Interactive Hashing has featured as an essential ingredient in protocols realizing a large variet... more Interactive Hashing has featured as an essential ingredient in protocols realizing a large variety of cryptographic tasks, notably Oblivious Transfer in the bounded memory model. In Interactive Hashing, a sender transfers a bit string to a receiver such that two strings are received, the original string and a second string that appears to be chosen at random among those distinct from the first. This paper starts by formalizing the notion of Interactive Hashing as a cryptographic primitive, disentangling it from the specifics of its various implementations. To this end, we present an application-independent set of information theoretic conditions that all Interactive Hashing protocols must ideally satisfy. We then provide a standard implementation of Interactive Hashing and use it to reduce a very standard version of Oblivious Transfer to another one which appears much weaker.
IEEE Transactions on Information Theory, Oct 1, 2015
Interactive hashing has featured as an essential ingredient in protocols realizing a large variet... more Interactive hashing has featured as an essential ingredient in protocols realizing a large variety of cryptographic tasks, notably oblivious transfer in the bounded storage model. In interactive hashing, a sender transfers a bit string to a receiver such that two strings are received, the original string and a second string that appear to be chosen at random. This paper presents a self-contained, information theoretic study of interactive hashing. We start by formalizing the notion of interactive hashing as a cryptographic primitive, disentangling it from the specifics of its various implementations. To this end, we present an application-independent set of information theoretic conditions that all interactive hashing protocols must ideally satisfy. We then provide a detailed analysis of a standard implementation of interactive hashing which is shown to satisfy all the conditions of our definition. Our analysis represents a significant improvement over previous attempts in more restricted contexts. Despite its generality, it offers a considerably simpler proof of security. Moreover, it establishes a tighter upper bound on the cheating probability of a dishonest sender, who wishes to manipulate the protocol so that both output strings have some rare desirable property. In particular, we prove that if the set of desirable strings for the dishonest sender represents a fraction f of all strings, then the probability that both outputs will be from this set is no larger than 15.6805 • f. This upper bound is valid for any f and is tight up to a small constant, since a sender acting honestly would get two outputs from this set with probability very close to f. We illustrate the power of interactive hashing as a cryptographic tool by surveying protocols achieving oblivious transfer in the bounded storage model, which typically rely heavily on interactive hashing.
i\ (:)-OT, (one-out-of-two Bit Oblivious Transfer) is a technique by which a party S owning two s... more i\ (:)-OT, (one-out-of-two Bit Oblivious Transfer) is a technique by which a party S owning two secret bits b , b l , can transfer one of them b, to another party R, who chooses c. This is done in a way that does not release any bias about bz to R nor any bias about c to S. How can one build a 2TO-(i) ((;)-OT2 from R to S) given a (i)-OT, (from S to a)? This question is interesting because in many scenarios, one of the two parties will be much more powerful than the other. In the current paper we answer this question and show a number of related extensions. One interesting extension of this transfer is the (:)-OTk (one-out-of-two String O.T.) in which the two secrets qo, q1 are elements of CFk(2) instead of bits. We show that $TO-(:) can be obtained at about the same cost as (3-OT:, in terms of number of c a b to (i)-OTz. Assume now that we are in a scenario where one party is much more powerful in terms of computational ower or simply in terms of technology than the other pasty. In such a setting it is likely that (3-OT2 can be implemented in one direction but not the other. In particular one can make a computational assumption of the '*weaker" party but not of the other. This scenario was also studied by Ostrovsky, Venkatesan and Yung in [OVYSl] where they independently give a reduction similar to 2.1. Also if quantum technology is used [Cre90,BC91] it might be the case that one party is limited in the equipment it can carry (especially if one participant sits on a smart card!). Therefore a fundamental question is:"Can w e reverse (i)-OT,?". 'This work waa performed while the authors were viaiting the Universitit des Saarlandes, Saarbruckea. 'Supported in part by an NSERC Postdoctorate Scholarship.
