Multiple rounds of (Committed) Oblivious Transfer

Question

I would like to know a protocol which computes the following functionality:

• Alice chooses a bit b.
• For i = 1 to n, Bob chooses $x^i_0$ and $x^i_1$.
• For i = 1 to n, Alice and Bob run $F_{OT}$ with Alice, acting as a receiver, inputting b and Bob, acting as a sender, inputting $x^i_0$ and $x^i_1$, resulting in Alice receiving $x^1_b, x^2_b, ..., x^n_b$.
• (optional functionality) For any i in 1 to n, Bob can decide to reveal $x^i_0$ and $x^i_1$ at a later point.

It is important that Alice cannot change the chosen bit b between $F_{OT}$ interactions. Is that possible? Do Commited Oblivious Transfer help? If so, why?

Answer 1

The most straightward approach is to have Bob select two random symmetric keys $k_0$ and $k_1$ and have Bob publish $Encrypt_{k_0}( x_0^i )$ and $Encrypt_{k_1}( x_1^i)$.

Then, Bob does an OT with Alice, allowing Alice to select between $k_0$ or $k_1$.

She learns $k_b$, and then is able to decrypt all the $Encrypt_{k_b}( x_b^i )$ values, resulting in her learning $x_b^1, x_b^2, …, x_b^n$

Because she learns only one of $k_0, k_1$, the value she learns all come from the same half.