Thomas Agrikola
email: thomas.agrikola@kit.edu

Geoffroy Couteau
email: geoffroy.couteau@irif.fr

Sven Maier
email: sven.maier@kit.edu

Sven ⋆⋆

Maier

Anonymous Whistleblowing over Authenticated Channels

The goal of anonymous whistleblowing is to publicly disclose a message while at the same time hiding the identity of the sender in a way that even if suspected of being the sender, this cannot be proven. While many solutions to this problem have been proposed over the years, they all require some form of interaction with trusted or non-colluding parties. In this work, we ask whether this is fundamentally inherent. We put forth the notion of anonymous transfer as a primitive allowing to solve this problem without relying on any participating trusted parties. We initiate the theoretical study of this question, and derive negative and positive results on the existence of such a protocol. We refute the feasibility of asymptotically secure anonymous transfer, where the message will be received with overwhelming probability while at the same time the identity of the sender remains hidden with overwhelming probability. On the other hand, resorting to fine-grained cryptography, we provide a heuristic instantiation (assuming ideal obfuscation) which guarantees that the message will be correctly received with overwhelming probability and the identity of the sender leaks with vanishing probability. Our results provide strong foundations for the study of the possibility of anonymous communications through authenticated channels, an intriguing goal which we believe to be of fundamental interest.

Introduction

The term whistleblowing denotes "the disclosure by a person, usually an employee in a government agency or private enterprise, to the public or to those in authority, of mismanagement, corruption, illegality, or some other wrongdoing" [Whi]. Consider the following scenario. You are happily employed by some government agency. However, one day, you learn that your employer violates human rights. You strongly disagree with this breach of trust and law but you are bound by law to keep internal information secret. Consequently, you are faced with a dilemma: either you ignore the human rights violation, or you face dishonorable discharge or even jail. In fact, whistleblowers often take an immense personal risk, and face sentences ranging from exile [START_REF] Burrough | The snowden saga: a shadowland of secrets and light[END_REF] to incarceration [START_REF] Philipps | Reality winner, former nsa translator, gets more than 5 years in leak of russian hacking report[END_REF] or worse. Whistleblowing is crucial for democracy to educate the public of misdeeds and to call those in power to account. Therefore, it is desirable to cryptographically protect the identity of the whistleblower to allow a low-risk disclosure of wrongdoing.

The importance of this question is well recognized in cryptography and security. It has been the subject of several influential works (e.g. DC-nets [START_REF] Chaum | The dining cryptographers problem: Unconditional sender and recipient untraceability[END_REF], Riposte [START_REF] Corrigan-Gibbs | Riposte: an anonymous messaging system handling millions of users[END_REF] or Blinder [START_REF] Abraham | Blinder -scalable, robust anonymous committed broadcast[END_REF]). Concrete solutions include the use of secure messaging apps [CGCD + 20; Ber16], mix-nets [START_REF] Chaum | Untraceable electronic mail, return addresses and digital pseudonyms[END_REF], onion routing systems such as the Tor network [START_REF] Dingledine | Tor: the second-generation onion router[END_REF], or solutions built on top of DC-nets and secure computation techniques [CBM15; APY20] (see also [ECZ + 21; NSSD21]).

Yet, all current approaches to anonymous whistleblowing rely on trusted parties (or noncolluding partially trusted servers), which either receive privately the communication, or implement a distributed protocol to emulate an anonymous network. Therefore, however ingenious and scalable some of these solutions are, whistleblowers must ultimately trust that they will interact with parties or servers which will (at least for some of them) remain honest and refuse to collude throughout the transmission.

In this work, we ask whether this is fundamentally inherent, or whether anonymous whistleblowing is possible in theory without having to privately communicate with trusted parties. In its most basic form, the question we ask is the following: Is it possible for a whistleblower (who is communicating solely through authenticated point-to-point or broadcast channels) to publicly reveal some message m while remaining anonymous without assuming trusted participating parties?

We do allow a Common Reference String (CRS) for technical reasons, and stress that while it is technically also a trust assumption, it is much weaker; instead of trusting a set of parties every time to follow the exact protocol and to not cheat in any way, we only require a CRS to be set up once: A CRS that was successfully sampled just once can be used for all future interactions.

The above is, of course, trivially impossible if the whistleblower is the only communicating party. However, it becomes meaningful in a multiparty setting, where a number of parties (unaware of the intent of the whistleblower) exchange innocent-looking messages (think of a group of people having a conversation, or using some public messaging service like Twitter or Facebook to broadcast information). In this context, the question translates as follows: could the whistleblower somehow disguise its communication as an innocent-looking conversation with the other parties, such that the message m can be publicly extracted (by anyone) from the entire conversation, yet the identity of which party was indeed the whistleblower remains hidden? To our knowledge, this intriguing question has never been studied in the past. Our main contributions are threefold:

1. A definitional framework. We put forth a formal definition for a cryptographic primitive that realizes the above goal, which we call an Anonymous Transfer. We study the relation between variants of the notion. 2. Impossibility results. We prove a strong impossibility result: we show that Anonymous Transfer with overwhelming correctness and anonymity cannot be realized in any polynomial number of rounds, by exhibiting a general attack against any such protocol. This non-trivial result demonstrates that anonymously communicating over authenticated channels is impossible with standard cryptographic security levels, even assuming strong cryptographic primitives such as ideal obfuscation. 3. Feasibility result. We complement our impossibility result by an intriguing feasibility result:

we show that fine-grained Anonymous Transfer is possible assuming ideal obfuscation. The term fine-grained refers to cryptographic constructions which are only guaranteed secure against adversaries whose computational power is a fixed polynomial in the computing power of the honest parties (in our case, the gap is quadratic). Our instantiation is a plausible heuristic candidate when instantiating the ideal obfuscation by candidate indistinguishability obfuscation schemes.

Both our negative and positive results are highly non-trivial and require a very careful analysis. We view our work as addressing a fundamental question regarding the a priori possibility of secure whistleblowing without interacting with trusted parties, through the lens of anonymous communications over authenticated channels. Nevertheless, our study is of a purely theoretical nature, and does not have immediate practical relevance. In particular, we do not compare our results to the practical real-world methods which whistleblowers can employ.

Anonymous Transfer and plausible deniability. The fundamental goal of an Anonymous

Transfer protocol is to achieve plausible deniability: the whistleblower should be able to hide its identity among a group of parties, such that even if it is strongly suspected that he is the whistleblower, this cannot be proven -any party could equally be the whistleblower. Importantly, the involved parties are never required to be aware that a message is being transmitted: their consent or collaboration is not needed for the Anonymous Transfer to take place, and they themselves have no advantage in finding out who the whistleblower was.

Undetectable Secure Computation

Secure Multiparty Computation (MPC) allows a set of parties to jointly evaluate a function on their inputs without revealing these inputs. In certain scenarios, however, the standard guarantees of MPC become insufficient: the mere fact that a party is participating to a certain protocol already reveals information about that party. Consider for example the following scenario: your company was hacked, but you do not have enough forensic data to trace the attackers. If several companies fell victim to the same hacker, a joint effort may yield enough information to successfully trace the hacker. However, the very fact that you are initiating such a protocol reveals that your company has been hacked.

The notion of Covert Multiparty Computation (CMPC) [vHL05; CGO + 07] was introduced to cope with situations in which even revealing one's participation to the protocol is undesirable. CMPC allows a set of parties to securely compute a protocol among n parties with the following two guarantees: (1) If all parties are actually willing to participate in the protocol (and are not simply having innocent conversations), and if the output of the protocol was acceptable (which is specified by some function g of the joint input), then everyone learns the result of the protocol. (2) Otherwise (if at least one party was not participating, or the output was not acceptable), no one learns anything about who were the participating parties (or even whether there was any).

CMPC is a powerful strengthening of secure computation. However, it still has two important downsides: a single non-participating party is sufficient to make the entire protocol fail (no one gets any output), and when all parties participate, they all learn that they participated (hence, no one can deny anymore having participated in the protocol). One of the primary motivations behind the study of Anonymous Transfer, which we put forth in this work, is to open the avenue to the study of a significantly more powerful form of secure computation that provides the strongest deniability guarantees one can hope for: a secure computation protocol where, even after the successful protocol execution, no one learns who the participants were. Specifically, we consider the following setting: N individuals are interacting. Among them, k players are willing to jointly compute a public function f on their private inputs (x 1 , . . . , x k ), while the remaining (N -k) are not interested in taking part to the protocol (nor are even aware of the fact that a secure computation might be taking place). At the end of the protocol, the k participants should all receive the output, but no party should be able to find out which of the parties were actually participating. We call this strengthening of secure computation undetectable secure computation.

Since undetectable secure computation is stronger than Anonymous Transfer (which it implies), our impossibility results for Anonymous Transfer also translate to impossibility results for undetectable secure computation3 . Furthermore, building on our positive result, we show how to construct anonymous oblivious transfer (in the fine-grained security setting), a core building block for constructing undetectable secure computation for more general functionalities.

Defining Anonymous Transfer

An Anonymous Transfer (AT) protocol describes the interaction between a sender, a receiver and a non-participant. We assume all parties to interact in the synchronous model over a public broadcast channel, i.e., in each round each participant broadcasts a message which only depends on messages from previous rounds. The non-participant is not aware that a protocol takes place, and is only having an innocent conversation (we call them the "dummy player", or the "dummy friend"). We follow [vHL05; CGO + 07] and model non-participating parties as parties that only broadcast uniform randomness in each round, since any ordinary communication pattern can be viewed as an embedding of the uniform distribution due to standard techniques [vHL05;[START_REF] Hopper | Provably secure steganography[END_REF][START_REF] Von Ahn | Public-key steganography[END_REF]. The sender aims to transmit a message to the receiver in a way that does not leak its identity (the notion easily generalizes to more non-participating parties). We say that an AT protocol is ε-correct if the probability that the receiver successfully receives the message is at least ε. Further, we say that an AT protocol is δ-anonymous if no adversary is able to determine the identity of the sender (given the transcript and the receiver's random tape) with advantage more than (1 -δ)/2 over guessing. These are the core properties which shape an AT protocol. If the protocol allows the receiver to remain silent throughout the protocol execution, sending a message corresponds to publicly revealing the message (i.e., whistleblowing). Eventually, we call fine-grained AT an Anonymous Transfer, where anonymity is only required to hold against adversaries from a restricted complexity class (typically, adversaries whose runtime is bounded by a fixed polynomial in the runtime of the honest parties).

Impossibility Result

Our first main result shows that AT is impossible in a strong sense.

Theorem 1 (Impossibility of AT, informal).

There is no Anonymous Transfer protocol with overwhelming correctness and anonymity, with any polynomial number of rounds and any number n ≥ 1 of non-participating parties, even for transmitting a single bit message.

Our proof proceeds in several steps. First, we show that any Anonymous Transfer for transmitting a single bit with n non-participants, with overwhelming correctness and anonymity implies (in a black-box way) a silent-receiver Anonymous Transfer (where the receiver never speaks) for transmitting κ bits (where κ is some security parameter) with a single non-participating party. This reduction uses a relatively standard indistinguishability-based hybrid argument.

Then, the core of the proof rules out the existence of κ-bit silent-receiver 1-non-participant Anonymous Transfer with overwhelming correctness and anonymity. The key intuition is the following: let P 0 , P 1 be the two parties interacting with the receiver, where P b is the sender, and P 1-b is the non-participant. Let Π κ AT be the protocol which these two parties execute, and assume that it satisfies ε-correctness and δ-anonymity. Suppose that during their interaction, the parties produce a transcript π. We consider an adversary A which replaces the last message of P 0 by a random value, before running the receiver algorithm to reconstruct the transmitted message. Then if b = 1, the adversary just replaced the last (random) message of the non-participating party by another random message, and the transcript is still a perfectly valid transcript for Π κ AT , hence the reconstruction algorithm must still output the right string Σ with overall probability ε. On the other hand, if b = 0, then the transcript is a valid transcript for a "round-reduced" version of Π κ AT , where the last round is replaced by two random messages. By the δ-anonymity, A should not distinguish between the two situations with advantage better than (1 -δ)/2. This implies that the correctness of the round-reduced protocol cannot be much lower than ε, hence that we constructed a δ-anonymous (c -1)-round protocol with non-trivial correctness guarantees. Then, A keeps repeating this procedure until we reach a 0-round protocol, which cannot possibly have any non-trivial correctness guarantee.

While the above provides an intuition of the approach, the real strategy is much more involved. In particular, using A to distinguish between a random transcript of Π κ AT and a random round-reduced transcript does not suffice to rule out arbitrary polynomial-round protocols (more precisely, it would only rule out logarithmic-round protocols, since the correctness guarantees would decrease roughly by a factor two at each step of round reduction). Instead, A will replace independently the last message of each party by a random value, getting two distinct transcripts (π 0 , π 1 ). Then, A attempts to distinguish whether π 0 is a transcript of Π κ AT and π 1 is a round-reduced transcript, or the other way around. While this is the proper way to attack the protocol, the analysis is more involved, since now π 0 , π 1 are not independent random variables anymore, as they share a common prefix (the transcript of the first c -1 rounds). Nevertheless, a more careful analysis shows that this dependency cannot significantly lower the distinguishing probability of A.

In Section 4.3 we further prove that no AT protocol for N > 3 parties with overwhelming correctness and anonymity can exist unless a N = 3-party protocol exists with overwhelming correctness and anonymity-which cannot exist. It suffices to prove that any N -party Silent Receiver AT for N > 3 implies a (N )-party "normal" (i.e. with an actively participating receiver) AT, without losing the overwhelming correctness and anonymity in the process.

Intuitively, the receiver does not broadcast any messages in the N -party protocol; all communication comes from the (N -1) potential senders. We construct an (N -1)-party protocol by letting the receiver play one non-participant, with the one difference being that this party is known not to be the sender (since it is the receiver); the sender can only be one of the (N -2) other parties. While the correctness remains unaffected, the anonymity decreases due to the fact that guessing with one party less yields better results; yet we show that the anonymity still remains overwhelming in the security parameter. We then transform any N -party AT to an N -party SR-AT as described above and that to a (N -1)-party AT, until we have a 3-party AT that, assuming that the N -party AT has overwhelming anonymity and correctness, maintains these properties.

On a high level, this process lets the actual participants simulate non-participants behavior in their head; one-by-one their random tape is moved to the CRS until only three parties are left: a sender, a receiver, and a non-participant.

Our negative result applies to a weak model. In particular, non-participants are modeled to be semi-honest. Hence, our negative result does not leave much room for positive results.

A Candidate Fine-Grained Anonymous Transfer

To circumvent the above impossibility result, we need to give up asymptotic security and resort to the fine-grained setting: We only require anonymity against adversaries which require polynomially-quadratically, in our case-more resources than an honest protocol execution.

That is, our second main result shows that (perhaps surprisingly) non-trivial AT is indeed possible in a weaker setting:

Theorem 2 (Feasibility of AT, informal). Let N = 3 be the number of individuals. Assuming ideal obfuscation, for any anonymity δ, there is a c-round Anonymous Transfer protocol Π 1 AT (for ℓ bit messages) that has overwhelming correctness, where anonymity δ holds against any adversary A with runtime ≪ c 2 .

That is, for our second main contribution we propose a protocol which-assuming ideal obfuscation-allows to reduce the problem of de-anonymizing the sender to a distribution testing problem. More precisely, we show that determining the real sender in a c-round protocol given only a transcript of the AT protocol is as hard as differentiating between two Bernoulli oracles, where one returns 1 with probability p and the other returns 1 with p + 1/(2c). For this distribution testing problem, strong lower bounds on the number of required samples and thus the adversarial runtime are known.

The protocol proceeds in rounds, where each honest message from the sender gradually increases the probability that the transmitted bit is correctly received. The sender first encrypts a verification key that is to-be-used be the obfuscated circuit, and in each successive round the sender encrypts the bit and a signature on both messages from the previous round to limit the ability of the adversary to manipulate the transcript when attacking anonymity. The non-participant only broadcasts random bits in each round. The Common Reference String contains an obfuscated program with hard-coded keys for the pseudorandom encryption scheme. The circuit checks the validity of the signatures of each round. Each consecutive valid round increases the confidence in the transmitted bit. Finally, the circuit outputs random bit according to the confidence gained. If all rounds are valid, the correct bit will be output with probability 1, if no round is valid, the correct bit will be output with probability 0.5.

While the high level intuition of the protocol is relatively clear, its exact instantiation is particularly delicate -any small variant in the design seems to open the avenue to devastating attacks. Furthermore, its analysis relies on long and complex hybrid arguments that progressively reduce the advantage of the adversary to contradictions with respect to known distribution testing bounds with a limited number of samples. In order not to disturb the general reading flow, most of the proof is deferred to the Appendix.

Our proof can be split in two parts. The first part exploits properties of the encryption schemes, the signature scheme, and ideal obfuscation to prove indistinguishability (against even PPT adversaries) between the actual protocol and a hybrid, where all reported messages are truly random and independent from the sender and the transferred bit, and the obfuscated circuit only counts how many input messages are identical to those from the challenge transcript.

This game still contains information on the sending party as it treats those messages differently. To remove this dependency, we resort to distribution testing and view the obfuscated circuit as a Bernoulli oracle which follows one of two (known) distributions, and where the goal is to determine which one.

Discussions and Implications

In this section, we further discuss some implications and relations of our results to the literature.

'Philosophical implications:' between obfustopia and impossibilitopia.

There is a small remaining gap between our negative and positive results: the possibility of building anonymous transfer secure against arbitrary polytime adversaries, but with non-negligible (e.g. inverse polynomial) anonymity error remains open. Closing this gap would have an intriguing philosophical consequence: stretching the terminology of Impagliazzo on the "worlds" of cryptography, it would establish the existence of a cryptographic primitive that plausibly exists in obfustopia (the world where indistinguishability obfuscation is possible) in the fine-grained setting, yet does not exist ("reside in impossibilitopia") with standard hardness gaps. Interestingly, there are several known examples where fine-grained constructions of a "higher world" primitive reside in a lower world; for example, (exponentially secure) one-way functions (a Minicrypt assumption) imply fine-grained public-key encryption (a Cryptomania assumption). Our work seems to provide a new example of this behavior, at the highest possible level of the hierarchy, showing that impossible primitives might end up existing if we weaken their security to the fine-grained setting.

Relation to the anonymous whistleblowing literature. We clarify how our (positive and negative) results relate to the literature on anonymous broadcast and secure whistleblowing. In general, a whistleblower willing to reveal something anonymously has two alternative choices: (1) the whistleblower has access to an anonymous communication channel, for example by putting their message (say, encrypted with the receiver public key) on some public website that somehow cannot be traced to them. However, access to an anonymous channel is typically a 'physical' assumption, and one which is very hard to guarantee. This issue is developed in great detail in the literature: see for example the discussion in Spectrum [NSSD21] about how metadata have been used by federal judges to trace and prosecute people who leaked data through secure messaging apps, or the discussion in Riposte [START_REF] Corrigan-Gibbs | Riposte: an anonymous messaging system handling millions of users[END_REF] and Express [ECZ + 21] on how traffic analysis can be used to trace whistleblowers on the Tor network or the SecureDrop service. Hence, most of the literature focuses on scenario (2): the individuals interact over a communication network, and we do not assume that this network guarantees anonymity in itself. In this case, what we want is to emulate this anonymity, by developing a strategy to help the whistleblower transmit a message anonymously to the receiver.

The literature on this subject is incredibly vast, but this emulated anonymity is always achieved using the same template in all solutions we are aware of (including Spectrum, Blinder, Riposte, Express, Talek, P3, Pung, Riffle, Atom, XRD, Vuvuzela, Alpenhorn, Stadium (or any other Mixnetbased solution), Karaoke, Dissent, Verdict, and many more): when the whistleblower wants to anonymously transmit a message, either to everyone (anonymous broadcast) or to a target receiver, other users generate 'honest' traffic in which communications can be hidden. To do so, the users interact with a set of non-colluding servers (sometimes two servers, sometimes more, some with honest majority, some without). This is never even discussed or remarked: it is taken as an obvious fact that this is the structure of an anonymous broadcast (or messaging) protocol. And indeed, the need to generate honest traffic feels clear -if the whistleblower is the sole sender, observing traffic directly leaks their identity. That the use of non-colluding servers was never challenged or even discussed probably means that it also feels clear -but this assumption is precisely what we challenge in our work: we do assume that some users generate honest traffic, but we ask whether the assumption of non-colluding participating servers is avoidable. Of course, any scientific treatment of a broad question ('are non-colluding helpful participants required for anonymous broadcast?') is bound to move from the broad question to a formal model, in which (feasibility or impossibility) results can be achieved. Nevertheless, we believe that our impossibility result demonstrates that the use of non-colluding servers in all previous works was indeed unavoidable, at least insofar as their aim was to achieve anonymity against arbitrary polynomial-time adversaries.

Non-participating parties versus malicious parties. Our choice of formalism, with the notion of anonymous transfer, allows to study whether the assumption of honest, non-colluding, participating servers can be replaced by a considerably weaker trust assumption: that of nonparticipating parties, not trying to take part to the protocol in any way (and not even required to be aware of the execution of the protocol) beyond generating traffic. As we show, this weaker assumption does not suffice against arbitrary polynomial-time adversaries, but possibly suffices against bounded polynomial-time adversaries (where the bound is sub-quadratic). As a natural next step, one could push the question even further and ask: what if some of the non-participating parties were in fact planted by a malicious adversary, and now play maliciously during the protocol? It seems plausible, that our general strategy can be extended to deal with malicious non-participants. However, we expect the analysis to require different techniques than the ones we used. We leave a formal proof of this to future work.

Further Results and Open Questions

In Appendix F, we extend our fine-grained AT such that it transfers ℓ-bit messages directly. To achieve the same level of security as the single-bit AT, this only stretches the number of required rounds by a factor of 2. In Appendix E, we provide an asymptotically secure AT instantiation in the designated-sender setting which achieves non-trivial but not useful parameters for ε and δ. In Section 6, we define an extension of AT called Strong AT which we require for Undetectable Computation. We define our novel primitive Undetectable Oblivious Transfer in Section 6 which allows two parties to hide their OT execution in a group of N individuals and instantiate it using strong AT in Appendix G. Finally, in Section 7 we provide definitions for Undetectable Multiparty Computation, which allows a number of k parties to perform an MPC protocol while hiding their identities among N individuals and instantiate UMPC using Undetectable Oblivious Transfer for k = 3.

Our work leaves open two exciting questions:

(1) Can our impossibility result for asymptotically secure AT with overwhelming correctness and anonymity be extended to rule out asymptotically secure AT with anonymity 1 -1/poly(κ)? (2) Is it possible to instantiate AT in the fine-grained setting from "Obfustopia" standard assumptions achieving similar parameter as our instantiation?

Given that both our open questions can be answered affirmatively, this would separate the realm of asymptotic security from the realm of fine-grained security.

Acknowledgements

We thank Rafael Pass for insightful comments and contributions to early stages of this work.

Preliminaries

Notations

For any party P we denote by T P the random tape of P.

For events (A, B), Ā denotes the complementary even of A, Pr[A | B] denotes the probability of A happening conditioned on B happening. For values (a, b), the notation a = b denote the bit value of the corresponding predicate. We let κ be a security parameter; we write negl(κ) to denote any function negligible in κ and owhl(κ) to denote a function overwhelming in κ (that is, 1 -owhl(κ) = negl(κ)). For any probability distribution D, we denote by Supp(D) the support of D, and by x $ ← D we denote that x is uniformly sampled from D. For probability distributions p and q we write p ⊗t as the distribution arising from taking t sample from p, and p • q as the distribution obtained by sampling one time from p and one time from q. We write ∥p∥ 1 to denote the L 1 norm of p.

For two bitstrings A, B ∈ {0, 1} m , A ⊕ B denotes the bitwise XOR of A and B. We write by [n] for n ∈ N the set of numbers {1, . . . , n}.

A c-round protocol between k parties is defined as the evaluation of the parties' next message algorithms on input of all previously exchanged messages. The output of the protocol is the emerging transcript.

{0, 1} m , where in each round, parties broadcast:

a 1 := P 1 (x; r 1,1 ) a 2 := P 2 (x; r 2,1 )
. . .

a k := P k (x; r k,1 )
a k+1 := P 1 (x, a 1 , . . . , a k ; r 1,2 ) . . .

a 2k := P k (x, a 1 , . . . , a k ; r k,2 ) . . . a c•k := P k (x, a 1 , . . . , a c•k-1 ; r k,c )
and r i,j is the random tape used by P i in round j. We write

⟨P 1 , . . . , P k ⟩(x; r 1,1 ∥ . . . ∥r 1,c , . . . , r k,1 ∥ . . . ∥r k,c )
to make the used random tape of the parties explicit.

At the end of this document we provide a comprehensive list of symbols and acronyms alongside a detailed glossary.

Steganography

Informally, steganography describes the art of hiding information in such a way, that no outsider is able to even notice that any information is hidden at all. The concept has been around for a long time, yet it was first brought up as a field of scientific research by Simmons [START_REF] Simmons | The prisoners' problem and the subliminal channel[END_REF] and put into a more complexity-theoretic and cryptographic context by Hopper, Langford, and von Ahn [START_REF] Hopper | Provably secure steganography[END_REF]. Simmons [START_REF] Simmons | The prisoners' problem and the subliminal channel[END_REF] described the problem analogously to prison communication: Two prisoners can talk to each other and want to come up with an escape plan, but a warden hears everything they say. The problem of steganography can roughly be described by the following question: How can the two prisoners discuss their escape plan without the warden noticing that the two prisoners are up to something? While it is true that in most scenarios, the two prisoners could simply encrypt their messages and discuss their escape plan through a secure channel, this method is insufficient for the scenario where a warden is present: If the warden notices that the two prisoners are up to something, they end up in solitary confinement. Thus the problem is much harder than the one considered in classical encryption, as the actual communication itself needs to be undetectable for the warden. In contrast, it suffices for classical encryption schemes if any other person can detect messages as long as they are unable to decrypt them. We consider the differentiation to be similar to the one between Multiparty Computation and Covert Multiparty Computation, where the former only hides information whereas the latter hides the entire execution.

A steganographic channel is modeled as indistinguishable from the uniform channel over m bits [START_REF] Hopper | Provably secure steganography[END_REF][START_REF] Von Ahn | Public-key steganography[END_REF]vHL05], where each party broadcasts uniformly random bitstrings of length m. This is neither a restriction nor an additional trust assumption: steganographic methods use actual sources of randomness like the least significant bit in timestamps or the least significant bits of images (where minor differences can occur due to the noise induced by the camera) that follow two basic rules: (1) when naturally occurring, they are uniformly random, and (2) it is efficiently possible by a sender to change this source such that it has a target value, without acting in a noticeably different way. A random source is suitable for steganography if it fulfills both these requirements: Unaware parties unknowingly broadcast random bits automatically, while sending parties can efficiently embed any message.

As a practical example that not only motivates how steganography can be used in practice, but also illustrates the fact that the natural messages are indistinguishable from a sampling of the uniform channel, think of a public forum where all registered parties can post images of cats. Each post has its timestamp attached (in UNIX-time, i.e., seconds since the first of January in 1970), which is set by the sender during the upload and not by the server. As such, this can be exploited as a steganographic channel: in this (arguably inefficient) steganographic channel the timestamps of each post encodes a single bit, which can be extracted directly by taking the least significant bit of the timestamp.

It is easy to see that under normal circumstances, people who are unaware of the fact that the steganographic channel exists and who only upload images whenever they feel like it can be modeled as parties that only broadcast random bits. Furthermore, the delay of up to one second ends up unnoticed, so it is possible to covertly embed a message by manipulating the least significant bit of the timestamp.

Even though in such forums it might not be the case that all parties send the same number of messages, which might be required if we execute a protocol over several rounds by embedding (random looking) messages into the steganographic channel as was done by von Ahn, Hopper, and Langford [vHL05]), this does not pose a restriction. If party P i has finished a given round by publishing m bits, while P j still only published m ′ < m bits, P i continues as normal and publishes images at arbitrary timestamps until all other parties also broadcast m bits. The protocol then only considers the first m messages for each party in each round and ignores all other messages of the resp. parties until the next round starts.

Distribution Testing

In this section, we introduce preliminaries for probability testing. We start by describing the Total Variational Distance between two distributions.

Definition 2 (Total Variational Distance). Let p and q be two probability distributions over the countable set of possible outcomes Ω. The total variational distance between p and q is defined as:

d TV (p, q) := 1 2 ω∈Ω |p(ω) -q(ω)| = 1 2 ∥p -q∥ 1 (1)
An important property of the total variational distance is that it acts sublinear when taking many samples. When taking t samples from a Bernoulli distribution the corresponding distribution can be described by taking a single sample from a t-bit Binomial distribution. The sub-additivity then bounds the total variational distance of the corresponding binomial distribution:

Lemma 1 (Total variational distance of a t-fold probability distribution, folklore). Let p and q be two Bernoulli distributions with total variational distance d TV (p, q). Then it holds for the binomial distributions p ⊗t and q ⊗t that result from sampling t times from the respective distributions:

d TV (p ⊗t , q ⊗t ) ≤ t • d TV (p, q) (2)
Thus we can bound the distinguishing advantage of any distinguisher who has taken t samples form the same oracle using the total variational distance of the respective distributions directly.

A similar rule also holds for two different distributions, where the distinguisher has to distinguish whether two samples originate from p ⊗ r or from q ⊗ s for known values of p, q, r and s. In this case the rule states that: Lemma 2 (Sub-Additivity of the Total Variational Distance for Product Distributions, folklore). Let p and q be a probability distribution over {0, 1} m with total variational distance d TV (p, q). Let r and s be two Bernoulli distributions with total variational distance d TV (r, s). Then it holds for the distribution derived from sampling from each distribution once and concatenating the outputs (which yields a sample from {0, 1} m+1 originating either from p • r or q • s) that

d TV (p • r, q • s) ≤ d TV (p, q) + d TV (r, s)
The following lemma limits the distinguishing advantage of any distinguisher that tries to distinguish two distributions p and q based on a single sample.

The Model

Let b ∈ {1, • • • , N -1} denote the index of the sender and let Σ ∈ {0, 1} ℓ be the message that P b wants to transfer to the receiver. We consider an interactive protocol in the Common Reference String (CRS) model between N players (P 1 , • • • , P N -1 , R), where R and P b participate in the protocol, and P i for i ̸ = b are non-participating but present players that only broadcast random strings. The receiver R gets the CRS as input and the sender P b gets the CRS and the message Σ as input. For any player P, let T P denote the random tape from which P draws his random coins. The players interact through authenticated broadcast channels in the synchronous model: the protocol proceeds in rounds, and each player broadcasts a message at each round. We denote by ⟨R, P 1 , • • • , P N -1 ⟩(crs, b, Σ) the distribution of the possible transcripts of the protocol in this setting (i.e., the sequence of all messages broadcasted by the players during an execution of the protocol), where the probabilities are taken over the random coins T P of the players P ∈ {R, P 1 , • • • , P N -1 } and the random choice of the CRS crs.

Definition 3 ((ε, δ, c, ℓ)-Anonymous Transfer

). An N -party (ε, δ, c, ℓ)-Anonymous Transfer (AT) for ε, δ ∈ R [0,1] and N , c, ℓ ∈ N (all possibly functions in κ) is a tuple containing three PPT algorithms (Setup, Transfer, Reconstruct). The number of rounds in the Transfer protocol is given as c and the bitlength ℓ defines the length of the transferred message Σ. The algorithms are defined as follows:

Setup(1 κ ) takes as input the security parameter 1 κ in unary encoding and outputs a Common Reference String crs.

Transfer(crs, b, Σ) defines a c-round protocol4 that takes as input the Common Reference String crs, an index b ≤ N -1 specifying the sender, and the message Σ ∈ {0, 1} ℓ from the sender and outputs a transcript π. The non-sender sends independent uniformly distributed noise in each round. All protocol messages sent by the receiver, the sender and the non-participating parties at each round are bitstrings of length m = m(κ), where m is implicitly specified by the Transfer protocol. Reconstruct(crs, π, T R ) is a local algorithm executed by the receiver that takes as input the CRS crs, the protocol transcript π and the receiver's random tape T R and outputs a message Σ ′ .

The algorithms additionally satisfy the ε-correctness and the δ-anonymity properties defined in Definitions 4 and 5.

Definition 4 (ε-Correctness). For any sufficiently large security parameter κ, for any number of individuals N ∈ poly(κ), for any participant b ∈ [N -1], for any message length ℓ ∈ poly(κ), for any message Σ ∈ {0, 1} ℓ , and for any CRS crs ← Setup(1 κ ), an Anonymous Transfer protocol Π ℓ AT between players (P 1 , . . . ,

P N -1 , R) is ε-correct if the following holds: Pr π $ ← Transfer ⟨R,P1,...,P N -1 ⟩ (crs, b, Σ) Σ ′ ← Reconstruct(crs, π, T R ) : Σ = Σ ′ ≥ ε (3)
Note that ε can take on any value between 0 and 1. The naive algorithm that lets the receiver sample a uniformly random ℓ-bit string has ε = 1/2 ℓ . Definition 5 (δ-Anonymity). For any PPT algorithm A = (A 0 , A 1 ), for all sufficiently large security parameters κ, for any number of individuals N ∈ poly(κ), and for any message length ℓ ∈ poly(κ), an Anonymous Transfer protocol Π ℓ AT between players (P 1 , . . . ,

P N -1 , R) is δ-anonymous if it holds that Pr b $ ←[N -1] Exp anon Π ℓ AT ,A,b (κ) = b - 1 N -1 ≤ (1 -δ) • N -2 N -1 (4)
where Exp anon Π ℓ AT ,A,b (κ) is defined in Fig. 1. The value δ can take any value between 0 and 1. The higher δ the stronger the provided anonymity guarantees. If a protocol is δ = 1-anonymous, the advantage over guessing at random equals 0, and if a protocol is δ = 0-anonymous, the advantage over guessing at random equals 1. The right-hand-side of Definition 5 contains a scaling factor of (N -1)/(N -2). This is due to the fact that even under perfect anonymity (δ = 1), the receiver can still guess the sender. Knowing that one of the N parties-namely itself-is not the sender, there are (N -1) potential senders, of which (N -2) are just dummy friends. Thus, the probability of guessing wrong is given by the aforementioned factor.

Note that we require anonymity to hold, in particular, against the receiver. Therefore, the adversary in the anonymity game may know the receiver's random tape T R from the beginning.

The guessing algorithm is split between A 0 who is given the CRS and the random tape T R the receiver is going to use during the protocol, and outputs the target message Σ that should be transferred and a state st. In the second phase, the algorithm A 1 which is given the inputs π and the state.

Unless stated otherwise, we consider the case N = 3, i.e., one non-participant.

Fine-grained Anonymous Transfer

Fine-grained cryptographic primitives are only secure against adversaries with an a-priori bounded runtime which is greater than the runtime of the honest algorithms, [START_REF] Merkle | Secure communications over insecure channels[END_REF][START_REF] Degwekar | Fine-grained cryptography[END_REF]. We use the notion of [START_REF] Degwekar | Fine-grained cryptography[END_REF]. In the following, C 1 and C 2 are function classes. Example 1 (Merkle-Puzzles). Merkle-Puzzles [START_REF] Merkle | Secure communications over insecure channels[END_REF] are a fine-grained protocol to exchange a shared key from symmetric encryptions where successful encryptions can be efficiently distinguished from false ones. The sender S creates n mer many ciphertexts, each under a different (relatively short) key, containing a unique identifier and a symmetric key. The receiver R then randomly picks one of the ciphertexts and runs a brute-force attack (which we assume to cost m mer many steps) to recover the key and to send the identifier back to the sender.

Exp anon Π ℓ AT ,A,N ,b (κ) crs $ ← Setup(1 κ ) T R $ ← {0, 1} poly(κ) (Σ, st) ← A0(crs, T R ) π $ ← Transfer ⟨R,P1,...,PN-1⟩ (crs, b, Σ; T R , •, •) return A1(π, T R , st)
Here C 1 := O(n mer + m mer ) as the sender has to create n mer puzzles and the receiver must use m mer steps to break one of them, and C 2 := O(n mer • m mer ) as an adversary has to break at worst all the n mer ciphertexts to recover the key.

Trivial Anonymous Transfers

For simplicity, we focus on 3-party anonymous transfer in the following discussions, with two players P 0 , P 1 and a receiver R.

Remark 1 (Perfect correctness.). A perfectly correct (i.e. ε = 1) protocol is impossible. Given a player P b with input Σ, there is always a probability that the non-participating player P 1-b behaves exactly as a participating player with input Σ ′ ̸ = Σ, in which case R cannot obtain the correct output for sure.

Therefore, the best one can hope for is a correctness statistically close to 1. In the following, we demonstrate ATs with trivial parameters.

Example 2 (Trivial single-bit AT). Consider the following trivial single-round AT to transfer a single bit σ: P b broadcasts his input σ (and P 1-b broadcasts a random bit). Upon receiving (σ 0 , σ 1 ) from P 0 and P 1 , if σ 0 = σ 1 , R outputs σ 0 ; otherwise, R outputs a uniformly random bit. As P 1-b broadcasts a random bit, it holds that σ 0 = σ 1 with probability 1/2, in which case R obtains the correct output σ = σ b ; else, R obtains the correct output with probability 1/2. Overall, R obtains the correct output with probability 3/4. The protocol is 1/2-anonymous since the adversary knows the message to be transmitted and can hence determine the sender whenever the transmitted bits are distinct and guess with probability 1/2 otherwise. Hence, the above protocol is a (3/4, 1/2, 1, 1)-AT.

Example 3 (Trivial ℓ-bit AT). One can also construct a trivial ℓ-bit AT. To transmit a message Σ ∈ {0, 1} ℓ : P b simply sends Σ repeated κ times. Clearly, (not only) R finds out both Σ and b with overwhelming probability. Hence, the above protocol is a (1 -negl(κ), negl(κ), κ • ℓ, ℓ)-AT.

In this work, we study whether ATs with non-trivial parameters can exist.

Reductions Among AT Protocols

In this section, we show that several simplified variants of anonymous transfer are equivalent to the original definition.

AT implies silent-receiver AT. We say that an anonymous transfer has silent receiver if the receiver never sends messages during the Transfer protocol, and Reconstruct is a deterministic function of the CRS and the transcript π. Any AT directly implies a silent-receiver AT with the same parameters for correctness and anonymity, but at the cost of secrecy: Any (non-)participant is able to reconstruct the message given only the transcript of broadcasted messages, not just the receiving party of the protocol, which might be undesirable for practical applications. Let Π ℓ AT be a (ε, δ, c, ℓ)-Anonymous Transfer. Define the silent-receiver AT Π ℓ SR as follows: The notion of silent receiver AT captures the notion of an anonymous transfer whose aim is to publicly reveal a message (i.e., whistleblowing) rather than sending it to a single receiver. An other way to look at it is to consider that the silent receiver transformation can be seen as passive to active security transformation for the receiver: If there is a secure AT protocol against a passive receiver, then there is a secure silent receiver AT against an active receiver, simply because the receiver has no option to cheat as no messages are sent.

Π ℓ SR .Setup(1 κ ) runs crs ← Π ℓ AT .

