Adaptively Secure Laconic Function Evaluation for $\mathsf {NC}^1$

Abstract

Laconic Function Evaluation (LFE) protocols, introduced by Quach et al. in FOCS’18, allow two parties to evaluate functions laconically, in the following manner: first, Alice sends a compressed “digest” of some function – say $\mathscr {C}$ – to Bob. Second, Bob constructs a ciphertext for his input $M$ given the digest. Third, Alice, after getting the ciphertext from Bob and in full knowledge of her circuit, can recover $\mathscr {C}( M )$ and (ideally) nothing more about Bob’s message. The protocol is said to be laconic if the sizes of the digest, common reference string ($\mathsf {crs}$) and ciphertext are much smaller than the circuit size $|\mathscr {C}|$.

Quach et al.  put forward a construction of laconic function evaluation for general circuits under the learning with errors (LWE) assumption (with sub-exponential approximation factors), where all parameters grow polynomially with the depth but not the size of the circuit. Under LWE, their construction achieves the restricted notion of selective security where Bob’s input $M$ must be chosen non-adaptively before even the $\mathsf {crs}$ is known.

In this work, we provide the first construction of LFE for $\mathsf {NC}^1$, which satisfies adaptive security from the ring learning with errors assumption (with polynomial approximation factors). The construction is based on the functional encryption scheme by Agrawal and Rosen (TCC 2017).