On the Feasibility of Extending Oblivious Transfer

Yehuda Lindell, Hila Zarosim

Research output: Contribution to journalArticlepeer-review

1 Scopus citations


Oblivious transfer is one of the most basic and important building blocks in cryptography. As such, understanding its cost is of prime importance. Beaver (in: The 28th STOC, pp 479–488, 1996) showed that it is possible to obtain poly(n) oblivious transfers given only n actual oblivious transfer calls and using one-way functions, where n is the security parameter. In addition, he showed that it is impossible to extend oblivious transfer information theoretically. The notion of extending oblivious transfer is important theoretically (to understand the complexity of computing this primitive) and practically (since oblivious transfers can be expensive and thus extending them using only one-way functions is very attractive). Despite its importance, very little is known about the feasibility of extending oblivious transfer, beyond the fact that it is impossible information theoretically. Specifically, it is not known whether or not one-way functions are actually necessary for extending oblivious transfer, whether or not it is possible to extend oblivious transfers with adaptive security, and whether or not it is possible to extend oblivious transfers when starting with O(log n) oblivious transfers. In this paper, we address these questions and provide almost complete answers to all of them. We show that the existence of any oblivious transfer extension protocol with security for static semi-honest adversaries implies one-way functions, that an oblivious transfer extension protocol with adaptive security implies oblivious transfer with static security, and that the existence of an oblivious transfer extension protocol from only O(log n) oblivious transfers implies oblivious transfer itself.

Original languageEnglish
Pages (from-to)737-773
Number of pages37
JournalJournal of Cryptology
Issue number3
StatePublished - 1 Jul 2018

Bibliographical note

Funding Information:
∗This research was supported by THE ISRAEL SCIENCE FOUNDATION (Grant No. 189/11). Hila Zarosim is grateful to the Azrieli Foundation for the award of an Azrieli Fellowship.

Publisher Copyright:
© 2017, International Association for Cryptologic Research.


Dive into the research topics of 'On the Feasibility of Extending Oblivious Transfer'. Together they form a unique fingerprint.

Cite this