In this article, the authors cryptanalyze a k-out-of-n oblivious transfer protocol proposed in [12 Jain , A. , and C. Hari . 2010 . A New Efficient Protocol for k-out-of-n Oblivious Transfer , Cryptologia , 34 ( 4 ): 282 – 290 .[Taylor & Francis Online], [Web of Science ®] , [Google Scholar]]. Their protocol is one of the most efficient k-out-of-n oblivious transfer protocols and is directly built from a 1-out-of-n oblivious transfer protocol. However, their analysis shows that the proposed k-out-of-n oblivious transfer protocol is insecure, though the primitive 1-out-of-n oblivious transfer protocol is secure. The weakness is that with high probability the receiver in their protocol can get all n secret messages encrypted by the sender. Finally, they fix the serious flaw and introduce an improved k-out-of-n oblivious transfer protocol without increasing any cost.
In this article, the authors cryptanalyze a k-out-of-n oblivious transfer protocol proposed in [12 Jain , A. , and C. Hari . 2010 . A New Efficient Protocol for k-out-of-n Oblivious Transfer , Cryptologia , 34 ( 4 ): 282 – 290 .[Taylor & Francis Online], [Web of Science ®] , [Google Scholar]]. Their protocol is one of the most efficient k-out-of-n oblivious transfer protocols and is directly built from a 1-out-of-n oblivious transfer protocol. However, their analysis shows that the proposed k-out-of-n oblivious transfer protocol is insecure, though the primitive 1-out-of-n oblivious transfer protocol is secure. The weakness is that with high probability the receiver in their protocol can get all n secret messages encrypted by the sender. Finally, they fix the serious flaw and introduce an improved k-out-of-n oblivious transfer protocol without increasing any cost.
A new k-out-of-n oblivious transfer protocol is presented in this paper. The communication cost of our scheme are n+1 messages of sender to receiver and k messages from the receiver to sender. To the best knowledge of the authors, the communication complexity of our scheme is the least. Also, our scheme has a lower computation cost with (k+1)n modular exponentiations for sender and 3k modular exponentiations for the receiver. The security of our scheme is only based on the Decision Diffie-Hellman assumption. Further, we proved the sender’s computational security and the receiver’s unconditional security under standard model.
Oblivious transfer (OT) protocol is an essential tool in cryptography that provides a wide range of applications such as secure multi-party computation, private information retrieval, private set intersection, contract signing, and privacy-preserving location-based services. The OT protocol has different variants such as one-out-of-2, one-out-of- n , k -out-of- n , and OT extension. In the OT (one-out-of-2, one-out-of- n , and OT extension) protocol, the sender has a set of messages, whereas the receiver has a key. The receiver sends that key to the sender in a secure way; the sender cannot get any information about the received key. The sender encrypts every message by operating on every message using the received key and sends all the encrypted messages to the receiver. The receiver is able to extract only the required message using his key. However, in the k -out-of- n OT protocol, the receiver sends a set of k keys to the sender, and in replay, the sender sends all the encrypted messages. The receiver uses his keys and extracts the required messages, but it cannot gain any information about the messages that it has not requested. Generally, the OT protocol requires high communication and computation cost if we transfer millions of oblivious messages. The OT extension protocol provides a solution for this, where the receiver transfers a set of keys to the sender by executing a few numbers of OT protocols. Then, the sender encrypts all the messages using cheap symmetric key cryptography with the help of a received set of keys and transfers millions of oblivious messages to the receiver. In this work, we present different variants of OT protocols such as one-out-of-2, one-out-of- n , k -out-of- n , and OT extension. Furthermore, we cover various aspects of theoretical security guarantees such as semi-honest and malicious adversaries, universally composable, used techniques, computation, and communication efficiency aspects. From the analysis, we found that the semi-honest adversary-based OT protocols required low communication and computation costs as compared to malicious adversary-based OT protocols.
Oblivious transfer is an important cryptographic protocol in various security applications. For example, in on-line transactions, a k-out-of-n oblivious transfer scheme allows a buyer to privately choose k out of n digital goods from a merchant without learning information about other n-k goods. In this paper, we propose several efficient two-round k-out-of-n oblivious transfer schemes, in which the receiver R sends O(k) messages to the sender S, and S sends O(n) messages back to R. The schemes provide unconditional security for either sender or receiver. The computational security for the other side is based on the Decisional Diffie-Hellman (DDH) or Chosen-Target Computational Diffie-Hellman (CT-CDH) problems. Our schemes have the nice property of universal parameters, that is, each pair of R and S need not hold any secret before performing the protocol. The system parameters can be used by all senders and receivers without any trapdoor specification. In some cases, our OTkn schemes are the most efficient ones in terms of the communication cost, either in rounds or the number of messages. Moreover, one of our schemes is extended to an adaptive oblivious transfer scheme. In that scheme, S sends O(n) messages to R in one round in the commitment phase. For each query of R, only O(1) messages are exchanged and O(1) operations are performed. The preliminary version of this paper was published at PKC '05 [Chu and Tzeng 2005].
Abstract: Oblivious transfer is an important cryptographic protocol in various security applications. For example, in on-line transactions, a k-out-of-n oblivious transfer scheme allows a buyer to privately choose k out of n digital goods from a merchant without learning information about other n−k goods. In this paper, we propose several efficient two-round k-out-of-n oblivious transfer schemes, in which the receiver R sends O(k) messages to the sender S, andS sends O(n) messages back to R. The schemes provide unconditional security for either sender or receiver. The computational security for the other side is based on the Decisional Diffie-Hellman (DDH) or Chosen-Target Computational Diffie-Hellman (CT-CDH) problems. Our schemes have the nice property of universal parameters, that is, each pair of R and S need not hold any secret before performing the protocol. The system parameters can be used by all senders and receivers without any trapdoor specification. In some cases, our OT k n schemes are the most efficient ones in terms of the communication cost, either in rounds or the number of messages. Moreover, one of our schemes is extended to an adaptive oblivious transfer scheme. In that scheme, S sends O(n) messages to R in one round in the commitment phase. For each query of R, onlyO(1) messages are exchanged and O(1) operations are performed. The preliminary version of this paper was published at PKC ’05 [Chu and Tzeng 2005].
Oblivious Transfer (OT), a fundamental primitive in cryptography and a cornerstone of Secure Multi-Party Computation (SMPC), is widely applied in privacy-preserving domains. Constructing efficient and secure OT protocols remains an active research area. To address the limitations of existing OT protocols, such as high time complexity and poor scalability, this paper proposes a secure and efficient k-out-of-n oblivious transfer protocol based on the Paillier homomorphic encryption algorithm . The protocol employs a system of multivariate equations to enable the receiver to select k messages from n messages held by the sender. By integrating multi-threaded parallel processing, the computational speed of ciphertext matrix-vector operations is significantly improved. Additionally, plaintext-ciphertext computation replaces traditional encryption methods to optimize the Paillier algorithm’s efficiency for batch data encryption. Experimental results demonstrate that, compared to recent k-out-of-n OT schemes: when n exceeds 30,000 with k=1, the protocol achieves a 200% performance improvement; when n=512 and k=256, it outperforms existing protocols by approximately 100% in overall efficiency.