Multi-input Non-interactive Functional Encryption: Constructions and Applications.

We consider a non-interactive secure computation protocol that we call multi-input non-interactive functional encryption (MINI-FE). In a MINI-FE protocol for some class of functionalities F , N users independently and non-interactively setup their own pairs of public- and secret-keys. Each user i∈{1, … ,N} , with knowledge of the public-keys of all other participants, its own secret-key, an identifier and a functionality F, can encode its own input x_i to produce a ciphertext _i . There is a public evaluation function that, given N ciphertexts _1,… ,_N for the same identifier and functionality F, outputs F(x_1,… ,x_n) . Moreover, the same public keys can be reused for an unbounded number of computations (for different identifiers). The security essentially guarantees that for any two tuples of inputs that map to the same value under a functionality, the corresponding tuples of ciphertexts are computationally indistinguishable to adversaries that can also corrupt a subset of the users. MINI-FE shares some similarities with decentralized multi-client functional encryption (DMCFE) [Chotard et al. - Asiacrypt ’18] but, unlike DMCFE and alike dynamic DMCFE (DDMCFE) [Chotard et al. - Crypto ’20], in MINI-FE there is no interaction in the setup phase. Unlike DDMCFE and similarly to traditional secure computation, there is no concept of token and thus the leakage of information is limited to the execution of each computation for a given identifier. In MINI-FE each user can completely work independently and the entire protocol can be executed over a broadcast channel (e.g., a distributed ledger) with just a single message from each user in both the setup and encoding phases. We give an instantiation of a MINI-FE protocol for the Inner-Product functionality from bilinear groups; previous constructions were only known for the summation functionality. We show applications of our protocol to private stream aggregation and secure quadratic voting.