I'm now reading this paper Extending Oblivious Transfers Efficiently. I understand how to reduce an OT cost. OT extension is a method that replaces an OT with many base-OTs. But I'm still not sure how to implement each base-OT.

  • How is this possible?
  • Any references?

I prefer more recent construction.


You can take a look at LibOT, which is a C++ implementation of several OT extension protocols. In the Readme you can find a list with many base and extension Oblivious Transfer protocols.

A protocol that people use a lot is the Simplest OT (although it was announced that the security proof has a bug by one of the authors at the TPMPC2018 workshop).

Another popular option is PVW, the protocol by Peikert, Vaikuntanathan and Waters. It has two variants. One DDH-based and another LWE-based. The first one is particularly easy to understand and implement.

| improve this answer | |
  • 1
    $\begingroup$ "Simplest OT" has a bug but according to the authors (not published yet), it is secure when used as the base OTs in OT-extension. $\endgroup$ – Mikero Nov 2 '18 at 14:03
  • $\begingroup$ @Mikero Hmmm interesting, didn't know. Was this announced somewhere? Or was it some internal communication $\endgroup$ – Daniel Nov 2 '18 at 15:43
  • $\begingroup$ I don't remember exactly how I came to know this, but I think it was a private communication with Claudio Orlandi. $\endgroup$ – Mikero Nov 2 '18 at 20:43
  • $\begingroup$ @Mikero I see. This is very relevant since it is very rare that OT is used without extension. It also sounds weird, since conceptually you could use OT extension without extending at all, so it would mean that the extension layer "fixes" Simplest OT $\endgroup$ – Daniel Nov 3 '18 at 18:38

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.