I n t r o d u c t i o n The fates of S I G A C T News and Quantum Cryptography are inseparably en... more I n t r o d u c t i o n The fates of S I G A C T News and Quantum Cryptography are inseparably entangled. The exact date of Stephen Wiesner's invention of "conjugate coding" is unknown but it cannot be far from April 1969, when the premier issue of SIGACT News-or rather S I C A C T News as it was known at the time-came out. Much later, it was in S I G A C T News that Wiesner's paper finally appeared [74] in the wake of the first author's early collaboration with Charles H. Bennett [7]. It was also in SIGACT News that the original experimental demonstration for quantum key distribution was announced for the first time [6] and that a thorough bibliography was published [19]. Finally, it was in S I G A C T News that Doug Wiedemann chose to publish his discovery when he reinvented quantum key distribution in 1987, unaware of all previous work but Wiesner's [73, 5].
Assume A owns t secret k-bit strings. She is willing to disclose one of them to 13, at his choosi... more Assume A owns t secret k-bit strings. She is willing to disclose one of them to 13, at his choosing, provided he does not learn anything about the other strings. Conversely, B does not want A to learn which secret he chose to learn. A protocol for the above task is said to implement One-out-of-t String Oblivious Transfer, denoted (4)-0T;. This primitive is particularly useful in a variety of cryptographic settings. An apparently simpler task corresponds to the case k = 1 and t = 2 of two 1-bit secrets: this is known as One-out-of-two Bit Oblivious Transfer, denoted (?)-OTz. We address the question of implementing (i)-OT," assuming the existence of a (?)-OTz. In particular, we prove that unconditionally secure (;)-OT,k can be implemented from 0 (k) calls to (2)-0Tz. This is optimal up to a small multiplicative constant. Our solution is based on the notion of self-intersecting codes. Of independent interest, we give several efficient new constructions for such codes. Another contribution of this paper is a set of information-theoretic definitions for correctness and privacy of unconditionally secure oblivious transfer. codes, algebraic-geometric codes, information theory.
Oblivious transfer (OT) is an important primitive in cryptography. In chosen one-out-of-two strin... more Oblivious transfer (OT) is an important primitive in cryptography. In chosen one-out-of-two string OT, a sender offers two strings, one of which the other party, called the receiver, can choose to read, not learning any information about the other string. The sender on the other hand does not obtain any information about the receiver's choice. We consider the problem of reducing this primitive to OT for single bits. Previous attempts to doing this were based on self-intersecting codes. We present a new technique for the same task, based on so-called privacy amplification. It is shown that our method has two important advantages over the previous approaches. First, it is more efficient in terms of the number of required realizations of bit OT, and second, the technique even allows for reducing string OT to (apparently) much weaker primitives. An example of such a primitive is universal OT, where the receiver can adaptively choose what type of information he wants to obtain about the two bits sent by the sender subject to the only constraint that some, possibly very small, uncertainty must remain about the pair of bits.
Cryptographic techniques have been used intensively in the past to show how to play multiparty ga... more Cryptographic techniques have been used intensively in the past to show how to play multiparty games in an adversarial scenario. We now investigate the cryptographic power of a deck of cards in a solitary scenario. In particular, we show how a person can select a random permutation satisfying a certain criterion dixreetly (without knowing which one was picked) using a simple deck of cards. We also show how it is possible using cards to play games of partial information such-as POKER, BRIDGE and other carda games in solitary. * This work was performed while visiting NEC Research Institute in the spring of 1992.
A perfect zero-knowledge interactive proof is a protocol by which Alice can convince Bob of the t... more A perfect zero-knowledge interactive proof is a protocol by which Alice can convince Bob of the truth of some theorem in a way that yields no information as to how the proof might proceed (in the sense of Shannon's information theory). We give a general technique for achieving this goal for any problem in NP (and beyond). The fact that our protocol is perfect zero-knowledge does not depend on unproved cryptographic assumptions. Furthermore, our protocol is powerful enough to allow Alice to convince Bob of theorems for which she does not even have a proof. Whenever Alice can convince herself probabilistically of a theorem, perhaps thanks to her knowledge of some trap-door information, she can convince Bob as well without compromising the trap-door in any way. This results in a non-transitive transfer of confidence from Alice to Bob, because Bob will not be able to subsequently convince someone else that the theorem is true. Our protocol is dual to those of [GMWl, BC].
