A:Xb+k-X1, Xb+k-X2 -> k1, k2
A:m0+k0, m1+k1 -> m'1, m'2 -> B
B knows Xb+k (transmitted it in a previous message), X1, X2 (A sent those), hence he can compute k1, k2.
Hence, he can reconstruct both m0, m1, hence the protocol doesn't have the security properties we're looking at...
Now, you don't have to use RSA, however you really do have to use something that has some cryptographical properties. After all, Oblivious Transfer is provably impossible between two computationally-unbounded entities, hence for OT to be possible, we need to use something that a real entity can't solve (but an unbounded entity can); RSA is one such problem (but certainly not the only one).