Lemma 4. Π ℓ

SR is an (ε, δ, c, ℓ)-Anonymous Transfer.

Proof (sketch). Correctness and number of rounds follow directly from the description of Π ℓ SR , which simply mimics Π ℓ AT , except that the random tape of the receiver is made public, and its messages are computed on the fly locally by the sender and during the reconstruction. Anonymity follows also immediately by observing that T R is given to the adversary in the anonymity game, hence making it public cannot harm anonymity.

⊓ ⊔

Since the converse direction is straightforward, AT and silent receiver AT are therefore equivalent.

Single-bit AT implies many-bit AT.

In this section, we analyze how a single-bit AT can be generically transformed into an AT which allows to transmit bitstrings. We construct an ℓ-bit AT by executing the single-bit AT ℓ times (sequentially) to transmit the message bit-by-bit. Let Π 1 AT be a C 1 -fine-grained-(ε, δ, c, 1)-Anonymous Transfer against C 2 . Further, let Π ℓ AT be the protocol which uses ℓ instances of Π 1 AT to transmit ℓ-bit messages bit-by-bit. We analyze Π ℓ AT using the fine-grained definition. The results directly apply using asymptotic security.

Lemma 5. Let Π 1 AT be a C 1 -fine-grained (ε, δ, c, 1)-Anonymous Transfer against C 2 . Then, the protocol Π ℓ AT is a C ′ 1 := C 1 • ℓ-fine-grained ε ′ , δ ′ , c • ℓ, ℓ -AT against C ′ 2 := C 2 -ℓ • C 1 , where ε ′ = ε ℓ and δ ′ = (δℓ -ℓ -δ + 2). 5 Proof. For Σ ∈ {0, 1} ℓ , we have ε ′ = Pr crs,π,Σ ′ [Σ = Σ ′ ] = ε ℓ .
For the purpose of avoiding notational overhead, we prove anonymity for N = 3 parties, i.e., for one non-participant. The general case follows by generalizing notation. Let A be an adversary against the anonymity of Π ℓ AT . We define a sequence of hybrid games H 1 , .

T ′ R := (T R,1 , . . . , T R,ℓ ) ← ({0, 1} poly(κ) ) ℓ (Σ, st A ) ← A0(crs ′ , T ′ R ) for j ∈ {1, . . . , i -1} do πj ← Transfer(crs, 0, Σ[j]; T R,i , •, •) for j ∈ {i, . . . , ℓ} do πj ← Transfer(crs, 1, Σ[j]; T R,i , •, •) return A1((π1, . . . , π ℓ ), st A ) B0(crs, T R ) i ← {1, . . . , ℓ -1} for j ∈ [ℓ] \ {i} do crsj ← Setup(1 κ ) T R,j ← {0, 1} poly(κ) crsi := crs, T R,i := T R crs ′ := (crs1, . . . , crs ℓ ) T ′ R := (T R,1 , . . . , T R,ℓ ) (Σ, st A ) ← A0(crs ′ , T ′ R ) st := (Σ, i, st A ) return (Σ[i], st) B1(π, st) parse st =: (Σ, i, st A ) for j ∈ {1, . . . , i -1} do πj ← Transfer(crs, 0, Σ[j]; T R,j , •, •) for j ∈ {i + 1, . . . , ℓ} do πj ← Transfer(crs, 1, Σ[j]; T R,j , •, •) πi := π return A1((π1, . . . , π ℓ ), st A )
Fig. 2: Hybrid games for the expansion of single-bit AT to multi-bit AT (left) and the adversary (middle and right).

Provided that B is in C 2 , we have 1 -δ ≥ |Pr[Exp anon Π ℓ AT ,B,0 (κ)] -Pr[Exp anon Π ℓ AT ,B,1 (κ)]| = ℓ-1 j=1 Pr[Exp anon Π ℓ AT ,B,0 (κ) ∧ i = j] -Pr[Exp anon Π ℓ AT ,B,1 (κ) ∧ i = j] = 1 ℓ -1 ℓ-1 j=1 (Pr[Exp anon Π ℓ AT ,B,0 (κ)|i = j] -Pr[Exp anon Π ℓ AT ,B,1 (κ)|i = j]) = 1 ℓ -1 ℓ-1 j=1 (Pr[H j+1 ] -Pr[H j ]) = 1 ℓ -1 (Pr[H ℓ ] -Pr[H 1 ]) = 1 ℓ -1 Pr[Exp anon Π ℓ AT ,A,0 (κ)] -Pr[Exp anon Π ℓ AT ,A,1 (κ)] We have that T(B) = T(A) + (ℓ -1) • C 1 = T(A) + ℓ • C 1 . Hence, given that T(A) = T(B) -C 1 ∈ C 2 -ℓ • C 1 , the anonymity advantage of A is (1 -δ)(ℓ -1)/2, yielding anonymity of δ ′ = δℓ -ℓ -δ + 2. ⊓ ⊔

Impossibility of Anonymous Transfer

In this section, we prove that no anonymous transfer protocol, with an arbitrary polynomial number of rounds, can simultaneously enjoy overwhelming correctness (ε = 1 -negl(κ)) and overwhelming anonymity (δ = 1 -negl(κ)), even for transmitting single bit messages.

Theorem 3 (Impossibility of AT). Let µ : N → R be any negligible function and p be any polynomial. There is no (1 -µ(κ), 1 -µ(κ), p(κ), 1)-Anonymous Transfer, for any number of parties.

Theorem 3 will follow as a corollary from a more general result bounding the relation between ε and δ in any c-round protocol. Throughout this section we will focus on N = 3, that is, the case with one dummy player. This is without loss of generality as we will show in Section 4.3 that any N -party anonymous transfer with N > 3 implies in particular a 3-party anonymous transfer, for which we will show here that it can not exist.

Attacker A t = (A t 0 , A t 1 ) Algorithm A t 0 -On input crs, sample (Σ1, • • • , Σt) $ ← DR,
, x ′ 1 ) $ ← {0, 1} m × {0, 1} m , set π0 ← (π[c -1], x0, x ′ 1 ), π1 ← (π[c -1], x ′ 0 , x1), and compute Σ ′ b * ← Reconstruct(crs, π b * ) for b * = 0, 1. -Return the following: • if Σ ′ 0 = Σ t , output 0; • else, if Σ ′ 1 = Σ t , output 1; • else, return a uniformly random bit b ′ $ ← {0, 1}.
Fig. 3: Attacker A t against the δ-anonymity of the silent-receiver κ-bit AT protocol Π κ AT , parameterized by a polynomial t = t(κ).

The Attacker

From now on, we focus on building a generic attack against 3-party silent-receiver anonymous transfer for κ-bit messages. The theorem will follow from the reductions from 1-bit anonymous transfer to multibit silent-receiver anonymous transfer described in Section 3.5.

Let Π κ AT be a silent-receiver (ε, δ, c, κ)-Anonymous Transfer. Let m = m(κ) be the bitlength of the message from the non-participating party. Let Rand denote the following procedure: on input a transcript π of Π κ AT , Rand(π) truncates π to c -1 rounds of the AT protocol, and replaces the messages of the last round by two uniformly random length-m bitstrings6 . It outputs the new rerandomized transcript π ′ . For every Σ ∈ {0, 1} κ and b ∈ {0, 1}, we let D b,Σ , D ′ b,Σ , DR denote the following distribution:

D b,Σ = {Σ ′ : crs ← Setup(1 κ ), π ← Transfer(b, Σ), Σ ′ ← Reconstruct(crs, π)} D ′ b,Σ = {Σ ′ : crs ← Setup(1 κ ), π ′ ← Rand(Transfer(b, Σ)), Σ ′ ← Reconstruct(crs, Σ ′ )} DR = {Σ ′ : crs ← Setup(1 κ ), π $ ← ({0, 1} m × {0, 1} m ) c , Σ ′ ← Reconstruct(crs, π)}
Fix an arbitrary polynomial t. We define an attacker A t = (A t 0 , A t 1 ) against the anonymity of Π κ AT , parameterized by the polynomial t, on Figure 3. In the following, we will not use A t directly to attack the full c-round protocol: rather, we will use A t as a distinguisher between the c-round protocol Π κ AT , and the (c -1)-round protocol obtained by running Π κ AT for (c -1) rounds, and replacing the messages of the last round by uniformly random m-bit strings. From there, the proof of impossibility will proceed by induction; we refer the reader to the introduction for a high-level intuition of our proof.

Base case: advantage of A t when c = 1. We start the induction by bounding the advantage of A t in the anonymity game when Π κ AT is non-interactive (i.e., Transfer consists of a single message from each of P 0 , P 1 to the receiver). Before proceeding, we make two key observations:

(1) When c = 1, D ′ b,Σ = DR for any (b, Σ). In particular, this means that D ′ b,Σ is independent of (b, Σ).

(2) When c = 1 and b = 0, the distribution of the values (Σ ′ 0 , Σ ′ 1 ) constructed by A t 1 given as input a random transcript π ← Transfer(0, Σ t ) is exactly the distribution D 0,Σ t × DR. This is because x 0 is a random message from the sender with input b = 0 and value Σ t , and (x 1 , x ′ 0 , x ′ 1 ) are three uniformly random elements of {0, 1} m , hence (x 0 , x ′ 1 ) is exactly a random transcript of Π κ AT with (b, Σ t ), while (x ′ 0 , x 1 ) is just a pair of random messages. Similarly, if b = 1, the distribution of the values (Σ ′ 0 , Σ ′ 1 ) constructed by A t 1 given as input a random transcript π ← Transfer(1, Σ t ) is exactly the distribution DR × D 1,Σ t .

Both observations follow directly from the definitions of D b,Σ , D ′ b,Σ , DR and of A t 1 . Building on the above observations, we show that for an appropriate choice of t, the advantage of A t in the anonymity game can be made arbitrarily close to (ε -1)/2: Claim. For any polynomial n, there is a polynomial t such that

Pr b $ ←{0,1} Exp anon Π κ AT ,A t ,b (κ) = b -1/2 ≥ ε 2 - 1 n , ( 5
)
which implies that any silent-receiver (ε, δ, 1, κ)-Anonymous Transfer must satisfy δ ≤ 1 -ε + 2/n for any polynomial n; equivalently, δ ≤ 1 -ε + negl(κ). In particular, this means that if the AT has overwhelming correctness (ε = 1 -negl(κ)), then δ must be negligible.

Proof. Let t := κ • n, and let Bad ⊂ {0, 1} κ denote the set

Bad = Σ ∈ {0, 1} κ : Pr Σ ′ $ ←D ′ [Σ ′ = Σ] > 2 n .
We first show that Pr

Σ t $ ←A t 0 (crs) Σ t ∈ Bad ≤ e -κ .
Fix any Σ ∈ Bad. Then Pr

Σ t $ ←A t 0 (crs) [Σ = Σ t ] ≤ Pr Σ1,••• ,Σt $ ←D ′ [Σ / ∈ {Σ 1 , • • • , Σ t }] = Pr Σ1,••• ,Σt $ ←D ′ t i=1 (Σ i ̸ = Σ) < 1 - 2 n t ≤ e -2t/n = e -2κ .
Therefore, by a union bound over all Σ ∈ Bad, Pr

Σ t $ ←A t 0 (crs) [Σ t ∈ Bad] ≤ |Bad| • e -2κ ≤ 2 κ • e -2κ ≤
e -κ . Now, denoting b the identity of the sender, we bound the success probability of

A t = (A t 0 , A t 1 ) in guessing b.
Consider first the case b = 0. Then by observation (2), the values (Σ ′ 0 , Σ ′ 1 ) form a random sample from D 0,Σ t × D ′ (in particular, they are independent samples from these two distributions). Now, by definition of A t 1 , we have

Pr[Exp anon Π κ AT ,A t ,b (κ) = 0 | b = 0] = Pr[(Σ ′ 0 = Σ t ) ∨ ((Σ ′ 0 ̸ = Σ t ) ∧ b ′ = 0)] = Pr[Σ ′ 0 = Σ t ] + 1 2 • Pr[Σ ′ 0 ̸ = Σ t ] = 1 2 • 1 + Pr[Σ ′ 0 = Σ t ] ≥ 1 + ε 2 ,
where the second equality is because the events are disjoint, and the last inequality is by the ε-correctness of the AT. Now, consider the case b = 1; in this case, the values (Σ ′ 0 , Σ ′ 1 ) computed by A t 1 (π, st) are distributed exactly as a random sample from DR × D 1,Σ t . Then, if we condition on Σ t being outside of the set Bad, we have

Pr[Exp anon Π κ AT ,A t ,b (κ) = 1 | b = 0, Σ t / ∈ Bad] = Pr[((Σ ′ 0 ̸ = Σ t ) ∧ (Σ ′ 1 = Σ t )) ∨ ((Σ ′ 0 ̸ = Σ t ) ∧ (Σ ′ 1 ̸ = Σ t ) ∧ b ′ = 1) | Σ t / ∈ Bad] = Pr[(Σ ′ 0 ̸ = Σ t ) ∧ (Σ ′ 1 = Σ t ) | Σ t / ∈ Bad] + 1 2 • Pr[(Σ ′ 0 ̸ = Σ t ) ∧ (Σ ′ 1 ̸ = Σ t ) | Σ t / ∈ Bad] = Pr[Σ ′ 0 ̸ = Σ t | Σ t / ∈ Bad] • Pr[Σ ′ 1 = Σ t | Σ t / ∈ Bad] + 1 2 • Pr[Σ ′ 0 ̸ = Σ t | Σ t / ∈ Bad] • Pr[Σ ′ 1 ̸ = Σ t | Σ t / ∈ Bad] = 1 2 • Pr[Σ ′ 0 ̸ = Σ t | Σ t / ∈ Bad] • (1 + Pr[Σ ′ 1 = Σ t | Σ t / ∈ Bad]) ≥ 1 - 2 n • 1 + ε 2 ,
where the third equality follows from the fact that Σ ′ 0 and Σ ′ 1 are independent samples, and the last inequality follows from ε-correctness and the definition of the set Bad. Now, since

2 • Pr[Exp anon Π κ AT ,A t ,b (κ) = b] = Pr[Exp anon Π κ AT ,A t ,b (κ) = 0 | b = 0] + Pr[Exp anon Π κ AT ,A t ,b (κ) = 1 | b = 1] ≥ Pr[Exp anon Π κ AT ,A t ,b (κ) = 0 | b = 0] + Pr[Exp anon Π κ AT ,A t ,b (κ) = 1 | b = 1, Σ t / ∈ Bad] • Pr[Σ t / ∈ Bad] ≥ Pr[Exp anon Π κ AT ,A t ,b (κ) = 0 | b = 0] + Pr[Exp anon Π κ AT ,A t ,b (κ) = 1 | b = 1, Σ t / ∈ Bad] • (1 -e -κ ), we get Pr[Exp anon Π κ AT ,A t ,b (κ) = b] ≥ 1 2 • 1 + ε 2 + 1 - 2 n • 1 + ε 2 • (1 -e -κ ) ≥ 1 + ε 2 • 1 - 1 n • (1 -e -κ ) ≥ 1 + ε 2 - 1 n ,
where the last inequality uses the fact that (1 + ε) • (1 -e -κ )/2n ≤ 1/n. This concludes the proof. ⊓ ⊔ Induction case. Fix a polynomial number of rounds c(κ) and assume that any silent-receiver (ε, δ, c -1, κ)-Anonymous Transfer must satisfy

1 -δ 2 ≥ 1 c -1 • ε 2 - 1 n for any polynomial n.
equivalently, this means that (1 -δ)/2 ≥ ε/2(c -1) -negl(κ). Let Π κ AT be any silent-receiver (ε, δ, c, κ)-Anonymous Transfer.

Claim. For any polynomial n,

1 -δ 2 ≥ 1 c • ε 2 - 1 n . ( 6
)
Proof. We have

Pr[Exp anon Π κ AT ,A t ,b (κ) = b] = 1 2 • Pr[Exp anon Π κ AT ,A t ,b (κ) = 0 | b = 0] + 1 2 • Pr[Exp anon Π κ AT ,A t ,b (κ) = 1 | b = 1].
We bound separately the two probabilities on the right hand side:

Pr[Exp anon Π κ AT ,A t ,b (κ) = 0 | b = 0] = Pr[(Σ ′ 0 = Σ t ) ∨ ((Σ ′ 0 ̸ = Σ t ) ∧ b ′ = 0)] = Pr[Σ ′ 0 = Σ t ] + 1 2 • Pr[Σ ′ 0 ̸ = Σ t ] = 1 2 • 1 + Pr[Σ ′ 0 = Σ t ] ≥ 1 + ε 2 ,
where the second equality is because the events are disjoint, and the last inequality is by the ε-correctness of the AT. Note that nothing really changes when b = 0 compared to the base case, because the independence of Σ ′ 0 and Σ ′ 1 needs only to be invoked in the case b = 1 (this is because the attacker "favors Σ ′ 0 " in case of tie). Now, consider the case b = 1. In this case, the values (Σ ′ 0 , Σ ′ 1 ) computed by A t 1 (π, st) are distributed as correlated samples from D ′ 1,Σ t and D 1,Σ t . We have

Pr[Exp anon Π κ AT ,A t ,b (κ) = 1 | b = 1] = Pr[((Σ ′ 0 ̸ = Σ t ) ∧ (Σ ′ 1 = Σ t )) ∨ ((Σ ′ 0 ̸ = Σ t ) ∧ (Σ ′ 1 ̸ = Σ t ) ∧ b ′ = 1)] = Pr[(Σ ′ 0 ̸ = Σ t ) ∧ (Σ ′ 1 = Σ t )] + 1 2 • Pr[(Σ ′ 0 ̸ = Σ t ) ∧ (Σ ′ 1 ̸ = Σ t )] = 1 2 • Pr[(Σ ′ 0 ̸ = Σ t ) ∧ (Σ ′ 1 = Σ t )] + Pr[Σ ′ 0 ̸ = Σ t ] ,
where the second equality follows from the fact that the events

Σ ′ 1 = Σ t and Σ ′ 1 ̸ = Σ t are disjoint. Now, observe that Pr[Σ ′ 1 = Σ t ] = Pr[Σ ′ 1 = Σ t | Σ ′ 0 = Σ t ] • Pr[Σ ′ 0 = Σ t ] + Pr[Σ ′ 1 = Σ t ∧ Σ ′ 0 ̸ = Σ t ] ≤ Pr[Σ ′ 0 = Σ t ] + Pr[Σ ′ 1 = Σ t ∧ Σ ′ 0 ̸ = Σ t ].
By construction, Pr[Σ ′ 1 = Σ t ] is exactly the probability that Reconstruct outputs Σ t given a random transcript for b = 1 and transmitted value Σ t . By ε-correctness of the protocol, we therefore have Pr[Σ ′ 1 = Σ t ] ≥ ε. Plugging this into the previous inequality, we get

Pr[Σ ′ 1 = Σ t ∧ Σ ′ 0 ̸ = Σ t ] ≥ ε -Pr[Σ ′ 0 = Σ t ],
which implies that

Pr[Exp anon Π κ AT ,A t ,b (κ) = 1 | b = 1] ≥ 1 2 • ε -Pr[Σ ′ 0 = Σ t ] + Pr[Σ ′ 0 ̸ = Σ t ] = ε + 1 2 -Pr[Σ ′ 0 = Σ t ]. It remains to bound Pr[Σ ′ 0 = Σ t ].
To do so, we define a round-reduced anonymous transfer protocol (Setup ′ , Transfer ′ , Reconstruct ′ ), built on top of Π κ AT : Setup ′ = Setup Transfer ′ (crs, b, Σ) : proceeds as Transfer, except that the parties interrupt the protocol Transfer(crs, b, Σ) after c -1 rounds, obtaining a transcript π. In the (c -1)'s round, P 0 and P 1 both additionally broadcast 2m random bits, denoted (r 0 , r 1 ). Define the final transcript of Transfer ′ to be (π, r 0 , r 1 ). Reconstruct ′ (crs, (π, r 0 , r 1 )) : on input a transcript (π, r 0 , r 1 ), set r := r 0 ⊕ r 1 and parse r as a concatenation of two m-bit messages (x 0 , x 1 ). Let π ′ be a c-round transcript where the transcript of the first c -1 rounds is π, and the last round transcript is (x 0 , x 1 ). Output Reconstruct(crs, π ′ ).

A transcript for the round-reduced protocol is exactly a transcript for Π κ AT where the last two messages have been replaced by uniform random strings 7 . Now, observe that when b = 1, replacing only the message of b 1 by random in the last round still leads to the exact same distribution over transcript. In other terms, Pr[Σ ′ 0 = Σ t ] is exactly the probability that Reconstruct ′ outputs Σ t given a transcript for the round-reduced protocol. Of course, the round-reduced protocol is δ-anonymous8 , and has c -1 rounds. Hence, by the induction hypothesis, we can bound the correctness of the round-reduced protocol:

1 -δ 2 ≥ 1 c -1 • Pr[Σ ′ 0 = Σ t ] 2 - 1 n =⇒ Pr[Σ ′ 0 = Σ t ] ≤ (c -1) • (1 -δ) + 2/n.
Therefore, we get

Pr[Exp anon Π κ AT ,A t ,b (κ) = 1 | b = 1] ≥ ε + 1 2 -(c -1) • (1 -δ) - 2 n .
Putting everything together, we obtain

Pr[Exp anon Π κ AT ,A t ,b (κ) = b] ≥ 1 2 • ε + 1 2 + ε + 1 2 -(c -1) • (1 -δ) - 2 n = ε + 1 2 - (c -1) • (1 -δ) 2 - 1 n , hence Pr[Exp anon Π κ AT ,A t ,b (κ) = b] - 1 2 ≥ ε 2 - (c -1) • (1 -δ) 2 - 1 n .
Now, by definition of δ-anonymity, we also have

1 -δ 2 ≥ Pr[Exp anon Π κ AT ,A t ,b (κ) = b] - 1 2 ≥ ε 2 - (c -1) • (1 -δ) 2 - 1 n =⇒ c • 1 -δ 2 ≥ ε 2 - 1 n ,
which concludes the proof of the claim. ⊓ ⊔

Putting the Pieces Together

With the above analysis, we showed that for any silent-receiver (ε, δ, c, κ)-Anonymous Transfer, it must necessarily hold that (1 -δ)/2 ≥ ε/2c -negl(κ). Since any (ε, δ, c, κ)-Anonymous Transfer implies a silent-receiver (ε, δ, c, κ)-Anonymous Transfer (with the exact same parameters, see Section 3.5), we obtain:

Corollary 2. Any (ε, δ, c, κ)-Anonymous Transfer must satisfy 1 -δ 2 ≥ ε 2c -negl(κ).
In particular, this implies that there exists no κ-bit AT with overwhelming correctness and anonymity, for any polynomial number of rounds.

Furthermore, as shown in Section 3.5, any single-bit c-round AT with correctness ε = 1 -negl(κ) and anonymity δ = 1 -negl(κ) implies a κ-bit AT with correctness (1)

ε ′ = ε κ = (1 -negl(κ)) κ = 1 -negl(κ), and anonymity δ ′ = (δ -1) • κ -δ + 2 = 1 -negl(κ).
N -2 , x (1) R , . . . , x (χ-1) 1 , . . . , x (χ-1) N -2 , x (χ-1) R . P b ′ for b ′ ∈ [N -2] \ b broadcasts x (χ) b ′ $ ← {0, 1} m . R broadcasts x (χ) R $ ← {0, 1} m . R outputs Π 1 AT .Reconstruct x (1) 1 , . . . , x (1) N -2 , x (1) R , . . . , x (c) 1 , . . . , x (c) N -2 , x (c) R
.

Fig. 4:

The protocol Π 1 AT ′ that constructs (N -1)-party AT from a given N -party SR-AT for N parties.

Impossibility of Anonymous Transfer for N > 3

The impossibility proof showed thus far only considered the setting for N = 3. In this section we will expand the impossibility proof to an arbitrary N > 3. For that purpose, we prove the following claim:

Claim. Let Π 1 AT be an (ε, δ) Silent Receiver Anonymous Transfer protocol for N parties. Then, protocol Π 1 AT ′ defined in Fig. 4 that makes black-box access to Π 1 AT is an (ε, δ ′ ) AT protocol for (N -1) parties, where δ ′ > 1 -(1 -δ) • N -2 N -3 .
Combining this with the insight from Lemma 4 that (ε, δ)-AT imply (ε, δ)-SR-AT, this implies that an (ε, δ)-AT for N parties implies an (ε, δ ′ )-SR-AT for (N -1) parties.

We then proceed to show that if δ is overwhelming, then δ ′ is overwhelming. The correctness ε does not change by our transformation. Hence, we can iteratively apply this step for any number of parties N . Therefore, if there is an N -party (owhl(κ), owhl(κ))-AT, then there is also a threeparty (owhl(κ), owhl(κ))-AT. Since the latter is impossible due to Theorem 3, an N -party AT with overwhelming correctness and anonymity cannot exist for any polynomial number of parties N .

To prove our claim we construct an (N -1)-party AT Π 1 AT ′ as shown in Fig. 4. The protocol is based on an (ε, δ)-SR-AT Π 1 AT . All parties in Π 1 AT ′ follow their respective roles in Π 1 AT , which means that the sender is constructing special messages as advised by Π 1 AT whereas the dummy friends only broadcast random bits. To compensate for the missing party (the N -th party that does not exist in the N -1 party protocol) the messages of the N -th party are sent by the receiver, who takes on the role of one dummy friend. This is possible because the N -party protocol is a Silent Receiver AT where the receiver sends no messages, whereas in the (N -1)-party protocol the receiver is allowed to report messages in each round. Then parties continue with the extended transcript and proceed to the next round.

Security Analysis of Π

1 AT ′ Correctness. Correctness of Π 1 AT ′ follows directly from correctness of Π 1 AT . Lemma 6 (Correctness). Let Π 1 AT be an N -party (ε, δ)-SR-AT. Then Π 1 AT ′ has correctness ε.
Proof. This trivially follows from the fact that the extended transcript is distributed identically to an execution of Π 1 AT : The messages of the first (N -1) parties are distributed correctly by design, as they follow the original protocol, and the messages of the N -th party are also distributed the same, but accounted to a different party. Thus, the reconstruction algorithm is queried with the same inputs.

⊓ ⊔

Anonymity. Anonymity requires some work, since one party (the non-silent receiver) in Π 1 AT ′ is guaranteed to not be the sender.

Lemma 7 (Anonymity

). Let Π 1 AT be an N -party (ε, δ)-SR-AT. Then Π 1 AT ′ has anonymity δ ′ = 1 -(1 -δ) • N -2 N -3 .
Proof. We want to find a bound δ ′ for the δ ′ -anonymity of Π 1 AT ′ , that is, a value δ ′ for which the following holds for any PPT algorithm A ′ :9

Pr[A ′ successful] ≤ 1 (N -2) + (1 -δ ′ ) • N -3 N -2 (7)
Now let A ′ be an adversary on the anonymity of the (N -1)-party protocol Π 1 AT ′ . We will now demonstrate how A ′ can be used by a guessing algorithm A to break the anonymity of Π 1 AT : Upon receiving the challenge transcript π C for the N -party AT, A picks a uniformly random party from the group of potential senders (i.e., among everyone except the receiver) and erases that party from the transcript. A reports this party's messages as coming from the receiver in Π 1 AT ′ . Observe that the resulting transcript is perfectly distributed as an honest transcript of Π 1 AT ′ (given that a non-participant was erased). Now, A feeds this simulated transcript to A ′ , and outputs whatever A ′ outputs.

If A selects a non-participant-which is the case with probability (N -2)/(N -1) as the party is uniformly sampled among all parties except for the receiver and there is only one actual sender-then the modified transcript is a valid transcript of Π 1 AT ′ and the probability that A ′ returns the correct sender is returned is given by the success probability Pr[A ′ successful] of A ′ . Otherwise, if A selected the actual sender, then all possible return values for A ′ are dummy friends and the probability that A is correct equals 0.

Hence, the overall probability that A is successful is given by the following term:

Pr[A successful] = N -2 N -1 • Pr[A ′ successful] ⇐⇒ Pr[A ′ successful] = N -1 N -2 • Pr[A successful] (8)
Due to the δ-anonymity of Π 1 AT it holds that

Pr[A successful] ≤ 1 N -1 + (1 -δ) • N -2 N -1 (9)
By merging Eqs. ( 8) and (9) we get that

Pr[A ′ successful] = N -1 N -2 • Pr[A successful] ≤ N -1 N -2 1 N -1 + (1 -δ) • N -2 N -1 =⇒ Pr[A ′ successful] ≤ 1 N -2 + (1 -δ) (10)
However, to apply δ ′ -anonymity we need Eq. ( 10) to be in the form from Eq. ( 7), which means that we have to set:

Pr[A ′ successful] ≤ 1 N -2 + (1 -δ) ! = 1 N -2 + (1 -δ ′ ) N -3 N -2 (11)
Solving Eq. ( 11) for δ ′ yields the following result:

δ ′ = 1 -(1 -δ) • N -2 N -3 (12)
For this value of δ ′ , the guessing algorithm A ′ on Π 1 AT ′ can not be used to violate the δ-anonymity of Π 1 AT . In contrast, if there is some guessing algorithm A ′ which violates the δ ′ -anonymity for the above value of δ ′ , then it holds that:

Pr[A ′ successful] > 1 N -2 + (1 -δ ′ ) • N -3 N -2 (13)
Then the probability that A can successfully determine the sender in the N -party AT is given as follows:

Pr

[A successful] = N -2 N -1 • Pr[A ′ successful] > N -2 N -1 • 1 N -2 + (1 -δ ′ ) • N -3 N -2 Pr[A successful] > 1 N -1 + (1 -δ ′ ) • N -3 N -1 (14)
By inserting the computed value of δ ′ from Eq. ( 12) into Eq. ( 14) and get:

Pr[A successful] > 1 N -1 + 1 -1 -(1 -δ) • N -2 N -3 • N -3 N -1 (15)
So, in total A would be successful with probability

Pr[A successful] > 1 N -1 + 1 -1 + (1 -δ) • N -2 N -3 • N -3 N -1 =⇒ Pr[A successful] > 1 N -1 + (1 -δ) • N -2 N -1 (16)
which would contradict the assumed δ-anonymity of Π 1 AT .

⊓ ⊔

From Lemmas 6 and 7 our claim follows:

Corollary 3. If Π 1
AT is an (ε, δ) Silent Receiver Anonymous Transfer protocol for N parties, then there exists a protocol Π 1 AT ′ with black-box access to Π 1 AT that is an (ε, δ ′ ) AT protocol for (N -1) parties, where

δ ′ > 1 -(1 -δ) • N -2
N -3 . This insight yields the following corollary:

Corollary 4. Let Π 1
AT be an (ε, δ) Anonymous Transfer protocol for N parties where ε, δ ∈ owhl(κ). Then there is a protocol three-party

(ε, δ ′ )-AT protocol Π 1 AT ′ where ε, δ ∈ owhl(κ).
Proof. Let the number N of parties be given. From Π 1

AT we can construct a Silent Receiver AT with the same values for ε and δ, so the constructed Silent Receiver AT still has overwhelming correctness and anonymity.

By then applying Corollary 3 it follows that there is a protocol Π 1 AT ′ for (N -1) parties which still has the same (hence overwhelming) correctness and anonymity

δ ′ > 1 -(1 -δ) • N -2 N -3 . As we assume that δ ∈ owhl(κ) it holds that (1 -δ) ∈ negl(κ), and since N -2 N -3 ∈ poly(κ) it holds that (1 -δ) • N -2 N -3 ∈ negl(κ). So it total it holds that δ ′ > 1 -negl(κ) ∈ owhl(κ).
By then alternating between an application of Lemma 4 to construct a Silent Receiver AT from the normal AT and Corollary 3 to reduce the number of parties by one we can proceed until N = 3, where still it holds that both correctness and anonymity are overwhelming.

⊓ ⊔

This insight, however, contradicts Theorem 3, which states that no three-party AT with overwhelming correctness and anonymity can exist, which leads to our final corollary:

Corollary 5. Let κ be the security parameter. Let N ∈ poly(κ) be the number of individuals present in an execution of Anonymous Transfer. Then for any N -party AT protocol

Π 1 AT it holds that Π 1 AT is not a (owhl(κ), owhl(κ))-AT.
Proof. This proof is by contradiction. Assuming that Π 1 AT is an (owhl(κ), owhl(κ))-AT means that due to Corollary 4, there is an (owhl(κ), owhl(κ))-AT for three parties. However, such a protocol cannot exist due to Theorem 3. ⊓ ⊔

Extensions and Limitations

The adversary in our impossibility result makes a black-box use of an arbitrary 3-party silent receiver multibit anonymous transfer; the reduction to N -party single-bit anonymous transfer is black-box as well. In particular, this means that our impossibility result relativizes: it remains true relative to any oracle, where access to the oracle is granted to all participants and all algorithms (including the adversary).

In the next section, we will provide a heuristic construction of fine-grained anonymous transfer. The aim of this construction is to complement our impossibility result, and to draw an interesting and surprising picture: anonymous transfer appears to be impossible to realize with the standard superpolynomial cryptographic hardness gaps, but becomes feasible if one settles for a small polynomial hardness gap. Our fine-grained construction is described and formally proven secure using an ideal obfuscation scheme; instantiating the scheme with candidate indistinguishability obfuscation schemes gives a plausible heuristic construction (the same way that instantiating the random oracle model with standard hash functions gives plausible heuristic constructions of various cryptographic primitives, when the construction is not pathological). Because our impossibility result relativizes, in contrast, standard anonymous transfer remains provably impossible relative to an ideal obfuscation oracle (while fine-grained anonymous transfer, as we will see, provably exist relative to such an oracle).

Impossibility of fine-grained multibit AT with overwhelming correctness and anonymity.

In the multibit setting, where the sender wants to transmit ω(log κ) bits to the receiver, our result further demonstrates that there exists no fine-grained anonymous transfer with overwhelming correctness and anonymity 1 -negl(κ), even with an arbitrary small polynomial gap between the runtime of the honest parties and that of the adversary. Indeed, let r = O(c • m) be a lower bound on the runtime of the honest parties (r is the total number of bits sent by the sender, hence it is a clear lower bound on its running time), and consider an adversary A t with t = κ • c g , where g > 0 is an arbitrarily small constant. Then by construction, the runtime of

A t is O(κ • r • c g ) ≤ O(κ • r 1+g
) (as it is dominated by the cost of sampling t random transcripts for A t 0 ). Then this adversary satisfies

1 -δ 2 ≥ Pr[Exp anon Π κ AT ,A t ,b (κ) = b] - 1 2 ≥ 1 c • ε 2 - 1 c g , ( 17
)
which implies that δ and ε cannot be simultaneously equal to 1 -negl(κ) (since 1/(2c) -1/c 1+g cannot be a negligible function for any polynomial c and any constant g > 0).

Limitations of the impossibility result.

Even putting aside the heuristic security guarantee of our fine-grained construction (or its security in an idealized model), a gap remains between our impossibility result and our construction: our impossibility result does not rule out the possibility of having, say, a (1 -negl(κ), 1 -1/c, c, κ)-Anonymous Transfer -that is, an anonymous transfer with overwhelming correctness, and vanishing anonymity error 1/c in c rounds, with standard (superpolynomial) security. In contrast, our heuristic construction only achieves overwhelming correctness and anonymity arbitrarily close to 1/c against fine-grained adversaries. It is an interesting open question to close this gap. We conjecture that the true answer is negative:

Conjecture 1. There exists no (1 -negl(κ), 1 -1/c, c, κ)-Anonymous Transfer.
What follows assumes that the reader is familiar with standard philosophical considerations on the worlds of Impagliazzo. Proving the above conjecture would have a very interesting (theoretical) consequence: it would demonstrate the existence of a natural cryptographic primitive that plausibly exists within the realm of fine-grained cryptography, yet is impossible with standard hardness gap. It is known that fine-grained constructions sometimes allow building "high-end" cryptographic primitives in "low-end" cryptographic realms. For example, Merkle puzzles, which can be instantiated under exponentially strong one-way functions [START_REF] Biham | Basing weak public-key cryptography on strong one-way functions[END_REF], provide a fine-grained key exchange; borrowing Impagliazzo's terminology [START_REF] Impagliazzo | A personal view of average-case complexity[END_REF], this places "fine-grained Cryptomania" inside (a strong form of) Minicrypt. Proving the conjecture would induce a comparable result, but at the highest level of the hierarchy: it would, in a sense, place fine-grained Impossibilitopia (a world of cryptographic primitives so powerful that they simply cannot exist) inside Obfustopia. For each round χ from 1 to c :

P b computes µ ← Sig.Sig(k b , (x (χ-1) 0 , x (χ-1) 1
)) and sets x

(χ) b ← Ske.Enc(sk b , (σ, µ)). P 1-b : Broadcast x (χ) 1-b $ ← {0, 1} m . R: computes µ ← Sig.Sig(k R , (x (0) R , (x (0) 0 , x (0) 1 ), . . . , (x (c) 0 , x (c) 1 ))), compute σ ′ := P AT (x (0) R , (x (0) 0 , x (0) 1 ), . . . , (x (c) 0 , x (c) 1 ), µ) and output OTP ⊕ σ ′ .

Fig. 5: The protocol Π 1

AT for fine-grained Anonymous Transfer. The circuit P AT is defined in Fig. 6.

P AT [pk P , c] x (0) R , x (0) 0 , x (0) 1 , x (1) 0 , x (1) 1 . . . , x (c) 0 , x (c) 1 (OTP, vk R ) := Pke.Dec * (skP , x (0) R ), (sk0, vk0) := Pke.Dec * (skP , x (0) 0 [1 : m]), (σ0, µ 0 ) := Ske.Dec * (sk0, x (0) 0 [m + 1 : 2m]), (sk1, vk1) := Pke.Dec * (skP , x (0) 1 [1 : m]), (σ1, µ 1 ) := Ske.Dec * (sk1, x (0) 1 [m + 1 : 2m]), if ¬Sig.Vfy(vk R , (x (0) R , (x (0) 0 , x (0) 1 ), . . . , (x (c) 0 , x (c) 1 ))) then : return CointossS (π) (0.5) (0, 1) χ 0 := Sig.Vfy(µ 0 , vk0, x (0) R ) • (c + 1), χ 1 := Sig.Vfy(µ 1 , vk1, x (1) R ) • (c + 1), foreach χ ∈ {1, . . . , c} do : foreach b ∈ {b ′ |b ′ ∈ {0, 1}
, χ b = (c + 1)} do : / / Take on the role of each potential sender.

X b := Ske.Dec * (sk b , x (χ) b ), σ ′ b := X b [0], µ b := X b [1 : |X b |] if ¬Sig.Vfy(µ b , vk b , π[χ -1]) ∨ σ b ̸ = σ ′ b then : χ b := χ / / Remember first bad round. b ′ := argmax b (χ b ) return OTP ⊕ CointossS (π) (1/2•(1+χ b ′ /c)) (σ b ′ , (1 -σ b ′ ))

Fine-Grained AT from Ideal Obfuscation

In this section, we focus on realizing Anonymous Transfer with fine-grained security according to Definition 6. More precisely, we construct a c-round protocol which achieves anonymity δ, where the honest parties have runtime in

C 1 := O(c) against adversaries in C 2 := o(c 2 (1 -δ)), where c = c(κ) is a polynomial in κ.
For the sake of simplicity we introduce the protocol with N = 3, implying a single dummy friend. However, expanding this protocol to an arbitrary N ∈ N is straightforward as the behavior of all dummy friends is the same by definition and instead of two messages, each round now contains N -1 messages.

