Pith. sign in

REVIEW 3 major objections 5 minor 39 references

Multi-client Functional Encryption for Set Intersection with Non-monotonic Access Structures in Federated Learning

T0 review · 3 major / 5 minor · reviewed 2026-08-11 · deepseek-v4-flash

Challenge this review Re-run · record.json Download PDF Read on arXiv ↗ Review JSON

Pith's one-line read The paper proposes a multi-client functional encryption scheme for set intersection in which non-monotonic access policies let an aggregator compute an intersection only when its attributes satisfy the policy.

desk verdict New combination, broken write-up: Setup omits the r that Enc and KeyGen need, and the proof silently sets a_k=b_k; not acceptable as is, but a major revision could salvage the idea. read the letter →

arxiv 2412.09259 v1 pith:RZPCWA3M submitted 2024-12-12 cs.CR

Ruyuan Zhang , Jinguang Han This is my paper · ORCID
classification cs.CR MSC 94A60
keywords functionalencryptionsetintersectionaccesscontrolfederatedlearningnon-monotonicstructuremulti-clientbilinearpairingciphertextlabel
verification ladder T0 review T1 audit T2 compute T3 formal

The pith

A machine-rendered reading of the paper's core claim, the machinery that carries it, and where it could break.

The reading

The paper sets out to add non-monotonic access control to multi-client functional encryption for set intersection, a tool aimed at federated learning. In the proposed MCFE-SI-NAS scheme, each client encrypts its set independently under a shared label, and an aggregator can compute the intersection of two clients' plaintext sets only when the attribute set attached to the ciphertexts satisfies the aggregator's policy. The policies are non-monotonic, so they can contain AND, OR, NOT, and threshold gates, which earlier MCFE-SI schemes with access control could not express. The construction works over asymmetric prime-order pairings, resists mix-and-match attacks via labels, and is claimed to be passively secure (P-IND) in the random oracle model under the paper's stated assumptions.

What carries the argument

The mechanism that carries the argument is label-bound ciphertext indexing over an asymmetric prime-order bilinear map $e: G \times \hat{G} \to G_T$. Each plaintext element is hashed together with the label $\mathit{Tag}$, and the resulting hash is raised to the client's own exponent $a_k$; equal elements from two clients produce equal pairing values when tested against the function-key components $\hat{g}^{a_w \dot{r}}$ and $\hat{g}^{a_v \dot{r}}$. Access control is layered on through a non-monotonic structure $\tilde{\mathbb{A}} = \mathrm{NM}(\mathbb{A})$ implemented with a linear secret-sharing scheme: non-negated attributes are encoded through the vector $u_0^{r}\prod_{i=1}^{d} u_i^{y_i}$ and negated attributes through a companion encoding $h_1^{r y_1}\prod_{i=2}^{d} h_i^{y_i}$, where $Y = (y_1,\ldots,y_d)$ is the coefficient vector of the polynomial $P_S[X] = \prod_{j\in S}(X-j)$ built from the ciphertext attribute set $S$. The decryption procedure cancels these policy factors with the key shares $\lambda_i$ and reconstruction coefficients $\pi_i$, leaving exactly $M_{w,\eta}\cdot e(H(M_{w,\eta}\cdot\mathit{Tag}), \hat{g}^r)^{b_w}$, from which the indexing equation removes the residual $b_w$ term.

What would settle it

Follow Section 3 exactly: Setup never produces $r$, while KeyGen and Enc both require $r$, so an exact implementation cannot run without inventing an additional parameter; if different parties choose their own $r$, the central pairing equations no longer cancel and decryption outputs garbage.

Watch

Extended reading notes

Core claim

The central discovery is a recipe for making set-intersection functional encryption policy-aware without giving up non-interactive client encryption. Concretely, the paper constructs a scheme in which client $k$ encrypts each element $M_{k,\eta}$ under its own key $(a_k,b_k)$ and the shared label $\mathit{Tag}$, producing $ct^{(0)}_{k,\eta} = M_{k,\eta} \cdot e(g,\hat{g})^{\tilde{\alpha} s_k} \cdot e(H(M_{k,\eta}\cdot \mathit{Tag}), \hat{g}^{r})^{b_k}$ and $ct^{(1)}_{k,\eta} = H(M_{k,\eta}\cdot \mathit{Tag})^{a_k}$. A decryption key for $f=(w,v)$ and policy $\tilde{\mathbb{A}}$ contains $\hat{g}^{a_w \dot{r}}$, $\hat{g}^{a_v \dot{r}}$, $\hat{g}^{r b_w/(a_w+a_v)}$, plus policy components that cancel when the ciphertext attribute set satisfies $\tilde{\mathbb{A}}$. The same-label check $e(ct^{(1)}_{w,\eta}, \hat{g}^{a_v \dot{r}}) = e(ct^{(1)}_{v,\eta}, \hat{g}^{a_w \dot{r}})$ identifies equal elements, and the final division recovers $M_{w,\eta}$ exactly. The paper proves P-IND security in the random oracle model under the assumptions in [20] and a variant of the $q$-DBDHE assumption.

