1. The receiver R chooses $a,b,r$ and computes as follows:

    If σ = 0 then $A = (g^a, g^b, g^{ab},g^r)$.

    If σ = 1 then $A = (g^a, g^b, g^r, g^{ab})$. R sends $A$ to S.

  2. Denote $(x,y,z_0,z_1)$ the tuple received by S. Then, S checks that $(x,y,z_0,z_1)\in G$ and that $z_0 \neq z_1$. If not, it aborts outputting ⊥.

    Otherwise, S chooses random $u_0,u_1,v_0,v_1$($\in{1,2,...,q}$) and computes the following four values:

    $w_0 = x^{u_0}·g^{v_0}$, $k_0 = {z_0}^{u_0}·y^{v_0}$

    $w_1 = x^{u_1}·g^{v_1}$, $k_1 = {z_1}^{u_1}·y^{v_1}$

    S then encrypts $m_0$ under $k_0$ and $m_1$ under $k_1$.....

Here are my questions: Is it must necessary to choose random $u_0,u_1,v_0,v_1$, and what if $u_0 = u_1, v_0 = v_1$, in which situation the OT protocol seems work well and property of privacy keep unchanged.


Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Browse other questions tagged or ask your own question.