Cr epeau, C., "Equivalence between two flavours of oblivious transfers", In Advances in Cryptology: Proceedings of Crypto '87, Lecture Notes in Computer Science, Springer-Verlag, August 1987, pp. 350 -- 354.  Home/Search   Document Not in Database   Summary   Related Articles   Check

....of the function but not their respective inputs. It was shown in a computational model that One out of two Oblivious Transfer su#ces to perform general secure computations by Goldreich, Micali and Wigderson [17] and later in an abstract (non computational) model by Kilian [20] Crepeau showed [8] that Rabin s Oblivious Transfer is as powerful as One out of two Oblivious Transfer. The OVCS problem is of course a special case of the general secure computation. Nevertheless, if we were to rely on general reductions from secure computation to Oblivious Transfers we would end up with a very ....

Cr epeau, C., "Equivalence between two flavours of oblivious transfers", In Advances in Cryptology: Proceedings of Crypto '87, Lecture Notes in Computer Science, Springer-Verlag, August 1987, pp. 350 -- 354.

....an idealized implementation of the primitive, except possibly with exponentially small probability. Many results in cryptography can be phrased as a reduction among primitives. Some of them were mentioned above, and a few are listed below: Many reduction results for oblivious transfer (e.g. [8, 10, 14 16, 18, 20]) Secret key agreement by public discussion from noisy channels as discussed in the previous section can be interpreted as the reduction of key agreement to a certain type of noisy source. Privacy amplification [6, 5] an important sub protocol in unconditional key agreement, can be ....

C. Cr'epeau, Equivalence between two flavours of oblivious transfer, Advances in Cryptology - CRYPTO '87, Lecture Notes in Computer Science, pp. 350--354, Springer-Verlag, 1988.

....protocol, one must prove that the subroutine remains secure when composed in the specific way it is used. For this reason, we describe a notion of secure reduction that enables us to prove general results on composition of protocols. The idea of a reduction has appeared before in the literature [BVV84,BCR86,Cr e88], but the notion of security was missing. Unlike very general results that give very general ways of building cryptographic protocols but lead to inefficient solutions, reductions give a number of tools to choose from to built protocols. Using the most appropriate building block one can design ....

....therefore of the theorem 3.5 follows. 3.5 Generalization Notice that the reduction 3.1 does not rely very much on the fact that OBT transfers bits with probability 1 2 . Indeed the same reduction can be generalized to use an OBT protocol that transfer bits with an arbitrary probability p (see [Cr e88]) The only difference necessary to adjust to p is to use sets of size 2ps 3 in step 3 instead of s 3 , when p 3 4 and of size s 2 when p 3 4 . 3.6 Conclusion The techniques developed in this chapter are very useful. In the next chapter we use similar techniques to reduce ....

C. Cr'epeau. Equivalence between two flavours of oblivious transfers (abstract) . In C. Pomerance, editor, Advances in Cryptology: Proceedings of Crypto '87, volume 293 of Lecture Notes on Computer Science, pages 350--354. Springer-Verlag, 1988.

.... and All or Nothing Disclosure of Secrets (a generalization of one out of two oblivious transfer) of Brassard, Cr epeau and Robert [15] All these different tasks were shown equivalent: any one of them can be implemented securely starting with a secure protocol of any other one of them [14, 20, 24, 23, 21]. In particular, any of these protocols can be used to achieve the following very general task [44, 33, 17, 39, 22] Secure two party computation: Consider a twoparameter polynomial time computable function f . One party knows input x and the other party knows input y. The protocol allows both ....

C. Cr'epeau. Equivalence between two flavours of oblivious transfers (abstract). In C. Pomerance, editor, Advances in Cryptology: Proceedings of Crypto '87, volume 293 of Lecture Notes in Computer Science, pages 350--354. SpringerVerlag, 1988.

....of the function but not their respective inputs. It was shown in a computational model that One out of two Oblivious Transfer su#ces to perform general secure computations by Goldreich, Micali and Wigderson [17] and later in an abstract (non computational) model by Kilian [20] Crepeau showed [8] that Rabin s Oblivious Transfer is as powerful as One out of two Oblivious Transfer. The OVCS problem is of course a special case of the general secure computation. Nevertheless, if we were to rely on general reductions from secure computation to Oblivious Transfers we would end up with a very ....

