 Hello everyone, I will briefly discuss our new result constraint hiding constraint PRFs for any circuit from standard lattice assumptions. This is a joint work with Chris Pickert. So first let's recall the definition of the constraint hiding constraint PRF. A constraint hiding constraint PRF is a normal PRF which has this nice property. Given a circuit C, we can produce by V, I mean anyone who holds the secret key for the PRF. We can produce a constraint version of the PRF. And what does that mean? That means that this constraint version of the PRF satisfies all these three properties informally. So as long as the circuit C, so as long as the input to the input X, as long as C of X is 0, the value of the constraint PRF and the true value of the PRF match. But if the C of X is 1, then the constraint version of the PRF reveals nothing about the true value of the PRF. And furthermore, the constraint version of the PRF hides the circuit C. Now, in PKT 2017, 2017, Bonnet, Levy, and Wu defined the notion of defined constraint hiding constraint PRFs and gave a construction using based on indistinguishability obfuscation. Later in EuroCrip 2017, Bonnet, Keem, and Montgomery gave a construction which supported this circuit class of equality check circuits. And in the same conference, Canetti and Chen gave a construction for NC1 circuits, circuits with logarithmic depth. Both of these two constructions were based on standard lattice assumptions. In our work, we give a lattice-based construction which supports basically all polynomial size circuits. As a bonus, we also construct lattice-based private programmable PRFs. And what is a private programmable PRF? If you attended this morning's talk, then you would remember that it's a constraint hiding constraint PRF for the circuit class of equality check circuits, which allows us to program the value of the PRF at the constraint point. So, let's have a high level, brief high level overview of our techniques. Our core technique is a way to secretly embed any function g. And by any function g in particular, I mean function g that are independent of the PRF inside the, so we can hide any function g inside the constraint PRF, such that if we evaluate the constraint PRF, the value equals the true value of the PRF plus the value of g evaluated at that point. So, with this technique, now it is easy to, with this technique, we set g to be c times an auxiliary PRF. And this auxiliary PRF can be any PRF based on any assumption. It's independent of the PRF we are constructing. And with this g that we defined, it's not hard to see why we are now having a constraint hiding constraint PRF. When c of x equals 0, then g also equals 0, so the value, the true value and the constraint value match. But when c equals 1, then g, the value of g equals the value of the auxiliary PRF. And that completely hides the true value of the PRF. That was it. Thank you.