Load-bearing premise

The scheme assumes a single random value $r$ is known to the key-issuing authority and to every client during encryption, but the Setup algorithm never samples $r$ or places it in the public parameters; the security proof additionally assumes two per-client secret values can be set equal without changing the key distribution.

Editorial extensions

If this is right

  • An aggregator whose attributes satisfy the policy can compute the intersection of any two clients' plaintext sets and provably learns nothing else about the sets.
  • Labels bind all ciphertexts of one run, so ciphertexts from different runs cannot be spliced to compute unintended intersections.
  • Non-monotonic policies make rules expressible that monotonic-only schemes cannot, such as a history-department aggregator that is explicitly barred from biology-department data.
  • Clients encrypt once and never interact, which fits federated learning settings where clients may come online only briefly.
  • Under the P-IND security notion, an adversary that queries only unauthorized policies cannot distinguish which of two challenge message tuples was encrypted.

Reading between the lines

Editorial extensions of the paper, not claims the author makes directly.

  • The paper leaves implicit that the same label-bound indexing equation could be reused to expose coarser statistics, such as intersection cardinality or union size, without changing the pairing structure.
  • Not addressed in the paper: decentralizing key generation would require a new model and proof, because the security argument assumes one fully trusted authority that knows every client key.
  • A natural extension is to lift the passive P-IND notion to static or adaptive corruption; the provided proof does not cover corrupted clients.
  • The paper's measured encryption cost grows linearly with the number of clients and elements, so precomputation or batched exponentiation would be the first place to make the scheme practical for federated learning.
Share X Bluesky LinkedIn Reddit HN

Signed reviews

No signed human review yet.

Editorial analysis

A structured set of objections, weighed in public.

Desk editor's note, referee report, and a circularity audit.

Referee Report

3 major / 5 minor

Summary. The paper proposes a multi-client functional encryption scheme for set intersection with non-monotonic access structures (MCFE-SI-NAS), intended for federated learning. The scheme is described by four algorithms (Setup, KeyGen, Enc, Dec) in Figures 2-5, with correctness equations in Section 3 and a claimed security proof (Theorem 1) in the random oracle model under assumptions from Lee [20] and a variant of q-DBDHE. The authors also report an implementation and efficiency measurements. The central claim is that this is the first MCFE-SI scheme supporting non-monotonic (AND, OR, NOT, threshold) policies, with formal security proof.

Significance. If the construction were correct and instantiable, the contribution would be meaningful: it extends MCFE for set intersection to support non-monotonic access structures, which existing MCFE-SI schemes do not. The use of labels to resist mix-and-match attacks and the independent, non-interactive client encryption are also attractive properties for federated learning. However, the manuscript as written contains load-bearing gaps that prevent the central claim from being accepted: the Setup algorithm does not produce a global exponent r that both Enc and KeyGen rely on, and the security proof simulates a different key distribution than the real scheme. These are not merely presentation issues; they undermine both the instantiation and the proof of Theorem 1. The paper also provides an implementation, but no code or reproducible benchmarks are included, so the efficiency results cannot be independently verified.