Cr epeau, C., "Equivalence between two flavours of oblivious transfers", In Advances in Cryptology: Proceedings of Crypto '87, Lecture Notes in Computer Science, Springer-Verlag, August 1987, pp. 350 -- 354.

....value f( b; r) m; r 0 1 ; r 0 2 ) on its output tape, where f( b; r) m; r 0 1 ; r 0 2 ) m 8 b; r 0 2 ) if r = r 0 1 , and = m; 1 8 r 0 2 ) if r 6= r 0 1 . There are many other types of Oblivious Transfer that have all been shown to be equivalent to the simple one [26] [37] [38] One important alternative is called 1 2 Oblivious Transfer [40] abbreviated 1 2 OT ) In this version, player A begins with two secret bits b 0 and b 1 . Player B can choose to receive exactly one of these bits, without letting A know which bit was chosen. Oblivious Transfer is one of ....

....of Oblivious Transfer, more sophis10 ticated protocols can be built from this primitive. In fact, secure distributed computation can be reduced to Oblivious Transfer [57] 13] 47] as will be discussed in later sections. To give a simpler reduction now, the following scheme, due to Cr epeau [37], achieves bit commitment through oblivious transfer: 1. Player A chooses random b 1 ; 1 1 1 ; b n such that b 1 8 1 1 1 8 b n = b. 2. Player A sends each b i , in order, to player B by oblivious transfer. At this point, player A has committed to bit b. To reveal the committed bit b, player A ....

[Article contains additional citation context not shown here]

C. Cr'epeau, "Equivalence between two flavours of Oblivious Transfer," Crypto 87, 350-354.

....and leakage of an exponentially small amount of information. 1.2 Related Work Reductions among oblivious transfers and disclosure problems have a long history in cryptography. It is known how to implement any of the basic variants, OT, Gamma 2 1 Delta OT, and GOT, in terms of each other [BCR86, Cr e88], even in a way where an online protocol uses only precomputed transfers [Bea95] Several ways to weaken the security assumptions for oblivious transfer were considered previously by Cr epeau and Kilian [CK88] Research on reductions from Gamma 2 1 Delta OT k string OT to bitwise Gamma 2 ....

Claude Cr'epeau, Equivalence between two flavours of oblivious transfer, Advances in Cryptology: CRYPTO '87 (Carl Pomerance, ed.), Lecture Notes in Computer Science, vol. 293, Springer, 1988, pp. 350--354.

....f( b; r) m; r 0 1 ; r 0 2 ) on its output tape, where f( b; r) m; r 0 1 ; r 0 2 ) m Phi b; r 0 2 ) if r = r 0 1 , and = m; 1 Phi r 0 2 ) if r 6= r 0 1 . There are many other types of Oblivious Transfer that have all been shown to be equivalent to the simple one [34] [54] [55] One important alternative is called 1 2 Oblivious Transfer [65] abbreviated 1 2 OT ) In this version, player A begins with two secret bits b 0 and b 1 . Player B can choose to receive exactly one of these bits, without letting A know which bit was chosen. Oblivious Transfer is one of ....

....versions of Oblivious Transfer, more sophisticated protocols can be built from this primitive. In fact, secure distributed computation can be reduced to Oblivious Transfer [96] 15] 84] as will be discussed in later sections. To give a simpler reduction now, the following scheme, due to Cr epeau [54], achieves bit commitment through oblivious transfer: 1. Player A chooses random b 1 ; Delta Delta Delta ; b n such that b 1 Phi Delta Delta Delta Phi b n = b. 2. Player A sends each b i , in order, to player B by oblivious transfer. At this point, player A has committed to bit b. To ....

[Article contains additional citation context not shown here]

C. Cr'epeau, "Equivalence between two flavours of Oblivious Transfer," in Advances in Cryptology---CRYPTO '87 Proceedings (Lecture Notes in Computer Science, Vol. 293), ed. C. Pomerance, 350--354, Springer-Verlag, New York, 1988.

