MA}\text {-}\textsf{ABUIPFE}$$ by introducing a novel hash-decomposition technique.