The desire to obtain an unconditionally secure bit commitment protocol in quantum cryptography wa... more The desire to obtain an unconditionally secure bit commitment protocol in quantum cryptography was expressed for the first time thirteen years ago. Bit commitment is sufficient in quantum cryptography to realize a variety of applications with unconditional security. In 1993, a quantum bit commitment protocol was proposed together with a security proof. However, a basic flaw in the protocol was discovered by Mayers in 1995 and subsequently by Lo and Chau. Later the result was generalized by Mayers who showed that unconditionally secure bit commitment is impossible. A brief review on quantum bit commitment which focuses on the general impossibility theorem and on recent attempts to bypass this result is provided.
It has been recently shown by Mayers that no bit commitment scheme is secure if the participants ... more It has been recently shown by Mayers that no bit commitment scheme is secure if the participants have unlimited computational power and technology. However it was noticed that a secure protocol could be obtained by forcing the cheater to perform a measurement. Similar situations had been encountered previously in the design of Quantum Oblivious Transfer. The question is whether a classical bit commitment could be used for this specific purpose. We demonstrate that, surprisingly, classical unconditionally concealing bit commitments do not help.
In this work, we define a new notion of weakly Random-Self-Reducibile cryptosystems and show how ... more In this work, we define a new notion of weakly Random-Self-Reducibile cryptosystems and show how it can be used to implement secure Oblivious Transfer. We also show that two recent (Post-quantum) cryptosystems (based on Learning with errors and Approximate Integer GCD) can be considered as weakly Random-Self-Reducible. 1 Introduction An oblivious transfer is a protocol by which a sender transfers one of many pieces of information to a receiver, but remains oblivious as to which piece has been transferred. The early implementations of Oblivious Transfer of Rabin [1], and Even, Goldreich and Lempel [2] were very innovative but did not offer very strong security. The very first OT protocols that may be considered secure were introduced by Ficher, Micali and Rackoff [3], and Berger, Peralta and Tedrick [4]. Later, two methodologies where introduced. A first set of results by Brassard, Crépeau and Robert [18] relied on Random-Self-Reducibility (RSR for short) of certain number theoretic assumptions such as the Quadratic Residuosity assumption, the RSA assumption or the Discrete log assumption. These results were not extended to very general computational assumptions because the RSR property, which was at the heart of the construction, is not very common. In a second set of results by Goldreich, Micali and Wigderson [19], secure Oblivious Transfer protocols were constructed from the generic assumption that (enhanced) 1 Trap-door One-Way permutations exist. Unfortunately, all constructions that are used to implement secure OT under either of these methodologies fall apart when faced with a quantum computer [5]: none of the so-called Post-Quantum Cryptosystems can directly implement secure OT under these methodologies. Nevertheless, some small modifications to the GMW methodology have led to proposals for OT under the Learning with error LWE assumption [6]. Similarily, Dowsley, van de Graaf, Müller-Quade and Nascimento [7] as well as Kobara, Morozov and Overbeck [8] have proposed Oblivious Transfer protocols based on assumptions related to the McEliece public-key cryptosystem [9]. Both of these papers use generalization of the GMW methodology. However both of them also require an extra computational assumption on top of McEliece's to conclude security. Those were the first proposals for OT protocols believed secure against a quantum computer 2. Supported in part by Québec's FQRNT, Canada's NSERC, CIFAR, and QuantumWorks. 1 The enhanced property is not very restrictive, but some examples of candidates Trap-door One-Way permutations seem to escape it [20]. 2 Earlier results accomplished a similar security level using only a One-Way function and Quantum Communication. The motivation of the papers cited above and of the current work is to avoid quantum communication altogether [10].
