%This notes are written by Qionglin Wu (ID: 9545239)

\documentclass[12pt]{article}



\usepackage[dvips]{graphics, color}
\usepackage{epsfig}

%\usepackage{fullpage}
\usepackage{amsmath}
\usepackage{amssymb}

\pagenumbering{arabic}

%\renewcommand{\textfraction}{0.15}
%\renewcommand{\topfraction}{0.85}
%\renewcommand{\bottomfraction}{0.65}
%\renewcommand{\floatpagefraction}{0.60}

\input{ProgMacs}
\input{MathMacs}
\input{ThmMacs}
\newcommand{\comment}[1]{}                       % truc a Claude.

\begin{document}
\section{Lecture 11}
\subsection{One-Out-Of-Two (OT)}

At the beginning of this lecture, we should introduce three basic concepts for OT:\\

\begin{itemize}
\item {\bf R-OT,} or Rabin's OT, permits Alice to send a bit b to 
Bob.  Bob receives b with 50-50 probability and knows whether he received the bit.  
Alice does not know whether Bob received the bit.  This has been given in the last 
class.
\item  $\begin{array}{c}
\left(
\begin{array}{c}
2 \\ 1
 \end{array}
\right)
\; - \;
OT
\end{array}$, or "one-out-of-two" OT, permits Alice to send one
of two bits, $b_{0}$ or $b_{1}$, to Bob.  Bob chooses an index c and receives 
$b_{c}$. Alice does not learn c.\\
\end{itemize}

\begin{flushleft}
The following figure describes the second case:\\
\end{flushleft}

%\begin{flushleft}
%Figure 1
%\end{flushleft}
\begin{eqnarray*}
\begin{array}{ccccccc}
A & &
\begin{array}{cc}
b_{0}  \; \longrightarrow\\
b_{1}  \; \longrightarrow
\end{array}
%\begin{boxit}
\left[
\begin{array}{c}
\left(
\begin{array}{c}
2 \\ 1
 \end{array}
\right)

\; - \;
OT
\end{array}
\right]
%\end{boxit}
\begin{array}{cc}
\longleftarrow \; c  \\
\longrightarrow  \; b_{c}   
\end{array}
& & B
\end{array}
\end{eqnarray*}\\

\begin{flushleft}
Here the implementation assumes 
that Bob can not distinguish between $QR_{n} [+1]$ and $QNR_{n} [+1]$ given
$(\frac{y}{n})\;=\;1$.\\
\end{flushleft}

%\begin{flushleft}
%Figure 2\\
%\end{flushleft}


\begin{eqnarray*}
& n, \; y \in QNR_{n} [+1] & \\
\hspace{-2cm}A    &  &          B \hspace{1cm}\\
 & \stackrel{ZK\;(y\;\in\;QNR_{n} [+1])}{{\linethickness{0.2mm}\put(-30,3)
                       {\line(1,0){60}}}}\,> & \\
\\
\hline\\
\\
z_{0}\;=\;r_{0}^{2}\;y_{0}^{b_{0}} & & \\
z_{1}\;=\;r_{1}^{2}\;y_{1}^{b_{1}} & & \\
 (mod \; n) & & \\
& \stackrel{z_{0},\;z_{1}}{{\linethickness{0.2mm}\put(-30,3)
                       {\line(1,0){40}}}} \, > & \\
& & {w} \leftarrow z_{c} \ast r^{2} \ast y^{b}, \\
& & r \in_{R}Z_{n}^\ast,\\
& & b \in_{R}\{0,\;1\} \\
& \hspace{-2cm} <\,\stackrel{w}{{\linethickness{0.2mm}\put(-10,3)
                        {\line(1,0){40}}}}   & \\
 & \stackrel{\left(
\frac{w}{p}
\right)}{{\linethickness{0.2mm}\put(-30,3)
                       {\line(1,0){40}}}}\,> &  \\
& & \left(
\frac{z_{c}}{p}
\right) = (-1)^b\;\left(
\frac{w}{p}
\right)\\
\end{eqnarray*}

\begin{flushleft}
Here, $\left(
\frac{w}{p}
\right)
$ is the Legendre Symbol.   
If $w\in QR_{n}$, $\left(
\frac{w}{p}
\right)$ = 1, otherwise $\left(
\frac{w}{p}
\right)$ 
= -1. (since $\left(
\frac{w}{n}
\right)\; =\;
\left(
\frac{w}{p}
\right)
\left(
\frac{w}{q}
\right)).
$ Bob knows the value of $\left(
\frac{w}{p}
\right)$, but he has no knowledge about p.  Using 
 $\left(
\frac{z_{c}}{p}
\right)=\;(-1)^b\;\left(
\frac{w}{p}
\right)$ 
Bob can compute the Legendre Symbol of $z_{c}$ with p.
\end{flushleft}

\begin{flushleft}
  Let's modify the previous scheme in order to impose that w has
the following forum:\; ${w}\;=\;z_{c} \ast r^{2} \ast y^{b}$: \\   
In the following figure, let $\varsigma$ be the security parameter such that the probability is $<
      \frac{1}{2^\varsigma}$ that $Bob$ could succeed in convincing $Alice$ that its questions are built properly on
      the two bit commitments of $Alice$.
\end{flushleft}

