Cryptographic Treatment of CryptDB's Adjustable Join

In this document, we provide a cryptographic treatment of the adjustable join protocol from CryptDB. We also discuss how our scheme could be used outside of CryptDB because it provides a simple functionality that may be needed in other settings. Intuitively, it is a pseudorandom permutation where an external party not knowing the secret key can nonetheless adjust a ciphertext under one key to a ciphertext under a different key, given an adjustment token from a party that knows the secret key