major comments (3)
  1. [Figures 2, 3, and 4] The Setup algorithm in Figure 2 outputs pp = (G, Ghat, GT, e, p, g, ghat, e(g,ghat)^tilde_alpha, Hvec, Uvec, H, N) and msk = (tilde_alpha, a_1..a_N, b_1..b_N), but it does not generate or publish a global exponent r. Figure 3 (KeyGen) then says "Let ghat^r, u0^r, h1^r be public," and Figure 4 (Enc) computes c_t2,k = (u0^r * prod u_i^{y_i})^{s_k}, c_t3,k = (h1^{r*y1} * prod h_i^{y_i})^{s_k}, and c_t(0)_{k,eta} = M_{k,eta} * e(g,ghat)^{tilde_alpha s_k} * e(H(M_{k,eta} * Tag), ghat^r)^{b_k}, all of which require ghat^r, u0^r, and h1^r. As written, clients cannot run Enc with the published pp, and if r were chosen independently inside KeyGen or Enc, the correctness equations in Section 3 would not hold because the pairing products would not cancel. The scheme is therefore not instantiable as specified.
  2. [Section 4, Phase-1 function key queries] The simulator answers f=(w,v) queries with sk_f,1 = ghat^{b_w c_{w,v}}, sk_f,2 = ghat^{b_v c_{w,v}}, and sk_f,3 = (ghat^{1/(b_w+b_v)})^{tilde_b_w r}. The real KeyGen in Figure 3 produces sk_f,1 = ghat^{a_w * dot_r}, sk_f,2 = ghat^{a_v * dot_r}, and sk_f,3 = ghat^{r*b_w/(a_w+a_v)}. Matching the first two components forces a_w = b_w and a_v = b_v, and matching the third component then forces tilde_b_w = b_w. No argument is given that setting a_k = b_k is without loss of generality, and the proof does not simulate the actual distribution of a_k and b_k chosen in Setup. Consequently, Theorem 1 establishes security for a different scheme from the one presented in Figures 2-5, so the paper's central claim that the described scheme is P-IND secure is not supported.
  3. [Section 4, Challenge phase] The same a_k = b_k mismatch appears in the challenge ciphertext simulation. For k < rho, in the case (M*_{k,eta,mu} in E*_k) and (M*_{k,eta,mu} = M*_{rho,eta,mu}), the simulator sets ct(1)_{k,eta} = g^{a b_i} and e(H(M*_{k,eta,mu} * Tag*), ghat^r)^{b_k} = e(g^a, ghat^r)^{b_k}. But in the real Enc, ct(1)_{k,eta} = H(M_{k,eta} * Tag)^{a_k}, which would require a_k = b_k to match the simulated value. This reinforces the previous point: the simulated ciphertexts are not distributed as in the real scheme unless the independent a_k, b_k from Setup are artificially equated.
minor comments (5)
  1. [Section 2.2, Definitions 2-4] The advantage expressions contain malformed formatting: "|||Pr[...]=1||| <= epsilon(lambda)" should be an absolute value, and the double bars are likely meant to denote absolute value but are displayed incorrectly. Please fix the notation in all three definitions.
  2. [Throughout] There are many typos and LaTeX errors, including "simulatior" (Section 4), "clssified" (Section 4), "massage sets" (Section 2.6), and "interaction" for "intersection" in the introduction. A careful proofreading pass is needed.
  3. [Section 3, Correctness] The correctness equations are unnumbered and several steps mix elements from G and Ghat in what appears to be a single expression, for example in the negated-attribute derivation. This makes the correctness argument harder to verify; please rewrite with clear group membership and equation numbers.
  4. [Table 1] The table uses "#" for the access structure of the related MCFE-SI schemes [19,21,20,31]. This symbol is not defined; presumably it means that no access control is supported, but it should be stated explicitly.
  5. [Section 5] The implementation section reports average running times over five runs but gives no standard deviation, no hardware/software details beyond the laptop model, and no code or artifact link. The efficiency analysis would be more credible with at least a confidence interval or a description of the test methodology.

Circularity Check

0 steps flagged · score 0.0 of 10

No circularity found: the scheme relies on external assumptions and prior MCFE-SI work; the noted Setup/proof defects are soundness gaps, not self-referential reductions.

full rationale

No load-bearing circular step is present. The construction in Figures 2-5 is a composition of asymmetric pairings, non-monotonic LSSS policy keys, and ciphertext indexing; the security proof in Theorem 1 reduces directly to the external assumption of Lee [20] and the asymmetric q-DBDHE variant, both stated in Definitions 2 and 4 with no dependence on the present paper's conclusions. The authors cite no result of their own as the basis for correctness or security, so there is no self-citation chain and no uniqueness theorem imported from the authors' prior work. There is also no fitted quantity relabeled as a prediction and no definition of MCFE-SI-NAS that presupposes the claimed theorem. Two skeptical concerns are real but are not circularity: (1) Setup (Figure 2) outputs pp without the exponent r, while Enc (Figure 4) and KeyGen (Figure 3) use r, and the sentence 'Let ghat^r, u0^r, h1^r be public' appears only in KeyGen; this makes the algorithms not instantiable from Setup's output. (2) In the Phase-1 simulation the simulator selects only b_1,...,b_N and forms sk_f,1=ghat^{b_w c}, sk_f,2=ghat^{b_v c}, sk_f,3=(ghat^{1/(b_w+b_v)})^{tilde_b_w r}, whereas real keys use independent a_w,a_v; matching these forces a_w=b_w, a_v=b_v, and tilde_b_w=b_w without a stated wlog argument, so Theorem 1's proof may simulate a different distribution. Both defects undermine correctness and security as written, but neither is an equation that reduces the claimed result to its own inputs. The honest circularity verdict is therefore no significant circularity.

