I-(OT)^2: A Client-optimal Oblivious Transfer Protocol for IoT Devices
2026-06-01 • Cryptography and Security
Cryptography and Security
AI summaryⓘ
The authors present a new way to do Oblivious Transfer (OT), which is a key tool in privacy-focused computing. Their protocol, called $I$-$(OT)^2$, is designed to use very little work from the receiver's side, making it ideal for devices like IoT gadgets that have limited power. It shifts most of the work to the sender and reduces the number of messages exchanged during transfers. They also tested their method on real hardware and found it to be much faster than similar existing methods, especially for small numbers of transfers.
Oblivious TransferQuadratic Residuosity ProblemSecure Multi-Party ComputationIoT devicesBase OTPre-computationRSA modulusCryptographic ProtocolPrivacy-preserving Computation
Authors
Elia Onofri, Andrea Ciccotelli, Roberto Di Pietro
Abstract
Oblivious Transfer (OT) is a fundamental cryptographic primitive enabling privacy-preserving computation and constitutes a core building block for secure multi-party computation while supporting a wide range of security-sensitive applications: private information retrieval, zero-knowledge proofs, and password-authenticated key exchange, to cite a few. While recent advances in OT extension have significantly reduced amortised costs, their reliance on batches of random base OTs and substantial pre-computation phases limits their practicality in scenarios where the number of transfers is modest or where communication latency and client-side computation are critical constraints. In such settings, efficient base OT protocols remain both relevant and necessary. In this work, we introduce $I$-$(OT)^2$, a novel base 1-out-of-2 OT protocol grounded in the quadratic residuosity problem, specifically designed to minimise receiver-side computation and interaction. Our construction is particularly appealing on client--server architectures in which the receiver operates on low-power hardware, such as Internet of Things (IoT) devices. Through a lightweight offline pre-computation phase, $I$-$(OT)^2$ shifts the on-transfer computational burden almost entirely to the Sender, while reducing online communication to only six messages and four digests exchanged. We provide a detailed description of the protocol, accompanied by a formal proof of its security. Moreover, to demonstrate the viability of $I$-$(OT)^2$, we also present an open-source proof-of-concept implementation (in C language) evaluated on real IoT hardware. Results are staggering: for 128-bit security using a 3072-bit RSA modulus, the receiver incurs an average online cost per OT as low as 2.80 μs on desktop platforms and 39.90 μs on IoT devices, more than 10$\times$ faster than the well known SimplestOT.