A Novel k-out-of-n Oblivious Transfer Protocol from Bilinear Pairing

Abstract

Oblivious transfer (OT) protocols mainly contain three categories: 1-out-of-2 OT, 1-out-of-n OT, and k-out-of-n OT. In most cases, they are treated as cryptographic primitives and are usually executed without consideration of possible attacks that might frequently occur in an open network, such as an impersonation, replaying, or man-in-the-middle attack. Therefore, when used in certain applications, such as mental poker games and fair contract signings, some extra mechanisms must be combined to ensure the security of the protocol. However, after a combination, we found that very few of the resulting schemes are efficient enough in terms of communicational cost, which is a significant concern for generic commercial transactions. Therefore, we propose a novel k-out-of-n oblivious transfer protocol based on bilinear pairing, which not only satisfies the requirements of a k-out-of-n OT protocol, but also provides mutual authentication to resist malicious attacks. Meanwhile, it is efficient in terms of communication cost.

1. Introduction

An oblivious transfer (OT) is an important primitive for designing security services. It can be used in various applications like the signing of fair contracts, oblivious database searches, mental poker games, privacy-preserving auctions, secure multiparty computations [1], and so on. In 1981, Rabin [2] first proposed an interactive OT scheme in which the probability of the receiver’s capability to decrypt a message sent by the sender is 1/2. Rabin used the proposed OT to design a 3-pass secret exchange (EOS) protocol, hoping that two parties can exchange their secrets fairly. In 1985, Even et al. [3] presented a more generalized OT, called 1-out-of-2 OT (OT²₁), in which a sender sends two encrypted messages to a chooser with only one of which the chooser can decrypt. They also presented a contract-signing protocol by evoking OT²₁ multiple times to prevent one party from obtaining the other party’s contract signature without first showing his own. In 1986, Brassard et al. [4] further extended OT²₁ into a 1-out-of-n OT (OT^𝑛₁, also known as “all-or-nothing”), in which only one out of n sent messages can actually be obtained by the chooser. The authors pointed out that their OT^𝑛₁ scheme can be used to implement a multiparty mental poker game [5] against a player coalition. In contrast to the interactive versions described above, Bellare and Micali [6] first proposed a noninteractive OT²₁ scheme in 1989. In this scheme, a user obliviously transfers two messages to another party equipped with two public keys to decrypt one of the messages.

From 1999 to 2001, based on the above-mentioned interactive and noninteractive OT schemes, Naor and Pinkas proposed some related OT methods, such as an adaptive OT^𝑛_𝑘 [7], proxy OT²₁ [8], distributed OT^𝑛_𝑘 [9], efficient OT^𝑛₁ [10], and efficient OT^𝑛_𝑘 [11]. Here, OT^𝑛_𝑘 is the final form of the OT schemes. In this form, from the n encrypted messages sent, the chooser can obtain k chosen messages in plaintext form without the sender’s knowledge regarding which part of the messages are decrypted. In Naor and Pinkas’s distributed OT^𝑛_𝑘 schemes [9], the sender distributes two messages (𝑀₀,𝑀₁) among n servers, and the chooser contacts 𝑘(𝑘<𝑛) servers to receive one (𝑀_𝜎,𝜎=0or1) of them. The authors claimed that their schemes can protect the privacy of both parties. However, in 2007, Ghodosi [12] showed two possible attacks on these schemes. In the first attack, two collaborating servers can reveal the chooser’s choice of 𝜎, while, in the second attack, the chooser can learn both M₀ and M₁ by colluding with only a single server. In 2002, Mu et al. [13] proposed three OT^𝑛_𝑘 schemes constructed using RSA encryption, a Nyberg-Rueppel signature, and an ElGamal encryption scheme, respectively. Two of these are interactive, while the other can be either interactive or noninteractive. The authors claimed that their schemes are complete, robust, and flexible and induce a significant improvement in communication cost. However, in 2006, Ghodosi and Zaare-Nahandi [14] showed that these schemes fail to satisfy the requirements of an oblivious transfer protocol. In 2004, Ogata and Kurosawa [15] proposed another OT^𝑛_𝑘 scheme, based on an RSA blind signature, which can be employed in either an adaptive or a nonadaptive manner. The authors claimed that their scheme can be applied to oblivious key searching. In 2005, three OT^𝑛_𝑘 schemes are proposed [16–18]. Among these, Chu and Tzeng's scheme [16] is the most efficient as it needs only 2 passes to send 1024 k bits from the chooser to the sender, and 1024^∗(𝑘+1)+𝑛^∗|Data| bits from the sender to the chooser, where Data is a message or ciphertext, and |Data| represents the bit length of Data. In 2006, Parakh [19] proposed an elliptic-curve-based algorithm allowing 𝐴 to obliviously transfer his secrecy, 𝑛_𝐴, to 𝐵 with a 50% probability of success. However, we found that 𝐴 can decide whether 𝐵 can obtain his secret 𝑛_𝐴 (which is one-to-one mapped to Pn_A) by first assuming that 𝑃_𝐴=𝑃_𝐵. Under this assumption, upon receiving {𝑛_𝐵𝑃_𝐵;𝑛_𝐵(𝑛_𝐴𝑃_𝐴)+𝑅;𝑛_𝐵𝑅} from B, A can obtain B’s one-time random variable 𝑅 by computing (𝑛_𝐵(𝑛_𝐴𝑃_𝐴)+𝑅)−𝑛_𝐴(𝑛_𝐵𝑃_𝐵). Then, by computing 𝑛_𝐴(𝑛_𝐵𝑅) = 𝑛_𝐵(𝑛_𝐴𝑅), A can obtain 𝑛_𝐵𝐾. Subsequently, by computing (𝑛_𝐴(𝑛_𝐵𝑅)+𝑃𝑛_𝐴)−𝑛_𝐵𝐾, A obtains 𝑍_𝐵, just as 𝐵 does in step 5(b). Therefore, if 𝐴 finds 𝑍_𝐵 = 𝑃𝑛_𝐴, it confirms that 𝐵 can obtain 𝑛_𝐴 after the protocol runs; otherwise, it knows 𝐵 cannot obtain the value of 𝑛_𝐴. This violates B’s privacy. In the same year, for coping with all possible attacks encountered in an open network, Kim and Lee [20] proposed two OT²₁ protocols, which are modified from Bellare-Micali noninteractive OT²₁ scheme [6] by appending the sender’s signature to make the sender undeniable about what he sent and be authentic to the chooser. However, we found, other than the weaknesses pointed by Chang and Shiao [21], Kohnfelder’s protocol still has the reblocking problem [22]. Because when modulus 𝑛_𝐴>𝑛_𝐵, message 𝑀_𝐴 cannot be recovered by Bob. This makes legal Alice unable to be authenticated by Bob.

