Challenges
Datasets
Workspaces
Papers
Discussions
Leaderboard
Log inSign up
Challenges
Datasets
Workspaces
Papers
Discussions
Leaderboard
Blog
Job Board
Q3AS

© 2026 Aqora Quantum S.A.S.

TermsPrivacyLegal Notice

Efficient Oblivious Transfer in the Bounded-Storage Model

Dowon Hong, Ku-Young Chang, Heuisu Ryu

Published Jan 29, 2014• 0 citations
OpenAlex

Abstract

Abstract. In this paper we propose an efficient OT N 1 scheme in the bounded storage model, which is provably secure without complexity assumptions. Under the assumption that a public random string of M bits is broadcasted, the protocol is secure against any computationally unbounded dishonest receiver who can store τM bits, τ < 1. The protocol requires the sender and the receiver to store N · O ( √ kM) bits, where k is a security parameter. When N = 2, our protocol is similar to that of Ding [10] but has more efficient round and communication complexities. Moreover, in case of N> 2, if the sender and receiver can store N ·O ( √ kM) bits, we are able to construct a protocol for OT N 1 which has almost the same complexity as in OT 2 1 scheme. Ding’s protocol was constructed by using the interactive hashing protocol which is introduced by Noar, Ostrovsky, Venkatesan and Yung [15] with very large roundcomplexity. We propose an efficiently extended interactive hashing and analyze its security. This protocol answers partially an open problem raised in [10]. 1

Related papers

Information-Theoretic Interactive Hashing and Oblivious Transfer to a Storage-Bounded Receiver

Christian Cachin, Claude Crépeau, Julien Marcil +1 more

Interactive hashing has featured as an essential ingredient in protocols realizing a large variety of cryptographic tasks, notably oblivious transfer in the bounded storage model. In interactive hashing, a sender transfers a bit string to a receiver such that two strings are received, the original string and a second string that appear to be chosen at random. This paper presents a self-contained, information theoretic study of interactive hashing. We start by formalizing the notion of interactive hashing as a cryptographic primitive, disentangling it from the specifics of its various implementations. To this end, we present an application-independent set of information theoretic conditions that all interactive hashing protocols must ideally satisfy. We then provide a detailed analysis of a standard implementation of interactive hashing which is shown to satisfy all the conditions of our definition. Our analysis represents a significant improvement over previous attempts in more restricted contexts. Despite its generality, it offers a considerably simpler proof of security. Moreover, it establishes a tighter upper bound on the cheating probability of a dishonest sender, who wishes to manipulate the protocol so that both output strings have some rare desirable property. In particular, we prove that if the set of desirable strings for the dishonest sender represents a fraction f of all strings, then the probability that both outputs will be from this set is no larger than 15.6805 · f. This upper bound is valid for any f and is tight up to a small constant, since a sender acting honestly would get two outputs from this set with probability very close to f. We illustrate the power of interactive hashing as a cryptographic tool by surveying protocols achieving oblivious transfer in the bounded storage model, which typically rely heavily on interactive hashing.

IEEE Transactions on Information Theory•Sep 11, 2015•5 citations

Oblivious transfer with a memory-bounded receiver

Christian Cachin, Claude Crépeau, Julien Marcil

We propose a protocol for oblivious transfer that is unconditionally secure under the sole assumption that the memory size of the receiver is bounded. The model assumes that a random bit string slightly larger than the receiver's memory is broadcast (either by the sender or by a third party). In our construction, both parties need memory of size in /spl theta/(n/sup 2-2/spl alpha//) for some /spl alpha//spl beta/>0, whereas a malicious receiver can have up to /spl gamma/N bits of memory for any /spl gamma/<1. In the course of our analysis, we provide a direct study of an interactive hashing protocol closely related to that of M. Naor et al. (1998).

