Cryptography Stack Exchange is a question and answer site for software developers, mathematicians and others interested in cryptography. It only takes a minute to sign up.
Sign up to join this community
In the paper The Simplest Protocol for Oblivious Transfer, in the scenario where the receiver chooses $c=1$, then $B$ is calculated as $Ag^b$.
Then $k_1$ is calculated as $H( (B/A)^a)$.
That means that the receiver can calculate the same encryption key, and decrypt message $M_1$ (because it's encrypted with $k_1$.
Does this imply that $H( (B/A)^a ) = H( Ag^b)$ ?
I don't understand how it works in this scenario (receiver choosing $c=1$)
I don't understand how it works in this scenarios (receiver choosing $C_1$)
Initially, the sender picks a random $a$ and sends $A = g^a$.
Then, in the $C_1$ case, the receiver picks a random $b$ and sends $B = Ag^b$; the receiver also computes the symmetric key $H(A^b) = H(g^{ab})$
Then, the sender computes both $H(B^a)$ and $H((B/A)^a)$, and sends the two messages encrypted by those two keys.
Now, because we're in the $C_1$ case, we have $H((B/A)^a) = H((Ag^b / A)^a) = H((g^b)^a) = H(g^{ab})$, hence that second message is encrypted by the key that the receiver knows (and hence can read the message). And, because the other key is encrypted by $H(B^a) = H((Ag^b)^a) = H(g^{a^2+ab})$ is a value that the receiver does not know (assuming the CDH problem is hard and $H$ acts like a random Oracle), and hence he cannot read the first message.
As you have said, let's say the receiver chooses $c = 1$. Then his $B = Ag^b$. So In Alice's case, the $k_0 = H(B^a) = H((Ag^b)^a) = H(g^{a a} g^{a b}) = H(g^{a a + a b})$. Similarly, $k_1 = H((\frac{B}{A})^a) = H(g^{ab})$. Receiver's own key $k_R$ is also, $H(A^b) = H(g^{ab})$. So you see, his key is similar to the senders key $k_1$. That is why, even though the sender is sending both encryptions, the receiver can only decrypt one of these. The one for which the keys are the same, i.e. message 1!
