Oblivious transfer

Oblivious transfer separates the recipient’s access from the sender’s knowledge of the recipient’s choice. In 1-out-of-2 OT, a sender inputs messages m0 and m1, while a recipient inputs a choice bit b and receives mb; the sender should not learn b, and the recipient should not learn the other message. These are usually called sender privacy and receiver privacy.

The protocol is not ordinary encryption: both parties participate, and privacy is defined against specified adversaries. A semi-honest protocol assumes participants follow the instructions but inspect the transcript, whereas a malicious-secure protocol also addresses arbitrary deviation. Security may be computational, relying on assumptions such as the hardness of discrete logarithms, or information-theoretic under stronger setup or communication conditions.

The first protocol associated with the name was proposed by Michael Rabin in 1981 as a way for a sender to transmit a secret that the recipient receives only with a prescribed probability. Later work established more regular choice-based forms, including protocols in which the recipient obtains exactly one of two messages without revealing which one.

Public-key techniques commonly provide the underlying mechanism: the recipient creates values related to a hidden choice, and the sender uses them to form encryptions or correlated ciphertexts. The recipient can recover the selected message but lacks the information needed to decrypt the other. Formal reductions connect OT security to primitives such as trapdoor permutations, public-key encryption, and other hardness assumptions. General completeness results showed that OT can serve as a foundation for broad secure computation. ¹²

Oblivious transfer is a basic building block for secure multiparty computation, where several parties jointly evaluate a function while limiting what each party learns about private inputs. It can implement private database queries, comparisons, auctions, private set intersection, and secure evaluation of Boolean circuits. ¹

Practical systems often use OT extension: a relatively small number of expensive public-key OTs are expanded into many more OTs using symmetric-key operations. The influential IKNP construction made this approach efficient for large batches, substantially reducing the public-key workload. ³ Protocol designers must still account for authentication, malicious behavior, randomness quality, leakage through implementation details, and the distinction between stand-alone security and security when OT is composed with other protocols.

Oblivious transfer is a family of related primitives rather than one single protocol. Variants include 1-out-of-n OT, where the recipient selects one item from n; k-out-of-n OT, where several items may be selected; and correlated OT, in which the transferred values have a prescribed relationship useful for efficient computation.

Rabin OT and 1-out-of-2 OT differ in their delivery guarantees: probabilistic receipt in the former is not the same as a guaranteed selected-message transfer in the latter. Another subtlety is that “oblivious” describes the sender’s ignorance of the choice, not complete invisibility of the communication or protection against every form of traffic analysis. Security definitions also distinguish privacy from correctness, and many deployed protocols require a separate consistency or cut-and-choose mechanism to prevent a malicious party from supplying malformed inputs. ³

1-out-of-2 OT

A protocol in which a recipient selects one of two sender-held messages and receives only the selected message, while the sender does not learn the choice.

OT extension

A method for generating many oblivious transfers from a smaller number of base transfers using efficient symmetric-key operations.

Semi-honest security

Security against parties that follow the protocol but may analyze all information recorded during execution.

Malicious security

Security that remains meaningful when a participant may deviate arbitrarily from the prescribed protocol.

Correlated OT

An OT variant whose outputs satisfy a designed algebraic or bitwise relationship, often aiding secure computation.