Oblivious Transfer. (OT) Informally, 1-out-of-2 Oblivious Transfer (see [21] and citations therein) enables one party (the sender) to transfer exactly one of two secrets to another party (the receiver). The receiver chooses (by index 0 or 1) which secret she wants. The security of the OT protocol guarantees that the sender does not learn this choice bit, and the receiver does not learn anything about the other secret.
Oblivious Transfer. The Oblivious Transfer (OT) functionality was defined by Xxxxxxx et al. [CLOS02]. We recall it in Figure 16. Password-Authenticated Key Exchange. The initial PAKE functionality pwKE has been defined by Xxxxxxx et al. [CHK+05]. We recall it in Figure 17. We stress that this functionality immediately leaks the result of the TestPwd-query, which models explicit authentication; when the adversary tries a password, it learns whether the guess was correct or not. and the players S (the sender) and R (the receiver) via the following queries: The functionality FOT is parameterized by a security parameter λ. It interacts with an adversary S – Upon receiving a query (Send, sid, x0, x1) from S, where x0, x1 ∈ {0, 1}λ, record the tuple (x0, x1). – Upon receiving a query (Receive, sid, i) from R: If there is a record (x0, x1), then send (sid, xi) to R and sid to S, and halt. Otherwise, ignore the query.
