[Ppm] A new cryptographic primitive for streaming PPM applications

[Xiangfu Song <[e-mail]>]

Hi PPM,

We (Xiangfu Song, Jianli Bai, Ye Dong, Yijian Liu, Yu Zhang, Xianhui Lu,
Tianwei Zhang) would like to introduce our new work, streaming function
secret sharing and its applications, which may be related to the ongoing
PPM standardization.

We understand that function secret sharing (FSS), such as distributed point
function (DPF), serves as one of the underlying techniques in PPM.
Commonly, a clients use FSS to encode its data as a function, shares the
function using a pair of FSS keys, and distributes the FSS keys between two
servers. After collecting keys from clients, the servers can compute
aggregation using these keys. This is a common paradigm for applications
such as Popular [1] and Mastic [2]. In short, FSS provides a mechanism to
secret-share a function $f$ between the servers and allows the servers to
non-interactively share $f(x)$ for any public $x$. This paradigm supports
many useful applications as considered by PPM.

Streaming Function Secret Sharing (SFSS) is a variant of FSS in the
streaming setting, where messages are continuously sent, and secure
computation tasks are repeatedly performed over incoming
messages.

SFSS allows a client to perform a *one-time* setup by distributing a pair
of SFSS keys between the servers. Later, the client can send only a single
ciphertext $c_j$ message, encrypting a streaming message $m_j$ in round
$j$. By applying the SFSS keys over $c_j$ and any public $x$, the servers
can share $f(x)*m_j$ non-interactively. We note that SFSS supports many
streaming messages after a one-time key setup. Namely, the SFSS keys are
*reusable* across many streaming messages.

We find that SFSS would save significant communication for certain
applications in the streaming setting because each SFSS streaming
ciphertext is of constant size after the one-time SFSS key setup, while the
FSS-based approach requires sending a fresh pair of keys for each
message. For example, SFSS can extend the weighted/attribute-based
aggregation in Mastic [2] to the streaming setting. We have more results on
SFSS constructions and applications in our paper at
https://eprint.iacr.org/2025/2304.

We are looking forward to comments and feedback, and wish you a happy
holiday.

Best regards,

Xiangfu Song
Nanyang Technological University, Singapore.

[1] Boneh, Dan, et al. "Lightweight techniques for private heavy hitters."
2021 IEEE Symposium on Security and Privacy (SP). IEEE, 2021.

[2] Mouris, Dimitris, et al. "Mastic: Private weighted heavy-hitters and
attribute-based metrics." Proceedings on Privacy Enhancing Technologies
(2025).