C. Cr'epeau, Correct and Private Reductions Among Oblivious Transfers, Ph.D. thesis, MIT, 1990.  Home/Search   Document Not in Database   Summary   Related Articles   Check

.... and All or Nothing Disclosure of Secrets (a generalization of one out of two oblivious transfer) of Brassard, Cr epeau and Robert [15] All these different tasks were shown equivalent: any one of them can be implemented securely starting with a secure protocol of any other one of them [14, 20, 24, 23, 21]. In particular, any of these protocols can be used to achieve the following very general task [44, 33, 17, 39, 22] Secure two party computation: Consider a twoparameter polynomial time computable function f . One party knows input x and the other party knows input y. The protocol allows both ....

....More recently, a theoretical implementation of the one out of two Oblivious Transfer was proposed in [23] but was totally useless in a realistic scenario were errors could occur during the quantum transmission. A more complete description of that work and more thorough proofs may be found in [21]. Finally, joint work of myself with Bennett and Brassard, together with my student Marie H el ene Skubiszewska, has led to a practical solution as explained in [6] At this stage, the solution we have described has been experimentally exploited with the quantum prototype of [5] Unfortunately, ....

C. Cr'epeau. Correct and Private Reductions among Oblivious Transfers. PhD thesis, Department of Elec. Eng. and Computer Science, Massachusetts Institute of Technology, 1990. Supervised by Silvio Micali.

....shown insecure from the start (circa 1969) it was not until 1988 that Claude Cr epeau and Joe Kilian [29] presented the first alternative protocol. This protocol was clearly secure provided neither parties could store photons for long periods of time and only von Neumann measurements were allowed [25, 26]. The vulnerability to photon storage was easy to circumvent if only a secure bit commitment scheme were available. A more robust version of this protocol, capable of dealing with transmission errors on the quantum channel, was subsequently developed [10] Then Mayers and Salvail [61] analysed the ....

Cr' epeau, C., Correct and private reductions among oblivious transfers, PhD thesis, Department of Electrical Engineering and Computer Science, Massachusetts Institute of Technology, 1990. (Supervised by Silvio Micali.)

.... bits involved in the calculation of g(m 0 ; m 1 ) are 1=6 biased, even if all the other bits are exactly known, B s can only (1=3) 7(flk s) 2 bias the value of g(m 0 ; m 1 ) In general, if one can ffi bias x 1 ; x 2 ; x l , she can (2ffi) l =2 bias x 1 Phi x 2 Phi : Phi x l [Cr e90]. It follows that for any set of choices fc i g, and any v 0 ; v 1 6= 0 k Prob i B can 3 Gamma7(flk s) 2 bias g(m 0 ; m 1 ) j 2 Gamma(fl k s) Finally, given that there are less than 2 2k pairs v 0 ; v 1 , taking fl 2, and using the fact that 3 Gamma7(flk s) 2 2 ....

C. Cr'epeau, Correct and Private Reductions among Oblivious Transfers, PhD thesis, Department of Elec. Eng. and Computer Science, Massachusetts Institute of Technology, 1990. Supervised by Silvio Micali.

....RAND. k CNRS URA 410. Laboratoire de Recherche en Informatique, Universit e Paris Sud, Batiment 490, 91405 Orsay, France. e mail: santha lri.fr. to appear in IEEE Transactions on Information Theory 2 1 Introduction The equivalence between cryptographic primitives is a major research topic [6, 11, 16, 30, 12, 25, 13, 31, 18, 19, 15, 17]. A large number of cryptographic protocols have been shown equivalent to one another. One out of two String Oblivious Transfer, denoted ( 2 1 ) OT k 2 , is a primitive that originates with [43] under the name of multiplexing ) a paper that marked the birth of quantum cryptography. ....

....from the set T = f0; 1; t Gamma 1g. to appear in IEEE Transactions on Information Theory 7 Formally speaking we describe a two party protocol that satisfies the following constraints of correctness and privacy . These notions have been defined before for general protocols by Cr epeau [13], Micali and Rogaway [36] and Beaver [1] using simulators. In this paper, we use the language of information theory to express definitions similar to those introduced by Cr epeau [14] Our goal is not to discuss definitions for general two party protocols: we restrict our study to oblivious ....

