Black-Box

Constructions

for

Secure

Computation

It

is

well

known

that

the

secure

computation

of

non-trivial

functionalities

in

the

setting

of

no

honest

majority

requires

computational

assumptions

We

study

the

way

such

computational

assumptions

are

used

Specifically

we

ask

whether

the

secure

protocol

can

use

the

underlying

primitive

-LRB-

e.g.

one-way

trapdoor

permutation

-RRB-

in

a

black-box

way

or

must

it

be

nonblack-box

-LRB-

by

referring

to

the

code

that

computes

this

primitive

-RRB-

Despite

the

fact

that

many

general

constructions

of

cryptographic

schemes

-LRB-

e.g.

CPA-secure

encryption

-RRB-

refer

to

the

underlying

primitive

in

a

black-box

way

only

there

are

some

constructions

that

are

inherently

nonblack-box

Indeed

all

known

constructions

of

protocols

for

general

secure

computation

that

are

secure

in

the

presence

of

a

malicious

adversary

and

without

an

honest

majority

use

the

underlying

primitive

in

a

nonblack-box

way

-LRB-

requiring

to

prove

in

zero-knowledge

statements

that

relate

to

the

primitive

-RRB-

In

this

paper

we

study

whether

such

nonblack-box

use

is

essential

We

present

protocols

that

use

only

black-box

access

to

a

family

of

-LRB-

enhanced

-RRB-

trapdoor

permutations

or

to

a

homomorphic

public-key

encryption

scheme

The

result

is

a

protocol

whose

communication

complexity

is

independent

of

the

computational

complexity

of

the

underlying

primitive

-LRB-

e.g.

a

trapdoor

permutation

-RRB-

and

whose

computational

complexity

grows

only

linearly

with

that

of

the

underlying

primitive

This

is

the

first

protocol

to

exhibit

these

properties

F.

-LSB-

Theory

of

Computation

-RSB-

Interactive

and

reactive

computation

Research

supported

by

grant

from

the

Israel

Science

Foundation

Department

of

Computer

Science

Technion

Israel

email

-LCB-

yuvali

eyalk

erez

-RCB-

@cs

technion.ac.il

Department

of

Computer

Science

Bar-Ilan

University

Israel

email

lindell@cs.biu.ac.il

Much

of

this

work

was

carried

out

while

the

author

was

visiting

the

Technion

Permission

to

make

digital

or

hard

copies

of

all

or

part

of

this

work

for

personal

or

classroom

use

is

granted

without

fee

provided

that

copies

are

not

made

or

distributed

for

profit

or

commercial

advantage

and

that

copies

bear

this

notice

and

the

full

citation

on

the

first

page

To

copy

otherwise

to

republish

to

post

on

servers

or

to

redistribute

to

lists

requires

prior

specific

permission

and/or

a

fee

STOC

May

Seattle

Washington

USA

Copyright

ACM

Algorithms

Theory

It

is

a

known

fact

that

most

cryptographic

tasks

require

the

use

of

computational

hardness

assumptions

These

assumptions

typically

come

in

two

types

specific

assumptions

like

the

hardness

of

factoring

RSA

discrete

log

and

others

and

general

assumptions

like

the

existence

of

one-way

functions

trapdoor

permutations

and

others

In

this

paper

we

refer

to

general

assumptions

and

how

they

are

used

Specifically

we

consider

an

intriguing

question

regarding

how

secure

protocols

utilize

a

primitive

that

is

assumed

to

carry

some

hardness

property

Here

again

there

is

a

clear

distinction

between

two

types

of

uses

Black-box

usage

a

protocol

-LRB-

or

construction

-RRB-

uses

a

primitive

in

a

black-box

way

if

it

refers

only

to

the

input/output

behavior

of

the

primitive

For

example

if

the

primitive

is

a

trapdoor

permutation

then

the

protocol

may

sample

a

permutation

and

its

domain

and

may

compute

the

permutation

and

its

inverse

-LRB-

if

the

trapdoor

is

given

-RRB-

Beyond

this

no

reference

is

made

to

the

primitive

In

particular

the

code

used

to

compute

the

permutation

-LRB-

or

carry

out

any

other

task

-RRB-

is

not

referred

to

by

the

protocol

The

vast

majority

of

constructions

in

cryptography

are

black-box

Nonblack-box

usage

a

protocol

-LRB-

or

construction

-RRB-

uses

a

primitive

in

a

nonblack-box

way

if

it

refers

to

the

code

for

computing

its

functionality

A

typical

example

of

a

nonblack-box

construction

is

where

a

Karp

reduction

is

applied

to

the

circuit

computing

the

function

say

in

order

to

prove

an

N

P

zero-knowledge

proof

as

in

-LSB-

-RSB-

A

rich

and

fruitful

body

of

work

initiated

by

-LSB-

-RSB-

attempts

to

draw

the

borders

between

possibility

and

impossibility

for

black-box

constructions

in

cryptography

While

many

of

the

relations

between

primitives

are

well

understood

there

are

still

some

important

tasks

for

which

the

only

constructions

that

we

have

rely

on

nonblack-box

access

to

the

assumed

primitive

yet

the

existence

of

a

black-box

construction

is

It

is

typically

also

required

that

the

security

proof

of

the

construction

is

black-box

in

the

sense

that

an

adversary

breaking

the

protocol

can

be

used

as

an

oracle

in

order

to

break

the

underlying

primitive

See

e.g.

-LSB-

-RSB-

for

a

comprehensive

treatment

of

black-box

reductions

in

cryptography

not

ruled

out

In

particular

all

known

general

constructions

of

multiparty

protocols

that

are

secure

in

the

presence

of

malicious

adversaries

and

without

an

honest

majority

originating

from

-LSB-

-RSB-

use

nonblack-box

access

to

the

assumed

primitive

-LRB-

We

note

that

by

general

construc-tions

we

mean

constructions

that

can

be

used

to

securely

compute

any

functionality

-RRB-

Another

notable

example

of

this

phenomenon

is

the

case

of

public-key

encryption

that

is

secure

against

chosen-ciphertext

attacks

-LSB-

-RSB-

here

too

all

known

constructions

are

nonblack-box

The

above

phenomenon

begs

the

following

question

Is

it

possible

to

construct

general

protocols

for

secure

computation

without

an

honest

majority

and

with

malicious

adversaries

given

only

black-box

access

to

a

low-level

primitive

Answering

the

above

question

is

of

interest

for

the

following

reasons

First

it

is

of

theoretical

interest

to

understand

whether

or

not

nonblack-box

access

to

a

primitive

is

necessary

for

these

tasks

An

answer

to

this

question

would

enhance

our

understanding

of

how

hardness

assumptions

can

-LRB-

or

must

-RRB-

be

used

Second

as

we

have

mentioned

the

nonblack-box

use

of

the

underlying

primitive

is

typically

utilized

in

order

to

apply

a

Karp

reduction

for

the

purpose

of

using

a

-LRB-

general

-RRB-

zero-knowledge

proof

Such

reductions

are

highly

inefficient

and

are

unlikely

to

be

very

useful

in

practice

Furthermore

in

these

protocols

the

communication

complexity

depends

on

the

complexity

of

computing

the

primitive

and

the

computational

complexity

grows

more

than

linearly

with

that

of

the

primitive

-LRB-

An

exception

to

this

rule

is

the

communication-efficient

compiler

presented

in

-LSB-

-RSB-

which

relies

on

the

communication-efficient

arguments

of

-LSB-

-RSB-

However

the

computational

complexity

of

the

protocol

of

-LSB-

-RSB-

is

even

worse

than

the

GMW

protocol

-LSB-

-RSB-

-RRB-

To

illustrate

the

type

of

inefficiency

resulting

from

current

nonblack-box

constructions

consider

the

following

hypothetical

scenario

Suppose

that

due

to

major

advances

in

cryptanalytic

techniques

the

security

parameter

must

be

large

enough

so

that

all

basic

cryptographic

primitives

require

a

full

second

of

computation

on

a

fast

CPU

In

such

a

case

would

it

still

be

possible

to

carry

out

a

distributed

task

like

oblivious

transfer

Current

nonblack-box

techniques

-LRB-

e.g.

the

GMW

protocol

-LSB-

-RSB-

-RRB-

require

parties

to

prove

in

zero-knowledge

statements

that

involve

the

computation

of

the

underlying

primitive

say

a

trapdoor

permutation

These

zero-knowledge

protocols

in

turn

invoke

cryptographic

primitives

for

any

gate

of

a

circuit

computing

a

trapdoor

permutation

Since

-LRB-

by

our

assumption

-RRB-

a

trapdoor

permutation

takes

one

second

to

compute

its

circuit

implementation

contains

trillions

of

gates

thereby

requiring

the

protocol

trillions

of

second

to

run

In

contrast

a

black-box

construction

of

oblivious

transfer

from

the

trapdoor

permutation

primitive

would

make

the

number

of

invocations

of

the

primitive

independent

of

the

complexity

of

We

stress

that

the

above

discussion

is

only

true

when

considering

general

assumptions

Furthermore

it

is

only

true

when

considering

low-level

primitives

like

trapdoor

permutations

Specifically

there

do

exist

constructions

of

secure

multiparty

protocols

that

use

only

black-box

access

to

an

oblivious

transfer

primitive

-LSB-

-RSB-

However

since

it

is

not

known

how

to

construct

oblivious

transfer

using

only

black-box

access

to

say

trapdoor

permutations

the

overall

construction

obtained

does

not

use

its

low-level

primitive

in

a

black-box

way

implementing

the

primitive

thus

making

oblivious

transfer

feasible

even

in

the

hypothetical

scenario

described

above

We

conclude

that

the

current

nonblack-box

use

of

the

underlying

primitives

constitutes

an

obstacle

to

efficiency

It

is

therefore

of

great

interest

to

know

whether

or

not

it

is

possible

to

obtain

solutions

to

these

tasks

that

do

not

suffer

from

this

obstacle

-LRB-

We

note

that

the

inefficiency

of

nonblack-box

constructions

here

is

quite

ironic

because

in

many

areas

of

cryptography

black-box

constructions

have

been

shown

to

have

inherent

computational

limitations

-LSB-

-RSB-

-RRB-

Despite

the

above

we

stress

that

the

focus

of

this

paper

is

not

on

efficiency

but

rather

on

the

theoretical

question

of

whether

or

not

it

is

possible

to

obtain

the

aforementioned

black-box

constructions

We

believe

this

question

to

be

interesting

in

its

own

right

Our

results

We

show

how

to

construct

general

secure

multiparty

computation

-LRB-

for

the

case

of

no

honest

majority

and

malicious

adversaries

-RRB-

given

black-box

access

to

either

homomorphic

encryption

schemes

or

enhanced

trapdoor

permutations

-LRB-

see

-LSB-

Appendix

C.

