Paper 2023/1191

Attribute-Based Multi-Input FE (and more) for Attribute-Weighted Sums

Abstract

Recently, Abdalla, Gong and Wee (Crypto 2020) provided the first functional encryption scheme for attribute-weighted sums (AWS), where encryption takes as input $N$ (unbounded) attribute-value pairs $\{{\overrightarrow{x}}_i,{\overrightarrow{z}}_i{\}}_{I\in [N]}$ where ${\overrightarrow{x}}_i$ is public and ${\overrightarrow{z}}_i$ is private, the secret key is associated with an arithmetic branching programs $f$, and decryption returns the weighted sum ${\sum }_{i\in [N]}f({\overrightarrow{x}}_i{)}^{\mathrm{\top }}{\overrightarrow{z}}_i$, leaking no additional information about the ${\overrightarrow{z}}_i$'s. We extend FE for AWS to the significantly more challenging multi-party setting and provide the first construction for {\it attribute-based} multi-input FE (MIFE) supporting AWS. For $$, encryptor $$ can choose an attribute $$ together with AWS input $$ where $$ and $$ is unbounded, the key generator can choose an access control policy $$ along with its AWS function $$ for each $$, and the decryptor can compute $$ Previously, the only known attribute based MIFE was for the inner product functionality (Abdalla et al.~Asiacrypt 2020), where additionally, $$ had to be fixed during setup and must remain the same for all ciphertexts in a given slot. Our attribute based MIFE implies the notion of multi-input {\it attribute based encryption} (\miabe) recently studied by Agrawal, Yadav and Yamada (Crypto 2022) and Francati, Friolo, Malavolta and Venturi (Eurocrypt 2023), for a conjunction of predicates represented as arithmetic branching programs (ABP). Along the way, we also provide the first constructions of multi-client FE (MCFE) and dynamic decentralized FE (DDFE) for the AWS functionality. Previously, the best known MCFE and DDFE schemes were for inner products (Chotard et al.~ePrint 2018, Abdalla, Benhamouda and Gay, Asiacrypt 2019, and Chotard et al.~Crypto 2020). Our constructions are based on pairings and proven selectively secure under the matrix DDH assumption.

Note: fixed an editorial error