.... the notion of oblivious transfer to help solve the problem of exchanging secrets, a problem also studied by Blum [4] Protocols for oblivious transfer have been studied by Even, Goldreich, and Lempel [11, 12] Fischer, Micali, and Rackoff [14] Berger, Peralta, and Tedrick [3] Cr epeau [6], and others [19, 9, 16, 1] These protocols are interactive: they require the recipient, Larry, to actively participate in the protocol by sending messages to Alice. For our purposes, we need the oblivious transfer to be non interactive: Larry should not have to send any messages in order to ....

Claude Cr'epeau. Equivalence between two flavours of oblivious transfers. In Carl Pomerance, editor, Proc. CRYPTO 87, pages 350--354. Springer-Verlag, 1988. Lecture Notes in Computer Science No. 293.

.... OT is based on computational assumptions, such as the hardness of factoring or the existence of trapdoor one way permutations [EGL83, BM90] Gamma 2 1 Delta OT can also be implemented in terms of Rabin s OT [Rab81] in which Alice sends a bit b that is received by Bob with probability 1 2 [Cr e88]. The security of Rabin s protocol for OT is based on the quadratic residuosity problem. These are relatively strong computational assumptions. However, it is also known that OT cannot likely be based on weaker assumptions: Proving that OT is secure assuming only a one way function in a black box ....

Claude Cr'epeau, Equivalence between two flavours of oblivious transfer, Advances in Cryptology: CRYPTO '87 (Carl Pomerance, ed.), Lecture Notes in Computer Science, vol. 293, Springer, 1988, pp. 350--354.

....can impart some information to another player, Rachel(the receiver) without knowing precisely what information he has imparted. Oblivious transfers come in a wide variety of flavors, and are not obviously reducible to each other. Following the work of Brassard, Cr epeau, Robert[BCR2] and Cr epeau[C], we develop techniques for establishing equivalences between a wide variety of oblivious transfers. Why study oblivious transfer A compelling reason to study oblivious transfer protocols is their connection to the problem of oblivious circuit evaluation. Oblivious circuit evaluation can be ....

....implemented using cryptographic assumptions. Unfortunately, the use of cryptographic assumptions occurred elsewhere in the protocol as well. A more recent protocol, due to Kilian[K] reduces oblivious circuit evaluation to 1 2 oblivious transfer without any cryptographic assumptions. 1 Cr epeau[C] has reduced 1 2 oblivious transfer to a weaker form of oblivious transfer, which we refer to as standard or ordinary oblivious transfer(defined in Section 2) Thus, one only has to implement oblivious transfer in order to have the full power of oblivious circuit evaluation at ones disposal. A ....

[Article contains additional citation context not shown here]

Cr'epeau Claude, "Equivalence Between Two Flavours of Oblivious Transfer", Proceedings of Crypto 87, 1988,Springer-Verlag.

.... introduced the notion of oblivious transfer to help solve the problem of exchanging secrets, a problem also studied by Blum [5] Protocols for oblivious transfer have been studied by Even, Goldreich, and Lempel [12] Fischer, Micali, and Rackoff [14] Berger, Peralta, and Tedrick [4] Cr epeau [7], and others [19, 10, 16, 1] These protocols are interactive: they require the recipient, Larry, to actively participate in the protocol by sending messages to Alice. For our purposes, we need the oblivious transfer to be non interactive: Larry should not have to send any messages in order to ....

C. Cr'epeau. Equivalence between two flavours of oblivious transfers. In Carl Pomerance, editor, Proc. CRYPTO 87, pages 350--354. Springer-Verlag, 1988. Lecture Notes in Computer Science No. 293.

....RAND. k CNRS URA 410. Laboratoire de Recherche en Informatique, Universit e Paris Sud, Batiment 490, 91405 Orsay, France. e mail: santha lri.fr. to appear in IEEE Transactions on Information Theory 2 1 Introduction The equivalence between cryptographic primitives is a major research topic [6, 11, 16, 30, 12, 25, 13, 31, 18, 19, 15, 17]. A large number of cryptographic protocols have been shown equivalent to one another. One out of two String Oblivious Transfer, denoted ( 2 1 ) OT k 2 , is a primitive that originates with [43] under the name of multiplexing ) a paper that marked the birth of quantum cryptography. ....

C. Cr'epeau, "Equivalence between two flavours of oblivious transfers (abstract)", Advances in Cryptology: Crypto '87 Proceedings, Springer-Verlag, 1988, pp. 350 -- 354.

