# Is a good idea to generate a public key from a secret key using a functional encryption scheme?

FE - functional encryption

PK - public key

I want to design a PK cryptosystem that has a unique PK for each encryptor. Namely, the encryptor submits a unique value (or an attribute) to the private key holder, and the private key holder generates an encryption of the PK cryptosystem private key as well as a secret key for the FE scheme.

The encryptor can then produce its unique PK using the following FE scheme's modified primitives:

$FE.KeyGen(msk, A, x): outputs$ $sk_{x,A}$, where msk - master secret key of the FE scheme, A - atribute of the encryptor, and $x$= a random value

$FE.Encrypt(msk, y=PrivKey):outputs$ $ct_y$, where PrivKey is the private key of the PK cryptosystem

$FE.Decrypt(sk_{x,A}, ct_y):outputs$ $x*y=x*PrivKey$.

For what I need it is important that the $PrivKey$ to remain hidden as well as the product $x*PrivKey$. That's why I called for attribute A. I hope that only the user with attribute A would be able to obtain the product $x*PrivKey$ and nobody else. The problem is that what I want to do,the secret key $sk_x$ would have the same form so I need to customize the decryption and to allow only the target user to decrypt it, based on attribute A. The secret key $sk_x$ would be the same for all users, but if I use an attribute, I can obtain $sk_{x,A}=sk(x,A)$, and by modifying decryption primtive I insure that only the user with attribute A can decrypt.

Is this secure ? Behind having infinit public keys, for each user, what are other drawbacks and how can they be mitigated ?

• This certainly looks like an X-Y Problem. ​ Specifically, IBE seems like what you're actually after. ​ ​ ​ ​ – user991 May 14 '16 at 10:41
• @RickyDemer, sorry because I omitted to mention that the product $x*PrivKey$ should remain private to user i. I have edited the post to mention this. – guglielmo london May 14 '16 at 12:30
• Does IBE apply here ? – guglielmo london May 14 '16 at 12:38