Weak Oblivious Transfer from Strong One-Way Permutations

Keisuke Tanaka, Akihiro Yamada, Kenji Yasunaga

圭介 田中, Keisuke Tanaka, 裕俊 竹部 +3 more

Arka Rai Choudhuri, Michele Ciampi, Vipul Goyal +2 more

Iftach Haitner

Kirill Morozov, George Savvides

We use interactive hashing to achieve the most efficient OT protocol to date based solely on the assumption that trapdoor permutations (TDP) exist. Our protocol can be seen as the following (simple) modification of either of the two famous OT constructions: 1) In the one by Even et al (1985), a receiver must send a random domain element to a sender through IH; 2) In the one by Ostrovsky et al (1993), the players should use TDP instead of one-way permutation. A similar approach is employed to achieve oblivious transfer based on the security of the McEliece cryptosystem. In this second protocol, the receiver inputs a public key into IH, while privately keeping the corresponding secret key. Two different versions of IH are used: the computationally secure one in the first protocol, and the information-theoretically secure one in the second.

Gilles Brassard A, Louis Salvail, Alain Tapp

Oblivious transfer (OT) is a fundamental primitive in cryptography. It is known that unconditionally secure OT is impossible, even with the help of quantum mechanics. Furthermore, no classical OT scheme has been proven to offer computational security in the usual super-polynomial model, and there is evidence that such schemes cannot be based on one-way permutations. Nevertheless, inspired by Ralph Merkle's 1974 key distribution scheme, we offer a novel classical OT scheme based on one-way permutations and prove its polynomial security: the effort to cheat it scales as t3/2, where t is the legitimate effort needed to implement it. Unfortunately, our scheme melts down under the onslaught of a quantum adversary after an effort merely in the order of t5/6, so that it is actually easier to subvert it than to use it legitimately! By allowing the honest parties to use quantum computation as well, however, it may be that our OT scheme can be repaired so as to resist modest quantum attacks.