We propose a protocol for oblivious transfer that is unconditionally secure under the sole assump... more We propose a protocol for oblivious transfer that is unconditionally secure under the sole assumption that the memory size of the receiver is bounded. The model assumes that a random bit string slightly larger than the receiver's memory is broadcast (either by the sender or by a third party). In our construction, both parties need memory of size in
Introducing the simplest of all No-Signalling Games: the RGB Game where two verifiers interrogate... more Introducing the simplest of all No-Signalling Games: the RGB Game where two verifiers interrogate two provers, Alice and Bob, far enough from each other that communication between them is too slow to be possible. Each prover may be independently queried one of three possible colours: Red, Green or Blue. Let $a$ be the colour announced to Alice and $b$ be announced to Bob. To win the game they must reply colours $x$ (resp. $y$) such that $a \neq x \neq y \neq b$. This work focuses on this new game mainly as a pedagogical tool for its simplicity but also because it triggered us to introduce a new set of definitions for reductions among multi-party probability distributions and related {locality classes}. We show that a particular winning strategy for the RGB Game is equivalent to the PR-Box of Popescu-Rohrlich and thus No-Signalling. Moreover, we use this example to define No-Signalling in a new useful way, as the intersection of two natural classes of multi-party probability distribu...
The foundation of zero-knowledge is the simulator: a weak machine capable of pretending to be a w... more The foundation of zero-knowledge is the simulator: a weak machine capable of pretending to be a weak verifier talking with all-powerful provers. To achieve this, simulators need some kind of advantage such as the knowledge of a trapdoor. In existing zero-knowledge multi-prover protocols, this advantage is essentially signalling, something that the provers are explicitly forbidden to do. In most cases, this advantage is stronger than necessary as it is possible to define a sense in which simulators need much less to simulate. We define a framework in which we can quantify the simulators' non-local advantage and exhibit examples of zero-knowledge protocols that are sound against local or entangled provers but that are not sound against no-signalling provers precisely because the no-signalling simulation strategy can be adopted by malicious provers.
Interactive Hashing has featured as an essential ingredient in protocols realizing a large variet... more Interactive Hashing has featured as an essential ingredient in protocols realizing a large variety of cryptographic tasks, notably Oblivious Transfer in the bounded memory model. In Interactive Hashing, a sender transfers a bit string to a receiver such that two strings are received, the original string and a second string that appears to be chosen at random among those distinct from the first. This paper starts by formalizing the notion of Interactive Hashing as a cryptographic primitive, disentangling it from the specifics of its various implementations. To this end, we present an application-independent set of information theoretic conditions that all Interactive Hashing protocols must ideally satisfy. We then provide a standard implementation of Interactive Hashing and use it to reduce a very standard version of Oblivious Transfer to another one which appears much weaker.
IEEE Transactions on Information Theory, Oct 1, 2015
Interactive hashing has featured as an essential ingredient in protocols realizing a large variet... more Interactive hashing has featured as an essential ingredient in protocols realizing a large variety of cryptographic tasks, notably oblivious transfer in the bounded storage model. In interactive hashing, a sender transfers a bit string to a receiver such that two strings are received, the original string and a second string that appear to be chosen at random. This paper presents a self-contained, information theoretic study of interactive hashing. We start by formalizing the notion of interactive hashing as a cryptographic primitive, disentangling it from the specifics of its various implementations. To this end, we present an application-independent set of information theoretic conditions that all interactive hashing protocols must ideally satisfy. We then provide a detailed analysis of a standard implementation of interactive hashing which is shown to satisfy all the conditions of our definition. Our analysis represents a significant improvement over previous attempts in more restricted contexts. Despite its generality, it offers a considerably simpler proof of security. Moreover, it establishes a tighter upper bound on the cheating probability of a dishonest sender, who wishes to manipulate the protocol so that both output strings have some rare desirable property. In particular, we prove that if the set of desirable strings for the dishonest sender represents a fraction f of all strings, then the probability that both outputs will be from this set is no larger than 15.6805 • f. This upper bound is valid for any f and is tight up to a small constant, since a sender acting honestly would get two outputs from this set with probability very close to f. We illustrate the power of interactive hashing as a cryptographic tool by surveying protocols achieving oblivious transfer in the bounded storage model, which typically rely heavily on interactive hashing.
