1
$\begingroup$

Assume that there is a protocol $(A,B)$ such that receives no input and satisfies:

$A$ - outputs two random bits $x_0, x_1 \in \{0,1\}$

$B$ - outputs a random bit $b \in \{0,1\}$ and also outputs $x_b$

Saying that $(A,B)$ is secure means that $A$ doesn't learn what is $b$, and $B$ doesn't learn what is $x_{\lnot b}$

Now, I need to construct a secure Oblivious Transfer protocol $(S,R)$ using $(A,B)$.

At first, I didn't really understand why I can't just plainly use $(A,B)$ as the Oblivious Transfer protocol, but I guess that since the outputs of $(A,B)$ are random and don't use any input, so it's not really an Oblivious Transfer protocol.

So my idea was to somehow use the output of $(A,B)$, namely $x_0, x_1, b$ as keys in an encryption system that will be used to pass input between $S$ and $R$. I want to use the simplest encryption, so One Time Pad will work for me.

However, I am not sure how exactly construct $(S,R)$, when to use $(A,B)$ and when to use the One Time Pad.

I know that are Oblivious Transfer protocols based on $RSA$ or $DDH$, but I don't think that I need to use them when $(A,B)$ is given to me.

Help would be really appreciated.

Improve this question
$\endgroup$
1
  • $\begingroup$ There is a classic reduction of chosen-inputs-OT to random-inputs-OT, but since this seems like a homework problem I won't take away your opportunity to discover it on your own. I just want to mention that all your observations seem correct so far (use some of the outputs as one-time pad keys). Maybe think separately about the case where the random $b$ happens to be "correct" (it's the one that Bob chose to use in the chosen-input-OT protocol) vs when the random $b$ is wrong. $\endgroup$
    – Mikero
    Commented Jan 2, 2021 at 23:59

0

Reset to default

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.