Oblivious Transfer: One Secret, Never Knowing Which

Secrets & Choice

Secret A (m₀)

Secret B (m₁)

Receiver requests

Protocol State

Press "Next Step" to begin the RSA-based 1-out-of-2 Oblivious Transfer.

N=3233, e=17, d=2753 (sender's RSA trapdoor)

Blinded value v

—

Recovered

—

Sender knows which?

Match check

—

How it works

1-out-of-2 Oblivious Transfer (OT) lets a Sender hold two secrets m₀, m₁ and a Receiver learn exactly one of them, chosen by a private bit b — the sender never learns b, and the receiver learns nothing about the message it didn't pick. It is the core primitive behind secure two-party computation (garbled circuits) and private information retrieval. This is a simplified, pedagogical version of the classic Even–Goldreich–Lempel (1985) RSA-trapdoor protocol:

Sender publishes RSA (N, e, d) and two random blinds x₀, x₁
Receiver picks b, random k, sends v = (x_b + k^e) mod N
Sender computes k'₀=(v−x₀)^d mod N,  k'₁=(v−x₁)^d mod N
   → exactly one of these equals the receiver's real k
Sender sends c₀=(m₀+k'₀) mod N,  c₁=(m₁+k'₁) mod N
Receiver recovers m_b = (c_b − k) mod N

The trapdoor — only the sender's private exponent d can invert v−x_b back to k; for the unchosen index, (v−x_{1-b})^d mod N lands on an unpredictable value neither party controls.
Sender-blindness — v is a single number derived from whichever x_b the receiver used; it is statistically indistinguishable whichever branch produced it, so the sender cannot tell b from v alone.
Receiver-blindness — the receiver can only invert c_b (it knows k for that branch); c_{1-b} is masked by a k it never computed and cannot separate from m_{1-b}.
A production system would hash k before masking (m ⊕ H(k)) rather than adding it directly, to avoid any algebraic relation between the two ciphertexts — this demo keeps the raw modular arithmetic visible for teaching.

Public blinds x₀, x₁ Receiver's response v Masked ciphertexts c₀, c₁ Recovered secret

⚠ Couldn't load the 3D engineThree.js failed to load from the CDN. Check your connection and reload.