# Universally Composable Oblivious Transfer with Low Communication
## 4 UC-Secure 1-out-of-2 OT Protocol
### Oblivious Transfer Protocol  
A standard UC-secure OT protocol can be obtained by combining the random OT mentioned in Section 4.1 and the authentication symmetric encryption algorithm mentioned in Section 3.3. After receiving the key, the S encrypts two messages \(M_{1}\) and \(M_{2}\) with two keys \(C_{1}\) and \(C_{2}\), respectively. Then, the \(S\) sends them to the \(R\), and the \(R\) decrypts the chosen ciphertext. Theorem 3 demonstrates that the OT protocol can be simulated as an ideal function under the random oracle machine model and can resist static adversary attacks. If the following assumptions hold, then the OT protocol can be simulated as \(\mathcal{F}_{\mathcal{OT}}\). 1. The adversary only performs static attacks. 2. The random oracle machine simulates the hash function. Proof of Theorem 3.: The static adversary attacks can be divided into four types as follows:  
1. Neither the S nor the \(R\) is corrupted. 2. Only the S is corrupted. 3. Only the \(R\) is corrupted. 4. Both the \(R\) and the S are corrupted. Let \(\mathcal{A}\) denote the adversary interacting with the honest participant in the real environment. For any \(\mathcal{A}\), a simulator \(\mathcal{S}\) can be constructed in the ideal environment, which runs the ideal function \(\mathcal{F}_{\mathcal{OT}}\) to simulate the interaction with the honest party. It is impossible for the \(\mathcal{Z}\) to distinguish between the real execution and the ideal environment. All corruption cases are shown as follows. 1. When neither the \(S\) nor the \(R\) is corrupted, the adversary can attack the process of data transmission. To demonstrate the universally composable security of the protocol, we build a simulator \(\mathcal{S}\). The simulation for the ideal environment is built as follows:  
* The \(\mathcal{S}\) simulates the S for parameter selection. The \(\mathcal{S}\) chooses \(seed_{a}\leftarrow\mathcal{U}\Big{(}\big{\{}0,1\big{\}}^{256}\Big{)}\), \(s\leftarrow\beta_{\mu}\Big{(}R_{q}^{l\times 1}\Big{)}\), and \(T\leftarrow\mathcal{U}\Big{(}R_{q}^{l\times 1}\Big{)}\) ; generates the key \(a\gets gen(seed_{a})\in R_{q}^{l\times 1}\); and then computes \(A=bits\big{(}as+h,\in_{q},\in_{p}\big{)}\). * The \(\mathcal{S}\) simulates the \(R\) to make a choice. The \(\mathcal{S}\) chooses \(s\leftarrow\beta_{\mu}\Big{(}R_{q}^{l\times 1}\Big{)}\) and calculates \(b^{\prime}=bits\big{(}a^{T}s^{\prime}+h,\in_{q},\in_{p}\big{)}\), \(v^{\prime}=A^{T}bits\big{(}s^{\prime},\in_{p},\in_{p}\big{)}+h_{1}\), \(and\ c=bits\big{(}v^{\prime},\in_{p}-1,\in_{t}\big{)}\). * The \(\mathcal{S}\) generates \((C_{1},C_{2})\) by random sampling from the ciphertext space. * The \(\mathcal{S}\) outputs \((seed_{a},A,T)\), \((B,c)\), and \((C_{1},C_{2})\). From Theorems 1 and 2, we know that the protocol can guarantee the privacy of the sender S and the receiver \(R\), so the \(\mathcal{Z}\) cannot distinguish whether \((seed_{a},A,T)\) and \((B,\ c)\) are in the real execution or ideal environment. The \(\mathcal{Z}\) can also not distinguish between \((C_{1},C_{2})\) in the real execution and the ideal environment owing to the authentication symmetric encryption algorithm. Hence, the ideal environment and the real execution are indistinguishable from the perspective of the \(\mathcal{Z}\). 2. When the adversary \(\mathcal{A}\) corrupts the S, denote S as S\({}^{*}\). We build a simulator \(\mathcal{S}\) to prove that the ideal environment and the real execution are indistinguishable. First, the \(\mathcal{S}\) interacts with the S\({}^{*}\) to get the real input \((M_{1},M_{2})\), then plays the role of the S to interact with the ideal function \(\mathcal{F}_{\mathcal{O}\mathcal{T}}\), which finally enables the \(R\) to get \(M_{\sigma}\). As the \(\mathcal{S}\) responds to S\({}^{*/}\)s queries using a random oracle machine, it is possible to decrypt the ciphertext using query records and get the sender's real input.