oblivious-transfer alternatives and similar packages
Based on the "Cryptography" category.
Alternatively, view oblivious-transfer alternatives based on common mentions on social networks and blogs.
-
cryptonite
lowlevel set of cryptographic primitives for haskell -
merkle-tree
An implementation of a Merkle Tree and merkle tree proofs -
cacophony
A Haskell library implementing the Noise protocol. -
saltine
Cryptography that's easy to digest (NaCl/libsodium bindings) -
pedersen-commitment
An implementation of Pedersen commitment schemes -
arithmetic-circuits
Arithmetic circuits for zero knowledge proof systems -
galois-field
Finite field and algebraic extension field arithmetic -
aos-signature
Abe-Ohkubo-Suzuki Linkable Ring Signatures -
cryptohash
efficient and practical cryptohashing in haskell. DEPRECATED in favor of cryptonite -
elliptic-curve
A polymorphic interface for elliptic curve operations -
ed25519
Minimal ed25519 Haskell package, binding to the ref10 SUPERCOP implementation. -
cipher-aes
DEPRECATED - use cryptonite - a comprehensive fast AES implementation for haskell that supports aesni and advanced cryptographic modes. -
signable
Deterministic serialisation and signatures with proto-lens and protobuf-elixir support -
cipher-blowfish
DEPRECATED by cryptonite; A collection of cryptographic block and stream ciphers in haskell -
crypto-api
Haskell generic interface (type classes) for cryptographic algorithms -
skein
Skein, a family of cryptographic hash functions. Includes Skein-MAC as well. -
galois-fft
Finite field polynomial arithmetic based on fast Fourier transforms -
qnap-decrypt
Decrypt files encrypted by the QNAP's Hybrid Backup Sync -
cryptohash-sha256
Fast, pure and practical SHA-256 implementation -
crypto-pubkey-types
Crypto Public Key algorithm generic types. -
cryptohash-md5
Fast, pure and practical MD5 implementation -
crypto-pubkey
DEPRECATED - use cryptonite - Cryptographic public key related algorithms in haskell (RSA,DSA,DH,ElGamal) -
crypto-pubkey-openssh
OpenSSH keys decoder/encoder -
scrypt
Haskell bindings to Colin Percival's scrypt implementation. -
cprng-aes
Crypto Pseudo Random Number Generator using AES in counter mode -
cipher-aes128
Based on cipher-aes, but using a crypto-api interface and providing resulting IVs for each mode -
crypto-numbers
DEPRECATED - use cryptonite - Cryptographic number related function and algorithms -
crypto-enigma
A Haskell Enigma machine simulator with rich display and machine state details.
Collect and Analyze Billions of Data Points in Real Time
* Code Quality Rankings and insights are calculated and provided by Lumnify.
They vary from L1 to L5 with "L5" being the highest.
Do you think we are missing an alternative of oblivious-transfer or a related project?
README
Oblivious Transfer (OT) is a cryptographic primitive in which a sender transfers some of potentially many pieces of information to a receiver. The sender doesn't know which pieces of information have been transferred.
1-out-of-2 OT
Oblivious transfer is central to many of the constructions for secure multiparty computation. In its most basic form, the sender has two secret messages as inputs, m0 and m1; the receiver has a choice bit c as input. At the end of the 1-out-of-2 OT protocol, the receiver should only learn message Mc, while the sender should not learn the value of the receiver's input c.
The protocol is defined for elliptic curves over finite fields E(Fq). The set of points E(Fq) is a finite abelian group. It works as follows:
- Alice samples a random a and computes A = aG. Sends A to Bob
- Bob has a choice c. He samples a random b.
- If c is 0, then he computes B = bG.
- If c is 1, then he computes B = A + bG.
Sends B to Alice
- Alice derives two keys:
- K0 = aB
- K1 = a(B - A)
It's easy to check that Bob can derive the key Kc corresponding to his choice bit, but cannot compute the other one.
1-out-of-N OT
The 1-out-of-N oblivious transfer protocol is a natural generalization of the 1-out-of-2 OT protocol, in which the sender has a vector of messages (M0, ..., Mn-1). The receiver only has a choice c.
We implement a protocol for random OT, where the sender, Alice, outputs n random keys and the receiver, Bob, only learns one of them. It consists on three parts:
Setup
Alice samples a ∈ Zp and computes A = aG and T = aA, where G and p are the generator and the order of the curve, respectively. She sends A to Bob, who aborts if A is not a valid point in the curve.
Choose
Bob takes his choice c ∈ Zn, samples b ∈ Zp and replies R = cA + bG. Alice aborts if R is not a valid point in the curve.
Key derivation
For all e ∈ Zn, Alice computes ke = aR - eT. She now has a vector of keys (k0, ..., kn-1).
Bob computes kR = bA.
We can see that the key ke = aR - eT = abG + (c - e)T. If e = c, then kc = abG = bA = kR. Therefore, kR = kc if both parties are honest.
{-# LANGUAGE ScopedTypeVariables #-}
import Protolude
import Data.Curve.Weierstrass.SECP256K1
import qualified OT
testOT :: Integer -> IO Bool
testOT n = do
-- Alice sets up the procotol
(sPrivKey, sPubKey, t) :: (Fr, PA, PA) <- OT.setup
-- Bob picks a choice bit 'c'
(rPrivKey, response, c) <- OT.choose n sPubKey
-- Alice computes a set of n keys
let senderKeys = OT.deriveSenderKeys n sPrivKey response t
-- Bob only gets to know one out of n keys. Alice doesn't know which one
let receiverKey = OT.deriveReceiverKey rPrivKey sPubKey
pure $ receiverKey == (senderKeys !! fromInteger c)
k-out-of-N OT
1-out-of-N oblivious transfer can be generalised one step further into k-out-of-N. This is very similar in structure to the methods above comprising the same 3 parts:
Setup As above, Alice samples a ∈ Zp and computes A = aG and T = aA, where G and p are the generator and the order of the curve, respectively. She sends A to Bob, who aborts if A is not a valid point in the curve.
Choose Bob takes his choices ci ∈ Zn, samples bi ∈ Zp and replies Ri = ciA + biG. Alice aborts if Ri is not a valid point in the curve.
Key derivation
For all ei ∈ Zn, Alice computes kei = aRi - eiT. She now has a vector of vectors of keys (k0i, ..., kn-1i).
Bob computes kRi = biA.
We can see that the key kei = aRi - eiT = abiG + (ci - ei)T. If e = c, then kci = abiG = biA = kRi. Therefore, kRi = kci if both parties are honest.
References:
- Chou, T. and Orlandi, C. "The Simplest Protocol for Oblivious Transfer" Technische Universiteit Eindhoven and Aarhus University
Notation:
k: Lower-case letters are scalars. P: Upper-case letters are points in an elliptic curve. kP: Multiplication of a point P with a scalar k over an elliptic curve defined over a finite field modulo a prime number.
License
Copyright 2018-2020 Adjoint Inc
Licensed under the Apache License, Version 2.0 (the "License");
you may not use this file except in compliance with the License.
You may obtain a copy of the License at
http://www.apache.org/licenses/LICENSE-2.0
Unless required by applicable law or agreed to in writing, software
distributed under the License is distributed on an "AS IS" BASIS,
WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
See the License for the specific language governing permissions and
limitations under the License.
*Note that all licence references and agreements mentioned in the oblivious-transfer README section above
are relevant to that project's source code only.