Key-exchange protocols have been overlooked as a possible means for implementing oblivious transfer (OT). In this paper we present a protocol for mutual exchange of secrets, 1-out-of-2 OT and coin flipping similar to Diffie-Hellman protocol using the idea of obliviously exchanging encryption keys. Since, Diffie-Hellman scheme is widely used, our protocol may provide a useful alternative to the conventional methods for implementation of oblivious transfer and a useful primitive in building larger cryptographic schemes.
This paper presents protocols for Kak's cubic transformation and proposes a modification to Diffie-Hellman key exchange protocol in order to achieve asymmetric oblivious exchange of keys.
This paper presents a new efficient protocol for k-out-of-n oblivious transfer which is a generalization of Parakh's 1-out-of-2 oblivious transfer protocol based on Diffie-Hellman key exchange. In the proposed protocol, the parties involved generate Diffie-Hellman keys obliviously and then use them for oblivious transfer of secrets.
This paper proposes an algorithm for oblivious transfer using elliptic curves. Also, we present its application to chosen one-out-of-two oblivious transfer.
In this short note we want to introduce {\em anonymous oblivious transfer} a new cryptographic primitive which can be proven to be strictly more powerful than oblivious transfer. We show that all functions can be robustly realized by multi party protocols with {\em anonymous oblivious transfer}. No assumption about possible collusions of cheaters or disruptors have to be made. Furthermore we shortly discuss how to realize anonymous oblivious transfer with oblivious broadcast or by quantum cryptography. The protocol of anonymous oblivious transfer was inspired by a quantum protocol: the anonymo…
Oblivious transfer is a primitive of paramount importance in cryptography or, more precisely, two- and multi-party computation due to its universality. Unfortunately, oblivious transfer cannot be achieved in an unconditionally secure way for both parties from scratch. Therefore, it is a natural question what information-theoretic primitives or computational assumptions oblivious transfer can be based on. The results in our thesis are threefold. First, we present a protocol that implements oblivious transfer from a weakened oblivious transfer called universal oblivious transfer, where one of th…
We show that stand-alone statistically secure random oblivious transfer protocols based on two-party stateless primitives are statistically universally composable. I.e. they are simulatable secure with an unlimited adversary, an unlimited simulator and an unlimited environment machine. Our result implies that several previous oblivious transfer protocols in the literature which were proven secure under weaker, non-composable definitions of security can actually be used in arbitrary statistically secure applications without lowering the security.
With oblivious transfer multiparty protocols become possible even in the presence of a faulty majority. But all known protocols can be aborted by just one disruptor. This paper presents more robust solutions for multiparty protocols with oblivious transfer. This additional robustness against disruptors weakens the security of the protocol and the guarantee that the result is correct. We can observe a trade off between robustness against disruption and security and correctness. We give an application to quantum multiparty protocols. These allow the implementation of oblivious transfer and the p…
Although random sequences can be used to generate probability events, they come with the risk of cheating in an unsupervised situation. In such cases, the oblivious transfer protocol may be used and this paper presents a variation to the DH key-exchange to serve as this protocol. A method to verify the correctness of the procedure, without revealing the random numbers used by the two parties, is also proposed.
We present an oblivious transfer (OT) protocol that combines the OT scheme of Chou and Orlandi together with thesupersingular isogeny Diffie-Hellman (SIDH) primitive of De Feo, Jao, and Plût. Our construction is a candidate for post-quantum secure OT and demonstrates that SIDH naturally supports OT functionality. We consider the protocol in the simplest configuration of $\binom{2}{1}$-OT and analyze the protocol to verify its security.
We present an oblivious transfer scheme that extends the proposal made by Barreto, Oliveira and Benits, based in isogenies supersingular elliptic curves, to the setting of principally polarized supersingular abelian surfaces.
Oblivious Transfer (OT) is a major primitive for secure multiparty computation. Indeed, combined with symmetric primitives along with garbled circuits, it allows any secure function evaluation between two parties. In this paper, we propose a new approach to build OT protocols. Interestingly, our new paradigm features a security analysis in the Universal Composability (UC) framework and may be instantiated from post-quantum primitives. In order to do so, we define a new primitive named Smooth Projective Hash Function with Grey Zone (SPHFwGZ) which can be seen as a relaxation of the classical Sm…
Privacy is a major concern in designing any cryptographic primitive when frequent transactions are done electronically. During electronic transactions, people reveal their personal data into several servers and believe that this information does not leak too much about them. The adaptive oblivious transfer with hidden access policy (AOT-HAP) takes measure against such privacy issues. The existing AOT-HAP involves a sender and multiple receivers apart from a designated issuer. Security of these schemes rely on the fact that the issuer cannot collude with a set of receivers. Moreover, they loose…
We study the cryptographic primitive Oblivious Transfer; a composable construction of this resource would allow arbitrary multi-party computation to be carried out in a secure way, i.e. to compute functions in a distributed way while keeping inputs from different parties private. First we review a framework that allows us to analyze composability of classical and quantum cryptographic protocols in special relativity: Abstract Cryptography implemented with Causal Boxes. We then (1) explore and formalize different versions of oblivious transfer found in the literature, (2) prove that their equiv…
Oblivious transfer protocols (R-OT and OT$_{1}^{2}$) are presented based on non-orthogonal states transmission, and the bit commitment protocols on the top of OT$_{1}^{2}$ are constructed. Although these OT protocols are all unconditional secure, the bit commitment protocols based on OT protocols are not secure against attack similar to that presented by no-go theorem.
