Alice：has $x=(x_1，x_2,...x_m）$

Bob: has $(y_1,m_1),...,(y_n,m_n)$

For this, Alice wants to get some message from Bob, but does not want bob to know which one she gets

• Bob generate random $a \in Z_q$，$cid_i=H(y_i^b),c_i=AES_{enc}(y_i^b, m_i),\forall i \in n$
• Bob send all $(cid_i,c_i)$ to alice
• Alice generate random $b \in Z_q$，compute $choose_j=x_j^b$
• Alice send $choose_j$ to Bob
• Bob compute $choose_j^a=x_j^{ab}$,send to alice
• Alice get $x_j^{a}$ and $cid_j=H(x_j^a)$, if $x_j=y_i, cid_j=cid_i$， Alice can decrypt $m_i=AES_{dec}(c_j,x_j^a)$

Is this approach secure, or do I need to introduce additional constraints?

Moreover, can I incorporate the OPRF portion from RA2018 or KKRT, in which Bob shares the appropriate key with Alice in this manner, while Alice only obtains the information she can query for? For example, if Alice queries for x1 and x2, she won't receive anything beyond m1 and m2

Alice：has $x=(x_1，x_2,...x_m)$

Bob: has $(y_1,m_1),...,(y_n,m_n)$

For this, Alice wants to get some message from Bob, but does not want bob to know which one she gets

• Bob generate random $a \in Z_q$，$cid_i=H(y_i^b),c_i=AES_{enc}(y_i^b, m_i),\forall i \in n$
• Bob send all $(cid_i,c_i)$ to alice
• Alice generate random $b \in Z_q$，compute $choose_j=x_j^b$
• Alice send $choose_j$ to Bob
• Bob compute $choose_j^a=x_j^{ab}$,send to alice
• Alice get $x_j^{a}$ and $cid_j=H(x_j^a)$, if $x_j=y_i, cid_j=cid_i$， Alice can decrypt $m_i=AES_{dec}(c_j,x_j^a)$

Is this approach secure, or do I need to introduce additional constraints?

Moreover, can I incorporate the OPRF portion from RA2018 or KKRT, in which Bob shares the appropriate key with Alice in this manner, while Alice only obtains the information she can query for? For example, if Alice queries for x1 and x2, she won't receive anything beyond m1 and m2

It is possible to utilize the OPRF-PSI algorithm to implement a K-V-PIR protocol, as follows:

• Alice wishes to inquire about the values corresponding to $(x_i, x_j)$, while
• Bob possesses data in the form of $(x_1, y_1), (x_2, y_2), ..., (x_n, y_n)$.

Both parties would engage in the OPRF-PSI protocol, such as ECDH. In this process:

• Bob employs his personal $key_b$ to encrypt the $y_i$ data and subsequently transmits $(c_y1, ..., c_yn)$ to Alice.
• Alice, in turn, uses her OPRF $key_a$ to decrypt the data.

For instance, Alice forwards $H(x_i)^a$ to Bob, who computes $H(x_i)^{ab}$ and returns it to Alice. Subsequently, Alice obtains $H(x_i)^b$, which serves as the key for $c_{yi}$.

It is also possible to enhance this specific implementation by incorporating additional MAC mechanisms for data verification.

Alice：has $x=(x_1，x_2,...x_m）$

Bob: has $(y_1,m_1),...,(y_n,m_n)$

For this, Alice wants to get some message from Bob, but does not want bob to know which one she gets

• Bob generate random $a \in Z_q$，$cid_i=H(y_i^b),c_i=AES_{enc}(y_i^b, m_i),\forall i \in n$
• Bob send all $(cid_i,c_i)$ to alice
• Alice generate random $b \in Z_q$，compute $choose_j=x_j^b$
• Alice send $choose_j$ to Bob
• Bob compute $choose_j^a=x_j^{ab}$,send to alice
• Alice get $x_j^{a}$ and $cid_j=H(x_j^a)$, if $x_j=y_i, cid_j=cid_i$， Alice can decrypt $m_i=AES_{dec}(c_j,x_j^a)$

Is this approach secure, or do I need to introduce additional constraints?

Moreover, can I incorporate the OPRF portion from RA2018 or KKRT, in which Bob shares the appropriate key with Alice in this manner, while Alice only obtains the information she can query for? For example, if Alice queries for x1 and x2, she won't receive anything beyond m1 and m2

It is possible to utilize the OPRF-PSI algorithm to implement a K-V-PIR protocol, as follows: Alice wishes to inquire about the values corresponding to (xi, xj), while Bob possesses data in the form of (x1, y1), (x2, y2), ..., (xn, yn). Both parties would engage in the OPRF-PSI protocol, such as ECDH. In this process, Bob employs his personal key_b to encrypt the y_i data and subsequently transmits (c_y1, ..., c_yn) to Alice. Alice, in turn, uses her OPRF key_a to decrypt the data. For instance, Alice forwards H(xi)^a to Bob, who computes H(xi)^ab and returns it to Alice. Subsequently, Alice obtains H(xi)^b, which serves as the key for c_yi. It is also possible to enhance this specific implementation by incorporating additional MAC mechanisms for data verification.  

It is possible to utilize the OPRF-PSI algorithm to implement a K-V-PIR protocol, as follows:

• Alice wishes to inquire about the values corresponding to $(x_i, x_j)$, while
• Bob possesses data in the form of $(x_1, y_1), (x_2, y_2), ..., (x_n, y_n)$.

Both parties would engage in the OPRF-PSI protocol, such as ECDH. In this process:

• Bob employs his personal $key_b$ to encrypt the $y_i$ data and subsequently transmits $(c_y1, ..., c_yn)$ to Alice.
• Alice, in turn, uses her OPRF $key_a$ to decrypt the data.

For instance, Alice forwards $H(x_i)^a$ to Bob, who computes $H(x_i)^{ab}$ and returns it to Alice. Subsequently, Alice obtains $H(x_i)^b$, which serves as the key for $c_{yi}$. 

It is also possible to enhance this specific implementation by incorporating additional MAC mechanisms for data verification.