Adaptive Oblivious Transfer with Access Control from Lattice Assumptions

Abstract

Adaptive oblivious transfer (OT) is a protocol where a sender initially commits to a database {Mi} N i=1 . Then, a receiver can query the sender up to k times with private indexes ρ1, . . . , ρ k so as to obtain Mρ 1 , . . . , Mρ k and nothing else. Moreover, for each i ∈ [k], the receiver's choice ρi may depend on previously obtained messages {Mρ j }j<i. Oblivious transfer with access control (OT-AC) is a flavor of adaptive OT where database records are protected by distinct access control policies that specify which credentials a receiver should obtain in order to access each Mi. So far, all known OT-AC protocols only support access policies made of conjunctions or rely on ad hoc assumptions in pairing-friendly groups (or both). In this paper, we provide an OT-AC protocol where access policies may consist of any branching program of polynomial length, which is sufficient to realize any access policy in NC1. The security of our protocol is proved under the Learning-with-Errors (LWE) and ShortInteger-Solution (SIS) assumptions. As a result of independent interest, we provide protocols for proving the correct evaluation of a committed branching program on a committed input.

UC Updatable Databases and Applications

“…In addition to POT and PPB, (non-)updatable databases are implicitly used as building blocks of other protocols. For example, many oblivious transfer with access control [1,8,16,30] protocols and other privacy preserving access control protocols [28] use a database that associates the index i of messages m i with an access control policy ACP i (∀i ∈ [1, N]). As another example, privacy-preserving client-side profiling protocols [18] use a database that stores a codification of a profiling algorithm.…”

Postquantum Cut-and-Choose Oblivious Transfer Protocol Based on LWE

“…ere exist some cryptographic protocols based on lattice's assumption, which can resist quantum attack with the specific construction of lattice. Reduction from worst case to average case in lattice, trapdoors algorithm and some lattice theory are mentioned in [29][30][31][32].…”

Unlinkable Updatable Databases and Oblivious Transfer with Access Control

“…Π OTAC supports any policies that can be represented by tuples of values. In [23], policies are represented by branching programs. If the ZK proof for a policy committed in com i,j ∀j∈[1,L] requires R k to hide the indices j that are used from the policy, the proof for F R ACP ZK can follow an approach similar to Π UUD to compute an OR proof.…”

“…In the initialization phase, U computes N ciphertexts c i that encrypt m i . Some OTAC [8,1,23] use a signature that binds ACP i to c i , while others [30,31,32,27] use fuzzy identity-based encryption (IBE) or ciphertext-policy attribute-based encryption (CP-ABE) to encrypt m i under ACP i . The receivers obtain (c i , ACP i ) ∀i∈ [1,N ] .…”