Function-Hiding Inner-Product Techniques

• Function-hiding inner-product techniques are encryption methods that reveal only the inner product of two hidden vectors while protecting the individual inputs.
• The approach employs pairing-based cryptography on the BLS12-381 curve, using optimized scalar multiplications and shared multi-pairing to achieve practical performance.
• It balances constrained output ranges and memory demands with robust security, making it a viable primitive for privacy-preserving edge computing deployments.

Function-hiding inner-product techniques are a class of functional encryption methods in which decryption reveals only an inner product $\langle \boldsymbol{x}, \boldsymbol{y} \rangle$ while intending to hide both the encrypted vector $\boldsymbol{y}$ and the function vector $\boldsymbol{x}$. In the pairing-based setting examined in "Privacy-Preserving Edge Computing from Pairing-Based Inner Product Functional Encryption" (Banerjee, 2 Apr 2025), the relevant technique is function-hiding inner product encryption (FHIPE), instantiated not through a new cryptographic construction but through an efficient implementation of the scheme of Kim et al. (SCN 2018) on the BLS12-381 pairing-friendly elliptic curve. The resulting framework positions FHIPE as a practical primitive for privacy-preserving edge computing, especially when the computation can be expressed as a bounded inner product.

1. Functional-encryption setting and the meaning of function hiding

Functional encryption (FE) is organized around the principle that decryption should reveal a prescribed function of encrypted data rather than the data itself. Within FE, inner-product encryption (IPE) specializes to the case where ciphertexts encrypt a vector $\boldsymbol{y}$, secret or functional keys encode a vector $\boldsymbol{x}$, and decryption returns the inner product

$\langle \boldsymbol{x}, \boldsymbol{y} \rangle.$

The function-hiding variant, FHIPE, is the form in which both vectors are intended to remain hidden and only the inner product is revealed (Banerjee, 2 Apr 2025).

The deployment model described in the paper is a two-party style computation. An encryptor holds a private input vector $\boldsymbol{y}$, a decryptor holds a functional key corresponding to a private function vector $\boldsymbol{x}$, and decryption reveals only $\langle \boldsymbol{x}, \boldsymbol{y} \rangle$. In the application settings discussed, this means that a client’s signal or fingerprint can remain hidden, while model weights or a database vector also remain hidden.

The paper is explicit that its contribution is not a new function-hiding construction. The FHIPE syntax, correctness relation, and security intent are inherited from the scheme of Kim et al.; the contribution lies in software realization, optimization, and deployment on an edge device using BLS12-381. This distinction is central to the topic: in this line of work, “function-hiding inner-product techniques” refers both to the underlying cryptographic method and to the implementation strategies that determine whether the method is operationally viable.

2. Bilinear-group formulation and cryptographic structure

The construction is pairing-based. The ambient algebraic setting uses bilinear groups $G_1$, $\boldsymbol{y}$0, and $\boldsymbol{y}$1 of prime order $\boldsymbol{y}$2, with

$\boldsymbol{y}$3

and bilinearity

$\boldsymbol{y}$4

Although the background notation is described as typographically inconsistent in places, the algorithmic presentation makes clear that the intended setting is the asymmetric pairing model $\boldsymbol{y}$5 (Banerjee, 2 Apr 2025).

The implementation uses BLS12-381, with curve equation

$\boldsymbol{y}$6

prime field size $\boldsymbol{y}$7, subgroup order size $\boldsymbol{y}$8, embedding degree $\boldsymbol{y}$9, and estimated security level $\boldsymbol{x}$0-bit. The paper contrasts this with BN-254 at $\boldsymbol{x}$1-bit and BN-462 at $\boldsymbol{x}$2-bit, and motivates BLS12-381 as a widely adopted point in the practical-security design space.

A further structural feature is the sextic twist $\boldsymbol{x}$3 of BLS12-381, together with an isomorphism

$\boldsymbol{x}$4

where

$\boldsymbol{x}$5

This twist representation is used to represent one source group, simplifying pairing arithmetic and compressing elements. The paper attributes to this design a $\boldsymbol{x}$6 reduction in ciphertext size relative to an uncompressed alternative.