%begin{figure*}[htbp]
%  \begin{center}
  \begin{minipage}{16cm}
      $$\begin{array}{r @{\: \vline \:} l @{\setlength{\arrayrulewidth}{0.05mm} \: \vline \: } c @{\setlength{\arrayrulewidth}{0.05mm} \: \vline \:} l}
        & Alice & \ \hspace{3cm} & Bob\\
        \hline
        1 & 
        \begin{array}{l}
          r_0, r_1 \in_R \mathbb{Z}_n^\ast\\
          z_0 \leftarrow {r_0}^2 \, y_0^{b} \; \mathsf{mod} \; n\\
          z_1 \leftarrow {r_1}^2 \, y_1^{b} \; \mathsf{mod} \; n
        \end{array} & 
        \begin{array}{c}
          \left( z_0, z_1 \right)\\
          \xrightarrow[\hspace{3cm}]{}\\
        \end{array} & \\
        & & & \\
        2 & & 
        \begin{array}{c}
          \xleftarrow[\hspace{3cm}]{}\\
          \left( w_{0}, w_{1} \right)
        \end{array}
        & 
        \begin{array}{l}
          s_0, s_1 \in_R \mathbb{Z}_n^\ast\\
          a_0, a_1  \in_R \{0, 1\}\\
          w_0 \leftarrow z_0 \, s_0^2 \, y^{a_0} \; \mathsf{mod} \; n\\
          w_1 \leftarrow z_1 \, s_1^2 \, y^{a_1} \; \mathsf{mod} \; n\\
        \end{array}\\
        & & & \\
        \hline
        & & & \\
        3 & & 
        \begin{array}{c}
          \xleftarrow[\hspace{3cm}]{}\\
          { \left\{ \left(w_{0}^i, w_{1}^i \right) \right\} }_{1\le i \le \varsigma}
        \end{array}
        &
        \begin{array}{l}
          s_{0_i}, s_{1_i} \in_R \mathbb{Z}_n^\ast\\
          a_{0_i}, a_{1_i} , c_i \in_R \{0, 1\}\\
          {w_{{c_{}^{}}_i}}^i \leftarrow z_{0} \, {s_{0_i}}^2 \, y^{a_{0_i}} \; \mathsf{mod} \; n\\
          {w_{\overline{{c_{}^{}}_i}}}^i \leftarrow z_{1} \, {s_{1_i}}^2 \, y^{a_{1_i}} \; \mathsf{mod} \; n\\
          \hfill  1\le i \le \varsigma
        \end{array}\\
        4 & 
        \begin{array}{l}
          \tiny{Define \; \mathcal{P} \; and \; \mathcal{O} \; such \; that:}\\
          \mathcal{P} \cup \mathcal{O} = \{ 1, 2, \ldots, \varsigma \}\\
          \mathcal{P} \cap \mathcal{O} = \emptyset\\
        \end{array}
        & 
        \begin{array}{c}
          \mathcal{P}, \mathcal{O} \\
          \xrightarrow{\hspace{3cm}}\\
        \end{array}
        & \\
        5 & & 
        \begin{array}{c}
          \xleftarrow[\hspace{3cm}]{}\\
          {\left\{ \left(\theta_{{}_i} , \delta_{0_i} , \delta_{1_i}, u_{0_i}, u_{1_i} \right) \right\} }_{i \in \mathcal{P}}\\
          \&\&\\
          {\left\{ \left(c_i , a_{0_i} , a_{1_i}, s_{0_i}, s_{1_i} \right) \right\} }_{i \in \mathcal{O}}
        \end{array}
        &
        \begin{array}{l}
          {\theta_{}^{}}_i = c \oplus c_i\\
          {\delta}_{c_i} = {a_c} \oplus {a_{c_i}} \\
          {\delta}_{\overline{c_i}} = {a_{\overline{c}}} \oplus {a_{\overline{c_i}}} \\
          {u}_c \leftarrow z_{c} \, s_c \, {s_{c_i}} \, y^{{a_c} \wedge {a_{c_i}}} \; \mathsf{mod} \; n\\
          {u}_{\overline{c}} \leftarrow z_{\overline{c}} \, s_{\overline{c}} \, {s_{\overline{c_i}}} \, y^{{a_{\overline{c}}}  \wedge {a_{\overline{c_i}}}} \; \mathsf{mod} \; n\\
          \hfill  i \in \mathcal{P}\\
        \end{array}\\
        6 & 
        \begin{array}{l}
          \mathrm{Verify}:\\
          w_{\theta_i}^i w_{0} \equiv {{u}_0}^2 \; y^{{\delta_{0}^{}}_i} \; (\mathrm{mod} \; n)\\
          w_{\overline{\theta_i}}^i w_{1} \equiv {{u}_1}^2 \; y^{{\delta_{1}^{}}_i} \; (\mathrm{mod} \; n)\\
          \hfill  i \in \mathcal{P}\\
          w_{c_i}^i \equiv z_{0} \, s_{0_i}^2 \, y^{a_{0_i}} \; (\mathsf{mod} \; n)\\
          w_{\overline{c_i}}^i \equiv z_{1} \, s_{1_i}^2 \, y^{a_{1_i}} \; (\mathsf{mod} \; n)\\
          \hfill  i \in \mathcal{O}\\          
        \end{array}
        & & \\
        & & & \\
        \hline
        & & & \\
        7 & & 
        \begin{array}{c}
          \xleftarrow[\hspace{3cm}]{} \\
          \tau
        \end{array}
        & \begin{array}{l}\tau \leftarrow s \oplus c\end{array}\\