....f( b; r) m; r 0 1 ; r 0 2 ) on its output tape, where f( b; r) m; r 0 1 ; r 0 2 ) m Phi b; r 0 2 ) if r = r 0 1 , and = m; 1 Phi r 0 2 ) if r 6= r 0 1 . There are many other types of Oblivious Transfer that have all been shown to be equivalent to the simple one [29] [46] [47] One important alternative is called 1 2 Oblivious Transfer [50] abbreviated 1 2 OT ) In this version, player A begins with two secret bits b 0 and b 1 . Player B can choose to receive exactly one of these bits, without letting A know which bit was chosen. Oblivious Transfer is one of ....

....versions of Oblivious Transfer, more sophisticated protocols can be built from this primitive. In fact, secure distributed computation can be reduced to Oblivious Transfer [70] 13] 59] as will be discussed in later sections. To give a simpler reduction now, the following scheme, due to Cr epeau [46], achieves bit commitment through oblivious transfer: 1. Player A chooses random b 1 ; Delta Delta Delta ; b n such that b 1 Phi Delta Delta Delta Phi b n = b. 2. Player A sends each b i , in order, to player B by oblivious transfer. At this point, player A has committed to bit b. To ....

[Article contains additional citation context not shown here]

C. Cr'epeau, "Equivalence between two flavours of Oblivious Transfer," Crypto 87, 350-354.

....fellowship, and NSF grant 865727 DCR. Some of this research was performed while visiting Bell Communication Research. Oblivious transfers come in a wide variety of flavors, and are not obviously reducible to each other. Following the work of Brassard, Cr epeau, Robert[BCR] and Cr epeau [C], we develop techniques for establishing equivalences between a wide variety of oblivious transfers. We also investigate the properties of an ordinary noisy channel. By a noisy channel, we mean a communication line in which a transmitted bit is flipped with a certain fixed probability. This model ....

Cr'epeau Claude, "Equivalence Between Two Flavours of Oblivious Transfer", Proceedings of Crypto 87, 1988,Springer-Verlag.

....function but not their respective inputs. It was shown in a computational model that One out of two Oblivious Transfer suffices to perform general secure computations by Goldreich, Micali and Wigderson [13] and later in an abstract (not necessarily computational) model by Kilian [14] I showed [7] that indeed Rabin s Oblivious Transfer can also do the job by describing a general technique to turn an Oblivious Transfer into a One out of two Oblivious Transfer. The result of the current paper is an extension of that technique. Although quite remarkable, Wiesner s idea of a conjugate coding ....

Cr' epeau, C., "Equivalence between two flavours of oblivious transfers", In Advances in Cryptology: Proceedings of Crypto '87, Lecture Notes in Computer Science, August 1987, pp. 350 -- 354.

....exist under some assumption. For instance, ot can be constructed if trapdoor functions exist [16] from a noisy channel [11, 12] or from a quantum channel [2, 10] It is also a well known fact that using O(n) of Rabin s Oblivious Transfers [26] one can construct one out of two Oblivious Transfer [7]. In a Bit Commitment Alice sends a committed bit a to Bob in such a way that she is able to reveal it later in a unique way (a) but Bob is not able to find its value by himself. Alice cannot change her mind and open a as a. Bc is impossible without making an assumption. It is easy to convert ....

C. Cr'epeau, Equivalence Between Two Flavours of Oblivious Transfer, Advances in Cryptology - CRYPTO'87, Springer-Verlag, 1988, pp. 350-354.

....to Bob in such a way that he can choose to receive either one of them (learning its value with exponentially small error probability) but cannot obtain significant partial information on both 2 , while Alice remains entirely ignorant of which of the two messages he received. It is shown in [11] that Gamma 2 1 Delta OT and Rabin s OT are equivalent in the sense that either one can be 1 In fact, what Wiesner called multiplexing channel as early as the late 1960 s [30] is essentially what we now call 1 out of 2 oblivious transfer (of messages rather than single bits) but his ....

Cr'epeau, C., "Equivalence between two flavours of oblivious transfers (abstract)", Advances in Cryptology: Proceedings of Crypto '87, August 1987, Springer-Verlag, pp. 350 -- 354.

