Functional Encryption & Property Preserving Encryption Shashank Agrawal (UIUC), Shweta Agrawal (IIT-D), Saikrishna Badrinarayanan (IIT-M), Abisekh Kumarasubramanian (UCLA), Manoj Prabhakaran (UIUC), Amit Sahai (UCLA).

Outline Various encryption schemes: Public-key functional encryption, Private-key functional encryption, Property Preserving encryption. Fairly new ideas, spend some time on each one. What they are? Our results. Come back and discuss Public-key functional encryption in detail.

Public key Functional enc. MPK 𝑚∈𝑀 ENC (m) MSK, MPK MPK Alice Note that there are two parameters – message space, and the more important one, the function family – the more . Providing function hiding is not easy in this setting. Bob 𝑓∈𝐹 MPK Trusted Authority 𝑆 𝐾 𝑓 DEC ( ENC(m),𝑆 𝐾 𝑓 ) = f(m) Julie

Public key Functional enc. First formally studied by Boneh, Sahai and Waters in 2011. Encompasses well-known notions of encryption: Public-key encryption [DH76, RSA77, …], Identity-based encryption [Sha84, BF01, Coc01, BW06, GPV08], Attribute-based encryption [SW05, GPSW06, GVW13, GGH+13], Predicate encryption [KSW08, LOS+10, AFV11], Searchable encryption [BCOP04], etc . Has been the subject of intense study in the recent past.

Our contribution A new definition for Functional Encryption: Simulation based (real-ideal world), Provides both function and message hiding, Simple and intuitive. First definition with the above features. Construct a secure protocol in the generic group model. Practice: Security against a large class of attacks. Function family F: inner-product predicates. A weaker simulation-based definition that can be realized under a weaker assumption.

Private key functional Enc. 𝑚1, 𝑚2, 𝑚3∈𝑀 ENC (m1, SK) SK ENC (m2, SK) ENC (m3, SK) 𝑆 𝐾 𝑓 for an 𝑓∈𝐹 Client could be backing up files on the server. Later the client wants to access files which contain a particular keyword. 𝑓 𝑚1 , 𝑓 𝑚2 , 𝑓(𝑚3) Client Server

USE CASE Client stores files on server by encrypting them. Later the client wants all files with the keyword ‘urgent’. Client sends a key 𝑆𝐾 𝑢𝑟𝑔𝑒𝑛𝑡 to the server. Server applies decryption function to each file. Returns files for which output is 1 to the client. Dec ( 𝑆𝐾 𝑢𝑟𝑔𝑒𝑛𝑡 , Enc. file) = 1 iff file contains the word ‘urgent’.

Private key functional Enc. First studied by Shen, Shi and Waters in 2009 [SSW09]. SSW09 construct a secure protocol for inner-product predicates. A new protocol that is better in several ways.

An improved protocol SSW09 protocol Our protocol Selective security Full security Composite-order groups Prime-order groups Non-standard assumptions Standard assumption

Our protocol Derived from Okamoto and Takashima [OT12]. Symmetric nature of inner-product predicates. Ways to transform a protocol with weaker properties into one with stronger properties [Fre10, Lew12]. No method can simultaneously solve all the three problems.

Property preserving encryption :𝑀×𝑀→{0,1} TEST(ENC(m1), ENC(m2)) = P(m1, m2) SK ENC (m1, SK) ENC (m2, SK) Client Server

USE case Property: Given two files, which one comes before in alphabetical order. Client stores files on server by encrypting them. Later client wants to retrieve the file which comes first in alphabetical order. Server uses 𝑇𝐸𝑆𝑇 to compare encrypted files. Sorts the files in alphabetical order.

