Function-Hiding Inner Product Encryption Is Practical

• Published in: Security and Cryptography for Networks Vol. 11035; pp. 544 - 562
• Main Authors: Kim, Sam, Lewi, Kevin, Mandal, Avradip, Montgomery, Hart, Roy, Arnab, Wu, David J.
• Format: Book Chapter
• Language: English
• Published: Switzerland Springer International Publishing AG 2018; Springer International Publishing
• Series: Lecture Notes in Computer Science
• DOI: 10.1007/978-3-319-98113-0_29
• ISBN: 9783319981123; 3319981129
• ISSN: 0302-9743

In a functional encryption scheme, secret keys are associated with functions and ciphertexts are associated with messages. Given a secret key for a function f, and a ciphertext for a message x, a decryptor learns f(x) and nothing else about x. Inner product encryption is a special case of functional encryption where both secret keys and ciphertext are associated with vectors. The combination of a secret key for a vector x $${\mathbf {x}}$$ and a ciphertext for a vector y $$\mathbf {y}$$ reveal ⟨x,y⟩ $$\langle {\mathbf {x}}, \mathbf {y}\rangle $$ and nothing more about y $$\mathbf {y}$$ . An inner product encryption scheme is function-hiding if the keys and ciphertexts reveal no additional information about both x $${\mathbf {x}}$$ and y $$\mathbf {y}$$ beyond their inner product. In the last few years, there has been a flurry of works on the construction of function-hiding inner product encryption, starting with the work of Bishop, Jain, and Kowalczyk (Asiacrypt 2015) to the more recent work of Tomida, Abe, and Okamoto (ISC 2016). In this work, we focus on the practical applications of this primitive. First, we show that the parameter sizes and the run-time complexity of the state-of-the-art construction can be further reduced by another factor of 2, though we compromise by proving security in the generic group model. We then show that function privacy enables a number of applications in biometric authentication, nearest-neighbor search on encrypted data, and single-key two-input functional encryption for functions over small message spaces. Finally, we evaluate the practicality of our encryption scheme by implementing our function-hiding inner product encryption scheme. Using our construction, encryption and decryption operations for vectors of length 50 complete in a tenth of a second in a standard desktop environment.