%\ This notes are written by Qionglin Wu (ID: 9545239).


\documentclass[12pt]{article}


\usepackage[dvips]{graphics, color}
\usepackage{epsfig}


\input{ProgMacs}
\input{MathMacs}
\input{ThmMacs}
\newcommand{\comment}[1]{}                       % truc a Claude.

\begin{document}
\section{Lecture 10}

\section{Oblivious Transfer}

There are no more specific P and V. $\;\;$ But we can use the notion of IP 
whenever we need it. $\;\;$ The following examples give us a basic idea for 
oblivious transfer. $\;\;$ We have a sender and a receiver in the following 
applications.  \\

%\begin{example}
\begin{eqnarray*}
S \; (sender)   \hspace{1.6in} R \; (receiver) \\
& \\ 
\begin{array}{ccccc}
\left. \begin{array}{c}
\hspace{2cm} \bigcirc  \\
\hspace{2cm} \bigcirc  \\
\hspace{2cm} \bigcirc  \\
\hspace{2cm} \bigcirc  

\end{array} 
\right \} \;
 x \; 
\longrightarrow & f(x,y) &
\; 
\longleftarrow \;  y \;
\left \{ 
\begin{array}{c}
\bigcirc  \\
\bigcirc  \\
\bigcirc  \\
\bigcirc  
\end{array} 
\right. \\
& & {{\linethickness{0.2mm}\put(-67,0)
                        {\vector(-3,-4){32}}}} {{\linethickness{0.2mm}\put(-57,0)
                        {\vector(3,-4){33}}}}\, & & \\
f(x,y) & & & f(x,y)
\end{array}
\end{eqnarray*}\\
%\end{example}

\begin{flushleft}
In this application, the symbol "$\bigcirc$" represents that commits to some values. 
Both the sender and receiver can learn f(x, y).  But the sender will not learn 
anything about the input y and 
the receiver will not also learn anything about the input x.  f(x, y) is a 
function of x and y.\\
\end{flushleft}

\begin{flushleft}
%\begin{example}
Suppose only R obtain f(x,y), the above figure will become: \\
\end{flushleft}

\begin{eqnarray*}
S \; (sender)   \hspace{1.6in} R \; (receiver) \\
& \\ 
\begin{array}{ccccc}
\left. \begin{array}{c}
\hspace{2cm} \bigcirc  \\
\hspace{2cm} \bigcirc  \\
\hspace{2cm} \bigcirc  \\
\hspace{2cm} \bigcirc  
\end{array} 
\right \} \;
 x \; 
\longrightarrow & f(x,y) &
\; 
\longleftarrow \;  y \;
\left \{ 
\begin{array}{c}
\bigcirc  \\
\bigcirc  \\
\bigcirc  \\
\bigcirc  
\end{array} 
\right. \\
& &  {{\linethickness{0.2mm}\put(-57,0)
                        {\vector(3,-4){33}}}}\, & & \\
& & & & f(x,y)
\end{array}
\end{eqnarray*}
%\end{example}
In this application, only the receiver learns f(x, y). \\

\subsection{The definition of Oblivious Transfer}

Now we can give the difinition of oblivious transfer:\\
{\bf An Oblivious Transfer} is a process by which Alice sends to Bob a bit 
over a noisy channel without knowing whether it arrives.\\

\begin{flushleft}
The original obvilious transfer concept is introduced by Rabin.\\ 
\end{flushleft}

\begin{flushleft}
The basic idea of Rabin OT can be described as the following:
\end{flushleft}

%\begin{flushleft}
%{\bf Figure 1}
%\end{flushleft}
\begin{eqnarray*}
 Alice  & &  Bob\\ 
 m \; (message) 
 &\hspace{1cm} \stackrel{{\linethickness{0.2mm}\put(-30,3)
                        {\line(1,0){40}}}}\,> & \left\{
\begin{array}{llll}
get & m & with & prob. \; 1/2,\\
get & ? & with & prob. \; 1/2.
\end{array}
\right.
\end{eqnarray*} \\
Here, wiping out the message happens half of the time and so is the correct
transmission of the message.\\

\begin{flushleft}
The following two examples describe one possible implementation of R-OT based 
on factoring:: 
\end{flushleft}

%\begin{flushleft}
%{\bf Figure 2}
%\end{flushleft}

\begin{example}
\begin{eqnarray*}
 Alice  & &  Bob\\ 
 m\;=\;p \;*\; q  
 &\hspace{1cm} \stackrel{ m }{{\linethickness{0.2mm}\put(-30,3)
                        {\line(1,0){40}}}}\,> & \\
%\left\{
%\begin{array}{llll}
%get & p, \; q & with & prob. \; 1/2,\\
%get & ? &  with & prob. \; 1/2.
%\end{array}
%\right.
%\end{eqnarray*}
%\begin{example}
%Implementation of R-OT:
%\begin{eqnarray*}
% Alice  & &  Bob\\ 
%& & \\
     & & x \in_R Z_{n}^\ast,\\
     & & y \leftarrow x^{2} \; mod \; n \\
& \hspace{-1cm} <\,\stackrel{ y}{{\linethickness{0.2mm}\put(-10,3)
                        {\line(1,0){40}}}}  & \\
{x'} \leftarrow \sqrt{y} \; mod \; n & & \\
&\hspace{1cm} \stackrel{ x' }{{\linethickness{0.2mm}\put(-30,3)
                        {\line(1,0){40}}}}\,>  & \\
 & & {\bf if} \; x = \pm{x'} \; (mod  \; n), {\bf then} \; get \; ?\\
     & & {\bf else} \; compute \; p, \; q \\
 & & {(x-x')}{(x+x')} \equiv 0 \; (mod \; n).\\
& & \Longrightarrow x^{2} \equiv y^{2} 0 \; mod \; n.\\
\end{eqnarray*}
\end{example}

