1-out-of-2 Oblivious Transfer (OT) lets a Sender hold two secrets m₀, m₁ and a Receiver learn exactly one of them, chosen by a private bit b — the sender never learns b, and the receiver learns nothing about the message it didn't pick. It is the core primitive behind secure two-party computation (garbled circuits) and private information retrieval. This is a simplified, pedagogical version of the classic Even–Goldreich–Lempel (1985) RSA-trapdoor protocol:
Sender publishes its RSA public key (N, e) and two random blinds x₀, x₁
— the private exponent d never leaves the sender.
Receiver picks b, random k, sends v = (x_b + k^e) mod N
Sender computes k'₀=(v−x₀)^d mod N, k'₁=(v−x₁)^d mod N
→ exactly one of these equals the receiver's real k
Sender sends c₀=(m₀+k'₀) mod N, c₁=(m₁+k'₁) mod N
Receiver recovers m_b = (c_b − k) mod N
- The trapdoor — only the sender's private exponent d can invert v−x_b back to k; for the unchosen index, (v−x_{1-b})^d mod N lands on an unpredictable value neither party controls.
- Sender-blindness — v is a single number derived from whichever x_b the receiver used; it is statistically indistinguishable whichever branch produced it, so the sender cannot tell b from v alone.
- Receiver-blindness — the receiver can only invert c_b (it knows k for that branch); c_{1-b} is masked by a k it never computed and cannot separate from m_{1-b}.
- A production system would hash k before masking (m ⊕ H(k)) rather than adding it directly, to avoid any algebraic relation between the two ciphertexts — this demo keeps the raw modular arithmetic visible for teaching.
- Fixed from the 3D original: its step text said the sender "publishes RSA (N, e, d)" — but d is the private trapdoor exponent the whole protocol depends on staying secret (as its own ket-box and theory text correctly said). Publishing d would let the receiver invert both k'₀ and k'₁ and read both secrets, breaking the scheme entirely. Verified numerically (20,000 random trials, 0 mismatches) that the protocol is otherwise correct with d kept private — only the wording was wrong, not the math. The "Reveal sender's d" button below lets you see what only the sender ever knows.