Annual Symposium on Foundations of Computer Science•Nov 27, 2002•111 citations

Efficient computational oblivious transfer using interactive hashing

Kirill Morozov, George Savvides

We present two protocols for reducing oblivious transfer (OT) to the security of trapdoor permutations and to the hardness of some coding problems, respectively. The first protocol is the most efficient known to date, while the second one is a theoretical proof-of-concept. Our constructions leverage the power of Interactive Hashing (IH). The first protocol can be viewed as a simple modification of the well-known OT construction by Even, Goldreich and Lem-pel (1985), in which a receiver must send a random domain element to a sender through IH. Alternatively, our protocol can be viewed as a simple modification of the construction by Ostrovsky, Venkatesan and Yung (1993), in which the players substitute the one-way permutation with a trapdoor permutation. We use a similar approach to derive a second OT protocol based on coding assumptions related to security of the McEliece cryptosystem. In our second construction, the receiver inputs a public key into IH while privately keeping the corresponding secret key. Two different versions of IH are used: the computationally secure one in the first protocol, and the information-theoretically secure one in the second.

ACM Asia Conference on Computer and Communications Security (ASIA CCS)•Mar 22, 2011•1 citation

Provable everlasting security in the bounded storage model

Michael O. Rabin, Yan Zong Ding

Traditional modern cryptography relies on unproven complexity assumptions that certain problems, such as integer factorization, are computationally hard, and the adversary is bounded in computing power. However, advances in algorithms and computing technology may render current cryptosystems insecure, and lead to the decryption of past secret messages. On the other hand, Shannon's pessimistic negative result essentially implies that if the adversary is all-powerful and has complete access to the communication line, then efficient practical solutions for information-theoretic security do not exist. This thesis is a study of cryptography in the bounded storage model, where provable everlasting security can be achieved efficiently without any complexity assumption. It first presents an efficient scheme for encryption and authentication that is provably secure against strong adaptive attacks, by an adversary who is computationally unbounded and only storage-bounded. A major new result is that the shared secret key employed by the sender and the receiver can be re-used to send an exponential number of messages. Our encryption scheme further enjoys the surprising property that even if the secret key is captured by the adversary after the transmission of the ciphertext, the secrecy of the message is assured. The above is joint work with Michael Rabin. Oblivious transfer is a cryptographic protocol that can serve as a basic primitive for all of cryptography. This thesis presents an implementation of oblivious transfer in the bounded storage model, which is again provably secure without complexity assumption.

•Jan 1, 2001•7 citations

Interactive hashing and reductions between Oblivious Transfer variants

George Savvides

Interactive Hashing has featured as an essential ingredient in protocols realizing a large variety of cryptographic tasks. We present a study of this important cryptographic tool in the information theoretic context. We start by presenting a security definition which is independent of any particular setting or application. We then show that a standard implementation of Interactive Hashing satisfies all the conditions of our definition. Our proof of security improves upon previous ones in several ways. Despite its generality, it is considerably simpler. Moreover, it establishes a tighter upper bound on the cheating probability of a dishonest sender. Specifically, we prove that if the fraction of good strings for a dishonest sender is f, then the probability that both outputs will be good is no larger than 15.6805· f. This upper bound is valid for any f and is tight up to a small constant since a sender acting honestly would get two good outputs with probability very close to f. We illustrate the potential of Interactive Hashing as a cryptographic primitive by demonstrating efficient reductions of String Oblivious Transfer with string length k to Bit Oblivious Transfer and several weaker variants. Our reductions incorporate tests based on Interactive Hashing that allow the sender to verify the receiver's adherence to the protocol without compromising the latter's privacy. This allows a much more efficient use of the available entropy without any appreciable impact on security. As a result, for Bit OT and most of its variants n = (1 + epsilon) k executions suffice, improving efficiency by a factor of two or more compared to the most efficient reductions that do not use Interactive Hashing. As it is theoretically impossible to achieve an expansion factor n/k smaller than 1, our reductions are in fact asymptotically optimal. They are also more general since they place no restrictions on the types of 2-universal hash families used for Privacy Amplification. Lastly, we present a direct reduction of String OT to Rabin OT which uses similar methods to achieve an expansion factor of 2 + epsilon which is again asymptotically optimal.

