# non-interactive secure computation with a twist?

non-interactive secure computation (NISC) (introduced by this paper, followed by others) is a variant of secure 2PC/MPC defined as the following setting:

Alice publishes an encrypted version of f(*, y), such that Bob or anyone else who knows some x can construct a message m that reveals f(x, y) to Alice (without requiring any other interaction with Alice).

However, in the current proposals Bob would not be able to learn f(x, y) without the help of Alice, if I understand correctly. But that's exactly what I want. In contrast to the NISC literature, neither Bob's privacy of x nor that of f(x, y) is important to me. Just the privacy of y is important. Does anyone know if this is possible/already proposed somewhere?

• Are you asking for Alice to send a single message, so that Bob learns $f(x,y)$ without sending anything himself? Commented Jun 23, 2021 at 6:38
• Yes! Sorry for not being clear right away Commented Jun 28, 2021 at 14:49

If Alice is the only person to speak, but Bob can learn output, then the protocol must leak more than just $$f(x,y)$$. See:
Essentially, Bob can choose many different $$y_i$$ values and re-run the protocol to learn many different $$f(x,y_i)$$ outputs. Since Bob never speaks in the protocol, he can do all this "in his head", without Alice's involvement. So the best you can hope for is that the protocol leaks no more to Bob than an oracle for the residual function $$f(x,\cdot)$$.
For some functions $$f$$, achieving this "best possible" leakage is impossible. Theorem 2.3 of the paper has an example (in which $$f$$ is a pseudorandom function and $$x$$ is its seed). For other functions, "best possible" leakage is equivalent to just giving out $$x$$ in the clear. So it's not always clear what you can get from this limited-interaction model.