Abstract. Functional encryption supports restricted decryption keys that allow users to learn specific functions of the encrypted messages. Although the vast majority of research on functional encryption has so far focused on the privacy of the encrypted messages, in many realistic scenarios it is crucial to offer privacy also for the functions for which decryption keys are provided. Whereas function privacy is inherently limited in the public-key setting, in the private-key setting it has a tremendous potential. Specifically, one can hope to construct schemes where encryptions of messages m 1 , . . . , m T together with decryption keys corresponding to functions f 1 , . . . , f T , reveal essentially no information other than the values { f i (m j )} i, j∈ [T ] . Despite its great potential, the known function-private private-key schemes either support rather limited families of functions (such as inner products) or offer somewhat weak notions of function privacy. We present a generic transformation that yields a function-private functional encryption scheme, starting with any non-function-private scheme for a sufficiently rich function class. Our transformation preserves the message privacy of the underlying scheme and can be instantiated using a variety of existing schemes. Plugging in known constructions of functional encryption schemes, we obtain function-private schemes based either on the learning with errors assumption, on obfuscation assumptions, on simple multilinear- * Supported by the Israel Science Foundation (Grant No. 468/14), by the US-Israel Binational Science
In terms of underlying assumptions, we rely on the fact that Brakerski and Segev REF showed that a function private scheme can be obtained from any private-key functional encryption scheme.
Function-Private Functional Encryption in the Private-Key Setting
Journal of Cryptology
Journal of Cryptology
Mathematics Computer Science