Alice has two 1GB files, and Bob wants one without Alice knowing which. Can this be done with less than 2GB (1GB for each file) of bandwidth between Alice and Bob?
I wonder if it's possible to do it with indistinguishability obfuscation. Let's say that the two files have hashes H1 and H2, and that Bob knows those hashes. He can give Alice an obfuscated program that checks the two files against H1 and H2, aborts if the check fails, and if not returns one of the two files (say the one corresponding to H2) encrypted against his public key.
Alice can make sure that both files are not transferred by capping the response to 1 GB. Alternatively Alice can provide a zero-knowledge proof that the response of the obfuscated program is exactly one of the files.
With a protocol that is UC secure in the standard model, the total communication from the sender has to be at least $|m_0| + |m_1|$.
In UC security, there must be a simulator that interacts with a corrupt sender and eventually extracts the two OT payloads $m_0, m_1$ (to send to the ideal functionality). The only information that the simulator receives are the protocol messages of the sender. So the total communication must be large enough to encode an arbitrary $m_0, m_1$.
I doubt a random oracle would help, and I doubt semi-honest security would help. I still feel like a similar incompressibility argument could go through. But I have not worked out such an argument.