Take the 2-minute tour ×
Cryptography Stack Exchange is a question and answer site for software developers, mathematicians and others interested in cryptography. It's 100% free, no registration required.

Predicate encryption(PE) arrived as a descendant of attribute based encryption. Attribute based encryption allows the encryptor to embody a policy to the ciphertext (Ciphertext-Policy based encryption) and the receipent to receive a key from a central trusted authority according to his attributes. If the attributes do satisfy the policy then the receipent can decrypts. Another less secure version is the key-policy based encryption whereby the encryptor associates with the ciphertext the attributes that he wills a potential decryptor to have and the key of the receiver comes with the policy. Because attribute based encryption reveals the policy(KP-ABE) and the attributes(CP-ABE) predicate encryption comes to solve this by allowing the receipent to apply a predicate if he owns a secret key of that predicate.

Functional encryption(FE) As presented in the paper is a generalization of Identity based encryption, Attribute based encryption and predicate encryption. Instead of a predicate there is a function $f$ that evaluates the attributes of the ciphertext. At the paper the construction is given based on predicate encryption.

My question is what extra functionality FE provides in comparison with PE. Is there a drawback or a security leakage in PE that FE solves? My intuition from the literature is that the contribution of FE is the generalization of the 3 previous mention crypto schemes(IBE,ABE,PE) into 1 scheme (research purpose for acceptance in a conference, not practical at all) and second is the area of applications. I understood that in PE if your secret key $sk$ lets you evaluate at $1$ a predicate $P$ over a ciphertext $c$ then you recover the plaintext but with the FE if $F_{sk}(c)=1$ then you learn the output of the function on the plaintext. I.e: the function might be a machine learning algorithm classifying spam so you learn if the message is a spam or no, but not the contents of the message. Is this correct?

share|improve this question

3 Answers 3

up vote 5 down vote accepted

PE is a subclass of FE.

This (from the other answer) is correct.

Also, from my understanding, your analogy is correct. PE returns the plaintext if the predicate evaluates to true. FE, on the other hand, returns a function of the plaintext.

We can say that PE is a subclass of FE, since we can use FE to implement PE. Just use the identity function.

Your example of $f$ being a machine learning function is an example of something that FE can do that PE cannot.

share|improve this answer
Just as an add @mikeazo: In PE schemes the holder of a secret key $sk_f$ for some predicate $f$ given a ciphertext $c$ does not necessarily learn the plaintext $m$, i.e, is able to decrypt the message (if the decryptor learns $m$, such schemes are called full fledged). There are also constructions which are predicate only, i.e, given $c$ and $sk_f$ one only learns whether the predicate $f(m)$ holds, but does not learn the plaintext $m$. Latter constructions for instance can be used to realise searchable encryption schemes in a generic way (although there are more efficient alternatives). –  DrLecter Nov 6 '13 at 11:14

PE is a subclass of FE. A description can be found on page 256 of the book “Theory of Cryptography: 8th Theory of Cryptography Conference, TCC 2011”.

The related paper is available in PDF format via eprint.iacr.org:

share|improve this answer
Ok but you didn't answer to my question. Is there an obvious difference, a use case scenario whereby i cannot use PE in terms of functionality and security and i should use FE –  curious Dec 18 '12 at 11:11

The previous comments skip an important fact.

I think that a PE for all circuits and A FE for all circuits are equivalent in the sense that you can build the second from the first one (the opposite direction is trivial).

A key for a circuit C with output size of n bits can be implemwnted as n PE keys in which the i-th key is relative to the circuit that comoutes the i-th bit of the output. Furthermore the PE ciphertexts are set with payload message equal to the bit 1. The decryption procedure decrypts the ciphertext that encrypts (1,x) with each of the keys and when the decryption return error, it sets the i-th bit equal to 0, or 1 otherwise.

But it does not hold for any functionality and there is a loss of efficiency

share|improve this answer

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.