1
$\begingroup$

I started learning about cryptography very recently, and I got interested in the Simplest-OT protocol of Chou and Orlandi. However (as the authors themselves noted) the protocol is not UC-secure against a corrupt sender. My question is: if both sender and receiver are semihonest, is Simplest-OT still not UC-secure?

Thanks in advance.

$\endgroup$

1 Answer 1

2
$\begingroup$

The paper mentions that the issue is with one of the parties delaying an action that makes simulation impossible. So if they are semi-honest and follow the protocol, it should fix that issue. There seems to be other problems with the original proof, but maybe they
don't apply to the semi-honest case.

Here is a rough argument of why it's plausibly UC-secure against semi-honest adversaries in the random oracle model. I leave it to you to fill the gaps.

Extracting the receiver's input

The semi-honest receiver will make a single query to the random oracle as $k_R= H(A^b)$. Let $x$ be the input to $H$ that is observed by the simulator. Since it knows $a$, when it receives $B$ from the receiver, it can guess $c=0$ if $B^a=x=g^{ab}$ and $c=1$ if $B^a\neq x$.

Extracting the sender's input

The semi-honest sender makes exactly two random oracle queries and uses the outputs $k_0,k_1$ to encrypt its two messages. The simulator can record the outputs of these two queries and decrypt both $e_0$ and $e_1$ to recover both messages.

$\endgroup$
2
  • $\begingroup$ Simulator doesn't need to extract in the semi-honest model (semi-honest adversaries have inputs provided by the environment). $\endgroup$
    – Mikero
    Apr 4 at 2:22
  • $\begingroup$ Thanks @Mikero, I did not know that. So in semi-honest UC, the simulator only needs to recreate the views of the semi-honest adversary by interacting with its interface of the ideal primitive? $\endgroup$
    – lamontap
    Apr 4 at 15:23

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Not the answer you're looking for? Browse other questions tagged or ask your own question.