In 2007, Halevi and Kalai [23] proposed another OT²₁ scheme by using smooth projective hashing and showed that the used RSA composite in their scheme need not be a product of safe primes. Also in 2007, Camenish et al. and Green and Hohenberger proposed two related OT schemes [24, 25], respectively. Both focus on the security of full simulatability for the sender and receiver to resist against selective-failure attack [7]. In 2009, Qin et al. [26] proposed two noninteractive OT^𝑛₁ schemes. However, in their protocols, a receiver has to interact with a third party to obtain the choice-related secret key each time it wants to select one of the 𝑛 sent message. This makes their scheme somewhat inconvenient and inconsistent with the meaning of noninteractive protocols as indicated in the title (this phenomenon can also be found in some proposed noninteractive OT schemes). In the same year, Chang and Lee [27] presented a robust OT^𝑛_𝑘 scheme using both the RSA blind signature and Chinese Remainder Theorem. However, we found their scheme fails since the sender can decide which parts of the messages were chosen by the chooser. We will describe this weakness in Section 3.2. In addition, in 2011, Ma et al. [28] proposed an oblivious transfer using a privacy scheme for a timed-release receiver. Their scheme has a good timed-release property. However, it needs to call ZKP 𝑘 times to learn k of the n sent messages. This makes their protocol less efficient. Moreover, it does not have mutual authentication. Therefore, when the sender and receiver want to communicate, they need a secure channel. Otherwise, without identity authentication, malicious attackers can simultaneously launch many ZKPs. This will degrade the system performance and may cause the system to suffer from a denial-of-service (DOS) attack (according to the definition in [29]).

After surveying all of the above-mentioned OT schemes, we found that almost all of them lack the consideration of adding security features. Only [2, 20] do consider the protection against all possible attacks. However, study [20] fails which we have described earlier. Hence, if we wish all of the proposed OT protocols, other than scheme [2], to be able to resist against various attacks, we should run them through secure channels. This would incur extra communicational overhead. For this reason, in this paper, we propose a novel interactive OT^𝑛_𝑘 scheme that needs only two passes but can get rid of using a secure channel to avoid adding extra communicational overhead. It not only is simple in concept but also encompasses some essential security features such as mutual authentication, the prevention of man-in-the-middle (MIMA) attack, and replay attack. Thus, when compared with other interactive OT schemes, our scheme promotes not only in the communicational efficiency but also in the aspect of security.

The rest of this paper is organized as follows. The introduction has been presented in Section 1, and some preliminaries are shown in Section 2. In Section 3, we review Chang et al.’s scheme and show its weakness. After that, we show our protocol in Section 4. Then, the security analyses and communicational cost comparisons among related works and our scheme are made in Section 5. Finally, a conclusion is given in Section 6.

2. Preliminaries

In this section, we briefly introduce the security features of our OT^𝑛_𝑘 scheme in Section 2.1, the principles of bilinear pairing in Section 2.2, and some intractable problems used in this paper in Section 2.3.

2.1. Security Features of Our 𝑂𝑇^𝑛_𝑘 Scheme

Just as traditional OT schemes, our OT^𝑛_𝑘 also has two parties, the sender 𝑆 and the chooser 𝐶. In the scheme, S obliviously transfers 𝑛 messages to C, and 𝐶 can choose 𝑘 messages among them without S’s knowledge about which k messages were selected, where 𝑛≥2 and 𝑘<𝑛. In addition, our scheme also possesses the following three security features which are needed in a traditional OT scheme.

(1) Correctness
After the protocol run, 𝐶 should be able to obtain the valid data chosen by him before.

(2) Chooser’s Privacy
In the protocol, each of the 𝑘 chooser’s choices should not be known to the sender or any third party. More precisely, each of the chooser’s encrypted choice can be any valid choice with equal probability, that is, for an encrypted choice 𝑦 and any valid choice x, Pr[𝑥∣𝑦]=Pr[𝑥]. This property is known as Shannon perfect secrecy.

(3) Sender’s Privacy
At end of the protocol run, the chooser cannot get any knowledge about the other messages it did not choose. More formally, the ciphertexts sent by the sender are semantically secure [30]. The chooser can obtain a plaintext decrypted from its ciphertext only if it has the key offered by the sender.

Except for the above three properties, our interactive OT^𝑛_𝑘 scheme also has the following three security features, (4) through (6), to guard against possible security threats.

(4) Impersonation Attack Resistance
Each party has to authenticate the counterpart. That is, it should be a mutual-authentication OT.

(5) Replaying Attack Resistance
An adversary could not obtain any messages by only replaying old messages sent by the sender.

(6) Man-in-the-Middle Attack (MIMA) Resistance
MIMA is an attack that an adversary eavesdropping on the communication line between two communicating parties uses as some means to make them believe that they each are talking to the intended party. But indeed, they are talking to the adversary.

2.2. Bilinear Pairing

Let 𝐺₁ be an additive group composed of points on an elliptic curve with order q, and let 𝐺₂ be a multiplicative group with the same order. A bilinear mapping is defined as 𝑒̂∶𝐺₁×𝐺₁→𝐺₂ which must satisfy the following properties [31].(1)Bilinear: a mapping 𝑒̂∶𝐺₁×𝐺₁→𝐺₂ is bilinear if 𝑒(̂𝑎𝑃,𝑏𝑄)=𝑒(̂𝑃,𝑄)^𝑎𝑏 for all 𝑃, 𝑄∈𝐺₁ and all 𝑎,𝑏∈𝑍^∗_𝑞.(2)Nondegenerate: the mapping does not map all pairs in 𝐺₁×𝐺₁ to the identity in 𝐺₂.(3)Computable: there is an efficient algorithm to compute 𝑒(̂𝑃,𝑄) for any 𝑃,𝑄∈𝐺₁.(4)If 𝑃 is a generator for 𝐺₁ then 𝑒(̂𝑃,𝑃) is a generator for 𝐺₂.(5)Commutative: for all 𝑃₁,𝑃₂∈𝐺₁,𝑒(̂𝑃₁,𝑃₂)=𝑒(̂𝑃₂,𝑃₁).(6)Distributive: for all 𝑃₁,𝑃₂,𝑃₃∈𝐺₁,𝑒(̂𝑃₁+𝑃₂,𝑃₃)=𝑒(̂𝑃₁,𝑃₃)𝑒(̂𝑃₂,𝑃₃).