i\ (:)-OT, (one-out-of-two Bit Oblivious Transfer) is a technique by which a party S owning two s... more i\ (:)-OT, (one-out-of-two Bit Oblivious Transfer) is a technique by which a party S owning two secret bits b , b l , can transfer one of them b, to another party R, who chooses c. This is done in a way that does not release any bias about bz to R nor any bias about c to S. How can one build a 2TO-(i) ((;)-OT2 from R to S) given a (i)-OT, (from S to a)? This question is interesting because in many scenarios, one of the two parties will be much more powerful than the other. In the current paper we answer this question and show a number of related extensions. One interesting extension of this transfer is the (:)-OTk (one-out-of-two String O.T.) in which the two secrets qo, q1 are elements of CFk(2) instead of bits. We show that $TO-(:) can be obtained at about the same cost as (3-OT:, in terms of number of c a b to (i)-OTz. Assume now that we are in a scenario where one party is much more powerful in terms of computational ower or simply in terms of technology than the other pasty. In such a setting it is likely that (3-OT2 can be implemented in one direction but not the other. In particular one can make a computational assumption of the '*weaker" party but not of the other. This scenario was also studied by Ostrovsky, Venkatesan and Yung in [OVYSl] where they independently give a reduction similar to 2.1. Also if quantum technology is used [Cre90,BC91] it might be the case that one party is limited in the equipment it can carry (especially if one participant sits on a smart card!). Therefore a fundamental question is:"Can w e reverse (i)-OT,?". 'This work waa performed while the authors were viaiting the Universitit des Saarlandes, Saarbruckea. 'Supported in part by an NSERC Postdoctorate Scholarship.
I n t r o d u c t i o n The fates of S I G A C T News and Quantum Cryptography are inseparably en... more I n t r o d u c t i o n The fates of S I G A C T News and Quantum Cryptography are inseparably entangled. The exact date of Stephen Wiesner's invention of "conjugate coding" is unknown but it cannot be far from April 1969, when the premier issue of SIGACT News-or rather S I C A C T News as it was known at the time-came out. Much later, it was in S I G A C T News that Wiesner's paper finally appeared [74] in the wake of the first author's early collaboration with Charles H. Bennett [7]. It was also in SIGACT News that the original experimental demonstration for quantum key distribution was announced for the first time [6] and that a thorough bibliography was published [19]. Finally, it was in S I G A C T News that Doug Wiedemann chose to publish his discovery when he reinvented quantum key distribution in 1987, unaware of all previous work but Wiesner's [73, 5].
Assume A owns t secret k-bit strings. She is willing to disclose one of them to 13, at his choosi... more Assume A owns t secret k-bit strings. She is willing to disclose one of them to 13, at his choosing, provided he does not learn anything about the other strings. Conversely, B does not want A to learn which secret he chose to learn. A protocol for the above task is said to implement One-out-of-t String Oblivious Transfer, denoted (4)-0T;. This primitive is particularly useful in a variety of cryptographic settings. An apparently simpler task corresponds to the case k = 1 and t = 2 of two 1-bit secrets: this is known as One-out-of-two Bit Oblivious Transfer, denoted (?)-OTz. We address the question of implementing (i)-OT," assuming the existence of a (?)-OTz. In particular, we prove that unconditionally secure (;)-OT,k can be implemented from 0 (k) calls to (2)-0Tz. This is optimal up to a small multiplicative constant. Our solution is based on the notion of self-intersecting codes. Of independent interest, we give several efficient new constructions for such codes. Another contribution of this paper is a set of information-theoretic definitions for correctness and privacy of unconditionally secure oblivious transfer. codes, algebraic-geometric codes, information theory.
