Long distance two-party quantum crypto made simple

Oblivious Transfer(OT) protocol is a fundamental primitive in the modern cryptography. In the realistic unauthenticated setting, we should consider message authentication which is a prime necessity in the information security. It is, however, not considered in general for designing OT protocol because we can provide it in modular way. A shared key is established by authenticated key-exchange(AKE) protocol and used with message authentication code(MAC). By the way, the existing solutions for authentication introduce non-negligible computational overheads such as modular exponentiation. Thus, we have the following question: “Can we build the more efficient authentgnicated OT protocol?” In this work, we show, by presenting an efficient authenticated variant of Naor-Pinkas OT, that it is possible with little costs. We present a conceptually simple and unified primitive that does not require the authenticated channel assumption.

An m out of n oblivious transfer (OT) protocol is a cryptographic protocol for a sender to transfer m out of n messages to a receiver such that the sender has no idea which m messages are obtained by the receiver (receiver security) and at the same time the receiver cannot obtain more than m messages (sender security). Three such protocols are proposed in [1], which have the advantage that the communication overhead of the protocols is much smaller than that of m implementations of a 1 out of n OT protocol. In this paper we give a security analysis of the three protocols. First we show that the first protocol cannot guarantee both the sender security and the receiver security simultaneously. Next, we point out an obvious security flaw in the second protocol which allows the receiver to obtain all the n messages. The third protocol is nicely designed to be non-interactive. However, we show that the security of the protocol is based on a sort of parallel discrete logarithm problem, instead of the discrete logarithm problem as claimed in the paper. Using the technique of "generalized birthday attack", the former problem can be solved with a computation complexity much smaller than that required to solve the discrete logarithm problem.

Though all-or-nothing oblivious transfer and one-out-of-two oblivious transfer are equivalent in classical cryptography, we here show that a protocol built upon secure quantum all-or-nothing oblivious transfer cannot satisfy the rigorous definition of quantum one-out-of-two oblivious transfer due to the nature of quantum cryptography. Thus the securities of the two oblivious transfer protocols are not equivalent at the quantum level. © 2006 The American Physical Society.

Oblivious transfer (OT) and bit commitment (BC) are two-party cryptographic protocols which play crucial roles in the construction of various cryptographic protocols. We propose three practical quantum cryptographic protocols in this paper. We first construct a practical quantum random oblivious transfer (R-OT) protocol based on the fact that non-orthogonal states cannot be reliably distinguished. Then, we construct a fault-tolerant one-out-of-two oblivious transfer ( O T 1 2 ) protocol based on the quantum R-OT protocol. Afterwards, we propose a quantum bit commitment (QBC) protocol which executes the fault-tolerant O T 1 2 several times. Mayers, Lo and Chau (MLC) no-go theorem proves that QBC protocol cannot be unconditionally secure. However, we find that computing the unitary transformation of no-go theorem attack needs so many resources that it is not realistically implementable. We give a definition of physical security for QBC protocols and prove that the practical QBC we proposed is physically secure and can be implemented in the real world.

Suppose that a receiver R wishes to publish an encryption of her secret input x so that every sender S, holding an input y, can reveal f(x, y) to R by sending her a single message. This should be done while simultaneously protecting the secrecy of y against a corrupted R and preventing a corrupted S from having an unfair influence on the output of R beyond what is allowed by f. When the parties are semi-honest, practical solutions can be based on Yao's garbled circuit technique. However, for the general problem when the parties, or even S alone, may be malicious, all known polynomial-time solutions are highly inefficient. This is due in part to the fact that known solutions make a non-black-box use of cryptographic primitives, e.g., for providing non-interactive zero-knowledge proofs of statements involving cryptographic computations on secrets. Motivated by the above question, we consider the problem of secure two-party computation in a model that allows only parallel calls to an ideal oblivious transfer (OT) oracle with no additional interaction. We obtain the following results. - Feasibility. We present the first general protocols in this model which only make a black-box use of a pseudorandom generator (PRG). All previous OT-based protocols either make a non-black-box use of cryptographic primitives or require multiple rounds of interaction. - Efficiency. We also consider the question of minimizing the asymptotic number of PRG calls made by such protocols. We show that polylog(κ) calls are sufficient for each gate in a (large) boolean circuit computing f, where κ is a statistical security parameter guaranteeing at most 2-κ simulation error of a malicious sender. Furthermore, the number of PRG calls per gate can be made constant by settling for a relaxed notion of security which allows a malicious S to arbitrarily correlate the event that R detects cheating with the input of R. This improves over the state of the art also for interactive constant-round black-box protocols, which required Ω(κ) PRG calls per gate, even with similar relaxations of the notion of security. Combining the above results with 2-message (parallel) OT protocols in the CRS model, we get the first solutions to the initial motivating question which only make a black-box use of standard cryptographic primitives.

