Abstract A ‘1-out-of-n’ oblivious transfer (OT) protocol involves two participants: a sender, who provides a set of items as input, and a receiver. The protocol guarantees that the receiver gets exactly one of the items of the input set, while the sender is unable to determine which. Priced OT (POT) protocols further allow each item of the input set to be assigned a price in such a way that, after a proper execution of the protocol, the receiver gets the requested item if and only if the corresponding sum of money has been paid. In this paper, we present a construction which takes a ‘1-out-of-n’ OT protocol and transform it into a POT one. Moreover, the resulting system is unlinkable in the sense that the sender is unable to determine whether two executions of the protocol were run by the same receiver or not. When compared to existing unlinkable POT protocols, our construction offers a lower conceptual complexity as it does not involve the use of zero-knowledge proofs.
Abstract A ‘1-out-of-n’ oblivious transfer (OT) protocol involves two participants: a sender, who provides a set of items as input, and a receiver. The protocol guarantees that the receiver gets exactly one of the items of the input set, while the sender is unable to determine which. Priced OT (POT) protocols further allow each item of the input set to be assigned a price in such a way that, after a proper execution of the protocol, the receiver gets the requested item if and only if the corresponding sum of money has been paid. In this paper, we present a construction which takes a ‘1-out-of-n’ OT protocol and transform it into a POT one. Moreover, the resulting system is unlinkable in the sense that the sender is unable to determine whether two executions of the protocol were run by the same receiver or not. When compared to existing unlinkable POT protocols, our construction offers a lower conceptual complexity as it does not involve the use of zero-knowledge proofs.
Abstract Priced oblivious transfer (POT) is a cryptographic protocol in which a merchant provides a set of items for sale and a customer acquires one of them. The protocol guarantees that the customer receives the item if and only if they have paid its price, while the merchant remains oblivious to the acquired item. Obviously, the merchant cannot not know what price the client has paid, as such price could be unique. A recent paper proposes a POT protocol that is built from two blocks: an e-coin system and an asymmetric secure computation protocol. In this paper, we present a quantum-resistant proposal for the latter building block. As a result, we are able to construct a quantum-resistant POT protocol implemented from the newly proposed asymmetric secure computation protocol and a post-quantum implementation of the mentioned e-coin system. To our knowledge, no quantum-resistant POT protocol has been proposed so far.
Oblivious transfer (OT) protocol is an essential tool in cryptography that provides a wide range of applications such as secure multi-party computation, private information retrieval, private set intersection, contract signing, and privacy-preserving location-based services. The OT protocol has different variants such as one-out-of-2, one-out-of- n , k -out-of- n , and OT extension. In the OT (one-out-of-2, one-out-of- n , and OT extension) protocol, the sender has a set of messages, whereas the receiver has a key. The receiver sends that key to the sender in a secure way; the sender cannot get any information about the received key. The sender encrypts every message by operating on every message using the received key and sends all the encrypted messages to the receiver. The receiver is able to extract only the required message using his key. However, in the k -out-of- n OT protocol, the receiver sends a set of k keys to the sender, and in replay, the sender sends all the encrypted messages. The receiver uses his keys and extracts the required messages, but it cannot gain any information about the messages that it has not requested. Generally, the OT protocol requires high communication and computation cost if we transfer millions of oblivious messages. The OT extension protocol provides a solution for this, where the receiver transfers a set of keys to the sender by executing a few numbers of OT protocols. Then, the sender encrypts all the messages using cheap symmetric key cryptography with the help of a received set of keys and transfers millions of oblivious messages to the receiver. In this work, we present different variants of OT protocols such as one-out-of-2, one-out-of- n , k -out-of- n , and OT extension. Furthermore, we cover various aspects of theoretical security guarantees such as semi-honest and malicious adversaries, universally composable, used techniques, computation, and communication efficiency aspects. From the analysis, we found that the semi-honest adversary-based OT protocols required low communication and computation costs as compared to malicious adversary-based OT protocols.
Oblivious transfer (OT) protocol is a fundamental building block of cryptography and can be applied widely in many fields. A secure oblivious transfer protocol is supposed to ensure the privacy of both senders and receivers. The privacy of receivers means that the information being selected by receivers would never be revealed to senders. On the other hand, the privacy of senders means that receivers have no further information except for the one that has been selected. In this case, senders are able to deceive receivers by sending same messages. Likewise, in existing 1-out-of-n OT protocols, malicious senders can make all the n messages the same, so that receivers will always get the specific one assigned by senders. This indicates that privacy of receivers wouldnt work under the 1-out-of-n OT protocol. To prevent this kind of attack, this paper provides a general framework on how to design a secure OT protocol based on commutative and ciphertext equality test and take RSA as an example to explain how the protocol is processed.
In an adaptive oblivious transfer (OT) protocol, a sender commits to a database of messages and then repeatedly interacts with a receiver in such a way that the receiver obtains one message per interaction of his choice (and nothing more) while the sender learns nothing about any of the choices. Recently, there has been significant effort to design practical adaptive OT schemes and to use these protocols as a building block for larger database applications. To be well suited for these applications, the underlying OT protocol should: (1) support an efficient initialization phase where one commitment can support an arbitrary number of receivers who are guaranteed of having the same view of the database, (2) execute transfers in time independent of the size of the database, and (3) satisfy a strong notion of security under a simple assumption in the standard model. We present the first adaptive OT protocol simultaneously satisfying these requirements. The sole complexity assumption required is that given (g, g a, g b, g c, Q), where g generates a bilinear group of prime order p and a, b, c are selected randomly from Zp, it is hard to decide if Q = g abc. All prior protocols in the standard model either do not meet our efficiency requirements or
Oblivious Transfer (OT) is an important cryptographic tool, which has found its usage in many crypto protocols, such as Secure Multiparty Computations [9], Certified E-mail [2] and Simultaneous Contract Signing [20].In this paper, we propose three k-out-of-n OT (OT n k ) protocols based on additive homomorphic encryption.Two of these protocols prohibit malicious behaviors from both sender and receiver.We also achieve efficient communication complexity bounded by O(l • n) in bits, where l is the size of the encryption key.The computational complexity is same or better than the most efficient existing protocols.Due to the semantic security property, the sender cannot get receiver's selection.When the receiver tries to retrieve more than k values, the receiver is caught cheating with 1 -1/m probability (Protocol II) or the receiver is unable to get any value at all (Protocol III).We introduce a novel technique based on the solvability of linear equations, which could find its way into other applications.We also provide an experimental analysis to compare the efficiency of the protocols.