A Novel k-out-of-n Oblivious Transfer Protocol from Bilinear Pairing

Table 1

The proposed k-out-of-n authentic OT protocol.

Sender; (𝑆pub/𝑆priv(=𝑠𝑆pub))		Chooser; (𝐶pub/𝐶priv(=𝑠𝐶pub))
		(1) Selects ,𝑏∈𝑅𝑍^∗𝑞, computes 𝑉=𝑎𝑏𝐶pub, for 𝑗=1 to 𝑘, computes 𝑉𝑗=𝑏𝐻(𝜎𝑗)𝐶priv, computes ℎ=𝐻2(𝑉) and Sig=ℎ𝐶priv.
	^𝐼𝐷𝐶,𝑉,𝑉←^1,…,𝑉𝑘,Sig
(2) Computes ℎ=𝐻2(𝑉) and verifies𝑒(̂𝑃,Sig)=?𝑒(̂𝑃pub,ℎ𝐶pub). If it does not hold, aborts.; Selects 𝑐∈𝑅𝑍^∗𝑞 and computes 𝑈𝑗=𝑐𝑉𝑗, for 𝑗=1,…,𝑘, and 𝑐𝑡𝑖=𝑚𝑖⊕𝑒(̂𝐻(𝑖)𝑉,𝑆priv)^𝑐, for 𝑖=1,…,𝑛.
	−−−−−−−−−−−→^𝑈1,…,𝑈𝑘,𝑐𝑡1,…,𝑐𝑡𝑛
		(3) For 𝑗=1 to 𝑘 and 𝑖=1 to 𝑛, computes 𝑚𝜎𝑖=𝑐𝑡𝜎𝑖⊕𝑒(̂𝑈𝑗,𝑆pub)^𝑎.