UC-secure OT ⇒ OT

Fully-black-box reduction · standard model · folklore · security loss: none

Statement

A protocol that UC-realizes ${\mathcal{F}}_{\mathrm{OT}}$ in the common reference string model has sender privacy and receiver privacy with the same reference string, so it is a semi-honest OT — folklore. The privacy games let the adversary choose the inputs after seeing $\mathsf{pp}$, and a UC environment can do the same, because it learns the reference string through the adversary.

Sketch

Receiver privacy: the environment runs a corrupted sender honestly, and its view is simulated without $c$. Sender privacy: by correctness an honestly behaving receiver’s view determines $x_c$, while the simulator learns only $x_{c^{\ast }}$ for the choice $c^{\ast }$ it extracts, so $c^{\ast }=c$ except with negligible probability and the view is simulated from $x_c$ alone — standard.

Notes

• The same extraction argument shows that stand-alone malicious security gives semi-honest OT for protocols in the plain model — folklore.
• UC security also implies stand-alone malicious security (UC-secure OT ⇒ malicious OT) — Can01.