How to break a “secure” oblivious transfer protocol

Abstract

We show how to break a protocol for Oblivious Transfer presented at Euro-crypt 90 [11]. Armed with a new set of definitions for proving the security of interactive computations, we found difficulties in proving the protocol secure. These difficulties led us to a simple attack that breaks the OT protocol in a subtle but fundamental way. The error that we found may be present in a wide variety of secure protocols. It reveals a fundamental flaw in the traditional definition of Oblivious Transfer itself.