# Multiple rounds of (Committed) Oblivious Transfer

I would like to know a protocol which computes the following functionality:

• Alice chooses a bit b.
• For i = 1 to n, Bob chooses $$x^i_0$$ and $$x^i_1$$.
• For i = 1 to n, Alice and Bob run $$F_{OT}$$ with Alice, acting as a receiver, inputting b and Bob, acting as a sender, inputting $$x^i_0$$ and $$x^i_1$$, resulting in Alice receiving $$x^1_b, x^2_b, ..., x^n_b$$.
• (optional functionality) For any i in 1 to n, Bob can decide to reveal $$x^i_0$$ and $$x^i_1$$ at a later point.

It is important that Alice cannot change the chosen bit b between $$F_{OT}$$ interactions. Is that possible? Do Commited Oblivious Transfer help? If so, why?

• Generalized multiparty computation with commitments on the inputs could work. It's a whole lot of extra overhead, but it works Aug 2, 2019 at 18:24

The most straightward approach is to have Bob select two random symmetric keys $$k_0$$ and $$k_1$$ and have Bob publish $$Encrypt_{k_0}( x_0^i )$$ and $$Encrypt_{k_1}( x_1^i)$$.
Then, Bob does an OT with Alice, allowing Alice to select between $$k_0$$ or $$k_1$$.
She learns $$k_b$$, and then is able to decrypt all the $$Encrypt_{k_b}( x_b^i )$$ values, resulting in her learning $$x_b^1, x_b^2, …, x_b^n$$
Because she learns only one of $$k_0, k_1$$, the value she learns all come from the same half.