Flexible multi-client functional encryption for set intersection

A multi-client functional encryption ([Formula: see text] ) scheme [Goldwasser–Gordon–Goyal 2014] for set intersection is a cryptographic primitive that enables an evaluator to learn the intersection from all sets of a predetermined number of clients, without need to learn the plaintext set of each individual client. Using these schemes, it is impossible to compute the set intersections from arbitrary subsets of clients, and thus, this constraint limits the range of its applications. To provide such a possibility, we redefine the syntax and security notions of [Formula: see text] schemes, and introduce flexible multi-client functional encryption ([Formula: see text] ) schemes. We extend the [Formula: see text] security of [Formula: see text] schemes to [Formula: see text] security of [Formula: see text] schemes in a straightforward way. For a universal set with polynomial size in security parameter, we propose an [Formula: see text] construction for achieving [Formula: see text] security. Our construction computes set intersection for n clients that each holds a set with m elements, in time [Formula: see text] . We also prove the security of our construction under DDH1 that it is a variant of the symmetric external Diffie–Hellman (SXDH) assumption.