Simple oblivious transfer protocols compatible with supersingular isogenies

Abstract

The key exchange protocol of Diffie and Hellman, which can be defined for any group, has the special feature of using only exponentiations. In particular, it can also be instantiated in Kummer varieties, which are not groups, and in the post-quantum isogeny-based setting. In this article, we propose a new simple oblivious transfer (OT) protocol, based on Diffie–Hellman key exchange, that only uses exponentiations; we also revisit the older Wu–Zhang–Wang scheme. Both protocols can be directly instantiated on fast Kummer varieties; more importantly, they can also be transposed in the isogeny setting. The semantic security of our proposals relies on the hardness of non-standard versions of the (supersingular) DH problem, that are investigated within this article. To the best of our knowledge, these protocols are the simplest discrete-log based OT schemes using only exponentiations, and the first isogeny-based OT schemes.