Property preserving encryption Introduced by Pandey and Rouselakis in 2012 [PR12]. PR12 gives a protocol for the inner-product property. We improve their protocol in two crucial ways. Exploit connection b/n Private-key FE and PPE. PR12 Our protocol Composite-order groups Prime order groups Generic group model Standard model (DLIN assumption)

Public-key functional encryption

Alice 𝑓∈𝐹 MPK 𝑚∈𝑀 ENC (m, MPK) MSK, MPK MPK Adversary MPK 𝑆 𝐾 𝑓 Trusted Authority 𝑆 𝐾 𝑓 DEC ( ENC(m),𝑆 𝐾 𝑓 ) = f(m) Julie

Indistinguishability based def. Message hiding: 𝑚 1 and 𝑚 2 s.t. 𝑓( 𝑚 1 ) = 𝑓( 𝑚 2 ). 𝐸𝑛𝑐( 𝑚 1 ) indistinguishable from 𝐸𝑛𝑐( 𝑚 2 ). Function hiding: 𝑓1 and 𝑓2 s.t. 𝑓1(𝑚) = 𝑓2(𝑚). 𝑆 𝐾 𝑓1 indistinguishable from 𝑆 𝐾 𝑓2 . By creating 𝐸𝑛𝑐( 𝑚 1 ), 𝐸𝑛𝑐 𝑚 2 , 𝐸𝑛𝑐( 𝑚 3 ),… compute 𝑓1 𝑚 1 , 𝑓1 𝑚 2 , 𝑓1( 𝑚 3 ) or 𝑓2 𝑚 1 , 𝑓2 𝑚 2 , 𝑓2 𝑚 3 . Could distinguish between 𝑓1 and 𝑓2. Intuitively, given 𝐸𝑛𝑐(𝑚) and SK for 𝑓, the only information Bob learns is 𝑓(𝑚).

Simulation based def. A new definition for Functional Encryption: Simulation based (real-ideal world), Provides both function and message hiding, Simple and intuitive. Real world execution of a protocol is compared with an “Ideal” world. Ideal world: Security requirements we want from our protocol.

Real World Ideal World MSK, MPK MPK Environment Environment 𝑚 1 , 𝑚 2 ,…, 𝑚 𝑖−1 , 𝑚 𝑖 MSK, MPK 𝑓 1 , 𝑓 2 ,…, 𝑓 𝑘−1 ,𝑓 𝑘 MPK 𝐸𝑛𝑐 ( 𝑚 1 ) 𝑓 1 𝑚 1 , 𝑓 2 𝑚 2 , …, 𝑓 𝑘−1 ( 𝑚 𝑖 ) …, 𝐸𝑛𝑐( 𝑚 𝑖 ) 𝑓 𝑘 𝑚 1 , 𝑓 𝑘 𝑚 2 , …, 𝑓 𝑘 ( 𝑚 𝑖 ) 𝑆 𝐾 𝑓 1 …,𝑆 𝐾 𝑓 𝑘 Trusted Authority Adversary Oracle Simulator 𝑓 1 …,𝑓 𝑘 𝑓 𝑘 ∈𝐹 𝑚 1 …, 𝑚 𝑖 𝑚 𝑖 ∈𝑀 Environment Environment ∀ 𝐴𝑑𝑣 ∃ 𝑆𝑖𝑚 𝑅𝑒𝑎𝑙≈𝐼𝑑𝑒𝑎𝑙

Our set-up Strong security definition. Cannot be realized in the standard model [BSW11, O’N11, BO12]. Adversary doesn’t exploit structure of the group. Generic group model: captures most real-world attacks. Function family F: inner product predicates. Looking at some special cases of Functional Encryption. Inner-product predicates capture those cases.