-RSB-

for

the

definition

of

enhanced

trapdoor

permutations

-RRB-

We

note

that

all

known

general

constructions

for

this

task

from

low-level

primitives

rely

on

either

enhanced

trapdoor

permutations

or

homomorphic

encryption

schemes

However

they

all

use

them

in

an

inherently

nonblack-box

way

This

is

the

case

even

for

protocols

that

implement

very

simple

functionalities

such

as

oblivious

transfer

We

prove

the

following

Theorem

There

exist

protocols

for

securely

computing

any

multiparty

functionality

without

an

honest

majority

and

in

the

presence

of

static

malicious

adversaries

that

rely

only

on

black-box

access

to

a

family

of

enhanced

trapdoor

permutations

or

to

a

homomorphic

encryption

scheme

We

remark

that

nonblack-box

access

is

not

typically

used

when

considering

semi-honest

adversaries

-LSB-

-RSB-

Rather

the

nonblack-box

access

is

utilized

in

known

protocols

in

order

to

have

the

parties

prove

-LRB-

in

zero-knowledge

-RRB-

that

they

are

correctly

following

the

protocol

specification

This

is

necessary

for

preventing

a

malicious

adversary

from

effec-tively

deviating

from

the

protocol

instructions

We

note

also

that

in

the

case

of

an

honest

majority

it

is

possible

to

securely

compute

any

functionality

information-theoretically

and

without

any

hardness

assumption

-LSB-

-RSB-

Thus

no

primitive

at

all

is

needed

For

this

reason

we

focus

on

the

case

of

no

honest

majority

-LRB-

including

the

important

two-party

case

-RRB-

and

malicious

adversaries

Techniques

In

order

to

prove

Theorem

we

begin

by

constructing

oblivious

transfer

protocols

that

use

only

black-box

access

to

enhanced

trapdoor

permutations

or

homomorphic

encryption

schemes

but

provide

rather

weak

security

guarantees

We

then

boost

the

security

of

these

protocols

in

order

to

obtain

protocols

that

are

secure

in

the

presence

of

malicious

adversaries

Constructions

until

today

that

have

followed

this

paradigm

work

by

first

obtaining

protocols

that

are

secure

in

the

presence

of

semi-honest

adversaries

and

then

boosting

them

so

that

they

are

secure

in

the

presence

of

malicious

adversaries

However

it

is

not

known

how

to

carry

out

this

boosting

in

a

black-box

way

-LRB-

and

indeed

it

has

been

conjectured

that

malicious

oblivious

transfer

can

not

be

constructed

from

semi-honest

oblivious

transfer

in

a

black-box

way

-LSB-

-RSB-

-RRB-

Since

we

wish

to

make

our

construction

black-box

we

take

a

different

route

Protocol

number

Security

for

corrupted

sender

Security

for

corrupted

receiver

Private

for

defensible

sender

Private

for

defensible

receiver

Private

for

defensible

sender

Secure

for

malicious

receiver

Secure

for

malicious

sender

Private

for

defensible

receiver

In

Theorem

Secure

for

malicious

sender

Secure

for

malicious

receiver

Table

The

progression

of

our

constructions

each

protocol

uses

the

previous

one

as

a

subprotocol

Specifically

we

begin

by

introducing

the

notion

of

a

defensible

adversary

In

order

to

describe

this

notion

we

describe

what

a

defense

is

a

defense

is

an

input

and

random-tape

that

is

provided

by

the

adversary

after

the

protocol

execution

concludes

A

defense

is

good

if

the

honest

party

upon

that

input

and

random-tape

would

have

sent

the

same

messages

as

the

adversary

sent

Such

a

defense

is

a

supposed

proof

of

honest

behavior

However

the

adversary

need

not

actually

behave

honestly

and

can

construct

its

defense

retroactively

-LRB-

after

the

execution

concludes

-RRB-

A

protocol

is

said

to

be

private

in

the

presence

of

defensible

adversaries

if

privacy

is

preserved

in

the

event

that

an

adversary

provides

a

good

defense

However

in

the

case

that

the

adversary

does

n't

provide

a

good

defense

nothing

is

guaranteed

and

the

entire

honest

party

's

input

may

be

learned

This

notion

is

therefore

rather

weak

We

note

that

the

oblivious

transfer

protocol

of

-LSB-

-RSB-

is

not

secure

under

this

notion

However

it

can

be

efficiently

modified

into

one

that

is

secure

under

this

notion

It

is

also

possible

to

efficiently

construct

such

an

oblivious

transfer

protocol

from

homomorphic

encryption

Importantly

we

show

that

it

is

possible

to

construct

oblivious

transfer

that

is

secure

in

the

presence

of

malicious

adversaries

from

oblivious

transfer

that

is

private

in

the

presence

of

defensible

adversaries

Furthermore

this

construction

is

black-box

As

we

have

mentioned

we

start

by

constructing

oblivious

transfer

protocols

that

are

private

in

the

presence

of

defensible

adversaries

We

present

two

such

protocols

one

that

uses

black-box

access

to

a

family

of

enhanced

trapdoor

permutations

and

one

that

uses

black-box

access

to

a

homomorphic

public-key

encryption

scheme

Next

we

construct

from

the

above

oblivious

transfer

protocol

a

new

oblivious

transfer

protocol

that

is

still

private

in

the

presence

of

defensible

senders

but

is

secure

in

the

presence

of

malicious

receivers

-LRB-

where

security

is

full

security

according

to

the

ideal/real

simulation

paradigm

-RRB-

This

is

achieved

using

the

so-called

cut-and-choose

technique

That

is

many

oblivious

transfer

executions

-LRB-

using

random

inputs

-RRB-

are

run

and

the

receiver

is

asked

to

present

a

defense

for

its

behavior

in

half

of

them

If

it

indeed

presents

a

good

defense

then

we

are

guaranteed

that

it

behaved

somewhat

honestly

in

most

of

the

executions

We

stress

that

this

step

is

novel

because

the

requirements

on

a

protocol

that

is

secure

according

to

the

ideal/real

simulation

paradigm

are

much

stricter

than

when

only

privacy

is

guaranteed

Indeed

some

efficient

protocols

for

oblivious

transfer

from

the

literature

-LSB-

-RSB-

are

private

for

both

-LRB-

malicious

-RRB-

parties

but

are

not

fully

secure

for

either

party

Nevertheless

we

are

able

to

boost

both

the

resilience

of

the

protocol

-LRB-

from

a

defensible

to

a

malicious

adversary

-RRB-

and

its

security

guarantee

-LRB-

from

privacy

to

full

simulation-based

security

-RRB-

Next

we

reverse

the

oblivious

transfer

protocol

-LRB-

i.e.

by

switching

the

sender

and

receiver

roles

-RRB-

in

order

to

obtain

a

protocol

with

reversed

security

properties

Specifically

this

next

protocol

is

secure

in

the

presence

of

malicious

senders

and

private

in

the

presence

of

defensible

receivers

At

this

point

we

reapply

our

security

boosting

technique

in

order

to

obtain

a

protocol

that

is

fully

secure

that

is

a

protocol

that

is

secure

in

the

presence

of

malicious

senders

and

receivers

See

Table

for

the

series

of

oblivious

transfer

protocols

that

we

construct

Needless

to

say

each

protocol

uses

its

subprotocol

in

a

black-box

way

Finally

having

constructed

secure

oblivious

transfer

protocols

using

only

black-box

access

to

primitives

it

suffices

to

apply

the

well-known

result

of

Kilian

-LSB-

-RSB-

that

shows

that

any

functionality

can

be

securely

computed

using

black-box

access

to

a

secure

oblivious

transfer

protocol

This

therefore

yields

Theorem

as

desired

Related

work

Recently

in

-LSB-

-RSB-

it

was

shown

that

it

is

possible

to

construct

constant-round

protocols

for

the

setting

of

an

honest

majority

that

use

only

black-box

access

to

the

assumed

primitive

As

we

have

mentioned

in

the

setting

of

an

honest

majority

it

is

possible

to

construct

information-theoretically

secure

protocols

-LRB-

which

are

by

triviality

black-box

-RRB-

Nevertheless

there

are

no

known

-LRB-

general

-RRB-

constant-round

protocols

for

the

information-theoretic

setting

and

so

-LSB-

-RSB-

relates

to

this

issue

We

remark

that

the

techniques

used

in

-LSB-

-RSB-

and

here

are

vastly

different

due

to

the

inherent

differences

between

the

setting

of

an

honest

majority

and

that

of

no

honest

majority

Organization

Due

to

lack

of

space

in

this

abstract

we

present

only

brief

sketches

of

the

definitions

and

proofs

Complete

details

appear

in

the

full

version

of

the

paper

We

often

write

OT

as

shorthand

for

oblivious

transfer

We

denote

by

P

-LRB-

n

x

-RRB-

P

-LRB-

n

x

-RRB-

the

transcript

of

an

execution

between

parties

P

and

P

with

a

security

parameter

n

where

P

i

has

input

x

i

and

random-tape

i

For

brevity

we

will

sometimes

omit

the

security

parameter

n

The

message

sent

by

party

P

i

-LRB-

on

the

above

inputs

-RRB-

after

having

received

the

series

of

incoming

messages

is

denoted

by

P

i

-LRB-

x

i

i

-RRB-

Stated

otherwise

P

i

-LRB-

x

i

i

-RRB-

denotes

the

next

message

function

of

P

i

Let

t

P

-LRB-

x

-RRB-

P

-LRB-

x

-RRB-

Then

denote

the

th

message

sent

by

P

i

in

t

by

sent

P

i

-LRB-

t

-RRB-

and

the

first

messages

received

by

P

i

in

t

by

received

P

i

-LRB-

t

-RRB-

We

also

denote

the

output

of

P

i

in

an

execution

by

output

P

i

P

-LRB-

x

-RRB-

P

-LRB-

x

-RRB-

In

our

presentation

we

assume

familiarity

with

the

standard

definitions

of

secure

computation

see

-LSB-

Chapter

-RSB-

for

a

full

treatment

In

this

work

we

consider

malicious

adversaries

-LRB-

i.e.