We present a framework for fully-simulatable $h$-out-of-$n$ oblivious transfer ($OT^{n}_{h}$) with security against non-adaptive malicious adversaries. The framework costs six communication rounds and costs at most $40n$ public-key operations in computational overhead. Compared with the known protocols for fully-simulatable oblivious transfer that works in the plain mode (where there is no trusted common reference string available) and proven to be secure under standard model (where there is no random oracle available), the instantiation based on the decisional Diffie-Hellman assumption of the…
We present a device independently secure quantum scheme for p-threshold all-or-nothing oblivious transfer. Novelty of the scheme is that, its security does not depend -- unlike the usual case -- on any quantum bit commitment protocol, rather it depends on Hardy's argument for two-qubit system. This scheme is shown to be unconditionally secure against any strategy allowed by quantum mechanics. By providing a secure scheme for all-or-nothing quantum oblivious transfer, we have answered a long standing open problem, other than the quantum key distribution, whether there is any two-party quantum c…
The oblivious transfer primitive is sufficient to implement secure multiparty computation. However, secure multiparty computation based only on classical cryptography is severely limited by the security and efficiency of the oblivious transfer implementation. We present a method to efficiently and securely generate and distribute oblivious keys by exchanging qubits and by performing commitments using classical hash functions. With the presented hybrid approach, quantum and classical, we obtain a practical and high-speed oblivious transfer protocol, secure even against quantum computer attacks.…
We consider oblivious transfer protocols performed over binary symmetric channels in a malicious setting where parties will actively cheat if they can. We provide constructions purely based on coding theory that achieve an explicit positive rate, the essential ingredient being the existence of linear codes whose Schur products are asymptotically good.
We introduce AOT, an anonymous communication system based on mix network architecture that uses oblivious transfer (OT) to deliver messages. Using OT to deliver messages helps AOT resist blending ($n-1$) attacks and helps AOT preserve receiver anonymity, even if a covert adversary controls all nodes in AOT. AOT comprises three levels of nodes, where nodes at each level perform a different function and can scale horizontally. The sender encrypts their payload and a tag, derived from a secret shared between the sender and receiver, with the public key of a Level-2 node and sends them to a Level-…
A boardroom election is an election with a small number of voters carried out with public communications. We present BVOT, a self-tallying boardroom voting protocol with ballot secrecy, fairness (no tally information is available before the polls close), and dispute-freeness (voters can observe that all voters correctly followed the protocol). BVOT works by using a multiparty threshold homomorphic encryption system in which each candidate is associated with a masked unique prime. Each voter engages in an oblivious transfer with an untrusted distributor: the voter selects the index of a prime a…
In the m-out-of-n oblivious transfer (OT) model, one party Alice sends n bits to another party Bob, Bob can get only m bits from the n bits. However, Alice cannot know which m bits Bob received. Y.Mu[MJV02]} and Naor[Naor01] presented classical m-out-of-n oblivious transfer based on discrete logarithm. As the work of Shor [Shor94], the discrete logarithm can be solved in polynomial time by quantum computers, so such OTs are unsafe to the quantum computer. In this paper, we construct a quantum m-out-of-n OT (QOT) scheme based on the transmission of polarized light and show that the scheme is ro…
Oblivious transfer is a fundamental cryptographic primitive in which Bob transfers one of two bits to Alice in such a way that Bob cannot know which of the two bits Alice has learned. We present an optimal security bound for quantum oblivious transfer protocols under a natural and demanding definition of what it means for Alice to cheat. Our lower bound is a smooth tradeoff between the probability B with which Bob can guess Alice's bit choice and the probability A with which Alice can guess both of Bob's bits given that she learns one of the bits with certainty. We prove that 2B + A is greater…
Network Oblivious Transfer via Noisy Channels: Limits and Capacities
Institute for Communications Technology, Technische Universität Braunschweig（不伦瑞克工业大学通信技术研究所在）；Faculty of Electrical Engineering, K. N. Toosi University of Technology（K. N. 托伊西理工大学电气工程学院）
The bounded storage model restricts the memory of an adversary in a cryptographic protocol, rather than restricting its computational power, making information theoretically secure protocols feasible. We present the first protocols for commitment and oblivious transfer in the bounded storage model with errors, i.e., the model where the public random sources available to the two parties are not exactly the same, but instead are only required to have a small Hamming distance between themselves. Commitment and oblivious transfer protocols were known previously only for the error-free variant of t…