2.3. Some Diffie-Hellman Problems

Let 𝑎,𝑏,𝑐,𝑔∈_𝑅𝑍^∗_𝑞, let P be a base point of a group on an Elliptic curve, and let 𝐺=⟨𝑔⟩, 𝐺₁=⟨𝑃⟩, and 𝐺₂=⟨𝑔(=𝑒(̂𝑃,𝑃))⟩  be three groups with each having a prime order 𝑞. Using these definitions, we describe some well-known intractable Diffie-Hellman problems [32] that will be used in this paper.

(1) The Computational Diffie-Hellman (CDH) Problem
In G, given (𝑔,𝑔^𝑎,𝑔^𝑏), finding the element 𝐶=𝑔^𝑎𝑏 mod q.

(2) The Decisional Diffie-Hellman (DDH) Problem
In G, given (𝑔,𝑔^𝑎,𝑔^𝑏,𝑔^𝑐), deciding whether 𝑐=𝑎𝑏 mod q.

(3) The Bilinear Computational Diffie-Hellman (BCDH) Problem
Given (𝑃,𝑎𝑃,𝑏𝑃,𝑐𝑃) in 𝐺₁, finding 𝑒(̂𝑃,𝑃)^𝑎𝑏𝑐 in 𝐺₂.
According to Boneh and Franklin’s study [31], the BCDH problem is no harder than the CDH problem in G (or equivalently 𝐺₂).

(4) Chosen-Target CDH (CTCDH) Problem
Let 𝐻∶{0,1}^∗→𝐺 be a hash function, let 𝑇(⋅) be a target oracle which returns a random element in G, and (⋅)^𝑐 a helper oracle which returns 𝑇(𝑗)^𝑐 when queried by 𝑇(𝑗), where 𝑐 is an unknown random integer in 𝑍^∗_𝑞. Also, let 𝑞_𝑡 be the number of queries to 𝑇(⋅) and 𝑞_ℎ the number of queries to (⋅)^𝑐. The CTCDH problem is finding 𝑙 pairs of (𝑗₁,𝑣₁),…,and(𝑗_𝑙,𝑣_𝑙), with each satisfying 𝑣_𝑖=(𝑇(𝑗_𝑖))^𝑐, for 1≤𝑖≤𝑙 and 𝑞_ℎ<𝑙≤𝑞_𝑡. Without loss of generality, we can let 𝑞_ℎ and 𝑞_𝑡 be 𝑙−1 and l, respectively. The CTCDH problem can then be rephrased as that after obtaining 𝑇(𝑗₁),…,𝑇(𝑗_𝑙) and (𝑗₁,𝑣₁),…,(𝑗_𝑙−1,𝑣_𝑙−1) via querying the 𝑇(⋅) oracle and the helper oracle (⋅)^𝑐 correspondingly, trying to find the lth pair (𝑗_𝑙,𝑣_𝑙) without the knowledge of c. The CTCDH problem is proposed and considered as a hard problem by Boldyreva in 2002 [33]. Its former version in RSA is proved by Bellare et al. in [34].

3. Review of Chang et al.’s Protocol

In 2009, Chang et al. proposed a robust OT^𝑛_𝑘 scheme based on CRT, hoping that their scheme can achieve the security requirements of a general OT^𝑛_𝑘 scheme. However, we found their scheme cannot satisfy the chooser’s privacy. In the following, we first review the scheme in Section 3.1 then show the weakness found in Section 3.2.

3.1. Review

We roughly describe the protocol by listing the relevant steps in the following (see [27] for more details).

Step 1. After receiving the request from Bob for all messages 𝑎₁,𝑎₂,…,𝑎_𝑛, Alice owning these 𝑛 messages selects 𝑛 relatively prime integers, 𝑑₁,𝑑₂,…,𝑑_𝑛, and computes D = 𝑑₁∗𝑑₂∗⋯∗𝑑_𝑛. She then constructs the congruence system 𝐶≡𝑎₁mod𝑑₁,𝐶≡𝑎₂mod𝑑₂,…,𝐶≡𝑎_𝑛mod𝑑_𝑛. (1)Furthermore, Alice computes the following values: 𝑇₁=𝑑^𝑒₁mod𝑁, 𝑇₂=𝑑^𝑒₂mod𝑁,…, and 𝑇_𝑛=𝑑^𝑒_𝑛mod𝑁, where 𝑁 be the product of two large primes and (𝑒,𝑑) be Alice public/private key pair satisfying 𝑒𝑑=1mod𝜑(𝑁), by using her public key 𝑒. Finally, she publishes 𝐶 and the 𝑛 pairs of (ID_𝑖,𝑇_𝑖), for 𝑖=1 to n, in the public board.

Step 2. If Bob wants to learn 𝑘 messages among them, he must select 𝑘 pairs of (ID^′_𝑗,𝑇^′_𝑗), for 𝑗=1 to k, from the public board and first generate 𝑘 corresponding random numbers 𝑟₁,𝑟₂,…,𝑟_𝑘, for each pair of (ID^′_𝑗,𝑇^′_𝑗). Then, he subsequently computes the following: 𝛼₁=𝑟^𝑒₁∗𝑇^′₁mod𝑁,𝛼₂=𝑟^𝑒₂∗𝑇^′₂,mod𝑁,…,𝛼_𝑘=𝑟^𝑒_𝑘∗𝑇^′_𝑘mod𝑁, (2) by using Alice’s public key 𝑒 and sends {𝛼₁,𝛼₂,…,𝛼_𝑘} back to Alice.

Step 3. Upon receiving the messages sent by Bob, Alice employs her private key 𝑑 to compute 𝛽₁=𝛼^𝑑₁=𝑟₁𝑇₁^′𝑑=𝑟₁𝑑^′₁mod𝑁, 𝛽₂=𝛼^𝑑₂=𝑟₂𝑇₂^′𝑑=𝑟₂𝑑^′₂mod𝑁,…,𝛽_𝑘=𝛼^𝑑_𝑘=𝑟_𝑘𝑇_𝑘^′𝑑=𝑟_𝑘𝑑^′_𝑘mod𝑁 and then sends the results {𝛽₁,𝛽₂,…,𝛽_𝑘} to Bob.

