Take the 2-minute tour ×
Cryptography Stack Exchange is a question and answer site for software developers, mathematicians and others interested in cryptography. It's 100% free, no registration required.

Predicate encryption(PE) arrived as a descendant of attribute based encryption. Attribute based encryption allows the encryptor to embody a policy to the ciphertext (Ciphertext-Policy based encryption) and the receipent to receive a key from a central trusted authority according to his attributes. If the attributes do satisfy the policy then the receipent can decrypts. Another less secure version is the key-policy based encryption whereby the encryptor associates with the ciphertext the attributes that he wills a potential decryptor to have and the key of the receiver comes with the policy. Because attribute based encryption reveals the policy(KP-ABE) and the attributes(CP-ABE) predicate encryption comes to solve this by allowing the receipent to apply a predicate if he owns a secret key of that predicate.

Functional encryption(FE) As presented in the paper is a generalization of Identity based encryption, Attribute based encryption and predicate encryption. Instead of a predicate there is a function $f$ that evaluates the attributes of the ciphertext. At the paper the construction is given based on predicate encryption.

My question is what extra functionality FE provides in comparison with PE. Is there a drawback or a security leakage in PE that FE solves? My intuition from the literature is that the contribution of FE is the generalization of the 3 previous mention crypto schemes(IBE,ABE,PE) into 1 scheme (research purpose for acceptance in a conference, not practical at all) and second is the area of applications. I understood that in PE if your secret key $sk$ lets you evaluate at $1$ a predicate $P$ over a ciphertext $c$ then you recover the plaintext but with the FE if $F_{sk}(c)=1$ then you learn the output of the function on the plaintext. I.e: the function might be a machine learning algorithm classifying spam so you learn if the message is a spam or no, but not the contents of the message. Is this correct?

share|improve this question

2 Answers 2

up vote 4 down vote accepted

PE is a subclass of FE.

This (from the other answer) is correct.

Also, from my understanding, your analogy is correct. PE returns the plaintext if the predicate evaluates to true. FE, on the other hand, returns a function of the plaintext.

We can say that PE is a subclass of FE, since we can use FE to implement PE. Just use the identity function.

Your example of $f$ being a machine learning function is an example of something that FE can do that PE cannot.

share|improve this answer
Just as an add @mikeazo: In PE schemes the holder of a secret key $sk_f$ for some predicate $f$ given a ciphertext $c$ does not necessarily learn the plaintext $m$, i.e, is able to decrypt the message (if the decryptor learns $m$, such schemes are called full fledged). There are also constructions which are predicate only, i.e, given $c$ and $sk_f$ one only learns whether the predicate $f(m)$ holds, but does not learn the plaintext $m$. Latter constructions for instance can be used to realise searchable encryption schemes in a generic way (although there are more efficient alternatives). –  DrLecter Nov 6 '13 at 11:14

PE is subclass of FE.

For more description,see page number 256 of book, Theory of Cryptography: 8th Theory of Cryptography Conference, TCC 2011.

share|improve this answer
It's better to point me the paper of the TCC. –  curious Dec 18 '12 at 9:14
here is springer link. link.springer.com/chapter/… –  pratibha Dec 18 '12 at 9:40
Ok but you didn't answer to my question. Is there an obvious difference, a use case scenario whereby i cannot use PE in terms of functionality and security and i should use FE –  curious Dec 18 '12 at 11:11

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.