The security assumptions are not restated in full. The implementation paper inherits the assumptions of the Kim et al. FHIPE construction and emphasizes practical realization rather than new assumption formulations. A plausible implication is that the main research interest here is less the definition of a new hardness basis than the study of how far an established pairing-based FHIPE primitive can be pushed on constrained hardware.

3. Core FHIPE algorithms and correctness conditions

The scheme operates over vectors $\boldsymbol{x}$7, with an invertible matrix

$\boldsymbol{x}$8

and its associated dual-form matrix

$\boldsymbol{x}$9

Let $\boldsymbol{y}$0 be a polynomial-size set of admissible inner products.

The setup algorithm

$\boldsymbol{y}$1

samples an invertible matrix $\boldsymbol{y}$2 and outputs public parameters

$\boldsymbol{y}$3

together with a master secret key

$\boldsymbol{y}$4

Key generation

$\boldsymbol{y}$5

chooses random $\boldsymbol{y}$6 and returns

$\boldsymbol{y}$7

where

$\boldsymbol{y}$8

Encryption

$\boldsymbol{y}$9

chooses random $\boldsymbol{x}$0 and returns

$\boldsymbol{x}$1

where

$\boldsymbol{x}$2

Decryption

$\boldsymbol{x}$3

computes

$\boldsymbol{x}$4

and

$\boldsymbol{x}$5

Using

$\boldsymbol{x}$6

one obtains

$\boldsymbol{x}$7

Decryption therefore reduces to finding $\boldsymbol{x}$8 such that

$\boldsymbol{x}$9

If such $\langle \boldsymbol{x}, \boldsymbol{y} \rangle.$0 exists, it is the inner product; otherwise the output is $\langle \boldsymbol{x}, \boldsymbol{y} \rangle.$1 (Banerjee, 2 Apr 2025).

The correctness condition is correspondingly bounded: correctness holds iff

$\langle \boldsymbol{x}, \boldsymbol{y} \rangle.$2

If entries satisfy

$\langle \boldsymbol{x}, \boldsymbol{y} \rangle.$3

then

$\langle \boldsymbol{x}, \boldsymbol{y} \rangle.$4

The paper therefore requires

$\langle \boldsymbol{x}, \boldsymbol{y} \rangle.$5

and emphasizes the stronger practical condition

$\langle \boldsymbol{x}, \boldsymbol{y} \rangle.$6

because decryption uses a bounded discrete logarithm over a manageable interval.

This bounded-range requirement is not incidental. It is a defining practical property of this style of FHIPE: the hidden-function evaluation is efficient only when the revealed inner product is known in advance to lie in a suitably small set.

4. Leakage model, bounded discrete logarithms, and operational constraints

The intended privacy guarantee is that the ciphertext hides $\langle \boldsymbol{x}, \boldsymbol{y} \rangle.$7 except for what is implied by the inner product, and the functional key hides $\langle \boldsymbol{x}, \boldsymbol{y} \rangle.$8 except for what is implied by that same output. The pairing computation, together with the randomizers $\langle \boldsymbol{x}, \boldsymbol{y} \rangle.$9 and $\boldsymbol{y}$0 and the hidden basis matrices $\boldsymbol{y}$1 and $\boldsymbol{y}$2, collapses the encoded structures into a relation in $\boldsymbol{y}$3 that depends only on $\boldsymbol{y}$4.

At the same time, the paper is clear about residual exposure. The decryptor learns the value of the inner product and therefore any information inferable from repeated observations of such outputs. Operational leakage also includes the vector dimension $\boldsymbol{y}$5, ciphertext length $\boldsymbol{y}$6, the selected discrete-log search bound $\boldsymbol{y}$7 or equivalently

$\boldsymbol{y}$8

and application-level metadata (Banerjee, 2 Apr 2025).

The bounded discrete logarithm is recovered with Baby-Step Giant-Step (BSGS). For

$\boldsymbol{y}$9

the implementation precomputes

$\boldsymbol{x}$0

sets

$\boldsymbol{x}$1

and iterates through giant steps until a match with a baby-step entry is found, yielding

$\boldsymbol{x}$2

The paper also addresses signed values through modular encoding. If $\boldsymbol{x}$3, it is encoded as

$\boldsymbol{x}$4

After discrete-log recovery, if

$\boldsymbol{x}$5

the output is decoded as

$\boldsymbol{x}$6

This requires choosing $\boldsymbol{x}$7 so that positive and negative representatives remain disjoint.

