I would like to know a protocol which computes the following functionality:

  • Alice chooses a bit b.
  • For i = 1 to n, Bob chooses $x^i_0$ and $x^i_1$.
  • For i = 1 to n, Alice and Bob run $F_{OT}$ with Alice, acting as a receiver, inputting b and Bob, acting as a sender, inputting $x^i_0$ and $x^i_1$, resulting in Alice receiving $x^1_b, x^2_b, ..., x^n_b$.
  • (optional functionality) For any i in 1 to n, Bob can decide to reveal $x^i_0$ and $x^i_1$ at a later point.

It is important that Alice cannot change the chosen bit b between $F_{OT}$ interactions. Is that possible? Do Commited Oblivious Transfer help? If so, why?

  • $\begingroup$ Generalized multiparty computation with commitments on the inputs could work. It's a whole lot of extra overhead, but it works $\endgroup$
    – Natanael
    Aug 2, 2019 at 18:24

1 Answer 1


The most straightward approach is to have Bob select two random symmetric keys $k_0$ and $k_1$ and have Bob publish $Encrypt_{k_0}( x_0^i )$ and $Encrypt_{k_1}( x_1^i)$.

Then, Bob does an OT with Alice, allowing Alice to select between $k_0$ or $k_1$.

She learns $k_b$, and then is able to decrypt all the $Encrypt_{k_b}( x_b^i )$ values, resulting in her learning $x_b^1, x_b^2, …, x_b^n$

Because she learns only one of $k_0, k_1$, the value she learns all come from the same half.


Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Not the answer you're looking for? Browse other questions tagged or ask your own question.