Assumptions & free parameters 1 free parameters · 5 assumptions · 0 invented entities

The central claim depends on the existence of secure bilinear groups and the stated hardness assumptions, plus ideal hash functions. No new entities are introduced.

free parameters (1)
  • global exponent r = unspecified
    Enc and KeyGen use r in ct_2, ct_3, and sk_f3, but Setup does not generate it, making the scheme underspecified.
assumptions (5)
  • domain assumption Definition 2 assumption from Lee [20] holds
    Used in the security proof (Section 4).
  • domain assumption Variant of q-DBDHE assumption holds
    Used in the security proof (Section 4).
  • domain assumption Random oracle model for hash function H
    Security proof is in the random oracle model.
  • domain assumption Type-III bilinear groups exist and are efficient
    Construction is based on asymmetric prime-order pairings.
  • standard math LSSS and access structure properties (Proposition 1)
    Used in KeyGen and security proof.

how reviews work

0 comments
Cite this review

Pith. "Pith review of Multi-client Functional Encryption for Set Intersection with Non-monotonic Access Structures in Federated Learning." pith.science (2026). https://pith.science/paper/RZPCWA3M

@misc{pith2026241209259,
  author       = {Pith},
  title        = {Pith review of: Multi-client Functional Encryption for Set Intersection with Non-monotonic Access Structures in Federated Learning},
  year         = {2026},
  howpublished = {\url{https://pith.science/paper/RZPCWA3M}},
  note         = {Machine review of arXiv:2412.09259}
}
read the original abstract

Federated learning (FL) based on cloud servers is a distributed machine learning framework that involves an aggregator and multiple clients, which allows multiple clients to collaborate in training a shared model without exchanging data. Considering the confidentiality of training data, several schemes employing functional encryption (FE) have been presented. However, existing schemes cannot express complex access control policies. In this paper, to realize more flexible and fine-grained access control, we propose a multi-client functional encryption scheme for set intersection with non-monotonic access structures (MCFE-SI-NAS), where multiple clients co-exist and encrypt independently without interaction. All ciphertexts are associated with an label, which can resist "mix-and-match" attacks. Aggregator can aggregate ciphertexts, but cannot know anything about the plaintexts. We first formalize the definition and security model for the MCFE-SI-NAS scheme and build a concrete construction based on asymmetric prime-order pairings. The security of our scheme is formally proven. Finally, we implement our MCFE-SI-NAS scheme and provide its efficiency analysis.

Figures

Figures reproduced from arXiv: 2412.09259 by the authors.

