# Universally Composable Oblivious Transfer with Low Communication
## 4 UC-Secure 1-out-of-2 OT Protocol
### Random Oblivious Transfer
#### 4.1.3 The Privacy of the Sender  
Assuming the receiver only can get the chosen message after the protocol and knows nothing about other messages, the protocol can guarantee the sender's privacy. In the protocol, the key for encryption and decryption is generated by the hash function. If the receiver knows the sender's private key \(s\), it is possible to obtain \(sk_{1-\sigma}\) by computing \((B-(1-\sigma)T)^{T}bits(s,\varepsilon_{p},\varepsilon_{p})+h_{1}\). However, getting \(s\) from \(A\) is a difficult problem. Alternatively, if the sender can find a _key_ that satisfies \(Hash(key)=Hash(sk_{1-\sigma})\) and \(key\
eq sk_{1-\sigma}\), the sender can get \(m_{1-\sigma}\). However, the random oracle machine that runs the hash function is controlled by the simulator and has collision resistance, so this case can also be ignored. Next, a series of games shown in Table 4 are used to prove that the receiver cannot get \(sk_{1-\sigma}\), thus the protocol can guarantee the sender's privacy. Theorem 2 can prove the security of the sender. **Theorem 2**. : _Owing to the Mod-LWR difficulty problem, no PPT adversary \(R^{*}\) can obtain both \(v_{1}\) and \(v_{2}\)._  
Proof of Theorem 2.: The \(R^{*}\) determines the value of n at the end of each game. If the advantage of the \(R^{*}\) in judging the value of n is not negligible, the \(R^{*}\) wins the game. In Game 0, \(v^{\prime}\), c, and uniformly distributed samples are indistinguishable, so  
\[ADV(\mathrm{S}^{*})=|Pr(X_{0})-1/2| \tag{9}\]  
Suppose that the D\({}_{3}\) is a probabilistic polynomial-time algorithm with input \(((a,b^{\prime}),(A,v^{\prime}))\). When \(b^{\prime}\) and \(v^{\prime}\) are computed, the D\({}_{3}\) outputs \((a,\,A,\,T,\,B,\,c,\,sk)\); however, when \(b^{\prime}\) and \(v^{\prime}\) are randomly sampled from a uniform distribution, the D\({}_{3}\) outputs \((a,A,\,T,\,B,\,c,\,sk^{\prime})\). Owing to Mod-LWR difficulties, Game 0 and Game 1 are indistinguishable. The next step is to prove that \(sk\) can be regarded as a uniformly distributed sampling on the ring. In Game 1, \(b^{\prime}\), \(v\), and \(T\) are samples from a uniform distribution, so \(B\) is uniformly distributed on \(R^{\prime}_{d}\) and \(c\) is uniformly distributed on \(R_{d}\). \begin{table}
\begin{tabular}{l l l} \hline \hline
**Game 0:** & **Game 1:** & \(\mathbf{D_{3}}\)**:** \\ \hline \(seed_{a}+\mathcal{U}\Big{(}\{0,1\}^{256}\Big{)}\) & & \\ \(a\gets gen(seed_{a})\) & \(seed_{a}\leftarrow\mathcal{U}\Big{(}\{0,1\}^{256}\Big{)}\) & \\ \(s,s^{\prime}\leftarrow\beta_{\mu}\Big{(}R^{l\times 1}_{q}\Big{)}\) & \(a\gets gen(seed_{a})\) & \\ \(T\leftarrow\mathcal{U}\Big{(}R^{l\times 1}_{q}\Big{)}\) & \(s,s^{\prime}\leftarrow\beta_{\mu}\Big{(}R^{l\times 1}_{q}\Big{)}\) & \(c=bits(s^{\prime},\varepsilon_{p}-1,\varepsilon_{t})\) \\ \(A=bits\big{(}as+h,\varepsilon_{q},\varepsilon_{p}\big{)}\) & \(T\leftarrow\mathcal{U}\Big{(}R^{l\times 1}_{q}\Big{)}\) & \(B=b^{\prime}+\sigma T\) \\ \(b^{\prime}=bits\big{(}a^{T}s^{\prime}+h,\varepsilon_{q},\varepsilon_{p}\big{)}\) & \(A=bits(as+h,\varepsilon_{q},\varepsilon_{p})\) & \(v_{1-\sigma}=(B-\sigma T)^{T}bits\big{(}s,\varepsilon_{p},\varepsilon_{p})+h_ {1}\) \\ \(v^{\prime}=A^{T}bits\big{(}s^{\prime},\varepsilon_{p},\varepsilon_{p}\big{)}+h_ {1}\) & \(c=bits(v^{\prime},\varepsilon_{p}-1,\varepsilon_{t})\) & \(sk=bits\big{(}v_{1-\sigma}-2^{\varepsilon_{r}-\varepsilon_{t}-1}c+h_{2}, \varepsilon_{p},1\big{)}\) \\ \(c=bits(v^{\prime},\varepsilon_{p}-1,\varepsilon_{t})\) & \(B=b^{\prime}+\sigma T\) & \(sk^{\prime}\leftarrow\mathcal{U}(R)\) \\ \(B=b^{\prime}+\sigma T\) & \(\begin{array}{ll}&&\\ &\!\! It is necessary to prove that \(sk\) and \(sk^{\prime}\) are indistinguishable.