Deniable Functional Encryption.
Angelo De, Vincenzo Iovino, Adam O’Neill · 2015
Abstract. Deniable encryption, first introduced by Canetti et al. (CRYPTO 1997), allows a sender and/or receiver of encrypted communication to produce fake but authentic-looking coins and/or secret keys that “open” the communication to a different message. Here we initiate its study for the more general case of functional encryption (FE), as introduced by Boneh et al. (TCC 2011), wherein a receiver in possession of a key k can compute from any encryption of a message x the value F (k, x) according to the scheme’s functionality F. Our results are summarized as follows: We put forth and motivate the concept of deniable FE, for which we con-sider two models. In the first model, as previously considered by O’Neill et al. (CRYPTO 2011) in the case of identity-based encryption, a re-ceiver gets assistance from the master authority to generate a fake secret key. In the second model, there are “normal ” and “deniable ” secret keys, and a receiver in possession of a deniable secret key can produce a fake but authentic-looking normal key on its own. This parallels the “multi-