In this paper, we introduce two new cryptographic primitives: functional digital signatures and functional pseudorandom functions.In a functional signature scheme, in addition to a master signing key that can be used to sign any message, there are signing keys for a function f , which allow one to sign any message in the range of f . As a special case, this implies the ability to generate keys for predicates P , which allow one to sign any message m, for which P (m) = 1.We show applications of functional signatures to constructing succinct non-interactive arguments and delegation schemes. We give several general constructions for this primitive based on different computational hardness assumptions, and describe the trade-offs between them in terms of the assumptions they require and the size of the signatures.In a functional pseudorandom function, in addition to a master secret key that can be used to evaluate the pseudorandom function F on any point in the domain, there are additional secret keys for a function f , which allow one to evaluate F on any y for which there exists an x such that f (x) = y. As a special case, this implies pseudorandom functions with selective access, where one can delegate the ability to evaluate the pseudorandom function on inputs y for which a predicate P (y) = 1 holds. We define and provide a sample construction of a functional pseudorandom function family for prefix-fixing functions.This work appeared in part as the Master Thesis of Ioana Ivan filed May 22 at MIT. We note that independently the notion of pseudorandom functions with selective access was studied by BonehWaters under the name of constrained pseudorandom functions

Motivated by the goal of securely searching and updating distributed data, we introduce and study the notion of function secret sharing (FSS). This new notion is a natural generalization of distributed point functions (DPF), a primitive that was recently introduced by Gilboa and Ishai (Eurocrypt 2014). Given a positive integer p ≥ 2 and a class F of functions f : {0, 1} n → G, where G is an Abelian group, a p-party FSS scheme for F allows one to split each f ∈ F into p succinctly described functions fi : {0, 1} n → G, 1 ≤ i ≤ p, such that: (1) p i=1 fi = f , and (2) any strict subset of the fi hides f . Thus, an FSS for F can be thought of as method for succinctly performing an "additive secret sharing" of functions from F . The original definition of DPF coincides with a twoparty FSS for the class of point functions, namely the class of functions that have a nonzero output on at most one input.We present two types of results. First, we obtain efficiency improvements and extensions of the original DPF construction. Then, we initiate a systematic study of general FSS, providing some constructions and establishing relations with other cryptographic primitives. More concretely, we obtain the following main results:-Improved DPF. We present an improved (two-party) DPF construction from a pseudorandom generator (PRG), reducing the length of the key describing each fi from O(λ • n log 2 3 ) to O(λn), where λ is the PRG seed length. -Multi-party DPF. We present the first nontrivial construction of a p-party DPF for p ≥ 3, obtaining a near-quadratic improvement over a naive construction that additively shares the truth-table of f . This constrcution too can be based on any PRG. -FSS for simple functions. We present efficient PRG-based FSS constructions for natural function classes that extend point functions, including interval functions and partial matching functions. -A study of general FSS. We show several relations between general FSS and other cryptographic primitives. These include a construction of general FSS via obfuscation, an indication for the

We initiate the study of extractability obfuscation, a notion first suggested by Barak et al. (JACM 2012): An extractability obfuscator eO for a class of algorithms M guarantees that if an efficient attacker A can distinguish between obfuscations eO(M1), eO(M2) of two algorithms M1, M2 ∈ M, then A can efficiently recover (given M1 and M2) an input on which M1 and M2 provide different outputs.-We rely on the recent candidate virtual black-box obfuscation constructions to provide candidate constructions of extractability obfuscators for NC 1 ; next, following the blueprint of Garg et al. (FOCS 2013), we show how to bootstrap the obfuscator for NC 1 to an obfuscator for all non-uniform polynomial-time Turing machines. In contrast to the construction of Garg et al., which relies on indistinguishability obfuscation for NC 1 , our construction enables succinctly obfuscating non-uniform Turing machines (as opposed to circuits), without turning running-time into description size. -We introduce a new notion of functional witness encryption, which enables encrypting a message m with respect to an instance x, language L, and function f , such that anyone (and only those) who holds a witness w for x ∈ L can compute f (m, w) on the message and particular known witness. We show that functional witness encryption is, in fact, equivalent to extractability obfuscation. -We demonstrate other applications of extractability extraction, including the first construction of fully (adaptive-message) indistinguishability-secure functional encryption for an unbounded number of key queries and unbounded message spaces. -We finally relate indistinguishability obfuscation and extractability obfuscation and show special cases when indistinguishability obfuscation can be turned into extractability obfuscation.

No abstract

We consider the problem of securely generating useful instances of two-party correlations, such as many independent copies of a random oblivious transfer (OT) correlation, using a small amount of communication. This problem is motivated by the goal of secure computation with silent preprocessing, where a low-communication input-independent setup, followed by local ("silent") computation, enables a lightweight "non-cryptographic" online phase once the inputs are known.Recent works of Boyle et al. (CCS 2018, Crypto 2019) achieve this goal with good concrete efficiency for useful kinds of two-party correlations, including OT correlations, under different variants of the Learning Parity with Noise (LPN) assumption, and using a small number of "base" oblivious transfers. The protocols of Boyle et al. have several limitations. First, they require a large number of communication rounds. Second, they are only secure against semi-honest parties. Finally, their concrete efficiency estimates are not backed by an actual implementation. In this work we address these limitations, making three main contributions: • Eliminating interaction. Under the same assumption, we obtain the first concretely efficient 2-round protocols for generating useful correlations, including OT correlations, in the semi-honest security model. This implies the first efficient 2-round OT extension protocol of any kind and, more generally, protocols for non-interactive secure computation (NISC) that are concretely efficient and have the silent preprocessing feature.