On the Reversibility of Oblivious Transfer

Christian Cachin

Lara Stroh, Nikola Horová, Robert Stárek +4 more

Oblivious transfer (OT) is an important cryptographic primitive.Any multiparty computation can be realized with OT as building block.XOR oblivious transfer (XOT) is a variant where the sender Alice has two bits and a receiver Bob obtains either the first bit, the second bit, or their XOR.Bob should not learn anything more than this and Alice should not learn what Bob has learnt.Perfect quantum OT with information-theoretic security is known to be impossible.We determine the smallest possible cheating probabilities for unrestricted dishonest parties in noninteractive quantum XOT protocols using symmetric pure states and present an optimal protocol, which outperforms classical protocols.We also "reverse" this protocol, so that Bob becomes sender of a quantum state and Alice the receiver who measures it, while still implementing oblivious transfer from Alice to Bob.Cheating probabilities for both parties stay the same as for the unreversed protocol.We optically implement both the unreversed and the reversed protocols, and cheating strategies, noting that the reversed protocol is easier to implement.

Yehuda Lindell, Hila Zarosim

Erika Andersson, Lara Stroh, Ittoop Vergheese Puthoor +6 more

Modern cryptography is more than sending secret messages, and quantum cryptography is more than quantum key distribution. One example is oblivious transfer, which is interesting partly because it can be used to implement secure multiparty computation. We discuss a protocol for quantum XOR oblivious transfer, and how non-interactive quantum oblivious transfer protocols can be “reversed”, so that oblivious transfer is still implemented from a sender to a receiver, but so that it is the receiver who sends a quantum state to the sender, who measures it, instead of the other way round. This is useful when one party can only prepare and send quantum states, and the other party can only measure them, which is often the case in practical quantum communication systems. Both the “original” XOR oblivious transfer protocol and its reversed version have been implemented optically. We also discuss how quantum random access codes can be connected with quantum oblivious transfer.

Yehuda Lindell, Hila Zarosim

UniversitP de Paris-Sud

i (:)-OT, (one-out-of-two Bit Oblivious Transfer) is a technique by which a party S owning two secret bits b,bl, can transfer one of them b, to another party R, who chooses c. This is done in a way that does not release any bias about bz to R nor any bias about c to S. How can one build a 2TO-(i) ((;)-OT2 from R to S) given a (i)-OT, (from S to a)? This question is interesting because in many scenarios, one of the two parties will be much more powerful than the other. In the current paper we answer this question and show a number of related extensions. One interesting extension of this transfer is the (:)-OTk (one-out-of-two String O.T.) in which the two secrets qo, q1 are elements of CFk(2) instead of bits. We show that $TO-(:) can be obtained at about the same cost as (3-OT:, in terms of number of cab to (i)-OTz.