In the Socialist Millionaires protocol, Alice selcts some $x$ and Bob selects some $y$, and both parties learn whether or not $x=y$ without learning the other party's selected value. However, on a successful match, both parties do learn the other person's value -- it's the same as their own value. Does there exist a variant protocol (or way of cheating the existing protocol) wherein only one party learns $x=y$ and the other party learns nothing?
My particular case goes something like this:
- Bob has a small list of people he has invited to his birthday party.
- Bob is happy to let people query his entire list, item by item, via a Socialist Millionaires exchange to see if a particular person is included in the list. However, he does not want to give out the entire list wholesale.
- Alice has a secret crush on Charlie and wants to learn if Charlie is invited to the party. She could learn the answer by engaging Bob in a Socialist Millionaires exchange for every item in Bob's list.
- However, she does not want Bob to learn that she is interested in Charlie's invitation. If Charlie is on Bob's list, Bob will see that he and Alice participated in a matching exchange for his entry for Charlie.
Can Alice learn the equality of "Charlie" against every item on Bob's list, without Bob learning whether any particular item on the list was a match?
To put it another way, I think that this could be done with fully-homomorphic encryption, e.g.:
- Bob encrypts each item in his list with Alice's public key
- Alice sends her request for "Charlie" also encrypted with her public key
- Bob performs a homomorphic equality comparison of each encrypted list item against Alice's encrypted query (that is, Bob performs a $map$ of the encrypted list into a list of encrypted booleans, based on the homomorphic equality comparison of each item)
- Bob sends back a list of homomorphically encrypted booleans describing the matching-state of each comparison
- Alice decrypts Bob's reply with her private key
This case satisfies my requirement (I think?) that Bob learns nothing, because he can decrpyt neither Alice's query nor the results of his own homomorphic equality comparisons.
Is there a way to get a similar guarantee using a zero-knowledge proof exchange?