Step 4. After receiving the messages from Alice, Bob computes the following values: 𝑑^′₁=𝑟₁⁻¹∗𝛽₁mod𝑁,𝑑^′₂=𝑟₂⁻¹∗𝛽₂mod𝑁,𝑑^′_𝑘=𝑟_𝑘⁻¹∗𝛽_𝑘mod𝑁. Consequently, Bob learns the demanded messages successfully by computing 𝑏₁=𝐶mod𝑑^′₁,𝑏₂=𝐶mod𝑑^′₂𝑏,…,_𝑘=𝐶mod𝑑^′_𝑘. (3)

3.2. Weaknesses

Although Chang et al. claimed that their scheme can satisfy the security requirements demanded by the OT^𝑛_𝑘 scheme, we found that Bob’s privacy has been violated, since according to their protocol, Alice first sets 𝑛 values of 𝑑_𝑖 (𝑖=1 to n), and Bob commits his 𝑘 choices to the 𝑘 values of 𝛼_𝑗(𝑗=1 to k). After computing the 𝑘 values of 𝛽_𝑗 (=1 to k), Alice can use each of the 𝑑_𝑖⁻¹𝑠 (𝑖=1 to n) to compute 𝑟_𝑗𝑖 = 𝛽_𝑗∗𝑑_𝑖⁻¹, for 𝑗=1 to 𝑘 and 𝑖=1 to 𝑛. In addition, using each 𝑟_𝑗𝑖, Alice can compute the 𝑛 values of 𝛼_𝑖^(*) = (𝑟_𝑗𝑖∗𝑑_𝑖)^𝑒, for i = 1 to n, to compare with the 𝑘 committed values, 𝛼_𝑗. For example, suppose Bob chooses the first message, 𝑇₁=𝑑₁^𝑒 mod N, and Alice wants to guess which 𝑇_𝑖 Bob chose, Alice starts to use 𝑑₁⁻¹ to compute 𝑟₁₁ = 𝛽₁∗𝑑₁⁻¹ mod 𝑁=𝛼₁^𝑑(=𝑟₁∗𝑑₁)∗𝑑₁⁻¹mod𝑁=𝑟₁mod𝑁. He will get 𝛼₁^(∗)=(𝑟₁₁∗𝑑₁)^𝑒 mod 𝑁=𝛼₁ = 𝑟^𝑒₁∗𝑇₁. That is, Alice will find a match, 𝛼₁, and knows that Bob chose the first message. Conversely, if Alice uses 𝑑_𝑖⁻¹, (𝑖=2,𝑛) to compute 𝑟_1𝑖=𝛽₁∗𝑑_𝑖⁻¹, he will get 𝛼_𝑖^(*) = (𝑟_1𝑖∗𝑑_𝑖)^𝑒 mod N, which is not equal to 𝛼₁. In other words, Alice cannot know the correct message 𝑇₁ that Bob chose. That is, once a pair, (𝛼_𝑖^(∗), 𝛼_𝑖), for example, has been matched, Alice knows that Bob chose the 𝑖th message. Hence, we can easily see that such explorations cost at most 𝑛∗𝑘 multiplications to obtain 𝑟_𝑗𝑖, and 𝑛²∗𝑘 multiplications and 𝑛²∗𝑘 exponentiations to yield all values of 𝛼_𝑖^(*). Therefore, with at most (𝑛²∗𝑘+𝑛∗𝑘) multiplications and 𝑛²∗𝑘 exponentiations, it is computationally feasible for Alice to decide which 𝑘 values Bob selected, which violates Bob’s privacy.

4. Proposed Protocol

In this section, we present our ID-based OT^𝑛_𝑘 protocol based on bilinear pairings, which were proved and applied to cryptography by Boneh and Franklin in 2001 [31]. Our scheme consists of two phases: (1) an initialization phase and (2) an oblivious transfer phase. In the following, we first describe these two phases. Then, to demonstrate the chooser’s privacy preservation, we use a misleading attack for an explanation. As the receiver’s privacy preservation can be reasoned in a similar fashion, we omit its description here.

(1) Initialization Phase
In this phase, we adopt the same system parameters as the ones used in [31]. In addition, there also exists a trusted key generation center (KGC) which is assumed to be key-escrow-attack free. Initially, KGC chooses an additive group 𝐺₁=⟨𝑃⟩ of order q, a multiplicative group 𝐺₂=⟨𝑒(̂𝑃,𝑃)⟩ of the same order, where 𝑒̂ is a bilinear mapping, that is, 𝑒̂∶𝐺₁×𝐺₁→𝐺₂, and three one-way hash functions: H: {0,1}^∗→{0,1}^𝑙, 𝐻₂∶𝐺₁→{0,1}^𝑙, and 𝐻₁ which maps a string (a user’s ID) to an element in 𝐺₁, that is, 𝐻₁:{0,1}^∗→𝐺₁. Moreover, it selects 𝑠∈𝑍^∗_𝑞 as its private master key and computes the corresponding system public key as𝑃_pub=𝑠𝑃. Then, KGC publishes the system parameter set {𝐺₁,𝐺₂,𝑞,𝑒,̂𝑃,𝑃_pub,𝐻,𝐻₁,𝐻₂}. After that, when a user 𝑈 (sender/chooser) registers his identifier 𝐼𝐷_𝑈, KGC will compute a public/private key pair 𝑈_pub/𝑈_priv for him, where 𝑈_pub= 𝐻₁(𝐼𝐷_𝑈) and 𝑈_priv = 𝑠𝑈_pub.

(2) Oblivious Transfer Phase
In this phase, when a sender possessing 𝑛 messages (𝑚₁,𝑚₂,…, and 𝑚_𝑛) wants to obliviously transfer 𝑘 messages of them (𝑚_𝜎1,𝑚_𝜎2,…,and 𝑚_𝜎𝑘) to a chooser, they together will execute the following steps, where the public/private key pairs of the sender and chooser are 𝑆_pub/𝑆_priv and 𝐶_pub/𝐶_priv, respectively, and {𝜎₁,𝜎₂,…,𝜎_𝑘}⊂{1,2,…,𝑛} are the set of 𝑘 choices selected by the chooser in advance. We also depict them in Table 1.

Table 1 

The proposed k-out-of-n authentic OT protocol.

Step 1. The chooser randomly chooses two integers a, b ∈𝑍^∗_𝑞 and computes 𝑉=𝑎𝑏𝐶_pub, 𝑉_𝑗=𝑏𝐻(𝜎_𝑗)𝐶_priv, where 𝑗=1,2,…,𝑘 and 𝑉_𝑗 are the 𝑘 random choices. After that, he generates a signature Sig on 𝑉 by computing ℎ=𝐻₂(𝑉) and Sig=ℎ𝐶_priv. Then, he sends ID_𝑐,𝑉,𝑉₁,…,𝑉_𝑘 together with Sig to the sender.