MiniQCrypt is a world where quantum-secure one-way functions exist, and quantum communication is possible. We construct an oblivious transfer (OT) protocol in MiniQCrypt that achieves simulation-security in the plain model against malicious quantum polynomial-time adversaries, building on the foundational work of Bennett, Brassard, Crépeau and Skubiszewska (CRYPTO 1991). Combining the OT protocol with prior works, we obtain secure two-party and multi-party computation protocols also in MiniQCrypt. This is in contrast to the classical world, where it is widely believed that one-way functions al…
We consider oblivious transfer between Alice and Bob in the presence of an eavesdropper Eve when there is a broadcast channel from Alice to Bob and Eve. In addition to the secrecy constraints of Alice and Bob, Eve should not learn the private data of Alice and Bob. When the broadcast channel consists of two independent binary erasure channels, we derive the oblivious transfer capacity for both 2-privacy (where the eavesdropper may collude with either party) and 1-privacy (where there are no collusions).
We derive a new upper bound on the string oblivious transfer capacity of discrete memoryless channels. The main tool we use is the tension region of a pair of random variables introduced in Prabhakaran and Prabhakaran (2014) where it was used to derive upper bounds on rates of secure sampling in the source model. In this paper, we consider secure computation of string oblivious transfer in the channel model. Our bound is based on a monotonicity property of the tension region in the channel model. We show that our bound strictly improves upon the upper bound of Ahlswede and Csiszár (2013).
We study oblivious transfer (OT) between Alice and Bob in the presence of an eavesdropper Eve over a degraded wiretapped binary erasure channel from Alice to Bob and Eve. In addition to the privacy goals of oblivious transfer between Alice and Bob, we require privacy of Alice and Bob's private data from Eve. In previous work we derived the OT capacity (in the honest-but-curious model) of the wiretapped binary independent erasure channel where the erasure processes of Bob and Eve are independent. Here we derive a lower bound on the OT capacity in the same secrecy model when the wiretapped binar…
On (Im)possibility of Network Oblivious Transfer via Noisy Channels and Non-Signaling Correlations
Institute for Communications Technology, Technical University of Braunschweig（布伦瑞克工业大学通信技术研究所）；Chair of Theoretical Information Technology, Technical University of Munich（慕尼黑大学理论信息技术讲席）
Oblivious transfer (OT) is an important tool in cryptography. It serves as a subroutine to other complex procedures of both theoretical and practical significance. Common attribute of OT protocols is that one party (Alice) has to send a message to another party (Bob) and has to stay oblivious on whether Bob did receive the message. Specific (OT) protocols vary by exact definition of the task - in the all-or-nothing protocol Alice sends a single bit-string message, which Bob is able to read only with 50% probability, whereas in 1-out-of-2 OT protocol Bob reads one out of two messages sent by Al…
We propose an information theoretic framework for the secure two-party function computation (SFC) problem and introduce the notion of SFC capacity. We study and extend string oblivious transfer (OT) to sample-wise OT. We propose an efficient, perfectly private OT protocol utilizing the binary erasure channel or source. We also propose the bootstrap string OT protocol which provides disjoint (weakened) privacy while achieving a multiplicative increase in rate, thus trading off security for rate. Finally, leveraging our OT protocol, we construct a protocol for SFC and establish a general lower b…
Oblivious transfer protocol is a basic building block in cryptography and is used to transfer information from a sender to a receiver in such a way that, at the end of the protocol, the sender does not know if the receiver got the message or not. Since Shor's quantum algorithm appeared, the security of most of classical cryptographic schemes has been compromised, as they rely on the fact that factoring is unfeasible. To overcome this, quantum mechanics has been used intensively in the past decades, and alternatives resistant to quantum attacks have been developed in order to fulfill the (poten…
We propose one of the very few constructive consequences of the second law of thermodynamics. More specifically, we present protocols for secret-key establishment and multiparty computation the security of which is based fundamentally on Landauer's principle. The latter states that the erasure cost of each bit of information is at least kTln2 (where k is Boltzmann's constant and T is the absolute temperature of the environment). Albeit impractical, our protocols explore the limits of reversible computation, and the only assumption about the adversary is her inability to access a quantity of fr…
Oblivious transfer is a powerful cryptographic primitive that is complete for secure multi-party computation. In oblivious transfer protocols a user sends one or more messages to a receiver, while the sender remains oblivious as to which messages have been received. Protocols for oblivious transfer cannot exist in a classical or fully-quantum world, but can be implemented by restricting the users' power. The isolated qubits model is a cryptographic model in which users are restricted to single-qubit operations and are not allowed to use entangling operations. Furthermore, all parties are allow…
