# Question on Simplest Oblivious Transfer Protocol

In the paper The Simplest Protocol for Oblivious Transfer, in the scenario where the receiver chooses $$c=1$$, then $$B$$ is calculated as $$Ag^b$$.

Then $$k_1$$ is calculated as $$H( (B/A)^a)$$.

That means that the receiver can calculate the same encryption key, and decrypt message $$M_1$$ (because it's encrypted with $$k_1$$.

Does this imply that $$H( (B/A)^a ) = H( Ag^b)$$ ?

I don't understand how it works in this scenario (receiver choosing $$c=1$$)

• Actually, we have $\LaTeX$/MathJax is enabled here. – kelalaka Apr 10 at 17:17

I don't understand how it works in this scenarios (receiver choosing $$C_1$$)

Initially, the sender picks a random $$a$$ and sends $$A = g^a$$.

Then, in the $$C_1$$ case, the receiver picks a random $$b$$ and sends $$B = Ag^b$$; the receiver also computes the symmetric key $$H(A^b) = H(g^{ab})$$

Then, the sender computes both $$H(B^a)$$ and $$H((B/A)^a)$$, and sends the two messages encrypted by those two keys.

Now, because we're in the $$C_1$$ case, we have $$H((B/A)^a) = H((Ag^b / A)^a) = H((g^b)^a) = H(g^{ab})$$, hence that second message is encrypted by the key that the receiver knows (and hence can read the message). And, because the other key is encrypted by $$H(B^a) = H((Ag^b)^a) = H(g^{a^2+ab})$$ is a value that the receiver does not know (assuming the CDH problem is hard and $$H$$ acts like a random Oracle), and hence he cannot read the first message.

• That's a really clear explanation (as is Hasan's) - thank you! – simbro Apr 14 at 9:45

As you have said, let's say the receiver chooses $$c = 1$$. Then his $$B = Ag^b$$. So In Alice's case, the $$k_0 = H(B^a) = H((Ag^b)^a) = H(g^{a a} g^{a b}) = H(g^{a a + a b})$$. Similarly, $$k_1 = H((\frac{B}{A})^a) = H(g^{ab})$$. Receiver's own key $$k_R$$ is also, $$H(A^b) = H(g^{ab})$$. So you see, his key is similar to the senders key $$k_1$$. That is why, even though the sender is sending both encryptions, the receiver can only decrypt one of these. The one for which the keys are the same, i.e. message 1!