Adaptive Simulation Security for Inner Product Functional Encryption

Abstract

Inner product functional encryption (IPFE) [1] is a popular primitive which enables inner product computations on encrypted data. In IPFE, the ciphertext is associated with a vector x, the secret key is associated with a vector y and decryption reveals the inner product x, y. Previously, it was known how to achieve adaptive indistinguishability (IND) based security for IPFE from the DDH, DCR and LWE assumptions [8]. However, in the stronger simulation (SIM) based security game, it was only known how to support a restricted adversary that makes all its key requests either before or after seeing the challenge ciphertext, but not both. In more detail, Wee [46] showed that the DDH-based scheme of Agrawal et al. (Crypto 2016) achieves semi-adaptive simulation-based security, where the adversary must make all its key requests after seeing the challenge ciphertext. On the other hand, O'Neill showed that all IND-secure IPFE schemes (which may be based on DDH, DCR and LWE) satisfy SIM based security in the restricted model where the adversary makes all its key requests before seeing the challenge ciphertext. In this work, we resolve the question of SIM-based security for IPFE by showing that variants of the IPFE constructions by Agrawal et al., based on DDH, Paillier and LWE, satisfy the strongest possible adaptive SIMbased security where the adversary can make an unbounded number of key requests both before and after seeing the (single) challenge ciphertext. This establishes optimal security of the IPFE schemes, under all hardness assumptions on which it can (presently) be based.

Functional Encryption for Attribute-Weighted Sums from k-Lin

“…We conjecture that our transformation from one-slot to unbounded-slot preserves adaptive security. Solving the one-slot problem would require first adapting the techniques for adaptive simulation-based security in [21,7], and more recent advances in [34] to avoid the one-use restriction.…”

“…We rely on an asymmetric bilinear group (G 1 , G 2 , G T , e) of prime order p where e : [22]. Our starting point is the following scheme 7 :…”

A survey on functional encryption

“…In [15], Agrawal et al provide constructions which provably achieve security against more realistic adaptive attacks, where the messages m 0 and m 1 may be adaptively chosen in the challenge phases. Later, in [14], Agrawal et al prove that the scheme in [15] achieves adaptive SIM-based security (AD-SIM) rather than just adaptive IND-based security. Moreover, they prove AD-SIM security for an unbounded number of key queries and a single challenge ciphertext, for IPE schemes, based on the DDH, DCR and LWE assumptions.…”

SoK: Privacy Preserving Machine Learning using Functional Encryption: Opportunities and Challenges

“…IPFE is protected by selective security, whereas QFE is protected by selective as well as adaptive security against chosen-plaintext attack. There is a theoretical advancement by [4] towards making IPFE adaptively secured, but FE-based PPML works do not yet implement it. Also, information leakage proposed by [17] is the only work that discusses this concept.…”