Two-Client Inner-Product Functional Encryption with an Application to Money-Laundering Detection

In this paper, we extend Inner-Product Functional Encryption (IPFE), where there is just a vector in the key and a vector in the single sender's ciphertext, to two-client ciphertexts. More precisely, in our two-client functional encryption scheme, there are two data providers who can independently encrypt vectors x and y for a data consumer who can, from a functional decryption key associated to a vector α, compute αixiyi = x • Diag(α) • y ⊤ . Ciphertexts are linear in the dimension of the vectors, whereas the functional decryption keys are of constant size. We study two interesting particular cases: -2-party Inner-Product Functional Encryption, with α = (1, . . . , 1). There is a unique functional decryption key, which enables the computation of x • y ⊤ by a third party, where x and y are provided by two independent clients; -Inner-Product Functional Encryption with a Selector, with x = x0∥x1 and y = bn ∥b n ∈ 1 n ∥0 n , 0 n ∥1 n , for some bit b, on the public coefficients α = α0∥α1, in the functional decryption key, so that one gets x b • α ⊤ b , where x and b are provided by two independent clients. This result is based on the fundamental Product-Preserving Lemma, which is of independent interest. It exploits Dual Pairing Vector Spaces (DPVS), with security proofs under the SXDH assumption. We provide two practical applications: to medical diagnosis for the latter IPFE with a selector, and to money-laundering detection for the former 2-party IPFE, both with strong privacy properties, adaptative security and the use of labels granting a Multi-Client Functional Encryption (MCFE) security for the scheme, thus enabling its use in practical situations.