# Input-independence of base OT in OT extension

In [1], the authors state:

[...] observe that unlike [32] the initial OT phase in Protocol 52 is completely independent of the actual inputs of the parties. Thus, the parties can perform the initial OT phase before their inputs are determined.

where “initial OT phase” refers to the base OT phase. In a follow-up/extension work by the same authors ([2]), the reference to [32] here is removed and the quote now reads:

[...] observe that the initial OT phase in Protocol 4 is completely independent of the actual inputs of the parties. Thus, the parties can compute the initial base-OTs before their inputs are determined.

My question is: is the claim in [1] (that [32]’s base OT phase is input-dependent) correct, or was it just a simple mistake? If it is correct, where in [32] is this shown? I could not find it but perhaps I am missing something.

References:

[1] (ALSZ) https://eprint.iacr.org/2013/552.pdf

[2] (ALSZ) https://eprint.iacr.org/2016/602.pdf

[32] (IKNP03) Y. Ishai, J. Kilian, K. Nissim, and E. Petrank. Extending oblivious transfers efficiently. In Advances in Cryptology – CRYPTO’03, volume 2729 of LNCS, pages 145–161. Springer, 2003.

Yes, it is true. You can check for example this blog post: in the paragraph where it says “The OT extension we present here is from Ishai et al (2003)”, we can see that Step 4.1 requires the receiver to provide as input to the base OT two vectors $$(t_j, u_j)$$ such that the columns of the resulting matrices $$T$$ and $$U$$ (using the notation from the post) XOR to the choice bits, which are the receiver’s input.
• Protocol 52 in [1] indeed uses the base OTs with input-independent data: “$S$ choose a random string $s = (s_1,\ldots,s_\kappa)$ and $R$ chooses $\kappa$ pairs of $\kappa$-bits seeds…” The base OT is run with these as inputs, which are uniformly random and independent of the actual inputs for the OT extension Aug 2 at 13:11
• I don't think that's possible since it seems you do need both $T$ and $U$ for the base OTs (in fact these are the two messages) Aug 2 at 20:00