Briefing
The core research problem is the inability to conduct a fair, private, and atomic exchange of a function’s output over secret data on a blockchain without revealing the data itself. Traditional cryptographic solutions, such as adaptor signatures, only support an “all-or-nothing” exchange, forcing the seller to reveal their entire secret or nothing at all, while smart contract solutions are inefficient and costly. This paper introduces Functional Adaptor Signatures (FAS) , a novel cryptographic primitive that allows a buyer to atomically receive only the evaluation of a function $f(x)$ upon payment, while the seller’s secret data $x$ remains cryptographically protected via a new security property called witness privacy. This breakthrough fundamentally enables the creation of efficient, private, and trustless data markets, significantly expanding the utility of blockchains like Bitcoin for complex, privacy-preserving transactions.
Context
Before this work, the foundational challenge in trustless data exchange was a binary choice between two flawed models. The first model, relying on smart contracts, allowed for complex conditional logic, but was prohibitively expensive, inefficient, and compromised the seller’s data privacy. The second model, utilizing traditional adaptor signatures (e.g. for atomic swaps), offered efficiency and atomicity but operated on an “all-or-nothing” basis → the buyer either extracted the entire secret witness $x$ or the transaction failed. This theoretical limitation prevented the creation of a system for “functional sales,” where a buyer pays for and receives only the result of a computation $f(x)$, not the raw input data $x$.
Analysis
Functional Adaptor Signatures (FAS) fundamentally re-architect the cryptographic signature primitive by integrating concepts from functional encryption. The core mechanism involves the seller creating a signature that is adaptable not to the secret $x$, but to the function output $f(x)$. The seller first commits to their secret data $x$. The buyer then pays, and the seller reveals an adaptor, $sigma$, which is tied to $x$.
Critically, the FAS construction ensures that the buyer can use $sigma$ to compute the desired function output $f(x)$ and complete the transaction, but cannot computationally reverse $f(x)$ to learn the underlying secret $x$. This is enforced by the new security notion of witness privacy , which guarantees that the buyer learns nothing beyond the intended function output, thereby achieving a fair, atomic, and private functional sale.
Parameters
- Supported Function Class → The most efficient constructions of FAS are presented for linear functions , forming the basis for practical deployment in current systems.
- Core Security Notion → The primitive satisfies the zero-knowledge notion of witness privacy , which is the strongest guarantee that the buyer learns absolutely nothing about the secret data $x$ beyond the output $f(x)$.
Outlook
The introduction of Functional Adaptor Signatures opens a new avenue of research into combining the atomicity of adaptor signatures with the privacy of functional encryption. Future work will focus on extending FAS to support more complex, non-linear functions, such as polynomial or arbitrary circuit evaluations, which would unlock a significantly broader range of private computations. Strategically, this primitive is poised to become a foundational building block for decentralized, private data marketplaces and verifiable machine learning on-chain, allowing data providers to monetize their models or sensitive datasets without ever exposing the underlying intellectual property or raw data.
