Universally Composable Oblivious Transfer with Low Communication

Round 1

Reviewer 1 Report

The authors present an UC oblivious transfer protocol with low communication. The communication cost of the protocol is calculated obtaining a value of 24576 bits with a running time of less than 1 ms, which means higher efficiency and low communication cost when comparing with other two protocols in the state of the art. This values were obtained from a statistic relevant amount of 100000 trials. This work is of high importance for SMC applications where multiple users want to interact keeping them inputs private. The authors well describe the protocol and also present proofs of security regarding sender and receiver's privacy.

This paper is well written and I just recommend to check minor spelling errors. For instance, in the point 1 of 5.1, the authors might have a mistake when from theorem 2 they claim the sender only gets the information he chooses.  Should be the receiver instead of the sender assuring the privacy of the sender.

Author Response

Please see the attachment.

Author Response File: Author Response.docx

Reviewer 2 Report

Song et. al have proposed a universal composable (UC) 1-out-of-N oblivious transfer (OT) protocol based on the module learning with rounding (Mod-LWR) assumption. The authors have proved the full-simulation security of the protocol in the random oracle model (ROM) and used experimental simulations to show its advantages of high efficiency and low communication cost. 

The manuscript is well-written and the components of the protocol are fully described with robust definitions, proofs, and simulations. I suggest to publish with minor revisions. Please see below for my comments:

1. Please unify MPC and SMPC, as they are all abbreviations of "secure multi-party computation". Also please show the full name of DDH when it first appears in the main text. 

2. In the Introduction section, could the authors briefly explain about the motivation of proposing OT under Mod-LWR assumption? Why it can potentially solve the main problems of current OT protocols?

3. In the Discussion section, why the authors just compare the efficiency with OT protocols in Ref. 16 and Ref. 20? What about the comparison with other OT protocols discussed in the Introduction section?

4. Another question for the Discussion section is, are there any metric to characterize the level of privacy of sender and receiver? Or in other words, is the proposed protocol more secure than other protocols?

Author Response

Please see the attachment.

Author Response File: Author Response.docx

Reviewer 3 Report

The paper presents a universal composable 1-out-of-N oblivious transfer protocol with low com-8 munication. The proof of encoding and decoding are given. The complecsity of the developed protocol is estimated and compared with existing approaches. The paper is interesting and well organized.

I recommend few improvements:

What does dollar mean before O notation in Table 6?

The reference to formula 1 should be added

Table 3 should be explained. Only the definitions of games are found after the table

 

 

Author Response

Please see the attachment.

Author Response File: Author Response.docx

Reviewer 4 Report

The subject of the paper is interesting and the analysis is correct to the best of the reviewer’s understanding. The main drawback of the paper is the large amount of syntax/grammar errors (only some of them are listed below) and the very limited length of section 6 (the discussion section which includes only one table). The reviewer believes that a very careful reading is necessary to correct the various syntax/grammar errors and additional results should also be included in the revised version of this work.

Specific comments

Lines 37-38, revise the sentence: “In 1995, Even proposed a
random 1-out-of-2 oblivious transfer [11] based on public-key cryptography in 1995,…”

Lines 46-47, revise the sentence: “But it can obtain
half-simulation security and construct simulators for one of the parties in the ideal environment.”

Lines 87-88, revise the following sentence so as to be clear: “The simulation shows that the average communication is only 2.45 kb per time and the average running time is only 0.5 ms.”

In line 99, write “In this section” instead of “In this segment”…the same change in line 142.

In line 101,write “Denote” instead of “Donate”. Similar changes in lines 107, 108.

Line 119, revise the phrase: “The module learning with rounding is the module version of LWR, replaces the ring…”

Line 131, revise the phrase: “π denote the running protocol, and ? donate…”

Line 139, revise the phrase: “…and the formula is expressed as follows”

Line 142, revise the phrase: “…we introduce the constitutions of the OT protocol in this paper”

 

The results of Section 6 are limited. Besides, it is not clear to the reviewer if the results presented in Table 6 are based on theoretical analysis or on simulation. In both cases it should be clarified how these results have been obtained.

Author Response

Please see the attachment.

Author Response File: Author Response.docx

Round 2

Reviewer 4 Report

Authors have improved their paper. Some minor syntax/grammar errors still exist in the paper and can be corrected during the preparation of the camera ready version.

 

 

Author Response

Please see the attachment.

Author Response File: Author Response.docx