2
$\begingroup$

Refer to the chart on 1-2 oblivious transfer : https://en.wikipedia.org/wiki/Oblivious_transfer

I'm Bob, I know N,e,x0,x1. Can I send Alice a v value that, by knowing the m'0,m'1 received, I can crack both m0 and m1?

Thank you

$\endgroup$

1 Answer 1

3
$\begingroup$

Can I send Alice a v value that, by knowing the m'0,m'1 received, I can crack both m0 and m1?

One would hope not; if Bob can, this would show that the proposed protocol does not meet the security requirements of an OT protocol.

However, in this case, selecting such a $v$ value would appear to be difficult. What Bob would need to do is find two values $y, y'$ that map to two values with an Alice specified difference, that is, $y^e - y'^e = x_1 - x_0$.

If Bob can do that, we can learn both values (by setting $v = y^e + x_0$. Conversely, if he knows a value $v$ for which he can learn both secrets, he can compute such a $y, y'$ pair, hence this reformulation of the problem is tight.

However, the mapping $x \rightarrow x^e$ acts unpredictably (if you don't know the factorization); there is no known way to find such a pair for a random difference $x_1 - x_0$.

$\endgroup$

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.