C. Cr'epeau, Correct and private reductions among oblivious transfers, PhD thesis, Department of Electrical Engineering and Computer Science, Massachusetts Institute of Technology, 1990. (Supervised by Silvio Micali.)

.... bits involved in the calculation of g(m 0 ; m 1 ) are 1=6 biased, even if all the other bits are exactly known, B can only (1=3) 7(flk s) 2 bias the value of g(m 0 ; m 1 ) In general, ffi biasing each of x 1 ; x 2 ; x l allows to (2ffi) l =2 bias x 1 Phi x 2 Phi : Phi x l [Cr e90] It follows that for any set of choices fc i g, and any v 0 ; v 1 6= 0 k Prob i B can 3 Gamma7(flk s) 2 bias g(m 0 ; m 1 ) j 2 Gamma(fl k s) Finally, given that there are less than 2 2k pairs v 0 ; v 1 , taking fl 2, and using the fact that 3 Gamma7(flk s) 2 2 ....

C. Cr'epeau, Correct and Private Reductions Among Oblivious Transfers, PhD thesis, Department of Electrical Engineering and Computer Science, Massachusetts Institute of Technology, 1990. Supervised by Silvio Micali.

....measurements. 1 Introduction Work on quantum cryptography was started by Wiesner [Wi70] twenty five years ago. Much knowledge on how to exploit quantum physics for cryptographic purposes has been gained through the work of Bennet and Brassard ( BBBW83] BB84] BBBSS92] and later Cr epeau ([Cr90][BC91] BBCS92] Cr94] Furthermore, prototypes for implementing some of these This research was supported in part by the National Science Foundation under grant CCR 9301430. algorithms have been built ( BB89] TRT93] TRT94] How to design securely the important cryptographic primitive ....

....was supported in part by the National Science Foundation under grant CCR 9301430. algorithms have been built ( BB89] TRT93] TRT94] How to design securely the important cryptographic primitive oblivious transfer in quantum cryptography has received much attention in the recent literature [BBCS92][Cr90][Cr94] MS94] Central to all the proposed protocols is the transmission of a large number of polarized photons from Alice to Bob. At present, the strongest security result [MS94] obtained is that if Bob is allowed to make arbitrary measurements only on individual photons, then neither Alice nor ....

C. Cr'epeau, "Correct and private reductions among oblivious transfers," Ph.D. thesis, Department of EECS, MIT, 1990.

....in Eve s initial information. It would have been reasonnable to better explain our formal definitions of security that appear in section 2. Ideally, we should have explained the connection between these definitions and previous definitions found in the literature such as those found in [Cr90]. As mentioned before, an analysis of these definitions will be presented in a subsequent paper. Finally, now that we know that security may be obtained, it will be useful to determine the maximal error rate that can be tolerated and, for a given error rate, how much resource is required to ....

C. Cr'epeau, Correct and Private Reductions among Oblivious Transfers, Ph.D. Thesis, Massachusetts Institute of Technology, 1990.

....want to reduce the security of one protocol to some other protocol (or primitive) 19 Micali and Rogaway [MR91] were among the first to present formal definitions of MPC, using simulators in a way analogous to the definition of zero knowledge. This work continues the approach taken by Crepeau in [CR90], which studies reductions between various flavors of Oblivious Transfer. Another approach was taken by Beaver [BE90, BE91B] Though from a global point of view his approach seems similar, it differs significantly in some of the technical details. More recently Canetti, Feige, Goldreich and Naor ....

....polynomial time program which is entirely dedicated to running a protocol. We model this program as a Turing Machine to have an explicit way to specify the parties input and output. For a precise description of this model we make some minor modifications to the one presented by Crepeau [CR90], in order to obtain a model that easily extends to quantum protocols, the subject of Chapter 4. Apart from the input tape, work tape, random tape and output tape these Turing Machines, A and B, are equipped with one shared tape, the communication tape. Auxiliary inputs are dealt with by ....

CR EPEAU, C., Correct and Private Reductions Among Oblivious Transfers, PhD thesis, Massachusetts Institute of Technology, 1990.

