IB-TOT: Identity-Based Traceable Oblivious Transfer and Its Applications

Abstract

Oblivious Transfer (OT) is a fundamental cryptographic primitive for privacy-preserving data exchange. While traditional OT protocols guarantee unconditional receiver anonymity, they inherently lack the mechanisms to prevent abusive mass data harvesting. Traceable Oblivious Transfer (TOT) addresses this by introducing “conditional anonymity,” revoking the privacy of malicious users. However, existing TOT mechanisms either rely on computationally expensive dynamic assumptions or require continuous interaction with a Trusted Third Party (TTP) to manage credentials. To overcome these limitations, we present an Identity-Based Traceable Oblivious Transfer (IB-TOT) protocol. By synergizing polynomial-based secret sharing with Blind Identity-Based Encryption (Blind IBE), our scheme completely eliminates the TTP during the data transfer stage. The Blind IBE extraction algorithm serves as the primary oblivious channel, utilizing data indices as user identities. We strictly bound the receiver’s query quota by embedding a degree-k tracing polynomial directly into the key issuance phase. Honest clients enjoy fully protected retrieval of up to k items, whereas any attempt to exceed this quota deterministically exposes the violator’s identity. Comprehensive security proofs demonstrate that IB-TOT satisfies sender privacy, receiver privacy, and strict accountability under standard static assumptions (DBDH and DL).

1. Introduction

Oblivious Transfer (OT) functions as a crucial cryptographic mechanism, enabling diverse secure systems such as secure multiparty computation [1], the exchange of secrets [2,3], and electronic contract signing [4,5]. Conceptually, this interactive protocol involves a sender who provides a database of elements $\{m_1,m_2,\dots ,m_n\}$ and a receiver who wishes to access a chosen subset $\{{\sigma }_1,{\sigma }_2,\dots ,{\sigma }_k\}$. The defining characteristic of OT is its dual-privacy guarantee: the receiver accurately retrieves the desired elements $m_{{\sigma }_1},\dots ,m_{{\sigma }_k}$ without being exposed to any other data in the set, and the sender is mathematically prevented from discovering the receiver’s selection parameters [2].

The fundamental notion of OT was originally proposed by Rabin [2]. Even et al. [4] later proposed the ${\mathrm{OT}}_1^2$ scheme, and Brassard et al. [6] generalized this to the ${\mathrm{OT}}_k^n$. Further advancements by Naor and Pinkas [7] introduced adaptive OT.

While traditional OT protocols guarantee unconditional privacy, this property poses challenges in scenarios like digital rights management (DRM), where malicious users might abuse the protocol to download the entire database [8]. To address this, concepts like Access Control OT (AC-OT) [9,10] and Traceable Oblivious Transfer (TOT) [8,11] were introduced. Previous works on TOT often require complex dynamic assumptions or interaction with a Trusted Third Party (TTP) for identity management.

In the realm of Identity-Based Cryptography, researchers have actively explored constructing OT protocols using Identity-Based Encryption (IBE) primitives. A seminal work by Green and Hohenberger [12] formalized the paradigm of Blind Identity-Based Encryption (Blind IBE) and demonstrated its application in constructing efficient and fully simulatable OT schemes. In their framework, the sender acts as a Private Key Generator (PKG), and the receiver’s choice indices are treated as identities. This paradigm effectively bridges IBE and OT, offering a path to simulatable security without random oracles. Similarly, Camenisch et al. [13] proposed simulatable adaptive OT schemes based on unique blind signatures. While these works successfully integrated identity-based concepts into OT to achieve efficiency, they primarily focused on standard privacy rather than traceability for abusive users.

1.1. Our Motivation

Despite significant progress, designing schemes that efficiently balance privacy, access control, and traceability remains a challenge. Early approaches [9,14] often relied on complex state graphs or heavy zero-knowledge proofs. Han et al. [15] proposed Accountable AC-OT, but it typically requires dynamic assumptions (e.g., q-SDH) which can affect efficiency.

Very recently, Liu et al. [16] proposed an AC-TOT scheme. Grounded in the principles of cryptographic symmetry, particularly leveraging the symmetrical characteristics of bilinear pairings, this work successfully integrates dynamic access control with traceability. It ensures that exclusively approved clients are granted access to services, whilst enabling the sender to trace improper behaviors without knowing the specific content accessed by honest users. This represents the state-of-the-art in combining access control credentials with traceability.

However, while the AC-TOT scheme in [16] is highly efficient, it relies on a distinct Issuer entity to generate and manage access credentials. Within this study, our objective is to investigate an alternative architectural paradigm through leveraging IBE. Our goal is to bind the user’s identity directly to their queries using the structural advantages of Blind IBE, thereby achieving traceability without relying on an external Issuer or TTP during the transfer phase.

1.2. Our Contribution

In the current work, we put forward an innovative Identity-Based Traceable Oblivious Transfer (IB-TOT) scheme (see

Table 1. Comparison of features among related TOT schemes.

