5
$\begingroup$

I'm curious about what operations have been developed into functional encryption schemes.

What I mean by that is: what operations can be performed over encrypted ciphertexts? Obviously homomorphic encryption allows for $+$ and $*$. Deterministic encryption allows for equality comparison ($==$). Order-preserving encryption allows for $<$. What other schemes exist that allow for other operations?

I'm primarily concerned with schemes that are implementable so that their running time is fast enough to be practical. I am aware of the recent result for general case functional encryption, but it is far from being useful because it is so slow.

Improve this question
$\endgroup$
5
  • 2
    $\begingroup$ It sounded as if , Homorphic supports only those two operations. But they are the building blocks to support any other complex operations. $\endgroup$
    – sashank
    Sep 9, 2014 at 1:23
  • 1
    $\begingroup$ Note that there is a qualitative difference what homomorphic encryption does and what the other two types you mentioned do. $\:$ The results produced by homomorphic encryption are still encrypted, and one might plausibly expect the schemes to be IND-CCA1. $\:$ The results produced by the other two schemes are in-the-clear, so semantic security cannot hold. $\:$ I another type of scheme in which the private key holder can issue tokens that suffice for in-the-clear results for specific functions, although I don't remember what those papers were or whether the schemes were practical. $\;\;\;\;$ $\endgroup$
    – user991
    Sep 9, 2014 at 8:53
  • $\begingroup$ @RickyDemer - that's true. I am looking for operations that are supported in either fashion: such that the result of the operation is either cleartext or encrypted. $\endgroup$
    – bkaiser
    Sep 10, 2014 at 15:10
  • $\begingroup$ One talk at Crypto 2012 was about the implementation of calculating an AES encryption via fully homomorphic encryption. $\endgroup$
    – j.p.
    Feb 23, 2015 at 15:35
  • $\begingroup$ Are you aware of the field of multi-party computation? Many researchers consider homomorphic encryption as part of MPC along with Yao Garbled Circuits and secret sharing (either Shamir style or, better performing and more modern linear sharing). $\endgroup$
    – Thomas M. DuBuisson
    Feb 23, 2015 at 16:57

1 Answer 1

Reset to default
4
$\begingroup$

I think you are confusing functional encryption and homomorphic encryption.

  • In a functional encryption scheme, using a secret key for some function $f$ on a ciphertext $c$ which is an encryption of $m$ allows you to get $f(m)$ in clear.
  • In an homomorphic encryption scheme, you can run some operation on ciphertexts, and get an encryption of the result, for example in multiplicatively homomorphic encryption, $c_1c_2$ encrypts $m_1m_2$ if $c_i$ encrypted $m_i$.

If you want some answers about homomorphic encryption, there exists homomorphic encryption for addition and multiplication, and somewhat fully homomorphic encryption, which supports both of these operation, but there is a noise growing with each operation that reduces the probability of decryption each time an operation is run -this is only a small problem because given the number of operation you want to make, you can set the parameters of your scheme according to that.

If you want answers about functional encryption, recents works follow two paths:

  • Ineficient, theoretical functional encryption for all circuits. Which is really interesting for science but is really not practical for the moment.
  • Predicate encryption, which is all-or-nothing decryption based on an attribute given in the ciphertext and an attribute of each secret key. There should be practical particular predicate encryption such as Attribute Based Encryption or Identity Based Encryption.

If you want practical scheme that give partial information on the message with depending on the key you have, I don't know of many, but I have a paper that will be presented at PKC15 about Simple Functional Encryption Scheme for Inner Product, this scheme enables you to decrypt $<x.y>$ given a $ct_x$ and $sk_y$.

Improve this answer
$\endgroup$

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.