Cut-and-choose bilateral oblivious transfer protocol based on DDH assumption

In secure two-party computation protocols, the cut-and-choose paradigm is used to prevent the malicious party who constructs the garbled circuits from cheating. In previous realization of the cut-and-choose technique on the garbled circuits, the delivery of the random keys is divided into multiple stages. Thus, the round complexity is high and the consistency of cut-and-choose challenge should be proved. Based on DDH assumption, we build a so-called cut-and-choose bilateral oblivious transfer protocol, which transfers all necessary keys of garbled circuits in one process. Specifically, in our oblivious transfer protocol, the sender inputs two pairs (k_0^1,k_1^1) , (k_0^2,k_1^2) and a bit τ ; the receiver inputs two bits σ and j . After the protocol execution, the receiver obtains k_τ^1,k_σ^2 for j=1 , and k_0^1,k_1^1,k_0^2,k_1^2 for j=0 . The protocol inherit the cut-and-choose OT protocol in Lindell and Pinkas (Proceedings of the 8th conference on theory of cryptography, Springer, 2011 ), and can be applied into the state-of-the-art cut-and-choose secure two party computation protocol without any obstacles. By the cut-and-choose bilateral oblivious transfer protocol, the cut-and-choose challenge j is no need to be opened anymore, therefore the consistency proof of j is omitted, and the round complexity of secure two-party computation protocol can be decreased.