We exploit the limited runtime of the adversary and provide a protocol in Fig. 5 with c rounds. In each new round (or with each valid sender message) the probability that the correct bit is eventually returned increases, i.e., each valid round increases the receiver's confidence in the message. Each round lets the sender compute a signature µ using a sEUF-CMA secure signature scheme 10 for the transcript of the previous round. The transferred bit σ and the signature µ are then sent. The verification key for the signature scheme is transmitted by the sender in the first round. In order to make the sent messages look random the message is not sent directly. Instead, the sender encrypts the message using an IND$-CCA secure encryption scheme 11 , [Rog04]. Since not every length m bitstring is a valid ciphertext, we use a special function Dec * instead of the normal function Dec, which is defined as follows: If Dec on input ct returns ⊥ then Dec * returns F(ct), otherwise Dec * returns Dec(ct). Hence, every possible input allows an interpretation as a cleartext. We use those for both the asymmetric and symmetric schemes.

In order to make the output unusable for any other party, the receiver draws a One-Time-Pad as first message which eventually masks the final output, and a verification key of a signature scheme. The latter is used to ensure that the receiver approves with the transcript; after the two potential senders provided all messages, the receiver signs the entire transcript and only if this signature verifies the entire previous transcript, the circuit continues. The first message of the receiver is broadcast, while the signature is only used locally.

The receiver obtains its output by computing the signature as described above and feeding the final transcript alongside the signature into an obfuscated circuit which is supplied in a common reference string. The circuit is obfuscated using ideal obfuscation 12 . It hides a PRF key and a secret decryption key sk P for the IND$-CCA secure PKE. The corresponding encryption key pk P is also part of the CRS and, hence, known to all parties. This encryption scheme is used by the sender and the receiver to hide their respective first message. This uniquely determines the symmetric key used to decrypt the remaining messages of each potential sender. The message also contains a verification key used to sign the previous messages in future rounds, the bit that the sender wants to transfer, and the initial signature on the receivers message. The remaining rounds of the sender are encrypted using a symmetric scheme, namely the IND$-CCA secure SKE scheme, using the key transferred to the circuit in the first round.

The circuit is shown in Fig. 6. It starts by extracting the verification keys and symmetric encryption keys (one per potential sender) alongside the bits that the respective party wants to transfer and the initial signatures on the first receiver messages from the respective initial messages of both parties, and the receivers OTP and verification key from the receiver message. Then the circuit starts by verifying the signature of the receiver on the entire transcript, and if that does not match, returns a uniformly random bit 13 . Otherwise, if the receiver's signature is valid, the circuit searches for the first faulty round of each potential sender. That is, the first round of each potential sender where the signature on the previous round fails to verify or where the encoded bit differs from the bit extracted from the initial message. The party who sent the most consecutive valid rounds is selected as the sending party. The circuit outputs the bit transmitted by that party with probability depending on the ratio between valid sender messages and the total number of rounds, which ranges between 1/2 (i.e., a uniformly random bit) if no round was valid for any party and 1 (i.e., deterministically returning the correct bit) if all rounds were correct. However, as stated before, the circuit does not output that bit directly, but instead masks it using the OTP extracted from the receiver's first message. This ensures secrecy, as other parties only get a masked output which information-theoretically hides the actual bit.

Security Analysis Theorem 4 (Correctness). If the protocol from Fig. 5 is instantiated with an Ideally Obfuscated version of the circuit from Fig. 6 the protocol is

ε-correct with ε = (1 -negl(κ)).
At the end of an honest protocol execution, the maximum round in which a valid signature has been provided equals the number of rounds c. With overwhelming probability, the sending parties' input is the only one that contains c many valid rounds. Hence, the correctly masked bit is returned. Since the mask is input by the receiver and later applied to the output, the receiver obtains the correctly masked bit. We refer the reader to Appendix D.1 for a formal proof.

11 See Appendix A.2 for a definition of IND$-CCA. 12 See Appendix A.4 for a definition of ideal obfuscation. 13 This is denoted in the figure by the CointossS (π) (p) (σ, σ) function, which returns σ, i.e. the first argument, with probability p, and σ, i.e. the second argument, with the complementary probability (1 -p), where the randomness for p is extracted from the argument provided by π. Theorem 5 (Anonymity). Let Pke be an IND$-CCA secure asymmetric encryption scheme, let Ske be a tightly secure multi-challenge IND$-CCA secure symmetric encryption scheme, let Sig be an sEUF-CMA secure signature scheme, let O be an ideal obfuscator, let F be a secure PRF, and let κ be the security parameter. Then the c-round protocol Π 1 AT for N = 3 satisfies δ-anonymity for all adversaries in

Oracle O β i if β = 0 then pi := i + c -1 2c else pi := i + c 2c return Ber(pi) C(c) β $ ← {0, 1} return A O β 1 ,...,O β c (1 κ ) A(1 κ ) for j = 1 . . . t do ij ← Computations xj $ ← Oi j β ′ ← Computations((ij, xj) t j=1 ) return β ′
C 2 := o(c 2 (1 -δ)).
Proof (sketch). An outline of the entire proof is given in Appendix D.2. On a high level, the proof is structured into two parts. In the first part, we successively modify the anonymity game Exp anon Π 1 AT ,A,b (κ) and the obfuscated circuit oracle P AT to remove as much computationally hidden information about b as possible. More precisely, we exploit the non-malleability of Pke and sEUF-CMA security of Sig to unnoticeably alter the oracle to determine the number of valid rounds by counting how many rounds of the input transcript are identical to the challenge transcript provided by Exp anon

Π 1 AT ,A,b (κ).
The first round which is not entirely identical to the challenge transcript (i.e. either the sender message or the non-sender message differ) increases the valid rounds count only if the input sender message is identical to the challenge sender message or if the input sender message decrypts to the same content as the challenge sender message. The following round will be counted as invalid since the signature verification will fail. After this step, the decryption keys of Ske and Pke are not necessary for chosen-ciphertext simulation anymore. Then, we first replace the sender messages which are encrypted using Ske and then the first round sender message which is encrypted using Pke with uniform randomness exploiting the IND$-CCA security of both encryption schemes.

The only information about the bit b that is left in the present game is due to the oracle which counts valid sender messages by comparing the input sender message with the challenge sender message. Clearly, the final modification of the game must be the removal of this dependency on b. However, this removal will noticeably alter the output distribution of the oracle. Hence, an adversary with arbitrary polynomial runtime will be able to distinguish this hop with constant probability [CDV + 14]. However, if we can limit the runtime of the adversary to be sub-quadratic in the runtime of the honest protocol execution, we are able to apply results from distribution testing to achieve a good bound for this distinguishing advantage. We will elaborate on this final game hop in more detail below and will refer to the second last game as Game σ 7 (κ) and to the last game (i.e. the game, where no information about b remains) as Game σ 8 (κ). For detailed game descriptions and the remaining game hops, we refer the reader to Appendices D.2 and D.3, respectively.

For the sake of reducing complexity of the problem of proving indistinguishability between Game σ 7 (κ) and Game σ 8 (κ) we describe an intermediate game in Fig. 7 that is provably as hard to solve as distinguishing the two games.

The key idea is the following: The challenger C creates c oracles where the probability to return 1 is equally distributed between 1/2 and 1 in c steps.

On β = 0 the oracles are distributed equally between [1/2, 1). On β = 1 the oracles are distributed equally between (1/2, 1]. That is, on β = 0 the oracle χ returns 1 with probability (c + χ -1)/(2c) and on β = 1 it returns 1 with probability (c + χ)/(2c).

We now stress that this game is as hard as the problem of distinguishing the two games from Game σ 7 (κ) and Game σ 8 (κ): Lemma 8. Let D be a distinguisher distinguishing Game σ 7 (κ) and Game σ 8 (κ) with advantage α over guessing. Let t be the number of queries that D sends to the obfuscated circuit. There is a reduction adversary A that uses D which has advantage α over guessing in winning Fig. 7.

Proof. Creating the Transcript. Upon activation the adversary samples a bit σ ∈ {0, 1} that is to be transferred in the transcript and a bit b ∈ {0, 1} that defines the sending party. Using c as the number of rounds and m as the length of each message A creates the transcript by reporting two uniformly sampled messages of length m for each round inside the loop, and for the preparational round two messages of length 2m each for the dummy friend and the sender and one message of length m for the receivers messages. The resulting transcript π C is reported to the distinguisher D.

Simulating the Circuit. When receiving a transcript π,

A checks if π[0] ̸ = π C [0]
. If this is the case A executes the program honestly as defined in Game σ 7 (κ) and returns the output bit. Note that the normal execution of a different transcript is entirely independent of the secret β chosen by C and effectively of the whole change induced in the transition from Game σ 7 (κ) to Game σ 8 (κ). Hence A has all the information to simulate new transcripts.

Otherwise, if

π[0] = π C [0], A embeds the challenge oracle by finding χ * = max χ π[0 . . . χ] = π C [0 . . . χ]
by comparing the input to the previously reported challenge transcript. Then A checks the messages π[χ * + 1]. Let x C 0 and x C 1 be the message from the challenge transcript at round χ * + 1 of parties P 0 and P 1 , respectively, and let x 0 and x 1 be the respective messages from the transcript that was input by D.

A only considers the message reported for P b ; if x b = x C b , that is, if at round χ * + 1, the input transcript contains the same message of the sending party, A sends χ * to the oracle O χ * provided by C and obtains a binary output σ * . Since the output of C is going towards 1, whereas the bit σ C was uniformly distributed, A has to adjust the output if σ C = 0, such that 0 is output with higher probability. Hence, A sends σ * ⊕ σC back as output to D; this essentially flips the output bit iff σ C = 0, in which case the output of the oracle lies between 0 and 1/2.

Otherwise, if x b ̸ = x C b , A locally samples a Bernoulli-distributed bit according to p χ * and sends the result back to D.

Translating the Result. After (at most) t queries the distinguisher terminates and sends its guess. If D guesses it was playing Game σ 8 (κ) then A reports β ′ = 0 to C, thus guessing that the χ-th oracle returns 1 with probability (χ + c -1)/2c. If D guesses it was playing Game σ 7 (κ) then A sends the output β ′ = 1 to C, indicating that the probabilities were given as (χ + c)/2.

For a tight reduction it remains to show that the view of D is statistically close to that from Game σ 7 (κ) and Game σ 8 (κ), depending on the choice of C: First, note that the way that C handles the queries in Fig. 7 mimics exactly the situation from the game change: either a query for χ returns the 1 with probability χ+c 2c or with probability χ-1+c 2c . The former implies that the sending parties message is still considered as in Game σ 7 (κ), the latter representing Game σ 8 (κ) where the oracle ignores a valid message in round χ + 1 and only considers the round χ * until both messages match the challenge transcript.

The challenge oracle is only queried when the right sending message for the following round is used. This is also the only instance where Game σ 7 (κ) and Game σ 8 (κ) differ from each other. Finally, note that at most t sample were sent to the challenge oracle. Thus, the view is simulated perfectly and the view of D corresponds to Game σ 8 (κ) iff the additional factor of -1/2c is ignored and to Game σ 7 (κ) otherwise. So if D has non-negligible advantage α over guessing then A inherits this advantage for winning the game from Fig. 7, albeit if D sends t queries to A, less than t queries are forwarded to C. ⊓ ⊔ Proving indistinguishability has thus been reduced to showing that no fine-grained adversary can win the game from Fig. 7 with non-negligible advantage. The interface of an adversary in this game is given as a set of 2c oracles. Each oracle follows a Bernoulli distribution that returns the correct bit σ C with probability p. For each round χ < c any distinguisher D is given access to two oracles. Each oracle can be queried by copying the first χ messages of both parties, but then using (exactly) one new message for round (χ + 1)-which replaces either the sending parties message or that of the dummy friend. Any upper bound on winning the game from Fig. 7 translates to the underlying problem of distinguishing the final two games.

Analyzing the game from Fig. 7 comes down to probability theory. Recall from Corollary 1 that in order to distinguish two Bernoulli distributions p and q with advantage α/2 we require Ω(α/d TV (p, q)) many samples. Applying this corollary to Fig. 7 implies that we have c instances where the χ-th instance is to distinguish p = χ+c 2c from q = χ+c-1 2c . This implies the following L 1 -norm between p and q in round χ:

d TV (p, q) = 1 2 (|Pr[p = 1] -Pr[q = 1]| + |Pr[p = 0] -Pr[q = 0]|) = 1 2 c + χ 2c - c + χ -1 2c + c -χ 2c - c -χ + 1 2c = 1 2 1 2c + 1 2c = 1 2c (18)
Note here that the total variational distance in round χ is independent from the round χ and the same for all c oracles. Combining this information with Lemma 2 means that any distribution p and q resulting from sampling t times from arbitrary oracles results in a total variational distance ≤ t 1 2c . 14We now merge this insight with the result of Eq. ( 18) and the bound of Corollary 1. This leads a lower bound of:

t ∈ Ω α d TV (p, q) = Ω(αc) (19)
We thus have:

Corollary 6. Let D be a distinguisher in Fig. 7 that uses t samples and has runtime in C 2 := o(c 2 /α). Let the cost of acquiring a single sample be O(c). Then the distinguisher D is correct with probability at most 1/2 + α/2.

Proof. The bound from Eq. ( 19) covers any adversary trying to win Fig. 7 regardless of how the t samples are distributed between the c oracles. This follows from the subadditional property of the total variational distance shown in Lemma 2 and the computation in Eq. ( 18) showing that the total variational distance is the same between all oracles; thus the bound from Lemma 1 still is valid and the total variational distance between any pair of t-fold distributions is at most t • 1 2c . Thus Lemma 3 maintains its validity. Hence the lower bound of Eq. ( 19) matches our setting. The bound is linear in c with the linear cost of querying a single sample (as the adversary has to evaluate the entire circuit for each sample, which requires O(c) runtime) this limits the distinguisher in such a way that only strictly less samples can be drawn than required according to Eq. ( 19). [Exp anon

Π 1 AT ,A,b (κ) = b] -1/2| ≤ α/2. ⊓ ⊔
On the Need for Stronger Obfuscation. Due to [CLT + 15], indistinguishability obfuscation (or more precisely, its probabilistic variant) can only guarantee indistinguishability if the distance between the output distributions of two circuits is statistically close to zero. This is not the case in our final game hop. Therefore, we crucially require a stronger form of obfuscation such as virtual black-box obfuscation or ideal obfuscation. Due to [JLL + 22], employing ideal obfuscation yields a heuristic candidate proven secure in an idealized model. Hence, our result constitutes a first step towards instantiating anonymous transfer.

Stronger Anonymity Notions. Our positive result demonstrates that despite our strong negative result, some non-trivial anonymity is achievable. Note, however, that our positive result is still weak in many regards. Strengthening the achieved notion to, for instance, achieve anonymity against malicious non-participants, seems highly non-trivial. In particular, malicious non-participants may easily nullify any correctness guarantee by behaving exactly like a sender. Straightforward attempts to address this problem, e.g. letting the obfuscated circuit output all messages with equal confidence, open the gates for new attacks. For instance, in the above setup, replacing the last message of half of all possible senders causes the circuit to output either both the sender message and the injected message or only the injected message, depending on whether the real sender is part of the parties whose messages are replaced. This strategy allows to de-anonymize the sender in runtime O(c log c).

Final Result

Let c = c(κ) be a polynomial in κ.

Let C 1 := O(c) and let C 2 := o(c 2 (1 -δ)) for some δ ∈ R [0,1] .
Putting Theorems 4, 5 and 6 together, we have:

Corollary 7. The protocol Π 1 AT is a strong C 1 -fine-grained (1 -negl(κ), δ, 1 -negl(κ), c, 1)-AT against C 2 .
Applying Lemma 5 to transform our single-bit AT into an ℓ-bit AT yields:

Corollary 8. The protocol Π ℓ AT is a strong C ′ 1 -fine-grained (1 -negl(κ), (δℓ -ℓ -δ + 2), 1 - negl(κ), c • ℓ, ℓ)-AT against C ′ 2 , where C ′ 1 = ℓ • C 1 and C ′ 2 = C 2 -ℓ • C 1 . Using δ = 1 -1 √ c and c = Ω(ℓ 2 ) for the single-bit AT Π 1 AT we get that δ ′ := 1 -ℓ-1 c and C ′ 1 = O(ℓ • c) and C ′ 2 = o(c 2 (1 -δ) -ℓ • c) = o(c 2 (1 -δ)) = o(c 1.5 ). A non-black-box change to the protocol Π 1
AT from Figs. 5 and 6 leads to better overall parameters. We introduce the necessary changes to the protocol alongside a security analysis in Appendix F.

Corollary 9. The protocol Π ℓ AT ′ defined in Appendix F is a strong C 1 -fine-grained (1-negl(κ), δ, 1- negl(κ))-AT against C 2 , where C 1 := O(c) and C 2 := o(c 2 (1 -δ)).

Undetectable Oblivious Transfer

For a candidate application of Anonymous Transfer we propose Undetectable Oblivious Transfer (UOT): An N party protocol with k = 2 participants, one sender and one receiver, performing classical Oblivious Transfer without (1) the sender knowing which of the N -1 other individuals is the receiver, (2) the receiver knowing which of the N -1 other individuals is the sender, and (3) the dummy friends knowing that a computation is in progress at all.

To that end we require an additional property for Anonymous Transfer protocols which we define in Section 6.1 which hides the output of an AT from the dummy friends.

We then define in Section 6.2 the security properties of an Undetectable Oblivious Transfer scheme. We additionally provide a candidate instantiation for N = 3 that can be canonically extended to any number N > 3 in Appendix G.

Strong Anonymous Transfer

For several applications we require the additional property that the real message can only be extracted by the real receiver. This gives rise to a stronger definition of AT:

Definition 7 (Strong (ε, δ, ς, c, ℓ)-Anonymous Transfer). A strong (ε, δ, ς, c, ℓ)-Anonymous
Transfer is defined analogously to a (ε, δ, c, ℓ)-Anonymous Transfer from Definition 3 but additionally satisfies ς-secrecy from Definition 8.

The additional property we require formally states that without the receivers random tape, the message cannot be successfully reconstructed from the transcript. We focus on the 3-party case, since case captures the primitive we will need to construct undetectable oblivious transfer; the definition can however easily be generalized to any number of parties.

Definition 8 (ς-Secrecy). For any sufficiently large security parameter κ, any message length ℓ ∈ poly(κ), any message Σ ∈ {0, 1} ℓ , any number of individuals N ∈ poly(κ), any PPT reconstruction algorithm A, and any CRS crs ← Setup(1 κ ), an Anonymous Transfer protocol Π ℓ AT between players

(P 0 , P 1 , R) is ς-secret if it holds that: Pr π ← Transfer ⟨R,P0,P1⟩ (crs, b, Σ) Σ ′ ← A(crs, π) : Σ = Σ ′ - 1 2 ℓ ≤ (1 -ς) • 2 ℓ -1 2 ℓ ( 20
)
The secrecy is a value between 0 and 1, where ς = 0 implies that A can reconstruct Σ with absolute certainty and ς = 1 means that Σ can at best be guessed. Note that secrecy requires T R to remain secret. Hence, the transformation to silent receiver AT from Section 3.5 does not preserve secrecy. Π U OT ,A,ϖ (κ).

Exp anon-ot Π U OT ,A,ϖ (κ) crs $ ← Setup(1 κ ) (Σ0,

Definitions for Undetectable Oblivious Transfer

Towards our goal of undetectable multiparty computation we consider a notion of undetectable oblivious transfer. In Undetectable Oblivious Transfer we have a set of N parties. Two of which want to run an Oblivious Transfer protocol without the participants learning with whom they executed the OT, and without the N -2 other parties realizing that the protocol is executed.

Definition 9 ((ε, δ, c, ℓ)-Undetectable Oblivious Transfer). An (ε, δ, c, ℓ)-Undetectable Oblivious Transfer for ε, δ ∈ R [0,1] and ℓ, c ∈ N is a tuple containing three PPT algorithms (Setup, OT, Reconstruct). The number of rounds in the OT protocol is given as c and the bitlength ℓ defines the length of the transferred message Σ σ . The algorithms are defined as follows:

Setup(1 κ ) takes as input the security parameter 1 κ in unary encoding and outputs a Common Reference String crs. OT(crs, ϖ, Σ 0 , Σ 1 , σ) is a c-round protocol that takes as input the Common Reference String crs, a permutation ϖ ∈ S N to determine which of (P 1 , . . . , P N ) is the sender, which is the receiver and which are the dummy friends, two messages Σ 0 and Σ 1 ∈ {0, 1} ℓ from the sender and one bit σ ∈ {0, 1} from the receiver and outputs a transcript π. The non-sender send independent uniformly distributed noise in each round. Reconstruct(crs, π, T R ) is a local algorithm executed by the receiver that takes as input the CRS crs, protocol transcript π and the receiver's random tape T R and outputs a message Σ σ .

The algorithms additionally satisfy the ε-correctness, the δ-anonymity and the privacy from Definitions 10 to 12.

Definition 10 (ε-Correctness). An Undetectable Oblivious Transfer protocol between players

(P 1 , . . . , P N ) is ε-Correct if for any ϖ ∈ S N , any (Σ 0 , Σ 1 ) ∈ {0, 1} 2ℓ , any σ ∈ {0, 1} and any crs ← Setup(1 κ ), Pr π $ ← OT ⟨ϖ(P1,...,P N )⟩ (crs, (Σ 0 , Σ 1 ), σ) Σ ′ σ ← Reconstruct(crs, π, T R ) : Σ σ = Σ ′ σ ≥ ε (21)
This is quite similar to the definition of correctness for AT from Definition 4.

Definition 11 (δ-Anonymity

). An Undetectable Oblivious Transfer protocol between players (P 1 , . . . , P N ) is δ-Anonymous if for any PPT guessing algorithm A = (A 0 , A 1 ), it holds that

Pr ϖ $ ←S N Exp anon-ot Π U OT ,A,ϖ (κ) = ϖ -1/(N -1) ≤ (1 -δ) • (N -2) (N -1) ( 22
)
S N is the symmetric group over N elements alongside all possible bijections into themselves and ϖ is a random permutation drawn from that set. This reflects the intuition that a participant is trying to recover the permutation after finishing the execution. The guessing algorithm A 0 selects which party to corrupt (in a semi-honest setting, hence post-execution) and which messages should be transferred. A 1 gets the random tape of the corrupted party and the state st of the adversary that selected which party to corrupt. The definition implies uncertainty of the sender regarding which of the two parties was acting as receiver and of the receiver regarding which of the two parties was the sender. Additionally we require that the dummy friend can only guess as well.

Definition 12 (Privacy). An Undetectable Oblivious Transfer protocol between players (P 1 , . . . , P N ) is private for the sender and the receiver if for any guessing algorithm A, any ϖ ∈ S N , any (Σ 0 , Σ 1 ) ∈ {0, 1} 2ℓ , any σ ∈ {0, 1} and any crs ← Setup(1 κ ), the following two conditions hold against every PPT guessing algorithm A:

Pr π ← OT ϖ(P1,...,P N ) (crs, (Σ 0 , Σ 1 ), σ) Σ ′ σ ← A(π, T R ) : Σ σ = Σ ′ σ ∈ negl(κ) (23) Pr π ← OT ϖ(P1,...,P N ) (crs, (Σ 0 , Σ 1 ), σ) σ ′ ← A(π, T S ) : σ = σ ′ -1/2 ∈ negl(κ) (24)
For the sender this means that even with the random tape T R of the receiver it is not efficiently possible for the guessing algorithm A to predict the message Σ σ that was not transferred. For the receiver this implies security of the choice despite having the random tape T S of the sender.

Towards Undetectable Multiparty Computation

In this section, we make a first step to define Undetectable Multiparty Computation by providing an informal definition of the security requirement in Section 7.1 and a candidate instantiation for Undetectable Two-Party Computation (U2PC) in Section 7.2.

Defining Undetectable Multiparty Computation

In this section, we informally define the security requirements of Undetectable Multiparty Computation as the increment to the respective definition of Undetectable Oblivious Transfer from Section 6.2.

Again, we have N individuals, but now k of them are trying to compute a function f on k secret inputs.

ε-Correctness: This definition states that all players obtain the correct result of f evaluated on the k inputs. δ-Anonymity: This definition states that any of the N players, each of the N -1 k-1 subsets of remaining individuals is equally likely to have participated in the execution. Privacy: This definition enforces that each participants individual input remains private; that is, after the computation no party learns more on the other participants' input than what can be inferred from the result of the computation.

Towards constructing Undetectable Two-Party Computation from Undetectable Oblivious Transfer

We provide a candidate construction for the simpler case of k = 2 which we call Undetectable Two-Party Computation. That is, two parties out of N try to compute a bivariate function f on their respective secret inputs. To that end we use a covert two-party computation protocol like that from von Ahn, Hopper, and Langford [vHL05] that uses COT for communication and replace all invocations of COT between the sender and the receiver by invocations of Undetectable Oblivious Transfer between all participants. That way, the message is transferred from the sender to the receiver without leaking information regarding the identity of the respective parties. The protocol by von Ahn, Hopper, and Langford [vHL05] essentially uses garbled circuits [Yao86] and distributes the keys using COT instead of using classical OT. The protocol we propose replaces the COTs with UOTs where from the N parties only two are actually participating, one as sender and one as receiver.

Assuming that each UOT is correct with overwhelming probability the correctness of the entire scheme then follows from the correctness of garbled circuits.

Anonymity remains the same as in order to determine any of the participating parties, the only way is to de-anonymize any of the UOTs, the success probability of which is bounded by δ.

Privacy is inherited by the Garbled Circuits; since the Undetectable Oblivious Transfers are private as well our changes induce no additional leakage.

Finally, note that for a garbled circuit we require |f | many OTs and each requires c rounds, resulting in the new number of rounds.

Appendix

A Preliminaries

In this section we introduce some additional preliminaries we consider necessary for understanding the remainder of the appendix.

A.1 Covert Oblivious Transfer

Covert Oblivious Transfer is an extension of classical Oblivious Transfer first defined and used by von Ahn, Hopper, and Langford [vHL05]. It extends classical OT by two important properties that ensure the computation cannot be distinguished from an innocent-looking conversation: (1)the sender cannot distinguish between the case that the receiver is following the COT protocol or if the receiver is sending uniformly random messages, and (2)if the transferred messages are uniformly random, the receiver cannot distinguish between the case that the sender is following the COT protocol and the case where the sender is sending uniformly random messages. The latter has to hold even after the protocol execution is finished, as the authors use Covert Oblivious Transfer during the execution of their Covert Multiparty Computation protocol and actual participation should not be revealed before the computation finishes.

Definition 13 (Covert Oblivious Transfer, [vHL05, Appendix A]). A 2-party Covert Oblivious Transfer (COT) between a sender S and a receiver R is an Oblivious Transfer but additionally fulfills the following two requirements:

(1) S cannot distinguish between the case that R is following the COT protocol and the case that R is drawing uniformly random messages from

U m . (2) If Σ 0 , Σ 1 $ ← U m ,
R cannot distinguish between the case that S is following the COT protocol and the case that S is drawing uniformly random messages from U m .

A.2 Indistinguishability from Random Bits under Chosen Ciphertext Attacks

For our instantiations it is crucial that protocol messages can be transferred covertly, that is, without bystanders noticing. To that end we require an encryption that yields ciphertexts which look like uniformly random strings. A formal property ensuring this was defined by Rogaway [Rog04] as Indistinguishability from Random Bits.

While the paper also defines IND$-CPA, we focus on chosen ciphertext attacks only and provide definitions for symmetric and asymmetric schemes. For symmetric encryption schemes the definition looks as follows:

Definition 14 (IND$-CCA for Symmetric Encryption). A Symmetric Encryption Scheme

Ske = (KeyGen, Enc, Dec) fulfills Indistinguishability from Random Bits under Chosen Ciphertext Attacks (IND$-CCA) if the following condition holds for all PPT valid adversaries A that do not decrypt a challenge:

| Pr[sk ← KeyGen(1 κ ) : A Enc(sk,•),Dec(sk,•) = 1] -Pr[sk ← KeyGen(1 κ ) : A F(•),Dec(sk,•) = 1]| ∈ negl(κ) (25)
F is a random function. It is hence the adversaries task to distinguish whether it is interacting with a random oracle or with an actual encryption oracle. The definition for asymmetric schemes is equivalent except that the adversary is additionally given a public key. Yet the challenge still comes from either an encryption oracle or a random oracle.

Definition 15 (IND$-CCA for Asymmetric Encryption). An Asymmetric Encryption Scheme

Pke = (KeyGen, Enc, Dec) fulfills Indistinguishability from Random Bits under Chosen Ciphertext Attacks (IND$-CCA) if the following condition holds for all PPT valid adversaries A that do not decrypt a challenge:

| Pr[(pk, sk) ← KeyGen(1 κ ) : A Enc(sk,•),Dec(sk,•) (pk) = 1] -Pr[(pk, sk) ← KeyGen(1 κ ) : A F(•),Dec(sk,•) (pk) = 1]| ∈ negl(κ) (26)

A.3 Strong Existential Unforgeability under Chosen Message Attacks

For our construction we rely on a signature scheme. Their security is defined as follows [START_REF] Goldreich | Foundations of Cryptography: Basic Applications[END_REF]:

Definition
Pr (vk, k) ← Sig.KeyGen(1 κ ) (µ * , X * ) ← A Sig(k,•) (vk, 1 κ ) : Sig.Vfy(vk, µ * , X * ) = 1 ∈ negl(κ) (27)
and for all queries X to Sig(k, •) which were returned by a signature µ it holds that X ̸ = X * and µ ̸ = µ * .

A.4 Ideal Obfuscation

We use an abstract concept of idealized obfuscation which replaces a given program P directly with an oracle that evaluates the program on the given input. This notion has recently been rigorously studied by Jain, Lin, Luo, and Wichs [JLL + 22], who treat it as a theoretical, idealized concept (comparable to the Random Oracle Model), rather than a security property (like Virtual Black-Box Obfuscation). Due to Jain, Lin, Luo, and Wichs [JLL + 22], a proof under ideal obfuscation can be seen as heuristic evidence that the protocol is secure. In the following we adapt the definitions provided by Jain, Lin, Luo, and Wichs [JLL + 22, Section 5].

Definition 17 (Ideal Obfuscation

). An ideal obfuscator describes the existence of two oracles (Obfuscate, Evaluate), where

Obfuscate takes as input a program P and randomly samples a handle h ∈ {0, 1} κ , saves (P , h) in a list and returns h; Evaluate takes as input a handle h and an input x and searches for h in the list. If h is in the list,

evaluate the corresponding program P on the given input x and return its output, otherwise output ⊥.

Ideal obfuscation is called secure if for all efficient adversaries A = (A 1 , A 2 ) there are efficient simulators S = (S 1 , S 2 , S 3 ) such that the following advantage is negligible:

Pr (P , st) ← A Obf 1 (1 κ ) P * ← Obfuscate(1 κ , P ) : A Obf 2 (P * , st) = 1 -Pr (P , st) ← A S1 1 (1 κ ) P * ← S P 2 (1 κ , 1 |P | , P ) : A S P 3 2 (P * , st) = 1

B Proof of Lemma 3

As this lemma is crucial for proving security of our fine-grained construction of Anonymous Transfer in Section 5 we provide a formal proof here for the following lemma:

Lemma 3 (Distinguishing distributions based on the Total Variational Distance). Let p and q be two distributions with total variational distance d TV (p, q). If d TV (p, q) < 1 3 , then no algorithm can exist that distinguishes p and q with probability ≥ 2 3 based on a single sample. We stress here that this is not our proof but instead adapted from http://cs.brown.edu/courses/ csci1951-w/lec/lec%2011%20notes.pdf. Since we did not find a citeable source our adapted proof follows, which basically follows the source:

Proof. Let D be the distinguisher between p and q. Due to symmetry it holds for the correctness that the optimal algorithm has:

Pr[out D = p|p] -Pr[out D = p|q] = Pr[out D = p|q] -Pr[out D = q|q] = d TV (p, q) (28)
With a single sample the adversary can only output a single bit indicating whether it thinks the sample is from p or from q. This can not be done with better than d TV (p, q). To get an intuition as to why this is the case, the total variational distance can also be written as:

d TV (p, q) := sup X⊆[n] p(X) -q(X) (29)
that is, it corresponds to the largest difference in the probability of occurrence of some output. Thus, no distinguisher can-with a single sample-guess correctly with larger advantage than d TV (p, q). Guessing is always an option, which would result in the distinguisher being correct with probability 1/2. Thus, there can be no distinguisher which fulfills both these inequalities:

Pr[out D = p|p] > 1 2 + 1 2 • d TV (p, q) Pr[out D = q|q] > 1 2 + 1 2 • d TV (p, q) (30)
as this would imply an overall correctness larger than d TV (p, q). By using the requirement that d TV (p, q) < 1/3 in Eq. ( 30) we get the bound of 2/3 on the correctness of D.

⊓ ⊔

C Proof of Corollary 1

In this section we provide a full proof of the following corollary:

Corollary 1 (Distinguishing two Bernoulli-Distributions with t samples). Any distinguisher D that distinguishes between p and q with probability ≥ 1 2 + α 2 requires t ∈ Ω α d TV (p,q) samples.

Proof. The total variational distance limits the advantage as α = d TV (p ⊗t , q ⊗t ).

We know from the subadditivity of d TV that

d TV (p ⊗t , q ⊗t ) ≤ t • d TV (p, q) (31)
and as such, (p,q) . We claim that this even holds for C = 1 4 . This implies for Lemma 1 that

Pr[D correct] ≤ 1/2 + 1/2 • t • d TV (p, q) (32) We have that t ∈ Ω α d TV (p,q) =⇒ t ≥ α•C d TV
d TV (p ⊗t , q ⊗t ) ≤ C • α d TV (p, q) d TV (p, q) = αC = α 4 (33)
Thus, the total variation distance is less than α/4 for α ≤ 1, which in term is less than 1/3. Remember that d TV (p ⊗t , q ⊗t ) corresponds to distinguishing the t-fold (binomial) distribution with a single sample. Thus Lemma 3 states that with total variation distance less than 1/3 no distinguisher D can successfully distinguish with probability ≥ 2/3. ⊓ ⊔

D Security proof for the Fine-Grained Protocol

D.1 Full Proof of Correctness

In this section we provide the full proof of correctness for the fine-grained instantiation of Anonymous Transfer. In particular, we provide a proof for the following lemma:

Theorem 4 (Correctness). If the protocol from Fig. 5 is instantiated with an Ideally Obfuscated version of the circuit from Fig. 6 the protocol is ε-correct with ε = (1 -negl(κ)).

Proof. In a correct execution, there is one sender P b who encodes the bit σ b in the first round. Every round that follows has to have a valid signature µ on both messages of the previous round.

With honest people doing that, the only way that correctness is not given is if the circuit confuses P 1-b to be P b . This only happens if the inputs sent by P 1-b are interpreted as valid inputs, causing the argmax to return the bit of P 1-b . Since we assume the sending party to act honestly, the value of χ b is c which is as high as this variable can go. Thus, if the argmax ever returns (1 -b), then P 1-b has sent for c rounds a valid encryption of σ 1-b := (1 -σ b ) (if we assume a non-correct output, the bit has to differ, naturally) and a valid signature on π[χ -1] in each of the c rounds.

By requirement, Pke has sparse ciphertexts. With P 1-b sending uniformly random ciphertexts, the probability that this is a valid ciphertext is negligible in κ.

Assuming that P 1-b had a valid ciphertext by chance, the probability that it encodes the same bit that was decrypted in the first round is given by 1/2; yet the probability that the signature verifies the previous round is negligible. Now we have χ rounds. In each round we have a probability of negl(κ) • 1/2 • negl(κ) that the message is valid. So for P 1-b to accidentally send valid messages of 1 -σ b , the probability is given by (negl(κ) • 1/2 • negl(κ)) c . Additionally, in round 0 there has to be a valid encryption of 1 -σ b , which also happens with negligible probability as once more we have the sparseness of Pke. And in the negligible case that the message counts as cipher, there is only a probability of 1/2 that the message encodes the correct bit.

Thus, in an honest protocol execution, the output of the circuit is σ ′ b = OTP ⊕ σ b with overwhelming probability. Thus by outputting OTP ⊕ σ ′ b = OTP ⊕ OTP ⊕ σ b = σ b the receiver will output the correct bit with overwhelming probability.

Thus according to the definition of ε-correctness from Eq. (3) we get ε ∈ (1 -negl(κ)). This concludes our proof.