Figure 1
Figure 1. System model of our MCFE-SI-NAS scheme. 𝑆𝑒𝑡𝑢𝑝(1𝜆 , 𝑑, 𝑁) → (𝑠𝑘, 𝑐𝑠𝑘1 , 𝑐𝑠𝑘2 , ..., 𝑐𝑠𝑘𝑁 , 𝑝𝑝). The algorithm is executed by the TA, and takes as input a se￾curity parameter 1 𝜆 , a preset attribute number 𝑑 and a client number 𝑁. It outputs a secret key 𝑠𝑘, client encryption keys 𝑐𝑠𝑘1 , 𝑐𝑠𝑘2 , ..., 𝑐𝑠𝑘𝑁 and public parameters 𝑝𝑝, where master secret keys are 𝑚𝑠𝑘 = {𝑠𝑘, 𝑐𝑠𝑘1 , 𝑐𝑠𝑘2 , ..., 𝑐𝑠𝑘𝑁 }. 𝐾𝑒𝑦𝐺𝑒𝑛(𝑚𝑠𝑘, 𝑝𝑝, 𝑓, 𝔸̃… view at source ↗
Figure 2
Figure 2. The Setup algorithm of our MCFE-SI-NAS scheme. 𝐾𝑒𝑦𝐺𝑒𝑛(𝑚𝑠𝑘, 𝑝𝑝, 𝑓, 𝔸̃) → 𝑆𝐾𝔸̃,𝑓 . Given an index function 𝑓 = (𝑤, 𝑣) such that 𝑤, 𝑣 ∈ [1, 𝑁] and 𝑤 < 𝑣, it picks randomly ̇𝑟, 𝑟 ∈ 𝑍𝑝 and calculates {𝑠𝑘𝑓,1 , 𝑠𝑘𝑓,2 , 𝑠𝑘𝑓,3 } as follows using the corresponding client encryption keys 𝑐𝑠𝑘𝑤 = {𝑎𝑤, 𝑏𝑤}, 𝑐𝑠𝑘𝑣 = {𝑎𝑣 , 𝑏𝑣 }: 𝑠𝑘𝑓,1 = ̂𝑔 𝑎𝑤⋅ ̇𝑟 , 𝑠𝑘𝑓,2 = ̂𝑔 𝑎𝑣 ⋅ ̇𝑟 , 𝑠𝑘𝑓,3 = ̂𝑔 𝑟⋅𝑏𝑤 𝑎𝑤+𝑎𝑣 . Let ̂𝑔 𝑟 , 𝑢𝑟 0 , ℎ𝑟 1 be public. 𝔸̃ den… view at source ↗
Figure 3
Figure 3. The KeyGen algorithm of our MCFE-SI-NAS scheme. Proof. We first define the following intersection function 𝑆𝐼𝐹((𝑀𝜂 )𝜂∈[𝑁] , ). Given a tuple (𝑀𝑘 )𝑘∈[𝑁] and a index set  = {(𝑤, 𝑣)}, 𝑆𝐼𝐹((𝑀𝑘 )𝑘∈[𝑁] , ) is able to calculate the collected intersection of the 𝑀𝑤 and 𝑀𝑣 for every (𝑤, 𝑣) ∈ . Function 𝑆𝐼𝐹((𝑀𝑘 )𝑘∈[𝑁] , ) where  = {(𝑤, 𝑣)} Set 𝐸𝑘 = ∅ for all 𝑘 ∈ [𝑁]. For each (𝑤, 𝑣) ∈  : Compute the intersection set 𝑆𝐼… view at source ↗
Figures from the paper (3 more)
Figure 4
Figure 4. Figure 4: The Enc algorithm of the MCFE-SI-NAS scheme. 𝐷𝑒𝑐(𝑝𝑝, 𝐶𝑇𝑤, 𝐶𝑇𝑣 , 𝑆𝐾𝔸̃,𝑓 ) → 𝑀𝑤 ⋂𝑀𝑣∕ ⟂. Aggregator requests data from CSP and is responded with the ciphertexts 𝐶𝑇𝑤 and 𝐶𝑇𝑣 . Assume that the attribute set 𝑆 in the ciphertext matches successfully the non-monotonic access s…
Figure 5
Figure 5. Figure 5: The Dec algorithm of the MCFE-SI-NAS scheme. (1) Public key for comment element. It selects a random value 𝜗 ∈ 𝑍𝑝 and computes 𝑒(𝑧1 , ̂𝑧𝑛 ) 𝜗 = 𝑒(𝑔, ̂𝑔) 𝛾 𝑛+1𝜗 from the tuple. Hence, the master key ̃𝛼 is implicitly set as ̃𝛼 = 𝛾 𝑛+1𝜗 (2) Public keys for non-negated att…
Figure 6
Figure 6. Figure 6: The computation cost of our MCFE-SI-NAS scheme [16] Goyal, V., Pandey, O., Sahai, A., Waters, B., 2006. Attribute-based encryption for fine-grained access control of encrypted data, in: CCS 2006, Association for Computing Machinery, New York, NY, USA. pp. 89–98. [17] H…

Discussion (0). Continue with ORCID to comment.

Reference graph

Works this paper leans on

39 extracted references · 36 canonical work pages

  1. [20]

    Decentralized multi-client functional encryption for set intersection with improved efficiency

    Lee, K., 2023. Decentralized multi-client functional encryption for set intersection with improved efficiency. Designs, Codes and Cryptography 91, 1053–1093

    work page 2023

  2. [1]

    Inner-product functionalencryptionwithfine-grainedaccesscontrol,in:Moriai,S., Wang,H.(Eds.),ASIACRYPT2020,SpringerInternationalPublish- ing, Daejeon, Korea

    Abdalla, M., Catalano, D., Gay, R., Ursu, B., 2020. Inner-product functionalencryptionwithfine-grainedaccesscontrol,in:Moriai,S., Wang,H.(Eds.),ASIACRYPT2020,SpringerInternationalPublish- ing, Daejeon, Korea. pp. 467–497

    work page 2020

  3. [2]

