Simulatable Adaptive Oblivious Transfer

We study an adaptive variant of oblivious transfer in which a sender has $N$ messages, of which a receiver can adaptively choose to receive $k$ one-after-the-other, in such a way that (a) the sender learns nothing about the receiver's selections, and (b) the receiver only learns about the $k$ requested messages.

We propose two practical protocols for this primitive that achieve a stronger security notion than previous schemes with comparable efficiency. In particular, by requiring full simulatability for both sender and receiver security, our notion prohibits a subtle selective-failure attack not addressed by the security notions achieved by previous practical schemes.

[PDF]