⊓ ⊔

D.2 Graphical Depiction of the Anonymity Proof

Game 1 (κ) (1/2) (0, 1) 21 : χ 0 := Sig.Vfy(µ

(0) 0 , vk0, x (0) R ) • (c + 1) 22 : χ 1 := Sig.Vfy(µ (0) 1 , vk1, x (0) R ) • (c + 1) 23 : foreach χ ∈ {1, . . . , c} do 24 : foreach b ∈ {0, 1}|χ b > c do 25 : X b := Ske.Dec * (skb, x (χ) b ) 26 : σ ′ b := X b[0] 27 : µ χ b := X b[1 : |X b|] 28 : if ¬Sig.Vfy(µ (χ) b , vkb, π[χ -1]) ∨ σb ̸ = σ ′ b then 29 : χ b := χ 30 : b ′ := argmax b (χ b ) 31 : return OTP ⊕ CointossS (π) (1/2+χ b /2c) (σ (b ′ ) , 1 -σ (b ′ ) ) 32 :
1 : R :

2 : OTP $ ← {0, 1} 3 : (kR, vkR) ← Sig.KeyGen(1 κ ) 4 : x (0)
R ← Pke.Enc(pk P , (OTP, vkR)) 5 : Pb : Pb :

6 : (kb, vkb) ← Sig.KeyGen(1 κ ) 7 : (skb) ← Ske.KeyGen(1 κ ) 8 : (µ (0) b ) ← Sig.Sig(kb, x (0) R ) 9 : x
14 : µ (χ) ← Sig.Sig(kb, (x

(χ-1) 0 , x (χ-1) 1
))

15 : x (1/2) (0, 1) 21 : χ 0 := Sig.Vfy(µ

(0) 0 , vk0, x (0) R ) • (c + 1) 22 : χ 1 := Sig.Vfy(µ (0) 1 , vk1, x (0) R ) • (c + 1) 23 : foreach χ ∈ {1, . . . , c} do 24 : foreach b ∈ {0, 1}|χ b > c do 25 : X b := Ske.Dec * (skb, x (χ) b ) 26 : σ ′ b := X b[0] 27 : µ χ b := X b[1 : |X b|] 28 : if ¬Sig.Vfy(µ (χ) b , vkb, π[χ -1]) ∨ σb ̸ = σ ′ b then 29 : χ b := χ 30 : b ′ := argmax b (χ b ) 31 : return OTP ⊕ CointossS (π) (1/2+χ b /2c) (σ (b ′ ) , 1 -σ (b ′ ) ) 32 :
1 : R :

2 : OTP $ ← {0, 1} 3 : (kR, vkR) ← Sig.KeyGen(1 κ ) 4 : x (0)
R ← Pke.Enc(pk P , (OTP, vkR)) 5 : Pb : Pb :

6 : (kb, vkb) ← Sig.KeyGen(1 κ ) 7 : (skb) ← Ske.KeyGen(1 κ ) 8 : (µ (0) b ) ← Sig.Sig(kb, x (0) R ) 9 : x
14 : µ (χ) ← Sig.Sig(kb, (x

(χ-1) 0 , x (χ-1) 1
))

15 : x (1/2) (0, 1) 21 : χ 0 := Sig.Vfy(µ

(0) 0 , vk0, x (0) R ) • (c + 1) 22 : χ 1 := Sig.Vfy(µ (0) 1 , vk1, x (0) R ) • (c + 1) 23 : foreach χ ∈ {1, . . . , c} do 24 : foreach b ∈ {0, 1}|χ b > c do 25 : X b := Ske.Dec * (skb, x (χ) b ) 26 : σ ′ b := X b[0] 27 : µ χ b := X b[1 : |X b|] 28 : if ¬Sig.Vfy(µ (χ) b , vkb, π[χ -1]) ∨ σb ̸ = σ ′ b then 29 : χ b := χ 30 : b ′ := argmax b (χ b ) 31 : return OTP ⊕ CointossS (π) (1/2+χ b /2c) (σ (b ′ ) , 1 -σ (b ′ ) ) 32 :
1 : R :

2 : OTP $ ← {0, 1} 3 : (kR, vkR) ← Sig.KeyGen(1 κ ) 4 : x (0)
R ← Pke.Enc(pk P , (OTP, vkR)) 5 : Pb : Pb :

6 : (kb, vkb) ← Sig.KeyGen(1 κ ) 7 : (skb) ← Ske.KeyGen(1 κ ) 8 : (µ (0) b ) ← Sig.Sig(kb, x (0) R ) 9 : x
14 : µ (χ) ← Sig.Sig(kb, (x

(χ-1) 0 , x (χ-1) 1
))

15 : x (1/2) (0, 1) 21 : χ 0 := Sig.Vfy(µ

(0) 0 , vk0, x (0) R ) • (c + 1) 22 : χ 1 := Sig.Vfy(µ (0) 1 , vk1, x (0) R ) • (c + 1) 23 : foreach χ ∈ {1, . . . , c} do 24 : foreach b ∈ {0, 1}|χ b > c do 25 : X b := Ske.Dec * (skb, x (χ) b ) 26 : σ ′ b := X b[0] 27 : µ χ b := X b[1 : |X b|] 28 : if ¬Sig.Vfy(µ (χ) b , vkb, π[χ -1]) ∨ σb ̸ = σ ′ b then 29 : χ b := χ 30 : b ′ := argmax b (χ b ) 31 : return OTP ⊕ CointossS (π) (1/2+χ b /2c) (σ (b ′ ) , 1 -σ (b ′ ) ) 32 :
1 : R :

2 : OTP $ ← {0, 1} 3 : (kR, vkR) ← Sig.KeyGen(1 κ ) 4 : x (0)
R ← Pke.Enc(pk P , (OTP, vkR)) 5 : Pb : Pb :

6 : (kb, vkb) ← Sig.KeyGen(1 κ ) 7 : (skb) ← Ske.KeyGen(1 κ ) 8 : (µ (0) b ) ← Sig.Sig(kb, x (0) R ) 9 : x
14 : µ (χ) ← Sig.Sig(kb, (x

(χ-1) 0 , x (χ-1) 1
))

15 : x (1/2) (0, 1) 21 : χ 0 := Sig.Vfy(µ

(0) 0 , vk0, x (0) R ) • (c + 1) 22 : χ 1 := Sig.Vfy(µ (0) 1 , vk1, x (0) R ) • (c + 1) 23 : foreach χ ∈ {1, . . . , c} do 24 : foreach b ∈ {0, 1}|χ b > c do 25 : X b := Ske.Dec * (skb, x (χ) b ) 26 : σ ′ b := X b[0] 27 : µ χ b := X b[1 : |X b|] 28 : if ¬Sig.Vfy(µ (χ) b , vkb, π[χ -1]) ∨ σb ̸ = σ ′ b then 29 : χ b := χ 30 : b ′ := argmax b (χ b ) 31 : return OTP ⊕ CointossS (π) (1/2+χ b /2c) (σ (b ′ ) , 1 -σ (b ′ ) ) 32 :
1 : R :

2 : OTP $ ← {0, 1} 3 : (kR, vkR) ← Sig.KeyGen(1 κ ) 4 : x (0)
R ← Pke.Enc(pk P , (OTP, vkR)) 5 : Pb : Pb :

6 : (kb, vkb) ← Sig.KeyGen(1 κ ) 7 : (skb) ← Ske.KeyGen(1 κ ) 8 : (µ (0) b ) ← Sig.Sig(kb, x (0) R ) 9 : x
14 : µ (χ) ← Sig.Sig(kb, (x

(χ-1) 0 , x (χ-1) 1
))

15 : x (1/2) (0, 1) 21 : χ 0 := Sig.Vfy(µ

(0) 0 , vk0, x (0) R ) • (c + 1) 22 : χ 1 := Sig.Vfy(µ (0) 1 , vk1, x (0) R ) • (c + 1) 23 : foreach χ ∈ {1, . . . , c} do 24 : foreach b ∈ {0, 1}|χ b > c do 25 : X b := Ske.Dec * (skb, x (χ) b ) 26 : σ ′ b := X b[0] 27 : µ χ b := X b[1 : |X b|] 28 : if ¬Sig.Vfy(µ (χ) b , vkb, π[χ -1]) ∨ σb ̸ = σ ′ b then 29 : χ b := χ 30 : b ′ := argmax b (χ b ) 31 : return OTP ⊕ CointossS (π) (1/2+χ b /2c) (σ (b ′ ) , 1 -σ (b ′ ) ) 32 :
1 : R :

2 : OTP $ ← {0, 1} 3 : (kR, vkR) ← Sig.KeyGen(1 κ ) 4 : x (0)
R ← Pke.Enc(pk P , (OTP, vkR)) 5 : Pb : Pb :

6 : (kb, vkb) ← Sig.KeyGen(1 κ ) 7 : (skb) ← Ske.KeyGen(1 κ ) 8 : (µ (0) b ) ← Sig.Sig(kb, x (0) R ) 9 : x
14 : µ (χ) ← Sig.Sig(kb, (x

(χ-1) 0 , x (χ-1) 1
))

15 : x (1/2) (0, 1) 21 : χ 0 := Sig.Vfy(µ

(0) 0 , vk0, x (0) R ) • (c + 1) 22 : χ 1 := Sig.Vfy(µ (0) 1 , vk1, x (0) R ) • (c + 1) 23 : foreach χ ∈ {1, . . . , c} do 24 : foreach b ∈ {0, 1}|χ b > c do 25 : X b := Ske.Dec * (skb, x (χ) b ) 26 : σ ′ b := X b[0] 27 : µ χ b := X b[1 : |X b|] 28 : if ¬Sig.Vfy(µ (χ) b , vkb, π[χ -1]) ∨ σb ̸ = σ ′ b then 29 : χ b := χ 30 : b ′ := argmax b (χ b ) 31 : return OTP ⊕ CointossS (π) (1/2+χ b /2c) (σ (b ′ ) , 1 -σ (b ′ ) ) 32 :
1 : R :

2 : OTP $ ← {0, 1} 3 : (kR, vkR) ← Sig.KeyGen(1 κ ) 4 : x (0)
R ← Pke.Enc(pk P , (OTP, vkR)) 5 : Pb : Pb :

6 : (kb, vkb) ← Sig.KeyGen(1 κ ) 7 : (skb) ← Ske.KeyGen(1 κ ) 8 : (µ (0) b ) ← Sig.Sig(kb, x (0) R ) 9 : x
14 : µ (χ) ← Sig.Sig(kb, (x

(χ-1) 0 , x (χ-1) 1
))

15 : x Game 5 (κ)

1 : if π = πC then 2 : return OTPC ⊕ σC 3 : elseif Pke.Dec * (skP , π[0]) = Pke.Dec * (skP , πC[0])∧ 4 : π[0] ̸ = πC[0] then 5 : abort 6 : elseif π[0] = πC[0] then 7 : χ * := argmin χ ′ (π[χ ′ ] ̸ = πC[χ ′ ]) 8 : if π[x χ * +1 b C ] = πC[x χ * +1 b C ]∨ 9 : Ske.Dec * (skb C , x (χ * +1) b C ) = (σC∥µ C (χ * +1) ) then 10 : χ * := χ * + 1 11 : p := 1/2 + χ * /2c 12 : return OTPC ⊕ CointossS (π) (p) (σC, σC) 13 : if π[x (0) R ] = πC[x (0) R ] then 14 :
(OTP, vkR) := (OTPC, vkC R )

15 : (sk0, vk0) := Pke.Dec(skP , x (1/2) (0, 1) 21 : χ 0 := Sig.Vfy(µ

(0) 0 , vk0, x (0) R ) • (c + 1) 22 : χ 1 := Sig.Vfy(µ (0) 1 , vk1, x (0) R ) • (c + 1) 23 : foreach χ ∈ {1, . . . , c} do 24 : foreach b ∈ {0, 1}|χ b > c do 25 : X b := Ske.Dec * (skb, x (χ) b ) 26 : σ ′ b := X b[0] 27 : µ χ b := X b[1 : |X b|] 28 : if ¬Sig.Vfy(µ (χ) b , vkb, π[χ -1]) ∨ σb ̸ = σ ′ b then 29 : χ b := χ 30 : b ′ := argmax b (χ b ) 31 : return OTP ⊕ CointossS (π) (1/2+χ b /2c) (σ (b ′ ) , 1 -σ (b ′ ) ) 32 :
1 : R : Pb :

2 : OTP $ ← {0, 1} 3 : (kR, vkR) ← Sig.KeyGen(1 κ ) 4 : x (0) R ← Pke.Enc(pk P , (OTP, vkR)) 5 : Pb : 6 : (kb, vkb) ← Sig.KeyGen(1 κ ) 7 : (skb) ← Ske.KeyGen(1 κ ) 8 : (µ (0) b ) ← Sig.Sig(kb, x (0) R ) 9 : x
14 : µ (χ) ← Sig.Sig(kb, (x (χ-1) 0 , x (χ-1) 1
))

15 : x Game 5 (κ)

1 : if π = πC then 2 : return OTPC ⊕ σC 3 : elseif Pke.Dec * (skP , π[0]) = Pke.Dec * (skP , πC[0])∧ 4 : π[0] ̸ = πC[0] then 5 : abort 6 : elseif π[0] = πC[0] then 7 : χ * := argmin χ ′ (π[χ ′ ] ̸ = πC[χ ′ ]) 8 : if π[x χ * +1 b C ] = πC[x χ * +1 b C ]∨ 9 : Ske.Dec * (skb C , x (χ * +1) b C ) = (σC∥µ C (χ * +1) ) then 10 : χ * := χ * + 1 11 : p := 1/2 + χ * /2c 12 : return OTPC ⊕ CointossS (π) (p) (σC, σC) 13 : if π[x (0) R ] = πC[x (0) R ] then 14 :
(OTP, vkR) := (OTPC, vkC R )

15 : (sk0, vk0) := Pke.Dec(skP , x

(0) 0 [1 : m]) 16 : (σ0, µ (0) 0 ) := Ske.Dec(sk0, x (0) 0 [m + 1 : 2m]) 17 : (sk1, vk1) := Pke.Dec(skP , x (0) 1 [1 : m]) 18 : (σ1, µ (0) 1 ) := Ske.Dec(sk1, x (0) 1 [m + 1 : 2m]) 19 : if ¬Sig.Vfy(vkR, π) then 20 : return CointossS (π) (1/2) (0, 1) 21 : χ 0 := Sig.Vfy(µ (0) 0 , vk0, x (0) R ) • (c + 1) 22 : χ 1 := Sig.Vfy(µ (0) 1 , vk1, x (0) R ) • (c + 1) 23 : foreach χ ∈ {1, . . . , c} do 24 : foreach b ∈ {0, 1}|χ b > c do 25 : X b := Ske.Dec * (skb, x (χ) b ) 26 : σ ′ b := X b[0] 27 : µ χ b := X b[1 : |X b|] 28 : if ¬Sig.Vfy(µ (χ) b , vkb, π[χ -1]) ∨ σb ̸ = σ ′ b then 29 : χ b := χ 30 : b ′ := argmax b (χ b ) 31 : return OTP ⊕ CointossS (π) (1/2+χ b /2c) (σ (b ′ ) , 1 -σ (b ′ ) ) 32 :
1 : R : Pb :

2 : OTP $ ← {0, 1} 3 : (kR, vkR) ← Sig.KeyGen(1 κ ) 4 : x (0) R ← Pke.Enc(pk P , (OTP, vkR)) 5 : Pb : 6 : (kb, vkb) ← Sig.KeyGen(1 κ ) 7 : (skb) ← Ske.KeyGen(1 κ ) 8 : (µ (0) b ) ← Sig.Sig(kb, x (0) R ) 9 : x
14 : µ (χ) ← Sig.Sig(kb, (x (χ-1) 0 , x (χ-1) 1
))

15 : x Game 6 (κ)

1 : if π = πC then 2 : return OTPC ⊕ σC 3 : elseif Pke.Dec * (skP , π[0]) = Pke.Dec * (skP , πC[0])∧ 4 : π[0] ̸ = πC[0] then 5 : abort 6 : elseif π[0] = πC[0] then 7 : χ * := argmin χ ′ (π[χ ′ ] ̸ = πC[χ ′ ]) 8 : if π[x χ * +1 b C ] = πC[x χ * +1 b C ]∨ 9 : Ske.Dec * (skb C , x (χ * +1) b C ) = (σC∥µ C (χ * +1) ) then 10 : χ * := χ * + 1 11 : p := 1/2 + χ * /2c 12 : return OTPC ⊕ CointossS (π) (p) (σC, σC) 13 : if π[x (0) R ] = πC[x (0) R ] then 14 :
(OTP, vkR) := (OTPC, vkC R )

15 : (sk0, vk0) := Pke.Dec(skP , x

(0) 0 [1 : m]) 16 : (σ0, µ (0) 0 ) := Ske.Dec(sk0, x (0) 0 [m + 1 : 2m]) 17 : (sk1, vk1) := Pke.Dec(skP , x (0) 1 [1 : m]) 18 : (σ1, µ (0) 1 ) := Ske.Dec(sk1, x (0) 1 [m + 1 : 2m]) 19 : if ¬Sig.Vfy(vkR, π) then 20 : return CointossS (π) (1/2) (0, 1) 21 : χ 0 := Sig.Vfy(µ (0) 0 , vk0, x (0) R ) • (c + 1) 22 : χ 1 := Sig.Vfy(µ (0) 1 , vk1, x (0) R ) • (c + 1) 23 : foreach χ ∈ {1, . . . , c} do 24 : foreach b ∈ {0, 1}|χ b > c do 25 : X b := Ske.Dec * (skb, x (χ) b ) 26 : σ ′ b := X b[0] 27 : µ χ b := X b[1 : |X b|] 28 : if ¬Sig.Vfy(µ (χ) b , vkb, π[χ -1]) ∨ σb ̸ = σ ′ b then 29 : χ b := χ 30 : b ′ := argmax b (χ b ) 31 : return OTP ⊕ CointossS (π) (1/2+χ b /2c) (σ (b ′ ) , 1 -σ (b ′ ) ) 32 :
1 : R :

2 : OTP $ ← {0, 1} 3 : (kR, vkR) ← Sig.KeyGen(1 κ ) 4 : x (0) R $ ← {0, 1} m 5 : Pb : 6 : (kb, vkb) ← Sig.KeyGen(1 κ ) 7 : (skb) ← Ske.KeyGen(1 κ ) 8 : (µ (0) b ) ← Sig.Sig(kb, x (0) R ) 9 : x (0) b $ ← {0, 1} m ∥Ske.Enc(skb, (σ, µ (0) )) 10 : P b : 11 : x (0) b $ ← {0, 1} 2m
12 : foreach χ ∈ {1, . . . , c} do 13 :

Pb :

14 : µ (χ) ← Sig.Sig(kb, (x (χ-1) 0 , x (χ-1) 1
))

15 : x Game 6 (κ)

1 : if π = πC then 2 : return OTPC ⊕ σC 3 : elseif Pke.Dec * (skP , π[0]) = Pke.Dec * (skP , πC[0])∧ 4 : π[0] ̸ = πC[0] then 5 : abort 6 : elseif π[0] = πC[0] then 7 : χ * := argmin χ ′ (π[χ ′ ] ̸ = πC[χ ′ ]) 8 : if π[x χ * +1 b C ] = πC[x χ * +1 b C ]∨ 9 : Ske.Dec * (skb C , x (χ * +1) b C ) = (σC∥µ C (χ * +1) ) then 10 : χ * := χ * + 1 11 : p := 1/2 + χ * /2c 12 : return OTPC ⊕ CointossS (π) (p) (σC, σC) 13 : if π[x (0) R ] = πC[x (0) R ] then 14 :
(OTP, vkR) := (OTPC, vkC R )

15 : (sk0, vk0) := Pke.Dec(skP , x

(0) 0 [1 : m]) 16 : (σ0, µ (0) 0 ) := Ske.Dec(sk0, x (0) 0 [m + 1 : 2m]) 17 : (sk1, vk1) := Pke.Dec(skP , x (0) 1 [1 : m]) 18 : (σ1, µ (0) 1 ) := Ske.Dec(sk1, x (0) 1 [m + 1 : 2m]) 19 : if ¬Sig.Vfy(vkR, π) then 20 : return CointossS (π) (1/2) (0, 1) 21 : χ 0 := Sig.Vfy(µ (0) 0 , vk0, x (0) R ) • (c + 1) 22 : χ 1 := Sig.Vfy(µ (0) 1 , vk1, x (0) R ) • (c + 1) 23 : foreach χ ∈ {1, . . . , c} do 24 : foreach b ∈ {0, 1}|χ b > c do 25 : X b := Ske.Dec * (skb, x (χ) b ) 26 : σ ′ b := X b[0] 27 : µ χ b := X b[1 : |X b|] 28 : if ¬Sig.Vfy(µ (χ) b , vkb, π[χ -1]) ∨ σb ̸ = σ ′ b then 29 : χ b := χ 30 : b ′ := argmax b (χ b ) 31 : return OTP ⊕ CointossS (π) (1/2+χ b /2c) (σ (b ′ ) , 1 -σ (b ′ ) ) 32 :
1 : R :

2 : OTP $ ← {0, 1} 3 : (kR, vkR) ← Sig.KeyGen(1 κ ) 4 : x (0) R $ ← {0, 1} m 5 : Pb : 6 : (kb, vkb) ← Sig.KeyGen(1 κ ) 7 : (skb) ← Ske.KeyGen(1 κ ) 8 : (µ (0) b ) ← Sig.Sig(kb, x (0) R ) 9 : x (0) b $ ← {0, 1} m ∥Ske.Enc(skb, (σ, µ (0) )) 10 : P b : 11 : x (0) b $ ← {0, 1} 2m
12 : foreach χ ∈ {1, . . . , c} do 13 :

Pb :

14 : µ (χ) ← Sig.Sig(kb, (x (χ-1) 0 , x (χ-1) 1
))

15 : x Game 7 (κ)

1 : if π = πC then 2 : return OTPC ⊕ σC 3 : elseif Pke.Dec * (skP , π[0]) = Pke.Dec * (skP , πC[0])∧ 4 : π[0] ̸ = πC[0] then 5 : abort 6 : elseif π[0] = πC[0] then 7 : χ * := argmin χ ′ (π[χ ′ ] ̸ = πC[χ ′ ]) 8 : if π[x χ * +1 b C ] = πC[x χ * +1 b C ]∨ 9 : Ske.Dec * (skb C , x (χ * +1) b C ) = (σC∥µ C (χ * +1) ) then 10 : χ * := χ * + 1 11 : p := 1/2 + χ * /2c 12 : return OTPC ⊕ CointossS (π) (p) (σC, σC) 13 : if π[x (0) R ] = πC[x (0) R ] then 14 :
(OTP, vkR) := (OTPC, vkC R )

15 : (sk0, vk0) := Pke.Dec(skP , x

(0) 0 [1 : m]) 16 : (σ0, µ (0) 0 ) := Ske.Dec(sk0, x (0) 0 [m + 1 : 2m]) 17 : (sk1, vk1) := Pke.Dec(skP , x (0) 1 [1 : m]) 18 : (σ1, µ (0) 1 ) := Ske.Dec(sk1, x (0) 1 [m + 1 : 2m]) 19 : if ¬Sig.Vfy(vkR, π) then 20 : return CointossS (π) (1/2) (0, 1) 21 : χ 0 := Sig.Vfy(µ (0) 0 , vk0, x (0) R ) • (c + 1) 22 : χ 1 := Sig.Vfy(µ (0) 1 , vk1, x (0) R ) • (c + 1) 23 : foreach χ ∈ {1, . . . , c} do 24 : foreach b ∈ {0, 1}|χ b > c do 25 : X b := Ske.Dec * (skb, x (χ) b ) 26 : σ ′ b := X b[0] 27 : µ χ b := X b[1 : |X b|] 28 : if ¬Sig.Vfy(µ (χ) b , vkb, π[χ -1]) ∨ σb ̸ = σ ′ b then 29 : χ b := χ 30 : b ′ := argmax b (χ b ) 31 : return OTP ⊕ CointossS (π) (1/2+χ b /2c) (σ (b ′ ) , 1 -σ (b ′ ) ) 32 :
1 : R : Game 7 (κ)

2 : OTP $ ← {0, 1} 3 : (kR, vkR) ← Sig.KeyGen(1 κ ) 4 : x (0) R $ ← {0, 1} m 5 : Pb : 6 : - 7 : - 8 : - 9 : x (0) b $ ← {0, 1}
1 : if π = πC then 2 : return OTPC ⊕ σC 3 : elseif Pke.Dec * (skP , π[0]) = Pke.Dec * (skP , πC[0])∧ 4 : π[0] ̸ = πC[0] then 5 : abort 6 : elseif π[0] = πC[0] then 7 : χ * := argmin χ ′ (π[χ ′ ] ̸ = πC[χ ′ ]) 8 : if π[x χ * +1 b C ] = πC[x χ * +1 b C ]∨ 9 : Ske.Dec * (skb C , x (χ * +1) b C ) = (σC∥µ C (χ * +1) ) then 10 : χ * := χ * + 1 11 : p := 1/2 + χ * /2c 12 : return OTPC ⊕ CointossS (π) (p) (σC, σC) 13 : if π[x (0) R ] = πC[x (0) R ] then 14 :
(OTP, vkR) := (OTPC, vkC R )

15 : (sk0, vk0) := Pke.Dec(skP , x

(0) 0 [1 : m]) 16 : (σ0, µ (0) 0 ) := Ske.Dec(sk0, x (0) 0 [m + 1 : 2m]) 17 : (sk1, vk1) := Pke.Dec(skP , x (0) 1 [1 : m]) 18 : (σ1, µ (0) 1 ) := Ske.Dec(sk1, x (0) 1 [m + 1 : 2m]) 19 : if ¬Sig.Vfy(vkR, π) then 20 : return CointossS (π) (1/2) (0, 1) 21 : χ 0 := Sig.Vfy(µ (0) 0 , vk0, x (0) R ) • (c + 1) 22 : χ 1 := Sig.Vfy(µ (0) 1 , vk1, x (0) R ) • (c + 1) 23 : foreach χ ∈ {1, . . . , c} do 24 : foreach b ∈ {0, 1}|χ b > c do 25 : X b := Ske.Dec * (skb, x (χ) b ) 26 : σ ′ b := X b[0] 27 : µ χ b := X b[1 : |X b|] 28 : if ¬Sig.Vfy(µ (χ) b , vkb, π[χ -1]) ∨ σb ̸ = σ ′ b then 29 : χ b := χ 30 : b ′ := argmax b (χ b ) 31 : return OTP ⊕ CointossS (π) (1/2+χ b /2c) (σ (b ′ ) , 1 -σ (b ′ ) ) 32 :
1 : R : Game 8 (κ)

2 : OTP $ ← {0, 1} 3 : (kR, vkR) ← Sig.KeyGen(1 κ ) 4 : x (0) R $ ← {0, 1} m 5 : Pb : 6 : - 7 : - 8 : - 9 : x (0) b $ ← {0, 1}
1 : if π = πC then 2 : return OTPC ⊕ σC 3 : elseif Pke.Dec * (skP , π[0]) = Pke.Dec * (skP , πC[0])∧ 4 : π[0] ̸ = πC[0] then 5 : abort 6 : elseif π[0] = πC[0] then 7 : χ * := argmin χ ′ (π[χ ′ ] ̸ = πC[χ ′ ]) 8 : - 9 : - 10 : - 11 : p := 1/2 + χ * /2c 12 : return OTPC ⊕ CointossS (π) (p) (σC, σC) 13 : if π[x (0) R ] = πC[x (0) R ] then 14 :
(OTP, vkR) := (OTPC, vkC R )

15 : (sk0, vk0) := Pke.Dec(skP , x

(0) 0 [1 : m]) 16 : (σ0, µ (0) 0 ) := Ske.Dec(sk0, x (0) 0 [m + 1 : 2m]) 17 : (sk1, vk1) := Pke.Dec(skP , x (0) 1 [1 : m]) 18 : (σ1, µ (0) 1 ) := Ske.Dec(sk1, x (0) 1 [m + 1 : 2m]) 19 : if ¬Sig.Vfy(vkR, π) then 20 : return CointossS (π) (1/2) (0, 1) 21 : χ 0 := Sig.Vfy(µ (0) 0 , vk0, x (0) R ) • (c + 1) 22 : χ 1 := Sig.Vfy(µ (0) 1 , vk1, x (0) R ) • (c + 1) 23 : foreach χ ∈ {1, . . . , c} do 24 : foreach b ∈ {0, 1}|χ b > c do 25 : X b := Ske.Dec * (skb, x (χ) b ) 26 : σ ′ b := X b[0] 27 : µ χ b := X b[1 : |X b|] 28 : if ¬Sig.Vfy(µ (χ) b , vkb, π[χ -1]) ∨ σb ̸ = σ ′ b then 29 : χ b := χ 30 : b ′ := argmax b (χ b ) 31 : return OTP ⊕ CointossS (π) (1/2+χ b /2c) (σ (b ′ ) , 1 -σ (b ′ ) ) 32 :
1 : R :

2 : OTP $ ← {0, 1} 3 : (kR, vkR) ← Sig.KeyGen(1 κ ) 4 : x (0) R $ ← {0, 1} m 5 : Pb : 6 : - 7 : - 8 : - 9 : x (0) b $ ← {0, 1}

D.3 Full Proof of Anonymity

Theorem 5 (Anonymity). Let Pke be an IND$-CCA secure asymmetric encryption scheme, let Ske be a tightly secure multi-challenge IND$-CCA secure symmetric encryption scheme, let Sig be an sEUF-CMA secure signature scheme, let O be an ideal obfuscator, let F be a secure PRF, and let κ be the security parameter. Then the c-round protocol Π 1 AT for N = 3 satisfies δ-anonymity for all adversaries in C 2 := o(c 2 (1 -δ)).

We proceed over a series of games.

Game σ 1 (κ) This is the original game (after replacing the obfuscated circuit with oracle access to the circuit, the PRF with an actual random oracle and the adversary with the simulator), where the sending party P b is chosen uniformly at random. Game σ 2 (κ) This game follows Game σ 1 (κ), but during the simulation of the oracle P AT from Fig. 5 the simulation enforces correctness of the challenge transcript π C : if the input transcript π matches the challenge transcript π C , it returns OTP C ⊕ σ C . Due to Theorem 4, no PPT adversary can distinguish between Game σ 1 (κ) and Game σ 2 (κ). Game σ 3 (κ) This game follows Game σ 2 (κ) but during simulation of the circuit the adversary aborts if any of the first-round messages from P 0 or P 1 differ from the messages reported in the challenge transcript and the decryptions still yield the same verification key or symmetric key. This game hop is justified by the non-malleability of Pke. See Appendix D.5 for the full proof. Game σ 4 (κ) This game follows Game σ 3 (κ) but simulates the circuit slightly different: If the first receiver message of the input transcript π is the same as that of the challenge transcript π C , instead of decrypting it the circuit directly sets OTP = OTP C and vk R = vk C R as the values used in the creation of the challenge transcript. This game hop is justified by the perfect correctness of Pke, as we show in Appendix D.6. Game σ 5 (κ) This game follows Game σ 4 (κ) but simulates the oracle differently if the first-round messages of both parties match the first-round messages in the challenge transcript π C . In this case, the program compares the input transcript π with the challenge transcript π C until it finds the first round χ * in which the input differs from the challenge transcript. It then checks round χ * + 1, and if it contains the same message from the sending party, it adds one to χ. Finally, the circuit flips a biased coin, which returns the correct bit σ C with probability p := 1/2 + χ * /2c and the complementary bit (1 -σ C ) otherwise. This game hop is indistinguishable due to the sEUF-CMA security of Sig. The only way to make the output distribution of the circuit oracle differ in both games is by supplying a valid signature forgery. See Appendix D.7 for the full proof. Game σ 6 (κ) This game is the same as Game σ 5 (κ), but in creating the challenge transcript π C , this game only reports randomness for the first-round message x 0 b that specifies the symmetric key sk b and the verification key vk b to be used for the remaining communication with the circuit alongside the receiver message x (0) R that specifies the One-Time-Pad and the verification key. Note that all keys are still created as they are needed for the remaining rounds. This game hop is justified by the IND$-CCA security of Pke. See Appendix D.8 for the full proof. Game σ 7 (κ) This game is the same as Game σ 6 (κ) but in creating the challenge transcript π C , this game also reports randomness instead of transcripts for all messages x χ b for χ ∈ [c] that shift the bit towards σ C . That means that instead of using the IND$-CPA secure symmetric scheme Ske with the symmetric key sk b the challenge transcript now only contains randomly sampled messages. We also do not let the adversary create the keys for Sig and Ske as they are no longer needed for creating the transcript. This game hop is justified by the IND$-CCA security of Ske. See Appendix D.9 for the full proof. Game σ 8 (κ) This game follows Game σ 7 (κ), but instead of choosing a random sender at the beginning of the game and considering this message to be the right one, the oracle ignores the additional check and only looks for the first round where both messages are identical to the challenge.

Note that Game σ

8 (κ) is entirely independent of the real sender, hence given a challenge transcript, it is trivially impossible to obtain a non-negligible advantage to determine the sending party.

D.4 Proof of Lemma 9

Lemma 9 (Indistinguishability of Game σ 1 (κ) and Game σ 2 (κ)). Let Pke be an IND$-CCA secure asymmetric encryption scheme, let Ske be a tightly secure multi-challenge IND$-CCA secure symmetric encryption scheme, let Sig be an sEUF-CMA secure signature scheme, let O be an ideal obfuscator, and let F be a secure PRF. Then, for all PPT guessing algorithms A, the distinguishing advantage for Game σ 1 (κ) and Game σ 2 (κ) is bounded by:

|Pr[out Game σ 1 (κ) = 1] -Pr[out Game σ 2 (κ) = 1]| ∈ negl(κ) Proof.
Indistinguishability automatically follows from the fact that both simulated circuits behave identical with overwhelming probability due to Theorem 4. ⊓ ⊔

D.5 Proof of Lemma 10

Lemma 10 (Indistinguishability of Game σ 2 (κ) and Game σ 3 (κ)). Let Pke be an IND$-CCA secure asymmetric encryption scheme, let Ske be a tightly secure multi-challenge IND$-CCA secure symmetric encryption scheme, let Sig be an sEUF-CMA secure signature scheme, let O be an ideal obfuscator, and let F be a secure PRF. Then, for all PPT guessing algorithms A, the distinguishing advantage for Game σ 2 (κ) and Game σ 3 (κ) is bounded by:

|Pr[out Game σ 2 (κ) = 1] -Pr[out Game σ 3 (κ) = 1]| ∈ negl(κ) Proof.
In order to successfully cause a situation where Game σ 2 (κ) would yield output whereas Game σ 3 (κ) aborts a distinguisher D would have to essentially rerandomize the first ciphertext. To that end we use several hybrids to capture all the cases in which rerandomization might occur. We start with the case where the same verification key vk is encoded and then handle the case that the ciphertext has the same symmetric key sk.

H 0 if π = πC then return OTPC ⊕ σC H 1 if π = πC then return OTPC ⊕ σC elseif Pke.Dec * (skP , xb C ) = (•, vkb C )∧ x (0) b C ̸ = x C (0) b C ∧ Pke.Dec(skP , x (0) b C ) = ⊥ then abort H 2 if π = πC then return OTPC ⊕ σC elseif Pke.Dec * (skP , xb C ) = (•, vkb C )∧ x (0) b C ̸ = x C (0) b C ∧ Pke.Dec(skP , x (0) b C ) = ⊥ then abort elseif Pke.Dec(skP , x C (0) bC ) ̸ = ⊥∧ Pke.Dec * (skP , x bC ) = (•, vk bC )∧ x (0) bC ̸ = x C (0) bC ∧ Pke.Dec(skP , x (0) b C ) = ⊥ then abort H 3 if π = πC then return OTPC ⊕ σC elseif Pke.Dec * (skP , xb C ) = (•, vkb C )∧ x (0) b C ̸ = x C (0) b C ∧ Pke.Dec(skP , x (0) b C ) = ⊥ then abort elseif Pke.Dec(skP ), x C (0) bC ̸ = ⊥∧ Pke.Dec * (skP , x bC ) = (•, vk bC )∧ x (0) bC ̸ = x C (0) bC ∧ Pke.Dec(skP , x (0) b C ) = ⊥ then abort elseif Pke.Dec(skP ), x C (0) bC = ⊥∧ Pke.Dec * (skP , x bC ) = (•, vk bC )∧ x (0) bC ̸ = x C (0) bC ∧ Pke.Dec(skP , x (0) b C ) = ⊥ then abort H 4 if π = πC then return OTPC ⊕ σC elseif Pke.Dec * (skP , xb C ) = (•, vkb C )∧ x (0) b C ̸ = x C (0) b C ∧ Pke.Dec(skP , x (0) b C ) = ⊥ then abort elseif Pke.Dec(skP ), x C (0) bC ̸ = ⊥∧ Pke.Dec * (skP , x bC ) = (•, vk bC )∧ x (0) bC ̸ = x C (0) bC ∧ Pke.Dec(skP , x (0) b C ) = ⊥ then abort elseif Pke.Dec(skP ), x C (0) bC = ⊥∧ Pke.Dec * (skP , x bC ) = (•, vk bC )∧ x (0) bC ̸ = x C (0) bC ∧ Pke.Dec(skP , x (0) b C ) = ⊥ then abort elseif Pke.Dec * (skP , xb C ) = (•, vkb C )∧ x (0) b C ̸ = x C (0) b C ∧ Pke.Dec(skP , x (0) b C ) ̸ = ⊥ then abort H 5 if π = πC then return OTPC ⊕ σC elseif Pke.Dec * (skP , xb C ) = (•, vkb C )∧ x (0) b C ̸ = x C (0) b C ∧ Pke.Dec(skP , x (0) b C ) = ⊥ then abort elseif Pke.Dec(skP ), x C (0) bC ̸ = ⊥∧ Pke.Dec * (skP , x bC ) = (•, vk bC )∧ x (0) bC ̸ = x C (0) bC ∧ Pke.Dec(skP , x (0) b C ) = ⊥ then abort elseif Pke.Dec(skP ), x C (0) bC = ⊥∧ Pke.Dec * (skP , x bC ) = (•, vk bC )∧ x (0) bC ̸ = x C (0) bC ∧ Pke.Dec(skP , x (0) b C ) = ⊥ then abort elseif Pke.Dec * (skP , xb C ) = (•, vkb C )∧ x (0) b C ̸ = x C (0) b C ∧ Pke.Dec(skP , x (0) b C ) ̸ = ⊥ then abort elseif Pke.Dec(skP , x C bC ) ̸ = ⊥∧ Pke.Dec * (skP , x bC ) = (•, vk bC )∧ x (0) bC ̸ = x C (0) bC ∧ Pke.Dec(skP , x (0) bC
) ̸ = ⊥ then abort H 6 if π = πC then return OTPC ⊕ σC elseif Pke.Dec * (skP , xb C ) = (•, vkb C )∧ x (0) b C ̸ = x C (0) b C ∧ Pke.Dec(skP , x (0) b C ) = ⊥ then abort elseif Pke.Dec * (skP , x bC ) = (•, vk bC )∧ Pke.Dec(skP ), x C (0) bC ̸ = ⊥∧ x (0) bC ̸ = x C (0) bC ∧ Pke.Dec(skP , x (0) b C ) = ⊥ then abort elseif Pke.Dec * (skP , x bC ) = (•, vk bC )∧ Pke.Dec(skP ), x C (0) bC = ⊥∧ x (0) bC ̸ = x C (0) bC ∧ Pke.Dec(skP , x (0) b C ) = ⊥ then abort elseif Pke.Dec * (skP , xb C ) = (•, vkb C )∧ x (0) b C ̸ = x C (0) b C ∧ Pke.Dec(skP , x (0) b C ) ̸ = ⊥ then abort elseif Pke.Dec * (skP , x bC ) = (•, vk bC )∧ Pke.Dec(skP , x C bC ) ̸ = ⊥∧ x (0) bC ̸ = x C (0) bC ∧ Pke.Dec(skP , x (0) bC
) ̸ = ⊥ then abort elseif Pke.Dec * (skP , x bC ) = (•, vk bC )∧ Pke.Dec(skP ), x C (0) bC = ⊥∧ x (0) bC ̸ = x C (0) bC ∧ Pke.Dec(skP , x (0) b C ) ̸ = ⊥ then abort H 7 if π = πC then return OTPC ⊕ σC elseif ∃ b∈{0,1} x C (0) b ̸ = x (0) b ∧ Pke.Dec * (skP , x (0) b ) = (•, vkb) then abort H 8 if π = πC then return OTPC ⊕ σC elseif ∃ b∈{0,1} x C (0) b ̸ = x (0) b ∧ Pke.Dec * (skP , x (0) b ) = (•, vkb) then abort elseif Pke.Dec * (skP , xb C ) = (skb C , •)∧ x (0) b C ̸ = x C (0) b C ∧ Pke.Dec(skP , x (0) b C ) = ⊥ then abort H 9 if π = πC then return OTPC ⊕ σC elseif ∃ b∈{0,1} x C (0) b ̸ = x (0) b ∧ Pke.Dec * (skP , x (0) b ) = (•, vkb) then abort elseif Pke.Dec * (skP , xb C ) = (skb C , •)∧ x (0) b C ̸ = x C (0) b C ∧ Pke.Dec(skP , x (0) b C ) = ⊥ then abort elseif Pke.Dec(skP , x C (0) bC ) ̸ = ⊥∧ Pke.Dec * (skP , x bC ) = (sk bC , •)∧ x (0) bC ̸ = x C (0) bC ∧ Pke.Dec(skP , x (0) b C ) = ⊥ then abort H 10 if π = πC then return OTPC ⊕ σC elseif ∃ b∈{0,1} x C (0) b ̸ = x (0) b ∧ Pke.Dec * (skP , x (0) b ) = (•, vkb) then abort elseif Pke.Dec * (skP , xb C ) = (skb C , •)∧ x (0) b C ̸ = x C (0) b C ∧ Pke.Dec(skP , x (0) b C ) = ⊥ then abort elseif Pke.Dec(skP ), x C (0) bC ̸ = ⊥∧ Pke.Dec * (skP , x bC ) = (sk bC , •)∧ x (0) bC ̸ = x C (0) bC ∧ Pke.Dec(skP , x (0) b C ) = ⊥ then abort elseif Pke.Dec(skP ), x C (0) bC = ⊥∧ Pke.Dec * (skP , x bC ) = (sk bC , •)∧ x (0) bC ̸ = x C (0) bC ∧ Pke.Dec(skP , x (0) b C ) = ⊥ then abort H 11 if π = πC then return OTPC ⊕ σC elseif ∃ b∈{0,1} x C (0) b ̸ = x (0) b ∧ Pke.Dec * (skP , x (0) b ) = (•, vkb) then abort elseif Pke.Dec * (skP , xb C ) = (skb C , •)∧ x (0) b C ̸ = x C (0) b C ∧ Pke.Dec(skP , x (0) b C ) = ⊥ then abort elseif Pke.Dec(skP ), x C (0) bC ̸ = ⊥∧ Pke.Dec * (skP , x bC ) = (sk bC , •)∧ x (0) bC ̸ = x C (0) bC ∧ Pke.Dec(skP , x (0) b C ) = ⊥ then abort elseif Pke.Dec(skP ), x C (0) bC = ⊥∧ Pke.Dec * (skP , x bC ) = (sk bC , •)∧ x (0) bC ̸ = x C (0) bC ∧ Pke.Dec(skP , x (0) b C ) = ⊥ then abort elseif Pke.Dec * (skP , xb C ) = (skb C , •)∧ x (0) b C ̸ = x C (0) b C ∧ Pke.Dec(skP , x (0) b C ) ̸ = ⊥ then abort H 12 if π = πC then return OTPC ⊕ σC elseif ∃ b∈{0,1} x C (0) b ̸ = x (0) b ∧ Pke.Dec * (skP , x (0) b ) = (•, vkb) then abort elseif Pke.Dec * (skP , xb C ) = (skb C , •)∧ x (0) b C ̸ = x C (0) b C ∧ Pke.Dec(skP , x (0) b C ) = ⊥ then abort elseif Pke.Dec(skP ), x C (0) bC ̸ = ⊥∧ Pke.Dec * (skP , x bC ) = (sk bC , •)∧ x (0) bC ̸ = x C (0) bC ∧ Pke.Dec(skP , x (0) b C ) = ⊥ then abort elseif Pke.Dec(skP ), x C (0) bC = ⊥∧ Pke.Dec * (skP , x bC ) = (sk bC , •)∧ x (0) bC ̸ = x C (0) bC ∧ Pke.Dec(skP , x (0) b C ) = ⊥ then abort elseif Pke.Dec * (skP , xb C ) = (skb C , •)∧ x (0) b C ̸ = x C (0) b C ∧ Pke.Dec(skP , x (0) b C ) ̸ = ⊥ then abort elseif Pke.Dec(skP , x C bC ) ̸ = ⊥∧ Pke.Dec * (skP , x bC ) = (sk bC , •)∧ x (0) bC ̸ = x C (0) bC ∧ Pke.Dec(skP , x (0) bC ) ̸ = ⊥ then abort H 13 if π = πC then return OTPC ⊕ σC elseif ∃ b∈{0,1} x C (0) b ̸ = x (0) b ∧ Pke.Dec * (skP , x (0) b ) = (•, vkb) then abort elseif Pke.Dec * (skP , xb C ) = (skb C , •)∧ x (0) b C ̸ = x C (0) b C ∧ Pke.Dec(skP , x (0) b C ) = ⊥ then abort elseif Pke.Dec * (skP , x bC ) = (sk bC , •)∧ Pke.Dec(skP ), x C (0) bC ̸ = ⊥∧ x (0) bC ̸ = x C (0) bC ∧ Pke.Dec(skP , x (0) b C ) = ⊥ then abort elseif Pke.Dec * (skP , x bC ) = (sk bC , •)∧ Pke.Dec(skP ), x C (0) bC = ⊥∧ x (0) bC ̸ = x C (0) bC ∧ Pke.Dec(skP , x (0) b C ) = ⊥ then abort elseif Pke.Dec * (skP , xb C ) = (skb C , •)∧ x (0) b C ̸ = x C (0) b C ∧ Pke.Dec(skP , x (0) b C ) ̸ = ⊥ then abort elseif Pke.Dec * (skP , x bC ) = (sk bC , •)∧ Pke.Dec(skP , x C bC ) ̸ = ⊥∧ x (0) bC ̸ = x C (0) bC ∧ Pke.Dec(skP , x (0) bC
) ̸ = ⊥ then abort elseif Pke.Dec * (skP , x bC ) = (sk bC , •)∧ Pke.Dec(skP ), x C (0) bC = ⊥∧ x (0) bC ̸ = x C (0) bC ∧ Pke.Dec(skP , x (0) b C ) ̸ = ⊥ then abort H 14 if π = πC then return OTPC ⊕ σC elseif ∃ b∈{0,1} x C (0) b ̸ = x (0) b ∧ Pke.Dec * (skP , x (0) b ) = (skb, •)∨ Pke.Dec * (skP , x (0) b ) = (•, vkb) then abort
H 0 is the game from Game σ 2 (κ). H 1 is as H 0 but the circuit aborts only if the first-round message of the sending party P b C in the input transcript encrypts the same verification key as that from the challenge transcript and the decryption of the new first-round message is from the random oracle-that is, the decryption of that message using the first-round message of the input transcript using the actual decryption algorithm yields the error symbol ⊥. So the goal of the adversary is to distinguish, which is only possible if a different pre-image for the random oracle is found which evaluates to something that shares the same verification key as the random oracle when evaluated with the first sending parties ciphertext. However, as we already use a genuine random oracle in this game, this is information-theoretically impossible and hence the adversary cannot distinguish. Thus it holds that