Oblivious transfer between two untrusting parties is an important primitive in cryptography. There are different variants of oblivious transfer. In Rabin oblivious transfer, the sender Alice holds a bit, and the receiver Bob either obtains the bit, or obtains no information with probability p?. Alice should not know whether or not Bob obtained the bit. We examine a quantum Rabin oblivious transfer (OT) protocol that uses two pure states. Investigating different cheating scenarios for the sender and for the receiver, we determine optimal cheating probabilities in each case. Comparing the quantum Rabin oblivious transfer protocol to classical Rabin oblivious transfer protocols, we show that the quantum protocol outperforms classical protocols, which do not use a third party, for some values of p?. We find that quantum Rabin OT protocols that use mixed states can outperform quantum Rabin OT protocols that use pure states for some values of p?. Published by the American Physical Society 2024

One-sided leakage-resilient privacy only two-message oblivious transfer

The bounded storage model restricts the memory of an adversary in a cryptographic protocol, rather than restricting its computational power, making information theoretically secure protocols feasible. We present the first protocols for commitment and oblivious transfer in the bounded storage model with errors, i.e., the model where the public random sources available to the two parties are not exactly the same, but instead are only required to have a small Hamming distance between themselves. Commitment and oblivious transfer protocols were known previously only for the error-free variant of the bounded storage model, which is harder to realize.

The Yao’s protocol based on garbled circuits is the foundation of secure two-party computation protocols, and Oblivious Transfer (OT), as a important tool in modern cryptography, plays a crucial role in transmitting garbled keys in the Yao’s protocol. In the past decades, considerable attentions have been paid to the Cut-and-Choose technique which is applied to OT protocols to prevent malicious P 1 (called circuit generator) from constructing wrong garbled circuits. Additionally, Bilateral OT becomes a focus point, which can simultaneously transmit P 1 ’s and P 2 ’s (called circuit evaluator) garbled keys to guarantee input consistency of two parties and improve transmission efficiency. As can be seen, some Cut-and-Choose Bilateral OT (CCBOT) protocols have been proposed. Since CCBOT has emerged, the probability of malicious P 1 constructing wrong garbled circuits without being found becomes lower and the input consistency problem is properly resolved too. However, the security of most CCBOT protocols are facing challenges since they are based on the Decisional Diffie-Hellman (DDH) assumption, Quadratic Residues (QR) assumption and Decisional Composite Residuosity (DCR) assumption. In this paper, we present a novel CCBOT protocol with the security against malicious adversaries based on the Computational Diffie-Hellman (CDH) assumption, and analysize the correctness, efficiency and security of the constructed protocol. Besides, we analysize the cheating probability of P 1 in the CCBOT and extend the CCBOT to Single-Choice CCBOT to make the protocol more applicable.

We analyze and enhance Oblivious Transfer (OT) protocols to accommodate security against adaptive attacks. Previous analysis has been static in nature, treating the security of Alice and the security of Bob as separate cases, determined in advance. It remains unclear whether existing protocols are provably secure against adaptive attacks, but we provide enhancements to make them provably secure against attacks by adaptive 1-adversaries, who can choose at any time whether to corrupt Alice or Bob. We determine circumstances under which OT can be ex- ecuted “in the open,” without encrypting the messages, thereby giving simple alternatives to encrypting an entire interaction. We isolate equivocation properties that provide enough flexibility for a simulator to handle adaptive attacks. These properties also provide a means for classifying OT protocols and understanding the subtle demands of security against adaptive adversaries, as well as designing protocols that can be proven secure against adaptive attacks.KeywordsEncryption SchemeSpecification ProtocolOblivious TransferSecure Multiparty ComputationProbabilistic EncryptionThese keywords were added by machine and not by the authors. This process is experimental and the keywords may be updated as the learning algorithm improves.

