G. Brassard, C. Cr'epeau, and M. Santha. Oblivious transfers and intersecting codes. In IEEE Transaction on Information Theory, special issue on coding and complexity. November 1996.  Home/Search   Document Details and Download   Summary   Related Articles   Check

....equivalent in [9] One of them, denoted OT, allows Bob to securely choose a single secret out of a pair of secrets held by Alice. The problem of efficiently implementing Gamma n Gamma OT , in which Bob chooses a single secret from a set of n bit secrets held by Alice, was shown in [10] to be implementable using O(n ) parallel invocations of OT primitive on pairs of single bits. We generalize this problem as follows. Alice is holding n secrets, and is willing to obliviously transfer to Bob a subset A [n] of the secrets at his choice, provided that the set of secrets is ....

G. Brassard, C. Crepeau, and M. Santha. Oblivious transfers and intersecting codes. In IEEE Transaction on Information Theory, special issue on coding and complexity. November 1996.

....applications are described in Section 4. Another application is oblivious polynomial evaluation, which is described in [41] Reductions between various types of oblivious transfer protocols have been investigated extensively and they all turn out to be information theoretically equivalent (See [6, 8, 18, 17, 11]) This is of interest, given the possibility of implementing OT using physical means , e.g. via a noisy channel or quantum cryptography. However, some of these reductions are not particularly ecient and in this paper we use non information theoretic reductions, i.e. employ additional ....

....of magnitude more ecient than operations in public key cryptography. Our goal is therefore to come up with ecient constructions of 1 out N OT protocols from 1 out 2 OT protocols, where the number of invocations of the 1 out 2 OT protocol is small. For instance, the 1 out N OT constructions of [6, 8] need N calls to the 1 out 2 OT protocol. In contrast our protocols need only log N calls to the 1 out 2 OT protocol plus O(N) evaluations of a pseudo random function (note that the construction of [8] of 1 out 2 string OT from 1 out 2 bit OT is ecient) Another measure of complexity is ....

[Article contains additional citation context not shown here]

G. Brassard, C. Crepeau and M. Santha, Oblivious Transfer and Intersecting Codes, IEEE Trans. on Inform. Theory, Vol. 42(6), pp. 1769-1780, 1996.

....bit commitment to UNC, let I b (k; be the expected information the receiver obtains about b in the Commit protocol, and let p(k; be the probability that the binding condition fails. We will say that the reduction works for values and , I b (k; lim p(k; 0 We refer to [3] for a more sophisticated de nition of 1 2 OT; our protocols meet this de nition as well. The set of pairs for which a reduction works will be called the range of the reduction. We will say that a reduction works eciently in a point in its range, if the required convergence in k is exponential, ....

G. Brassard, C. Cr epeau, and M. S antha.\Oblivious Transfer and Intersecting Codes". In IEEE Transaction on Information Theory, special issue on coding and complexity, vol. 42, No. 6, pp.1769-1780, 1996.

.... (all or nothing disclosure of secrets) For an up to date de nition of OT and oblivious function evaluation see Goldreich [16] Reductions between various types of oblivious transfer protocols have been investigated extensively and they all turn out to be information theoretically equivalent (See [6, 8, 12, 11, 9]) These reductions emphasize the importance of distributed oblivious transfer, since they enable other types of OT protocols to be based on the ecient constructions of distributed OT presented in this paper. In particular, a protocol for distributed 1 out of N OT can be constructed using the ....

G. Brassard, C. Crepeau and M. Santha, Oblivious Transfer and Intersecting Codes, IEEE Trans. on Inform. Theory, Vol. 42(6), pp. 1769-1780, 1996.

.... SPIR counterparts can be obtained by applying standard zero knowledge techniques (whose polynomial communication overhead is insignificant in that case) We finally note that the SPIR problem may be viewed as a distributed version of the problem of Gamma n 1 Delta Oblivious Transfer [6, 7] (also denoted all or nothing disclosure of secrets ) Thus, our solutions immediately give 1 round distributed implementations of Gamma n 1 Delta Oblivious Transfer with sub linear communication complexity. ....

G. Brassard, C. Cr'epeau, and M. Santha. Oblivious transfers and intersecting codes. In IEEE Transaction on Information Theory, special issue on coding and complexity. November 1996.

.... etc [5, 14, 21] A general approach for constructing OT 1 n schemes is first to construct a basis OT 1 2 scheme (where m 1 and m 2 are bits) and then to construct the OT 1 n scheme by (explicitly or implicitly) invoking the basis OT 1 2 scheme for many runs, typically, n or log 2 n runs [9, 11, 26]. Another approach is to build OT 1 n schemes from basic techniques directly [29, 30, 33, 35] In this paper we propose a very e#cient OT 1 n scheme for any n # 2 even when the secrets m i s are strings. We build our OT 1 n scheme from fundamental cryptographic techniques directly. It ....