    Multi-party functional encryption, in: Nissim, K., Waters, B

    Agrawal, S., Goyal, R., Tomida, J., 2021. Multi-party functional encryption, in: Nissim, K., Waters, B. (Eds.), TCC 2021, Springer, Cham, Raleigh, NC, USA. pp. 224–255

    work page 2021

  4. [3]

    Asymmetric private set intersec- tion with applications to contact tracing and private vertical fed- erated machine learning

    Angelou, N., Benaissa, A., Cebere, B., Clark, W., Hall, A.J., Hoeh, M.A., Liu, D., Papadopoulos, P., Roehm, R., Sandmann, R., Schopp- mann, P., Titcombe, T., 2020. Asymmetric private set intersec- tion with applications to contact tracing and private vertical fed- erated machine learning. URL: https://arxiv.org/abs/2011.09350, arXiv:2011.09350

    arXiv 2020

  5. [4]

    How to backdoor federated learning, in: Chiappa, S., Calandra, R

    Bagdasaryan, E., Veit, A., Hua, Y., Estrin, D., Shmatikov, V., 2020. How to backdoor federated learning, in: Chiappa, S., Calandra, R. (Eds.), AISTATS 2020, PMLR. pp. 2938–2948

    work page 2020

  6. [5]

    Identity-based encryption from the weil pairing

    Boneh, D., Franklin, M., 2003. Identity-based encryption from the weil pairing. SIAM Journal on Computing 32, 586–615

    work page 2003

  7. [6]

    Functional encryption: Definitions and challenges, in: Ishai, Y

    Boneh, D., Sahai, A., Waters, B., 2011. Functional encryption: Definitions and challenges, in: Ishai, Y. (Ed.), TCC 2011, Springer Berlin Heidelberg, Berlin, Heidelberg. pp. 253–273

    work page 2011

  8. [7]

    Privacy-preserving federated learning via functional encryption, revisited

    Chang, Y., Zhang, K., Gong, J., Qian, H., 2023. Privacy-preserving federated learning via functional encryption, revisited. IEEE Trans- actions on Information Forensics and Security 18, 1855–1869

    work page 2023

Show all 39 references
  1. [8]

    Secure and efficient federated learning via novel multi-party computation and compressed sensing

    Chen, L., Xiao, D., Yu, Z., Zhang, M., 2024. Secure and efficient federated learning via novel multi-party computation and compressed sensing. Information Sciences 667. URL: https: //www.sciencedirect.com/science/article/pii/S0020025524003943, doi:https://doi.org/10.1016/j.ins...

    2024

  2. [9]

    Chotard, J., Dufour Sans, E., Gay, R., Phan, D.H., Pointcheval, D.,

  3. [10]

    Decentralizedmulti-authorityattribute-based inner-product fe: Large universe and unbounded, in: Boldyreva, A., Kolesnikov,V.(Eds.),PKC2023,Springer,Cham,Atlanta,GA,USA

    Datta,P.,Pal,T.,2023. Decentralizedmulti-authorityattribute-based inner-product fe: Large universe and unbounded, in: Boldyreva, A., Kolesnikov,V.(Eds.),PKC2023,Springer,Cham,Atlanta,GA,USA. pp. 587–621

    2023

  4. [11]

    jpbc:Javapairingbasedcryptography, in: ISCC 2011, Kerkyra, Greece

    DeCaro,A.,Iovino,V.,2011. jpbc:Javapairingbasedcryptography, in: ISCC 2011, Kerkyra, Greece. pp. 850–855

    2011

  5. [12]

    Sacfe: Secure access control in functional encryption with unbounded data, in: EuroS&P 2024, IEEE, Vienna, Austria

    Dowerah,U.,Dutta,S.,Hartmann,F.,Mitrokotsa,A.,Mukherjee,S., Pal, T., 2024. Sacfe: Secure access control in functional encryption with unbounded data, in: EuroS&P 2024, IEEE, Vienna, Austria. pp. 860–882

    2024

  6. [13]

    Privacypreserving federated learning from multi-input functional proxy re-encryption, in: ICASSP 2024, IEEE, Seoul, Korea

    Feng,X.,Shen,Q.,Li,C.,Fang,Y.,Wu,Z.,2024. Privacypreserving federated learning from multi-input functional proxy re-encryption, in: ICASSP 2024, IEEE, Seoul, Korea. pp. 6955–6959

    2024

  7. [14]

