Challenges
Datasets
Workspaces
Papers
Discussions
Leaderboard
Log inSign up
Challenges
Datasets
Workspaces
Papers
Discussions
Leaderboard
Blog
Job Board
Q3AS

© 2026 Aqora Quantum S.A.S.

TermsPrivacyLegal Notice

IEICE Transactions on Fundamentals of Electronics Communications and Computer Sciences

Oblivious Polynomial Evaluation in the Exponent, Revisited

Naoto Itakura, Kaoru Kurosawa, Kazuki Yoneyama

Published Dec 31, 2016• 0 citations
Publisher

Abstract

There are two extensions of oblivious polynomial evaluation (OPE), OPEE (oblivious polynomial evaluation in the exponent) and OPEE2. At TCC 2015, Hazay showed two OPEE2 protocols. In this paper, we first show that her first OPEE2 protocol does not run in polynomial time if the computational DH assumption holds. We next present a constant round OPEE protocol under the DDH assumption.

DOI
10.1587/transfun.e100.a.26

Related papers

Oblivious Polynomial Evaluation

Hong-DaLi, Dong-YaoJi, Deng-GuoFeng +1 more

The problem of two-party oblivious polynomial evaluation(OPE)is studied,where one party(Alice)has a polynomial P(x)and the other party(Bob)with an input x wants to learn P(x)in such an oblivious way that Bob obtains P(x)without learning any additional information about P except what is implied by P(x)and Alice does not know Bob's input x.The former OPE protocols are based on an intractability assumption except for OT protocols.In fact,evaluating P(x)is equivalent to computing the product of the coefficient vectors(a0,...,an)and(1,...,xn).Using this idea,an efficient scale product protocol of two vectors is proposed first and then two OPE protocols are presented which do not need any other cryptographic assumption except for OT protocol.Compared with the existing OPE protocol,another characteristic of the proposed protocols is the degree of the polynomial is private.Another OPE protocol works in case of existence of untrusted third party.

Journal of Computer Science and Technology•Jan 1, 2004•0 citations

Information-Theoretically Secure Oblivious Polynomial Evaluation in the Commodity-Based Model

Rafael Tonicelli, Anderson C. A. Nascimento, Rafael Dowsley +4 more

Abstract. Oblivious polynomial evaluation (OPE) consists of a two-party protocol where a sender inputs a polynomial p(x), and a receiver inputs a single value x0. At the end of the protocol, the sender learns nothing and the receiver learns p(x0). This paper deals with the problem of oblivious polynomial evaluation under an information-theoretic perspective, which is based on recent definitions of Unconditional Security developed by Crépeau et al. [11]. In this paper, we propose an information-theoretic model for oblivious polynomial evaluation relying on pre-distributed data, and prove very general lower bounds on the size of the pre-distributed data, as well as the size of the communications in any protocol. It is demonstrated that these bounds are tight by obtaining a round-optimal OPE protocol, which meets the lower bounds simultaneously. We present a natural generalization to OPE called oblivious linear functional evaluation.

•Oct 28, 2013•4 citations

Oblivious Polynomial Evaluation and Secure Set-Intersection from Algebraic PRFs.

Carmit Hazay

In this paper we study the two fundamental functionalities oblivious polynomial evaluation in the exponent and set-intersection, and introduce a new technique for designing efficient secure protocols for these problems (and others). Our starting point is the [BGV11] technique (CRYPTO 2011) for verifiable delegation of polynomial evaluations, using algebraic PRFs. We use this tool, that is useful to achieve verifiability in the outsourced setting, in order to achieve privacy in the standard two-party setting. Our results imply new simple and efficient oblivious polynomial evaluation (OPE) protocols. We further show that our OPE protocols are readily used for secure set-intersection, implying much simpler protocols in the plain model. As a side result, we demonstrate the usefulness of algebraic PRFs for various search functionalities, such as keyword search and oblivious transfer with adaptive queries. Our protocols are secure under full simulation-based definitions in the presence of malicious adversaries.