We present a simple and practical quantum protocol involving two mistrustful agencies in Minkowski space, which allows Alice to transfer data to Bob at a spacetime location that neither can predict in advance. The location depends on both Alice's and Bob's actions. The protocol guarantees unconditionally to Alice that Bob learns the data at a randomly determined location; it guarantees to Bob that Alice will not learn the transfer location even after the protocol is complete. The task implemented, transferring data at a space-time location that remains hidden from the transferrer, has no preci…
In this paper, we study the problem of the 1-of-2 string oblivious transfer (OT) between Alice and Bob in the presence of a passive eavesdropper Eve. The eavesdropper Eve is not allowed to get any information about the private data of Alice or Bob. When Alice and Bob are honest-but-curious users, we propose a protocol that satisfies $1$-private (neither Alice nor Bob colludes with Eve) OT requirements for the binary erasure symmetric broadcast channel, in which the channel provides dependent erasure patterns to Bob and Eve. We find that when the erasure probabilities satisfy certain conditions…
Noisy channels are a powerful resource for cryptography as they can be used to obtain information-theoretically secure key agreement, commitment and oblivious transfer protocols, among others. Oblivious transfer (OT) is a fundamental primitive since it is complete for secure multi-party computation, and the OT capacity characterizes how efficiently a channel can be used for obtaining string oblivious transfer. Ahlswede and Csiszár (\emph{ISIT'07}) presented upper and lower bounds on the OT capacity of generalized erasure channels (GEC) against passive adversaries. In the case of GEC with erasu…
We present a new template for building oblivious transfer from quantum information that we call the "fixed basis" framework. Our framework departs from prior work (eg., Crepeau and Kilian, FOCS '88) by fixing the correct choice of measurement basis used by each player, except for some hidden trap qubits that are intentionally measured in a conjugate basis. We instantiate this template in the quantum random oracle model (QROM) to obtain simple protocols that implement, with security against malicious adversaries: 1. Non-interactive random-input bit OT in a model where parties share EPR pairs a …
We present a simplified framework for proving sequential composability in the quantum setting. In particular, we give a new, simulation-based, definition for security in the bounded-quantum-storage model, and show that this definition allows for sequential composition of protocols. Damgard et al. (FOCS '05, CRYPTO '07) showed how to securely implement bit commitment and oblivious transfer in the bounded-quantum-storage model, where the adversary is only allowed to store a limited number of qubits. However, their security definitions did only apply to the standalone setting, and it was not clea…
Oblivious Transfer (OT) is a fundamental cryptographic protocol that finds a number of applications, in particular, as an essential building block for two-party and multi-party computation. We construct a round-optimal (2 rounds) universally composable (UC) protocol for oblivious transfer secure against active adaptive adversaries from any OW-CPA secure public-key encryption scheme with certain properties in the random oracle model (ROM). In terms of computation, our protocol only requires the generation of a public/secret-key pair, two encryption operations and one decryption operation, apart…
It is well known that unconditionally secure bit commitment is impossible even in the quantum world. In this paper a weak variant of quantum bit commitment, introduced independently by Aharonov et al. [STOC, 2000] and Hardy and Kent [Phys. Rev. Lett. 92 (2004)] is investigated. In this variant, the parties require some nonzero probability of detecting a cheating, i.e. if Bob, who commits a bit b to Alice, changes his mind during the revealing phase then Alice detects the cheating with a positive probability (we call this property binding); and if Alice gains information about the committed bit…
A blind decryption scheme enables a user to query decryptions from a decryption server without revealing information about the plaintext message. Such schemes are useful, for example, for the implementation of privacy preserving encrypted file storages and payment systems. In terms of functionality, blind decryption is close to oblivious transfer. For noiseless channels, information-theoretically secure oblivious transfer is impossible. However, in this paper we show that this is not the case for blind decryption. We formulate a definition of perfect secrecy of symmetric blind decryption for t…
Robust and leakage-resilient device-independent oblivious transfer in MiniQCrypt
Centre for Quantum Technologies, Singapore（新加坡量子技术中心）；Department of Computer Science, National University of Singapore（新加坡国立大学计算机系）；MajuLab, UMI 3654, Singapore（新加坡UMI 3654 MajuLab）
