Oblivious Transfer

• Parties are Sender and Chooser.
• Sender holds two initially private messages.
• By protocol Chooser learns exactly one of the messages.
• Sender does not learn which message Chooser has learned.

Protocols

Naor, Pinkas, Efficient Oblivious Transfer Protocols, SODA 2001.

INITIALIZATION
  G s/gp of Z_p^* of order q|(p-1). p, q prime
  g a generator of G

ASSUMPTIONS
  Computational Diffie_Hellman Assumptions holds for G
  H is a random oracle
 
PROTOCOL

Sender sends random C from G 
                               Chooser picks a random k and sends 
                               key = either g^k or C/g^k
Sender sets 
   key_0 = key and
   k_1 = C/key_0. 
Choose random r_i in G, 
encrypt m_i as pair:
   E_i = (i)  g^r_i; 
         (ii) m_i(+)h(key_i^r_i)
and sends E_1, E_2 to chooser.
                               Chooser can decode exactly one E_i.