2

Recently, I am learning the Oblivious Transfer (OT) Protocol. I have some questions about the OT extension. In ALSZ13, we know that $m\times OT_l$ can be reduced to $\kappa\times OT_\kappa$, where $\kappa$ is a security parameter, $l$ is secret's bit length. So my question is:

  • How can I implement $\kappa\times OT_\kappa$? Is it run $OT_\kappa^1$ protocol $\kappa$ times? If yes, is $OT_\kappa^1$ same to NP01 Protocol 3.1 says that $OT_1^N$?
kelalaka
  • 48,443
  • 11
  • 116
  • 196
Viming
  • 65
  • 5

1 Answers1

1

How can I implement $\kappa\times OT_\kappa$?

You pick your favourite public-key based OT protocol. Usually these will allow you to input a choice bit and learn exactly one out of two $r$ bit values in return.

Then you input two random $r$-bit values into that protocol and use the $\kappa$-bit hashes as output. This is your $OT_\kappa$ protocol.

Next, you execute $\kappa$ (e.g. 128) instances of that protocol in parallel with independently random choice bits. This is what is usually done for these OT-extension protocols.

As for building a $OT_\kappa$ from $OT_1$s, you can indeed run $\kappa$ such protocols in parallel with the same choice bit (which is only immediately secure in a semi-honest model).

SEJPM
  • 45,967
  • 7
  • 99
  • 205
  • Much thanks. :) – Viming Oct 28 '20 at 01:24
  • Hello, I have another question about base OT phase, see ALSZ13 Protocol 5.2, is it just need to compute only $\kappa$ times to get the hash input relation between $S$ and $R$? Or can we reuse this relation for different OT extension phase? – Viming Dec 11 '20 at 01:52