    Multi-input functional encryption,in:Nguyen,P.Q.,Oswald,E.(Eds.),EUROCRYPT2014, Springer Berlin Heidelberg, Berlin, Heidelberg

    Goldwasser, S., Gordon, S.D., Goyal, V., Jain, A., Katz, J., Liu, F.H., Sahai, A., Shi, E., Zhou, H.S., 2014. Multi-input functional encryption,in:Nguyen,P.Q.,Oswald,E.(Eds.),EUROCRYPT2014, Springer Berlin Heidelberg, Berlin, Heidelberg. pp. 578–602

    2014

  8. [15]

    Amulti-modalverticalfederatedlearningframeworkbased on homomorphic encryption

    Gong, M., Zhang, Y., Gao, Y., Qin, A.K., Wu, Y., Wang, S., Zhang, Y.,2024. Amulti-modalverticalfederatedlearningframeworkbased on homomorphic encryption. IEEE Transactions on Information Forensics and Security 19, 1826–1839. Ruyuan Zhang et al. Page 11 of 13 MCFE-SI-NAS in Fed...

    2024

  9. [16]

    Attribute-based encryption for fine-grained access control of encrypted data, in: CCS 2006, Association for Computing Machinery, New York, NY, USA

    Goyal, V., Pandey, O., Sahai, A., Waters, B., 2006. Attribute-based encryption for fine-grained access control of encrypted data, in: CCS 2006, Association for Computing Machinery, New York, NY, USA. pp. 89–98

    2006

  10. [17]

    Differentially private set intersection for asymmetrical id alignment

    He, Y., Tan, X., Ni, J., Yang, L.T., Deng, X., 2022. Differentially private set intersection for asymmetrical id alignment. IEEE Trans- actions on Information Forensics and Security 17, 3479–3494

    2022

  11. [18]

    Advances and open problems in federated learning

    Kairouz, P., et al., H.B.M., 2021. Advances and open problems in federated learning. Foundations and Trends® in Machine Learning 14, 1–210

    2021

  12. [19]

    Two- client and multi-client functional encryption for set intersection, in: Jang-Jaccard, J., Guo, F

    van de Kamp, T., Stritzl, D., Jonker, W., Peter, A., 2019. Two- client and multi-client functional encryption for set intersection, in: Jang-Jaccard, J., Guo, F. (Eds.), ACISP 2019, Springer, Cham, Christchurch, New Zealand. pp. 97–115

    2019

  13. [21]

    Functional encryption for set intersection in themulti-clientsetting

    Lee, K., Seo, M., 2022. Functional encryption for set intersection in themulti-clientsetting. Designs,CodesandCryptography90,17–47

    2022

  14. [22]

    Catfl: Certificateless authentication- based trustworthy federated learning for 6g semantic communica- tions

    Li, G., Zhao, Y., Li, Y., 2023. Catfl: Certificateless authentication- based trustworthy federated learning for 6g semantic communica- tions. URL: https://arxiv.org/abs/2302.00271, arXiv:2302.00271

    2023 arXiv

  15. [23]

    A survey on federated learning: a perspective from multi-party computation

    Liu, F., Zheng, Z., Shi, Y., Tong, Y., Zhang, Y., 2024. A survey on federated learning: a perspective from multi-party computation. Frontiers of Computer Science 18. doi: https://doi.org/10.1007/ s11704-023-3282-7

    2024

  16. [24]

    Efficient sample alignment with fast polynomial interpolation for vertical federated learning,in:GLOBECOM2023,KualaLumpur,Malaysia.pp.2596– 2601

    Liu, J., Ma, T., Zhang, H., Liu, W., Pei, Q., 2023. Efficient sample alignment with fast polynomial interpolation for vertical federated learning,in:GLOBECOM2023,KualaLumpur,Malaysia.pp.2596– 2601

    2023

  17. [25]

    Multi-partyprivatesetintersectioninvertical federated learning, in: TrustCom 2020, Guangzhou, China

    Lu,L.,Ding,N.,2020. Multi-partyprivatesetintersectioninvertical federated learning, in: TrustCom 2020, Guangzhou, China. pp. 707– 714

    2020

  18. [26]

    Verifiable de- centralized multi-client functional encryption for inner product, in: Guo,J.,Steinfeld,R.(Eds.),ASIACRYPT2023,Springer,Singapore, Guangzhou, China

    Nguyen, D.D., Phan, D.H., Pointcheval, D., 2023. Verifiable de- centralized multi-client functional encryption for inner product, in: Guo,J.,Steinfeld,R.(Eds.),ASIACRYPT2023,Springer,Singapore, Guangzhou, China. pp. 33–65

