In section 4 (protocol 4.1) of the paper by Naor and Pinkas [1], why did the authors decide to operate in a subgroup? When they say "the messages are in the subgroup" does that mean $x, y, z_0, z_1$, $w_0, w_1$ and the encryption keys are in the subgroup but the private values such as $a, b, r_0, s_0$, etc. are not? Does the construction work for any subgroup or is it more typical to use group of quadratic residues modulo prime?
Sorry if this is a bit elementary, any references regarding how subgroups are used in DH-based protocols are also appreciated.
[1] "Efficient oblivious transfer protocols" http://www.pinkas.net/PAPERS/effot.ps