1
$\begingroup$
  1. The receiver R chooses $a,b,r$ and computes as follows:

    If σ = 0 then $A = (g^a, g^b, g^{ab},g^r)$.

    If σ = 1 then $A = (g^a, g^b, g^r, g^{ab})$. R sends $A$ to S.

  2. Denote $(x,y,z_0,z_1)$ the tuple received by S. Then, S checks that $(x,y,z_0,z_1)\in G$ and that $z_0 \neq z_1$. If not, it aborts outputting ⊥.

    Otherwise, S chooses random $u_0,u_1,v_0,v_1$($\in{1,2,...,q}$) and computes the following four values:

    $w_0 = x^{u_0}·g^{v_0}$, $k_0 = {z_0}^{u_0}·y^{v_0}$

    $w_1 = x^{u_1}·g^{v_1}$, $k_1 = {z_1}^{u_1}·y^{v_1}$

    S then encrypts $m_0$ under $k_0$ and $m_1$ under $k_1$.....

Here are my questions: Is it must necessary to choose random $u_0,u_1,v_0,v_1$, and what if $u_0 = u_1, v_0 = v_1$, in which situation the OT protocol seems work well and property of privacy keep unchanged.

$\endgroup$

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Browse other questions tagged or ask your own question.