Direct Reduction of String (1, 2)-OT to Rabin’s OT Kaoru Kurosawa Department of Computer and Information Sciences, Ibaraki University, 4-12-1 Nakanarusawa, Hitachi, Ibaraki, 316-8511, Japan. Email: kurosawa@mx.ibaraki.ac.jp Takeshi Koshiba Division of Mathematics, Electronics and Informatics, Graduate School of Science and Engineering, Saitama University, 255 Shimo-Okubo, Sakura, Saitama 338-8570, Japan. Email: koshiba@tcs.ics.saitama-u.ac.jp Abstract It is known that string (1, 2)-OT and Rabin’s OT are equivalent. However, two steps are required to construct a string (1, 2)-OT from Rabin’s OT. The first step is a construction of a bit (1, 2)-OT from Rabin’s OT, and the second step is a construction of a string (1, 2)-OT from the bit (1, 2)-OT. No direct reduction is known. In this paper, we show a direct reduction of string (1, 2)-OT to Rabin’s OT by using a deterministic randomness extractor. Our reduction is much more efficient than the previous two-step reduction. Keywords: Oblivious Transfer, Reduction 1 Introduction Suppose that Alice (database company) has two secret strings, s 0 and s 1 . Bob (user) wants to buy one s c of them. But he wants to keep his privacy. That is, it must be that Alice does not know which one Bob bought. On the other hand, Alice wants to keep her privacy. That is, it must be that Bob does not know s 1-c . A two-party protocol which realizes the above goal is called a string (1, 2)-OT. The protocol is called a bit (1, 2)-OT if s 0 and s 1 are single bits. On the other hand, suppose that Alice wants to send a mail to Bob. However, the mail system is so bad that Bob receives the mail with prob- 1