adversaries

that

may

arbitrarily

deviate

from

the

protocol

specification

-RRB-

and

static

corruptions

-LRB-

meaning

that

the

set

of

corrupted

parties

is

fixed

before

the

protocol

execution

begins

-RRB-

We

use

a

non-uniform

formulation

of

adversaries

here

and

therefore

without

loss

of

generality

assume

that

they

are

deterministic

However

this

is

not

essential

and

all

of

our

proofs

hold

for

the

uniform

model

of

computation

Black-box

access

to

primitives

In

this

paper

we

consider

constructions

of

protocols

that

use

only

black-box

access

to

an

underlying

primitive

This

can

be

easily

formalized

by

defining

oracles

that

provide

the

functionality

of

the

primitive

For

example

a

trapdoor

permutation

can

be

defined

by

an

oracle

that

samples

a

function

description

along

with

a

trapdoor

an

oracle

that

is

given

the

function

description

and

samples

a

random

value

from

the

domain

an

oracle

that

is

given

the

function

description

and

a

point

in

the

domain

and

computes

the

permutation

and

an

oracle

that

is

given

the

trapdoor

and

a

point

in

the

domain

and

computes

the

permutation

inverse

It

is

easy

to

see

that

our

protocols

rely

on

the

underlying

primitive

in

a

black-box

way

We

will

therefore

not

burden

the

presentation

by

formally

defining

these

oracles

We

remark

that

we

also

construct

protocols

that

use

subprotocols

in

a

black-box

way

This

can

be

formalized

by

just

looking

at

the

input/output

behavior

of

the

protocol

We

will

not

formalize

this

It

suffices

for

our

result

to

note

that

if

the

subprotocol

uses

the

underlying

primitive

in

a

black-box

way

then

the

protocol

-LRB-

that

uses

the

subprotocol

-RRB-

also

uses

the

underlying

primitive

in

a

black-box

way

Again

this

is

easy

to

verify

for

all

of

our

protocols

In

addition

to

using

the

underlying

primitive

in

a

black-box

way

our

proofs

of

security

are

also

black-box

Therefore

our

reductions

are

what

are

typically

called

fully

black-box

-LSB-

-RSB-

Defensible

Adversarial

Behavior

We

introduce

the

notion

of

defensible

adversarial

behavior

Loosely

speaking

an

adversary

that

exhibits

defensible

behavior

may

arbitrarily

deviate

from

the

protocol

specification

However

at

the

conclusion

of

the

protocol

execution

the

adversary

must

be

able

to

justify

or

defend

its

behavior

by

presenting

an

input

and

a

random-tape

such

that

the

honest

party

-LRB-

with

this

input

and

random-tape

-RRB-

would

behave

in

the

same

way

as

the

adversary

did

A

protocol

is

private

under

defensible

adversarial

behavior

if

it

is

private

in

the

presence

of

such

adversaries

We

stress

that

if

an

adversary

behaves

maliciously

and

can

not

provide

a

good

defense

then

no

security

guarantees

are

given

We

now

define

the

notion

of

a

good

defense

Intuitively

a

defense

is

an

explanation

of

an

adversary

's

behavior

during

the

protocol

execution

Such

an

explanation

consists

of

an

input

and

random-tape

and

the

defense

is

good

if

an

honest

party

given

that

input

and

random-tape

would

have

sent

the

same

messages

as

the

adversary

did

during

the

protocol

execution

The

formal

definition

follows

Definition

-LRB-

good

defense

for

t

-RRB-

Let

t

be

the

transcript

of

an

execution

of

a

protocol

-LRB-

P

P

-RRB-

between

an

adversary

A

-LRB-

say

controlling

P

-RRB-

and

the

honest

party

-LRB-

say

P

-RRB-

Then

we

say

that

the

pair

-LRB-

x

-RRB-

constitutes

a

good

defense

by

A

for

t

in

denoted

-LRB-

x

-RRB-

defense

A

-LRB-

t

-RRB-

if

for

every

it

holds

that

sent

A

-LRB-

t

-RRB-

P

-LRB-

x

received

A

-LRB-

t

-RRB-

-RRB-

In

other

words

every

message

sent

by

A

in

the

execution

is

such

that

the

honest

party

P

with

input

-LRB-

x

-RRB-

would

have

sent

the

same

message

Security

of

OT

Protocols

The

starting

point

of

our

constructions

is

an

oblivious

transfer

protocol

-LSB-

-RSB-

that

is

private

in

the

presence

of

a

defensible

receiver

or

sender

Recall

that

an

oblivious

transfer

protocol

involves

a

sender

S

with

two

input

strings

s

and

s

and

a

receiver

R

with

an

input

bit

r

-LCB-

-RCB-

Very

informally

an

oblivious

transfer

protocol

has

the

property

that

the

sender

learns

nothing

about

the

receiver

's

bit

r

and

the

receiver

obtains

s

r

but

learns

nothing

about

s

-LRB-

The

variant

of

oblivious-transfer

that

we

use

here

is

usually

referred

to

as

OT

-RRB-

We

begin

by

presenting

the

formal

definition

of

oblivious

transfer

that

is

private

in

the

presence

of

a

defensible

receiver

and

then

proceed

to

define

privacy

in

the

presence

of

a

defensible

sender

Non-trivial

protocols

One

technicality

that

must

be

dealt

with

is

that

a

protocol

that

does

nothing

is

trivially

private

in

that

it

does

not

reveal

anything

about

the

par-ties

inputs

Of

course

such

a

protocol

is

also

useless

In

order

to

make

sure

that

the

oblivious

transfer

protocols

that

we

construct

are

useful

we

define

the

notion

of

a

non-trivial

oblivious

transfer

protocol

Such

a

protocol

has

the

property

that

if

both

the

sender

and

receiver

are

honest

then

the

receiver

will

receive

its

output

as

designated

by

the

oblivious

transfer

functionality

f

-LRB-

-LRB-

s

s

-RRB-

r

-RRB-

-LRB-

s

r

-RRB-

-LRB-

where

denotes

the

empty

output

-RRB-

Privacy

for

random

inputs

in

the

presence

of

a

defensible

receiver

We

now

define

privacy

for

defensible

receivers

Recall

that

the

receiver

in

an

oblivious

transfer

protocol

is

supposed

to

obtain

one

of

the

pair

-LRB-

s

s

-RRB-

in

the

execution

However

the

other

value

must

remain

secret

When

considering

defensible

adversaries

the

requirement

is

that

as

long

as

the

adversary

can

provide

a

good

defense

it

can

only

learn

one

of

the

values

Recall

that

by

Definition

a

party

's

defense

includes

its

input

-LRB-

in

this

case

the

bit

r

of

the

receiver

meaning

that

it

wishes

to

obtain

the

value

s

r

-RRB-

We

therefore

require

that

a

defensible

receiver

can

learn

nothing

about

s

when

its

defense

contains

the

input

value

r.

