International Association for Cryptologic Research (IACR)
Abstract
We investigate the optimal (asymptotic) efficiency of functional encryption (FE) and attribute-based encryption (ABE) by proving inherent space-time trade-offs and constructing nearly optimal schemes. We consider the general notion of partially hiding functional encryption (PHFE), capturing both FE and ABE, and the most efficient computation model of random-access machines (RAM). In PHFE, a secret key skf is associated with a function f, whereas a ciphertext ctx(y) is tied to a public input x and encrypts a private input y. Decryption reveals f(x,y) and nothing else about y.
We present the first PHFE for RAM solely based on the necessary assumption of FE for circuits. Significantly improving upon the efficiency of prior schemes, our construction achieves nearly optimal succinctness and computation time:
- Its secret key skf is of *constant size* (optimal), independent of the function description length ∣f∣, i.e., ∣skf∣=poly(λ).
- Its ciphertext ctx(y) is *rate-2* in the private input length ∣y∣ (nearly optimal) and *independent* of the public input length ∣x∣ (optimal), i.e., ∣ctx(y)∣=2∣y∣+poly(λ).
- Decryption time is *linear* in the *instance* RAM running time T, plus the function and public/private input lengths, i.e., TDec=(T+∣f∣+∣x∣+∣y∣)poly(λ).
As a corollary, we obtain the first ABE with both keys and ciphertexts being constant-size, while enjoying the best-possible decryption time matching the lower bound by Luo [ePrint \u2722]. We also separately achieve several other PHFE and ABE schemes.
We study the barriers to further efficiency improvements. We prove the first unconditional space-time trade-offs for (PH-)FE:
- *No* secure (PH-)FE can have ∣skf∣ and TDec *both* sublinear in ∣f∣.
- *No* secure PHFE can have ∣ctx(y)∣ and TDec *both* sublinear in ∣x∣.
Our lower bounds apply even to the weakest secret-key 1-key 1-ciphertext selective schemes. Furthermore, we demonstrate a conditional barrier towards the optimal decryption time TDec=Tpoly(λ) while keeping linear size dependency — any such (PH-)FE scheme implies doubly efficient private information retrieval (DE-PIR) with ideal efficiency, for which so far there is no satisfactory candidate