1
$\begingroup$

I was going through the paper - " Efficient Oblivious Transfer and Extensions for Faster Secure Computation" by Asharov et al. where the authors propose an optimized OT protocol along with a Random-OT (needed for finding multiplication triples) and a Correlated-OT (needed for Yao GC) protocol for specific applications.

On the footnote on Page 14 (which also continues on the footnote on Page 15), it is written that "That is, in addition to receiving their input and output from the random OT functionality, the parties receive the “discrete log” of the pertinent values."
I am not able to understand why the sender's ( $S$ ) output from ideal functionality got changed from ($x^{0}_i = KDF(g^{\beta^{0}_i})$) and ($x^{1}_i = KDF(g^{\beta^{1}_i})$) to ($\beta^{0}_i$, $x^{0}_i = KDF(g^{\beta^{0}_i})$) and ($\beta^{1}_i$, $x^{1}_i = KDF(g^{\beta^{1}_i})$) and also the reciever's ( $R$ ) output was also expanded by adding $\beta^{\sigma_i}_i$.

How does including the discrete logs of the values in the output help in proving the security of R-OT protocol specified, in the standard model (i.e., without random oracle)?

The protocol 51 in the paper, which is the proposed $n$x$OT_l$ protocol, the author says that the protocol is secure in standard model based on DDH assumption. In the last paragraph on page 13, a proof is also given backing this claim.
Can anyone please clear it to me if this proof is actually based on Random Oracle Model? Nowhere in the proof is the hardness of DDH used, and rather the $KDF$'s output being indistinguishable from a random $l$-bit string is used (though this also follows from hardness of DDH). Is $KDF$ being modeled as a Random Oracle here?

$\endgroup$

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Browse other questions tagged or ask your own question.