    2023

  19. [27]

    Multi-client func- tional encryption with fine-grained access control, in: Agrawal, S., Lin, D

    Nguyen, K., Phan, D.H., Pointcheval, D., 2022. Multi-client func- tional encryption with fine-grained access control, in: Agrawal, S., Lin, D. (Eds.), ASIACRYPT 2022, Springer Nature Switzerland, Taipei, Taiwan. pp. 95–125

    2022

  20. [28]

    Definitional issues in functional encryption

    O’Neill, A., 2010. Definitional issues in functional encryption. Cryptology ePrint Archive, Paper 2010/556. https://eprint.iacr.org/2010/556

    2010

  21. [29]

    De- centralized multi-client functional encryption for inner product with applicationstofederatedlearning

    Qian, X., Li, H., Hao, M., Xu, G., Wang, H., Fang, Y., 2024. De- centralized multi-client functional encryption for inner product with applicationstofederatedlearning. IEEETransactionsonDependable and Secure Computing , 1–16

    2024

  22. [30]

    Cryptofe: Practical and privacy-preserving federated learning via functional encryption, in: GLOBECOM 2022, IEEE, Rio de Janeiro, Brazil

    Qian, X., Li, H., Hao, M., Yuan, S., Zhang, X., Guo, S., 2022. Cryptofe: Practical and privacy-preserving federated learning via functional encryption, in: GLOBECOM 2022, IEEE, Rio de Janeiro, Brazil. pp. 2999–3004. Ruyuan Zhang et al. Page 12 of 13 MCFE-SI-NAS in Federated Learning

    2022

  23. [31]

    Flexible multi-client functional encryption for set intersection

    Rafiee, M., 2023. Flexible multi-client functional encryption for set intersection. The Journal of Supercomputing 79, 13744–13765

    2023

  24. [32]

    Functional encryption: beyond public key cryptography

    Sahai, A., Waters, B., 2008. Functional encryption: beyond public key cryptography. power point presentation, 2008. https://csrc.nist.gov/csrc/media/events/applications-of-pairing- based- cryptography-identi/documents/waters_nist08-keynote.pdf

    2008

  25. [33]

    Multi-client inner product encryption: Function-hidinginstantiationswithoutrandomoracles,in:Boldyreva, A., Kolesnikov, V

    Shi, E., Vanjani, N., 2023. Multi-client inner product encryption: Function-hidinginstantiationswithoutrandomoracles,in:Boldyreva, A., Kolesnikov, V. (Eds.), PKC 2023, Springer Nature Switzerland, Cham. pp. 622–651

    2023

  26. [34]

    Hierarchical identity-based inner product functional encryption

    Song, G., Deng, Y., Huang, Q., Peng, C., Tang, C., Wang, X., 2021. Hierarchical identity-based inner product functional encryption. In- formation Sciences 573, 332–344

    2021

  27. [35]

    Yan, N., Li, Y., Chen, J., Wang, X., Hong, J., He, K., Wang, W.,

  28. [36]

    Federated machine learning:Conceptandapplications

    Yang, Q., Liu, Y., Chen, T., Tong, Y., 2019. Federated machine learning:Conceptandapplications. ACMTransactionsonIntelligent SystemsandTechnology10. URL: https://doi.org/10.1145/3298981, doi:10.1145/3298981

    2019 doi

  29. [37]

    BatchCrypt: Efficient homomorphic encryption for Cross-Silo fed- erated learning, in: USENIX ATC 2020, USENIX Association, CA,USA

    Zhang, C., Li, S., Xia, J., Wang, W., Yan, F., Liu, Y., 2020. BatchCrypt: Efficient homomorphic encryption for Cross-Silo fed- erated learning, in: USENIX ATC 2020, USENIX Association, CA,USA. pp. 493–506. Ruyuan Zhang et al. Page 13 of 13

    2020

  30. [2018]

    (Eds.), ASIACRYPT 2018, Springer International Publishing, Cham

    Decentralized multi-client functional encryption for inner product, in: Peyrin, T., Galbraith, S. (Eds.), ASIACRYPT 2018, Springer International Publishing, Cham. pp. 703–732

    2018

  31. [2024]

    Efficient and straggler-resistant homomorphic encryption for heterogeneous federated learning, in: IEEE INFOCOM 2024, IEEE, Vancouver, BC, Canada. pp. 791–800

    2024

Pith tools

Reviewed August 11, 2026 · model on record in the stance chip above.