|Previous||Table of Contents||Next|
Bob now has one of the two messages from Alice and Alice does not know which one he was able to read successfully. Unfortunately, if the protocol stopped here it would be possible for Alice to cheat. Another step is necessary.
At this point, of course, Bob can figure out the second message.
The protocol is secure against an attack by Alice because she has no way of knowing which of the two DES keys is the real one. She encrypts them both, but Bob only successfully recovers one of themuntil step (6). It is secure against an attack by Bob because, before step (6), he cannot get Alices private keys to determine the DES key that the other message was encrypted in. This may still seem like nothing more than a more complicated way to flip coins over a modem, but it has extensive implications when used in more complicated protocols.
Of course, nothing stops Alice from sending Bob two completely useless messages: Nyah Nyah and You sucker. This protocol guarantees that Alice sends Bob one of two messages; it does nothing to ensure that Bob wants to receive either of them.
Other oblivious transfer protocols are found in the literature. Some of them are noninteractive, meaning that Alice can publish her two messages and Bob can learn only one of them. He can do this on his own; he doesnt have to communicate with Alice .
No one really cares about being able to do oblivious transfer in practice, but the notion is an important building block for other protocols. Although there are many types of oblivious transferI have two secrets and you get one; I have n secrets and you get one; I have one secret which you get with probability 1/2; and so onthey are all equivalent [245,391,395].
Honestly, I cant think of a good use for these, but there are two kinds :
Its a neat idea; Im sure it has a use somewhere.
Contract Signing with an Arbitrator
Alice and Bob want to enter into a contract. Theyve agreed on the wording, but neither wishes to sign unless the other signs as well. Face to face, this is easy: Both sign together. Over a distance, they could use an arbitrator.
This protocol works because Trent prevents either of the parties from cheating. If Bob were to refuse to sign the contract in step (5), Alice could appeal to Trent for a copy of the contract already signed by Bob. If Alice were to refuse to sign in step (4), Bob could do the same. When Trent indicates that he received both contracts in step (3), both Alice and Bob know that the other is bound by the contract. If Trent does not receive both contracts in steps (1) and (2), he tears up the one he received and neither party is bound.
Simultaneous Contract Signing without an Arbitrator (Face-to-Face)
If Alice and Bob were sitting face-to-face, they could sign the contract this way :
If you ignore the obvious problem with this protocol (Alice has a longer name than Bob), it works just fine. After signing only one letter, Alice knows that no judge will bind her to the terms of the contract. But the letter is an act of good faith, and Bob responds with a similar act of good faith.
After each party has signed several letters, a judge could probably be convinced that both parties had signed the contract. The details are murky, though. Surely they are not bound after only the first letter; just as surely they are bound after they sign their entire names. At what point in the protocol do they become bound? After signing one-half of their names? Two-thirds of their names? Three-quarters?
Since neither Alice nor Bob is certain of the exact point at which she or he is bound, each has at least some fear that she or he is bound throughout the protocol. At no point can Bob say: You signed four letters and I only signed three. You are bound but I am not. Bob has no reason not to continue with the protocol. Furthermore, the longer they continue, the greater the probability that a judge will rule that they are bound. Again, there is no reason not to continue with the protocol. After all, they both wanted to sign the contract; they just didnt want to sign before the other one.
Simultaneous Contract Signing without an Arbitrator (Not Face-to-Face)
This protocol uses the same sort of uncertainty . Alice and Bob alternate taking baby steps toward signing until both have signed.
In the protocol, Alice and Bob exchange a series of signed messages of the form: I agree that with probability p, I am bound by this contract.
The recipient of this message can take it to a judge and, with probability p, the judge will consider the contract to be signed.
|Previous||Table of Contents||Next|