Adv D = |Pr[out D,H1 = 1] -Pr[out D,H0=1 ]| ∈ negl(κ) (34)
Now let E be the event that D can find a collision for a fixed value. We can incorporate this event into Eq. (34) as follows:

Adv D =|Pr[out D,H1 = 1] -Pr[out D,H0 = 1]| =|Pr[E] • (Pr[out D,H1 = 1|E] -Pr[out D,H0 = 1|E]) + (1 -Pr[E]) • (Pr[out D,H1 = 1|¬E] -Pr[out D,H0 = 1|¬E])| (35)
It trivially holds that ¬E =⇒ Pr[out D,H1 = 1] = Pr[out D,H0 ] as there the two games act exactly the same. Hence it holds for the second line of Eq. ( 35) that (1

-Pr[E]) • (Pr[out D,H1 = 1|¬E] -Pr[out D,H0 = 1|¬E]) = 0.
So it holds that:

Adv D =|Pr[E] • (Pr[out D,H1 = 1|E] -Pr[out D,H0 = 1|E])| (36)
Which holds information-theoretically due to the properties of the random oracle. Thus it holds that Pr[E] ∈ negl(κ) and hence Adv D is negligible.

This concludes our proof.

H is as H 1 only that the circuit additionally aborts if (1) the first message of the dummy friend in the challenge transcript is a valid ciphertext, and (2) the first message of the dummy friend in the input transcript is an invalid ciphertext, and (3) the first message of the dummy friend in the challenge transcript differs from the first message of the dummy friend in the input transcript, and (4) the Dec * algorithm outputs the same verification key for the challenge-and input-transcript.

With the message in the challenge transcript being a valid ciphertext we can reduce a distinguisher D between H 2 and H 1 to an adversary breaking the pre-image resistance of the random oracle. Let E be the event that D can find a different pre-image for which the second half, which is interpreted as the verification key, is the same as for the challenge message. In this case this pre-image has to be a value that is mapped by the random oracle to the value that was reported by the adversary as first dummy-friend message.

First note that the distinguisher can only ever win this game if the challenge-transcript contains an invalid ciphertext for the dummy friend in the first round. Denote by C the event that while sampling a random value for the first message of the dummy friend the message is not a valid ciphertext. We stress that ¬C implies that the two games can not be distinguished as the change induced by the gamehop will never be noted; simply because the additional check will never succeed.

We can thus conclude for now that with probability (1 -Pr[C]) the gamehop is perfectly indistinguishable and focus on the case where the adversary reported a dummy-friend message that is not a valid cipher. Note that in this case we can use the same argument as in the last game hop, as any distinguisher would fail if ¬E where E is the event that D breaks the collision resistance, and Pr[E] is negligible due to the collision resistance of the random oracle.

H is as H 2 only that the circuit additionally aborts if (1) the first message of the dummy friend in the challenge transcript is an invalid ciphertext, and (2) the first message of the dummy friend in the input transcript is an invalid ciphertext, (3) the first message of the dummy friend in the challenge transcript differs from the first message of the dummy friend in the input transcript, and (4) the Dec * algorithm outputs the same verification key for the challenge-and input-transcript of the dummy friend. This then means that both decryptions are internally replaced by the PRF. Thus for distinguishing (which only works by causing an abort in H 3 where H 2 would have continued with the execution as the remaining part of the two games do not differ) the distinguisher would have to find a different message-which is a valid pre-image for the random oracle-that points to an output that shares the same second half as the value reported in the challenge transcript, which violates the collision resistance of the random oracle. Hence the two games can not be distinguished.

H is as H 3 but the circuit aborts only if the first-round message of the sending party P b C in the input transcript encrypts the same verification key as that from the challenge transcript and the decryption of the new first-round message yields a valid message-that is, the message is a valid cipher and the random oracle is not used for this message.

We want to show that for all PPT distinguishes D the following statement is true:

|Pr[out D,H4 = 1] -Pr[out D,H3 = 1]| ∈ negl(κ)
We first define an intermediate event E D as the event that D can rerandomize parts of a ciphertext. This leads to the following observation:

Adv D :=|Pr[out D,H4 = 1] -Pr[out D,H3 ] = 1| =E ∧ |Pr[out D,H4 = 1] -Pr[out D,H3 ] = 1|∨ ¬E ∧ |Pr[out D,H4 = 1] -Pr[out D,H3 = 1]| =E ∧ |Pr[out D,H4 = 1] -Pr[out D,H3 = 1]|+ ¬E ∧ |Pr[out D,H4 = 1] -Pr[out D,H3 = 1]| (37)
Now note that ¬E implies an equivalent behavior in both games, hence:

¬E ∧ Pr[out D,H4 = 1] = ¬E ∧ Pr[out D,H3 = 1]
Note next that E is negligible due to the IND-CCA-property of the encryption system Pke; if E / ∈ negl the following attack on the IND-CCA security would be possible: (1) The adversary creates two random messages x 0 = (•, vk 0 ) and x 1 = (•, vk 1 ), where the first half is not important but the second half differs, and sends them as challenges. (2) The challenger returns a ciphertext y. (3) The adversary rerandomizes y to y ′ such that the second half remains the same and sends y ′ to the decryption oracle. (4) If the second half of the result is vk 0 then A returns β = 0 and if it is vk 1 it returns β = 1. Otherwise it returns a uniformly random bit. If E can occur with non-negligible probability then A would violate the IND-CCA security (which is implied by the IND$-CCA security of Pke), thus we stress that Pr[E] is at most negligible. Our claim follows. H is as H 4 only that the circuit additionally aborts if (1) the first message of the dummy friend in the challenge transcript is a valid ciphertext, and (2) the first message of the dummy friend in the input transcript is a valid ciphertext, (3) the first message of the dummy friend in the challenge transcript differs from the first message of the dummy friend in the input transcript, and (4) the Dec * algorithm outputs the same verification key for the challenge-and input-transcript.

In this case we would have a distinguisher D that can effectively partially re-randomize transcripts. This distinguisher could be used in order to break the IND-CCA property of Pke as was the case in H 4 . H is as H 5 only that the circuit additionally aborts if (1) the first message of the dummy friend in the challenge transcript is an invalid ciphertext, and (2) the first message of the dummy friend in the input transcript is a valid ciphertext, and (3) the first message of the dummy friend in the challenge transcript differs from the first message of the dummy friend in the input transcript, and (4) the Dec * algorithm outputs the same verification key for the challenge-and input-transcript. Essentially, to distinguish the distinguisher D has to create a ciphertext that encodes the same verification key that is in the image domain of the random oracle. Since this is truly random and the distinguisher can not query the oracle it follows that this is possible with negligible probability only which proves our claim. H This game-hop is purely cosmetic and hence does not change the distribution. H is as H 7 but the circuit aborts only if the first-round message of the sending party P b C in the input transcript encrypts the same symmetric key as that from the challenge transcript and the decryption of the new first-round message is from the random oracle-that is, the decryption of that message using the first-round message of the input transcript using the actual decryption algorithm yields the error symbol ⊥. This is similar to the game hop from H 1 and hence indistinguishable. H is as H 8 only that the circuit additionally aborts if (1) the first message of the dummy friend in the challenge transcript is a valid ciphertext, and (2) the first message of the dummy friend in the input transcript is an invalid ciphertext, and (3) the first message of the dummy friend in the challenge transcript differs from the first message of the dummy friend in the input transcript, and (4) the Dec * algorithm outputs the same symmetric key for the challenge-and input-transcript. This is the same situation as the game hop between H 2 and H 1 and thus indistinguishable.

H 10 is as H 9 only that the circuit additionally aborts if (1) the first message of the dummy friend in the challenge transcript is an invalid ciphertext, and (2) the first message of the dummy friend in the input transcript is an invalid ciphertext, (3) the first message of the dummy friend in the challenge transcript differs from the first message of the dummy friend in the input transcript, and (4) the Dec * algorithm outputs the same symmetric key for the challenge-and input-transcript of the dummy friend. This then means that both decryptions are internally replaced by the PRF. Showing indistinguishability here is similar to that of H 3 and H 2 . H 11 is as H 10 but the circuit aborts only if the first-round message of the sending party P b C in the input transcript encrypts the same verification key as that from the challenge transcript and the decryption of the new first-round message yields a valid message-that is, the message is a valid cipher and the random oracle is not used for this message. Indistinguishability follows from the indistinguishability between H 3 and H 4 as the proof is almost identical. H 12 is as H 11 only that the circuit additionally aborts if (1) the first message of the dummy friend in the challenge transcript is a valid ciphertext, and (2) the first message of the dummy friend in the input transcript is a valid ciphertext, (3) the first message of the dummy friend in the challenge transcript differs from the first message of the dummy friend in the input transcript, and (4) the Dec * algorithm outputs the same symmetric key for the challenge-and input-transcript. Again the proof is analogous to the indistinguishability of H 11 and H 12 and we do not write it up specifically. H 13 is as H 12 only that the circuit additionally aborts if (1) the first message of the dummy friend in the challenge transcript is an invalid ciphertext, and (2) the first message of the dummy friend in the input transcript is a valid ciphertext, and (3) the first message of the dummy friend in the challenge transcript differs from the first message of the dummy friend in the input transcript, and (4) the Dec * algorithm outputs the same symmetric key for the challenge-and input-transcript. The non-existence of a successful PPT distinguisher D which is better than the naive distinguisher that randomly guesses a bit follows from the non-existence of a distinguisher for the hybrid game hop from H 5 to H 6 . H 14 This game-hop is purely cosmetic and hence does not change the distribution. We only include it for consistency with Game σ 3 (κ). ⊓ ⊔

D.6 Proof of Lemma 11

Lemma 11 (Indistinguishability of Game σ 3 (κ) and Game σ 4 (κ)). Let Pke be an IND$-CCA secure asymmetric encryption scheme, let Ske be a tightly secure multi-challenge IND$-CCA secure symmetric encryption scheme, let Sig be an sEUF-CMA secure signature scheme, let O be an ideal obfuscator, and let F be a secure PRF. Then, for all PPT guessing algorithms A, the distinguishing advantage for Game σ 3 (κ) and Game σ 4 (κ) is bounded by:

|Pr[out Game σ 3 (κ) = 1] -Pr[out Game σ 4 (κ) = 1]| ∈ negl(κ) Proof.
Indistinguishability easily follows from the perfect correctness of the encryption scheme Pke. If there was any message x (0) R created by the adversary as Pke.Enc(pk P , (OTP, vk R )) which does not decrypt with sk P to (OTP, vk R ) this would mean that Pke.Dec(sk P , Pke.Enc(pk P , (OTP, vk R ))) ̸ = (OTP, vk R ). As this can not happen by requirement indistinguishability follows.

⊓ ⊔

D.7 Proof of Lemma 12

Lemma 12 (Indistinguishability of Game σ 4 (κ) and Game σ 5 (κ)). Let Pke be an IND$-CCA secure asymmetric encryption scheme, let Ske be a tightly secure multi-challenge IND$-CCA secure symmetric encryption scheme, let Sig be an sEUF-CMA secure signature scheme, let O be an ideal obfuscator, and let F be a secure PRF. Then, for all PPT guessing algorithms A, the distinguishing advantage for Game σ 4 (κ) and Game σ 5 (κ) is bounded by:

|Pr[out Game σ 4 (κ) = 1] -Pr[out Game σ 5 (κ) = 1]| ∈ negl(κ)
Proof. We reduce a distinguisher D who differentiates between Game σ 4 (κ) and Game σ 5 (κ) to an adversary A breaking the sEUF-CMA security of the used signature scheme Sig.

Creating the Transcript. The creation of the transcript works similar in both games, hence the transcript can be created by letting the adversary play all three parties roles according to Game σ 2 (κ) for a randomly chosen sender P b C and a randomly transmitted bit σ C . The only change is with respect to signatures. While the verification key from the challengers signature oracle is known to the adversary and hence can be embedded into the senders first message all signatures of the form µ ← Sig.Sig(k b , (x

(χ-1) 0 , x (χ-1) 1
)) created in line 11 of the protocol are replaced by queries (x

(χ-1) 0 , x (χ-1) 1
) to the signing oracle. The complete transcript π C is then sent to the distinguisher D.

Simulating the Oracle. When D sends some transcript π for evaluation to the oracle the adversary A behaves according to Item Game σ 5 (κ): If the challenge transcript corresponds to the input transcript then it returns the correct bit, and if any of the first-round messages differ it simulates the circuit entirely:

If both parties input different messages than in the original transcript then we know due to the check in line 3 of the circuit code that both encrypt a different message and hence a use a new verification key (and also a symmetric key) for the remaining rounds. By knowing the secret key sk P the adversary can thus extract both and simulate accordingly.

The same reasoning is true if only the sending parties message is replaced as then still both parties messages are independent from the challenge.

Special care thus only has to be taken into the simulation for transcripts where the first sending party message matches.

If the dummy friends message differs then the circuit also executes the same circuit, which the adversary can simulate as it has all the required information; the only thing that depends on the challenge oracle are the signatures and being in possession of the verification key the simulator can efficiently verify a given signature.

If the dummy friends message also matches then the circuit acts by counting rounds until the messages differ for the first time. Let D be a distinguisher that uses this behavior to distinguish. In Game σ 5 (κ) the round χ * is fixed due to lines 7 -11 as the first round where any of the messages differs from the challenge transcript, where potentially 1 is added in case the sending parties message for the next round is different. Thus for a given transcript π we can fix p for Game σ 5 (κ); in order to distinguish this value p ′ must differ in Game σ 3 (κ). (i) p ′ < p, meaning that the circuit outputs the correct bit with a lower probability when the message is handled by the original code of the circuit. This, however, would contradict the correctness of the scheme. (ii) p ′ > p, meaning that the probability of output σ C is larger when the transcript is handled by the actual code than when it is handled by our modification. By requirement we know that up until round χ * all messages are takes directly from the challenge transcript, and that χ * < c (as otherwise the case would have been handled by the code in line 1). We can now differentiate between the two possible replacements n round (χ * + 1): (i.1) If the sending parties message has been replaced in this round then χ * stays the same and p := 1/2 + χ * /2c. In order to get a larger p ′ the adversary would have to create a replacement message which encrypts the same bit and a different signature on the same round-(χ * -1)-messages. Knowing the secret key used for the transcript the reduction adversary can extract this signature and send it as valid signature on (x

(χ * -1) 0 , x (χ * -1) 1
) to the challenger. Since the content of the message differs but the bit has to be the same (as otherwise the message would be rejected in Game σ 3 (κ)) it follows that the distinguisher created a new signature that was never returned from the challenge-oracle. (ii.2) If the dummy friend parties message has been replaced in this round then χ * is increased by 1 and in order to get p ′ > p the distinguisher has to create a message for round (χ * + 2) that contains a valid signature for this new message. Since by requirement the dummy friends message has been replaced in round (χ * + 1) this too corresponds to a new message and hence is a valid forgery for the challenger.

As A can only have a negligible chance to create a forgery due to the sEUF-CMA security of the signature scheme Sig it follows that α ∈ negl(κ).

⊓ ⊔

D.8 Proof of Lemma 13

Lemma 13 (Indistinguishability of Game σ 5 (κ) and Game σ 6 (κ)). Let Pke be an IND$-CCA secure asymmetric encryption scheme, let Ske be a tightly secure multi-challenge IND$-CCA secure symmetric encryption scheme, let Sig be an sEUF-CMA secure signature scheme, let O be an ideal obfuscator, and let F be a secure PRF. Then, for all PPT guessing algorithms A, the distinguishing advantage for Game σ 5 (κ) and Game σ 6 (κ) is bounded by:

|Pr[out Game σ 5 (κ) = 1] -Pr[out Game σ 6 (κ) = 1]| ∈ negl(κ) Proof.
Let D be an efficient distinguisher that can predict if it is in Game σ 5 (κ) or in Game σ 6 (κ) with probability 1/2 + α. Out of D we can construct an adversary A on the IND$-CCA property of Pke.

The reduction algorithm A starts by creating the key-pair for the signature scheme and the key for the symmetric scheme honestly and follows Game σ 5 (κ) the creation of the transcript, only that instead of encrypting the first message using the public-key scheme Pke directly, A forwards the messages (OTP, vk R ) and (sk b , vk b ) as challenge to the challenger C of the IND$-CCA game.

For further evaluation of the oracle the reduction adversary uses the decryption oracle from the challenger C for any first-round message that is not from the reported transcript π and continues simulation using the extracted secret key of that respective party; the same first-round message is covered automatically since Game σ 5 (κ) and the same receiver message in Game σ 4 (κ). The reported transcript contains exactly the same views that are required by the two games: if the output is a proper encryption then the view is equivalent to Game σ 5 (κ), and if the output of the oracle is uncorrelated randomness, the view corresponds to Game σ 6 (κ). Thus, if D can differentiate the two games with probability 1/2 + α, then A can differentiate the oracles with the same probability. The IND$-CCA requirement for Pke thus implies α ∈ negl(κ).

⊓ ⊔ D.9 Proof of Lemma 14 Lemma 14 (Indistinguishability of Game σ 6 (κ) and Game σ 7 (κ)). Let Pke be an IND$-CCA secure asymmetric encryption scheme, let Ske be a tightly secure multi-challenge IND$-CCA secure symmetric encryption scheme, let Sig be an sEUF-CMA secure signature scheme, let O be an ideal obfuscator, and let F be a secure PRF. Then, for all PPT guessing algorithms A, the distinguishing advantage for Game σ 6 (κ) and Game σ 7 (κ) is bounded by:

|Pr[out Game σ 6 (κ) = 1] -Pr[out Game σ 7 (κ) = 1]| ∈ negl(κ) Proof.
We reduce a distinguisher D that distinguishes Game σ 6 (κ) from Game σ 7 (κ) to an adversary A on the IND$-CPA property of the symmetric encryption scheme Ske. Again, we adapt the LR-view of Rogaway [Rog04] to account for the multiple challenges required, in that the game is played via oracle access to an oracle which either outputs valid encryptions of the input, or which outputs uncorrelated randomness.

We now describe how the adversary A behaves in order to embed the challenge of the IND$-CCA challenger C into a challenge for the distinguisher D.

The adversary starts by following the protocol according to Game σ 6 (κ) and creating the messages, with the one exception that any call to Ske.Enc(sk b , σ∥µ) is replaced by an oracle call to the challenge oracle with input (σ∥µ). This causes the transcript to either only have truly random messages (in which case the view corresponds to Game σ 7 (κ)) or actual encryptions under the challengers secret key sk (which results in a valid transcript for Game σ 6 (κ)). Thus the adversary inherits the advantage α as long as A can simulate the decryption oracle accordingly. Fortunately this is the case here. Further, as we assume a lazy evaluation of the or 15 the decryption oracle is only called on the first round message which differs from the challenge transcript and, hence, the decryption oracle is never called on the challenge ciphertext. The leaked public key pk P is controlled by the reduction adversary and hence any new transcript that contains a different first-round message than the challenge transcript can be simulated by first decrypting the secret key (which is different from the one used by the challenger with overwhelming probability) and then decrypting each round individually.

⊓ ⊔

D.10 Graphical Depiction of the Secrecy Proof Outline

Game 1 (κ) Pb :

14 : µ (χ) ← Sig.Sig(kb, (x

(χ-1) 0 , x (χ-1) 1
))

15 : x

* := argmin χ ′ (π[χ ′ ] ̸ = πC[χ ′ ]) 8 : if π[x c * +1 b C ] = πC[x χ * +1 b C ]∨ 9 : Ske.Dec * (skb C , x (χ * +1) b C ) = (σC∥µ C (χ * +1) ) then 10 : χ * := χ * + 1 11 : p := 1/2 + χ * /2c 12 : return OTPC ⊕ CointossS (π) (p) (0, 1) 13 : if π[x (0) R ] = πC[x (0) R ] ∧ π ̸ = πC then 14 :
return CointossS

* := argmin χ ′ (π[χ ′ ] ̸ = πC[χ ′ ]) 8 : if π[x c * +1 b C ] = πC[x χ * +1 b C ]∨ 9 : Ske.Dec * (skb C , x (χ * +1) b C ) = (σC∥µ C (χ * +1) ) then 10 : χ * := χ * + 1 11 : p := 1/2 + χ * /2c 12 : return OTPC ⊕ CointossS (π) (p) (0, 1) 13 : if π[x (0) R ] = πC[x (0) R ] ∧ π ̸ = πC then 14 :
return CointossS

* := argmin χ ′ (π[χ ′ ] ̸ = πC[χ ′ ]) 8 : if π[x c * +1 b C ] = πC[x χ * +1 b C ]∨ 9 : Ske.Dec * (skb C , x (χ * +1) b C ) = (σC∥µ C (χ * +1) ) then 10 : χ * := χ * + 1 11 : p := 1/2 + χ * /2c 12 : return OTPC ⊕ CointossS (π) (p) (1, 0) 13 : if π[x (0) R ] = πC[x (0) R ] ∧ π ̸ = πC then 14 :
return CointossS

* := argmin χ ′ (π[χ ′ ] ̸ = πC[χ ′ ]) 8 : if π[x c * +1 b C ] = πC[x χ * +1 b C ]∨ 9 : Ske.Dec * (skb C , x (χ * +1) b C ) = (σC∥µ C (χ * +1) ) then 10 : χ * := χ * + 1 11 : p := 1/2 + χ * /2c 12 : return OTPC ⊕ CointossS (π) (p) (1, 0) 13 : if π[x (0) R ] = πC[x (0) R ] ∧ π ̸ = πC then 14 :
return CointossS

31 : return OTP ⊕ CointossS (π) (1/2+χ b /2c) (σ (b ′ ) , 1 -σ (b ′ ) ) 32 : 1 : R : 2 : OTP $ ← {0, 1} 3 : (kR, vkR) ← Sig.KeyGen(1 κ ) 4 : x (0) R $ ← {0, 1} m 5 : Pb : 6 : - 7 : - 8 : - 9 : x (0) b $ ← {0, 1} 2m
(1/2) (0, 1) 21 : χ 0 := Sig.Vfy(µ

(0) 0 , vk0, x (0) R ) • (c + 1) 22 : χ 1 := Sig.Vfy(µ (0) 1 , vk1, x (0) R ) • (c + 1) 23 : foreach χ ∈ {1, . . . , c} do 24 : foreach b ∈ {0, 1}|χ b > c do 25 : X b := Ske.Dec * (skb, x (χ) b ) 26 : σ ′ b := X b[0] 27 : µ (χ) b := X b[1 : |X b|] 28 : if ¬Sig.Vfy(µ (χ) b , vkb, π[χ -1]) ∨ σb ̸ = σ ′ b then 29 : χ b := χ 30 : b ′ := argmax b (χ b ) 31 : return OTP ⊕ CointossS (π) (1/2+χ b /2c) (σ (b ′ ) , 1 -σ (b ′ ) ) 32 : 1 : R : 2 : OTP $ ← {0, 1} 3 : (kR, vkR) ← Sig.KeyGen(1 κ ) 4 : x (0) R ← Pke.Enc(pk P , (OTP, vkR)) 5 : Pb : 6 : (kb, vkb) ← Sig.KeyGen(1 κ ) 7 : (skb) ← Ske.KeyGen(1 κ ) 8 : (µ (0) b ) ← Sig.Sig(kb, x (0) R ) 9 : x (0) b ← Pke.Enc(pk P , (skb, vkb))∥Ske.Enc(skb, (1, µ (0) )) 10 : P b : 11 : x (0) b $ ← {0, 1} 2m
12 : foreach χ ∈ {1, . . . , c} do 13 :

Pb :

14 : µ (χ) ← Sig.Sig(kb, (x (χ-1) 0 , x (χ-1) 1
))

15 : x

D.11 Full Proof of Secrecy

Here we provide a full proof of the following theorem:

Theorem 6 (Secrecy). Let Pke be an IND$-CCA secure asymmetric encryption scheme, let Ske be an IND$-CCA secure symmetric encryption scheme, let Sig be a sEUF-CMA secure signature scheme, let O be an ideal obfuscator, and let F be a secure PRF. Then, Π 1 AT satisfies ς-secrecy with ς ∈ owhl(κ).

Essentially the proof shows that no PPT distinguisher that gets the transcript but not the receivers transcript can exist that can distinguish between the case where we always transfer a 0 and where we always transfer the 1 better than by guessing. This follows from the fact that the One-Time-Pad chosen uniformly at random by the receiver masks the output bit. As this masking bit is never revealed and only sent in an encrypted form with the key of the circuit our claim follows.

Game σ 1 (κ) This is the original game (after replacing the obfuscated circuit with oracle access to the circuit, the PRF with an actual random oracle and the adversary with the simulator), where the sending party P b is chosen uniformly at random but the sending party always sends σ = 0. Game σ 2 (κ) This game follows Game σ 1 (κ), but with the following changes: -During the simulation of the oracle P AT from Fig. 5 Lemma 15. Let Pke be an IND$-CCA secure public-key encryption scheme. Let Ske be an IND$-CCA secure secret-key encryption scheme. Let Sig be an sEUF-CMA secure signature scheme. For all PPT guessing algorithms A, the distinguishing advantage for Game σ 1 (κ) and Game σ 2 (κ) is bounded by:

|Pr[out Game σ 1 (κ) = 1] -Pr[out Game σ 2 (κ) = 1]| ∈ negl(κ) Proof.
Follows from Lemmas 9 to 14.

⊓ ⊔ Game σ 3 (κ) This game follows Game σ 2 (κ) but the oracle is simulated slightly different: If the first receiver message is the same as the one reported in the challenge transcript and the input transcript is not the challenge transcript, then the circuit reports a uniformly random bit. Note that this does not work in the anonymity proof as there we assume that the adversary is given access to the receivers random tape, and hence can create their own new signature on the modified transcript.

Lemma 16. Let Pke be an IND$-CCA secure public-key encryption scheme. Let Ske be an IND$-CCA secure secret-key encryption scheme. Let Sig be an sEUF-CMA secure signature scheme. For all PPT guessing algorithms A, the distinguishing advantage for Game σ 3 (κ) and Game σ 4 (κ) is bounded by:

|Pr[out Game σ 3 (κ) = 1] -Pr[out Game σ 4 (κ) = 1]| ∈ negl(κ) Proof.
We reduce a distinguisher D between these two games to an adversary A on the EUF-CMA security of the signature scheme Sig.

Two-round protocol Π 1

AT in the designated sender setting.

We assume three parties are present in this protocol, two of which are participating. Let P0 and P1 be the potential sender, one of which is not participating, and let R denote the receiver. Let Pke = (KeyGen, Enc, Dec) be a public-key IND$-CCA-secure encryption scheme with Pseudorandom Ciphertexts.

Let Sig be an sEUF-CMA-secure signature scheme. Let P AT be an obfuscated program from Fig. 10, which hides a verification key vk and a secret key skP , the corresponding public key pk P is leaked. The protocol Π 1 AT works as follows:

On input (⊥), R samples a uniformly random bit OTP

). P 1-b samples uniformly random x (1) 1-b . R outputs OTP ⊕ P AT x (0) 0 , x (0) 1 , x (0) R , x (1) 0 , x (1) 1 .

Fig. 9:

The designated sender protocol for Anonymous Transfer. We generally assume that once all messages of one round have been determined, parties publish them.

Proof. Follows from Lemmas 9 to 14 and 16.

⊓ ⊔ Thus our theorem follows:

Theorem 6 (Secrecy). Let Pke be an IND$-CCA secure asymmetric encryption scheme, let Ske be an IND$-CCA secure symmetric encryption scheme, let Sig be a sEUF-CMA secure signature scheme, let O be an ideal obfuscator, and let F be a secure PRF. Then, Π 1 AT satisfies ς-secrecy with ς ∈ owhl(κ).

E Asymptotically Secure AT in the Designated Sender Model

E.1 A two-round protocol

In this section, we introduce a candidate protocol for Anonymous Transfer in the designated sender setting. The sender is given secret information which is in some known relation with the Common Reference String. The protocol itself is displayed in Fig. 9. It requires a Common Reference String, which contains an ideally obfuscated circuit which behaves as described in Fig. 10.

The protocol consists only of two rounds. The ideally obfuscated circuit knows a verification key vk, to which the sending party is given the signing key k. For both messages, the sending party adds a signature created with k. In the first round, the sender only enters the bit σ that should be transferred and attaches a signature µ on σ with k. In the second round, the sender again enters the bit σ, but attaches a signature on the first round.

The circuit then checks for both second-round messages if either of them contains an encryption of a signature on the first round; if this is the case for at least one second-round message16 , it flips two biased coins, which return tails with probability 2d. If the first coin lands tails, the program returns the bit encoded in the second message. Otherwise, the second coin is considered. If this lands on tails, then the bit encoded in the first round is returned. Otherwise, the program returns a random bit.

Security analysis.

Correctness. We first investigate the correctness of our protocol. That is, we prove the following lemma:

Lemma 19 (Correctness). Let Π 1 AT be instantiated as described in Fig. 9. Then Π 1 AT is correct with ε = 1 -(1-2d) 2 2 according to Eq. (3).

Hence, an honest protocol run guarantees that the bit σ will be received successfully with probability at least 2d(1

-d) + 1/2 = 1 -(1-2d) 2 2 .
Proof. We assume as input an honest transcript. Without loss of generality we ignore the One-Time-Pad encoded by the receiver in this analysis by assuming that OTP = 0; the case for OTP = 1 is symmetrical only that the inverse bit is output by the circuit which is then flipped again by the receiver. An honest transcript is handled by P AT as follows:

-The signature of the first round verifies on the sending parties input. With probability (1negl(κ)), this is the only signature that verifies, meaning that with probability (1 -negl(κ))

+ negl(κ) 2
, this branch is taken. Now a biased coin is flipped:

• The first coin yield tails with probability 2d, in which case the correct output σ =: σ • With probability 1/2, this new coin returns (1 -σ). -With negligible probability negl(κ), the signature of the first round verifies on the dummy friends input. In case of two signatures verifying, we deterministically choose the message from party P 0 , which is correct with probability 1/2; hence we enter this branch with probability (negl(κ)) 2

. This too causes a coin flip.

• The first coin yield tails with probability 2d, in which case the encoded bit σ

(1)

1-b encoded in the second-round message of the dummy friend P 1-b is returned. Since the message was random, this bit is uniformly distributed.

* σ 1-b = σ with probability 1/2, meaning a correct output. * σ 1-b ̸ = σ with probability 1/2, causing a faulty output. • With probability (1 -2d), the coin yields heads, in which case a second coin is flipped: * With probability 2d, the coin yields tails, in which case the first-round message of P 1-b is considered.

• With probability (1-negl(κ)), this has the wrong form, that is, the attached message does not verify the encoded bit. In this case, the output bit is chosen at random: -With probability 1/2, the output is σ.

-With probability 1/2, the output is (1 -σ). • With probability (negl(κ)), the first-round message contains a valid signature. This causes a new coin flip: -With probability 2d, this coin lands on tails, causing the output to be the bit encoded in the first round. With this bit being uniformly distributed, we obtain: =⇒ σ with probability 1/2. =⇒ (1 -σ) with probability 1/2.

-With probability (1 -2d), the coin lands on heads. In this case, the output is taken at random, which implies we get =⇒ σ with probability 1/2. =⇒ (1 -σ) with probability 1/2. * With probability (1 -2d), the coin lands on the heads-side. In this case, a new unbiased coin is flipped: • With probability 1/2, this new coin returns σ.

• With probability 1/2, this new coin returns (1 -σ).

So a wrong output is obtained with probability

(1 -negl(κ)) + negl(κ) 2 • (1 -2d) • (1 -2d) • 1 2 + negl(κ) 2 • 1 2 ≈ (1 -2d) 2 2 (38)
The approximation comes from setting negl(κ) = 0. Thus, the correct output is returned with the complementary probability, which according to Eq. (3) yields:

ε = 1 - (1 -2d) 2 2 (39)
This concludes our proof.

⊓ ⊔

Anonymity. We now focus on the anonymity of Π 1 AT by proving the following lemma:

Lemma 20 (Anonymity (informal)). Let Π 1 AT be instantiated as described in Fig. 9. Then Π 1

AT is anonymous with δ = 1 -2d according to Eq. (4).

Our proof looks as follows:

sends (σ∥µ) to the oracle. The output is added to the challenge transcript π C as x (0) 0 . The adversary then samples some uniformly random x (0) 1 of the same size and adds it to the challenge transcript.

A then computes a signature µ on both those first-round messages and sends x∥µ to the oracle, the returning value is taken as x (1) 0 . Again, the dummy-friend message is chosen at random. The adversary A then reports π C to D, who is allowed to make queries to the obfuscated circuit on its own. Note that simulation of the circuit is trivially possible: Due to our previous games, no input manages to pass line 15 in the depiction of the oracle, so all that A does is comparing similarity of inputs π with the challenge transcript π C and acting accordingly. Eventually, D outputs one of Game σ 7 (κ) or Game σ 8 (κ). On output Game σ 7 (κ), A reports that a genuine encryption oracle has been used, on output Game σ 8 (κ), A reports that the oracle returned randomness. Those two cases are equivalent, as an encryption oracle yields exactly the distribution from Game σ 7 (κ), meaning that the message was actually an encryption, and a random oracle causes all reported messages to be random; just as in Game σ 8 (κ). It thus follows that the success probability of A is 1/2 + α for α ∈ negl(κ) from the IND$-CPA security of Pke, and since α from A is the same as the one from D, this implies D cannot be better than 1/2 + α.

