Alice has a secret A, Bob has a secret B. They have a secure channel and a MAC. They each want to know the other's secret, but don't particularly want to give up their own. However, neither will not lie about the secret, but if possible, will stop communications once [s]he learns the other's secret.

How can such a protocol work, that if Alice or Bob doesn't correctly follow all steps in the protocol, neither person can gain any information about the other's secret.

You may not use a third party.

  • 3
    $\begingroup$ I think your question got already answered here: crypto.stackexchange.com/questions/1639/… $\endgroup$
    – wonce
    Jun 4, 2015 at 0:16
  • $\begingroup$ Specifically, with this answer. $\;$ $\endgroup$
    – user991
    Jun 4, 2015 at 1:05
  • $\begingroup$ "Neither will not lie about the secret?" Did you mean "neither will lie?" $\endgroup$
    – cpast
    Jun 4, 2015 at 19:23
  • $\begingroup$ If you think the above link does not answer your question, please clarify. $\endgroup$
    – otus
    Apr 24, 2016 at 5:20

1 Answer 1


M.O.Rabin answered the question in 1981, named it oblivious transfer.

  • $\begingroup$ No, oblivious transfer is something else entirely $\endgroup$
    – poncho
    Jun 5, 2015 at 18:43
  • $\begingroup$ Welcome to Cryptography Stack Exchange. We actually prefer answers which contain the information itself, not just referring to information elsewhere. Could you add a summary of the information to the answer? Otherwise we will convert your answer to a comment. $\endgroup$ Jun 6, 2015 at 10:14

Not the answer you're looking for? Browse other questions tagged or ask your own question.