.... Cr epeau and Kilian showed how the quantum channel could be used in principle (although not in practice) to implement oblivious transfer in a strong way (Wiesner s original multiplexing channel could leak information on both channels) zero knowledge protocols, and secure two party computation [17, 16]. More recently, Ekert proposed an alternative approach to implement quantum key distribution [19] making use of EPR and Bell s theorem) but a simplified and no less secure version of his scheme is shown in [10] to be equivalent to the idealized quantum key distribution protocol ....

Cr'epeau, C., "Correct and private reductions among oblivious transfers", PhD Thesis, Department of Electrical Engineering and Computer Science, Massachusetts Institute of Technology, February 1990.

....to longer strings by the result of [6, 10] The result of this current paper is to exhibit a protocol for the binary version of One out of Two Oblivious Transfer, from now on denoted i 2 1 j OT 2 , whose security relies on quantum mechanics. Earlier versions of this work were presented in [9, 8]. 2 Formal Problem Formally speaking we describe a two party protocol that satisfies the natural constraints (see below) of correctness and privacy of a i 2 1 j OT 2 . For a more thorough description of these concepts, we refer the reader to [8] but some intuition follows. Let V P (H; b 0 ....

....versions of this work were presented in [9, 8] 2 Formal Problem Formally speaking we describe a two party protocol that satisfies the natural constraints (see below) of correctness and privacy of a i 2 1 j OT 2 . For a more thorough description of these concepts, we refer the reader to [8], but some intuition follows. Let V P (H; b 0 ; b 1 ; c) be the random variable that describes the information that a party P has at the end of its interaction through the protocol executed on inputs b 0 ; b 1 ; c and where H (for History) is the random variable describing the a priori information ....

Cr' epeau, C., Correct and Private Reductions among Oblivious Transfers, Ph.D. Thesis, Department of Electrical Engineering and Computer Science, Massachusetts Institute of Technology, February 1990.

No context found.

C. Cr'epeau, Correct and Private Reductions Among Oblivious Transfers, Ph.D. thesis, MIT, 1990.

....distribution was conceivable. We will look more closely at the quantum bit commitment scheme behind Bennett Brassard s coin flipping protocol and its attack in section 2. More recently, Cr epeau and Kilian [12] have presented an alternative protocol for oneout of two Oblivious Transfer. Cr epeau [9, 10] showed that this protocol is secure if neither parties can store photons for long periods of time and if only Von Neumann measurements are allowed. Alternatively, the first restriction may be dropped if we have a secure bit commitment protocol. A more robust version of this protocol that deals ....

C. Cr'epeau, "Correct and private reductions among oblivious transfers", PhD thesis, Department of Electrical Engineering and Computer Science, Massachusetts Institute of Technology, 1990. (Supervised by Silvio Micali.)

....direction but not the other. In particular one can make a computational assumption of the weaker party but not of the other. This scenario was also studied by Ostrovsky, Venkatesan and Yung in [OVY91] where they independently give a reduction similar to 2.1. Also if quantum technology is used [Cre90,BC91] it might be the case that one party is limited in the equipment it can carry (especially if one participant sits on a smart card ) Therefore a fundamental question is: Can we reverse i 2 1 j OT 2 . This work was performed while the authors were visiting the Universitat des Saarlandes, ....

.... expresses the fact that all the actions that a cheating participant could take are of no advantage over being honest (in the sense that whatever a cheater gets by cheating he could get by behaving honestly using a different input) For a precise definition of this notion we refer the reader to [Cre90,CM91]. Theorem 2.4 The reduction 2.2 is both R private and S private. Proof. The R privacy of this reduction is simple to prove since all the information R may get (one bit in each line of C) is purely random. The S privacy is due to the fact that any choice of C defines some legitimate values for c ....

C. Cr'epeau. Correct and Private Reductions among Oblivious Transfers. PhD thesis, Department of Elec. Eng. and Computer Science, Massachusetts Institute of Technology, 1990. Supervised by Silvio Micali.

Online articles have much greater impact   More about CiteSeer.IST   Add search form to your site   Submit documents   Feedback  

CiteSeer.IST - Copyright Penn State and NEC