⊓ ⊔ Game σ 9 (κ) This game follows Game σ 8 (κ), but changes the oracle simulation. Instead of considering P 0 to be the sending party of the challenge transcript, the oracle in Game σ 9 (κ) acts as if P 1 is the sender and P 0 is the dummy friend. Note that this also implies a changed message to-be-considered for the resp. coin-tosses.

Lemma 28 (Indistinguishability of Game σ 8 (κ) and Game σ 9 (κ)). Let Pke be an IND$-CCA secure public-key encryption scheme. Let Sig be an sEUF-CMA secure signature scheme. Let c be chosen such that c ≥ t. For all PPT guessing algorithms A, the distinguishing advantage for Game σ 8 (κ) and Game σ 9 (κ) is bounded by:

|Pr[out Game σ 8 (κ) = 1] -Pr[out Game σ 9 (κ) = 1]| ≤ d • (3 -2d) Proof.
Based on the randomness of the coin toss involved in creating the challenge messages, we can fix the world we are in based on the outcomes of the coin-tosses from F. Fig. 11 shows the different worlds that exist based on the randomness involved in the creation of the challenge transcript. A node contains three parts: The top part shows the output of the correct challenge transcript and, if it exists, the corresponding world in the description that follows. The middle part shows the probability that we end up in this world. The bottom part shows the probability that an adversary can correctly guess the sender in this world; note that the adversary can always guess, so the optimum here is at 1/2. As we can see in Fig. 11, the randomness extracted by the PRF brings us in one of several worlds: W orld 1 fixes the randomness extracted from the two first-round messages to yield the correct bit, and contains a first sender message that causes the coin-toss to land on heads and hence to ignore the bit contained in this round. This is the optimal world, as any changes performed in the second round result in the circuit outputting the correct bit-there is no path that causes the circuit to output anything other than σ C . Similarly, since the original first message round is ignored due to the coin landing on heads, changing any first-round message replaces randomness with new randomness and hence only causes a new uniformly distributed bit. Hence, in this world, an adversary can trivially only guess. Finally, note that the adversary can uniquely identify this world: It is the only world in Fig. 11, where the correct bit σ C is output, yet any new message of any party yields a new uniformly random bit. W orld 2 contains a first-round message-pair where the corresponding coin-toss still yields the correct bit, but the first-round sender-message additionally fixes the bit to σ C . Unlike W orld 1 , this allows for an efficient attack; the adversary can try out a polynomial number of random messages for x (0) 0 and then a polynomial number of random messages for x (0) 1 with the resp. other message taken from the challenge transcript. If the new message is from the sender, then the circuit always falls back to the uniform output, and the output is a uniform bit. If the new message is from the dummy friend, then the circuit extracts the correct bit from the sending parties first message and always outputs the correct bit. Hence, the adversary is able to clearly identify the sender. W orld 3 has the first round messages such that the coin-toss yields a different bit σ C . This line is more dangerous, as the path where all coin-tosses fail can now be efficiently distinguished from the one where any of the coin-tosses succeeds. Furthermore, in this world, the first sending parties coin lands on tails, thus fixing the bit immediately. Note that in this world, the adversary can launch the same attack as in W orld 2 ; changing x (0) b yields a new output with every new message. We stress that this world is indistinguishable to W orld 2 for any (even statistical) adversary A; the challenge transcript does not even consider the coin-toss based on both parties firstround messages, and any new first-round message of either the dummy friend or the sender yields new randomness to be used by F. But since they both share the same attack, output and probability, we stress that there is no advantage for any adversary in distinguishing W orld 2 and W orld 1 . However, note that the adversary can trivially distinguish the cases of being in either W orld 2 or W orld 1 from being in any of the other worlds mentioned in Fig. 11. W orld 4 has a first-round challenge transcript that causes the PRF to output the wrong bit, a first round sender-message that does not fix the output, but a second-round sender-message that does fix the bit. In this world, the distinguishing attack is similar to the one for the first round, only that those messages are now taken from the challenge transcript, resulting in a one-shot behavior.

(π C [0]) (0.5) (σC, σC) σC 1/2 ? CointossS (x (0) b C ) (2d) (T, H) W orld1 / σC 1/2 -d 0 H e a d s ( 1 - 2 d ) W orld2 / σC d 1 T a il s 2 d σ C 1 / 2 ? 1/2 ? CointossS (x (0) b C ) (2d) (T, H) ? 1/2 -d ? CointossS (x (1) b C ) (2d) (T, H) W orld5 / σC 1/2 • (1 -2d) 2 0 H e a d s ( 1 - 2 d ) W orld4 / σC d • (1 -2d) 1 T a i l s 2 d H e a d s ( 1 - 2 d ) W orld3 / σC d 1 T a il s 2 d σ C 1 / 2
With the entire challenge transcript outputting σ C , the circuit will also output σ C for any other arbitrarily chosen dummy-friend message. But since the second sending parties message fixes the bit, changing that one causes all coin-tosses to fail and hence the circuit to output bit σ C . This world can again be uniquely recognized by the adversary, as it is the only world where changing any of the first-round message results in uniformly random output, but only a new second-round sending parties message flips the output bit. W orld 5 again has the initial round challenge such that the PRF outputs the wrong bit σ C , and the two sending parties messages such that none of the coin-tosses results in the circuit fixing the bit. In this world, only randomness is involved, and the final output of even the challenge transcript is σ C -the wrong bit. This world is unique to the adversary, as it is the only one where the wrong bit is output. However, note that since no identifying information whatsoever is contained in the challenge transcript, an adversary trapped in this world can only guess who the sender is.

So we have seen that after any randomly sampled two-rounds challenge transcript π C , the adversary can be placed in one of five worlds. In Fig. 11, we additionally annotated the probability of ending up in this world. Since we have a binary outcome-the adversary can either uniquely determine the sender with 100% correctness, yielding an advantage of 1 in figuring out which game has been played, or do none better than guessing, which ends up with an advantage of 0. The advantage α of any distinguisher in correctly differentiating Game σ 8 (κ) from Game σ 9 (κ) comes down to the following formula:

α ≤ 5 i=1 Pr[W orld i ] • α W orldi =(1/2 -d + 1/2 • (1 -2d) 2 ) • 0 + (d + d + d • (1 -2d)) • 1 =d • (3 -2d) (42)
⊓ ⊔ Game σ 10 (κ) This game follows Game σ 9 (κ), but reports messages for an honest sender in the name of P 1 .

The protocol is defined for any c > 2 and works as follows: In each round χ, both messages are decrypted. If either of them contains a valid signature on the transcript up to round χ -1, the program returns the bit encoded in the same message with probability 2d. We require the signature to be on the full transcript, since otherwise, an adversary can learn if this round has been considered by the circuit for the transfer, by replacing both messages in round χ ∈ [1, c]. The program recursively returns its own output on the same input except for the last round, if the coin lands on heads (i.e. with probability (1 -2d)), or if the last-round messages do not contain a valid signature.

Security Analysis.

Correctness. We will now analyze the correctness of the new protocol:

Lemma 40 (Correctness). Let Π 1 AT be given as described in Fig. 12. Let c ∈ N > 1 be the number of rounds. Π 1 AT returns the correct bit with probability 1 -(1 -2d) c /2, and hence ε = 1 -(1 -2d) c /2. Proof. We perform this proof by mathematical induction.

Base: c = 2. Here our claim states that σ is returned with probability 1 -(1-2d) 2 2 , which was shown in Lemma 19 (see Eq. ( 39)). Proof. This proof follows from the correctness properties combined with the signatures on all previous messages: A changed sending parties message in round χ causes all signatures from rounds χ + 1 to c to fail to verify, and in itself has a valid signature only with negligible probability; as such, the output is the same if two random messages are used for each future round. Hence, our claim follows from the correctness property of Lemma 40, since this protocol is now equivalent to a valid c -1-round protocol. Proof. Likewise, this follows from the correctness property. A changed dummy friend message in round χ causes the sending parties signature to fail from round χ + 1 onward. Due to the recursion, all messages from rounds c to message χ + 1 are ignored, as they have an invalid signature. The output of the χ-message protocol is returned, which is correct with probability 1 -((1 -2d) χ )/2, according to Lemma 40.

⊓ ⊔

Lemmas 41 and 42 imply that most of the steps from Lemma 36 can be canonically extended from two to c rounds by introducing new hybrid games. The only game that requires further investigation is Lemma 28. In fact, the following diff is added to the games: Game σ 1 (κ) This game follows the protocol execution from Fig. 12 where the obfuscated circuit is replaced with oracle-access to the circuit and the PRF within the circuit is now a random oracle. Game σ 2 (κ) When the correct transcript is input, the oracle returns the correct bit with probability (1 -(1 -2d) c /2), simulating correctness according to Lemma 40. The randomness is taken over the whole transcript. Game σ 3 (κ) to Game σ 7 (κ) Those games hard-code the one-shot behavior for different input messages. We replace these four game by a series of 2c games, which alternate between hard-coding behaviors for the sending party and for the dummy friend in an increasing order. More precisely, for each round χ ∈ [2c], there are 2 consecutive games 2χ -1 and 2χ, where the (2χ -1)th game adds a new check regarding the sending parties input in round χ, and returns the correct bit with probability (1 -(1-2d) χ-1 2 ), and the (2χ)-th game adds a check regarding the dummy-friends input in round χ, where the correct bit is returned with probability (1 -(1-2d) χ

2

). Indistinguishability of the (2χ -1)-th new game follows from Lemma 41, indistinguishability of the (2χ)-th new game is implied by Lemma 42. Game σ 8 (κ) This is adjusted canonically to all c rounds. By exploiting the LR-view used in the proof, no further adjustments are required.

The adjustment of the inverse games, Game σ 10 (κ) to Game σ 16 (κ), is analogous to the above. The one missing game is Game σ 9 (κ), which requires a more rigorous analysis.

Lemma 43 (Adapting Game σ 9 (κ) to c rounds). Let Pke be an IND$-CCA secure public-key encryption scheme. Let Sig be an sEUF-CMA secure signature scheme. For all PPT guessing algorithms A, the distinguishing advantage for a changed sender after adjusting Game σ 8 (κ) to c rounds is bounded by:

|Pr[out P0 = 1] -Pr[out P1 = 1]| ≤ 2d + 1 -(1 -2d) c 2
Proof. We use the same basic technique as in Lemma 28, in that we discretize the set of possible worlds based on the coin-toss outcomes of an honestly created, fixed transcript. We claim that the view provided in Fig. 14 implies our claim. We once again use mathematical induction.

Base: c = 2. Here our claim states that the change is detected with probability 2d+1-(1-2d) 2 2 = d(3 -2d), with the tree from Fig. 14 corresponding to Fig. 11. This was proven in Lemma 28. Inductive Step: This step contains two parts. First, we show that, assuming that the view from Fig. 14 correctly represents the different worlds alongside their anonymity-and occurrenceguarantees, an additional round only adds one more relevant world to the one edge where the initial coin-toss yields σC and all other coin-tosses land on heads. We then show that, given the view from Fig. 14, the probability of successfully distinguishing the change induced by this game hop is 2d+1-(1-2d) c 2 . We start by the former, namely showing that our tree-expansion mechanism can be canonically expanded from c to (c + 1) rounds. For that, we refer to the following worlds: W orld 1 is as W orld 2 in the two-round setting. Here, there already is an attack that de-anonymizes the sender, hence allows detection of the game hop. Hence a new round brings absolutely no advantage. W orld 2 is as W orld 1 in the two-round setting. We refer to this world as optimal in the following sense: Every new input of any first-round message yields a fresh random output, but every new input of any other message-regardless from which party-yields the correct bit σ C . Hence, here it automatically follows that no new round induces any changes, as the result does not change regardless of the output of the new coin-toss. W orld 3 is as W orld 3 in the two-round setting. As we have already shown in Lemma 28 that there is an attack on the first round here, which works regardless of the number of rounds. W orld 4 represents all worlds that have a sequence where the first coin-toss lands on σC , followed by (χ -1) rounds of coin-tosses that land on heads and have a coin-toss in round χ that ends with tails. We stress that the same attack that was possible on round one of W orld 4 in Lemma 28 also works here, and that the respective probability of being in either of these worlds is given by 1/2 • (1 -2d) χ-1 • d. Whatever follows is irrelevant, as the attack already works on round χ. W orld 5 is the first of the two relevant new worlds that come up when we add a new round: We only are in this world, if the previous transcript has been such that all coin-tosses landed on heads, and the initial coin-toss yields the wrong bit σC . If the new round yields a coin-toss that lands on tail in the new round only, then this final round is susceptible to the same attack that was used in W orld 4 on trying new inputs for the final round. Any new sending parties message yields σC , but the same transcript with any new dummy-friend message causes the correct bit to be output, making it trivial to detect the change. W orld 6 is the second and final of the two new relevant worlds. In this world, the game change is impossible to detect, as all coin-tosses in the challenge transcript land on heads, and all sending parties messages are ignored just like the dummy friends inputs; the output bit is determined by the coin-toss on both first-round messages, which in these worlds yield σC . While the output is wrong, we stress that the anonymity in here is perfectly, meaning that we get an advantage of 0. Knowing that the world-view from Fig. 14 is consistent with the c rounds protocol, we can now put a bound on the success probability of the adversary. Intuitively, the adversary can perfectly detect the game hop, unless we are in W orld 2 or W orld 6 , where detection is (even statistically) impossible. Hence, the probability of an adversary to successfully distinguish the two games is given by 1 -

Pr[W orld 2 ] -Pr[W orld 6 ] =1 - 1 -2d 2 - 1 2 • (1 -2d) c = 2 -1 + 2d -(1 -2d) c 2 = 1 + 2d -(1 -2d) c 2 (47)

Conclusion:

The claim is true for any c round protocol.

⊓ ⊔

Thus, we have shown that all games for Lemma 36 can be canonically adjusted to c > 2 rounds, with the distinguishing advantage between the transcript where P 0 is the sending party and P 1 being the sending party being limited by 1+2d-(1-2d) c 2 .

We now analyze what this means for our overall anonymity guarantee. Lemma 53. Let D be a distinguisher distinguishing Game σ 7 (κ) and Game σ 8 (κ) with advantage α over guessing. Let t be the number of queries that D sends to the obfuscated circuit. There is a reduction adversary A that uses D which has advantage α over guessing in winning Fig. 18.

Proof. The overall idea of the proof is similar to that used in Fig. 7 but has some minor changes in order to incorporate the different range of the oracles and the fact that instead of 0 or 1, the oracle returns ⊥ or Σ.

Creating the Transcript. The transcript is the same in both games and hence can be created canonically. Upon activation the adversary A samples the required information for the challenge transcript, that is, Σ C $ ← {0, 1} ℓ and b $ ← {0, 1}, and creates and stores a transcript π C by sampling uniformly random messages for both parties. This transcript is then reported to the distinguisher.

Simulating the Circuit. When D sends some input to the simulated circuit A has to return some message Σ according to the respective distributions. There are several possible inputs for the circuit but the below list covers all the possibilities: (At least) one of the first-round messages is different. Then the adversary simulates the circuit by following the actual protocol. This case is equivalent for both games. Same input until round χ, then different message for both parties. Then the adversary flips a biased coin that lands on heads with probability p := χ/c and on heads A returns Σ and otherwise A returns ⊥. Same input until round χ, then different message for P b only. This case is equivalent to the one before and does not change in the game hop. Same input until round χ, then different message for P b only. This is the interesting case as this class contains all the transcripts that are actually treated differently in the two games.

In this case the adversary queries the χ + 1-th oracle that returns 1 with probability χ/c if β = 0 and with probability (χ + 1)/c if β = 1. When receiving output 0 the adversary returns ⊥ as oracle-output. On output 1 the adversary returns the challenge message Σ C . It is easy to see that this reflects the two games; if β = 0 then Σ is returned with probability χ/c as it is in Item Game σ 7 (κ), and if β = 1 then Σ is returned with probability (χ + 1)/c as in Item Game σ 8 (κ).

Using the Response. After (at most) t queries the distinguisher terminates and sends its guess. If D guesses it was playing Game σ 8 (κ) then A reports β ′ = 1 to C. And if D guesses it was playing Game σ 7 (κ) then A sends the output β ′ = 0 to C. As was described above the two distributions can be perfectly simulated, hence the probability that D guesses the correct game is the same that A has to correctly guess β.

Corrupted Receiver

In this section we analyze the anonymity of the remaining parties provided that the adversary corrupts the receiver of the message. In this case the party P R is fixed and the adversary has to distinguish between the two cases depicted in Fig. 21: Either P 0 is the sender and P 1 is the dummy friend or vice versa. The guessing algorithm has to distinguish the following two distributions: To prove the hardness of distinguishing these two cases we proceed as follows:

{(Σ 0 , Σ 1 ) $ ← {0, 1} 2ℓ
Translating the Result. Eventually D returns a guess which is either Game σ 1 (κ) or Game σ 2 (κ). In case D assumes to be in Game σ 1 (κ) we assume the party we refer to as P S is the sender, and if D assumes to be in Game σ 2 (κ) we let A refer to P D as the sender in the AT. As can be seen the distributions match perfectly, as the only change is the sender and that one perfectly translates to our problem of de-anonymization. Corrupted Dummy Friend If the adversary corrupts the dummy friend after the execution of the Undetectable Oblivious Transfer protocol then it is guaranteed that the two remaining parties are the sender and the receiver. However, distinguishing which is which is hard; to prove this claim we use the following games:

Fig. 1 :

 1 Fig. 1: Definition of the game Exp anon Π ℓ AT ,A,b (κ).

  Combining this reduction withCorollary 2 concludes the proof of Theorem 3.

AAT

  c-round Anonymous Transfer Protocol Π 1 AT ′ for (N -1) Parties. On input (b, σ), P b follows the role of P b on input (b, σ) according to Π 1 AT . On input ⊥, P b ′ for b ′ ∈ [N -2] \ b follows the role of P b ′ on input ⊥ according to Π 1 AT . On input ⊥, R follows the role of PN-1 on input ⊥ according to Π 1 AT . For each round χ from 1 to c : P b computes the next message according to P b in Π 1

Fine-grained Protocol Π 1 ←

 1 AT . Upon activation, R draws OTP $ ← {0, 1} and computes (k R , vk R ) ← Sig.KeyGen(1 κ ). Then R sets x (0) R ← Pke.Enc(pk P , (OTP, vk R )) and broadcasts x (0) R . On input (b, σ), P b computes a signature key pair (vk b , k b ) ← Sig.KeyGen(1 κ ) and a symmetric key sk b ← Ske.KeyGen(1 κ ). Then, P b computes a signature µ ← Sig.Sig(k b , x Pke.Enc(pk P , (sk b , vk b ))∥Ske.Enc(sk b , (σ, µ)). Upon activation , P 1-b sets uniformly random x

Fig. 6 :

 6 Fig. 6: Obfuscated program P AT for the fine-grained setting with c rounds.

Fig. 7 :

 7 Fig. 7: Game to distinguish whether Bernoulli oracles follow a given distribution p or q = p -1/2c.

  ⊓ ⊔ Putting everything together, we have that for all PPT distinguishers D, |Pr[out 0,D = 1] -Pr[out 8,D = 1]| is negligible in κ. In particular, |Pr[out 0,D = 1] -Pr[out 8,D = 1]| is negligible for distinguishers D in C 2 . Additionally, the employed reductions are in C 1 = O(c). Furthermore, for all adversaries A, |Pr[out 8,A = 1|b = 0] -Pr[out 8,A = 1|b = 1]| ≤ α, where the runtime of the game also is in C 1 . Hence, we may conclude that for all adversaries A in C 2 , |Pr b $ ←{0,1}

$←Fig. 8 :

 8 Fig. 8: Definition of the game Exp anon-ot Π U OT ,A,ϖ (κ).

  Assuming a (ε, δ, c, ℓ)-Undetectable Oblivious Transfer with ε ∈ owhl(κ), the protocol Π U M P C for computing a bivariate function f using Undetectable Two-Party Computation we obtain by replacing all COTs by UOTs in [vHL05, Protocol 3] is a (ε, δ, c • |f |)-Undetectable Two-Party Computation.

3. 5

 5 Reductions Among AT Protocols . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 4 Impossibility of Anonymous Transfer . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 4.1 The Attacker . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 4.2 Putting the Pieces Together . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 4.3 Impossibility of Anonymous Transfer for N > 3 . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 4.4 Extensions and Limitations . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 5 Fine-Grained AT from Ideal Obfuscation . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 5.1 Security Analysis . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 5.2 Final Result . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 6 Undetectable Oblivious Transfer . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 6.1 Strong Anonymous Transfer . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 6.2 Definitions for Undetectable Oblivious Transfer . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 7 Towards Undetectable Multiparty Computation . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 7.1 Defining Undetectable Multiparty Computation . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 7.2 Towards constructing Undetectable Two-Party Computation from Undetectable Oblivious Transfer . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . A Preliminaries . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . A.1 Covert Oblivious Transfer . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . A.2 Indistinguishability from Random Bits under Chosen Ciphertext Attacks . . . . . . . . . A.3 Strong Existential Unforgeability under Chosen Message Attacks . . . . . . . . . . . . . . . . A.4 Ideal Obfuscation . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . B Proof of Lemma 3 . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . C Proof of Corollary 1 . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . D Security proof for the Fine-Grained Protocol . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . D.1 Full Proof of Correctness . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . D.2 Graphical Depiction of the Anonymity Proof . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . D.3 Full Proof of Anonymity . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . D.4 Proof of Lemma 9 . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . D.5 Proof of Lemma 10 . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .

14 :

 14 (OTP, vkR) := Pke.Dec * (skP , x (0) R ) 15 : (sk0, vk0) := Pke.Dec(skP , x (0) 0 [1 : m]) 16 : (σ0, µ (0) 0 ) := Ske.Dec(sk0, x (0) 0 [m + 1 : 2m]) 17 : (sk1, vk1) := Pke.Dec(skP , x (0) 1 [1 : m]) 18 : (σ1, µ (0) 1 ) := Ske.Dec(sk1, x (0) 1 [m + 1 : 2m]) 19 : if ¬Sig.Vfy(vkR, π) then 20 : return CointossS (π)

←

  Pke.Enc(pk P , (skb, vkb))∥Ske.Enc(skb, (σ, µ (0) )) 10 : P b : 1} 2m 12 : foreach χ ∈ {1, . . . , c} do 13 :

← 14 :

 14 Ske.Enc(skb, σ∥µ (χ) ) 1} m 19 : R : 20 : µ ← Sig.Sig(kR, π) (OTP, vkR) := Pke.Dec * (skP , x (0) R ) 15 : (sk0, vk0) := Pke.Dec(skP , x (0) 0 [1 : m]) 16 : (σ0, µ (0) 0 ) := Ske.Dec(sk0, x (0) 0 [m + 1 : 2m]) 17 : (sk1, vk1) := Pke.Dec(skP , x (0) 1 [1 : m]) 18 : (σ1, µ (0) 1 ) := Ske.Dec(sk1, x (0) 1 [m + 1 : 2m]) 19 : if ¬Sig.Vfy(vkR, π) then 20 : return CointossS (π)

←

  Pke.Enc(pk P , (skb, vkb))∥Ske.Enc(skb, (σ, µ (0) )) 10 : P b : 1} 2m 12 : foreach χ ∈ {1, . . . , c} do 13 :

← 14 :

 14 Ske.Enc(skb, σ∥µ (χ) ) 1} m 19 : R : 20 : µ ← Sig.Sig(kR, π) (OTP, vkR) := Pke.Dec * (skP , x (0) R ) 15 : (sk0, vk0) := Pke.Dec(skP , x (0) 0 [1 : m]) 16 : (σ0, µ (0) 0 ) := Ske.Dec(sk0, x (0) 0 [m + 1 : 2m]) 17 : (sk1, vk1) := Pke.Dec(skP , x (0) 1 [1 : m]) 18 : (σ1, µ (0) 1 ) := Ske.Dec(sk1, x (0) 1 [m + 1 : 2m]) 19 : if ¬Sig.Vfy(vkR, π) then 20 : return CointossS (π)

←

  Pke.Enc(pk P , (skb, vkb))∥Ske.Enc(skb, (σ, µ (0) )) 10 : P b : 1} 2m 12 : foreach χ ∈ {1, . . . , c} do 13 :

← 1 : 14 :

 114 Ske.Enc(skb, σ∥µ (χ) ) 1} m 19 : R : 20 : µ ← Sig.Sig(kR, π) if π = πC then 2 : return OTPC ⊕ σC 3 : elseif Pke.Dec * (skP , π[0]) = Pke.Dec * (skP , πC[0])∧ 4 : π[0] ̸ = πC[0] then (OTP, vkR) := Pke.Dec * (skP , x (0) R ) 15 : (sk0, vk0) := Pke.Dec(skP , x (0) 0 [1 : m]) 16 : (σ0, µ (0) 0 ) := Ske.Dec(sk0, x (0) 0 [m + 1 : 2m]) 17 : (sk1, vk1) := Pke.Dec(skP , x (0) 1 [1 : m]) 18 : (σ1, µ (0) 1 ) := Ske.Dec(sk1, x (0) 1 [m + 1 : 2m]) 19 : if ¬Sig.Vfy(vkR, π) then 20 : return CointossS (π)

←

  Pke.Enc(pk P , (skb, vkb))∥Ske.Enc(skb, (σ, µ (0) )) 10 : P b : 1} 2m 12 : foreach χ ∈ {1, . . . , c} do 13 :

← 1 : 14 :

 114 Ske.Enc(skb, σ∥µ (χ) ) 1} m 19 : R : 20 : µ ← Sig.Sig(kR, π) if π = πC then 2 : return OTPC ⊕ σC 3 : elseif Pke.Dec * (skP , π[0]) = Pke.Dec * (skP , πC[0])∧ 4 : π[0] ̸ = πC[0] then (OTP, vkR) := Pke.Dec * (skP , x (0) R ) 15 : (sk0, vk0) := Pke.Dec(skP , x (0) 0 [1 : m]) 16 : (σ0, µ (0) 0 ) := Ske.Dec(sk0, x (0) 0 [m + 1 : 2m]) 17 : (sk1, vk1) := Pke.Dec(skP , x (0) 1 [1 : m]) 18 : (σ1, µ (0) 1 ) := Ske.Dec(sk1, x (0) 1 [m + 1 : 2m]) 19 : if ¬Sig.Vfy(vkR, π) then 20 : return CointossS (π)

←

  Pke.Enc(pk P , (skb, vkb))∥Ske.Enc(skb, (σ, µ (0) )) 10 : P b : 1} 2m 12 : foreach χ ∈ {1, . . . , c} do 13 :

← 1 :

 1 Ske.Enc(skb, σ∥µ (χ) ) 1} m 19 : R : 20 : µ ← Sig.Sig(kR, π) if π = πC then 2 : return OTPC ⊕ σC 3 : elseif Pke.Dec * (skP , π[0]) = Pke.Dec * (skP , πC[0])∧ 4 : π[0] ̸ = πC[0] then vkR) := (OTPC, vkC R ) 15 : (sk0, vk0) := Pke.Dec(skP , x (0) 0 [1 : m]) 16 : (σ0, µ (0) 0 ) := Ske.Dec(sk0, x (0) 0 [m + 1 : 2m]) 17 : (sk1, vk1) := Pke.Dec(skP , x (0) 1 [1 : m]) 18 : (σ1, µ (0) 1 ) := Ske.Dec(sk1, x (0) 1 [m + 1 : 2m]) 19 : if ¬Sig.Vfy(vkR, π) then 20 : return CointossS (π)

←

  Pke.Enc(pk P , (skb, vkb))∥Ske.Enc(skb, (σ, µ (0) )) 10 : P b : 1} 2m 12 : foreach χ ∈ {1, . . . , c} do 13 :

← 1 :

 1 Ske.Enc(skb, σ∥µ (χ) ) 1} m 19 : R : 20 : µ ← Sig.Sig(kR, π) if π = πC then 2 : return OTPC ⊕ σC 3 : elseif Pke.Dec * (skP , π[0]) = Pke.Dec * (skP , πC[0])∧ 4 : π[0] ̸ = πC[0] then vkR) := (OTPC, vkC R ) 15 : (sk0, vk0) := Pke.Dec(skP , x (0) 0 [1 : m]) 16 : (σ0, µ (0) 0 ) := Ske.Dec(sk0, x (0) 0 [m + 1 : 2m]) 17 : (sk1, vk1) := Pke.Dec(skP , x (0) 1 [1 : m]) 18 : (σ1, µ (0) 1 ) := Ske.Dec(sk1, x (0) 1 [m + 1 : 2m]) 19 : if ¬Sig.Vfy(vkR, π) then 20 : return CointossS (π)

←

  Pke.Enc(pk P , (skb, vkb))∥Ske.Enc(skb, (σ, µ (0) )) 10 : P b : 1} 2m 12 : foreach χ ∈ {1, . . . , c} do 13 :

←

  Ske.Enc(skb, σ∥µ (χ) ) 1} m 19 : R : 20 : µ ← Sig.Sig(kR, π)

  m]) 16 : (σ0, µ (0) 0 ) := Ske.Dec(sk0, x (0) 0 [m + 1 : 2m]) 17 : (sk1, vk1) := Pke.Dec(skP , x (0) 1 [1 : m]) 18 : (σ1, µ (0) 1 ) := Ske.Dec(sk1, x (0) 1 [m + 1 : 2m]) 19 : if ¬Sig.Vfy(vkR, π) then 20 : return CointossS (π)

←

  Pke.Enc(pk P , (skb, vkb))∥Ske.Enc(skb, (σ, µ (0) )) 10 : P b : 1} 2m 12 : foreach χ ∈ {1, . . . , c} do 13 :

←

  Ske.Enc(skb, σ∥µ (χ) ) 1} m 19 : R : 20 : µ ← Sig.Sig(kR, π)

←

  Pke.Enc(pk P , (skb, vkb))∥Ske.Enc(skb, (σ, µ (0) )) 10 : P b : 1} 2m 12 : foreach χ ∈ {1, . . . , c} do 13 :

←

  Ske.Enc(skb, σ∥µ (χ) ) 1} m 19 : R : 20 : µ ← Sig.Sig(kR, π)

←

  Ske.Enc(skb, σ∥µ (χ) ) 1} m 19 : R : 20 : µ ← Sig.Sig(kR, π)

←

  Ske.Enc(skb, σ∥µ (χ) ) 1} m 19 : R : 20 : µ ← Sig.Sig(kR, π)

  1} m 19 : R : 20 : µ ← Sig.Sig(kR, π)

  1} m 19 : R : 20 : µ ← Sig.Sig(kR, π)

  1} m 19 : R : 20 : µ ← Sig.Sig(kR, π)

14 :RR←

 14 (OTP, vkR) := Pke.Dec * (skP , x (0) R ) 15 : (sk0, vk0) := Pke.Dec(skP , x(0) 0 [1 : m]) 16 : (σ0, µ (0) 0 ) := Ske.Dec(sk0, x (0) 0 [m + 1 : 2m]) 17 : (sk1, vk1) := Pke.Dec(skP , x (0) 1 [1 : m]) 18 : (σ1, µ (0) 1 ) := Ske.Dec(sk1, x (0) 1 [m + 1 : 2m]) 19 : if ¬Sig.Vfy(vkR, π) then ) • (c + 1) 22 : χ 1 := Sig.Vfy(µ ) • (c + 1) 23 : foreach χ ∈ {1, . . . , c} do 24 : foreach b ∈ {0, 1}|χ b > c do 25 : X b := Ske.Dec * (skb, x b[1 : |X b|] 28 : if ¬Sig.Vfy(µ (χ) b , vkb, π[χ -1]) ∨ σb ̸ = σ ′ b then 29 : χ b := χ 30 : b ′ := argmax b (χ b ) 31 : return OTP ⊕ CointossS (π) (1/2+χ b /2c) (σ (b ′ ) , 1 -σ (b ′ ) ) 32 :1 : R : 2 : OTP $ ← {0, 1} 3 : (kR, vkR) ← Sig.KeyGen(1 κ ) 4 : x (0) R ← Pke.Enc(pk P , (OTP, vkR)) 5 : Pb : 6 : (kb, vkb) ← Sig.KeyGen(1 κ ) 7 : (skb) ← Ske.KeyGen(1 κ ) Pke.Enc(pk P , (skb, vkb))∥Ske.Enc(skb, (0, µ (0) )) 10 : P b : 1} 2m 12 : foreach χ ∈ {1, . . . , c} do 13 :

← 1 :RR 1 :RR 1 :

 111 Ske.Enc(skb, 0, µ (χ) ) 1} m 19 : R : 20 : µ ← Sig.Sig(kR, π) if π = πC then 2 : return OTPC ⊕ 0 3 : elseif Pke.Dec * (skP , π[0]) = Pke.Dec * (skP , πC[0])∧ 4 : π[0] ̸ = πC[0] then 5 : abort 6 : elseif π[0] = πC[0] then 7 : χ* := argmin χ ′ (π[χ ′ ] ̸ = πC[χ ′ ]) 8 : if π[x c * +1 b C ] = πC[x χ * +1 b C ]∨ 9 : Ske.Dec * (skb C , x (χ * +1) b C ) = (σC∥µ C (χ * +1) ) then 10 : χ * := χ * + 1 11 : p := 1/2 + χ * /2c vkR) := (OTPC, vkC R ) 15 : (sk0, vk0) := Pke.Dec(skP , x (0) 0 [1 : m]) 16 : (σ0, µ (0) 0 ) := Ske.Dec(sk0, x (0) 0 [m + 1 : 2m]) 17 : (sk1, vk1) := Pke.Dec(skP , x (0) 1 [1 : m]) 18 : (σ1, µ (0) 1 ) := Ske.Dec(sk1, x (0) 1 [m + 1 : 2m]) 19 : if ¬Sig.Vfy(vkR, π) then ) • (c + 1) 22 : χ 1 := Sig.Vfy(µ ) • (c + 1) 23 : foreach χ ∈ {1, . . . , c} do 24 : foreach b ∈ {0, 1}|χ b > c do 25 : X b := Ske.Dec * (skb, x b[1 : |X b|] 28 : if ¬Sig.Vfy(µ (χ) b , vkb, π[χ -1]) ∨ σb ̸ = σ ′ b then 29 : χ b := χ 30 : b ′ := argmax b (χ b ) 31 : return OTP ⊕ CointossS (π) (1/2+χ b /2c) (σ (b ′ ) , 1 -σ (b ′ ) ) 32 :1 : R :2 : OTP $ ← {0, 1} 3 : (kR, vkR) ← Sig.KeyGen(1 κ ) 1} m 19 : R : 20 : µ ← Sig.Sig(kR, π) if π = πC then 2 : return OTPC ⊕ 0 3 : elseif Pke.Dec * (skP , π[0]) = Pke.Dec * (skP , πC[0])∧ 4 : π[0] ̸ = πC[0] then 5 : abort 6 : elseif π[0] = πC[0] then 7 : χ * := argmin χ ′ (π[χ ′ ] ̸ = πC[χ ′ ]) 8 : if π[x c * +1 b C ] = πC[x χ * +1 b C ]∨ 9 : Ske.Dec * (skb C , x (χ * +1) b C ) = (σC∥µ C (χ *+1) ) then 10 : χ * := χ * + 1 11 : p := 1/2 + χ * /2c vkR) := (OTPC, vkC R ) 15 : (sk0, vk0) := Pke.Dec(skP , x (0) 0 [1 : m]) 16 : (σ0, µ (0) 0 ) := Ske.Dec(sk0, x (0) 0 [m + 1 : 2m]) 17 : (sk1, vk1) := Pke.Dec(skP , x (0) 1 [1 : m]) 18 : (σ1, µ (0) 1 ) := Ske.Dec(sk1, x (0) 1 [m + 1 : 2m]) 19 : if ¬Sig.Vfy(vkR, π) then ) • (c + 1) 22 : χ 1 := Sig.Vfy(µ ) • (c + 1) 23 : foreach χ ∈ {1, . . . , c} do 24 : foreach b ∈ {0, 1}|χ b > c do 25 : X b := Ske.Dec * (skb, x b[1 : |X b|] 28 : if ¬Sig.Vfy(µ (χ) b , vkb, π[χ -1]) ∨ σb ̸ = σ ′ b then 29 : χ b := χ 30 : b ′ := argmax b (χ b )31 : return OTP ⊕ CointossS (π) (1/2+χ b /2c) (σ (b ′ ) , 1 -σ (b ′ ) ) 32 :1 : R : 2 : OTP $ ← {0, 1} 3 : (kR, vkR) ← Sig.KeyGen(1 κ ) 1} m 19 : R : 20 : µ ← Sig.Sig(kR, π) if π = πC then 2 : return OTPC ⊕ 0 3 : elseif Pke.Dec * (skP , π[0]) = Pke.Dec * (skP , πC[0])∧ 4 : π[0] ̸ = πC[0] then 5 : abort 6 : elseif π[0] = πC[0] then 7 : χ

RR 1 :

 1 15 : (sk0, vk0) := Pke.Dec(skP , x (0) 0 [1 : m]) 16 : (σ0, µ (0) 0 ) := Ske.Dec(sk0, x (0) 0 [m + 1 : 2m]) 17 : (sk1, vk1) := Pke.Dec(skP , x(0) 1 [1 : m]) 18 : (σ1, µ (0) 1 ) := Ske.Dec(sk1, x (0) 1 [m + 1 : 2m]) 19 : if ¬Sig.Vfy(vkR, π) then ) • (c + 1) 22 : χ 1 := Sig.Vfy(µ ) • (c + 1) 23 : foreach χ ∈ {1, . . . , c} do 24 : foreach b ∈ {0, 1}|χ b > c do 25 : X b := Ske.Dec * (skb, x b[1 : |X b|] 28 : if ¬Sig.Vfy(µ (χ) b , vkb, π[χ -1]) ∨ σb ̸ = σ ′ b then 29 : χ b := χ 30 : b ′ := argmax b (χ b ) 31 : return OTP ⊕ CointossS (π) (1/2+χ b /2c) (σ (b ′ ) , 1 -σ (b ′ ) ) 32 :1 : R : 2 : OTP $ ← {0, 1} 3 : (kR, vkR) ← Sig.KeyGen(1 κ ) 1} m 19 : R : 20 : µ ← Sig.Sig(kR, π) if π = πC then 2 : return OTPC ⊕ 0 3 : elseif Pke.Dec * (skP , π[0]) = Pke.Dec * (skP , πC[0])∧ 4 : π[0] ̸ = πC[0] then 5 : abort 6 : elseif π[0] = πC[0] then 7 : χ

RR 1 :

 1 15 : (sk0, vk0) := Pke.Dec(skP , x (0) 0 [1 : m]) 16 : (σ0, µ (0) 0 ) := Ske.Dec(sk0, x (0) 0 [m + 1 : 2m]) 17 : (sk1, vk1) := Pke.Dec(skP , x(0) 1 [1 : m]) 18 : (σ1, µ (0) 1 ) := Ske.Dec(sk1, x (0) 1 [m + 1 : 2m]) 19 : if ¬Sig.Vfy(vkR, π) then ) • (c + 1) 22 : χ 1 := Sig.Vfy(µ ) • (c + 1) 23 : foreach χ ∈ {1, . . . , c} do 24 : foreach b ∈ {0, 1}|χ b > c do 25 : X b := Ske.Dec * (skb, x b[1 : |X b|] 28 : if ¬Sig.Vfy(µ (χ) b , vkb, π[χ -1]) ∨ σb ̸ = σ ′ b then 29 : χ b := χ 30 : b ′ := argmax b (χ b ) 31 : return OTP ⊕ CointossS (π) (1/2+χ b /2c) (σ (b ′ ) , 1 -σ (b ′ ) ) 32 :1 : R : 2 : OTP $ ← {0, 1} 3 : (kR, vkR) ← Sig.KeyGen(1 κ ) 1} m 19 : R : 20 : µ ← Sig.Sig(kR, π) if π = πC then 2 : return OTPC ⊕ 1 3 : elseif Pke.Dec * (skP , π[0]) = Pke.Dec * (skP , πC[0])∧ 4 : π[0] ̸ = πC[0] then 5 : abort 6 : elseif π[0] = πC[0] then 7 : χ

RR 1 :

 1 15 : (sk0, vk0) := Pke.Dec(skP , x (0) 0 [1 : m]) 16 : (σ0, µ (0) 0 ) := Ske.Dec(sk0, x (0) 0 [m + 1 : 2m]) 17 : (sk1, vk1) := Pke.Dec(skP , x(0) 1 [1 : m]) 18 : (σ1, µ (0) 1 ) := Ske.Dec(sk1, x (0) 1 [m + 1 : 2m]) 19 : if ¬Sig.Vfy(vkR, π) then ) • (c + 1) 22 : χ 1 := Sig.Vfy(µ ) • (c + 1) 23 : foreach χ ∈ {1, . . . , c} do 24 : foreach b ∈ {0, 1}|χ b > c do 25 : X b := Ske.Dec * (skb, x b[1 : |X b|] 28 : if ¬Sig.Vfy(µ (χ) b , vkb, π[χ -1]) ∨ σb ̸ = σ ′ b then 29 : χ b := χ 30 : b ′ := argmax b (χ b ) 31 : return OTP ⊕ CointossS (π) (1/2+χ b /2c) (σ (b ′ ) , 1 -σ (b ′ ) ) 32 :1 : R : 2 : OTP $ ← {0, 1} 3 : (kR, vkR) ← Sig.KeyGen(1 κ ) 1} m 19 : R : 20 : µ ← Sig.Sig(kR, π) if π = πC then 2 : return OTPC ⊕ 1 3 : elseif Pke.Dec * (skP , π[0]) = Pke.Dec * (skP , πC[0])∧ 4 : π[0] ̸ = πC[0] then 5 : abort 6 : elseif π[0] = πC[0] then 7 : χ

RR

  15 : (sk0, vk0) := Pke.Dec(skP , x (0) 0 [1 : m]) 16 : (σ0, µ (0) 0 ) := Ske.Dec(sk0, x (0) 0 [m + 1 : 2m]) 17 : (sk1, vk1) := Pke.Dec(skP , x (0) 1 [1 : m]) 18 : (σ1, µ (0) 1 ) := Ske.Dec(sk1, x (0) 1 [m + 1 : 2m]) 19 : if ¬Sig.Vfy(vkR, π) then ) • (c + 1) 22 : χ 1 := Sig.Vfy(µ ) • (c + 1) 23 : foreach χ ∈ {1, . . . , c} do 24 : foreach b ∈ {0, 1}|χ b > c do 25 : X b := Ske.Dec * (skb, x b[1 : |X b|] 28 : if ¬Sig.Vfy(µ (χ) b , vkb, π[χ -1]) ∨ σb ̸ = σ ′ b then 29 : χ b := χ 30 : b ′ := argmax b (χ b )

  1} m 19 : R : 20 : µ ← Sig.Sig(kR, π) 15 : (sk0, vk0) := Pke.Dec(skP , x (0) 0 [1 : m]) 16 : (σ0, µ (0) 0 ) := Ske.Dec(sk0, x (0) 0 [m + 1 : 2m]) 17 : (sk1, vk1) := Pke.Dec(skP , x (0) 1 [1 : m]) 18 : (σ1, µ (0) 1 ) := Ske.Dec(sk1, x (0) 1 [m + 1 : 2m]) 19 : if ¬Sig.Vfy(vkR, π) then 20 : return CointossS

←

  Ske.Enc(skb, (1, µ (χ) )) 1} m 19 : R : 20 : µ ← Sig.Sig(kR, π)

  the simulation enforces correctness of the challenge transcript π C : if the input transcript π matches the challenge transcript π C , it returns OTP C ⊕ σ C . -During simulation of the circuit the adversary aborts if any of the first-round messages from P 0 or P 1 differ from the messages reported in the challenge transcript and the decryptions still match. -During simulation of the circuit, if the first receiver message of the input transcript π is the same as that of the challenge transcript π C , instead of decrypting it the circuit directly sets OTP = OTP C and vk R = vk C R as the values used in the creation of the challenge transcript. -During simulation of the oracle, if the first-round messages of both parties match the first-round messages in the challenge transcript π C . In this case, the program compares the input transcript π with the challenge transcript π C until it finds the first round χ * in which the input differs from the challenge transcript. It then checks round χ * + 1, and if it contains the same message from the sending party, it adds one to χ. Finally, the circuit flips a biased coin, which returns the correct bit σ C with probability p := 1/2 + χ * /2c and the complementary bit (1 -σ C ) otherwise.