Step 2. After receiving ID𝑐,𝑉,𝑉₁,…,𝑉_𝑘 and Sig from the chooser, the sender computes ℎ=𝐻₂(𝑉) and verifies the chooser’s signature by checking whether the equation 𝑒(̂𝑃,Sig)= 𝑒(̂𝑃_pub,ℎ𝐶_pub) holds. If it holds, he believes that the chooser is the intended party as claimed. Then, the sender randomly chooses an integer 𝑐∈𝑍^∗_𝑞 and computes 𝑈_𝑗=𝑐𝑉_𝑗 and 𝑐𝑡_𝑖=𝑚_𝑖⊕𝑒(̂𝐻(𝑖)𝑉,𝑆_priv)^𝑐, where 𝑗=1,…,𝑘,𝑖=1,…,𝑛, and 𝑚_𝑖 are the 𝑛 messages. He/She then sends 𝑈₁,…,𝑈_𝑘,𝑐𝑡₁,…,and𝑐𝑡_𝑛 to the chooser.

Step 3. After receiving the message 𝑈₁,…,𝑈_𝑘,𝑐𝑡₁,…,  and 𝑐𝑡_𝑛 from the sender, the chooser can obtain the k intended messages by at most computing the equation, 𝑚_𝜎𝑗=𝑐𝑡_𝜎𝑗⊕𝑒(̂𝑈_𝑗,𝑆_pub)^𝑎,𝑛𝑘−⋅(𝑘(𝑘−1)/2)(=𝑛+(𝑛−1)+⋯+(𝑛−(𝑘−1))) times.

(3) A Misleading Attack for Chooser’s Privacy Preservation
To demonstrate the chooser’s privacy more clearly, we take the following as a counterexample. According to step 1 in our protocol, the chooser computes 𝑉₁,…,𝑉_𝑘, where 𝑉_𝑗=𝑏𝐻(𝜎_𝑗)𝐶_priv and j = 1 to 𝑘. Since 𝑏 and 𝐶_priv are both the same for 𝑉_𝑖 and 𝑉_𝑗, a misleading attack may be that 𝑉_𝑖/𝑉_𝑗=𝐻(𝜎_𝑖)/𝐻(𝜎_𝑗). A malicious sender can pre-compute 𝐻(𝜎_𝑖)/𝐻(𝜎_𝑗) for each  𝑖,𝑗 in the interval [1,𝑛]. After receiving 𝑉₁,…,𝑉_𝑘 from the chooser, he computes each 𝑉_𝑖/𝑉_𝑗 for all 𝑖,𝑗 in [1,𝑘] for a comparison with the precomputed values. Consequently, the sender may guess some or all of the chooser’s choices. Therefore, the protocol cannot achieve chooser privacy. However, the mistake here is that both 𝑉_𝑖  and 𝑉_𝑗 are points in the additive group 𝐺₁. The division operation 𝑉_𝑖/𝑉_𝑗 is invalid because 𝐺₁ is an additive group.

5. Security Analysis

In this section, we use the following claims to show that our protocol not only is correct but also possesses the properties of mutual authentication, chooser’s privacy, and sender’s privacy and can resist against active attacks such as relay attack, man-in-the-middle attack, and denial of service attack.

Claim 1. The proposed protocol is correct.

Proof. After the protocol runs, the chooser can exactly obtain the 𝑘 messages which he/she selected by computing 𝑐𝑡_𝜎𝑗⊕𝑒̂𝑈_𝑗,𝑆_pub^𝑎=𝑐𝑡_𝜎𝑗⊕𝑒̂𝑐𝑏𝐻𝜎_𝑗𝐶_priv,𝑆_pub^𝑎=𝑐𝑡_𝜎𝑗⊕𝑒̂𝐻𝜎_𝑗𝑏𝑐𝑠𝐶_pub,𝑆_pub^𝑎=𝑐𝑡_𝜎𝑗⊕𝑒̂𝐻𝜎_𝑗𝑎𝑏𝐶_pub,𝑠𝑆_pub^𝑐=𝑐𝑡_𝜎𝑗⊕𝑒̂𝐻𝜎_𝑗𝑉,𝑆_priv^𝑐=𝑚_𝜎𝑗. (4)

Claim 2. The proposed protocol can achieve mutual authentication.

Proof. We show the holdness of this claim by using the following two reasons.
(1)Apparently, it can be easily seen that the sender can authenticate the chooser by verifying the chooser’s signature, Sig (as described in step 2 of the oblivious transfer phase).(2)For that the ciphertext 𝑐𝑡_𝑖(=𝑚_𝑖⊕𝑒(̂𝐻(𝑖)𝑉,𝑆_priv)^𝑐) contains the sender’s private key 𝑆_priv(=𝑠𝑆_pub), the chooser can compute the meaningful message 𝑚_𝜎𝑗 only via using the sender’s public key 𝑆_pub (also refer to the equation in claim 1). This means that only the true sender can produce the right 𝑐𝑡_𝑖 and thus can be authenticated by the chooser using his public key.

Claim 3. The proposed protocol can achieve the chooser’s privacy.

Proof. Due to the fact that each of the chooser’s 𝑘 choices 𝜎_𝑗∈{1,2,…,𝑛} are first hashed and randomized by 𝐻 and 𝑏 respectively, and then signed as 𝑉_𝑗=𝑏𝐻(𝜎_𝑗)𝐶_priv by chooser 𝐶 in step 1, where 𝑏 is a random number. We argue that nobody except for the chooser can know the choice 𝜎_𝑗. Because even an attacker might steal the chooser’s private key 𝐶_priv, he/she cannot obtain 𝑏𝐻(𝜎_𝑗) from 𝑉_𝑗 owing to the hardness of ECDLP. That is, he cannot figure out 𝑏𝐻(𝜎_𝑗), and therefore not to mention 𝜎_𝑗. More formally, let 𝒜={(𝑏,𝜎_𝑗)∈𝑍_𝑞∗𝑍_𝑛∣𝑏𝐻(𝜎_𝑗)𝐶_priv=𝑉_𝑗}; that is, 𝒜 consists of all the possible ordered pairs (𝑏,𝜎_𝑗) satisfying the equation 𝑏𝐻(𝜎_𝑗)𝐶_priv=𝑉_𝑗. If we are given a value 𝑉_𝑗, then under fixed 𝐶_priv, there only exists a unique value 𝑏𝐻(𝜎_𝑗) satisfying the equation. And for a given 𝑏𝐻(𝜎_𝑗), under the definition of a collision-free one-way hash function, once 𝜎_𝑗 has been determined, the value of 𝑏 is determined as well. That is, the relationship between 𝑏 and 𝜎_𝑗 is one-to-one. Having this observation in mind and the dimension of 𝜎_𝑗 is n, we can see that there are 𝑛(𝑏,𝜎_𝑗) pairs in 𝒜. In other words, Pr [𝜎_𝑗∣𝑉_𝑗] = Pr [𝜎_𝑗] = 1/𝑛 which means that, under seeing a specific 𝑉_𝑗, the choice 𝜎_𝑗 of the chooser cannot be revealed other than guessing. This achieves the Shannon perfect secrecy. Therefore, the proposed protocol possesses chooser’s privacy.

