# Decentralized Inner-Product Encryption with Constant-Size Ciphertext
## 1 Introduction  
Identity-based encryption (IBE) was first introduced by [PERSON] [1] in 1985, which allows a sender to use the recipient's identity to encrypt a message. An identity is a unique string directly linking to a user, e.g., an email address, a student ID number, an employee ID, etc. The first IBE scheme was proposed by [PERSON] and [PERSON] [2] in 2001. Though IBE reduces the management cost for traditional public key infrastructures, a drawback of IBE is that an encrypted datum can be only shared at a coarse-grained control level. This may not be suitable in the real world because the sender should know the particular recipient in advance. In a system, there may be a lot of users, and the identities of recipients may be uncertain when a message is encrypted. To solve the issue, [PERSON], [PERSON] and [PERSON] [3] conceptualized inner product encryption (IPE) in 2008. In an IPE scheme, each ciphertext is associated with an attribute vector \(\vec{Y}\) that can be decrypted by a private key associated with a predicate vector \(\vec{X}\) if and only if the inner product of \(\vec{X}\) and \(\vec{Y}\) is zero, denoted by \(<\vec{X},\vec{Y}>=0\). IPE can be viewed as the generalization for several cryptographic primitives. For example, given two identities, \(ID\), \(ID^{\prime}\), we can encode it into two vectors, \(\vec{X}=(ID,1),\vec{Y}=(-1,ID^{\prime})\), and we have  
\[ID=ID^{\prime}\Leftrightarrow<\vec{X},\vec{Y}>=0.\]  
Thus, we are able to represent the functionality of IBE using IPE. Since then, lots of IPE scheme have been proposed [4; 5; 6; 7; 8; 9; 10; 11]. In additional to its theoretical value, IPE provides lots applications in fine-grained access control as well. Using the encoding technique, IPE can be converted into many types of one-to-many encryption, such as broadcast encryption [12; 13; 14], attribute-based encryption [15; 16; 17] and subset predicate encryption [18; 19; 20]. Therefore, by adopting IPE, one can realize multiple kinds of flexible access control using only a single cryptographic primitive. Recently, more applications forIPE have been developed, e.g., privacy-preserving video streaming [21], access control for WBAN [22], secure keyword searching [23] and outsourced data integration [24]. It shows the possibility for the application of IPE in various environments. Traditionally, IPE is a centralized architecture, which needs a trusted server to issue private keys for all users. However, a centralized paradigm may not be practical in a real-world environment. In practice, the privileges of a user are usually given by different authorities. In addition, a centralized architecture would suffer from the problem of a single point of failure. To cope with these problems, [PERSON] and [PERSON] gave the first Decentralized IPE (DIPE) scheme [25] in 2018. In a DIPE scheme, there are multiple authorities. For a user, each authority will output a partial private key for this user, without interaction with each other. After studying the DIPE scheme of [PERSON] and [PERSON], we found two problems. One problem is the large ciphertext size. In their scheme, the ciphertext size is \(\mathcal{O}(nk)\) group elements, where \(n\) is the length of attribute/predicate vector and \(k\) is the parameter of \(k\)-linear assumption. Since \(k\) can be viewed as a part of the security parameter, which is a constant, the ciphertext size is linear to the length of attribute/predicate vector. Another problem is that, in their scheme, each authority is responsible for issuing a private key for only an element in the user's predicate vector. This setting brings two disadvantages. First, unlike to decentralized attribute-based encryption [26; 27; 28], where the attributes of a user is independent to each other, the elements in a predicate vector for a user are usually closely bonded.