Due

to

technical

reasons

in

our

proofs

later

on

we

define

privacy

only

for

the

case

that

the

sender

's

inputs

are

uniformly

distributed

bits

Fortunately

this

will

suffice

for

our

constructions

We

define

an

experiment

for

a

protocol

and

an

adversary

A

modelled

by

a

polynomial-size

family

of

circuits

-LCB-

A

n

-RCB-

nN

Informally

the

experiment

begins

by

choosing

a

random

pair

of

bits

-LRB-

s

s

-RRB-

to

be

used

for

the

sender

's

input

The

adversary

's

aim

is

to

guess

the

value

of

the

input

that

it

does

n't

receive

as

output

Experiment

Expt

rec

-LRB-

A

n

-RRB-

Choose

s

s

R

-LCB-

-RCB-

uniformly

at

random

Let

S

be

a

uniformly

distributed

random

tape

for

S

and

let

t

S

-LRB-

n

s

s

S

-RRB-

A

n

Let

-LRB-

-LRB-

r

r

-RRB-

-LRB-

-RRB-

-RRB-

be

the

output

of

A

n

-LRB-

t

-RRB-

-LRB-

The

pair

-LRB-

r

r

-RRB-

constitute

A

n

's

defense

and

is

its

guess

for

s

-RRB-

Output

if

and

only

if

-LRB-

r

r

-RRB-

is

a

good

defense

by

A

n

for

t

in

and

s

Notice

that

by

A

's

defense

it

should

have

received

s

r

The

challenge

of

the

adversary

is

therefore

to

guess

the

value

of

s

if

it

can

not

do

this

then

the

sender

's

privacy

is

preserved

Definition

-LRB-

privacy

for

random

inputs

in

the

presence

of

a

defensible

receiver

-RRB-

Let

-LRB-

S

R

-RRB-

be

a

non-trivial

oblivious

transfer

protocol

We

say

that

is

private

for

random

inputs

in

the

presence

of

a

defensible

receiver

if

for

every

polynomial-size

family

of

circuits

A

-LCB-

A

n

-RCB-

nN

controlling

R

for

every

polynomial

p

-LRB-

-RRB-

and

for

all

sufficiently

large

n

's

Pr

-LSB-

Expt

rec

-LRB-

A

n

-RRB-

-RSB-

p

-LRB-

n

-RRB-

Remark

The

definition

of

Expt

rec

only

considers

the

case

that

the

inputs

of

the

sender

are

uniformly

distributed

We

stress

that

this

is

a

very

weak

definition

However

the

reasons

that

we

make

this

restriction

are

because

-LRB-

a

-RRB-

it

suffices

for

our

construction

of

fully

secure

oblivious

transfer

-LRB-

see

Protocol

-RRB-

and

more

importantly

-LRB-

b

-RRB-

without

this

restriction

we

were

unable

to

prove

the

privacy

of

Protocol

for

defensible

receivers

-LRB-

see

Section

-RRB-

We

stress

that

this

restriction

is

not

made

when

considering

security

in

the

presence

of

malicious

parties

Privacy

in

the

presence

of

a

defensible

sender

In

an

oblivious

transfer

protocol

the

sender

is

not

supposed

to

learn

anything

about

the

receiver

's

input

When

considering

a

defensible

sender

this

means

that

the

sender

should

not

be

able

to

simultaneously

present

a

good

defense

of

its

behavior

and

make

a

correct

guess

as

to

the

value

of

the

receiver

's

input

We

stress

that

this

privacy

requirement

only

needs

to

hold

when

the

sender

outputs

a

good

defense

in

all

other

cases

there

may

be

no

privacy

whatsoever

The

exact

definition

is

formulated

in

a

similar

way

as

above

Security

The

definitions

above

refer

only

to

privacy

meaning

that

the

adversary

can

learn

nothing

more

about

the

honest

party

's

input

than

what

is

revealed

by

the

output

However

these

definitions

say

nothing

about

the

simulata-bility

of

the

protocols

in

question

In

particular

a

protocol

that

is

private

by

one

of

the

above

definitions

may

not

be

secure

according

to

the

real/ideal

simulation

paradigm

-LRB-

see

-LSB-

Chapter

-RSB-

for

these

definitions

-RRB-

When

we

mention

security

in

this

paper

we

refer

to

security

according

to

the

ideal/real

model

paradigm

In

this

section

we

show

how

to

construct

oblivious

transfer

protocols

that

are

private

for

defensible

senders

and

receivers

We

present

two

protocols

one

based

on

homomorphic

encryption

and

one

based

on

enhanced

trapdoor

permutations

Importantly

both

protocols

access

the

underlying

primitive

in

a

black-box

way

only

Bit

OT

from

Homomorphic

Encryption

We

assume

the

existence

of

a

public-key

encryption

scheme

-LRB-

G

E

D

-RRB-

that

is

indistinguishable

under

chosen-plaintext

attacks

and

has

the

following

homomorphic

property

The

plaintext

is

taken

from

a

finite

Abelian

group

determined

by

the

public

key

For

notational

convenience

we

assume

here

that

the

group

is

an

additive

group

Z

q

however

the

same

construction

works

for

multiplicative

groups

as

well

Given

any

public-key

pk

generated

by

the

key

generation

algorithm

G

and

any

two

ciphertexts

c

E

pk

-LRB-

m

-RRB-

and

c

E

pk

-LRB-

m

-RRB-

it

is

possible

to

efficiently

compute

a

random

encryption

of

the

sum

E

pk

-LRB-

m

m

-RRB-

Consequently

it

is

also

possible

to

efficiently

compute

E

pk

-LRB-

m

-RRB-

for

any

known

integer

We

also

assume

that

-LRB-

G

E

D

-RRB-

has

no

decryption

errors

Such

encryption

schemes

can

be

constructed

under

the

quadratic

residuosity

decisional

Diffie-Hellman

and

other

assumptions

see

-LSB-

-RSB-

for

some

references

The

following

protocol

is

implicit

in

-LSB-

-RSB-

Protocol

Inputs

The

sender

S

has

a

pair

of

bits

-LRB-

s

s

-RRB-

the

receiver

R

has

a

bit

r.

The

protocol

The

receiver

R

chooses

a

pair

of

keys

-LRB-

pk

sk

-RRB-

G

-LRB-

n

-RRB-

computes

c

E

pk

-LRB-

r

-RRB-

and

sends

c

and

p

k

to

S.

The

sender

S

uses

the

homomorphic

property

and

its

knowledge

of

s

and

s

to

compute

a

random

encryption

c

E

pk

-LRB-

-LRB-

r

-RRB-

s

rs

-RRB-

R

computes

and

outputs

s

r

D

sk

-LRB-

c

-RRB-

Before

proving

security

note

that

if

S

and

R

are

both

honest

then

R

receives

the

correct

output

For

example

if

r

then

c

E

pk

-LRB-

s

s

-RRB-

E

pk

-LRB-

s

-RRB-

and

so

R

receives

the

correct

value

after

decryption

Claim

Assume

that

the

encryption

scheme

-LRB-

G

E

D

-RRB-

is

indistinguishable

under

chosen-plaintext

attacks

and

has

no

decryption

errors

Then

Protocol

is

a

non-trivial

oblivious

transfer

protocol

that

is

private

in

the

presence

of

defensible

senders

and

private

for

random

inputs

in

the

presence

of

defensible

receivers

Privacy

in

the

presence

of

a

defensible

-LRB-

or

even

malicious

-RRB-

sender

follows

from

the

fact

that

the

sender

's

view

consists

only

of

a

single

encryption

under

E

and

this

encryption

is

secure

Privacy

with

respect

to

a

defensible

receiver

follows

since

the

existence

of

a

proper

defense

implies

that

c

is

indeed

an

encryption

of

or

This

in

turn

guarantees

that

c

is

a

random

encryption

of

s

r

Hence

again

privacy

follows

from

the

security

of

E.

Bit

OT

from

Enhanced

Trapdoor

Permutations

The

following

protocol

is

a

modified

version

of

-LSB-

-RSB-

that

is

private

in

the

presence

of

defensible

adversaries

We

stress

that

the

original

protocol

of

-LSB-

-RSB-

is

completely

insecure

in

the

presence

of

defensible

adversaries

The

construction

uses

any

family

of

enhanced

trapdoor

permutations

Informally

speaking

a

family

of

trapdoor

permutations

is

comprised

of

a

function-sampling

algorithm

I

a

domain-sampling

algorithm

D

f

an

algorithm

F

for

computing

the

permutation

and

an

algorithm

F

for

inverting

the

permutation

-LRB-

given

the

trapdoor

-RRB-

Such

a

family

is

called

enhanced

if

it

is

hard

to

invert

a

random

value

y

even

when

given

the

coins

used

by

the

domain-sampling

algorithm

to

sample

y.

See

-LSB-

Appendix

C.

and

Section

-RSB-

for

a

full

definition

In

the

sequel

we

will

abuse

notation

and

refer

to

the

random

coins

used

by

D

f

as

its

input

We

note

that

the

enhanced

property

is

used

in

all

constructions

of

oblivious

transfer

from

trapdoor

permutations

Indeed

it

has

been

shown

that

black-box

constructions

of

oblivious

transfer

from

plain

trapdoor

permutations

is

impossible

-LSB-

-RSB-

We

will

require

that

I

is

errorless

meaning

that

for

every

series

of

random

coins

provided

to

I

the

description

of

the

function

output

is

indeed

a

permutation

We

call

this

errorless

function

sampling

or

just

errorless

sampling

The

protocol

uses

a

perfectly

binding

commitment

scheme

C

We

denote

a

commitment

to

a

using

randomness

by

C

-LRB-

a

-RRB-

For

simplicity

we

assume

that

in

order

to

commit

to

a

string

a

of

length

n

it

suffices

to

use

a

random

string

that

is

also

of

length

n

Such

a

commitment

scheme

can

be

obtained

using

black-box

access

to

any

trapdoor

permutation

or

homomorphic

encryption

scheme

Protocol

Inputs

The

sender

S

has

a

pair

of

random

bits

-LRB-

s

s

-RRB-

the

receiver

R

has

a

bit

r.

Auxiliary

information

The

description

of

a

family

of

-LRB-

enhanced

-RRB-

trapdoor

permutations

-LRB-

I

D

f

F

F

-RRB-

and

a

hard-core

bit

B

for

the

family

The

protocol

The

receiver

R

chooses

R

-LCB-

-RCB-

n

and

sends

c

C

-LRB-

-RRB-

to

the

sender

S.

S

chooses

a

trapdoor

permutation

pair

-LRB-

i

t

-RRB-

I

-LRB-

n

-RRB-

and

a

random

R

-LCB-

-RCB-

n

and

sends

i

and

to

R.

R

computes

y

D

f

-LRB-

-RRB-

i.e.

y

is

obtained

by

running

the

domain

sampling

algorithm

with

coins

In

addition

R

chooses

R

-LCB-

-RCB-

n

obtains

x

r

D

f

-LRB-

-RRB-

and

computes

y

r

f

i

-LRB-

x

r

-RRB-

Finally

R

sends

-LRB-

y

y

-RRB-

to

S.

S

uses

t

to

compute

B

-LRB-

f

i

-LRB-

y

-RRB-

-RRB-

s

and

B

-LRB-

f

i

-LRB-

y

-RRB-

-RRB-

s

S

sends

-LRB-

-RRB-

to

R.