•Jan 1, 2007•23 citations

Perfect Secrecy in the Bounded Storage Model

Divyanshu Bhardwaj, Hamid R. Sadjadpour

In this paper, we propose a new provably secure cryptosystem for two party communication that provides security in the face of new technological breakthroughs. Most of the practical cryptosystems in use today can be breached in the future with new sophisticated methods. This jeopardizes the security of older but highly confidential messages. Our protocol is based on the bounded storage model first introduced in [1]. The protocol is secure as long as there is bound on the storage, however large it may be. We also suggest methods to extend the protocol to unbounded storage models where access to adversary is limited. Our protocol is a substantial improvement over previously known protocols and uses short key and optimal number of public random bits size of which is independent of message length. The smaller and constant length of key and public random string makes the scheme more practical. The protocol generates key using elements of the additive group$\mathbb{Z}_{\mathrm{n}}$. Our protocol is very generalized and the protocol in [1] is a special case of our protocol. Our protocol is a step forward in making provably secure cryptosystems practical. An important open problem raised in [2] was designing an algorithm with short key and size of public random string$O(\mathcal{B})$where$\mathcal{B}$bounds the storage of adversary. Our protocol satisfies the conditions and is easy to implement.

Globecom•Dec 1, 2021•0 citations
Abstract. In this paper we propose an efficient OT N 1 scheme in the bounded storage model, which is provably secure without complexity assumptions. Under the assumption that a public random string of M bits is broadcasted, the protocol is secure against any computationally unbounded dishonest receiver who can store τM bits, τ < 1. The protocol requires the sender and the receiver to store N · O ( √ kM) bits, where k is a security parameter. When N = 2, our protocol is similar to that of Ding [10] but has more efficient round and communication complexities. Moreover, in case of N> 2, if the sender and receiver can store N ·O ( √ kM) bits, we are able to construct a protocol for OT N 1 which has almost the same complexity as in OT 2 1 scheme. Ding’s protocol was constructed by using the interactive hashing protocol which is introduced by Noar, Ostrovsky, Venkatesan and Yung [15] with very large roundcomplexity. We propose an efficiently extended interactive hashing and analyze its security. This protocol answers partially an open problem raised in [10]. 1
Interactive hashing has featured as an essential ingredient in protocols realizing a large variety of cryptographic tasks, notably oblivious transfer in the bounded storage model. In interactive hashing, a sender transfers a bit string to a receiver such that two strings are received, the original string and a second string that appear to be chosen at random. This paper presents a self-contained, information theoretic study of interactive hashing. We start by formalizing the notion of interactive hashing as a cryptographic primitive, disentangling it from the specifics of its various implementations. To this end, we present an application-independent set of information theoretic conditions that all interactive hashing protocols must ideally satisfy. We then provide a detailed analysis of a standard implementation of interactive hashing which is shown to satisfy all the conditions of our definition. Our analysis represents a significant improvement over previous attempts in more restricted contexts. Despite its generality, it offers a considerably simpler proof of security. Moreover, it establishes a tighter upper bound on the cheating probability of a dishonest sender, who wishes to manipulate the protocol so that both output strings have some rare desirable property. In particular, we prove that if the set of desirable strings for the dishonest sender represents a fraction f of all strings, then the probability that both outputs will be from this set is no larger than 15.6805 · f. This upper bound is valid for any f and is tight up to a small constant, since a sender acting honestly would get two outputs from this set with probability very close to f. We illustrate the power of interactive hashing as a cryptographic tool by surveying protocols achieving oblivious transfer in the bounded storage model, which typically rely heavily on interactive hashing.
We propose a protocol for oblivious transfer that is unconditionally secure under the sole assumption that the memory size of the receiver is bounded. The model assumes that a random bit string slightly larger than the receiver's memory is broadcast (either by the sender or by a third party). In our construction, both parties need memory of size in /spl theta/(n/sup 2-2/spl alpha//) for some /spl alpha//spl beta/>0, whereas a malicious receiver can have up to /spl gamma/N bits of memory for any /spl gamma/<1. In the course of our analysis, we provide a direct study of an interactive hashing protocol closely related to that of M. Naor et al. (1998).
We present two protocols for reducing oblivious transfer (OT) to the security of trapdoor permutations and to the hardness of some coding problems, respectively. The first protocol is the most efficient known to date, while the second one is a theoretical proof-of-concept. Our constructions leverage the power of Interactive Hashing (IH). The first protocol can be viewed as a simple modification of the well-known OT construction by Even, Goldreich and Lem-pel (1985), in which a receiver must send a random domain element to a sender through IH. Alternatively, our protocol can be viewed as a simple modification of the construction by Ostrovsky, Venkatesan and Yung (1993), in which the players substitute the one-way permutation with a trapdoor permutation. We use a similar approach to derive a second OT protocol based on coding assumptions related to security of the McEliece cryptosystem. In our second construction, the receiver inputs a public key into IH while privately keeping the corresponding secret key. Two different versions of IH are used: the computationally secure one in the first protocol, and the information-theoretically secure one in the second.