Oblivious transfer (OT) is an important primitive in cryptography. In chosen one-out-of-two strin... more Oblivious transfer (OT) is an important primitive in cryptography. In chosen one-out-of-two string OT, a sender offers two strings, one of which the other party, called the receiver, can choose to read, not learning any information about the other string. The sender on the other hand does not obtain any information about the receiver's choice. We consider the problem of reducing this primitive to OT for single bits. Previous attempts to doing this were based on self-intersecting codes. We present a new technique for the same task, based on so-called privacy amplification. It is shown that our method has two important advantages over the previous approaches. First, it is more efficient in terms of the number of required realizations of bit OT, and second, the technique even allows for reducing string OT to (apparently) much weaker primitives. An example of such a primitive is universal OT, where the receiver can adaptively choose what type of information he wants to obtain about the two bits sent by the sender subject to the only constraint that some, possibly very small, uncertainty must remain about the pair of bits.
Cryptographic techniques have been used intensively in the past to show how to play multiparty ga... more Cryptographic techniques have been used intensively in the past to show how to play multiparty games in an adversarial scenario. We now investigate the cryptographic power of a deck of cards in a solitary scenario. In particular, we show how a person can select a random permutation satisfying a certain criterion dixreetly (without knowing which one was picked) using a simple deck of cards. We also show how it is possible using cards to play games of partial information such-as POKER, BRIDGE and other carda games in solitary. * This work was performed while visiting NEC Research Institute in the spring of 1992.
A perfect zero-knowledge interactive proof is a protocol by which Alice can convince Bob of the t... more A perfect zero-knowledge interactive proof is a protocol by which Alice can convince Bob of the truth of some theorem in a way that yields no information as to how the proof might proceed (in the sense of Shannon's information theory). We give a general technique for achieving this goal for any problem in NP (and beyond). The fact that our protocol is perfect zero-knowledge does not depend on unproved cryptographic assumptions. Furthermore, our protocol is powerful enough to allow Alice to convince Bob of theorems for which she does not even have a proof. Whenever Alice can convince herself probabilistically of a theorem, perhaps thanks to her knowledge of some trap-door information, she can convince Bob as well without compromising the trap-door in any way. This results in a non-transitive transfer of confidence from Alice to Bob, because Bob will not be able to subsequently convince someone else that the theorem is true. Our protocol is dual to those of [GMWl, BC].
The desire to obtain an unconditionally secure bit commitment protocol in quantum cryptography wa... more The desire to obtain an unconditionally secure bit commitment protocol in quantum cryptography was expressed for the first time thirteen years ago. Bit commitment is sufficient in quantum cryptography to realize a variety of applications with unconditional security. In 1993, a quantum bit commitment protocol was proposed together with a security proof. However, a basic flaw in the protocol was discovered by Mayers in 1995 and subsequently by Lo and Chau. Later the result was generalized by Mayers who showed that unconditionally secure bit commitment is impossible. A brief review on quantum bit commitment which focuses on the general impossibility theorem and on recent attempts to bypass this result is provided.
It has been recently shown by Mayers that no bit commitment scheme is secure if the participants ... more It has been recently shown by Mayers that no bit commitment scheme is secure if the participants have unlimited computational power and technology. However it was noticed that a secure protocol could be obtained by forcing the cheater to perform a measurement. Similar situations had been encountered previously in the design of Quantum Oblivious Transfer. The question is whether a classical bit commitment could be used for this specific purpose. We demonstrate that, surprisingly, classical unconditionally concealing bit commitments do not help.
