# Is there an application of fully homomorphic encryption scheme such that encryption key and evaluation key are different?

I want know if there is an application of FHE contains three kinds of users such that:

1. $A$ is the data owner and she has the secret key.
2. $B$ only has the permissions to encrypt (just like a general user).
3. $C$ has the permissions to both encrypt and evaluate (just like the cloud or other servers)

Dose this kind of application of FHE make sense? And it is under the condition that encryption key and evaluation key are different. However, I haven't seen the application like this.

On the literature, these are called 'keyed fully homomorphic encryptions', with three keys: $\mathit{pk}$ is the public encryption key, $\mathit{sk}$ is the secret decryption key, and $\mathit{ek}$ is the secret evaluation key.
Moreover, for keyed FHE, you can actually define and achieve IND-CCA security: the reason why IND-CCA is impossible for FHE is the malleability, and when the adversary does not have the homomorphic evaluation ability, the attacker can no longer carry out the obvious CCA attack, so to an 'outsider' without $\mathit{ek}$, the scheme can be IND-CCA, but of course to an 'insider' with $\mathit{ek}$, the scheme can be at most IND-CPA.
• Thanks, and one more question about the IND-CCA security of keyed-FHE. In the game, the adversary does not know $ek$ as you say, but it seems that it still has the access of the evaluation oracle, right? So the adversary still has a strategy like $Dec_{sk}( Eval_{ek}( +,y, 0))$, I am not understand about the methodology of the construction of keyed-FHE totally. – TeamBright Nov 27 '17 at 10:04