# Universally Composable Oblivious Transfer with Low Communication
## 1 Introduction  
With the continuous updating and iteration of secure multi-party computation (MPC), many secure multi-party applications have been recently developed and used. For example, Cheetah [1], a new research achievement of [PERSON], is a secure two-party computing framework that can improve the performance of MPC. It has been used in the risk control field. In addition, many companies and institutes also participate in designing and developing privacy computing platforms [2; 3], such as the morse secure computing platform developed by Fu-min bank. Secure multi-party computation is not an independent technology. However, it includes many fundamental primitives such as secret sharing [4], homomorphic encryption [5], zero-knowledge proof [6], and bit commitment [7], as well as many secure multi-party applications based on the primitives above, such as private set insertion [8], private information retrieval, and secret geometry computing [9]. Besides, all of the efficient MPC applications are based on OT or OT extension. Thus, efficient OT protocols with low communication costs are the focus and difficulty in MPC research. Oblivious transfer [10], an essential and fundamental primitive of MPC, was first proposed by [PERSON] in 1981. There are two participants in the OT protocol: the sender ([PERSON]) and receiver ([PERSON]). [PERSON] sends [PERSON] a message, and [PERSON] has a \(1/2\) probability of receiving this message. Besides, [PERSON] does not know whether [PERSON] has received the message. In 1995, [PERSON] proposed a random 1-out-of-2 oblivious transfer [11] based on public-key cryptography, where the receiver can obtain only one of the two messages from the sender randomly. In 1986, [PERSON] expanded 1-out-of-2 OT to 1-out-of-N OT [12] to improve the efficiency of the OT protocol. [PERSON] proposed a k-out-of-n OT protocol [13] based on the DDH (decisional Diffie-Hellman) difficult problem. It allows the receiver to obtain k of n messages from the sender to make the OT protocol more efficient and practical. The OT protocol is the bottleneck of the efficiency and communication of the MPC because of its importance. In 2001, [PERSON] and [PERSON] proposed an efficient two-round 1-out-of-N OT protocol [14] based on the Diffie-Hellman difficult problem. However, it can obtain half-simulation security and construct a simulator for one party in the ideal environment. In 2008, [PERSON] proposed an attack method against MPC protocols [15] in the half-simulation paradigm, proving that OT protocols with half-simulation securitycannot be used sequentially in combination with other protocols. Hence, the OT protocol is required to prove its security in a fully simulation-based paradigm, where the simulator can be constructed in any corruption case. In 2008, [PERSON] proposed an OT protocol [16] with full-simulation security based on the cut-and-choose technology. In 2001, [PERSON] proposed the concept of the universally composable (UC) security model [17] to explain and prove the security of the protocol combined with others. From then to now, many universally composable protocols have been designed. In 2019, [PERSON] et al. proposed an OT protocol based on dual-mode encryption [18], which obtains UC security under the LWE (learning with errors) assumption. In 2020, [PERSON] proposed a UC-secure isogeny-based protocol [19] under ROM. Most OT protocols are based on number theory, such as the discrete logarithm problem and the substantial number decomposition problem. Considering that these problems may be solvable for quantum computers in an efficient manner, the post-quantum MPC protocol is a hot spot and the focus of contemporary cryptography research. For example, the United States included post-quantum cryptography in the latest revision of the Critical and Emerging Technologies List on 8 February 2022. Post-quantum cryptography is divided into lattice-based cryptography and code-based cryptography, among others.