Secure Two-party computation

Question

In the secure Two-party computation problem with parties $P1$ and $P2$, let us assume the following construction:

$P1$ knows input $a$ and does the following: $a = a1 \oplus a2$ and keeps with itself $a1$ while giving $a2$ to $P2$.

Similarly, $P2$ knows input $b$ and does the following: $b = b1 \oplus b2$ and keeps with itself $b2$ while giving $b1$ to $P1$

So finally, $P1$ knows $a$, $a1$ and $b1$ while $P2$ knows $b$, $a2$ and $b2$.

To compute $o = a \oplus b$, $P1$ computes $o1 = a1 \oplus b1$ while $P2$ computes $o2 = a2 \oplus b2$. We know that $o = o1 \oplus o2$.

My question is where is the operation $o1 \oplus o2$ performed? If it is on $P1$ (say), then $P1$ would know $o1$, $o2$ and $a2$ (because $P1$ knows $a$ and $a1$, he can recompute $a2$ as $a2 = a \oplus a1$) and we get $b2 = o2 \oplus a2$. Now since $P1$ knows $b1$ and $b2$, he knows $b$, which shouldn't happen.

What is the major flaw in my understanding of the problem here?

Answer 1

The protocol that you described computes the XOR function $a\oplus b$ in the presence of semi-honest adversaries. However, this function completely reveals the other party's input given your own input. Thus, no privacy is actually preserved. However, this is due to the definition of the ideal functionality and not a problem with the protocol.

Answer 2

You are asking a question that is more use-case than cryptography. If, at the end of a shared computation, you wish to acquire the answer who should learn the answer? Sometimes you want both $P_1$ and $P_2$ to learn the answer so $P_{i}$ sends $O_i$ to $P_{1-i}$. In other use cases there is another party $R$ who is intended to know the result, in which case both $P_i$ send $O_i$ to $R$.

And in case it was unclear the computation does not have to be over here. Players $P_1$ and $P_2$ can perform further computations on $a$, $b$ and $o$ without sharing the initial or intermediate values.