Annual Symposium on Foundations of Computer Science

Concurrent oblivious transfer

Juan A. Garay, PHILIP D. MACKENZIE

Published Nov 7, 2002• 43 citations

Abstract

We consider the problem of designing an efficient oblivious transfer (OT) protocol that is provably secure in a concurrent setting, i.e., where many OT sessions may be running concurrently with their messages interleaved arbitrarily. Known OT protocols use zero-knowledge proofs, and no concurrent zero-knowledge proofs are known that use less than a poly-logarithmic number of rounds (at least without requiring a pre-processing phase, a public random string, an auxiliary string, timing constraints, or pre-distributed public keys). We introduce a model for proving security of concurrent OT protocols, and present a protocol that is proven secure in this model based on the decisional Diffie-Hellman problem. The protocol is efficient, requiring only a slightly non-constant number of rounds.

DOI: 10.1109/sfcs.2000.892120

Related papers

Efficient k-out-of-n Oblivious Transfer Schemes

Cheng Kang Chu, Wen-Guey Tzeng

Oblivious transfer is an important cryptographic protocol in various security applications. For example, in on-line transactions, a k-out-of-n oblivious transfer scheme allows a buyer to privately choose k out of n digital goods from a merchant without learning information about other n-k goods. In this paper, we propose several efficient two-round k-out-of-n oblivious transfer schemes, in which the receiver R sends O(k) messages to the sender S, and S sends O(n) messages back to R. The schemes provide unconditional security for either sender or receiver. The computational security for the other side is based on the Decisional Diffie-Hellman (DDH) or Chosen-Target Computational Diffie-Hellman (CT-CDH) problems. Our schemes have the nice property of universal parameters, that is, each pair of R and S need not hold any secret before performing the protocol. The system parameters can be used by all senders and receivers without any trapdoor specification. In some cases, our OTkn schemes are the most efficient ones in terms of the communication cost, either in rounds or the number of messages. Moreover, one of our schemes is extended to an adaptive oblivious transfer scheme. In that scheme, S sends O(n) messages to R in one round in the commitment phase. For each query of R, only O(1) messages are exchanged and O(1) operations are performed. The preliminary version of this paper was published at PKC '05 [Chu and Tzeng 2005].

Apr 7, 202024 citations

Ciphertext Obfuscation-based Oblivious Transfer Protocol

LI Xiaodong, ZHU Xiaopeng, ZHANG Jianyi, WU Yong, DOU Yimeng

The Oblivious Transfer (OT) protocol is a privacy-preserving two-way communication protocol important for building secure multiparty computations. To exchange symmetric keys, this protocol is typically based on the Rivest—Shamir—Adleman (RSA) or Diffie—Hellman (DH) cryptographic systems, which are used for encryption during the message-encryption phase. However, in existing OT protocols, the generation of multiple pairs of public and private keys and data computations are time-consuming. Using bijective functions to transform the ciphertext within the same ciphertext domain can ensure indistinguishability after decryption and reduce the computational complexity. In the semi-honest model, a ciphertext obfuscation-based OT protocol framework is proposed and OT protocols are instantiated based on RSA and DH within this framework. Compared with RSA-based encryption schemes, the proposed protocol requires only one pair of public and private keys. When the number of public and private keys is reduced to one, the receiver can use the public key in the digital certificate of the sender to implement the OT protocol using an identity authentication function. Compared with the OT protocol based on the DH key exchange, this protocol has a small data transmission volume and low computational complexity. Experimental results show that, compared with existing OT protocols, the efficiency of instantiated protocols in the key exchange stage can be improved by at least 30%. Moreover, this protocol can be used as a basic protocol for privacy set intersections, obfuscation circuits, and OT extension protocols.

Jan 1, 20260 citations

Efficient k-out-of-n Oblivious Transfer Schemes with Adaptive and Non-Adaptive Queries.