Traditional modern cryptography relies on unproven complexity assumptions that certain problems, such as integer factorization, are computationally hard, and the adversary is bounded in computing power. However, advances in algorithms and computing technology may render current cryptosystems insecure, and lead to the decryption of past secret messages. On the other hand, Shannon's pessimistic negative result essentially implies that if the adversary is all-powerful and has complete access to the communication line, then efficient practical solutions for information-theoretic security do not exist. This thesis is a study of cryptography in the bounded storage model, where provable everlasting security can be achieved efficiently without any complexity assumption. It first presents an efficient scheme for encryption and authentication that is provably secure against strong adaptive attacks, by an adversary who is computationally unbounded and only storage-bounded. A major new result is that the shared secret key employed by the sender and the receiver can be re-used to send an exponential number of messages. Our encryption scheme further enjoys the surprising property that even if the secret key is captured by the adversary after the transmission of the ciphertext, the secrecy of the message is assured. The above is joint work with Michael Rabin. Oblivious transfer is a cryptographic protocol that can serve as a basic primitive for all of cryptography. This thesis presents an implementation of oblivious transfer in the bounded storage model, which is again provably secure without complexity assumption.
Interactive Hashing has featured as an essential ingredient in protocols realizing a large variety of cryptographic tasks. We present a study of this important cryptographic tool in the information theoretic context. We start by presenting a security definition which is independent of any particular setting or application. We then show that a standard implementation of Interactive Hashing satisfies all the conditions of our definition. Our proof of security improves upon previous ones in several ways. Despite its generality, it is considerably simpler. Moreover, it establishes a tighter upper bound on the cheating probability of a dishonest sender. Specifically, we prove that if the fraction of good strings for a dishonest sender is f, then the probability that both outputs will be good is no larger than 15.6805· f. This upper bound is valid for any f and is tight up to a small constant since a sender acting honestly would get two good outputs with probability very close to f. We illustrate the potential of Interactive Hashing as a cryptographic primitive by demonstrating efficient reductions of String Oblivious Transfer with string length k to Bit Oblivious Transfer and several weaker variants. Our reductions incorporate tests based on Interactive Hashing that allow the sender to verify the receiver's adherence to the protocol without compromising the latter's privacy. This allows a much more efficient use of the available entropy without any appreciable impact on security. As a result, for Bit OT and most of its variants n = (1 + epsilon) k executions suffice, improving efficiency by a factor of two or more compared to the most efficient reductions that do not use Interactive Hashing. As it is theoretically impossible to achieve an expansion factor n/k smaller than 1, our reductions are in fact asymptotically optimal. They are also more general since they place no restrictions on the types of 2-universal hash families used for Privacy Amplification. Lastly, we present a direct reduction of String OT to Rabin OT which uses similar methods to achieve an expansion factor of 2 + epsilon which is again asymptotically optimal.
In this paper, we propose a new provably secure cryptosystem for two party communication that provides security in the face of new technological breakthroughs. Most of the practical cryptosystems in use today can be breached in the future with new sophisticated methods. This jeopardizes the security of older but highly confidential messages. Our protocol is based on the bounded storage model first introduced in [1]. The protocol is secure as long as there is bound on the storage, however large it may be. We also suggest methods to extend the protocol to unbounded storage models where access to adversary is limited. Our protocol is a substantial improvement over previously known protocols and uses short key and optimal number of public random bits size of which is independent of message length. The smaller and constant length of key and public random string makes the scheme more practical. The protocol generates key using elements of the additive groupZn\mathbb{Z}_{\mathrm{n}}Zn​. Our protocol is very generalized and the protocol in [1] is a special case of our protocol. Our protocol is a step forward in making provably secure cryptosystems practical. An important open problem raised in [2] was designing an algorithm with short key and size of public random stringO(B)O(\mathcal{B})O(B)whereB\mathcal{B}Bbounds the storage of adversary. Our protocol satisfies the conditions and is easy to implement.