....but not their respective inputs. It was shown in a computational model that One out of two Oblivious Transfer suffices to perform general secure computations by Goldreich, Micali and Wigderson [12] and later in an abstract (not necessarily computational) model by Kilian [15] Cr epeau showed [7] that indeed Rabin s Oblivious Transfer can also do the job by describing a general technique to turn an Oblivious Transfer into a One out of two Oblivious Transfer. The result of the current section is an extension of that technique. 4.1 Oblivious Transfer from Binary Symmetric Channel 4.1.1 ....

....an extension of that technique. 4.1 Oblivious Transfer from Binary Symmetric Channel 4.1. 1 Basic Idea Simulate OT ffl (b) with protocol d OT ffl (b) obtained by sending b twice through the binary symmetric channel and then reduce ( 2 1 ) OT 2 to d OT ffl (b) with a Protocol similar to that of [7]. Protocol 4.1 ( d OT ffl (b) 1: Alice runs BS ffl (b)BS ffl (b) with Bob who receives b 0 b 1 . 2: if b 0 = b 1 then Bob returns b 0 else Bob returns . The problems with this approach are that d OT ffl (b) makes errors and that Alice can send bad pairs bb: if Alice is honest and sends bb ....

C. Cr'epeau. Equivalence between two flavours of oblivious transfers (abstract). In C. Pomerance, editor, Advances in Cryptology: Proceedings of Crypto '87, pages 350--354, SpringerVerlag, 1988.

....received without errors, or completly lost with probalities 1 Gamma ffl and ffl. However this situation has been previously analyzed since the erasure channel is the same as Rabin s Oblivious Transfer [16] Protocols for Bit Commitment and ( 2 1 ) OT using Rabin s O.T. are available in [14] and [7]. 2.2 Coding theory An [n; k; d] linear code C is a linear subspace of f0; 1g n of dimension k (and cardinality 2 k ) such that no two words c 1 ; c 2 from C are such that dH (c 1 ; c 2 ) d, except if c 1 = c 2 , where dH (x; y) is the Hamming distance between x and y: the number of ....

....but not their respective inputs. It was shown in a computational model that One out of two Oblivious Transfer suffices to perform general secure computations by Goldreich, Micali and Wigderson [12] and later in an abstract (not necessarily computational) model by Kilian [14] Cr epeau showed [7] that indeed Rabin s Oblivious Transfer can also do the job by describing a general technique to turn an Oblivious Transfer into a One out of two Oblivious Transfer. The result of the current section is an extension of that technique. 4.1 Oblivious Transfer from Binary Symmetric Channel Basic Idea ....

[Article contains additional citation context not shown here]

C. Cr'epeau. Equivalence between two flavours of oblivious transfers (abstract). In C. Pomerance, editor, Advances in Cryptology: Proceedings of Crypto '87, pages 350--354, Springer-Verlag, 1988.

.... probability essentially 1 and second, we give a deterministic polynomial time construction based on the algebraic codes of Goppa [Gop81] 1 Introduction The equivalence between cryptographic primitives has recently become a major research topic as evidenced by many papers on the topic: BCR86] [Cr e88], CK88] Kil88] Cr e89] So far a large number of cryptographic protocols have been shown equivalent to one another. Nevertheless very few of those reductions accomplish perfectly the task they are designed for. Generally the reduction will fail to achieve its goal with a small probability. An ....

C. Cr'epeau. Equivalence between two flavours of oblivious transfers (abstract). In C. Pomerance, editor, Advances in Cryptology: Proceedings of Crypto '87, pages 350--354, Springer-Verlag, 1988.

No context found.

Cr'epeau Claude, "Equivalence Between Two Flavours of Oblivious Transfer", Proceedings of Crypto 87, 1988,Springer-Verlag.

No context found.

C. Cr'epeau, "Equivalence Between Two Flavours of Oblivious Transfers (Abstract)", Advances in Cryptology: Proceedings of Crypto '87, Springer-Verlag, 1988, pp. 350 -- 354.

Online articles have much greater impact   More about CiteSeer.IST   Add search form to your site   Submit documents   Feedback  

CiteSeer.IST - Copyright Penn State and NEC