0
$\begingroup$

I have a question about OT? we assume that sender has $m_0,m_1,m_2$, and $m_3$ and selects random $S_0, S_1, S_2, S_3, S_4, S_5$ and compute this statement than sends to receiver.

$C_0 = S_0 \oplus S_2 \oplus m_0$

$C_1 = S_0 \oplus S_3 \oplus m_1$

$C_2 = S_1 \oplus S_4 \oplus m_2$

$C_3 = S_1 \oplus S_5 \oplus m_3$

Can i change above statement into this?

$C_0 = S_0 \oplus S_2 \oplus m_0$

$C_1 = S_0 \oplus S_3 \oplus m_1$

$C_2 = S_1 \oplus S_2 \oplus m_2$

$C_3 = S_1 \oplus S_3 \oplus m_3$

$\endgroup$
1
$\begingroup$

No, your proposed alternative allows the attacker to deduce things beyond the value he selects.

For example, suppose that during his OT transfers, he decides to learn the values $s0$ and $s2$, allowing him to recover $m0 = c0 \oplus s0 \oplus s2$. That is intended to be allowed, and so is fine as far as it goes.

However, the receiver can also deduce the value $m1 \oplus m2 \oplus m3 = c1 \oplus c2 \oplus c3 \oplus s0 \oplus s2$. As the receiver is supposed to learn only the value he selected ($m0$ in this case), and nothing about the other messages, this is a violation of the OT properties.

$\endgroup$

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.