I read the description of 1-2 oblivious transfer algorithm in wikipedia. In the algorithm described Alice has two messages $m_0, m_1$. Bob picks value $b \in {0,1}$, and the protocol allows Bob to obtain $m_b$, while Alice does not know which value was sent to Bob.

The protocol requires that Alice creates an RSA private,public key pair, and also a value for e. I was wondering if Bob has to perform any verification over there values. It seems to me that Alice can craft special values for N=pq, and e such that it is easier for Alice to find out what was the value of Bob's b.

An edge case would be for Alice to pick e=0. In that case, $k^e = 1$, and therefore the blinding performed by Bob does nothing, and Alice can always discover b.

What if Alice chooses an N that is not really a multiplication of two large primes, with a combination of a specially crafted value of e?

Is there a way for Bob to defend himself against such behavior from Alice?


Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Browse other questions tagged or ask your own question.