\begin{example}
\begin{eqnarray*}
&  n = p \ast q  & \\
&  e  & \\
Alice          & &          Bob\\ 
 &\hspace{1cm} \stackrel{ m^e \; mod \; n}{{\linethickness{0.2mm}\put(-30,3)
                        {\line(1,0){40}}}}\,> & \\
     & & x \in_R Z_{n}^\ast,\\
     & & y \leftarrow x^{2} \; mod \; n \\
& \hspace{-1cm} <\,\stackrel{ y}{{\linethickness{0.2mm}\put(-10,3)
                        {\line(1,0){40}}}}  & \\
{x'} \leftarrow \sqrt{y} \; mod \; n & & \\
&\hspace{1cm} \stackrel{x'}{{\linethickness{0.2mm}\put(-30,3)
                        {\line(1,0){40}}}}\,> & \\
\end{eqnarray*}
\end{example}
Bob can factor n with probability 1/2 and then find out m. \\

\begin{flushleft}
However, we must have
\end{flushleft}
$1/2 \leq Pr(Bob \; can \;factors) \leq 1/2 + 1/poly(|n|),\;$  for every 
polynomial. (**)\\
Moreover, we know:\\
fact: factoring $\Longleftrightarrow$  extracting square roots.\\
However, there could be a deterministic reduction.\\
$n \rightarrow \; y \rightarrow \sqrt{y} \rightarrow p, \;q$.  
$\sqrt{y}$: factoring n.\\

\begin{flushleft}
In order to keep the property of (**), Alice has to make sure that y is really a
square of some number, i.e. Bob really knows $\sqrt{y}$ and using 
zero-knowledge proof to prove Bob knows $\sqrt{y}$.\\

\end{flushleft}

\begin{eqnarray*}
& n = p \ast q  & \\
Alice  & &  Bob \\ 
     & & x \in_R Z_{n}^\ast,\\
     & & y \equiv x^{2} \; mod \; n \\
& \hspace{-1cm} <\,\stackrel{y}{{\linethickness{0.2mm}\put(-10,3)
                        {\line(1,0){40}}}}  & \\
%repeat \; k \; times 
%&\left\{
%\begin{array}{c}
& \hspace{-1cm} <\,\stackrel{ZK \; (y \in QR_{n})}{{\linethickness{0.2mm}\put(-10,3)
                        {\line(1,0){40}}}}  & \\
% \hspace{1cm} \stackrel{\sqrt{z}\; or\; \sqrt{zy} \; ?}{{\linethickness{0.5mm}
 %          \put(-30,3){\line(1,0){40}}}}\,>  \\
 %\hspace{-1cm} <\,\stackrel{r \; or \; rx}{{\linethickness{0.5mm}\put(-10,3)
  %                      {\line(1,0){40}}}}   
%\end{array} 
%\right\} & \\
{x'} = \sqrt{y} 
&\hspace{1cm} \stackrel{x'}{{\linethickness{0.2mm}\put(-30,3)
                        {\line(1,0){40}}}}\,> & \\
\end{eqnarray*}\\

%\begin{flushleft}
%Note:  Since we have $n \rightarrow \; y \rightarrow \sqrt{y} \rightarrow p, \;q$ 
%we can get these in the brace.  And we can replace it by $ZK(y \in QR_{n})$.  So 
%we have:
%\end{flushleft}

%\begin{eqnarray*}
%& n = p \ast q  & \\
%Alice  & &  Bob \\ 
 %    & & x \in_R Z_{n}^\ast,\\
  %   & & y \equiv x^{2} \; mod \; n \\
%& \hspace{-1cm} <\,\stackrel{y}{{\linethickness{0.5mm}\put(-10,3)
 %                       {\line(1,0){40}}}}  & \\
%repeat \; k \; times 
%&\left\{
%\begin{array}{c}
 %\hspace{-1cm} <\,\stackrel{z=r^{2}}{{\linethickness{0.5mm}\put(-10,3)
  %                      {\line(1,0){40}}}}   \\
 %\hspace{1cm} \stackrel{\sqrt{z}\; or\; \sqrt{zy} \; ?}{{\linethickness{0.5mm}
  %         \put(-30,3){\line(1,0){40}}}}\,>  \\
 %\hspace{-1cm} <\,\stackrel{r \; or \; rx}{{\linethickness{0.5mm}\put(-10,3)
  %                      {\line(1,0){40}}}}   
%\end{array} 
%\right\} & \\
%{x'} = \sqrt{y} 
%&\hspace{1cm} \stackrel{x'}{{\linethickness{0.5mm}\put(-30,3)
 %                       {\line(1,0){40}}}}\,> & \\
%& \hspace{-1cm} <\,\stackrel{ZK\;(y\;\in\;QR_{n})}{{\linethickness{0.5mm}\put(-10,3)

 %                       {\line(1,0){40}}}}  & \\
%\end{eqnarray*}\\

 \end{document}