A common misconception is that function hiding eliminates all leakage apart from the stated output. The implementation study does not claim such a theorem. Instead, it highlights the bounded-output and repeated-query realities of deployment. This suggests that in practical systems, function hiding should be interpreted as protecting the vectors against direct recovery while still leaving application-level inference risks attached to the observable sequence of inner-product outputs.

5. Implementation techniques on BLS12-381

The software framework is built in MIRACL and is described as constant-time, with execution time independent of secrets and including “state-of-the-art side-channel countermeasures.” The implementation uses MIRACL’s 64-bit limb representation for 381-bit field elements, with extra “word excess” and “field excess” bits to accelerate modular arithmetic.

Encryption requires $\boldsymbol{x}$8 scalar multiplications in the ciphertext group. To accelerate this step, the implementation uses the GLS method on BLS12-381, exploiting an efficient endomorphism. For a point $\boldsymbol{x}$9 and scalar $\langle \boldsymbol{x}, \boldsymbol{y} \rangle$0,

$\langle \boldsymbol{x}, \boldsymbol{y} \rangle$1

where $\langle \boldsymbol{x}, \boldsymbol{y} \rangle$2, $\langle \boldsymbol{x}, \boldsymbol{y} \rangle$3, and

$\langle \boldsymbol{x}, \boldsymbol{y} \rangle$4

The decomposition is four-dimensional and converts one long scalar multiplication into a multi-scalar multiplication using precomputed points

$\langle \boldsymbol{x}, \boldsymbol{y} \rangle$5

together with lookup tables of combinations

$\langle \boldsymbol{x}, \boldsymbol{y} \rangle$6

The reported timing for traditional 4-bit-window scalar multiplication in $\langle \boldsymbol{x}, \boldsymbol{y} \rangle$7 is 4.16 ms, while the optimized GLS-based scalar multiplication is 1.62 ms, yielding approximately $\langle \boldsymbol{x}, \boldsymbol{y} \rangle$8 speedup (Banerjee, 2 Apr 2025).

Decryption is accelerated through multi-pairing. The generic form is

$\langle \boldsymbol{x}, \boldsymbol{y} \rangle$9

with the two main pairing phases identified as Miller Loop (ML) and Final Exponentiation (FE). The optimization strategy studies three cases: no sharing, shared FE only, and shared ML and FE. Compared to no sharing, sharing FE gives up to $G_1$0 speedup, and sharing both ML and FE gives another $G_1$1 speedup, for a total pairing-stage decryption improvement of about $G_1$2.

The bounded discrete-log stage is also optimized. Instead of generating the BSGS table solely through repeated multiplications, the implementation uses Knuth’s power tree and replaces many multiplications with Granger-Scott cyclotomic squarings in the target group. The measured target-group costs are 20.4 $G_1$3s for multiplication and 10.1 $G_1$4s for cyclotomic squaring, and the power-tree method yields about 25% faster table generation than repeated multiplication alone. The lookup strategy remains a constant-time brute-force search; the paper notes that hash-table lookup can be faster, but it was not used because of prohibitive memory overhead for large $G_1$5.

These design choices expose the technique’s practical logic. The cryptographic construction is fixed, but performance is determined by a combination of curve choice, endomorphism exploitation, shared pairing work, constant-time engineering, and memory-sensitive discrete-log recovery.

6. Complexity, empirical performance, and application profiles

The asymptotic costs reported in the paper are explicit. Encryption has time

$G_1$6

dominated by $G_1$7 scalar multiplications, and memory

$G_1$8

due to storage of $G_1$9. Decryption has time

$\boldsymbol{y}$00

where $\boldsymbol{y}$01 arises from the $\boldsymbol{y}$02-fold multi-pairing and $\boldsymbol{y}$03 from bounded discrete-log recovery, with memory

$\boldsymbol{y}$04

typically dominated by the BSGS lookup table for large $\boldsymbol{y}$05 (Banerjee, 2 Apr 2025).