Identity based encryption ID = {Bob, Alice, Mary, …} and 𝑆={ 𝑚 1 , 𝑚 2 , 𝑚 3 ,…}. 𝐹= 𝑓 𝑖𝑑 𝑖𝑑∈𝐼𝐷}. 𝑀={(𝑚,𝑖 𝑑 ′ )|𝑚∈𝑆, 𝑖 𝑑 ′ ∈𝐼𝐷}. 𝑓 𝑖𝑑 𝑚, 𝑖 𝑑 ′ =𝑚 if 𝑖𝑑=𝑖𝑑′, and ⊥ otherwise. Authority gives secret key according to id Ex: Alice gets a SK for 𝑓 𝐴𝑙𝑖𝑐𝑒 Bob sends 𝐸𝑛𝑐( 𝑚 ∗ , 𝐴𝑙𝑖𝑐𝑒) to Alice. Only Alice can obtain 𝑚 ∗ , using SK for 𝑓 𝐴𝑙𝑖𝑐𝑒 .

Complex policies Complex policies like Head of Dept. OR (Faculty AND Security). 𝐼 𝐷 𝑝𝑜𝑠 ={𝐻𝑒𝑎𝑑 𝑜𝑓 𝐷𝑒𝑝𝑡., 𝐹𝑎𝑐𝑢𝑙𝑡𝑦, 𝑆𝑡𝑢𝑑𝑒𝑛𝑡𝑠, …} 𝐼 𝐷 𝑎𝑟𝑒𝑎 ={𝑆𝑒𝑐𝑢𝑟𝑖𝑡𝑦,𝐴𝑙𝑔𝑜𝑟𝑖𝑡ℎ𝑚𝑠, 𝐴𝐼,…} 𝐵𝐸𝑥𝑝= 𝐵𝑜𝑜𝑙𝑒𝑎𝑛 𝑒𝑥𝑝𝑟𝑒𝑠𝑠𝑖𝑜𝑛𝑠 𝑜𝑣𝑒𝑟 𝐼 𝐷 𝑝𝑜𝑠 𝑎𝑛𝑑 𝐼 𝐷 𝑎𝑟𝑒𝑎 𝐹= 𝑓 𝑖𝑑1, 𝑖𝑑2 𝑖𝑑1∈𝐼 𝐷 𝑝𝑜𝑠 , 𝑖𝑑2∈𝐼 𝐷 𝑎𝑟𝑒𝑎 } 𝑀= 𝑚, 𝑏𝑒𝑥𝑝 𝑚∈𝑆, 𝑏𝑒𝑥𝑝∈𝐵𝑒𝑥𝑝} 𝑓 𝑖𝑑1, 𝑖𝑑2 𝑚, 𝑏𝑒𝑥𝑝 =𝑚 iff 𝐼 𝐷 1 and 𝐼 𝐷 2 satisfy the Boolean Expression 𝑏𝑒𝑥𝑝.

Inner-product Predicates Powerful primitive: Identity Based Encryption Complex Policies like Boolean Expressions 𝐹= 𝑓 𝑣 𝑣 =( 𝑣 1 , 𝑣 2 ,…, 𝑣 𝑛 )}. 𝑀= 𝑚, 𝑥 𝑥 =( 𝑥 1 , 𝑥 2 ,…, 𝑥 𝑛 )}. 𝑓 𝑣 𝑚, 𝑥 =𝑚 if 𝑣 . 𝑥 =∑ 𝑣 𝑖 . 𝑥 𝑖 =0, and ⊥ otherwise. Given a key for 𝑓 𝑣 we would be able to recover 𝑚 from an encryption (𝑚, 𝑥 ) only if 𝑣 . 𝑥 =0.

Our protocol A protocol for inner-product predicates in the Generic group model, which is secure under a strong simulation- based definition. Two constructions Dual Pairing Vector Spaces (Okamoto and Takashima in 2008). Secret Sharing. The constructions have comparable efficiency. For vectors of length n, ciphertext and key of length 3n.

Conclusion A new powerful definition for Public-Key Functional Encryption. Protocol in the Generic group model. Another definition Relax-SIM. Protocol in the standard model. Improve protocols for Private-Key Functional Encryption and Property Preserving Encryption in various ways. First protocols under standard assumptions/model.

Thank You Paper will soon be available on Eprint.