R

computes

and

outputs

s

r

B

-LRB-

x

r

-RRB-

r

Note

that

the

only

difference

between

Protocol

and

the

protocol

of

-LSB-

-RSB-

is

that

in

-LSB-

-RSB-

the

value

y

is

chosen

singlehandedly

by

the

receiver

whereas

here

the

value

is

chosen

mutually

using

a

-LRB-

weak

non-simulatable

-RRB-

coin-tossing

protocol

-LRB-

Indeed

in

the

protocol

of

-LSB-

-RSB-

a

cheating

receiver

can

just

choose

a

value

y

for

which

it

knows

the

preimage

The

receiver

will

then

learn

both

s

and

s

Note

also

that

a

defensible

receiver

can

also

easily

cheat

in

the

protocol

of

-LSB-

-RSB-

because

it

can

send

any

value

y

and

not

the

value

that

equals

D

f

-LRB-

-RRB-

In

particular

it

can

send

a

value

y

for

which

it

knows

its

preimage

x

under

f

i

and

can

still

claim

in

its

defense

that

its

coins

are

such

that

y

was

sampled

directly

-RRB-

Claim

Assume

that

-LRB-

I

D

f

F

F

-RRB-

is

a

family

of

enhanced

one-way

trapdoor

permutations

and

that

the

scheme

C

is

perfectly

binding

and

computationally

hiding

Then

Protocol

is

a

non-trivial

oblivious

transfer

protocol

that

is

private

in

the

presence

of

defensible

receivers

and

private

for

random

inputs

in

the

presence

of

defensible

senders

Intuitively

a

corrupted

sender

can

not

guess

the

value

of

r

from

-LRB-

y

y

-RRB-

because

these

values

are

identically

distributed

This

actually

only

holds

as

long

as

the

function

f

i

chosen

by

the

sender

is

really

a

permutation

from

the

family

-LRB-

Otherwise

it

may

be

possible

to

distinguish

y

r

which

is

generated

by

computing

f

i

-LRB-

x

r

-RRB-

from

y

which

is

randomly

chosen

from

the

domain

-RRB-

The

fact

that

the

function

is

really

a

permutation

is

proven

in

the

defense

and

so

if

a

good

defense

is

provided

y

r

and

y

are

identically

distributed

We

therefore

have

that

the

only

way

a

defensible

sender

can

learn

the

value

of

r

is

from

the

commitments

However

this

involves

distinguishing

between

c

C

-LRB-

D

f

-LRB-

y

-RRB-

-RRB-

and

c

C

-LRB-

D

f

-LRB-

y

-RRB-

-RRB-

which

is

hard

due

to

the

hiding

property

of

commitments

-LRB-

Notice

that

y

D

f

-LRB-

-RRB-

and

so

c

C

-LRB-

-RRB-

C

-LRB-

D

f

-LRB-

y

-RRB-

-RRB-

Therefore

the

problem

of

guessing

r

reduces

to

the

problem

of

distinguishing

such

commitments

-RRB-

As

for

privacy

in

the

presence

of

a

defensible

receiver

R

intuitively

if

R

behaves

so

that

it

can

present

a

good

defense

then

it

is

unable

to

compute

B

-LRB-

f

-LRB-

y

-RRB-

-RRB-

because

it

has

no

freedom

in

choosing

y

That

is

R

must

choose

y

and

so

it

can

not

know

the

preimage

f

-LRB-

y

-RRB-

This

implies

that

it

can

only

learn

the

sender

's

bit

s

r

In

this

section

we

construct

a

bit

oblivious

transfer

protocol

that

is

secure

in

the

presence

of

a

malicious

receiver

and

private

in

the

presence

of

a

defensible

sender

We

stress

that

the

security

achieved

for

malicious

receivers

is

according

to

the

ideal/real

model

definition

of

security

for

secure

computation

Our

construction

uses

black-box

access

to

an

oblivious

transfer

protocol

that

is

private

for

defensible

receivers

and

senders

-LRB-

like

those

constructed

in

the

previous

section

-RRB-

Thus

in

this

section

we

show

how

to

boost

the

security

guarantee

from

privacy

in

the

presence

of

a

defensible

receiver

to

security

in

the

presence

of

a

malicious

receiver

The

guarantee

regarding

a

corrupted

sender

remains

unchanged

Protocol

Inputs

The

sender

S

has

a

pair

of

bits

-LRB-

s

s

-RRB-

the

receiver

R

has

a

bit

r.

The

protocol

The

receiver

R

chooses

uniformly

distributed

bits

r

r

R

-LCB-

-RCB-

The

sender

S

chooses

pairs

of

random

bits

s

i

s

i

R

-LCB-

-RCB-

for

i

S

and

R

run

parallel

executions

of

a

bit

oblivious

transfer

protocol

that

is

private

in

the

presence

of

defensible

receivers

and

defensible

senders

In

the

i

th

execution

S

inputs

-LRB-

s

i

s

i

-RRB-

and

R

inputs

r

i

Let

t

t

be

the

transcripts

that

result

from

these

executions

S

and

R

run

a

secure

two-party

coin-tossing

protocol

-LRB-

that

accesses

a

one-way

function

in

a

black-box

way

-RRB-

for

generating

a

random

string

of

length

n

q

q

q

n

The

string

q

is

used

to

define

a

set

of

indices

Q

-LCB-

-RCB-

of

size

n

in

the

following

way

Q

-LCB-

q

i

-RCB-

n

i

-LRB-

Thus

for

n

and

q

we

have

that

Q

-LCB-

-RCB-

-RRB-

Sequential

executions

of

the

coin-tossing

protocol

of

-LSB-

-RSB-

can

be

used

The

security

of

this

has

been

proven

formally

in

-LSB-

-RSB-

For

every

i

Q

the

receiver

R

provides

a

defense

-LRB-

r

i

i

r

-RRB-

S

checks

that

for

every

i

Q

the

pair

-LRB-

r

i

i

r

-RRB-

constitutes

a

good

defense

by

R

for

t

i

If

not

then

S

aborts

and

halts

Otherwise

it

continues

to

the

next

step

For

every

j

Q

the

receiver

R

computes

j

r

r

j

-LRB-

where

r

is

R

's

initial

input

-RRB-

and

sends

-LCB-

j

-RCB-

j

Q

to

S.

S

computes

s

j

Q

s

j

j

and

s

j

Q

s

j

and

sends

-LRB-

-RRB-

to

R.

R

computes

and

outputs

s

r

r

j

Q

s

r

j

j

We

note

that

the

sender

's

inputs

to

the

executions

of

the

oblivious

transfer

subprotocol

in

Protocol

are

uniformly

distributed

Therefore

it

suffices

to

use

Protocol

even

though

it

has

only

been

proven

private

for

the

case

of

uniformly

distributed

sender

inputs

We

stress

that

our

proof

below

of

Protocol

relies

on

the

fact

that

the

sender

's

inputs

are

single

bits

Claim

Assume

that

is

a

non-trivial

oblivious

transfer

protocol

that

is

private

for

random

inputs

in

the

presence

of

defensible

senders

and

receivers

Then

Protocol

is

a

non-trivial

oblivious

transfer

protocol

that

is

secure

in

the

presence

of

malicious

receivers

and

private

in

the

presence

of

defensible

senders

Proof

Sketch

We

first

demonstrate

the

non-triviality

property

that

is

we

show

that

if

S

and

R

are

honest

then

R

receives

s

r

as

required

To

see

this

first

note

that

by

the

non-triviality

of

the

receiver

R

obtains

all

of

the

bits

s

r

j

j

and

in

particular

all

s

r

j

j

for

j

Q.

Now

if

r

then

R

sets

j

r

j

for

every

j

Q.

Therefore

R

will

compute

s

j

Q

s

r

j

j

j

Q

s

j

j

This

computation

is

correct

because

S

computed

s

j

Q

s

j

j

In

contrast

if

r

then

j

r

j

for

every

j

which

is

equivalent

to

r

j

j

Thus

once

again

R

's

computation

of

j

Q

s

r

j

j

when

computing

s

equals

S

's

computation

of

j

Q

s

j

when

computing

and

R

will

obtain

Privacy

in

the

presence

of

defensible

senders

We

present

only

the

idea

behind

the

proof

that

Protocol

is

private

in

the

presence

of

a

defensible

sender

A.

Intuitively

if

protocol

is

private

in

the

presence

of

a

defensible

sender

then

a

defensible

adversary

here

can

not

learn

any

of

the

r

i

values

in

the

execution

-LRB-

apart

from

those

explicitly

revealed

by

R

when

it

provides

its

defenses

-RRB-

Therefore

the

j

r

j

r

values

that

it

receives

reveal

nothing

of

the

receiver

's

input

r

because

for

all

j

Q

the

value

r

j

is

not

learned

Security

in

the

presence

of

malicious

receivers

We

present

an

almost

full

proof

that

Protocol

is

secure

in

the

presence

of

malicious

receivers

The

intuition

behind

This

is

due

to

our

definition

of

oblivious

transfer

that

is

private

for

defensible

adversaries

It

is

possible

to

define

a

stronger

notion

of

defensible

adversaries

that

is

sufficient

for

proving

that

Protocol

is

secure

even

when

the

sender

's

inputs

are

strings

of

an

arbitrary

length

However

we

were

not

able

to

prove

that

Protocol

is

private

for

defensible

adversaries

under

this

stronger

notion

-LRB-

in

contrast

to

Protocol

that

can

be

proven

secure

under

the

stronger

notion

-RRB-

this

proof

is

that

the

cut-and-choose

technique

forces

an

adversarial

receiver

A

to

be

able

to

provide

a

good

defense

for

most

of

the

oblivious

transfer

executions

-LRB-

or

be

caught

with

high

probability

-RRB-

In

particular

there

must

be

at

least

one

j

Q

for

which

A

could

have

provided

a

good

defense

This

implies

that

there

exists

some

j

for

which

A

can

not

predict

the

value

of

s

j

j

with

any

non-negligible

advantage

Since

s

is

masked

by

s

j

j

it

follows

that

A

also

learns

nothing

about

s

We

stress

that

the

above

intuition

shows

that

a

malicious

A

can

not

learn

anything

about

s

However

we

actually

need

to

prove

a

much

stronger

claim

in

that

the

protocol

is

secure

for

a

malicious

R

as

defined

via

the

ideal/real

model

simulation

paradigm

We

present

our

analysis

in

the

so-called

hybrid

model

where

the

honest

parties

use

a

trusted

party

to

compute

the

coin-tossing

functionality

for

them

We

now

describe

the

simulator

Sim

for

A

-LCB-

A

n

-RCB-

For

each

i

simulator

Sim

chooses

random

pairs

s

i

s

i

R

-LCB-

-RCB-

and

plays

the

honest

sender

in

with

these

inputs

where

A

n

plays

the

receiver

Sim

chooses

a

random

string

q

R

-LCB-

-RCB-

n

and

hands

it

to

A

n

as

if

it

is

the

output

of

the

coin-tossing

functionality

as

sent

by

the

trusted

party

Let

Q

be

the

index

set

derived

from

q.