The concrete benchmarking platform is a Raspberry Pi 4 Model B with a 1.8 GHz quad-core ARM Cortex-A72, 8 GB LPDDR4-3200 RAM, 128 GB microSDXC storage, 64-bit Raspberry Pi OS kernel 5.15, GCC 10.2.1 with -O3, and the MIRACL Core library. All reported aggregate results were averaged over 10,000 runs.

For the comparison point used against the earlier practical implementation of Kim et al., with

$\boldsymbol{y}$06

the reported values are as follows.

Metric	Kim et al.	This work
Encrypt	71.4 ms	165 ms
Decrypt	366.4 ms	266 ms
Ciphertext	17.7 KB	18.9 KB

The comparison is notable because the BLS12-381 implementation runs on a 1.8 GHz Raspberry Pi 4B, whereas the earlier baseline used MNT6-224 on a 4.0 GHz Intel Core i7. The paper emphasizes that the newer implementation operates at approximately 126-bit security rather than approximately 80-bit security, yet still achieves comparable ciphertext size and faster decryption.

The application case studies further illustrate how practicality depends jointly on vector dimension and output range. For encrypted biomedical sensor data classification, two linear classifiers are implemented. The ECG case uses dimension $\boldsymbol{y}$07 and $\boldsymbol{y}$08, with Encrypt at 307 ms and Decrypt at 1004 ms. The EEG case uses dimension $\boldsymbol{y}$09 and $\boldsymbol{y}$10, with Encrypt at 291 ms and Decrypt at 1567 ms. The larger decryption times reflect the cost of bounded discrete-log recovery over a substantial range.

For secure wireless fingerprint-based indoor localization, the toy setting uses $\boldsymbol{y}$11 access points and $\boldsymbol{y}$12 locations, with transformed vector dimension

$\boldsymbol{y}$13

and discrete-log parameter

$\boldsymbol{y}$14

The reported per-distance computation costs are Encrypt at 12 ms and Decrypt at 29 ms. This lower-dimensional, small-range regime is much more favorable.

A plausible implication is that the dominant practical variable is not merely the dimension $\boldsymbol{y}$15, but the joint regime of $\boldsymbol{y}$16 and the admissible output range. The paper’s own summary supports this reading: encryption grows linearly with $\boldsymbol{y}$17, whereas decryption grows with both $\boldsymbol{y}$18 and $\boldsymbol{y}$19, ciphertext size grows linearly with $\boldsymbol{y}$20, encryption memory scales as $\boldsymbol{y}$21, and decryption memory scales as $\boldsymbol{y}$22.

7. Significance, limitations, and place in the broader research landscape

The work establishes that pairing-based FHIPE can be implemented efficiently enough for privacy-preserving edge computing on resource-constrained hardware, provided that the application admits moderate vector dimensions and tightly bounded inner products (Banerjee, 2 Apr 2025). The primary technical message is not the invention of a new function-hiding mechanism, but the demonstration that an existing one can remain practical when moved to a modern and widely adopted curve with substantially higher security than older deployments.

Several limitations are equally central. First, the bounded discrete logarithm is a fundamental bottleneck rather than a secondary implementation detail. Even with optimized scalar multiplication and shared multi-pairing, decryption becomes expensive when the possible inner-product range is large. Second, memory pressure is structurally important: encryption stores the $\boldsymbol{y}$23 matrix $\boldsymbol{y}$24, while decryption may require large BSGS tables. Third, function hiding does not eliminate application-level inference from repeated outputs or metadata.

The paper therefore locates function-hiding inner-product techniques in a specific practical niche. They are well suited to quantized signals, low-to-moderate dimensions, and tasks in which the output range can be tightly constrained. They are less attractive when the output must span a large interval or when very high-dimensional computations are required at high frequency.

Within the broader FE literature, this work suggests that the maturity of some pairing-based FHIPE constructions has shifted part of the research frontier from purely cryptographic design toward realization questions: curve selection, multi-pairing strategy, endomorphism-based acceleration, constant-time table lookup, serialization, and memory-aware deployment. In that sense, the paper serves as a detailed case study of how function-hiding inner-product techniques move from bilinear-group abstractions to operational edge systems.