Oblivious Keyword Search - eprint.iacr.org.pdfVIP

Oblivious Keyword Search Wakaha Ogata1 Kaoru Kurosawa2 1Tokyo Institute of Technology, 2-12-1 O-okayama, Meguro-ku, Tokyo 152-8552, Japan wakaha@ss.titech.ac.jp 2 Ibaraki University, 4-12-1 Nakanarusawa, Hitachi, Ibaraki, 316-8511, Japan kurosawa@cis.ibaraki.ac.jp Abstract. In this paper, we introduce a notion of Oblivious Keyword Search (OKS). Let W be the set of possible keywords. In the commit phase, a database supplier T commits n data. In each transfer subphase, a user U can choose a keyword w ∈ W adaptively and find Search(w) without revealing w to T , where Search(w) is the set of all data which includes w as a keyword. We then show two efficient protocols such that the size of the commit- ments is only O(nB) regardless of the size of W , where B is the size of each data. It is formally proved that U learns nothing more than Search(w) and T gains no information on the keywords which U searched for. We further present a more efficient adaptive OT n protocol than the previous one [19] k as an application of our first OKS protocol. Keywords: oblivious transfer, blind signature, oblivious polynomial evalu- ation. 1 Introduction 1.1 Background The notion of oblivious transfer (OT ) was introduced by Rabin [22]. It has many flavors such as 1-out-of-2 OT (OT 2 ) [13], 1-out-of-n OT (OTn ), under 1 1 the name of ANDOS [5, 6], adaptive k-out-of-n OT (adaptive OTn ) [19], and k 1 oblivious polynomial evaluation (OPE) [18]. Each of them is a two party