Generalized Non-Interactive Oblivious Transfer Using Count-Limited Objects with Applications to Secure Mobile Agents

Abstract

Abstract. Oblivious transfer (OT) is a fundamental primitive used in many cryptographic protocols, including general secure function evaluation (SFE) protocols. However, interaction is a primary feature of any OT protocol. In this paper, we show how to remove the interaction requirement in an OT protocol when parties participating in the protocol have access to slightly modified Trusted Platform Modules, as defined by Sarmenta et al. in proposing the notion of count-limited objects (clobs) [8]. Specifically, we construct a new cryptographic primitive called "generalized non-interactive oblivious transfer"(GNIOT). While it is possible to perform GNIOT using clobs in a straightforward manner, with multiple clobs, we show how to perform this efficiently, by using a single clob regardless of the number of values that need to be exchanged in an oblivious manner. Additionally, we provide clear definitions and a formal proof of the security of our construction. We apply this primitive to mobile agent applications and outline a new secure agent protocol called the GTX protocol which provides the same security guarantees as existing agent protocols while removing the need for interaction, thus improving efficiency.

One-Time Programs Made Practical

“…Our approach is in the opposite direction: removing all interaction (other than transfer of the device) from the protocol. (c) Prior to OTP being proposed, Gunupudi and Tate [21] proposed count-limited private key usage for realizing non-interactive oblivious transfer using a TPM. Their so-lution requires changes in the TPM design (due to lack of a TEE).…”

“…For these reasons, we decide to use Frigate for implementing the garbled circuit components of our GC-based OTP. 21 Battleship. Battleship, developed by the same group, separates out the interpreter and execution functionalities of Frigate.…”

Encrypted Secret Sharing and Analysis by Plaintext Randomization

“…For example, with k = 1 and K(i) = 1 for all i, we capture a scheme in which all shares are encrypted with the key of a single trusted authority and shares are distributed (either to a single party or multiple parties) so that decryption of shares is allowed based on some criteria determined by the trusted authority. For example, Γ might be a threshold structure with threshold t, and trusted hardware controls how many shares may be decrypted at any particular time (this is the case in Gunupudi and Tate's generalized oblivious transfer scheme based on trusted hardware [10]). As another example, consider k = n escrow authorities, all with their own keys, and K(i) = i for all i.…”

Embedded SFE: Offloading Server and Network Using Hardware Tokens

“…B) Efficiency Improvements for Specific Functionalities. Efficient protocols with a tamper-proof token trusted by both players have been proposed for specific functionalities such as set intersection and oblivious database search (ODBS) [HL08], non-interactive oblivious transfer (OT) [GT08], and verifiable encryption and fair exchange [TV09]. In contrast, we solve the general SFE problem.…”