Oblivious transfer from key encapsulation mechanisms

1 . A method for establishing an oblivious transfer channel for multi-party computations among a sender computer and a receiver computer, the method comprising performing by the sender computer:

generating a key pair including a public key pk and a secret key sk, wherein the public key pk is accessible to the receiver computer;

receiving a pair of receiver values from the receiver computer, wherein a first receiver value of the pair of receiver values includes a random value, and a second receiver value of the pair of receiver values is generated by applying a first function to (1) a first hash output generated from using a first hash function on the public key pk and the random value and (2) a ciphertext ct b generated using the public key pk;

generating a first sender value by using a second hash function, the first receiver value, the second receiver value, and the public key pk according to a choice bit b being 0;

generating a second sender value by using a third hash function, the first receiver value, the second receiver value, and the public key pk according to the choice bit b being 1;

determining an encapsulated key k 0 by using the secret key sk and the first sender value;

determining an encapsulated key k 1 by using the secret key sk and the second sender value;

using the encapsulated key k 0 and the encapsulated key k 1 to perform the multi-party computations with the receiver computer;

establishing a second oblivious transfer channel with a second receiver computer by re-using the key pair to determine a pair of additional encapsulated keys for the second receiver computer, the pair of additional encapsulated keys for use in additional multi-party computations with the second receiver computer; and

encrypting a set of communications for transmission to the second receiver computer by using the pair of additional encapsulated keys, wherein the set of communications is decryptable by the second receiver computer using a corresponding encapsulated key derived from re-using the public key pk.

2 . The method of claim 1 , wherein the sender computer publishes the public key pk on a public server that is accessible to the receiver computer.

3 . The method of claim 1 , wherein the sender computer sends the public key pk directly to the receiver computer.

4 . The method of claim 1 , wherein the random value is a random value r 1-b , the first receiver value is the random value, the second receiver value is an intermediate value r b , the first hash function is a hash function H b , the second hash function is a hash function H 0 , and the third hash function is a hash function H 1 , wherein the hash function Hp is the hash function H 0 or the hash function H 1 depending on the choice bit b.

5 . The method of claim 4 , wherein the first sender value is a ciphertext ct 0 , wherein the first sender value is generated by applying a second function to 1) the second receiver value and (2) a second hash output generated from using the second hash function on the public key pk and the first receiver value, wherein the second function is an inversion of the first function, wherein the first receiver value has a value r 1 and the second receiver value has an intermediate value r 0 according to the choice bit b being 0.

6 . The method of claim 5 , wherein the encapsulated key k 0 is generated by decapsulating the first sender value using the secret key sk.

7 . The method of claim 4 , wherein the second sender value is a ciphertext ct 1 , wherein the second sender value is generated by applying a second function to 1) the second receiver value and (2) a third hash output generated from using the third hash function on the public key pk and the first receiver value, wherein the second function is an inversion of the first function, wherein the first receiver value has a value r 0 and the second receiver value has an intermediate value r 1 according to the choice bit b being 1.

8 . The method of claim 7 , wherein the encapsulated key k 1 is generated by decapsulating the second sender value using the secret key sk.

9 . The method of claim 1 , wherein the first receiver value is an intermediate value s, the second receiver value is an intermediate value T, the random value is a random value r, the first hash output is generated from using the first hash function on the public key pk, the choice bit b, and the random value, the first hash function is a hash function H 0 , and the second hash function and the third hash function are hash function H 1 .

10 . The method of claim 9 , wherein the first receiver value is generated by applying a second function to (1) the random value and (2) a second hash output generated from using the hash function H 1 on the public key pk, the choice bit b, and the second receiver value.

11 . The method of claim 10 , wherein the first sender value is an intermediate value r 0 , wherein the first sender value is generated by applying a third function to 1) the first receiver value and (2) a third hash output generated from using the second hash function on the public key pk, the choice bit b of 0, and the second receiver value, wherein the third function is an inversion of the second function.

12 . The method of claim 11 , wherein the encapsulated key k 0 is generated by decapsulating a ciphertext ct 0 using the secret key sk, wherein the ciphertext ct 0 is generated by applying a fourth function to (1) the second receiver value and (2) a fifth hash output generated from using the hash function H 0 on the public key pk, the choice bit b of 0, and the first sender value, wherein the fourth function is an inversion of the first function.

13 . The method of claim 10 , wherein the second sender value is an intermediate value r 1 , wherein the second sender value is generated by applying a third function to 1) the first receiver value and (2) a fourth hash output generated from using the third hash function on the public key pk, the choice bit b of 1, and the second receiver value, wherein the third function is an inversion of the second function.

14 . The method of claim 13 , wherein the encapsulated key k 1 is generated by decapsulating a ciphertext ct 1 using the secret key sk, wherein the ciphertext ct 1 is generated by applying a fourth function to (1) the second receiver value and (2) a sixth hash output generated from using the hash function H 0 on the public key pk, the choice bit b of 1, and the second sender value, wherein the fourth function is an inversion of the first function.

15 . A method for establishing an oblivious transfer channel for multi-party computations among a sender computer and a receiver computer, the method comprising performing by the receiver computer:

obtaining a public key pk that is publicly accessible to the receiver computer, wherein a key pair includes the public key pk and a secret key sk generated by the sender computer;

computing a ciphertext ct b using an encapsulated key k b , the public key pk, and a choice bit b selected by the receiver computer;

generating a pair of receiver values, wherein generating a first receiver value of the pair of receiver values includes a random value, and generating a second receiver value of the pair of receiver values includes applying a first function to (1) a first hash output generated from using a first hash function on the public key pk and the random value and (2) the ciphertext ct b ;

providing the pair of receiver values to the sender computer, wherein the sender computer is configured to determine an encapsulated key k 0 and an encapsulated key k 1 using the secret key sk and corresponding sender values, wherein the corresponding sender values are generated by using corresponding hash functions, the first receiver value, the second receiver value, and the public key pk according to the choice bit b;

using the encapsulated key k b and the choice bit b to perform the multi-party computations with the sender computer;

establishing a second oblivious transfer channel with a second sender computer by re-using the key pair to generate additional receiver values for the second sender computer to determine a pair of additional encapsulated keys for use in additional multi-party computations with the second sender computer; and

decrypting a set of communications received from the second sender computer by using a corresponding encapsulated key derived from re-using the public key pk, wherein the set of communications is encrypted by the second sender computer using the pair of additional encapsulated keys.

16 . The method of claim 15 , wherein the encapsulated key k 0 and the encapsulated key k 1 are known only to the sender computer.

17 . The method of claim 15 , wherein the choice bit b is known only to the receiver computer.

18 . The method of claim 15 , wherein the encapsulated key k 0 and the encapsulated key k 1 are used to perform the multi-party computations with the receiver computer.

19 . The method of claim 15 , wherein the encapsulated key k 0 , the first receiver value, the second receiver value, and a hash function H 2 are used to generate a session key q 0 , and wherein the encapsulated key k 1 , the first receiver value, the hash function H 2 , and the second receiver value are used to generate a session key q 1 by the receiver computer.

20 . The method of claim 15 , wherein the encapsulated key k b , the first receiver value, the second receiver value, and a hash function H 2 are used to generate a session key q b by the sender computer.