I know a protocol for bit commitment using regular OT (Bob has 1/2
chance of learning the bit Alice transferred to him) which goes like this:
COMMITMENT PHASE
Alice chooses a bit $b$
For $i=0$ to $i=n^2$
$\;\;\;$Alice chooses $x_{ij}$ for $1\leq j\leq n^2$ randomly so that $(\sum_jx_{ij}) \equiv b \pmod 2$
$\;\;\;$Alice and Bob do an oblivious transfer $OT(x_{ij}=y_{ij})$ for every $j$
REVEAL PHASE
Alice sends to Bob committed bit $b$ and all of the $x_{ij}$.
If $(\sum_jx_{ij}) \not\equiv b \pmod 2$ for one $i$, Bob rejects. Otherwise, he accepts.
So this protocol uses $n^2$ iterations of OT. I'm trying to find a protocol that would use instead $n$
iterations of $\binom{1}{2}-OT$ (1-out-of-2 oblivious transfer) with exponential security in $n$. I'm thinking
about using $xor$'s and random bits but the only way I can think about has linear security (I think) ...
COMMITMENT PHASE
Alice chooses $b$ and $2n$ random bits $\{b_1,b_2,\dots,b_{2n}\}$
such that $b_1\oplus b_2=b$, $b_3\oplus b_4=b$, $\dots,b_{2n-1}\oplus b_{2n}=b$.
Bob chooses bits $c_1,\dots, c_n$.
Alice and Bob do a $\binom{1}{2}-OT$ for every $\{b_1,b_2,c_1\},\{b_3,b_4,c_2\},\dots,\{b_{2n-1},b_{2n},c_n\}$.
REVEAL PHASE
Alice sends to Bob committed bit $b$ and all of the $b_i\in b_{2n}$.
Bob checks if $b_1\oplus b_2=b$, $b_3\oplus b_4=b$, $\dots,b_{2n-1}\oplus b_{2n}=b$.
If it fails once, he rejects, otherwise he accepts.
I would like some of your inputs to know if I'm heading in the right direction.