Neste artigo, apresentamos um protocolo Oblivious Transfer (OT) que combina um esquema OT juntamente com a primitiva do protocolo Supersingular Isogeny Diffie-Hellman (SIDH). Nossa proposta é um candidato para segurança pós-quântica OT e demonstra que o SIDH naturalmente suporta a funcionalidade OT. Consideramos o protocolo na configuração mais simples de (cid:0)2 1 (cid:1)-SIOT e analisamos a sua segurança.

The oblivious transfer protocol is a powerful tool in the design of cryptographic applications, such as coin flipping by the telephone, exchanging secrets and sending certified mail. In this paper, for our purpose of extending the oblivious transfer to the exchange of secrets, we redefine a verifiable oblivious transfer protocol which has the three properties of fairness, verifiability and security. The structure of the protocols is similar to the original protocols proposed by Rabin and Blum. The major difference is that our protocols are based on the difficulty of the discrete logarithm.

Committed Oblivious Transfer (COT) is a two-party primitive that combines one-out-of-two oblivious transfer with bit commitment. In the beginning of COT, a sender is committed to bits b0, b1 and a receiver to a choice bit c. In the end, the receiver is committed to bc without learning anything about b1-c, while the sender learns nothing about c. This primitive implies secure multi-party computation assuming that a broadcast channel is available. In this paper, we introduce the first universally composable unconditionally secure committed oblivious transfer protocol based on a Trusted Initializer (TI), which pre-distributes data to the parties. Our protocol builds on simple bit commitment and oblivious transfer protocols, using XOR commitments to prove simple relations in zero-knowledge. Besides providing very high security guarantees, our protocols are significantly simpler and more efficient than previous results, since they rely on pre-computed operations distributed by the TI.

In a paper from EuroCrypt’99, Damgard, Kilian and Salvail show various positive and negative results on constructing Bit Commitment (BC) and Oblivious Transfer (OT) from Unfair Noisy Channels (UNC), i.e., binary symmetric channels where the error rate is only known to be in a certain interval [γ..δ] and can be chosen adversarily. They also introduce a related primitive called PassiveUNC. We prove in this paper that any OT protocol that can be constructed based on a PassiveUNC and is secure against a passive adversary can be transformed using a generic “compiler” into an OT protocol based on a UNC which is secure against an active adversary. Apart from making positive results easier to prove in general, this also allows correcting a problem in the EuroCrypt’99 paper: There, a positive result was claimed on constructing from UNC an OT that is secure against active cheating. We point out that the proof sketch given for this was incomplete, and we show that a correct proof of a much stronger result follows from our general compilation result and a new technique for transforming between weaker versions of OT with different parameters.

Symmetric password-authenticated key exchange (sPAKE) can be seen as an extension of traditional key exchange where two parties agree on a shared key if and only if they share a common secret (possibly low-entropy) password. We present the first sPAKE protocol to simultaneously achieve the following properties: only two exponentiations per party, the same as plain unauthenticated Diffie-Hellman key agreement (and likely optimal); optimal round complexity: a single flow (one message from each party that can be sent in parallel) to achieve implicit authentication, or two flows to achieve explicit mutual authentication; security in the random oracle model, rather than ideal cipher or generic group model; UC security, rather than game-based. Our protocol is a generalization of the seminal EKE protocol of Bellovin & Merritt (S&P 1992). We also present a UC-secure 1-out-of-N oblivious transfer (OT) protocol, for random payloads. Its communication complexity is independent of N, meaning that N can even be exponential in the security parameter. Such a protocol can also be considered a kind of oblivious PRF (OPRF). Our protocol improves over the leading UC-secure 1-out-of-N OT construction of Masny & Rindal (CCS 2019) for all N>2, and has essentially the same cost for N=2. The new technique underlying these results is a primitive we call programmable-once public function (POPF). Intuitively, a POPF is a function whose output can be programmed by one party on exactly one point. All other outputs of the function are outside of any party's control, in a provable sense.