....is computationally secure) with almost the same e#ciency for communication complexity. Some communication e#cient single database PIR schemes have been proposed [13, 25] 1. 1 Previous work and comparison Oblivious transfer has been studied in various flavors and security models extensively (cf. [1, 4, 7, 9, 11, 17, 21, 26, 30, 33, 35]) In particular, bit OT 1 2 (where m 1 and m 2 are bits) attracts much attention from researchers since it is the basis oblivious transfer scheme to which string OT 1 2 and OT 1 n schemes are reduced. Most previous oblivious transfer schemes are based on hardness of factoring or quadratic ....

[Article contains additional citation context not shown here]

G. Brassard, C. Crepeau, M. Santha, "Oblivious transfer and intersecting codes," IEEE Transactions on Information Theory 42(6), pp.1769-1780, 1996.

....is not a reduction from SPIR to PIR, in the sense that it requires an additional assumption (a 2 1 OT primitive) Rather, this result should be viewed as a communication ecient reduction from n 1 OT (or SPIR) to 2 1 OT . Such reductions have been known before (cf. [BCS96]) but the one of [NP99] is the most communication ecient reduction. In Section 6.3 we will use the [NP99] reduction by combining it with our reduction from 2 1 OT to PIR, to obtain a communication ecient reduction from SPIR to PIR. 1 which was done independently and subsequently to ....

G. Brassard, C. Crepeau, and M. Santa. Oblivious transfers and intersecting codes. IEEE Trans. on Information Theory, pages 1769-1780, 1996.

.... of quadratic residuosity) is also possible, using general zero knowledge techniques and a multi round protocol (see [17] An important observation is that the SPIR problem may be viewed as a distributed version of the cryptographic problem of Gamma n 1 Delta Oblivious Transfer (OT) [6, 7]. 1 Thus, the results presented in our paper immediately give the first 1 round distributed implementations of Gamma n 1 Delta OT with information theoretic security and sublinear communication complexity. Finally, in all the schemes presented in this paper, the multiplicative ....

G. Brassard, C. Cr'epeau, and M. Santha. Oblivious transfers and intersecting codes. In IEEE Transaction on Information Theory, special issue on coding and complexity. November 1996.

....because even the best cryptographic implementation of a chosen primitive may be expensive to run, it is crucial that reductions call such primitives as few times as possible. Because of the importance of OT, numerous reductions from more complex to simpler OT appear in the literature (e.g. [5], 8] 3] 6] Particular attention has been devoted to reducing Gamma N 1 Delta OT L 2 to Gamma n 1 Delta OT 2 , where N n and L , both in the weak and in the strong case. Typically, these reductions are information theoretically secure if the simpler OT is assumed to be ....

....reductions are information theoretically secure if the simpler OT is assumed to be so secure. An important class of OT reductions are the ones in which the receiver sends no messages to the sender. Such reductions are called natural, both because all known OT reductions are of this type (e.g. [5], 6] 3] and because they immediately imply that the sender gets no information about the receiver s index. So far, researchers have been focusing on improving the upper bounds of these reductions, that is, the number of times one calls Gamma n 1 Delta OT 2 in order to construct ....

[Article contains additional citation context not shown here]

G. Brassard, C. Cr'epeau, M. S'antha. Oblivious Transfers and Intersecting Codes. In IEEE Transaction on Information Theory, special issue in coding and complexity, Volume 42, Number 6, pp. 1769-1780, 1996.

....in [EGL83] with applications to contract signing protocols: One out of two Bit Oblivious Transfer, denoted ( 2 1 ) OT 2 , concerns the case k = 1 in which w 0 and w 1 are single bit secrets, generally called b 0 and b 1 in that case. Techniques were introduced in [BCR86] and refined in [CS91b, BCS96] to reduce ( 2 1 ) OT k 2 to ( 2 1 ) OT 2 : several two party protocols were given to achieve One out of two String Oblivious Transfer based on the assumption of the availability of a protocol for the simpler Oneout of two Bit Oblivious Transfer. The fact that ( 2 1 ) OT k 2 can be ....