Claim 4. The proposed scheme can achieve the sender’s privacy.

Proof. Assume that malicious chooser 𝐶 wants to obtain more than 𝑘 messages in the protocol. If he/she could succeed, then, the sender’s privacy is violated (see Section 2.1). However, we will prove that, other than his k chosen messages, it is computationally infeasible for 𝐶 to obtain the (𝑘+1)th message by using the following two arguments, (I) and (II). In argument (I), we show why 𝐶 must follow the protocol to form the values of 𝑉 and 𝑘𝑉_𝑗𝑠; otherwise, he/she cannot obtain the 𝑘 chosen messages. In argument (II), we show that if 𝐶 intends to obtain the (𝑘+1)th message, he/she will face the intractable CTCDH problem under the assumption that 𝐻(⋅) is a random hash function.

Argument (I)
𝐶must follow the protocol to form the values of 𝑉(=𝑎𝑏𝐶_pub) and 𝑉_𝑗(=𝑏𝐻(𝜎_𝑗)𝐶_priv), for 𝑗=1 to k; otherwise, he cannot obtain the 𝑘 chosen messages, 𝑚_𝜎1,…,𝑚_𝜎𝑗.
In the following, we further divide this argument into three cases: (a) 𝐶fakes 𝑉 but forms 𝑉_𝑗 honestly, (b) 𝐶 fakes 𝑉_𝑗 but forms 𝑉 honestly, and (c) 𝐶 fakes both the values of 𝑉 and 𝑉_𝑗. (For each case’s explanation, refer to Table 1.)
(a)𝐶 fakes 𝑉 but forms 𝑉_𝑗 honestly. Assume that 𝐶 is dishonest in forming 𝑉 but forms 𝑉_𝑗 honestly as specified in the protocol. For example, without loss of generality, it replaces 𝑉 with a specific 𝑋∈𝐺₁ and computes 𝑉_𝑗=𝑏𝐻(𝜎_𝑗)𝐶_priv. Then, the sender will compute 𝑈_𝑗=𝑐𝑉_𝑗, 𝑐𝑡_𝑖=𝑚_𝑖⊕𝑒(̂𝐻(𝑖)𝑋,𝑆_priv)^𝑐 and send them back to 𝐶. As a result, 𝐶 cannot decrypt 𝑐𝑡_𝜎𝑗(𝑐𝑡_𝜎𝑗=𝑚_𝜎𝑗⊕𝑒(̂𝑈_𝑗,𝑆_pub)^𝑎) to obtain the 𝑘 messages since 𝑒(̂𝑈_𝑗,𝑆_pub)^𝑎 is obviously not equal to 𝑒(̂𝐻(𝜎_𝑗)𝑋,𝑆_priv)^𝑐 (refer to claim 1). Perhaps, for obtaining the 𝑘 messages, 𝐶 may try another way by computing 𝑒(̂𝐻(𝑖)𝑋,𝑆_priv)^𝑐 expected to be equal to 𝑒(̂𝑈_𝑗,𝑆_pub)^𝑎. But this is computationally infeasible since 𝐶 does not know both the sender’s private key 𝑆_priv and the one-time secrecy 𝑐. To extract 𝑐 from 𝑈_𝑗 is an ECDLP.(b)𝐶 fakes 𝑉_𝑗𝑠 but forms 𝑉 honestly. Assume that 𝐶 is dishonest in forming 𝑉_𝑗𝑠 but forms 𝑉 in the same manner as specified in the protocol. For example, without loss of generality, he replaces each 𝑉_𝑗 with a specified 𝑋_𝑗∈𝐺₁ and computes 𝑉=𝑎𝑏𝐶_pub. Then, the sender will compute 𝑈_𝑗=𝑐𝑉_𝑗=𝑐𝑋_𝑗,𝑐𝑡_𝑖=𝑚_𝑖⊕𝑒(̂𝐻(𝑖)𝑉,𝑆_priv)^𝑐=𝑚_𝑖⊕𝑒(̂𝐻(𝑖)𝑎𝑏𝐶_pub,𝑆_priv)^𝑐, for 𝑖=1 to n, and send them back to 𝐶. As a result, 𝐶 cannot decrypt 𝑐𝑡_𝜎𝑗 since 𝑒(̂𝑈_𝑗,𝑆_pub)^𝑎=𝑒̂(𝑐𝑋_𝑗,𝑆_pub)^𝑎 is obviously not equal to 𝑒(̂𝐻(𝑖)𝑉,𝑆_priv)^𝑐. Perhaps, for obtaining the 𝑘 messages, 𝐶 may try another way by computing 𝑒(̂𝐻(𝑖)𝑉,𝑆_priv)^𝑐(=𝑒(̂𝐻(𝑖)𝑎𝑏𝐶_pub,𝑆_priv)^𝑐) expected to be equal to (𝑈_𝑗,𝑆_pub)^𝑎. But again this is computationally infeasible since 𝐶 does not know both the sender’s private key 𝑆_priv and the one-time secrecy 𝑐. Even he knows 𝑆_priv, extracting 𝑐 from 𝑈_𝑗(=𝑐𝑋_𝑗) is an ECDLP. Hence, 𝐶 cannot compute the value 𝑒(̂𝐻(𝑖)𝑉,𝑆_priv)^𝑐 to decrypt 𝑐𝑡_𝜎𝑗 for obtaining the 𝑘 messages, 𝑚_𝜎𝑗.(c)𝐶 fakes both the values of 𝑉 and 𝑉_𝑗. Without loss of generality, we assume that 𝐶 replaces 𝑉 with 𝑋 and also fakes 𝑉_𝑗 as H(𝜎_𝑗)X. Under this construction, the value of 𝑈_𝑗 computed by the sender would be 𝑈_𝑗=𝑐𝑉_𝑗=𝑐𝐻(𝜎_𝑗)𝑋 and the ciphertexts 𝑐𝑡_𝜎𝑗 would be 𝑚_𝜎𝑗⊕𝑒(̂𝐻(𝜎_𝑗)𝑋,𝑆_priv)^𝑐, for 𝑗=1 to k, or equivalently, 𝑐𝑡_𝜎𝑗=𝑚_𝜎𝑗⊕𝑒(̂𝑐𝐻(𝜎_𝑗)𝑋,𝑆_priv). Although, 𝐶 knows the value of 𝑐𝐻(𝜎_𝑗)𝑋 (since it just equals to 𝑈_𝑗 received from the sender), it still cannot compute 𝑒(̂𝑐𝐻(𝜎_𝑗)𝑋,𝑆_priv) without the knowledge of 𝑆_priv. From above description, we know that when the setting of 𝑉 is 𝑋 and 𝑉_𝑗 is 𝐻(𝜎_𝑗)𝑋, 𝐶 cannot obtain 𝑚_𝜎𝑗. Not to mention, 𝐶 might set 𝑉_𝑗 as 𝐻(𝜎_𝑗)𝑌, where 𝑌(≠𝑋) is a random chosen element in 𝐺₁. In summary, 𝐶 cannot obtain the 𝑘 selected messages under the violation of setting both the values, 𝑉 and 𝑉_𝑗.

