# Tag Info

My question is the following: why after the OT protocol, $q=r_0 \oplus[s\cdot F(y_R)]$? Let's start with a case-distinction on the first bit of the OTs: $s[0]=0$: In this case the sender gets $r_0[0]$ back. Written differently we actually get $r_0[0] \oplus 0\cdot F(y_R)[0]$ (because a XOR with a zero doesn't change anything). However we're in the case of \$...