Making Public Key Functional Encryption Function Private, Distributively

We put forth a new notion of distributed public key functional encryption. In such a functional encryption scheme, the secret key for a function f will be split into shares \(\mathsf {sk}_i^f\). Given a ciphertext \(\mathsf {ct} \) that encrypts a message x, a secret key share \(\mathsf {sk}_i^f\), one can evaluate and obtain a shared value \(y_i\). Adding all the shares up can recover the actual value of f(x), while partial shares reveal nothing about the plaintext. More importantly, this new model allows us to establish function privacy which was not possible in the setting of regular public key functional encryption. We formalize such notion and construct such a scheme from any public key functional encryption scheme together with learning with error assumption.