In recent years, there has been great interest in Functional Encryption (FE), a generalization of traditional encryption where a token enables a user to learn a specific function of the encrypted data and nothing else. In this paper we put forward a new generalization of FE that we call M ergeable FE (mFE). In a mFE system, given a ciphertext c 1 encrypting m 1 and a ciphertext c 2 encrypting m 2 , it is possible to produce in an oblivious way (i.e., given only the public-key and without

more »

... ge of the messages, master secret-key or any other auxiliary information) a ciphertext encrypting the string m 1 ||m 2 under the security constraint that this new ciphertext does not leak more information about the original messages than what may be leaked from the new ciphertext using the tokens.