•Jan 1, 2015•3 citations

Unconditionally secure Oblivious Polynomial Evaluation protocol

Li Luyao, Duan Zongtao, Wang Qinglong +2 more

Oblivious polynomial evaluation is a protocol involving two parties: a sender whose input is a polynomial and a receiver whose input is a value a .Most of existing Oblivious Polynomial Evaluation protocols were built based on some cryptographically intractable problems which made them a higher computation complexity.By using some random and hiding secure information in them, this paper presents an unconditionally secure oblivious polynomial evaluation protocol.It does not rely on any cryptographic assumption and involves only simple computation.Further, our protocol does not include any third party and is more practice.

International Conference on Advanced ICT and Education (ICAICTE)•Jan 1, 2013•2 citations

Efficient Oblivious Polynomial Evaluation with Simulation-Based Security.

Carmit Hazay, Yehuda Lindell

The study of secure multiparty computation has yielded powerful feasibility results showing that any efficient functionality can be securely computed in the presence of malicious adversaries. Despite this, there are few problems of specific interest for which we have highly efficient protocols that are secure in the presence of malicious adversaries under full simulation based definitions (following the ideal/real model paradigm). Due to the difficulties of constructing such protocols, many researchers have resorted to weaker definitions of security and weaker adversary models. In this paper, we construct highly efficient protocols for the well-studied problem of oblivious polynomial evaluation. Our protocol is secure under standard cryptographic assumptions for the settings of malicious adversaries, and readily transform to protocols that are secure under universal composability and in the presence of covert adversaries. Our protocol is constant round and requires O(d · s) exponentiations, where d is the degree of the polynomial and s is a statistical security parameter (that should equal about 160 in practice).

•Jan 1, 2009•26 citations

Oblivious transfer and polynomial evaluation

Moni Naor, Benny Pinkas B

We describe efficient constructions for two oblivious twoparty computation problems: l-out-of-N Oblivious Transfer &d 'Oblivious Poly&nial Evaluation.The oblivious polynomial evaluation protocol is based on a new intractability assumption which is closely related to noisy polynomial re construction.A direct corollary of the l-out-of-N OT protccol is an efficient transformation of any Private Information Retrieval (PIR) protocol to a Symmetric PIR (SPIR) prc-tow1 without increasing the number of databases.The new construction for l-out-of-N OT is highly efficient -it requires only log N executions of a l-out-of-2 OT protocol.We also present a construction for k-out-of-N OT which is more efficient than k repetitions of l-out-of-N OT.The efficiency of the new OT protocols makes them useful for a variety of applications.These include oblivious sampling which can be used to securely compare the sizes of web search engines, protocols for privately solving the list intersection problem and for mutually authenticated key exchange based on (possibly weak) passwords, and protocols for anonymity preserving web usage metering.