Cheng‐Kang Chu, Wen-Guey Tzeng

Abstract: Oblivious transfer is an important cryptographic protocol in various security applications. For example, in on-line transactions, a k-out-of-n oblivious transfer scheme allows a buyer to privately choose k out of n digital goods from a merchant without learning information about other n−k goods. In this paper, we propose several efficient two-round k-out-of-n oblivious transfer schemes, in which the receiver R sends O(k) messages to the sender S, andS sends O(n) messages back to R. The schemes provide unconditional security for either sender or receiver. The computational security for the other side is based on the Decisional Diffie-Hellman (DDH) or Chosen-Target Computational Diffie-Hellman (CT-CDH) problems. Our schemes have the nice property of universal parameters, that is, each pair of R and S need not hold any secret before performing the protocol. The system parameters can be used by all senders and receivers without any trapdoor specification. In some cases, our OT k n schemes are the most efficient ones in terms of the communication cost, either in rounds or the number of messages. Moreover, one of our schemes is extended to an adaptive oblivious transfer scheme. In that scheme, S sends O(n) messages to R in one round in the commitment phase. For each query of R, onlyO(1) messages are exchanged and O(1) operations are performed. The preliminary version of this paper was published at PKC ’05 [Chu and Tzeng 2005].

Jan 1, 20040 citations

RSA-based enhanced oblivious transfer protocol

Xinguo Li

Based on the RSA signature and (string) oblivious transfer, an enhanced oblivious transfer protocol is proposed which solves the access control problem for an oblivious transfer protocol. The protocol proposed has the property that only the receiver who has the signture issued by the central authority can open the message which he choose and that the sender can not decide whether the receiver has the signature or not. That is to say, the identity of the receiver can not be confirmed after the protocol. Under the decisional Diffie-Hellman assumption the proposed scheme has provable security.

Journal of Xidian UniversityJan 1, 20050 citations

Efficient 1-out-of-n oblivious transfer schemes with universally usable parameters

Wen-Guey Tzeng

We propose efficient and secure (string) oblivious transfer (OT/sup 1//sub n/) schemes for any n/spl ges/2. We build our OT/sup 1//sub n/ scheme from fundamental cryptographic techniques directly. The receiver's choice is unconditionally secure and the secrecy of the unchosen secrets is based on the hardness of the decisional Diffie-Hellman problem. Some schemes achieve optimal efficiency in terms of the number of rounds and the total number of exchanged messages for the case that the receiver's choice is unconditionally secure. The distinct feature of our scheme is that the system-wide parameters are independent of n and universally usable, that is, all possible receivers and senders use the same parameters and need no trapdoors specific to each of them. We extend our OT/sup 1//sub n/ schemes to distributed oblivious transfer schemes. Our distributed OT/sup 1//sub n/ schemes take full advantage of the research results of secret sharing. For applications, we present a method of transforming any (single-database) PIR protocol into a symmetric PIR protocol by slightly increasing the communication cost only.

IEEE Transactions on ComputersFeb 1, 200493 citations

Concurrent Non-Malleable Zero Knowledge

Boaz Barak, Manoj Prabhakaran, Amit Sahai

We provide the first construction of a concurrent and non-malleable zero knowledge argument for every language in NP. We stress that our construction is in the plain model with no common random string, trusted parties, or super-polynomial simulation. That is, we construct a zero knowledge protocol Pi such that for every polynomial-time adversary that can adaptively and concurrently schedule polynomially many executions of Pi, and corrupt some of the verifiers and some of the provers in these sessions, there is a polynomial-time simulator that can simulate a transcript of the entire execution, along with the witnesses for all statements proven by a corrupt prover to an honest verifier Our security model is the traditional model for concurrent zero knowledge, where the statements to be proven by the honest provers are fixed in advance and do not depend on the previous history (but can be correlated with each other); corrupted provers, of course, can chose the statements adaptively. We also prove that there exists some functionality F (a combination of zero knowledge and oblivious transfer) such that it is impossible to obtain a concurrent non-malleable protocol for F in this model. Previous impossibility results for composable protocols ruled out existence of protocols for a wider class of functionalities {including zero knowledge!) but only if these protocols were required to remain secure when executed concurrently with arbitrarily chosen different protocols (Lindell, FOCS 2003) or if these protocols were required to remain secure when the honest parties' inputs in each execution are chosen adaptively based on the results of previous executions (Lindell, TCC2004). We obtain an Otilde(n) -round protocol under the assumption that one-to-one one-way functions exist. This can be improved to Otilde(k log n) rounds under the assumption that there exist k-round statistically hiding commitment schemes. Our protocol is a black-box zero knowledge protocol

Annual Symposium on Foundations of Computer ScienceOct 1, 200686 citations