In this work, we define a new notion of weakly Random-Self-Reducibile cryptosystems and show how ... more In this work, we define a new notion of weakly Random-Self-Reducibile cryptosystems and show how it can be used to implement secure Oblivious Transfer. We also show that two recent (Post-quantum) cryptosystems (based on Learning with errors and Approximate Integer GCD) can be considered as weakly Random-Self-Reducible. 1 Introduction An oblivious transfer is a protocol by which a sender transfers one of many pieces of information to a receiver, but remains oblivious as to which piece has been transferred. The early implementations of Oblivious Transfer of Rabin [1], and Even, Goldreich and Lempel [2] were very innovative but did not offer very strong security. The very first OT protocols that may be considered secure were introduced by Ficher, Micali and Rackoff [3], and Berger, Peralta and Tedrick [4]. Later, two methodologies where introduced. A first set of results by Brassard, Crépeau and Robert [18] relied on Random-Self-Reducibility (RSR for short) of certain number theoretic assumptions such as the Quadratic Residuosity assumption, the RSA assumption or the Discrete log assumption. These results were not extended to very general computational assumptions because the RSR property, which was at the heart of the construction, is not very common. In a second set of results by Goldreich, Micali and Wigderson [19], secure Oblivious Transfer protocols were constructed from the generic assumption that (enhanced) 1 Trap-door One-Way permutations exist. Unfortunately, all constructions that are used to implement secure OT under either of these methodologies fall apart when faced with a quantum computer [5]: none of the so-called Post-Quantum Cryptosystems can directly implement secure OT under these methodologies. Nevertheless, some small modifications to the GMW methodology have led to proposals for OT under the Learning with error LWE assumption [6]. Similarily, Dowsley, van de Graaf, Müller-Quade and Nascimento [7] as well as Kobara, Morozov and Overbeck [8] have proposed Oblivious Transfer protocols based on assumptions related to the McEliece public-key cryptosystem [9]. Both of these papers use generalization of the GMW methodology. However both of them also require an extra computational assumption on top of McEliece's to conclude security. Those were the first proposals for OT protocols believed secure against a quantum computer 2. Supported in part by Québec's FQRNT, Canada's NSERC, CIFAR, and QuantumWorks. 1 The enhanced property is not very restrictive, but some examples of candidates Trap-door One-Way permutations seem to escape it [20]. 2 Earlier results accomplished a similar security level using only a One-Way function and Quantum Communication. The motivation of the papers cited above and of the current work is to avoid quantum communication altogether [10].
We propose a protocol for oblivious transfer that is unconditionally secure under the sole assump... more We propose a protocol for oblivious transfer that is unconditionally secure under the sole assumption that the memory size of the receiver is bounded. The model assumes that a random bit string slightly larger than the receiver's memory is broadcast (either by the sender or by a third party). In our construction, both parties need memory of size in
Introducing the simplest of all No-Signalling Games: the RGB Game where two verifiers interrogate... more Introducing the simplest of all No-Signalling Games: the RGB Game where two verifiers interrogate two provers, Alice and Bob, far enough from each other that communication between them is too slow to be possible. Each prover may be independently queried one of three possible colours: Red, Green or Blue. Let $a$ be the colour announced to Alice and $b$ be announced to Bob. To win the game they must reply colours $x$ (resp. $y$) such that $a \neq x \neq y \neq b$. This work focuses on this new game mainly as a pedagogical tool for its simplicity but also because it triggered us to introduce a new set of definitions for reductions among multi-party probability distributions and related {locality classes}. We show that a particular winning strategy for the RGB Game is equivalent to the PR-Box of Popescu-Rohrlich and thus No-Signalling. Moreover, we use this example to define No-Signalling in a new useful way, as the intersection of two natural classes of multi-party probability distribu...
The foundation of zero-knowledge is the simulator: a weak machine capable of pretending to be a w... more The foundation of zero-knowledge is the simulator: a weak machine capable of pretending to be a weak verifier talking with all-powerful provers. To achieve this, simulators need some kind of advantage such as the knowledge of a trapdoor. In existing zero-knowledge multi-prover protocols, this advantage is essentially signalling, something that the provers are explicitly forbidden to do. In most cases, this advantage is stronger than necessary as it is possible to define a sense in which simulators need much less to simulate. We define a framework in which we can quantify the simulators' non-local advantage and exhibit examples of zero-knowledge protocols that are sound against local or entangled provers but that are not sound against no-signalling provers precisely because the no-signalling simulation strategy can be adopted by malicious provers.
Uploads
Papers by Claude Crépeau