Upon

receiving

back

pairs

-LRB-

r

i

i

r

-RRB-

for

i

Q

simulator

Sim

checks

that

they

all

constitute

good

defenses

respectively

If

not

then

it

aborts

-LRB-

just

like

the

honest

sender

-RRB-

Sim

rewinds

A

n

to

the

beginning

of

the

previous

step

and

chooses

a

new

random

string

q

with

associated

index

set

Q

-LRB-

We

stress

that

q

is

independent

of

q.

-RRB-

Sim

hands

q

to

A

n

and

sees

if

it

replies

with

pairs

-LRB-

r

i

i

r

-RRB-

that

are

good

defenses

for

all

i

Q

Sim

repeats

this

process

with

a

new

q

until

A

n

indeed

replies

with

pairs

-LRB-

r

i

i

r

-RRB-

that

are

good

defenses

for

all

i

Q

If

Q

Q

then

Sim

outputs

fail

Otherwise

it

proceeds

to

the

next

step

Given

that

Q

Q

-LRB-

and

Q

Q

-RRB-

there

exists

at

least

one

index

j

such

that

j

Q

but

j

Q.

For

such

a

j

Sim

computes

r

r

j

j

and

sends

r

to

the

trusted

party

-LRB-

Note

that

r

j

is

obtained

from

the

defense

-LRB-

r

j

j

r

-RRB-

that

was

received

from

A

n

after

it

was

sent

the

query

set

Q

In

contrast

j

is

the

value

received

from

A

n

after

rewinding

i.e.

when

the

query

set

was

Q

-RRB-

Upon

receiving

back

a

bit

s

r

from

the

trusted

party

Sim

computes

and

as

follows

-LRB-

a

-RRB-

If

r

then

s

j

Q

s

j

j

and

R

-LCB-

-RCB-

-LRB-

b

-RRB-

If

r

then

R

-LCB-

-RCB-

and

s

j

Q

s

j

Sim

sends

-LRB-

-RRB-

to

A

n

and

output

whatever

A

n

does

We

proceed

to

prove

that

the

joint

output

of

Sim

and

the

honest

sender

S

in

the

ideal

model

is

computationally

indistinguishable

from

the

joint

output

of

A

n

and

S

in

the

real

model

Actually

since

the

honest

S

has

no

output

from

the

protocol

it

suffices

here

to

show

that

the

output

of

Sim

in

the

ideal

model

is

computationally

indistinguishable

from

the

output

of

A

n

in

the

real

model

We

first

claim

that

apart

from

the

pair

-LRB-

-RRB-

the

view

of

A

n

in

the

simulation

with

Sim

is

statistically

close

to

its

view

in

a

real

execution

with

S

the

only

difference

being

in

the

case

that

Sim

outputs

fail

This

can

be

seen

as

follows

if

A

n

does

not

send

good

defenses

after

receiving

q

then

Sim

aborts

just

as

the

honest

S

would

-LRB-

and

in

this

case

the

simulation

is

perfect

-RRB-

If

A

n

does

send

good

defenses

then

Sim

continues

until

it

finds

another

-LRB-

independent

-RRB-

q

for

which

A

n

also

replies

with

good

defenses

It

is

not

hard

to

see

that

this

yields

a

distribution

that

is

the

same

as

in

a

real

execution

except

when

q

q

in

which

case

Sim

outputs

fail

However

this

event

-LRB-

that

it

provides

good

defenses

on

q

and

then

the

next

time

that

it

provides

good

defenses

is

again

on

q

-RRB-

can

happen

with

probability

only

n

We

therefore

have

that

in

the

simulation

by

Sim

the

adversary

A

n

's

partial

view

up

until

the

point

that

it

receives

-LRB-

-RRB-

is

statistically

close

to

its

view

in

a

real

execution

with

S

We

now

show

that

A

n

's

full

view

is

computationally

indistinguishable

To

do

this

we

consider

a

modified

ideal-model

simulator

Sim

who

receives

the

sender

S

's

input

pair

-LRB-

s

s

-RRB-

Simulator

Sim

works

in

exactly

the

same

way

as

Sim

except

that

it

computes

as

an

honest

sender

would

instead

of

choosing

it

uniformly

By

the

above

argument

it

follows

that

the

distribution

generated

by

Sim

in

the

ideal

model

is

statistically

close

to

the

distribution

generated

by

a

real

execution

between

S

and

A

n

-LRB-

Recall

that

Sim

already

generates

r

in

the

same

way

as

an

honest

S

and

therefore

so

does

Sim

-RRB-

It

remains

to

show

that

the

distribution

generated

by

Sim

is

computationally

indistinguishable

to

that

generated

by

Sim

The

only

difference

between

Sim

and

Sim

is

in

the

generation

of

simulator

Sim

generates

it

honestly

whereas

Sim

chooses

it

uniformly

As

mentioned

above

intuitively

indistinguishability

follows

from

the

fact

that

at

least

one

s

j

j

masks

the

value

of

s

Formally

we

show

that

if

this

fake

can

be

distinguished

from

a

real

one

then

we

can

construct

a

defensible

receiver

A

n

that

can

break

the

oblivious

transfer

protocol

That

is

we

show

that

if

the

output

generated

by

Sim

and

Sim

can

be

distinguished

with

non-negligible

probability

then

it

is

possible

for

a

defensible

adversary

A

n

to

succeed

in

the

experiment

of

Definition

with

non-negligible

advantage

with

respect

to

the

subprotocol

Assume

by

contradiction

that

there

exists

a

distinguisher

D

a

polynomial

p

-LRB-

-RRB-

and

infinitely

many

n

's

such

that

Pr

-LSB-

D

-LRB-

output

Sim

-RRB-

-RSB-

Pr

-LSB-

D

-LRB-

output

Sim

-RRB-

-RSB-

p

-LRB-

n

-RRB-

Without

loss

of

generality

assume

that

Pr

-LSB-

D

-LRB-

output

Sim

-RRB-

-RSB-

Pr

-LSB-

D

-LRB-

output

Sim

-RRB-

-RSB-

p

-LRB-

n

-RRB-

-LRB-

-RRB-

We

now

use

the

above

to

construct

a

defensible

adversary

A

-LCB-

A

n

-RCB-

Adversary

A

n

begins

its

attack

by

starting

the

simulation

of

Protocol

according

to

Sim

's

strategy

Specifically

A

n

chooses

s

s

R

-LCB-

-RCB-

and

runs

the

simulation

strategy

of

Sim

with

A

n

up

until

the

point

where

and

are

sent

The

simulation

is

the

same

as

Sim

except

for

the

following

difference

A

n

begins

by

choosing

j

R

-LCB-

-RCB-

and

internally

invokes

A

n

simulating

an

execution

of

Protocol

Then

all

of

the

oblivious

transfers

subexecutions

of

except

for

the

j

th

one

are

run

internally

with

A

n

playing

the

honest

sender

-LRB-

A

n

also

chooses

the

s

i

and

s

i

values

as

S

would

-RRB-

in

contrast

the

messages

of

the

j

th

execution

of

the

oblivious

transfer

protocol

are

forwarded

between

A

n

's

external

sender

and

the

internal

A

n

playing

the

receiver

Following

the

oblivious

transfer

executions

A

n

runs

the

honest

sender

in

the

coin-tossing

protocol

to

generate

q

and

thus

Q

as

required

If

j

Q

then

A

n

outputs

fail

and

halts

Otherwise

A

n

receives

back

the

defenses

since

j

Q

the

j

th

defense

is

included

If

-LRB-

r

j

j

r

-RRB-

is

not

a

good

defense

then

A

n

outputs

fail

and

halts

Otherwise

it

stores

-LRB-

r

j

j

r

-RRB-

and

continues

like

Sim

by

rewinding

A

n

and

generating

a

new

q

and

Q

If

j

Q

then

once

again

A

n

outputs

fail

and

halts

Otherwise

it

continues

like

Sim

-LRB-

using

the

j

chosen

above

for

which

it

is

given

that

j

Q

and

j

Q

-RRB-

A

n

continues

in

the

same

way

that

Sim

does

up

until

-LRB-

but

not

including

-RRB-

the

point

at

which

-LRB-

-RRB-

must

be

sent

Now

A

n

computes

-LRB-

-RRB-

as

follows

First

note

that

A

n

knows

the

values

-LRB-

s

s

-RRB-

and

s

i

s

i

for

all

i

j

-LRB-

because

it

chose

them

-RRB-

However

the

values

s

j

and

s

j

are

not

known

to

A

n

because

these

are

the

values

used

by

the

external

sender

with

whom

it

interacts

Nevertheless

the

-LRB-

good

-RRB-

defense

provided

by

A

n

is

enough

to

obtain

the

value

s

r

j

j

This

holds

because

given

the

transcript

of

the

j

th

oblivious

transfer

execution

and

the

input

and

random-tape

of

the

receiver

it

is

possible

to

derive

s

r

j

j

The

only

value

unknown

to

A

n

is

therefore

s

j

j

Therefore

A

n

is

able

to

compute

r

like

the

honest

sender

In

contrast

it

can

not

honestly

compute

Rather

A

n

guesses

the

value

of

s

j

j

R

-LCB-

-RCB-

randomly

and

then

computes

using

s

all

of

the

s

i

values

that

it

knows

-LRB-

i.e.

all

apart

from

s

j

j

-RRB-

and

the

uniformly

chosen

s

j

j

In

order

to

determine

its

output

A

n

obtains

the

output

of

A

n

and

runs

the

distinguisher

D

-LRB-

from

Eq

-LRB-

-RRB-

-RRB-

on

this

output

let

b

be

the

bit

output

by

D.