        & & & \\
        8 & 
        \begin{array}{l}
          \beta \leftarrow (w_\tau \in Q_n) \; ? \; 0 \; \mathrm{else} \; 1\\
          \omega \in \mathbb{Z}_n | w_\tau y^{\beta}\equiv w^2 \; (\mathrm{mod} \; n)
        \end{array}
        & 
        \begin{array}{c}
          \beta \; \mathrm{and} \; \omega\\
          \xrightarrow{\hspace{3cm}} 
        \end{array}
        & 
        \; \mathrm{Verify} \; w_\tau y^{\beta}\equiv \omega^2 \; (\mathrm{mod} \; n)\\
        & & & \\
        9 & & & \; b_s \twoheadleftarrow \beta \oplus a_\tau\\
      \end{array}$$\\
    \end{minipage}
%\end{center}
%\end{figure*}

\begin{flushleft}
Note: the second row is ZK proof.
\end{flushleft}


\subsection{Trapdoor Permutation}

What is a trapdoor $\pi$? \\
{\bf $\pi$} is trapdoor one-way function or permutation.\\
It implies:
\begin{itemize} 
\item {\bf $\pi$}  is a one-way function or permutation.
\item {\bf $\pi^{-1}$}  can be computed efficiently given "a trapdoor".\\ 
%Example:     RSA \\  p, q  s.t. $p\; q$ = n \\  d  s.t.  $e\; d$ = 1 mod $\Phi(n)$.\\
%If we know d, then we can factor n.\\
\end{itemize}

\begin{flushleft}
If we have one-way function, then we can have a digital signature scheme, but
we need trapdoor one-way permutation to have a public key scheme.\\
Trapdoor functions are harder to get than one-way permutation.\\
\end{flushleft}

\begin{eqnarray*}
&  \pi \; (a\; T-D-O-W-P) & \\
& f:\;a\; hard\; core\; predicate\; of\; \pi &\\
& (given\; \pi(x),\; it\; is\; difficult \;to\; predicate\; f(x)) &\\
A      & &          B  \\
& & {y_{0}} \leftarrow \pi \leftarrow {x_{0}} \\
& & {y_{1}} \in_R \mathbb{Z}_n^\ast\\
 & <\,\stackrel{z_{0} = y_{c},\; z_{1} = y_{\bar{c}} }{{\linethickness{0.5mm}\put(-30,3)
                       {\line(1,0){60}}}} & \\
A\;naive\;way: & &\\
w_{0}\;=\;\pi^{-1}(z_{0}), & & \\
w_{1}\;=\;\pi^{-1}(z_{1}), & & \\
a_{0}\;\leftarrow\;f(w_{0})\;\bigoplus\;b_{0}, & & \\
a_{1}\;\leftarrow\;f(w_{1})\;\bigoplus\;b_{1}, & & \\
& \stackrel{a_{0},\; a_{1}}{{\linethickness{0.5mm}\put(-30,3)
                       {\line(1,0){40}}}} \, >  \\
%& & {y_{1}} \longleftarrow {x_{1}} \\
& & b_{c}\;\longleftarrow\;a_{c}\;\bigoplus\;f(x_{0}),  \\
\end{eqnarray*}

\begin{flushleft}
In this scheme, Bob can cheat by choosing $y_{1} = \pi (x_{1})$, but this will
be fixed later.  Alice can not find out which is the bit that Bob is interested
in by OT.  So the scheme is modified as follows:
\end{flushleft}

\begin{eqnarray*}
\hline\\
\\
\begin{array}{ccccccc}
\hspace{3.1cm}y_{0} \left\{ \begin{array}{c}
\bigcirc  \\
\bigcirc  \\
\bigcirc  \\
\vdots \\
\bigcirc  \\
\bigcirc  
\end{array} \right. 
\leftarrow \pi \leftarrow \left. \begin{array}{c}
 \bigcirc  \\
 \bigcirc  \\
 \bigcirc  \\
\vdots\\
\bigcirc\\
 \bigcirc  
\end{array} 
\right \} \;
 x_{0} \;
\left \{ \begin{array}{cc}
0  & \bigcirc  \\
1 & \bigcirc  \\
1 & \bigcirc  \\
\vdots & \vdots\\
1 & \bigcirc  \\

