Cryptography Stack Exchange is a question and answer site for software developers, mathematicians and others interested in cryptography. It's 100% free, no registration required.

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

Informally, In functional encryption system , a decryption key allows a user to learn a function of the encrypted data. But all i see is that the function acts as an access control over the data.

Can we have richer functions, say can a user add two cipher texts and get the result in plain text using decryption key ?

Are there any known forms of functional encryption schemes that allow anything else other than access control ?

share|improve this question

Existing definitions for functional encryption don't support "combining" ciphertexts in the way that you suggest.

As far as doing more than just access control, two very recent papers (to appear next month at STOC 2013) achieve functional encryption for arbitrary functionalities:

Two caveats:

  • These are feasibility results only, and are not practical (one could probably argue that they cannot be both practical and support arbitrary functionalities)
  • They achieve slightly relaxed (but still natural & useful) security definitions for functional encryption, where either the number of keys or number of ciphertexts in the system is bounded (I don't remember the exact details).
share|improve this answer

It is not true that the functional encryption acts as access control on data since you don't control access on data once you know the key but you know the result of a function applied on data. For instance if the function is find the minimum then you can learn the minimum coefficient of a vector encrypted appropriately. If your function is the decryption function then yes you have access control and the scheme is an instantiation of Identity or attribute based encryption.

It seems like you have mixed notions with homomorphic encryption schemes in which you can evaluate operations between ciphertexts as addition and multiplication BUT you don't learn the result in that case only the encrypted result

share|improve this answer
in a way yes , am mixing it with FHE , as there are possible connections – sashank May 16 '13 at 12:31
@sashank. There are no connections at all. In FHE you produce the encrypted version of an operation on encrypted data. In functional encryption you learn the result of a function applied on encrypted data – curious May 16 '13 at 13:11
search for a paper " on connections between FE and FHE". – sashank May 16 '13 at 15:33
I explain you clearly with arguments on the base difference. Two constructions for different purposes. Argue for that and if you don't agree or i am mistaken explain please. don't cite – curious May 16 '13 at 18:19
in a way you are correct, prima facie there aren't any connections. but if we dig deeper, both allow some kind of function evaluation over encrypted data which is key, FE does not give output privacy where as FHE gives that is difference, if we find connections may be we can find better FHE solutions , because there are successful methods already in FE – sashank May 16 '13 at 21:37

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.