Precomputing oblivious transfer

Abstract

Alice and Bob are too untrusting of computer scientists to let their privacy depend on unproven assumptions such as the existence of one-way functions. Firm believers in Schrödinger and Heisenberg, they might accept a quantum OT device, but IBM’s prototype is not yet portable. Instead, as part of their prenuptial agreement, they decide to visit IBM and perform some OT’s in advance, so that any later divorces, coin-flipping or other important interactions can be done more conveniently, without needing expensive third parties. Unfortunately, OT can’t be done in advance in a direct way, because even though Bob might not know what bit Alice will later send (even if she first sends a random bit and later corrects it, for example), he would already know which bit or bits he will receive. We address the problem of precomputing oblivious transfer and show that OT can be precomputed at a cost of Θ(κ) prior transfers (a tight bound). In contrast, we show that variants of OT, such as one-out-of-two OT, can be precomputed using only one prior transfer. Finally, we show that all variants can be reduced to a single precomputed one-out-of-two oblivious transfer.