Alice has a secret A, Bob has a secret B. They have a secure channel and a MAC. They each want to know the other's secret, but don't particularly want to give up their own. However, neither will not lie about the secret, but if possible, will stop communications once [s]he learns the other's secret.

How can such a protocol work, that if Alice or Bob doesn't correctly follow all steps in the protocol, neither person can gain any information about the other's secret.

You may not use a third party.

  • 3
    $\begingroup$ I think your question got already answered here: crypto.stackexchange.com/questions/1639/… $\endgroup$ – wonce Jun 4 '15 at 0:16
  • $\begingroup$ Specifically, with this answer. $\;$ $\endgroup$ – user991 Jun 4 '15 at 1:05
  • $\begingroup$ "Neither will not lie about the secret?" Did you mean "neither will lie?" $\endgroup$ – cpast Jun 4 '15 at 19:23
  • $\begingroup$ If you think the above link does not answer your question, please clarify. $\endgroup$ – otus Apr 24 '16 at 5:20

M.O.Rabin answered the question in 1981, named it oblivious transfer.

| improve this answer | |
  • $\begingroup$ No, oblivious transfer is something else entirely $\endgroup$ – poncho Jun 5 '15 at 18:43
  • $\begingroup$ Welcome to Cryptography Stack Exchange. We actually prefer answers which contain the information itself, not just referring to information elsewhere. Could you add a summary of the information to the answer? Otherwise we will convert your answer to a comment. $\endgroup$ – Paŭlo Ebermann Jun 6 '15 at 10:14

Not the answer you're looking for? Browse other questions tagged or ask your own question.