# Extractor for Oblivious Transfer Protocol

In a paper that I have been reading (https://cs.nyu.edu/~ganesh/zk.pdf), in one of the proofs, this has been said:

The simulator works as follows: It uses the OT simulator to extract the prover’s input $$x_0$$ to the OT.

How exactly does this work? There's nothing defined in the paper itself, and I couldn't find anything related to an extractor for an oblivious transfer protocol. (The paper also uses extractors for ZKPOK, but that has been defined)

The paper is about garbled-circuit-based ZK protocol, in which the verifier generates the garbled circuit, and the prover obtains the wire labels corresponding to his private input $$x_0$$ through COT (committed OT).

The simulation in your problem works by letting the simulator simulate the ideal functionality of COT, which is defined in Fig. 1 on page 4. Here the receiver is the prover. Now the prover needs to invoke the COT ideal functionality by sending $$(choose,b_i)$$ to the ideal functionality where $$b_i\in \{0,1\}$$ is the $$i$$-th bit in the prover's input $$x_0$$. Since this ideal functionality is simulated by the simulator, the simulator gets all $$b_i$$ thus "extracts" the prover's input $$x_0$$.