←←

  Pke.Enc(pk P , OTP). On input (b, σ, k), P b computes µ (0) b ← Sig.Sig(k, (σ, x (0) R )) and broadcasts x (0) b ← Pke.Enc(pk P , σ∥µ). On input (⊥), P 1-b sets uniformly random x Sig.Sig(k, π[0]) and broadcasts x (1) b ← Pke.Enc(pk P , σ∥µ (1) b

  encoded in the second-round message by P b is returned.• With probability (1 -2d), the coin yields heads, in which case a second coin is flipped: * With probability 2d, the coin yields tails, in which case the correct output σ =:σ (0) bencoded in the first-round message by P b is returned. * With probability (1 -2d), the coin lands on the heads-side. In this case, a new unbiased coin is flipped:• With probability 1/2, this new coin returns σ.

Fig. 11 :

 11 Fig. 11: Tree showcasing the different worlds, based on the randomness from a uniformly random challenge transcript.

  InductiveStep: If Π 1 AT (c) can transfer the bit σ with correctness 1-(1 -2d) c /2, then Π 1 AT (c+1)can transfer the bit σ with correctness 1 -(1 -2d) c+1 /2. On honest inputs, only the signature of party P b verifies, the random input of P 1-b is a valid signature only with negligible probability, which we drop here. The protocol Π 1 AT (c+1) returns the bit with the following probability:2d • 1 + (1 -2d) • Pr[Π 1 AT c returns correct bit] = 2d + (1 -2d) • 1 -(1 -2d) c 2 = 2d + (1 -2d) -(1 -2d) • (1 -2d)The claim is true.Plugging this into the Definition 4 for ε-correctness yields:ε = 1 -(1 -2d) c /2 (46) ⊓ ⊔Anonymity. We now also analyze our new protocol with respect to anonymity. But we first prove two lemmas we'll need later. Lemma 41 (Changing the Senders Message). Let Π 1 AT (c) be given as in Fig. 12. Let c ∈ N > 1 be the number of rounds. Changing the sending parties message in round χ ∈ [1, c] yields the correct output with probability 1 -((1 -2d) χ-1 )/2

⊓ ⊔ Lemma 42 (

 42 Changing the Dummy Friends Message). Let Π 1 AT (c) be given as in Fig. 12. Let c ∈ N > 1 be the number of rounds. Changing the dummy friends message in round χ ∈ [1, c] yields the correct output with probability 1 -((1 -2d) χ )/2

CointossS

Fig. 14 :

 14 Fig. 14: Tree showcasing the different worlds, based on the randomness from a uniformly random challenge transcript.

Lemma 44 (

 44 Anonymity of the c-round protocol). The protocol from Fig. 12 is δ-anonymouswith δ ≤ 1 -|2d -(1 -2d) c |.Proof. Recall from Eq. (4) that the anonymity δ is the maximum δ for which it holds thatPr b $ ←{0,1} Exp Π 1 AT ,A,b (κ) = b -1/2 ≤ (1 -δ)/2 (48) (a)The relation between correctness and anonymity for up to 100-round protocols.(b) The relation between correctness and anonymity for up to 10.000-round protocols.

Fig. 15 :Create c orales {Oi} c i=1 foreach

 15i=1 Fig. 15: Two images showing the anonymity obtained for a given correctness requirement. The x-axis showcases the number of rounds for the protocol, which for clarity we scaled to 100 and 10.000. The y-axis shows the anonymity guarantee, i.e. the maximum advantage of an adversary in finding the sending party.

Fig. 18 :

 18 Fig. 18: Game to determine whether c Bernoulli-oracle have a common offset ξ in their probability distribution or if they follow the distribution they were given.

Fig. 21 :

 21 Fig. 21:The two distributions we have to prove indistinguishable in case the adversary A0 picks the receiver.

$←

  ⟨P R , P 0 , P 1 ⟩(σ, (Σ 0 , Σ 1 ), ⊥)} ≈{(Σ 0 , Σ 1 ) $ ← {0, 1} 2ℓ , σ $ ← {0, 1} : π $ ← ⟨P R , P 0 , P 1 ⟩(σ, ⊥, (Σ 0 , Σ 1 ))} (61)

Fig. 22 :

 22 Fig. 22:The two distributions we have to prove indistinguishable in case the adversary A0 picks the dummy friend.

$←

  ⟨P 0 , P 1 , P D ⟩((Σ 0 , Σ 1 ), σ, ⊥)} ≈{(Σ 0 , Σ 1 ) $ ← {0, 1} 2ℓ , σ $ ← {0, 1} : π $ ← ⟨P 0 , P 1 , P D ⟩(σ, (Σ 0 , Σ 1 ), ⊥)}(63)

  Setup(1 κ ) and samples a uniform random tape T R for R. It outputs (crs, T R ).

	Π ℓ SR .Transfer(crs, b, Σ) proceeds exactly as Π ℓ AT .Transfer(crs, b, Σ), except that the receiver R does
	not broadcast any message. At each round χ = 1 to χ = c, the sender P b locally appends the χ-th receiver message x χ in Π ℓ AT .Transfer(crs, b, Σ; T R , •, •) to the current transcript π[χ] (note
	that x χ can be computed deterministically from π[χ] and T R ), and compute its next message
	as in Π ℓ AT .Transfer using the transcript π[χ]∥x χ .
	Π ℓ SR .Reconstruct(crs, π, T R ) is defined exactly as Π ℓ AT .Reconstruct(crs, π, T R ), except that it first expands the transcript π by recomputing (deterministically) the messages of R in Π ℓ AT .Transfer(crs,
	b, Σ; T R , •, •) and appending them to π at each round.

  . . , H ℓ between Exp anon (κ), then B simulates H i for A.

	Π ℓ AT ,A,0 (κ) AT ,A,1 (κ) and H ℓ is identical to Exp anon AT ,A,1 (κ) in Fig. 2. H 1 is identical to Exp anon and Exp anon Π ℓ Π ℓ Π ℓ AT ,A,0 (κ). We construct an adversary B against the anonymity of Π 1 AT in Fig. 2. If B plays Exp anon Π 1 AT ,B,0 (κ), then B simulates H i+1 for A. Otherwise, if B plays Exp anon Π 1 AT ,B,1 Hi
	for j ∈ [ℓ] do
	crsj ← Setup(1 κ )
	crs ′ := (crs1, . . . , crs ℓ )

  and set Σ t to be an arbitrary element of {0, 1} κ \ {Σ1, • • • , Σt} (which exists since t ≪ 2 κ ).-Output (Σ t , st = (crs, Σ t )).

	Algorithm A t 1
	-On input Σ, st, parse st as (crs, Σ t ) and π as a triple (π[c -1], x0, x1), where π[c -1] is
	a transcript for the first c -1 rounds (if c = 1, it is the empty string), and (x0, x1) ∈
	{0, 1} m × {0, 1} m are the last-round messages from P0 and P1 respectively.
	-Pick (x ′ 0

Table of Contents

 of 1 Introduction . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 1.1 Undetectable Secure Computation . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 1.2 Defining Anonymous Transfer . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 1.3 Impossibility Result . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 1.4 A Candidate Fine-Grained Anonymous Transfer . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 1.5 Discussions and Implications . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 1.6 Further Results and Open Questions . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 1.7 Acknowledgements . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 2 Preliminaries . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 2.1 Notations . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 2.2 Steganography . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 2.3 Distribution Testing . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 3 Anonymous Transfer . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 3.1 Network Model and Non-Participating Parties . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 3.2 The Model . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 3.3 Fine-grained Anonymous Transfer . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .

3.4 Trivial Anonymous Transfers . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .

  .9 Proof of Lemma 14 . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . D.10 Graphical Depiction of the Secrecy Proof Outline . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . D.11 Full Proof of Secrecy . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . E Asymptotically Secure AT in the Designated Sender Model . . . . . . . . . . . . . . . . . . . . . . . . . . E.1 A two-round protocol . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . E.2 A c-rounds protocol. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . E.3 On the security . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . F A fine-grained Anonymous Transfer for ℓ-bit messages . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . G Undetectable Oblivious Transfer from Anonymous Transfer and two-round Covert Oblivious Transfer . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . G.1 Correctness . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . G.2 Privacy . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . G.3 Anonymity . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .

. . . . . D.6 Proof of Lemma 11 . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . D.7 Proof of Lemma 12 . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . D.8 Proof of Lemma 13 . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . D

16 (Strong Existential Unforgeability under Chosen Message Attacks for

	Signatures). A signature scheme Sig = (KeyGen, Sig, Vfy) fulfills Strong Existential Unforgeability
	under Chosen Message Attacks (sEUF-CMA) if for every PPT-adversary A with access to a signing
	oracle Sig(k, •) it holds that:

This follows directly from the fact that given undetectable secure computation for any function f , we can directly construct AT by computing a function that lets two potential senders insert either a bitstring for transfer or ⊥ and outputs one of them (i.e. the one input that is not ⊥) to the receiver.

A c-round protocol corresponds to a synchronous model, where each message is broadcasted and the messages in each round only depend on messages from previous rounds, see Definition 1 for a formal definition.

We slightly abuse notation but we believe the meaning to be clear.

Since the protocol is silent-receiver, there is no message from the receiver; furthermore, assuming that the sender message is m-bit is without loss of generality, since otherwise the protocol is trivially not anonymous.

We define these strings to be the XOR of two strings sent in the previous rounds by P0 and P1 to guarantee that Reconstruct remains deterministic; this is just a syntactic manipulation which is not crucial, but simplifies the rest of the exposition.

Π κ AT is δ-anonymous; truncating the transcript can trivially not decrease anonymity.

We ignore the absolute value here as by definition, A ′ is better than guessing and hence Pr[A successful] -1/(N -2) > 0.

See Appendix A.3 for a definition of sEUF-CMA.

This is in contrast to the Hellinger-distance H which yields tighter bounds but where the amount of information from a single query really depends on the oracle Oχ which is queried. This makes it harder to provide meaningful bounds for adversaries querying different oracles with their t samples.

This means that first the simulator checks for equal messages and if that is already true, the second condition is ignored, and hence the sending parties message is only forwarded to the decryption oracle if it differs from the challenge.

In case both second-round messages contain a valid signature, always use the message of P0.

Again, in case both first-round messages contain a valid signature, always use the message of P0.

Note that the reduction only uses the Sig oracle to produce the challenge transcript and, hence, never queries the Sig oracle on 1 -σ (0) 0 .

See Appendix A.1 for a definition of COT.

⋆ Supported by funding from the topic Engineering Secure Systems of the Helmholtz Association (HGF) and by KASTEL Security Research Labs. ⋆⋆ Supported by ANR SCENE. party protocol). Let P 1 , . . .

Creating the Transcript. The creation of the transcript is straightforward and works by sampling random messages for each party.

Simulating the Oracle. The used verification key vk R is set to be the verification key of the challenger. Thus the final signature µ on the entire transcript, which is required for the circuit to not abort (by outputting a random bit), needs to be forged. Hence for each input transcript the adversary first checks if the receiver message is equivalent to that from the challenge transcript. If it isn't then the transcript can not be used for distinguishing anyways. If it is, the adversary checks if the remaining transcript is the same as well. If it is, the transcript can not be used for distinguishing and simulation just continues as the path taken is equivalent in both games. If it isn't then the adversary checks if the signature µ verifies under the used key. If it doesn't then both games act exactly the same and output a random bit. Hence to distinguish the signature has to verify. Then, however, the signature is a valid forgery.

Translating the Result. If no valid signature was queried then-as mentioned above-the distinguishing advantage must be negligible. For a non-negligible advantage the distinguisher has to query at least one signature. This can be used as forgery to break the EUF-CMA security of Sig. As stated above, the advantage of the distinguisher is directly related to the probability of successfully distinguishing. Hence A will have a valid forgery with non-negligible advantage. This would contradict the EUF-CMA security of the signature scheme and thus completes our proof.

⊓ ⊔

Game σ 4 (κ) This game is as Game σ 3 (κ) but instead of fixing σ := 0, we now act as if the sending party sends σ := 1. Lemma 17. Let Pke be an IND$-CCA secure public-key encryption scheme. Let Ske be an IND$-CCA secure secret-key encryption scheme. Let Sig be an sEUF-CMA secure signature scheme. For all PPT guessing algorithms A, the distinguishing advantage for Game σ 3 (κ) and Game σ 4 (κ) is bounded by: |Pr[out Game σ 3 (κ) = 1] -Pr[out Game σ 4 (κ) = 1]| ∈ negl(κ) Proof. Security automatically follows from the statistical security of the One-Time-Pad encryption: if there was a distinguisher D with non-negligible advantage α in distinguishing these two games then there would be an adversary A which can decrypt One-Time-Pad encrypted bits with non-negligible advantage.

Simulating the Transcript. As the transcript is the same in both games, we construct the transcript by uniformly sampling each message.

Simulating the Oracle.

If A is given a ciphertext ct (which by definition is defined as OTP ⊕ σ for some random OTP and σ) we simulate the oracle as described in both games (since they are equivalent) and whenever the code says return CointossS Translating the Result. If the distinguisher assumes Game σ 3 (κ) then A assumes σ = 0 (in which case the transferred bit is σ C := x), and if the distinguisher assumes Game σ 4 (κ) then A guesses σ = 1 (and the transferred bit is σ C := x). Note that if D is correct with advantage α over guessing, hence the guess of A is correct with advantage α as well.

⊓ ⊔ Game σ 5 (κ) This game follows Game σ 4 (κ) but undoes all the changes from the first-to-second gamehop and that from Game σ 3 (κ). Lemma 18. Let Pke be an IND$-CCA secure public-key encryption scheme. Let Ske be an IND$-CCA secure secret-key encryption scheme. Let Sig be an sEUF-CMA secure signature scheme. For all PPT guessing algorithms A, the distinguishing advantage for Game σ 4 (κ) and Game σ 5 (κ) is bounded by: |Pr[out Game σ 4 (κ) = 1] -Pr[out Game σ 5 (κ) = 1]| ∈ negl(κ)

1 , x

(1) 0 , x (1) 0

, σ

(1)

1 , µ

(1) 1 := Pke.Dec skP , x

(1) 1 if ∃b ∈ {0, 1} : Sig.Vfy(vk, µ If there is no second-round message with a valid encryption of the first round, the program continues by considering the first round messages. If there is a message that decrypts to a bit σ and a valid signature µ on σ with respect to vk 17 , then the program flips a single coin which lands on tails with probability 2d. In this case, the bit is returned. Otherwise, the circuit again returns a uniformly random bit.

It is crucial that the randomness inside the ideally obfuscated circuit is derived from designated parts of the circuit input only, the source of which is explicitly given inside the figures. We note that this is in contrast to the established way of obfuscating probabilistic circuits due to [CLT + 15]. Recall that in [CLT + 15], the obfuscated circuit always derives its randomness from the entire input. In our case, the randomness of, e.g., the first coin-toss is taken from the second sender message only, whereas the randomness of the second coin-toss is taken from the first sender message. This ensures a one-shot behavior, in that attacks which involve changing only a single message result in a circuit which behaves deterministic, regardless of the new value of the changed message. Thereby, this prevents attacks using repeated sampling to estimate output probabilities. (1/2) (0, 1) 30 :

1 : R :

R ← Pke.Enc(pk P , OTP) 4 : P0 :

0 ← Pke.Enc(pk P , σ∥µ) 13 : P1 :

(1/2) (0, 1) 30 :

1 : R :

0 ← Pke.Enc(pk P , σ∥µ) 13 : P1 :

(1/2) (0, 1) 30 :

1 : R :

0 ← Pke.Enc(pk P , σ∥µ) 13 : P1 :

(1/2) (0, 1) 30 :

1 : R :

0 ← Pke.Enc(pk P , σ∥µ) 13 : P1 :

(1/2) (0, 1) 30 :

1 : R :

0 ← Pke.Enc(pk P , σ∥µ) 13 : P1 :

(1/2) (0, 1) 30 :

1 : R :

0 ← Pke.Enc(pk P , σ∥µ) 13 : P1 :

(1/2) (0, 1) 30 :

1 : R :

0 ← Pke.Enc(pk P , σ∥µ) 13 : P1 :

(1/2) (0, 1) 30 :

1 : R :

(1/2) (0, 1) 30 :

1 : R : (1/2) (0, 1) 30 :

1 : R : (1/2) (0, 1) 30 :

1 : R : (1/2) (0, 1) 30 :

1 : R :

1 ← Pke.Enc(pk P , σ∥µ) 10 : P0 : (1/2) (0, 1) 30 :

1 : R :

1 ← Pke.Enc(pk P , σ∥µ) 10 : P0 :

return CointossS (1/2) (0, 1) 30 :

1 : R :

1 ← Pke.Enc(pk P , σ∥µ) 10 : P0 :

return CointossS (1/2) (0, 1) 30 :

1 : R :

1 ← Pke.Enc(pk P , σ∥µ) 10 : P0 :

return CointossS (1/2) (0, 1) 30 :

1 : R :

1 ← Pke.Enc(pk P , σ∥µ) 10 : P0 :

return CointossS (1/2) (0, 1) 30 :

1 : R :

1 ← Pke.Enc(pk P , σ∥µ) 10 : P0 :

return CointossS (1/2) (0, 1) 30 :

1 : R :

1 ← Pke.Enc(pk P , σ∥µ) 10 : P0 :

(1/2) (0, 1) 30 :

1 : R :

(1/2) (0, 1) 30 :

1 : R :

(1/2) (0, 1) 30 :

1 : R :

(1/2) (0, 1) 30 :

1 : R :

(1/2) (0, 1) 30 :

1 : R :

(1/2) (0, 1) 30 :

1 : R :

That is, we use the following games:

Game σ 1 (κ) This is the original game in which party P 0 is the sender, but where the obfuscated circuit has been replaced with oracle-access to the circuit and the PRF within the circuit is replaced by a random oracle. Game σ 2 (κ) This game follows Game σ 1 (κ), but during the simulation of the oracle P AT from Fig. 10, the simulation enforces correctness of the challenge transcript π C by initially checking if the input matches the challenge transcript and in that case, returning the output of a biased coin that returns OTP ⊕ σ C with probability (1 -(1 -2d) 2 /2) and OTP ⊕ σ C with the complementary probability ((1 -2d) 2 /2). The randomness is taken over the entire transcript.

Lemma 21 (Indistinguishability of Game σ

1 (κ) and Game σ 2 (κ)). Let Pke be an IND$-CCA secure public-key encryption scheme. Let Sig be an sEUF-CMA secure signature scheme. For all PPT guessing algorithms A, the distinguishing advantage for Game σ 1 (κ) and Game σ 2 (κ) is bounded by:

This game follows Game σ 2 (κ), but during simulation of the oracle P AT from Fig. 10, if the input has a different first-round message of the sender or of the receiver, the simulated program outputs a uniformly random bit. The randomness is taken over all three zero-round messages, that is, over

Lemma 22 (Indistinguishability of Game σ

2 (κ) and Game σ 3 (κ)). Let Pke be an IND$-CCA secure public-key encryption scheme. Let Sig be an sEUF-CMA secure signature scheme. For all PPT guessing algorithms A, the distinguishing advantage for Game σ 2 (κ) and Game σ 3 (κ) is bounded by:

In the first step, we simulate the oracle by first checking if the first sending parties message is a valid rerandomization of the message from the challenge transcript, i.e., if the message differs but decrypts to the same value. We then additionally add a check whether the first sending parties message differs and has a different decryption. We can then combine the two branches to obtain the behavior described in Game σ 3 (κ). ← {0, 1} to-be-transferred, creating a signature key-pair (k, vk) ← Sig.KeyGen(1 κ ) and computing the signature µ

0 ) to its NM-CCA challenger C who in return provides A with the challenge ciphertext ct * . A simulates the oracle P AT using the previously created verification key vk for signature checks and by forwarding all decryption queries to the decryption oracle provided by C. Note that the decryption oracle is never queried for ct * due to the changes made in H 1 . H 1 and H 2 behave fully identically except if D makes an oracle query that causes the simulated oracle to enter the newly introduced elseif-branch. If this event occurs, A returns x (0) 0 and the relation "equality". Hence, D's advantage in distinguishing H 1 and H 2 is upper bounded by some negligible function. H In this step, we additionally consider first sender-party messages which decrypt to a different message.

Let D be a PPT distinguisher between H 2 and H 3 . We build an adversary A breaking the sEUF-CMA security of Sig as follows. A simulates H 2 for D by choosing the encryption parameters via Pke.KeyGen and by using oracle-queries to obtain valid signatures of σ for the first round and of π[1] for the second round.

In order to distinguish H 2 and H 3 , a distinguisher D must cause the oracle to behave differently. That is, D needs to make the oracle in H 3 take the newly introduced elseifbranch such that the oracle in H 2 produces a different output distribution. Given the event that the oracle in H 3 enters the new elseif-branch and the oracle in H 2 does not behave identically, i.e. does not return a uniformly random bit. Then, either

Sig.Vfy(vk, µ

for b = 0 needs to be satisfied to ensure differing behavior. Let E 1 denote the event that Eq. ( 40) occurs and let E 2 denote the event that Eq. ( 41) occurs. Due to the changes introduced in H 2 , the new elseif-branch can only be executed if π[x

Hence, if E 2 occurs, the sEUF-CMA adversary A outputs (σ

0 ) which is either a valid signature for message 1 -σ (0) 0 (which has never been queried via the Sig oracle 18 ) or a fresh valid signature for σ

is a valid signature for the first round transcript, i.e., particularly for the message [x

0 ] and has hence never been sent to the Sig oracle. Hence, the advantage of D in distinguishing H 2 and H 3 is upper bounded by some negligible function. H 4 The oracle in H 3 and H 4 behaves identically, hence H 3 and H 4 are identically distributed.

Further, H 4 is identical to Game σ 3 (κ). This concludes the proof that |Pr[out Game σ

This game is as Game σ 3 (κ), but during simulation of the oracle P AT from Fig. 10, if the input shares the same first-round message of the sender but has a different first-round message of the receiver, the program outputs a uniformly random bit where the randomness is taken over all three first-round messages.

Lemma 23 (Indistinguishability of Game σ

3 (κ) and Game σ 4 (κ)). Let Pke be an IND$-CCA secure public-key encryption scheme. Let Sig be an sEUF-CMA secure signature scheme. For all PPT guessing algorithms A, the distinguishing advantage for Game σ 3 (κ) and Game σ 4 (κ) is bounded by:

Proof. Let D be a distinguisher between Game σ 3 (κ) and Game σ 4 (κ) with non-negligible advantage α. From D we can construct an adversary A on the sEUF-CMA security of the used signature scheme Sig. In order to differentiate D has to input a transcript π that in Game σ 4 (κ) returns a uniformly random bit, but that in Game σ 3 (κ) returns some bit σ with probability 1/2 + α * with nonnegligible bias α * . Yet the only difference in those two games is the case where the first sending parties message is the same as in the challenge transcript and the receiver message differs from the challenge transcript. Thus, in order to differentiate D has to insert a transcript π with the property that π[x

. Due to the overwhelming correctness of Pke this fixes both the bit σ C and the signature µ. The signature, however, is on (σ C , x (0) R ). Thus, this fixes the first receiver message. Assuming that D also uses the same second-round message for the sender, that is, if π[x

0 ], then the check in line 23 fails as well as the one in line 26, causing the circuit to return a uniformly random bit. The only way to cause a differentiating behavior is thus to forge a second-round message of the sender as well. This would be a valid forgery of a signature on a message not queried before and thus would violate the sEUF-CMA security. More formally, A works as follows:

Creation of the Transcript. The creation of the transcript is the same in both games. Thus the adversary samples a uniformly random bit σ C and completely simulates the encryption scheme Pke. It replaces the signature creations of P 0 with queries to the signature oracle provided by the sEUF-CMA challenger. A reports the transcript π C to the distinguisher D.

Simulation of the Oracle. To provide an output the adversary A uniformly randomly selects whether to return the bit according to the code from Game σ 3 (κ) or Game σ 4 (κ). It then follows the respective code, which is trivially possible as A gets the verification key from the sEUF-CMA challenger. Additionally, on each input π, the adversary checks if the following conditions hold: (1)π[x

There are two possibilities. Either none of the queries made by D fulfills all four conditions, then-as mentioned before-the behavior of the circuit is exactly the same in both games and hence α = 0. Or at least one of the queries made by D fulfills all four conditions-which by assuming α / ∈ negl(κ) has to be the case. Then the signature µ stored in x

(1) 0 is a valid forgery to a message that was not previously queried by the adversary, hence µ can be used to break the sEUF-CMA security of the signature scheme Sig with non-negligible probability. Since we assumed this not to be the case due to the sEUF-CMA security of Sig, it follows that D has at most a negligible advantage which proves our claim.

⊓ ⊔ Game σ 5 (κ) This game follows Game σ 4 (κ), but during simulation of the oracle P AT from Fig. 10, if the input shares the same first-round message of the sender and receiver but has a different first-round message of the dummy-friend, the program outputs the correct bit σ C with probability 1/2 + d and the wrong bit with the complementary probability.

Lemma 24 (Indistinguishability of Game σ 4 (κ) and Game σ 5 (κ)). Let Pke be an IND$-CCA secure public-key encryption scheme. Let Sig be an sEUF-CMA secure signature scheme. For all PPT guessing algorithms A, the distinguishing advantage for Game σ 4 (κ) and Game σ 5 (κ) is bounded by:

Again, the protocol messages are equivalent, we only take a shortcut in the simulation of the oracle. The case we're in implies that the first sending parties message to be equivalent to the challenge transcript, but the first dummy friend message is different. In this case, the game essentially claims that the only path that is taken is the one where the verification of the signature in the second sending parties message fails, and the first sending parties message is valid, thus returning the output with probability 1/2 + d. Again, a distinguisher D would have to cause some sort of different behavior; that is, creating some input transcript π that shares the first sending parties message with π C , has a different dummy friend first message than π C , and arbitrary second-round messages. While the second dummy friend message is independent of the bit σ, as it was chosen randomly, the second sending parties message will be considered invalid by the circuit, since the signature is on a different dummy friend parties message. As such, in order to obtain a different output probability, subject to the fact that the first sending parties message remains the same and the first dummy friends message is changed, the distinguisher D would either have to create a valid second-round message that contains a signature on the first round (which is equally hard for any party) or forge a valid first-round dummy-friend message that is considered a valid sending parties input. However, assuming again Non-Malleability of Pke and sEUF-CMA of Sig, we can show that no adversary can cause an altering behavior in Game σ 4 (κ), that is, providing an input with the same first sending-party message and a different dummy-friend message that causes a different output distribution than the one that is biased with 1/2 + d towards σ.

⊓ ⊔ Game σ 6 (κ) This game follows Game σ 5 (κ), but during simulation of the oracle P AT from Fig. 10, if the input shares the same first-round messages in the transcript, but a different second-round message than the sending party, the program outputs the correct bit σ C with probability 1/2 + d and the wrong bit with the complementary probability.

Lemma 25 (Indistinguishability of Game σ 5 (κ) and Game σ 6 (κ)). Let Pke be an IND$-CCA secure public-key encryption scheme. Let Sig be an sEUF-CMA secure signature scheme. For all PPT guessing algorithms A, the distinguishing advantage for Game σ 5 (κ) and Game σ 6 (κ) is bounded by:

This proof again just takes a shortcut in the simulation of the protocol. More precisely, we immediately capture the case where the second sending parties message is wrong. Let π be a transcript that helps the distinguisher D in distinguishing these two games. We know from the two previous games that π differs from π C in at least one second-round message, but the first-round messages are equivalent to the challenge transcript. If the second dummy-friend message, x

(1) 1 , differs, then the two games are actually equivalent, leaking absolutely no distinguishing information. Hence, in order to distinguish, D has to query the oracle with some input π where π[x

In the general program flow of Game σ 5 (κ), the probability is that one hard-coded in Game σ 6 (κ) unless either the first if in line 20 results in true, or the elseif in line 23 is false. Line 23 is fixed, however, since the randomness in both games is taken from the same source, which we know to be equivalent to the challenge transcript. Against line 20, we can create an efficient reduction algorithm breaking the sEUF-CMA-property of Sig, since this message has to contain a valid signature on the first round transcript.

⊓ ⊔ Game σ 7 (κ) This game follows Game σ 6 (κ), but during simulation of the oracle P AT from Fig. 10, if the input is equivalent to the challenge transcript except for the second dummy-friend message, output the correct bit with probability 1

Lemma 26 (Indistinguishability of Game σ 6 (κ) and Game σ 7 (κ)). Let Pke be an IND$-CCA secure public-key encryption scheme. Let Sig be an sEUF-CMA secure signature scheme. For all PPT guessing algorithms A, the distinguishing advantage for Game σ 6 (κ) and Game σ 7 (κ) is bounded by:

In both games, the only distinguishing behavior can be induced by messages which differ from the challenge transcript π C exactly in the final dummy-friend message. However, this message information-theoretically contains no information regarding the transferred bit. Replacing randomness with randomness changes nothing, so the only way a distinguisher can detect the change is by inserting a new message for the dummy friend, which contains a valid signature on the first round. Similar to Game σ 6 (κ), the games can be sufficiently well simulated to allow a reduction to the sEUF-CMA property of Sig.

⊓ ⊔ Game σ 8 (κ) This game follows Game σ 7 (κ), but reports uniformly random messages for all parties in the challenge transcript.

Lemma 27 (Indistinguishability of Game σ 7 (κ) and Game σ 8 (κ)). Let Pke be an IND$-CCA secure public-key encryption scheme. Let Sig be an sEUF-CMA secure signature scheme. For all PPT guessing algorithms A, the distinguishing advantage for Game σ 7 (κ) and Game σ 8 (κ) is bounded by:

Let D be a distinguisher between Game σ 7 (κ) and Game σ 8 (κ) with success probability 1/2 + α. Out of D, we construct an efficient adversary A on the IND$-CPA property of Pke: Let C be the IND$-CPA challenger. We once more adapt the Left-Right (LR) view, where the challenger initially sets up an oracle and decides in the preparation phase, if on input x the oracle should always return Pke.Enc(sk, x), or if it always returns a uniformly random string of the same size. The adversary A wins, iff it can guess which oracle was used. After obtaining oracle access from C, A samples a random OTP and sends OTP to the oracle. The result is used as receiver message. Now A creates a signature-pair (k, vk) ← Sig.KeyGen(1 κ ) and draws a random bit σ $ ← {0, 1}. Then, A computes a signature µ from σ using k and Lemma 29 (Indistinguishability of Game σ 9 (κ) and Game σ 10 (κ)). Let Pke be an IND$-CCA secure public-key encryption scheme. Let Sig be an sEUF-CMA secure signature scheme. For all PPT guessing algorithms A, the distinguishing advantage for Game σ 9 (κ) and Game σ 10 (κ) is bounded by:

Game σ 11 (κ) This game follows Game σ 10 (κ), but simulates the oracle in such a way, that the explicit check regarding equality of the second dummy friends message between the challenge transcript and the actual input is dropped.

Lemma 30 (Indistinguishability of Game σ 10 (κ) and Game σ 11 (κ)). Let Pke be an IND$-CCA secure public-key encryption scheme. Let Sig be an sEUF-CMA secure signature scheme. For all PPT guessing algorithms A, the distinguishing advantage for Game σ 10 (κ) and Game σ 11 (κ) is bounded by:

Game σ 12 (κ) This game follows Game σ 11 (κ), but simulates the oracle in such a way, that the explicit check regarding equality of the second senders message between the challenge transcript and the actual input is dropped.

Lemma 31 (Indistinguishability of Game σ 11 (κ) and Game σ 12 (κ)). Let Pke be an IND$-CCA secure public-key encryption scheme. Let Sig be an sEUF-CMA secure signature scheme. For all PPT guessing algorithms A, the distinguishing advantage for Game σ 11 (κ) and Game σ 12 (κ) is bounded by:

Game σ 13 (κ) This game follows Game σ 12 (κ), but simulates the oracle in such a way, that the explicit check regarding equality of the first dummy friends message between the challenge transcript and the actual input is dropped.

Lemma 32 (Indistinguishability of Game σ 12 (κ) and Game σ 13 (κ)). Let Pke be an IND$-CCA secure public-key encryption scheme. Let Sig be an sEUF-CMA secure signature scheme. For all PPT guessing algorithms A, the distinguishing advantage for Game σ 12 (κ) and Game σ 13 (κ) is bounded by:

⊓ ⊔ Game σ 14 (κ) This game follows Game σ 13 (κ), but simulates the oracle in such a way, that the explicit check regarding equality of the receivers message between the challenge transcript and the actual input is dropped.

Lemma 33 (Indistinguishability of Game σ 13 (κ) and Game σ 14 (κ)). Let Pke be an IND$-CCA secure public-key encryption scheme. Let Sig be an sEUF-CMA secure signature scheme. For all PPT guessing algorithms A, the distinguishing advantage for Game σ 13 (κ) and Game σ 14 (κ) is bounded by:

Game σ 15 (κ) This game follows Game σ 14 (κ), but simulates the oracle in such a way, that the explicit check regarding equality of the first sending parties message between the challenge transcript and the actual input is dropped.

We thus can go from a valid transcript for P 0 as sending party to a valid transcript for P 1 as sending party using only gamehops with negligible distinguishing advantage and one gamehop (Game σ 9 (κ)) with advantage d. Thus, no algorithm for deanonymizing the sending party can have advantage significantly better than d.

Corollary 10 (Anonymity). Let Π 1

AT be instantiated as described in Fig. 9. No guessing algorithm A can extract the identity b of the sending party P b better than with probability 1/2 + d.

We can now investigate the actual privacy of our algorithm.