Argument (II)
If 𝐶 follows the protocol honestly to obtain 𝑘 messages, but intends to extract the (𝑘+1)th message then it will face the intractable CTCDH problem under the assumption that 𝐻(⋅) is a random hash function.
That 𝐶 wants to obtain message 𝑚_𝑖 implies 𝐶 would have the knowledge of 𝑒(̂𝐻(𝑖)𝑉,𝑆_priv)^𝑐(=𝑒(̂𝑈_𝑗,𝑆_pub)^𝑎) (in fact, according to argument (I), an honest chooser 𝐶 could know 𝑘 of the 𝑛 values, 𝑒(̂𝐻(𝑖)𝑉,𝑆_priv)^𝑐, for 𝑖=1 to 𝑛, since 𝑒(̂𝐻(𝑖)𝑉,𝑆_priv)^𝑐 = 𝑒(̂𝑈_𝑗,𝑆_pub)^𝑎, for 𝑖=𝜎_𝑗 and 𝑗=1 to k). Let 𝑦^(𝑖)∈𝐺₂ and 𝑒(̂𝐻(𝑖)𝑉,𝑆_priv)^𝑐=𝑦^(𝑖). According to argument (I), for obtaining the 𝑘 chosen messages, 𝐶 cannot change the structures of 𝑉(=𝑎𝑏𝐶_pub) and 𝑉_𝑗(=𝑏𝐻(𝜎_𝑗)𝐶_priv). Under this situation, 𝑦^(𝑖) only can be decomposed as 𝑦^(𝑖)=𝑒(̂𝐻(𝑖)𝑎𝑏𝐶_pub,𝑆_priv)^𝑐=𝑒(̂𝑎𝑏𝐻(𝑖)𝐶_priv,𝑆_pub)^𝑐 since 𝑆_priv=𝑠𝑆_pub and 𝐶_priv=𝑠𝐶_pub. Moreover, under the assumption that 𝐻(⋅) is a random hash function and the fact that 𝐶 has the knowledge of 𝑎,𝑏,𝐶_priv, and 𝑆_pub, 𝑦^(𝑖) can be represented as (𝑔_𝑖)^𝑐, where 𝑔_𝑖 equals to 𝑒(̂𝑎𝑏𝐻(𝑖)𝐶_priv,𝑆_pub) and is a random element in 𝐺₂ due to the assumption that 𝐻(⋅) is a random hash function. Consequently, the problem 𝐶 really faces is finding the (𝑘+1)th pair (𝜎_𝑘+1,(𝑔_𝜎𝑘+1)^𝑐) with the knowledge of 𝑘 pairs of (𝜎₁,(𝑔_𝜎1)^𝑐), (𝜎₂,(𝑔_𝜎2)^𝑐),…, and (𝜎_𝑘, (𝑔_𝜎𝑘)^𝑐), where (𝑔_𝜎𝑗)^𝑐=𝑒(̂𝑈_𝑗,𝑆_pub)^𝑎, but without the knowledge of sender’s one-time secrecy c (since it is an ECDLP for extracting 𝑐 from 𝑈_𝑗(=𝑐𝑉_𝑗)). This is known as the intractable CTCDH problem introduced in Section 2.3 by letting 𝑘=(𝑙−1). Therefore, the chooser cannot obtain the (𝑘+1)th message.
According to arguments I and II, we have proven claim 4 that our scheme has the sender’s privacy.

Claim 5. The proposed scheme can resist against replay attack.

Proof. Suppose that an adversary intercepts a chooser’s OT request (containing ID_𝐶,𝑉,𝑉_𝑗, and Sig) and replays it later. After receiving the sender’s new response (𝑈₁,…,𝑈_𝑘, 𝑐𝑡₁,…,𝑐𝑡_𝑛) computed from the replayed 𝑉 and 𝑉_𝑗, the adversary cannot obtain the 𝑘 selected messages by computing 𝑚_𝜎𝑗=𝑐𝑡_𝜎𝑗⊕𝑒(̂𝑈_𝑗,𝑆_pub)^𝑎 since he/she does not know the value of 𝑎 embedded in the replayed message 𝑉. It is computationally infeasible for the adversary to extract 𝑎 from 𝑉=𝑎𝑏𝐶_pub, due to the hardness of ECDLP.

Claim 6. The proposed scheme can resist against man-in-the-middle attack (MIMA).