1 & \bigcirc 
\end{array} 
\right \} \;
 x_{0}^{'} \\
\hspace{7.5cm}
\vline \hspace{2.2cm} y_{1} \left \{ \begin{array}{c}
 \bigcirc  \\
 \bigcirc  \\
\bigcirc  \\
 \vdots\\
 \bigcirc  \\
 \bigcirc 
\end{array} 

\right \} \;
 x_{1}\;
 \left \{ \begin{array}{cc}
0 & \bigcirc  \\
1 & \bigcirc  \\
1 & \bigcirc  \\
\vdots & \vdots \\
1 & \bigcirc  \\
1 & \bigcirc 
\end{array} 
\right \} \;
 x_{1}^{'} 
\hspace{4.1cm}
\\
\end{array} 
\hspace{-16.2cm} <\,\stackrel{ z_{0} =  y_{c},\; z_{1} = y_{\bar{c}} }{{\linethickness{0.5mm}\put(-30,3)
                      {\line(1,0){60}}}}   \hspace{10.2cm} \\
\end{eqnarray*}

\begin{flushleft}
Bob commits $x_{0}^{'}$ and $x_{1}^{'}$ before Alice sends the 
two random numbers.  So he cannot change his mind. Instead of ZK proving 
$y_{0}\;=\;\pi(x_{0})$ above, we can only prove 
$y_{1}\;=\;x_{1}$.  Thus the above scheme will change into:
\end{flushleft}

\begin{eqnarray*}
\hline\\
\\
\begin{array}{ccc}

\hspace{0.2cm}
\left. \begin{array}{c}
 \bigcirc  \\
 \bigcirc  \\
 \bigcirc  \\
\vdots\\
\bigcirc\\
\bigcirc  
\end{array} 
\right \} \;
y_{c} \;\;
y_{0} \left\{ \begin{array}{c}
\bigcirc  \\
\bigcirc  \\
\bigcirc  \\
\vdots \\
\bigcirc  \\
\bigcirc  
\end{array} \right. \hspace{2cm}
y_{0}\;=\;\pi(x_{0}) \\
\hspace{6.0cm}
\left. \begin{array}{c}
 \bigcirc  \\
 \bigcirc  \\
 \bigcirc  \\
\vdots\\
\bigcirc\\
\bigcirc  

\end{array} 
\right \} \;
y_{\bar{c}} \;\;\;
\vline \hspace{2.2cm} y_{1} \left \{ \begin{array}{c}
 \bigcirc  \\
 \bigcirc  \\
 \bigcirc  \\
 \vdots\\
 \bigcirc  \\
 \bigcirc 
\end{array} 
\right \} \;
 x_{1}\;
 \left \{ \begin{array}{cc}
0 & \bigcirc  \\
1 & \bigcirc  \\
1 & \bigcirc  \\
\vdots & \vdots \\
1 & \bigcirc  \\
1 & \bigcirc 

\end{array} 
\right \} \;
 x_{1}^{'} 
\hspace{4.1cm}
\\
\end{array} 
\hspace{-18.2cm} <\,\stackrel{z_{0} =  y_{c} ,\; z_{1} = y_{\bar{c}} }{{\linethickness{0.5mm}\put(-30,3)
                       {\line(1,0){60}}}}   \hspace{10.2cm} \\
  \stackrel{a_{0},\; a_{1}}{{\linethickness{0.5mm}\put(-30,3)
                      {\line(1,0){40}}}} \, >   \hspace{9.5cm}\\
\end{eqnarray*}

\begin{flushleft}
In this scheme,  firstly we will do the 
right-up section and then do the right-down
section.  Repeat $y_{c_{i}}$ and $y_{\bar{c_{i}}}$ k times, we must show:\\
\begin{itemize}
\item $y_{c_{i}}^{i}$ and $y_{\bar{c_{i}}}^{i}$ are the same as $y_{0}$ and $y_{1}$.\\
\item $y_{c_{i}}^{i}$ and $y_{\bar{c_{i}}}^{i}$ are the same as $y_{c}$ and $y_{\bar{c}}$.\\.
\end{itemize}
\end{flushleft}
\end{document}