....a number of authors [GMW87, GV87, Kil88, Cr e89, GL89, CGT95] have shown that ( 2 1 ) OT 2 is sufficient to implement any two party computation. Our interest in direct reductions is their far greater efficiency. With the exception of [CS91a] all previous direct reductions that we are aware of [BCR86, CS91b, BCS96] are based on a notion called zigzag functions, whose construction is reduced to finding particular types of error correcting codes called self intersecting codes. In a nutshell, this approach consists in selecting once and for all a suitable zigzag function f from f0; 1g n to f0; 1g k for n ....

[Article contains additional citation context not shown here]

G. Brassard, C. Cr'epeau and M. S'antha, "Oblivious Transfers and Intersecting Codes", Submitted for publication to IEEE Transactions on Information Theory, 1996.

....from these results, have come up with another variation. In particular, their approach deals with MPC in a computational setting, which for a long time was considered to be difficult, but which makes it also less relevant here. A completely different avenue was pursued by Crepeau and Brassard [CR94, BCS96, BC97], who give a definition of One out of Two Oblivious Transfer purely in terms of information theory. The goal of this chapter is not to present a complete formal model of security for protocols for MPC, with formal proofs of all composition theorems etc. this could easily be the subject of a ....

....an attack on Pi 2 . This requirement can be enforced by demanding the existence of an algorithm, S, capable of translating any enemy E 1 attacking Pi 1 into an enemy E 2 attacking Pi 2 . Let us define this more formally, following the terminology used in [BE91B] but the notation introduced in [BCS96]. Let E 1 be the set of possible Turing Machines E representing valid attacks on protocol Pi 1 ; define E 2 similarly. We say that S is an interface between Pi 1 and Pi 2 if for all E 1 2 E 1 we have that S(E 1 ) 2 E 2 . That is, S translates any valid attack on Pi 1 into a valid attack on ....

[Article contains additional citation context not shown here]

BRASSARD, G., C. CR EPEAU AND M. S ANTHA, "Oblivious transfers and intersecting codes", IEEE Transactions on Information Theory 42, 6 (1996), pp. 1769--1780.

....them, denoted Gamma 2 1 Delta OT, allows Bob to securely choose a single secret out of a pair of secrets held by Alice. The problem of efficiently implementing Gamma n 1 Delta Gamma OT , in which Bob chooses a single secret from a set of n bit secrets held by Alice, was shown in [11] to be implementable using O(n ) parallel invocations of Gamma 2 1 Delta OT primitive on pairs of single bits. We generalize this problem as follows. Alice is holding n secrets, and is willing to obliviously transfer to Bob a subset A [n] of the secrets at his choice, provided that the set ....

G. Brassard, C. Crepeau, and M. Santha. Oblivious transfers and intersecting codes. In IEEE Transaction on Information Theory, special issue on coding and complexity. November 1996.

....in [EGL83] with applications to contract signing protocols: One out of two Bit Oblivious Transfer, denoted ( 2 1 ) OT, concerns the case k = 1 in which w 0 and w 1 are single bit secrets, generally called b 0 and b 1 in that case. Techniques were introduced in [BCR86] and refined in [CS91b, BCS96] to reduce ( 2 1 ) OT k to ( 2 1 ) OT: several two party protocols were given to achieve One out of two String Oblivious Transfer based on the assumption of the availability of a protocol for the simpler One out of two Bit Oblivious Transfer. The fact that ( 2 1 ) OT k can be reduced to ....

....because a number of authors [Kil88, Cr e89, CGT95] have shown that ( 2 1 ) OT is sufficient to implement any two party computation. Our interest in direct reductions is their far greater efficiency. With the exception of [CS91a] all previous direct reductions that we are aware of [BCR86, CS91b, BCS96] are based on a notion called zigzag functions, whose construction is reduced to finding particular types of error correcting codes called self intersecting codes. In a nutshell, this approach consists in selecting once and for all a suitable function f from f0; 1g n to f0; 1g k for n as ....

[Article contains additional citation context not shown here]

G. Brassard, C. Cr'epeau and M. S'antha, "Oblivious transfers and intersecting codes", IEEE Transactions on Information Theory, Vol. 42, no. 6, November 1996, pp. 1769 -- 1780.

No context found.

G. Brassard, C. Cr'epeau, and M. Santha. Oblivious transfers and intersecting codes. In IEEE Transaction on Information Theory, special issue on coding and complexity. November 1996.

No context found.

G. Brassard, C. Crepeau, and M. Santha. Oblivious transfer and intersecting codes. In IEEE Transactions on Information Theory, 1996, pp.1769-1780.

Online articles have much greater impact   More about CiteSeer.IST   Add search form to your site   Submit documents   Feedback  

CiteSeer.IST - Copyright Penn State and NEC