Flexible multi-client functional encryption for set intersection

A multi-client functional encryption ($$) scheme [Goldwasser-Gordon-Goyal 2014] for set intersection is a cryptographic primitive that enables an evaluator to learn the intersection from all sets of a predetermined number of clients, without need to learn the plaintext set of each individual client. Using these schemes, it is impossible to compute the set intersections from arbitrary subsets of clients, and thus, this constraint limits the range of its applications. To provide such a possibility, we redefine the syntax and security notions of $$ schemes, and introduce flexible multi-client functional encryption ($$) schemes. We extend the $$ security of $$ schemes to $$ security of $$ schemes in a straightforward way. For a universal set with polynomial size in security parameter, we propose an $$ construction for achieving $$ security. Our construction computes set intersection for n clients that each holds a set with m elements, in time $$. We also prove the security of our construction under DDH1 that it is a variant of the symmetric external Diffie-Hellman (SXDH) assumption.