Then

A

n

sets

s

j

j

b.

-LRB-

Recall

that

is

A

n

's

guess

for

the

not-received

bit

used

by

the

honest

sender

The

motivation

for

this

guess

is

that

by

Eq

-LRB-

-RRB-

D

outputs

with

higher

probability

on

Sim

-LRB-

when

the

bit

is

random

-RRB-

than

on

Sim

-LRB-

when

the

bit

is

correct

-RRB-

Thus

when

D

outputs

we

flip

A

n

's

guess

for

s

j

j

-RRB-

Finally

A

n

outputs

the

defense

-LRB-

r

j

j

r

-RRB-

from

above

and

the

bit

We

proceed

to

analyze

the

probability

that

A

n

succeeds

in

Expt

rec

First

note

that

unless

A

n

outputs

fail

the

view

of

A

n

when

interacting

with

A

n

above

is

identical

to

its

view

in

the

simulation

by

Sim

This

is

due

to

the

fact

that

A

n

follows

Sim

's

strategy

except

for

two

differences

The

first

difference

is

that

in

the

j

th

execution

of

the

oblivious

transfer

protocol

is

run

externally

However

since

Sim

plays

the

role

of

an

honest

receiver

in

all

of

the

executions

this

makes

no

difference

to

A

n

's

view

The

second

difference

is

in

how

is

computed

Sim

chooses

it

uniformly

whereas

A

n

computes

it

as

described

above

Clearly

the

distribution

generated

is

the

same

because

A

n

uses

a

uniformly

distributed

s

j

j

and

thus

is

also

uniformly

distributed

Now

denote

the

inputs

of

the

honest

sender

that

A

n

interacts

with

by

-LRB-

s

s

-RRB-

Using

the

facts

that

-LRB-

a

-RRB-

A

n

generates

the

exact

same

distribution

as

Sim

-LRB-

b

-RRB-

A

n

sets

s

j

j

b

-LRB-

where

b

is

D

's

output

bit

-RRB-

and

-LRB-

c

-RRB-

A

n

presents

a

good

defense

every

time

that

it

does

not

output

fail

we

have

that

Pr

Expt

rec

-LRB-

A

n

-RRB-

output

A

n

fail

-LRB-

-RRB-

Pr

D

-LRB-

output

Sim

-RRB-

s

j

j

s

j

-LRB-

Recall

that

Expt

rec

-LRB-

A

n

-RRB-

if

A

n

presents

a

good

defense

and

s

j

-RRB-

In

contrast

to

the

above

conditioned

on

the

event

that

s

j

j

s

j

-LRB-

i.e.

the

event

that

A

n

guessed

correctly

-RRB-

the

result

is

an

execution

that

is

distributed

exactly

according

to

Sim

-LRB-

Recall

that

the

only

difference

between

Sim

and

Sim

is

with

respect

to

the

computation

of

-RRB-

That

is

Pr

D

-LRB-

output

Sim

-RRB-

s

j

j

s

j

s

j

j

s

j

Pr

D

-LRB-

output

Sim

-RRB-

s

j

j

s

j

s

j

j

s

j

Pr

-LSB-

D

-LRB-

output

Sim

-RRB-

-RSB-

where

the

last

equality

is

just

due

to

the

fact

that

s

j

j

s

j

Now

recalling

that

s

j

j

is

chosen

uniformly

by

A

n

-LRB-

and

so

equals

s

j

with

probability

exactly

-RRB-

we

have

Pr

D

-LRB-

output

Sim

-RRB-

s

j

j

s

j

Pr

D

-LRB-

output

Sim

-RRB-

s

j

j

s

j

s

j

j

s

j

Pr

D

-LRB-

output

Sim

-RRB-

s

j

j

s

j

s

j

j

s

j

Pr

-LSB-

D

-LRB-

output

Sim

-RRB-

-RSB-

Pr

D

-LRB-

output

Sim

-RRB-

s

j

j

s

j

-LRB-

Pr

-LSB-

D

-LRB-

output

Sim

-RRB-

-RSB-

-RRB-

Pr

D

-LRB-

output

Sim

-RRB-

s

j

j

s

j

Pr

D

-LRB-

output

Sim

-RRB-

s

j

j

s

j

Pr

-LSB-

D

-LRB-

output

Sim

-RRB-

-RSB-

Recalling

again

that

when

s

j

j

s

j

the

output

of

Sim

is

the

same

as

Sim

we

have

that

Pr

D

-LRB-

output

Sim

-RRB-

s

j

j

s

j

Pr

-LSB-

D

-LRB-

output

Sim

-RRB-

-RSB-

Pr

D

-LRB-

output

Sim

-RRB-

s

j

j

s

j

Pr

D

-LRB-

output

Sim

-RRB-

s

j

j

s

j

Pr

-LSB-

D

-LRB-

output

Sim

-RRB-

-RSB-

Pr

-LSB-

D

-LRB-

output

Sim

-RRB-

-RSB-

Pr

-LSB-

D

-LRB-

output

Sim

-RRB-

-RSB-

Combining

the

above

with

Equations

-LRB-

-RRB-

and

-LRB-

-RRB-

we

have

that

for

infinitely

many

n

's

Pr

Expt

rec

-LRB-

A

n

-RRB-

output

A

n

fail

Pr

D

-LRB-

output

Sim

-RRB-

s

j

j

s

j

p

-LRB-

n

-RRB-

Recall

now

that

A

n

outputs

fail

if

A

n

does

not

output

a

good

defense

if

j

Q

or

if

j

Q

We

first

claim

that

A

n

must

output

a

good

defense

with

non-negligible

probability

This

follows

simply

from

the

fact

that

when

A

n

does

not

output

a

good

defense

the

execution

is

truncated

and

the

distributions

generated

by

Sim

and

Sim

are

identical

Therefore

Eq

-LRB-

-RRB-

implies

that

for

infinitely

many

n

's

A

n

outputs

a

good

defense

with

probability

at

least

p

-LRB-

n

-RRB-

Next

recall

that

A

n

chooses

the

sets

Q

and

Q

randomly

-LRB-

under

the

constraints

prescribed

in

the

protocol

-RRB-

Thus

with

probability

exactly

j

Q

and

j

Q

-LRB-

because

the

probability

that

a

given

j

is

in

a

specified

set

is

exactly

-RRB-

We

conclude

that

with

non-negligible

probability

A

n

does

not

output

fail

and

thus

Pr

-LSB-

Expt

rec

-LRB-

A

n

-RRB-

-RSB-

is

non-negligible

It

remains

to

show

that

Sim

runs

in

expected

polynomial-time

Aside

from

the

rewinding

stage

all

work

takes

a

fixed

polynomial

amount

of

time

Regarding

the

rewinding

stage

we

have

the

following

Let

p

denote

the

probability

that

A

n

replies

correctly

upon

a

random

set

of

indices

Q

of

size

n

as

specified

in

the

protocol

Then

given

that

A

n

replied

correctly

to

the

initial

query

set

Q

the

expected

number

of

rewinding

attempts

with

independent

Q

made

by

Sim

equals

p

Since

these

rewinding

attempts

are

only

made

if

A

n

replied

correctly

to

the

initial

query

set

Q

we

have

that

the

expected

number

of

attempts

overall

equals

p

This

completes

the

proof

In

this

section

we

reverse

the

oblivious

transfer

protocol

of

Protocol

to

obtain

a

protocol

that

is

secure

in

the

presence

of

a

malicious

sender

and

private

for

random

inputs

in

the

presence

of

a

defensible

receiver

We

use

the

construction

of

-LSB-

-RSB-

for

reversing

Protocol

The

protocol

is

as

follows

Protocol

-LRB-

reversing

oblivious

transfer

-RRB-

Inputs

The

sender

S

has

a

pair

of

bits

-LRB-

s

s

-RRB-

for

input

and

the

receiver

R

has

a

bit

r.

The

protocol

The

sender

and

receiver

run

an

oblivious

transfer

protocol

that

is

secure

in

the

presence

of

a

malicious

receiver

and

private

in

the

presence

of

a

defensible

sender

-LRB-

a

-RRB-

The

sender

S

playing

the

receiver

in

inputs

r

s

s

-LRB-

b

-RRB-

The

receiver

R

playing

the

sender

in

chooses

a

random

bit

R

-LCB-

-RCB-

and

inputs

s

and

s

r.

Denote

S

's

output

from

by

a.

S

sends

R

the

bit

s

a.