Proof. MIMA is an attack that an adversary 𝐸 intercepts the communication line between two communicating parties and uses some means to make them believe that they each are talking to the intended party as claimed. But indeed, they are talking to 𝐸. Figure 1 illustrates the scenario of such a MIMA. We first argue that the adversary 𝐸 cannot succeed in this scenario since it cannot generate the valid message (2), (ID_𝐶,𝑉^′,𝑉^′₁,…,𝑉^′_𝑘, Sig′) as shown in the figure. More clearly, without the knowledge of chooser’s private key 𝐶_priv, he/she cannot forge a valid signature Sig′ in message (2) to be successfully verified by the sender since Sig′ should be equal to 𝐻₂(𝑉)𝐶_priv. In addition, it is also hard for 𝐸 to forge valid message (4), (𝑈^′₁,…,𝑈^′_𝑘,𝑐𝑡^′₁,…,𝑐𝑡^′_𝑛), to be accepted by the chooser. Since that for embedding a meaningful 𝑚^′_𝑖 into 𝑐𝑡^′_𝑖, E must have the knowledge of 𝑒(̂𝐻(𝑖)𝑉,𝑆_priv)^𝑐. Although E can choose another random nonce 𝑐′ such that 𝑈^′_𝑗=𝑐′𝑉_𝑗, it still has to know the sender’s private key 𝑆_priv to form the valid 𝑐𝑡^′_𝑖(=𝑚_𝑖⊕𝑒(̂𝐻(𝑖)𝑉,𝑆_priv)^𝑐′). Therefore, without the knowledge of 𝑆_priv, E cannot launch such a MIMA attack.

Figure 1 

The scenario of MIMA attack.

Claim 7. The proposed scheme can resist a denial of service attack (DOS).

Proof. Our protocol has a built-in mutual authentication property; thus, it can prevent this kind of attack, as the sender needs only one hash and two bilinear pairing computations to authenticate the chooser in step (2). Once the sender finds that the authenticating equation 𝑒(̂𝑃,Sig)=𝑒(̂𝑃_pub,ℎ𝐶_pub) does not hold, it aborts the procedure.

5.1. Communicational Cost Comparisons

Generally, the communicational cost of a protocol run consists of three factors: (1) needed passes, (2) computational overhead, and (3) needed transmission data size (NTDS) or bandwidth consumption. It is well known that factor (1) is always dominant over factor (2). Hence, in this section, we focus only on factor (1) and (3) to demonstrate the communication cost comparisons among our nonadaptive OT^𝑛_𝑘 protocol and the other same type OT^𝑛_𝑘 protocols, such as Chu and Tzeng’s [16] (which is to our best knowledge, the most efficient OT^𝑛_𝑘 scheme up to date), Mu et al.’s [13], Naor and Pinkas’s [7], and recent works [17, 18, 24, 27]. From factor (1), our scheme is the most efficient since it only requires two passes. As to factor (3), the data size transmitted in our scheme is also the minimal among such type of OT^𝑛_𝑘 schemes. For demonstrating this in the following, we will first describe two underlying facts and used notations for making comparisons about factor (3).

Generally speaking, we have the following two facts for cryptosystems.

Fact 1. To the same security level, a RSA cryptosystem would require a key length of 1024 bits while an ECC-based cryptosystem only needs 160 bits.

Fact 2. The length of the ciphertexts for RSA, ElGamal, and ECC-based cryptosystems is 1024 bits, 1024 bits, and 160 bits, correspondingly.

Notations
We use |string/action| to represent the bit length of a string, or the required bit length that an action performs.

After the description of used facts and notations, we now use them to estimate the needed transmission data size (NTDS) of our scheme and the above-mentioned OT^𝑛_𝑘 protocols. In our scheme, each of the variables 𝑉,𝑉₁,…,𝑉_𝑘,Sig,𝑈₁,…,𝑈_𝑘 transmitted between the chooser and sender is an ECC point. Thus, the NTDS from the chooser to the sender is estimated as 160∗(𝑘+2) bits and from the sender to the chooser is 160𝑘+𝑛∗|ciphertext| bits. Naor and Pinkas’s scheme [7] constructs their OT^𝑛_𝑘 scheme by evoking an OT²₁ primitive log𝑛 times. Thus, the needed number of passes is log𝑛 times the number of passes required in one of their OT²₁’s protocol run and likewise the NTDS is aboutlog𝑛 times of the NTDS that an OT²₁’s work demands. Therefore, their scheme has the most expensive communicational cost. As for Camenisch et al.’s protocol [24], the communicational cost is expensive as well due to the complexity of the protocol. In their protocol, the sender first sends 𝑛 commitments to the chooser, and then the sender and the chooser together run a proof-of-knowledge (Pok) subprotocol for assuring the correctness of the commitments. If the proof is valid, the sender sends 𝑛 ciphertexts to the chooser, and the chooser then runs the BlindExtract subprotocol 𝑘 times with the help of the sender to extract the blind choices to decrypt the ciphertexts.

Consequently, the number of passes for executing protocol [24] is 2+𝑘∗Pok, where Pok represents the required passes for executing the proof-of-knowledge subprotocol. Besides, the NTDS from chooser to sender is estimated as |Pok|+𝑘∗|BlindExtract| and from sender to chooser is 𝑛∗|ciphertext|+|Pok|+𝑘∗|BlindExtract|. Similarly, the passes and NTDS of other studies can be estimated in the same manner. We show the comparison results in Table 2.

Table 2 

Needed rounds and data size comparisons among OT^𝑛_𝑘 protocols.

From Table 2, we can see that our scheme not only possesses the mutual authentication function but also is the most efficient in both needed passes and NTDS among these related. Therefore, our scheme can be gracefully used when applied in commercial applications (e.g., Kerschbaum et al.’s method [1] used OT scheme as a building block in constructing RFID benchmarking protocols).

6. Conclusion

An OT scheme which is secure and efficient in communicational cost is essential and eager for commercial applications. After reviewing most of the OT schemes, we found that, other than considering the protocol’s correctness and privacy of both communication parties, almost all of them lack the security services, such as mutual authentication, and the prevention of replay, DOS, and main-in-the-middle attacks. Hence, they should run under a secure channel when applied in commercial applications. This will increase execution overhead. Therefore, to get rid of using the secure channel (for improving the communicational efficiency in some applications, such as mental poker playing, oblivious key searching), we propose a novel k-out-of-n oblivious transfer protocol by combining an OT scheme with a security mechanism based on bilinear pairing. We have proved that our scheme not only is correct but also possesses the properties of mutual authentication, the sender’s privacy, and the chooser’s privacy and can resist against replay and MIMA attacks. Further, we have compared our scheme with other nonadaptive k-out-of-n OT schemes in the aspects of needed passes, NTDS, and the function of mutual authentication and shown the result in Table 2. From Table 2, we can see that our scheme is the most efficient in communicational cost (including needed passes and NTDS). In addition, to our knowledge, it is the only OT^𝑛_𝑘 scheme that has successfully integrated the function of mutual authentication nowadays.