# Universally Composable Oblivious Transfer with Low Communication
## 4 UC-Secure 1-out-of-2 OT Protocol
### Oblivious Transfer Protocol
The \(\mathcal{S}\) is constructed as follows: * The \(\mathcal{S}\) uses the random oracle machine to answer queries randomly before interacting with the S\({}^{*}\). * After receiving \((seed_{a},T,A)\) from the S\({}^{*}\), the \(\mathcal{S}\) generates the parameters by seed; chooses \(s^{\prime}\leftarrow\beta_{\mu}\big{(}R_{q}^{l\times 1}\big{)}\); calculates \(b^{\prime}=bits\big{(}a^{T}s^{\prime}+h,\in_{q},\in_{p}\big{)},v^{\prime}=A^{ T}bits\big{(}s^{\prime},\in_{p},\in_{p}\big{)}+h_{1}\), and \(c=bits(v^{\prime},\in_{p}-1,\in_{t})\); and sends \((b^{\prime},c)\) to the S\({}^{*}\). From this moment on, the \(\mathcal{S}\) records all queries of the form \(Hash_{((A,T),\mathcal{F}_{\mathcal{O}})}\) from the S\({}^{*}\). * After receiving \((C_{1},C_{2})\) from the S\({}^{*}\), the \(\mathcal{S}\) computes \(Dec(C_{i},Hash_{record})\) for each \(i\), where \(Hash_{record}\) denotes all the queries records of the S\({}^{*}\), and records the \(M\) that can be decrypted successfully from \(C\). * The S sends \((M_{1},M_{2})\) to \(\mathcal{F}_{\mathcal{O}\mathcal{T}}\). The next step is to demonstrate the indistinguishability under the \(\mathcal{Z}\)'s view. The \(\mathcal{Z}\) only can use \((B,\;c)\) and \(M_{\sigma}\) to distinguish the real execution and ideal environment. From Theorem 1, the protocol can guarantee the receiver's privacy so that \(the\;(B,c)\) generated by the \(\mathcal{S}\) and \(the\;(B^{\prime},\;c^{\prime})\) caused by the honest \(R\) in the protocol are indistinguishable. In addition, if the adversary can find an \(x\) that satisfies \(Hash(x)\
eq sk_{\sigma}\) and \(Dec(C_{\sigma},Hash(x))=M\), the \(x\) will help \(R\) output a different \(M\). However, owing to the robustness of the authentication encryption algorithm, the probability is negligible. 3. When only the adversary \(\mathcal{A}\) corrupts the \(R\), denote \(R\) as \(R^{*}\). We build a simulator \(\mathcal{S}\) to prove the indistinguishability. The \(\mathcal{S}\) needs to play the S's role to interact with the \(R^{*}\) to obtain the \(\sigma\), then uses \(\sigma\) to interact with \(\mathcal{F}_{\mathcal{O}\mathcal{T}}\) to obtain \(M_{\sigma}\) to make the R decrypt correctly, and finally generates \((C_{1},C_{2})\) based on \(M_{\sigma}\). The \(\mathcal{S}\) can obtain the value of \(\sigma\) by the queries records because the \(\mathcal{S}\) runs the hash function and the protocol guarantees the sender's privacy. The \(\mathcal{S}\) is constructed as follows: * The \(\mathcal{S}\) chooses \(seed_{a}\leftarrow\mathcal{U}\Big{(}\left\{0,1\right\}^{256}\Big{)}\), \(s\leftarrow\beta_{\mu}\Big{(}R_{q}^{l\times 1}\Big{)}\), and \(T\leftarrow\mathcal{U}\Big{(}R_{q}^{l\times 1}\Big{)}\); then generates key \(a\leftarrow gen(seed_{a})\); and finally computes \(A=bits\big{(}as+h,\in_{q},\in_{p}\big{)}\). * The \(\mathcal{S}\) uses the random oracle machine to answer the query and records queries of the form \(Hash_{((A,T),\mathcal{F}_{\mathcal{O}})}\) before interacting with \(R^{*}\). * The \(\mathcal{S}\) looks for records of the form \(Hash_{((A,T),\mathcal{B},c)}\) and judges if the output of the function is equal to \(sk\) after receiving \((B,\;c)\) from the \(R^{*}\). If equal, the \(\mathcal{S}\) records the value of \(i\) as \(\sigma\) and interacts with the function \(\mathcal{F}_{\mathcal{O}\mathcal{T}}\) to obtain \(M_{\sigma}\); otherwise, the \(\mathcal{S}\) fails and sets the value of \(\sigma\) to null. * The \(\mathcal{S}\) starts to generate \((C_{1},C_{2})\) after interacting with the \(R^{*}\). If the value of \(\sigma\) is null, the \(\mathcal{S}\) randomly samples \((sk_{1},sk_{2})\) in the ciphertext space and uses it as \((C_{1},C_{2})\); otherwise, the \(\mathcal{S}\) sets the value of \(sk_{\sigma}\) to the query result and computes \(C_{\sigma}=Enc(sk_{\sigma},M_{\sigma})\). Finally, the \(\mathcal{S}\) randomly generates \(C_{1-\sigma}\) and sends \((C_{1},C_{2})\) to the \(R^{*}\). * The \(\mathcal{S}\) continues to answer queries at random after outputting \((C_{1},C_{2})\).