I-(OT)^2: A Client-optimal Oblivious Transfer Protocol for IoT Devices

2026-06-01

AI Summary

This work addresses the inefficiency of traditional oblivious transfer (OT) protocols in resource-constrained environments such as the Internet of Things (IoT), where high computational overhead and multiple interaction rounds hinder practical deployment. The authors propose a novel 1-out-of-2 OT protocol based on the quadratic residuosity assumption, featuring an offline/online two-phase design that shifts the online computational burden to the sender and reduces interaction to six messages and four hashes. To the best of the authors’ knowledge, this is the first client-optimal OT protocol tailored for IoT devices. Under a 3072-bit RSA modulus, a single online OT execution requires only 39.90 microseconds—over ten times faster than SimplestOT—while significantly lowering both computational and communication costs for the receiver without compromising security.

Abstract

Oblivious Transfer (OT) is a fundamental cryptographic primitive enabling privacy-preserving computation and constitutes a core building block for secure multi-party computation while supporting a wide range of security-sensitive applications: private information retrieval, zero-knowledge proofs, and password-authenticated key exchange, to cite a few. While recent advances in OT extension have significantly reduced amortised costs, their reliance on batches of random base OTs and substantial pre-computation phases limits their practicality in scenarios where the number of transfers is modest or where communication latency and client-side computation are critical constraints. In such settings, efficient base OT protocols remain both relevant and necessary. In this work, we introduce $I$-$(OT)^2$, a novel base 1-out-of-2 OT protocol grounded in the quadratic residuosity problem, specifically designed to minimise receiver-side computation and interaction. Our construction is particularly appealing on client--server architectures in which the receiver operates on low-power hardware, such as Internet of Things (IoT) devices. Through a lightweight offline pre-computation phase, $I$-$(OT)^2$ shifts the on-transfer computational burden almost entirely to the Sender, while reducing online communication to only six messages and four digests exchanged. We provide a detailed description of the protocol, accompanied by a formal proof of its security. Moreover, to demonstrate the viability of $I$-$(OT)^2$, we also present an open-source proof-of-concept implementation (in C language) evaluated on real IoT hardware. Results are staggering: for 128-bit security using a 3072-bit RSA modulus, the receiver incurs an average online cost per OT as low as 2.80 μs on desktop platforms and 39.90 μs on IoT devices, more than 10$\times$ faster than the well known SimplestOT.

Problem

• Oblivious Transfer
• IoT devices
• client-optimal
• base OT
• resource-constrained

Innovation

• Oblivious Transfer
• IoT Security
• Client-Optimal Protocol
• Quadratic Residuosity
• Lightweight Cryptography