R

outputs

s

r

The

security

of

Protocol

can

be

easily

proven

as

an

information-theoretic

reduction

or

when

the

original

oblivious

transfer

protocol

is

fully

secure

In

contrast

it

is

far

more

subtle

in

the

setting

where

only

privacy

in

the

presence

of

a

defensible

sender

is

assumed

Nevertheless

we

do

obtain

the

following

claim

Claim

If

is

a

non-trivial

oblivious

transfer

protocol

that

is

secure

in

the

presence

of

a

malicious

receiver

and

private

in

the

presence

of

a

defensible

sender

then

Protocol

is

a

non-trivial

oblivious

transfer

protocol

that

is

secure

in

the

presence

of

a

malicious

sender

and

private

for

random

inputs

in

the

presence

of

a

defensible

receiver

In

this

section

we

use

the

construction

of

Protocol

again

in

order

to

boost

the

security

of

Protocol

so

that

it

is

secure

in

the

presence

of

both

a

malicious

sender

and

a

malicious

receiver

we

call

such

a

protocol

fully

secure

to

stress

that

it

is

secure

in

the

face

of

any

corruption

By

Claim

we

have

that

Protocol

boosts

the

security

of

any

oblivious

transfer

protocol

that

is

private

for

defensible

receivers

into

one

that

is

secure

in

the

presence

of

malicious

receivers

We

can

therefore

use

Protocol

to

boost

the

security

of

Protocol

so

that

the

result

is

a

protocol

that

is

secure

in

the

presence

of

malicious

receivers

This

does

not

suffice

however

because

we

must

show

that

if

the

subprotocol

used

in

Protocol

is

secure

in

the

presence

of

malicious

senders

then

the

result

is

still

secure

in

the

presence

of

malicious

senders

-LRB-

Claim

considers

only

privacy

for

defensible

senders

-RRB-

This

is

actually

easy

to

show

and

is

omitted

here

due

to

lack

of

space

Theorem

Assume

that

there

exists

a

non-trivial

bit

oblivious

transfer

protocol

that

is

secure

in

the

presence

of

malicious

senders

and

private

for

random

inputs

in

the

presence

of

defensible

receivers

Then

Protocol

that

is

in-stantiated

using

this

is

a

non-trivial

bit

oblivious

transfer

protocol

that

is

secure

in

the

presence

of

malicious

receivers

and

senders

Black-box

construction

of

oblivious

transfer

Noting

that

perfectly-binding

commitment

schemes

-LRB-

as

used

in

Protocol

-RRB-

can

be

constructed

using

black-box

access

to

homomorphic

encryption

or

enhanced

trapdoor

permutations

and

combining

Protocols

and

with

Protocol

followed

by

Protocol

and

the

construction

in

Theorem

we

obtain

secure

bit

oblivious

transfer

with

black-box

access

to

a

homomorphic

encryption

scheme

or

a

family

of

enhanced

trapdoor

permutations

Kilian

-LSB-

-RSB-

showed

that

any

function

can

be

securely

computed

given

black-box

access

to

a

bit

oblivious

transfer

functionality

We

therefore

have

the

following

theorem

that

constitutes

our

main

result

Theorem

Assume

that

there

exist

homomorphic

encryption

schemes

with

errorless

decryption

or

families

of

enhanced

trapdoor

permutations

Then

for

any

probabilis-tic

polynomial-time

functionality

f

there

exists

a

protocol

that

uses

only

black-box

access

to

a

homomorphic

encryption

scheme

or

to

a

family

of

enhanced

trapdoor

permutations

and

securely

computes

f

with

any

number

of

corrupted

parties

and

in

the

presence

of

a

static

malicious

adversary

We

remark

that

as

is

standard

for

the

setting

of

no

honest

majority

the

security

guarantee

achieved

here

is

that

of

se-curity

with

abort

see

-LSB-

Chapter

-RSB-

for

formal

definitions

-LSB-

-RSB-

W.

Aiello

Y.

Ishai

and

O.

Reingold

Priced

Oblivious

Transfer

How

to

Sell

Digital

Goods

In

EUROCRYPT

Springer-Verlag

-LRB-

LNCS

-RRB-

pages

-LSB-

-RSB-

M.

Ben-Or

S.

Goldwasser

and

A.

Wigderson

Completeness

Theorems

for

Non-Cryptographic

Fault-Tolerant

Distributed

Computation

In

STOC

pages

-LSB-

-RSB-

M.

Blum

Coin

Flipping

by

Phone

In

IEEE

Spring

COMPCOM

pages

-LSB-

-RSB-

R.

Canetti

Security

and

Composition

of

Multiparty

Cryptographic

Protocols

Journal

of

Cryptology

-LRB-

-RRB-

-LSB-

-RSB-

D.

Chaum

C.

Cr

epeau

and

I.

Damg

ard

Multi-party

Uncond-itionally

Secure

Protocols

In

STOC

pages

-LSB-

-RSB-

I.

Damg

ard

and

Y.

Ishai

Constant-Round

Multiparty

Computation

Using

a

Black-Box

Pseudorandom

Generator

In

CRYPTO

Springer-Verlag

-LRB-

LNCS

-RRB-

pages

-LSB-

-RSB-

D.

Dolev

C.

Dwork

and

M.

Naor

Non-Malleable

Cryptography

SIAM

Journal

on

Computing

-LRB-

-RRB-

-LSB-

-RSB-

S.

Even

O.

Goldreich

and

A.

Lempel

A

Randomized

Protocol

for

Signing

Contracts

In

Communications

of

the

ACM

-LRB-

-RRB-

-LSB-

-RSB-

R.

Gennaro

Y.

Lindell

and

T.

Malkin

Enhanced

versus

Plain

Trapdoor

Permutations

for

Non-Interactive

Zero-Knowledge

and

Oblivious

Transfer

Manuscript

in

preparation

-LSB-

-RSB-

R.

Gennaro

and

L.

Trevisan

Lower

Bounds

on

the

Efficiency

of

Generic

Cryptographic

Constructions

In

FOCS

pages

-LSB-

-RSB-

Y.

Gertner

S.

Kannan

T.

Malkin

O.

Reingold

and

M.

Viswanathan

The

Relationship

between

Public

Key

Encryption

and

Oblivious

Transfer

In

FOCS

pages

-LSB-

-RSB-

Y.

Gertner

T.

Malkin

and

O.

Reingold

On

the

Impossibility

of

Basing

Trapdoor

Functions

on

Trapdoor

Predicates

In

FOCS

pages

-LSB-

-RSB-

O.

Goldreich

Foundations

of

Cryptography

Volume

Basic

Applications

Cambridge

University

Press

-LSB-

-RSB-

O.

Goldreich

S.

Micali

and

A.

Wigderson

Proofs

that

Yield

Nothing

but

their

Validity

or

All

Languages

in

NP

Have

Zero-Knowledge

Proof

Systems

Journal

of

the

ACM

-LRB-

-RRB-

-LSB-

-RSB-

O.

Goldreich

S.

Micali

and

A.

Wigderson

How

to

Play

any

Mental

Game

A

Completeness

Theorem

for

Protocols

with

Honest

Majority

In

STOC

pages

-LSB-

-RSB-

R.

Impagliazzo

and

S.

Rudich

Limits

on

the

Provable

Consequences

of

One-way

Permutations

In

CRYPTO

Springer-Verlag

-LRB-

LNCS

-RRB-

pages

-LSB-

-RSB-

Y.T.

Kalai

Smooth

Projective

Hashing

and

Two-Message

Oblivious

Transfer

In

EUROCRYPT

Springer-Verlag

-LRB-

LNCS

-RRB-

pages

-LSB-

-RSB-

J.

Kilian

Founding

Cryptograph

on

Oblivious

Transfer

In

STOC

pages

-LSB-

-RSB-

J.

Kilian

Uses

of

Randomness

In

Algorithms

and

Protocols

MIT

Press

-LSB-

-RSB-

J.

Kilian

Improved

Efficient

Arguments

In

CRYPTO

Springer-Verlag

-LRB-

LNCS

-RRB-

pages

-LSB-

-RSB-

J.H.

Kim

D.R.

Simon

and

P.

Tetali

Limits

on

the

Efficiency

of

One-Way

Permutation-Based

Hash

Functions

In

FOCS

pages

-LSB-

-RSB-

E.

Kushilevitz

and

R.

Ostrovsky

Replication

Is

Not

Needed

Single

Database

Computationally-Private

Information

Retrieval

In

FOCS

pages

-LSB-

-RSB-

Y.

Lindell

A

Simpler

Construction

of

Public-Key

Encryption

Under

General

Assumptions

In

EUROCRYPT

Springer-Verlag

-LRB-

LNCS

-RRB-

pages

-LSB-

-RSB-

T.

Malkin

and

O.

Reingold

Personal

communication

-LSB-

-RSB-

S.

Micali

Computationally

Sound

Proofs

SIAM

Journal

on

Computing

-LRB-

-RRB-

-LSB-

-RSB-

M.

Naor

and

K.

Nissim

Communication

Preserving

Protocols

for

Secure

Function

Evaluation

In

STOC

pages

-LSB-

-RSB-

M.

Naor

and

B.

Pinkas

Efficient

Oblivious

Transfer

Protocols

In

SODA

pages

-LSB-

-RSB-

M.

Rabin

How

to

Exchange

Secrets

by

Oblivious

Transfer

Tech

Memo

Harvard

University

-LSB-

-RSB-

O.

Reingold

L.

Trevisan

and

S.

Vadhan

Notions

of

Reducibility

between

Cryptographic

Primitives

In

TCC

pages

-LSB-

-RSB-

A.

Sahai

Non-Malleable

Non-Interactive

Zero-Knowledge

and

Adaptive

Chosen-Ciphertext

Security

In

FOCS

pages

-LSB-

-RSB-

S.

Wolf

and

J.

Wullschleger

Oblivious

Transfer

Is

Symmetric

To

appear

in

EUROCRYPT

Appears

at

Cryptology

ePrint

Archive

Report

-LSB-

-RSB-

A.

Yao

How

to

Generate

and

Exchange

Secrets

In

FOCS

pages

oblivious transfer protocol
oblivious transfer
cryptographic
secure computation
encryption scheme
trapdoor permutation
malicious adversary

black-box
nonblack-box
theory of cryptography
black-box reductions