# How to formally define the security of Random Oblivious Transfer

Assume that there is a protocol $$(A,B)$$ such that receives no input and satisfies:

$$A$$ - outputs two random bits $$x_0, x_1 \in \{0,1\}$$

$$B$$ - outputs a random bit $$b \in \{0,1\}$$ and also outputs $$x_b$$

$$A$$ is supposed to learn what is $$b$$, and $$B$$ isn't supposed to learn what is $$x_{\lnot b}$$

I want to formally define the security of $$(A,B)$$.

Intuitively, I think I understand how to define the security of $$(A,B)$$, but I'm having problem how to formally write it.

For example, about the security of $$A$$ (the sender), I thought about this:

A is secure, if for every adversary $$B^*$$ of time complexity at most $$T$$, $$B^*$$ can guess correctly the value of $$x_{\lnot b}$$ with probability of at most $$\frac{1}{2} + \epsilon$$

Now, I want to write this as a math statement using probabilities, but I am not sure exactly how.

The same goes about the security of $$B$$.

Help would be appreciated.

• Your description of ROT is incorrect. Jan 5 at 8:59
• Your third criteria should be "$A$ is not supposed to learn what $b$ is and $B$ isn't supposed to learn what is $x_{\neg b}$". To write your statement using math formalism, have $B^*$ output a guess for $x_{\neg b}$ and describe the probability that this guess is correct. Jan 8 at 22:57