Lemma 36 (δ-Anonymity). The protocol from Fig. 9 is δ-anonymous with δ = (1 -2d).

Proof. The formula for δ-anonymity is given in Eq. (4) as

We have seen in Corollary 10 that the probability of winning Exp Π 1 AT ,A,b is bounded by 1/2 + d, which yields

This can be reformulated into δ ≤ 1 -2d. Since δ is the maximum number that that fulfills this equation, we obtain our claim that δ = 1 -2d.

⊓ ⊔

Secrecy. Now we analyze the chances of an algorithm A being able to output the correct bit without knowing the receivers random tape. Those chances are low due to the One-Time-Pad-our proof basically proves that (1) without the One-Time-Pad the output can not be reconstructed better than by randomly guessing a bit, and (2) without the secret key sk P hidden by the P AT the One-Time-Pad can not be reconstructed. Thus secrecy follows from the statistical security of One-Time-Pads and the IND$-CCA-security of Pke.

We now show indistinguishable of the transferred bit to any guessing algorithm A that does not use the receiver's random tape. To that end, we have to show indistinguishability of the following two distributions against any adversary that does not know the receiver's random tape:

We thus provide a proof reminiscent of that for anonymity but we deviate on different spots.

Essentially the game hops are the same until Game σ 8 (κ) which is distinguishable from Game σ 1 (κ) with only negligible advantage as shown in the anonymity proof. Our major difference is that we start with a sender who always transfers σ = 0, and in the situation resembling Game σ 8 (κ) we swap the message to be σ = 1. We claim that this can not be distinguished and hence show overwhelming secrecy ς ∈ (1 -negl(κ)). (1/2) (0, 1) 30 :

1 : R :

0 ← Pke.Enc(pk P , 0∥µ) 13 : P1 :

return CointossS (1/2) (0, 1) 30 :

1 : R :

return CointossS (1/2) (0, 1) 30 :

1 : R :

return CointossS (1/2) (0, 1) 30 :

1 : R :

return CointossS (1/2) (0, 1) 30 :

1 : R : (1/2) (0, 1) 30 :

1 : R :

0 ← Pke.Enc(pk P , 1∥µ) 13 : P1 :

Game σ 1 (κ) This is the original game, in which party P 0 is the sender who transmits σ = 0. Game σ 2 (κ) This game follows Game σ 1 (κ), but with the following changes: During the simulation of the oracle P AT from Fig. 10 the simulation enforces correctness of the challenge transcript π C by initially checking if the input matches the challenge transcript and in that case, returning the output of a biased coin that returns OTP ⊕ σ C with probability (1 -(1 -2d) 2 /2) and OTP ⊕ σ C with the complementary probability ((1 -2d) 2 /2). The randomness is taken over the entire transcript. During simulation of the oracle P AT from Fig. 10: if the input has a different first-round message of the sender or of the receiver, the simulated program outputs a uniformly random bit. The randomness is taken over all three zero-round messages, that is, over

R . -if the input shares the same first-round message of the sender but has a different first-round message of the receiver, the program outputs a uniformly random bit where the randomness is taken over all three first-round messages. -if the input shares the same first-round message of the sender and receiver but has a different first-round message of the dummy-friend, the program outputs the correct bit σ C with probability 1/2 + d and the wrong bit with the complementary probability. -if the input shares the same first-round messages in the transcript, but a different secondround message than the sending party, the program outputs the correct bit σ C with probability 1/2 + d and the wrong bit with the complementary probability. -if the input is equivalent to the challenge transcript except for the second dummy-friend message, output the correct bit with probability 1 -(1 -2d) 2 /2. Additionally, it reports uniformly random messages for the challenge transcript.

Lemma 37. Let Pke be an IND$-CCA secure public-key encryption scheme. Let Sig be an sEUF-CMA secure signature scheme. For all PPT guessing algorithms A, the distinguishing advantage for Game σ 1 (κ) and Game σ 2 (κ) is bounded by:

Game σ 3 (κ) This game follows Game σ 2 (κ), but changes the simulation of the circuit. Instead of using σ C = 0 for answering queries, this game uses σ C := 1.

Lemma 38. Let Pke be an IND$-CCA secure public-key encryption scheme. Let Sig be an sEUF-CMA secure signature scheme. For all PPT guessing algorithms A, the distinguishing advantage for Game σ 2 (κ) and Game σ 3 (κ) is bounded by:

Indistinguishability of these two games easily follows from the statistical security of One-Time-Pad encryption. Due to the messages being random the one-time-pad used to mask the bit is never shown directly to the distinguisher, and without the random tape it cannot be guessed. Hence in both games the distinguisher only ever gets a random bit. Indistinguishability follows.

⊓ ⊔

Game σ 4 (κ) This game is as Game σ 3 (κ) but undoes all the changes performed in Game σ 2 (κ).

Lemma 39. Let Pke be an IND$-CCA secure public-key encryption scheme. Let Sig be an sEUF-CMA secure signature scheme. For all PPT guessing algorithms A, the distinguishing advantage for Game σ 3 (κ) and Game σ 4 (κ) is bounded by:

Corollary 11 (Secrecy). Let Π 1 AT be instantiated as described in Fig. 9. No guessing algorithm A that works without knowledge of the receivers random tape T R can extract the transferred bit using only the transcript and oracle-access to P AT .

Protocol Π 1 AT (c) in the designated sender setting for c > 2 rounds.

We assume three parties are present in this protocol, two of which are participating. Let P0 and P1 be the potential sender, one of which is not participating, and let R denote the receiver. Let Pke = (KeyGen, Enc, Dec) be an asymmetric IND$-CCA-secure encryption scheme with Pseudorandom Ciphertexts. Let Sig be an sEUF-CMA-secure signature scheme. Let P AT be an obfuscated program from Fig. 10, which hides a verification key vk and a secret key skP , the corresponding public key pk P is leaked. The protocol Π 1 AT (c) works as follows:

On input (⊥), R does nothing. On input π (c-1) from Π 1 AT (c-1) , P b computes µ ← Sig.Sig(k, π (c-1) ) and sets x

Fig. 12:

The designated sender protocol for Anonymous Transfer. We generally assume that once all messages of one round have been determined, parties publish them.

Corollary 12 (ς-Secrecy). Π 1

AT from Fig. 9 is ς-secret with ς ∈ (1 -negl(κ)).

Proof. For ℓ = 1 the formula from Eq. ( 20) is given as:

where the former probability was shown to be ≤ 1/2 + negl(κ). Thus the equation becomes

E.2 A c-rounds protocol.

We now provide a recursive definition on how to extend the two-rounds protocol from Fig. 9 to a general c-rounds protocol.

and that the former probability has been shown to be limited by 1+2d-(1-2d) c

2

. Hence, we get that

This implies that δ ≤ 1 -|2d -(1 -2d) c |, which proves our claim.

⊓ ⊔

We now focus on the secrecy of the protocol. Note that the output is still encrypted by a OTP and hence the additional rounds do not change the fact that the actually transferred bit can not be extracted by any party other than the receiver.

We thus get Lemma 45. The protocol from Fig. 12 is ς-secret with ς ∈ (1 -negl(κ)).

Thus, by combining Lemmas 40, 44 and 45, we obtain:

Corollary 14 (Security of the c-round protocol). Π 1

E.3 On the security

For a practical instantiation, we assume that the parameter d is chosen subject to a given correctness guarantee and then chosen according to the formula from Lemma 40. For example, for a 10-round AT which is correct with 90% probability, we have to solve 1 -(1 -2d) 10 /2 = 0.9, resulting in d ≈ 0.07433. This would then yield a (0.9, 0.94)-AT, where the adversary is able to determine the sending party with a probability of 0.47433. In Fig. 15, we show the trade-of between correctness and anonymity for a correctness of 0.9999, 0.9, 0.75 and 0.6, respectively.

F A fine-grained Anonymous Transfer for ℓ-bit messages

Instead of using the limited composability guarantees established in Lemma 5 to extend our finegrained AT from transferring a single bit towards transforming an ℓ-bit string we perform some slight modifications of the protocol introduced in Section 5 to see how it can handle the transfer of ℓ-bit messages directly.

Fine-grained Protocol Π ℓ

AT for ℓ-bit messages Σ ∈ {0, 1} ℓ .

We assume three parties are present in this protocol, two of which are participating. Let P0 and P1 be the potential sender, one of which is not participating, and let R denote the receiver. Let Pke = (KeyGen, Enc, Dec) be a IND$-CCA-secure public-key encryption scheme. Let Ske = (KeyGen, Enc, Dec) be a multi-challenge IND$-CPA-secure symmetric encryption scheme. Let Sig : {0, 1} * × {0, 1} κ → {0, 1} m be a EUF-CMA-secure signature scheme. Let P AT be an obfuscated program from Fig. 17 For each round χ from 1 to c :

, µ and output OTP ⊕ Σ ′ .

, χ b = (c + 1)} do : / / Take on the role of each potential sender. The protocol is given in Fig. 16, the corresponding obfuscated program in Fig. 17. The protocol in Fig. 16 is essentially the same as the one in Fig. 5 for single-bit AT, where the bit σ ∈ {0, 1} was replaced by a message Σ ∈ {0, 1} ℓ and the circuit is now the one from Fig. 17 instead of the one from Fig. 6. The same is true for the circuit Fig. 17, which is the one from Fig. 6 but with a message Σ instead of a bit σ but one additional thing had to be changed: Instead of returning the actual bit σ with probability proportional to the amount of correct rounds of the sender P b and the complementary bit with the remaining probability the new circuit from Fig. 17 separates between returning either the message Σ b or a dedicated error state ⊥. The actual message Σ b is implicitly defined by the respective first-round messages. Accordingly, the probability does not start at 50% between 0 and 1 but starts at returning ⊥ with probability 100% and each new round moves this towards returning Σ b with probability 100%.

We start by analyzing the correctness of the new protocol.

Lemma 46 (Correctness). If the protocol from Fig. 16 is instantiated with an Ideally Obfuscated version of the circuit from Fig. 17 the protocol is ε-correct with ε = (1 -negl(κ)).

Proof. Again, in an honest execution the value of χ b = c and hence the correct message is returned with probability 1, the argumentation here is similar to that of Theorem 4. We only have to assume that there is a dedicated failure-state ⊥ differs from any message a party would ever send.

⊓ ⊔

Once again, the anonymity takes a lot more effort to analyze. However, the proof is still relatively close to that of single-bit AT leading to the anonymity in Corollary 7. Pb :

14 : µ (χ) ← Sig.Sig(kb, (x

))

15 : x Pb :

14 : µ (χ) ← Sig.Sig(kb, (x

))

15 : x Pb :

14 : µ (χ) ← Sig.Sig(kb, (x

))

15 : x Pb :

14 : µ (χ) ← Sig.Sig(kb, (x

))

15 : x Pb :

))

15 : x

1 : R : Pb :

))

15 : x

1 : R : Pb :

))

15 : x Game 5 (κ)

(OTP, vkR) := (OTPC, vkC R )

15 : (sk0, vk0) := Pke.Dec(skP , x

1 : R : Pb :

))

15 : x Game 5 (κ)

(OTP, vkR) := (OTPC, vkC R )

15 : (sk0, vk0) := Pke.Dec(skP , x

1 : R : Pb :

))

15 : x Game 6 (κ)

(OTP, vkR) := (OTPC, vkC R )

15 : (sk0, vk0) := Pke.Dec(skP , x

1 : R :

12 : foreach χ ∈ {1, . . . , c} do 13 :

Pb :

))

15 : x Game 6 (κ)

(OTP, vkR) := (OTPC, vkC R )

15 : (sk0, vk0) := Pke.Dec(skP , x

1 : R :

12 : foreach χ ∈ {1, . . . , c} do 13 :

Pb :

))

15 : x Game 7 (κ)

(OTP, vkR) := (OTPC, vkC R )

15 : (sk0, vk0) := Pke.Dec(skP , x

1 : R : Game 7 (κ)

(OTP, vkR) := (OTPC, vkC R )

15 : (sk0, vk0) := Pke.Dec(skP , x

1 : R : Game 8 (κ)

(OTP, vkR) := (OTPC, vkC R )

15 : (sk0, vk0) := Pke.Dec(skP , x

1 : R : Game σ 1 (κ) This is the original game (after replacing the obfuscated circuit with oracle access to the circuit, the PRF with an actual random oracle and the adversary with the simulator), where the sending party P b is chosen uniformly at random. Game σ 2 (κ) This game follows Game σ 1 (κ), but during the simulation of the oracle P AT from Fig. 16 the simulation enforces correctness of the challenge transcript π C : if the input transcript π matches the challenge transcript π C , it returns Σ C .

Lemma 47 (Indistinguishability of Game σ 1 (κ) and Game σ 2 (κ)). Let Pke be an IND$-CCA secure asymmetric encryption scheme. Let Ske be an IND$-CCA secure symmetric encryption scheme. Let Sig be an sEUF-CMA secure signature scheme. For all PPT guessing algorithms A, the distinguishing advantage for Game σ 1 (κ) and Game σ 2 (κ) is bounded by:

This game follows Game σ 2 (κ) but during simulation of the circuit the adversary aborts if any of the first-round messages differ from the messages reported in the challenge transcript and the decryptions still match.

Lemma 48 (Indistinguishability of Game σ 2 (κ) and Game σ 3 (κ)). Let Pke be an IND$-CCA secure asymmetric encryption scheme. Let Ske be an IND$-CCA secure symmetric encryption scheme. Let Sig be an sEUF-CMA secure signature scheme. For all PPT guessing algorithms A, the distinguishing advantage for Game σ 2 (κ) and Game σ 3 (κ) is bounded by:

Proof. The claim is similar to that from Lemma 10 and thus follows from their proof. ⊓ ⊔ Game σ 4 (κ) This game follows Game σ 3 (κ) but simulates the circuit slightly different: If the first receiver message of the input transcript π is the same as that of the challenge transcript π C , instead of decrypting it the circuit directly sets OTP = OTP C and vk R = vk C R as the values used in the creation of the challenge transcript.

Lemma 49 (Indistinguishability of Game σ 3 (κ) and Game σ 4 (κ)). Let Pke be an IND$-CCA secure asymmetric encryption scheme. Let Ske be an IND$-CCA secure symmetric encryption scheme. Let Sig be an sEUF-CMA secure signature scheme. For all PPT guessing algorithms A, the distinguishing advantage for Game σ 3 (κ) and Game σ 4 (κ) is bounded by:

Proof. This proof also follows from the correctness of the encryption scheme Pke just as Lemma 11. ⊓ ⊔ Game σ 5 (κ) This game follows Game σ 4 (κ) but simulates the oracle differently if the first-round messages of both parties match the first-round messages in the challenge transcript π C . In this case, the program compares the input transcript π with the challenge transcript π C until it finds the first round χ * in which the input differs from the challenge transcript. It then checks round χ * + 1, and if it contains the same message from the sending party, it adds one to χ. Finally, the circuit flips a biased coin, which returns the correct message Σ C with probability p := 1/2 + χ * /2c and an error symbol ⊥ otherwise.

Lemma 50 (Indistinguishability of Game σ 4 (κ) and Game σ 5 (κ)). Let Pke be an IND$-CCA secure asymmetric encryption scheme. Let Ske be an IND$-CCA secure symmetric encryption scheme. Let Sig be an sEUF-CMA secure signature scheme. For all PPT guessing algorithms A, the distinguishing advantage for Game σ 4 (κ) and Game σ 5 (κ) is bounded by:

Proof. Note that the unforgeability of a valid round-zero message required for detecting the new branch is similar to Lemma 12. Thus we can focus entirely on the second claim, namely that the behavior inside the branch reflects that of the actual circuit.

In fact, we have to show that at line 31 in Game σ 2 (κ) if the maximum round is χ b then the input transcript is equal to the challenge transcript until at least round (χ b -1). Let D be a PPT distinguisher who can create input π for which it holds that χ * is such that any of the messages from round (χ * -2) differ from the challenge transcript. Then the only way that the verification in round (χ * -1) succeeds is if the sending parties message encodes a valid signature on the changed message from round (χ * -2), which would violate the EUF-CMA security of the used signature scheme Sig. Thus the claim follows.

⊓ ⊔ Game σ 6 (κ) This game is the same as Game σ 5 (κ), but in creating the challenge transcript π C , this game only reports randomness for the first-round message x 0 b that specifies the symmetric key sk b to be used for the remaining communication with the circuit. Note that both the signature-and the symmetric-key are still created for the sending party P b as they are needed for the remaining rounds.

Lemma 51 (Indistinguishability of Game σ 5 (κ) and Game σ 6 (κ)). Let Pke be an IND$-CCA secure asymmetric encryption scheme. Let Ske be an IND$-CCA secure symmetric encryption scheme. Let Sig be an sEUF-CMA secure signature scheme. For all PPT guessing algorithms A, the distinguishing advantage for Game σ 5 (κ) and Game σ 6 (κ) is bounded by:

This game is the same as Game σ 6 (κ) but in creating the challenge transcript π C , this game also reports randomness instead of transcripts for all messages x χ b for χ ∈ [c] that shift the message towards Σ C . That means that instead of using the IND$-CPA secure symmetric scheme Ske with the symmetric key sk b the challenge transcript now only contains randomly sampled messages. We also do not let the adversary create the keys for Sig and Ske as they are no longer needed for creating the transcript.

Lemma 52 (Indistinguishability of Game σ 6 (κ) and Game σ 7 (κ)). Let Pke be an IND$-CCA secure asymmetric encryption scheme. Let Ske be an IND$-CCA secure symmetric encryption scheme. Let Sig be an sEUF-CMA secure signature scheme. For all PPT guessing algorithms A, the distinguishing advantage for Game σ 6 (κ) and Game σ 7 (κ) is bounded by:

Game σ 8 (κ) This game follows Game σ 7 (κ), but instead of choosing a random sender at the beginning of the game and considering this message to be the right one, the oracle ignores the additional check and only looks for the first round where both messages are identical to the challenge. Note that this game is entirely independent of the real sender, hence given a challenge transcript it is trivially impossible to obtain a non-negligible advantage to determine the sending party.

Claim (Indistinguishability of Game σ 7 (κ) and Game σ 8 (κ)). Let D be a distinguisher with runtime o(c 2 /α). Let the cost of acquiring a single sample be O(c). Then the distinguishing advantage is limited by

The actual proof is similar to the single-bit case, only that we do not differentiate a Bernoulli oracle that returns a single bit but one that returns either a ℓ-bit message or an error state. However, we slightly adapt the game from Fig. 7 to our new scenario; basically instead of ranging from 0.5 to 1 the oracles now range from 0 to 1 in equally-sized steps:

non-negligible advantage α over guessing then A inherits this advantage for winning the game from Fig. 18, albeit if D sends t queries to A, less than t queries are forwarded to C. ⊓ ⊔

We now have a new game in Fig. 18 which we used for a more intuitive proof, however we still need to analyze how hard winning Fig. 18 really is. Fortunately, the game is already quite close to Fig. 7 only with a larger range. We thus borrow ideas from the proof of the single-bit case and adapt them to our new scenario. Note that Lemma 3 can also be applied, and that Corollary 1 also holds for Fig. 18. We can thus skip towards adjusting Corollary 6, for which we first need to embed Corollary 1 into our problem setting: We have c instances where the χ-th instance corresponds to distinguishing p := (χ -1)/c from q := (χ)/c. This implies the following L 1 -norm between p and q in round χ:

This implies again that the total variational distance in round χ is independent of the round χ and hence the same for all oracles. So when combining this observation with the subadditivity of the total variational distance (Lemma 2) we get that any distribution resulting from t samples have a total variational distance of at most t c . Thus we get:

We thus end up with the following corollary.

Corollary 15. Let D be a distinguisher playing the game from Fig. 18 Secrecy. We conclude this section with a secrecy analysis of the protocol. Fortunately, this proof is quite close to that from the single-bit protocol from Theorem 6. The main difference is that we have to change an entire message instead of only changing the single bit. However, the crucial part is still the statistical security of the One-Time-Pad, which holds also in the multi-bit case. To prove our claim we thus show that the transfer of a uniformly random message cannot be distinguished efficiently from the transfer of the all-zero bitstring without the receiver's random tape.

In total we want to show that:

With that in mind we adjust the gamehops as follows:

Game 1 (κ)

R ) 15 : (sk0, vk0) := Pke.Dec(skP , x

1 : R :

12 : foreach χ ∈ {1, . . . , c} do 13 :

Pb :

))

15 : x Game 2 (κ)

(OTP, vkR) := (OTPC, vkC R )

15 : (sk0, vk0) := Pke.Dec(skP , x

1 : R : Game 2 (κ) ))

15 : x Game σ 1 (κ) This is the original game (after replacing the obfuscated circuit with oracle access to the circuit, the PRF with an actual random oracle and the adversary with the simulator), where the sending party P b is chosen uniformly at random and the sender uses the input message Σ. Game σ 2 (κ) This game follows Game σ 1 (κ), but with the following changes: -During the simulation of the oracle P AT from Fig. 16

Follows from Lemmas 47 to 52.

⊓ ⊔ Game σ 3 (κ) This game follows Game σ 2 (κ) but the oracle is simulated slightly different: If the first receiver message is the same as the one reported in the challenge transcript and the input transcript is not the challenge transcript, then the circuit outputs an error symbol ⊥. Note that this does not work in the anonymity proof as there we assume that the adversary is given access to the receivers random tape, and hence can create their own new signature on the modified transcript.

Lemma 55. Let Pke be an IND$-CCA secure public-key encryption scheme. Let Ske be an IND$-CCA secure secret-key encryption scheme. Let Sig be an sEUF-CMA secure signature scheme. For all PPT guessing algorithms A, the distinguishing advantage for Game σ 3 (κ) and Game σ 4 (κ) is bounded by:

We reduce a distinguisher D between these two games to an adversary A on the EUF-CMA security of the signature scheme Sig.

Creating the ranscript. The creation of the transcript is straightforward and works by sampling random messages for each party.

Simulating the Oracle. The used verification key vk R is set to be the verification key of the challenger. Thus the final signature µ on the entire transcript, which is required for the circuit to not abort (by outputting a random bit), needs to be forged. Hence for each input transcript the adversary first checks if the receiver message is equivalent to that from the challenge transcript. If it isn't then the transcript can not be used for distinguishing anyways. If it is, the adversary checks if the remaining transcript is the same as well. If it is, the transcript can not be used for distinguishing and simulation just continues as the path taken is equivalent in both games. If it isn't then the adversary checks if the signature µ verifies under the used key. If it doesn't then both games act exactly the same and output an error state ⊥. Hence to distinguish the signature has to verify. Then, however, the signature is a valid forgery.

Translating the Result. If no valid signature was queried then-as mentioned above-the distinguishing advantage must be negligible. For a non-negligible advantage the distinguisher has to query at least one signature. This can be used as forgery to break the EUF-CMA security of Sig. As stated above, the advantage of the distinguisher is directly related to the probability of successfully distinguishing. Hence A will have a valid forgery with non-negligible advantage. This would contradict the EUF-CMA security of the signature scheme and thus completes our proof.

⊓ ⊔ Game σ 4 (κ) This game is as Game σ 3 (κ) but instead of using a uniformly random Σ for the transferred message during simulation of the circuit we now fix Σ = ⃗ 0 ℓ as the all-zero bitstring of appropriate size.

Lemma 56. Let Pke be an IND$-CCA secure public-key encryption scheme. Let Ske be an IND$-CCA secure secret-key encryption scheme. Let Sig be an sEUF-CMA secure signature scheme. For all PPT guessing algorithms A, the distinguishing advantage for Game σ 3 (κ) and Game σ 4 (κ) is bounded by:

Again indistinguishability follows for any adversary who does not have the receivers random tape. The message is only ever used in its encrypted form via the uniformly random One-Time-Pad, and distinguishing two bitstrings after they have been masked is statistically impossible to do with non-negligible advantage. Thus indistinguishability follows.

⊓ ⊔ Game σ 5 (κ) This game follows Game σ 4 (κ) but undoes all the changes from the first-to-second gamehop and that from Game σ 3 (κ).

Lemma 57. Let Pke be an IND$-CCA secure public-key encryption scheme. Let Ske be an IND$-CCA secure secret-key encryption scheme. Let Sig be an sEUF-CMA secure signature scheme. For all PPT guessing algorithms A, the distinguishing advantage for Game σ 4 (κ) and Game σ 5 (κ) is bounded by:

Follows from Lemmas 47 to 52 and 55.

⊓ ⊔

Thus OTP is hidden to any guessing algorithm and so is Σ.

Corollary 16. The Anonymous Transfer from Fig. 16 is ς-secret with ς ∈ owhl(κ).

In total, we thus have:

G Undetectable Oblivious Transfer from Anonymous Transfer and two-round Covert Oblivious Transfer

In this section we present an instantiation of Undetectable Oblivious In Fig. 19 we present a generic transformation that takes any two-round Covert Oblivious Transfer protocol and a strong (ε, δ, ς, c, ℓ)-Anonymous Transfer and constructs a (ε, δ)-Undetectable Oblivious Transfer. For the sake of simplicity we only introduce a generic three-party protocol (that has one dummy friend), but we stress that the same technique can easily be modified to incorporate more parties at the cost of using 2 more ATs with the respective dummy friend as the receiver.

G.1 Correctness

For analyzing the correctness we assume that the Covert Oblivious Transfer protocol reconstructs the bit correctly with overwhelming probability. Then it holds for the correctness of the Undetectable Oblivious Transfer:

Lemma 58 (Correctness of the Undetectable Oblivious Transfer protocol). Let Π COT be correct with overwhelming probability. Let Π ℓ AT be a strong (ε, δ, ς, c, ℓ)-AT. Then the Undetectable Oblivious Transfer protocol from Fig. 19

Proof. We assume that when executed directly, Π COT is correct assuming that all messages are present and wrong if a message was transferred incorrectly. Thus the probability that the message has been transferred correctly corresponds to the probability that both messages have been transferred correctly-the first-round message by the receiver to the sender and the second-round message by the sender to the receiver.

With the AT being ε-correct it follows from Eq. (3) that

and the probability that both messages are transferred correctly squares that value. As such it holds that:

So we have for the correctness of the OT:

Thus we get that according to Eq. ( 21) we have ε U OT := ε 2 +2ε-1 2 .

⊓ ⊔

G.2 Privacy

The analysis of (input-) privacy is pretty straightforward, simply because our transformation leaves no extra insecurities that would allow extraction of either the choice bit σ or the message Σ σ not selected by the receiver. Yet in the following we provide a full proof of privacy.

Sender Privacy

We first define the privacy notion of classical OT protocols in a game-based notion:

Definition 18 (Sender-Privacy in Oblivious Transfer). Let Ot be an oblivious transfer protocol. Ot provides computational sender-privacy if for all PPT adversaries A it holds that:

The definition enforces that the adversary cannot extract both bits input by the sender. While the bit x σ is easy to extract given the transcript, the state of A 0 and the random tape T R , we enforce that the other bit x σ can not be determined better than by guessing.

Definition 19 (Receiver-Privacy in Oblivious Transfer

). Let Ot be an Oblivious Transfer protocol. Ot provides computational receiver-privacy if for all PPT adversaries A it holds that:

This definition is practically the same as that for sender-privacy in Definition 18 but lets the adversary play as the (semi-honest) sender who has to recover the choice bit by the receiver.

With that we can prove the following claim:

Lemma 59 (Privacy of the Undetectable Oblivious Transfer protocol). Let Π COT be an OT protocol with overwhelming sender-privacy. Then Π U OT from Fig. 19 is private for both parties.

Proof. Sender-Privacy Any COT protocol automatically fulfills the privacy requirement of an ordinary OT from Definition 18, as such we reduce sender privacy of Π U OT to the sender privacy of Π COT . To that end, let A be a guessing algorithm that breaks the sender privacy of Π U OT with non-negligible advantage α. From A we construct an adversary A who breaks the condition from Eq. (57) as follows:

A asks A 0 for receiver input σ and hands this to the challenger C of the COT sender privacy. From C, A obtains a transcript π of sent messages. A simulates inserting each sender message of π into Π ℓ AT with receivers P R and P D and each receiver message into F

(2,3)

AT with receivers P S and P D . This results in a transcript of Π U OT which A hands to A. Eventually A returns a tuple (x * 0 , x * 1 ) which A hands directly to the challenger C.

Note that if A is correct, then so is A, and if A is incorrect then the guess of A is also wrong, as the simulation did not change the sent messages.

Thus if A has non-negligible advantage then so has A, which it does not have by requirement.

Receiver Privacy

We let A be a guessing algorithm attacking the receiver privacy of Π U OT and construct an adversary A attacking the receiver privacy of Π COT with the same success probability. The adversary asks A for the senders input (x 0 , x 1 ) ∈ {0, 1} 2 and forwards that to the challenger C. The obtained transcript π is translated into a transcript for Π U OT by simulating the AT with the inputs being the messages reported by the respective parties, where the input by the dummy friend is constantly ⊥.

A then hands the transcript over to A who guesses a bit σ. The bit is then forwarded to C. Again, the transformation did not change any values, hence if A is correct with probability 1/2 + α then A is also correct with probability 1/2 + α. The latter, however, is not possible by requirement from Π COT , which concludes our proof. ⊓ ⊔

G.3 Anonymity

As the adversary is given the choice to corrupt any party we consider each potential party individually and show the two distributions that need to be indistinguishable.

Corrupted Sender

The guessing algorithm has to distinguish the following two distributions:

In this section we prove anonymity against any adversary that corrupts the sender after the execution. This adversary then has to guess which of the remaining parties acted as a receiver and which was the dummy friend.

The two possible transcripts if he sender is fixed are depicted in Fig. 20.

Game 1 (κ)

The single game required for that-which is actually the same as in Fig. 20. The formal description is as follows:

Game σ 1 (κ) is the original game where the sender is P S and the receiver is P R . Game σ 2 (κ) is as Item Game σ 1 (κ) but in providing the transcript the simulator follows Item Game σ 1 (κ) for the first round but inserts x Lemma 60. Let Pke be an IND$-CCA secure public-key encryption scheme. Let Ske be an IND$-CCA secure secret-key encryption scheme. Let Sig be an sEUF-CMA secure signature scheme. For all PPT guessing algorithms A, the distinguishing advantage for Game σ 1 (κ) and Game σ 2 (κ) is bounded by:

Proof. We reduce to the δ-anonymity of F

(2,3)

AT . If there was some distinguisher D who can distinguish Game σ 1 (κ) from Game σ 2 (κ) with advantage 1/2 + α then there is some adversary A (which implies a guessing algorithm A) who can determine the sender with advantage α. The limit δ then provides an upper bound on α.

Creating the Transcript. We denote by C the challenger for the anonymity-game of F (2,3) AT . A determines the message to-be-transferred as Π COT R (σ), that is, the first message sent by a receiver in Π COT who wants to receive x σ . From that C returns a transcript of the F (2,3) AT instance, which A inserts into the transcript provided to the distinguisher D instead of honestly simulating the first F (2,3) AT instance where the sender S of the AT is the receiver, the remainder is simulated as-is.

Translating the Result. Eventually D returns a guess which is either Game σ 1 (κ) or Game σ 2 (κ). In case D assumes to be in Game σ 1 (κ) we assume the party we refer to as P R is the sender, and if D assumes to be in Game σ 2 (κ) we let A refer to P D as the sender in the AT. As can be seen the distributions match perfectly, as the only change is the sender and that one perfectly translates to our problem of de-anonymization.

Game 1 (κ)

The formal description is as follows:

Game σ 1 (κ) is the original game where the sender is P S and the receiver is P R . Game σ 2 (κ) is as Game σ 1 (κ) but in providing the transcript the simulator follows Item Game σ 1 (κ) for the first round but inserts x Lemma 61. Let Pke be an IND$-CCA secure public-key encryption scheme. Let Ske be an IND$-CCA secure secret-key encryption scheme. Let Sig be an sEUF-CMA secure signature scheme. For all PPT guessing algorithms A, the distinguishing advantage for Game σ 1 (κ) and Game σ 2 (κ) is bounded by:

Proof. We reduce to the δ-anonymity of F

(2,3)

AT . If there was some distinguisher D who can distinguish Game σ 1 (κ) from Game σ 2 (κ) with advantage 1/2 + α then there is some adversary A (which implies a guessing algorithm A) who can determine the sender with advantage α. The limit δ then provides an upper bound on α.

Creating the Transcript. We denote by C the challenger for the anonymity-game of F (2,3) AT . A determines the message to-be-transferred as Π COT S (x 0 , x 1 , Σ), that is, the response sent by a sender in Π COT after having received the first message by the receiver. Note that Σ is the result of the first F (2,3) AT instance where R inserts the message, and we take the output of that which only corresponds to the desired message Π COT R (σ) with probability 1/2 + ε/2. However, we stress that this is not important to our proof, as the relevant part is only the insertion of that message as transferred message into the instance of F AT instance where the receiver R of the AT is also the receiver of the OT, the remainder is simulated as-is. Game σ 1 (κ) is the original game where the sender is P S and the receiver is P R . Game σ 2 (κ) is as Game σ 1 (κ) but in providing the transcript the simulator follows Game σ 1 (κ) for the first round but inserts x Proof. We reduce to the δ-anonymity of F

(2,3)

AT . If there was some distinguisher D who can distinguish Game σ 1 (κ) from Game σ 2 (κ) with advantage 1/2 + α then there is some adversary A (which implies a guessing algorithm A) who can determine the sender with advantage α. The limit δ then provides an upper bound on α.

Creating the Transcript. We denote by C the challenger for the anonymity-game of F (2,3) AT . A determines the message to-be-transferred as Π COT R (σ), that is, the first message sent by a receiver in Π COT who wants to receive x σ . From that C returns a transcript of the F (2,3) AT instance, which A inserts into the transcript provided to the distinguisher D instead of honestly simulating the first F

(2,3) AT instance where the sender S of the AT is the dummy friend, the remainder is simulated as-is.

Translating the Result. Eventually D returns a guess which is either Game σ 1 (κ) or Game σ 2 (κ). In case D assumes to be in Game σ 1 (κ) we assume the party we refer to as P R is the sender, and if D assumes to be in Game σ 2 (κ) we let A refer to P S as the sender in the AT. As can be seen the distributions match perfectly, as the only change is the sender and that one perfectly translates to our problem of de-anonymization. Thus it follows that D is correct with probability Proof. We reduce to the δ-anonymity of F

(2,3)

AT . If there was some distinguisher D who can distinguish Game σ 2 (κ) from Game σ 3 (κ) with advantage 1/2 + α then there is some adversary A (which implies a guessing algorithm A) who can determine the sender with advantage α. The limit δ then provides an upper bound on α.

Creating the Transcript. We denote by C the challenger for the anonymity-game of F (2,3) AT . A determines the message to-be-transferred as Π COT S (x 0 , x 1 , Σ), that is, the response sent by a sender in Π COT after having received the first message by the receiver. Note that Σ is the result of the first F (2,3) AT instance where S inserts the message and sends it to R since Game σ 2 (κ) (where the roles for the first round has been changed), and we take the output of that which only corresponds to the desired message Π COT R (σ) with probability 1/2 + ε/2. However, we stress that this is not important to our proof, as the relevant part is only the insertion of that message as transferred message into the instance of F AT instance where the receiver R of the AT is also the receiver of the OT, the remainder is simulated as-is.

Translating the Result. Eventually D returns a guess which is either Game σ 2 (κ) or Game σ 3 (κ). In case D assumes to be in Game σ 2 (κ) we assume the party we refer to as P S is the sender, and if D assumes to be in Game σ 3 (κ) we let A refer to P R as the sender in the AT. As can be seen the distributions match perfectly, as the only change is the sender and that one perfectly translates to our problem of de-anonymization. Thus it follows that D is correct with probability and thus if the adversary corrupts the sender then the protocol provides δ-Anonymity where δ is inherited from F

(2,3)

Given that this is the least efficient strategy it thus follows that the anonymity is bounded by δ for any possible A 0 corrupting any party. Cointoss: A function realizing a (biased) coin toss. We write Cointoss (p) (r) to denote the coin toss that returns tails with probability p and tails with probability (1 -p), where the randomness is taken from a PRF on input r. CointossS: A function realizing a (biased) coin toss. We write CointossS (r) (p) (x, y) to denote the coin toss that returns x with probability p and y with probability (1 -p), where the randomness is taken from a PRF on input r. crs: A common reference string. D: The dummy friend who is not participating in any protocol but is still present for some reason. D: The distinguisher, i.e. a PPT ITM which distinguishes two distributions. D: A distribution. d: Tweaking parameter which acts as a compromise between anonymity and correctness; if d = 0, we have a perfectly correct protocol, but if d = 1, we have a perfectly anonymous protoocl. Dec: A decryption protocol. δ: The measurement of anonymity for an AT or UOT protocol. d TV : The Total Variational Distance, defined over two probability distributions p and q as d TV (p, q) := 1 2 i |p i -q i |. Enc: An encryption protocol. ε: The measurement of correctness for an AT or UOT protocol. Evaluate: The method of an obfuscator O to evaluate a given program given only the handle. Exp: An experiment as part of a game. F: A Pseudorandom Function. F: The functionality in a simulation-based framework. f : The to-be-computed function for deniable secure computation. F

Acronyms

(2,3) AT : Ideal functionality for realizing Anonymous Transfer with three parties, two of which are aware that the protocol is executed. Game: The game in a game-hop based proof. H: The Hellinger Distance, defined over two probability distributions p and q as H(p, q) :=

H: A hybrid, that is, a minor change in a simulation which we claim to be not efficiently noticable. h: The handle an obfuscator returns that enables evaluating the program. heads: The heads-side of a coin toss. k: The signing key of a signature scheme, can be used to sign a given message such that third parties can verify the authenticity. k: The number of players, that is, participants. The Silent Receiver AT protocol, i.e. the AT protocol where the receiver sends no messages. Π U M P C : The Undetectable MPC protocol that allows k parties to hide a computation inside innocent-looking conversations of N individuals. Π U OT : A protocol for realizing Undetectable Oblivious Transfer. pk: The public key of an encryption scheme, can be used to encrypt a message into a cipher text. Pke: A public-key encryption scheme. poly: An arbitrary polynomial. p: Probability R: The receiving party. r: A random / undefined bitstring. Rand: The rerandomization of the last round of an AT. Reconstruct: Reconstruction algorithm for an AT. S: A symmetric group, that is, the group of elements alongside all bijections/permutations onto itself. S: The sending party. S: The simulator in a cryptographic framework. Setup: The setup algorithm that creates a Common Reference String. Sig A signature scheme. Sig: The function to compute the signature of a given message. Σ: The to-be-transferred message of an AT or UOT. σ: The to-be-transferred bit of an AT. ς: The measurement of secrecy for an AT, which is high if the non-receiver is unable to reconstruct the transferred bit better than by guessing. Σ C : The transferred message in the challenge transcript. σ C : The transferred bit in the challenge transcript. sk: The secret key of an encryption scheme, can be used to decrypt a cipher text. Ske: A (symmetric) encryption scheme. st: The (secret) state of a party. Supp: The support of a distribution. x C : A message reported in the challenge transcript. ξ: The slack, that is, the difference between two variables x and y: if x < y, we can write x + ξ = y, allowing for an easier analysis.