ACM Symposium on Theory of Computing (STOC)•May 1, 1999•635 citations
There are two extensions of oblivious polynomial evaluation (OPE), OPEE (oblivious polynomial evaluation in the exponent) and OPEE2. At TCC 2015, Hazay showed two OPEE2 protocols. In this paper, we first show that her first OPEE2 protocol does not run in polynomial time if the computational DH assumption holds. We next present a constant round OPEE protocol under the DDH assumption.
The problem of two-party oblivious polynomial evaluation(OPE)is studied,where one party(Alice)has a polynomial P(x)and the other party(Bob)with an input x wants to learn P(x)in such an oblivious way that Bob obtains P(x)without learning any additional information about P except what is implied by P(x)and Alice does not know Bob's input x.The former OPE protocols are based on an intractability assumption except for OT protocols.In fact,evaluating P(x)is equivalent to computing the product of the coefficient vectors(a0,...,an)and(1,...,xn).Using this idea,an efficient scale product protocol of two vectors is proposed first and then two OPE protocols are presented which do not need any other cryptographic assumption except for OT protocol.Compared with the existing OPE protocol,another characteristic of the proposed protocols is the degree of the polynomial is private.Another OPE protocol works in case of existence of untrusted third party.
Abstract. Oblivious polynomial evaluation (OPE) consists of a two-party protocol where a sender inputs a polynomial p(x), and a receiver inputs a single value x0. At the end of the protocol, the sender learns nothing and the receiver learns p(x0). This paper deals with the problem of oblivious polynomial evaluation under an information-theoretic perspective, which is based on recent definitions of Unconditional Security developed by Crépeau et al. [11]. In this paper, we propose an information-theoretic model for oblivious polynomial evaluation relying on pre-distributed data, and prove very general lower bounds on the size of the pre-distributed data, as well as the size of the communications in any protocol. It is demonstrated that these bounds are tight by obtaining a round-optimal OPE protocol, which meets the lower bounds simultaneously. We present a natural generalization to OPE called oblivious linear functional evaluation.
In this paper we study the two fundamental functionalities oblivious polynomial evaluation in the exponent and set-intersection, and introduce a new technique for designing efficient secure protocols for these problems (and others). Our starting point is the [BGV11] technique (CRYPTO 2011) for verifiable delegation of polynomial evaluations, using algebraic PRFs. We use this tool, that is useful to achieve verifiability in the outsourced setting, in order to achieve privacy in the standard two-party setting. Our results imply new simple and efficient oblivious polynomial evaluation (OPE) protocols. We further show that our OPE protocols are readily used for secure set-intersection, implying much simpler protocols in the plain model. As a side result, we demonstrate the usefulness of algebraic PRFs for various search functionalities, such as keyword search and oblivious transfer with adaptive queries. Our protocols are secure under full simulation-based definitions in the presence of malicious adversaries.
Oblivious polynomial evaluation is a protocol involving two parties: a sender whose input is a polynomial and a receiver whose input is a value a .Most of existing Oblivious Polynomial Evaluation protocols were built based on some cryptographically intractable problems which made them a higher computation complexity.By using some random and hiding secure information in them, this paper presents an unconditionally secure oblivious polynomial evaluation protocol.It does not rely on any cryptographic assumption and involves only simple computation.Further, our protocol does not include any third party and is more practice.
The study of secure multiparty computation has yielded powerful feasibility results showing that any efficient functionality can be securely computed in the presence of malicious adversaries. Despite this, there are few problems of specific interest for which we have highly efficient protocols that are secure in the presence of malicious adversaries under full simulation based definitions (following the ideal/real model paradigm). Due to the difficulties of constructing such protocols, many researchers have resorted to weaker definitions of security and weaker adversary models. In this paper, we construct highly efficient protocols for the well-studied problem of oblivious polynomial evaluation. Our protocol is secure under standard cryptographic assumptions for the settings of malicious adversaries, and readily transform to protocols that are secure under universal composability and in the presence of covert adversaries. Our protocol is constant round and requires O(d · s) exponentiations, where d is the degree of the polynomial and s is a statistical security parameter (that should equal about 160 in practice).
We describe efficient constructions for two oblivious twoparty computation problems: l-out-of-N Oblivious Transfer &d 'Oblivious Poly&nial Evaluation.The oblivious polynomial evaluation protocol is based on a new intractability assumption which is closely related to noisy polynomial re construction.A direct corollary of the l-out-of-N OT protccol is an efficient transformation of any Private Information Retrieval (PIR) protocol to a Symmetric PIR (SPIR) prc-tow1 without increasing the number of databases.The new construction for l-out-of-N OT is highly efficient -it requires only log N executions of a l-out-of-2 OT protocol.We also present a construction for k-out-of-N OT which is more efficient than k repetitions of l-out-of-N OT.The efficiency of the new OT protocols makes them useful for a variety of applications.These include oblivious sampling which can be used to securely compare the sizes of web search engines, protocols for privately solving the list intersection problem and for mutually authenticated key exchange based on (possibly weak) passwords, and protocols for anonymity preserving web usage metering.