On Oblivious Transfer Capacity

Christian Cachin

Anderson C. A. Nascimento, Andreas Winter

In this paper, we deal with the task of obtaining oblivious transfer (OT) from noisy resources. We characterize which noisy channels/distributions are useful for obtaining OT. We also introduce the problem of computing the oblivious-transfer capacity of a noisy resource, which measures the optimal way of implementing OT from a noisy channel/distribution. We show that for honest-but-curious sender, the oblivious-transfer capacity of noisy resources is strictly positive. Several open questions are raised.

Anuj Kumar Yadav, Preetam Kumar

Oblivious Transfer (OT) is a broadly studied cryptographic primitive which involves two mutually distrustful users who wish to interact with each other in order to transfer messages in an oblivious manner. Noise is an important resource to realize information-theoretically secure cryptographic protocols including oblivious transfer. However, oftentimes these noisy channels may be poorly characterized and the complete channel characteristics might be unknown to both users. Such channels are studied in the literature through the lens of compound channels. We study 1-out-of-2 oblivious transfer over a compound binary erasure channel (compound-BEC) and characterize the oblivious transfer capacity of compound-BEC. Our OT capacity characterization involves a general alphabet compound-DMC converse, subsequently specialized to compound-BEC along with an optimal and computationally-efficient achievability scheme for honest-but-curious users.

Carmit Hazay, Yehuda Lindell

Adriana C. B. Pinto, Rafael Dowsley, Kirill Morozov +1 more

Information-theoretically secure string oblivious transfer (OT) can be constructed based on discrete memoryless channel (DMC). The oblivious transfer capacity of a channel characterizes - similarly to the (standard) information capacity - how efficiently it can be exploited for secure oblivious transfer of strings. The OT capacity of a generalized erasure channel (GEC) - which is a combination of a (general) DMC with the erasure channel - has been established by Ahlswede and Csizar at ISIT'07 in the case of passive adversaries. In this paper, we present the protocol that achieves this capacity against malicious adversaries for GEC with erasure probability at least 1/2. Our construction is based on the protocol of Crepeau and Savvides from Eurocrypt'06 which uses interactive hashing (IH). We solve an open question posed by the above paper, by basing it upon a constant round IH scheme (previously proposed by Ding et al. at TCC'04). As a side result, we show that the Ding et al. IH protocol can deal with transmission errors.

Yehuda Lindell, Hila Zarosim