Scheme	Traceability	Assumptions	TTP in Transfer	Identity Management
Han et al. [15]	Yes	Dynamic (q-SDH)	Yes	Explicit Credentials
Liu et al. [16]	Yes	Static (DBDH)	Yes (Issuer)	Explicit Credentials
Ours (IB-TOT)	Yes	Static (DBDH, DL)	No	Identity-Based (IBE)

). We integrate the efficiency of Blind IBE extraction protocols [12] with polynomial-based secret sharing. The main contributions of our research are outlined below:

• Novel Construction via Blind IBE: We present an efficient IB-TOT scheme where database indices are treated as IBE identities, simplifying the architecture by removing the need for separate access credentials.
• TTP-Free Traceability: Unlike schemes requiring an issuer or TTP, our scheme empowers the sender to independently trace a dishonest receiver who exceeds the query limit k. This is achieved by solving a linear system via Lagrange interpolation to recover the receiver’s identity.
• Security and Efficiency: We analyze the resilience within the half-simulation framework [17] using standard static assumptions, specifically the DBDH assumption, offering a lightweight alternative to previous heavy constructions.

1.3. Organization of the Article

The remainder of this article proceeds as follows: Section 2 formulates the problem definitions and security games, while Section 3 covers the necessary cryptographic foundations. Our primary IB-TOT construction is detailed in Section 4, followed immediately by a comprehensive security evaluation utilizing the half-simulation model within Section 5. Finally, Section 6 offers our concluding observations.

2. Rigorous Formulation and Threat Model

2.1. Rigorous Formulation of IB-TOT

The proposed IB-TOT framework encompasses two primary entities: a Sender $\mathcal{S}$ and a Receiver $\mathcal{R}$. It is formally defined by the following suite of polynomial-time algorithms:

• $\mathsf{Setup}\left(1^{\lambda }\right)\to (params,msk)$: The system initialization algorithm run by the Sender.
• $\mathsf{KeyGen}\left(params\right)\to (rpk,rsk,\mathcal{VK})$: The receiver cryptographic key generation process that produces a recoverable public key $rpk$, a private key $rsk$, and a verification credential $\mathcal{VK}$.
• $\mathsf{DBEncrypt}(params,\mathcal{M})\to \mathcal{C}$: The database encryption algorithm that maps indices to IBE identities.
• $\mathsf{Transfer}(\dots )$: The interactive protocol for oblivious message retrieval.
• $\mathsf{Tracing}({\mathcal{L}}_{\mathcal{R}},params)\to (rp{k}^{\prime }\cup \perp )$: The deterministic algorithm that recovers the identity of a user who exceeds the query threshold k.

2.2. Threat Model

We define the security of IB-TOT under the half-simulation model, incorporating a specific game-based definition for traceability. Furthermore, to clarify the precise operational capabilities and threat boundaries, we explicitly define the following conditions:

• Adaptive Queries: The protocol supports adaptive queries across multiple independent transfer sessions. A receiver can iteratively select their i-th choice based on the outcomes of the previous $i-1$ queries, strictly up to the defined threshold k.
• Concurrency: Following the standard half-simulation paradigm [17], our security proofs currently analyze stand-alone executions. Ensuring robust security under fully concurrent executions typically requires the Universally Composable (UC) framework, which we designate as an area for future work.
• Collusion Resistance: By eliminating the active involvement of an external Issuer or TTP during the actual data transfer phase, the structural risk of collusion between a malicious receiver and the credential manager to secretly bypass the query threshold is fundamentally mitigated.

2.2.1. Definition of Receiver’s Privacy

Receiver’s privacy captures the indistinguishability of query indices. We define this via the experiment ${\mathbf{Exp}}_{\mathcal{A},\Pi }^{IND-REC}\left(\lambda \right)$:

Definition 1 (Receiver’s Privacy).

The scheme Π satisfies receiver’s privacy if for every probabilistic polynomial-time (PPT) opponent $\mathcal{A}$ (behaving as a corrupted Sender), the success probability in distinguishing between any two query indices ${\sigma }_0$ and ${\sigma }_1$ is negligible:

$${\mathbf{Adv}}_{\mathcal{A},\Pi }^{IND-REC}\left(\lambda \right)=\left|Pr[\mathcal{A} \mathit{guesses} b]-{\displaystyle \frac{1}{2}}\right|\le \mathsf{negl}\left(\lambda \right)$$

(1)

given that the opponent is permitted to engage with the legitimate Receiver for at most k queries.

2.2.2. Sender Confidentiality

The concept of sender confidentiality is formulated using the standard real-versus-ideal simulation framework. It ensures a Receiver learns nothing beyond the requested message.

Definition 2 (Sender Confidentiality).

The protocol Π guarantees sender confidentiality if for every PPT malicious client ${\mathcal{R}}^{*}$ operating in the real environment, one can construct a PPT simulator ${\mathcal{S}}_{sim}$ within the ideal environment (with access to an ideal functionality ${\mathcal{F}}_{OT}$ returning only $M_{\sigma }$) such that:

$$\left\{{\mathbf{View}}_{{\mathcal{R}}^{*}}^{\mathit{REAL}}\left(\lambda \right)\right\}{\approx }_c\left\{{\mathbf{View}}_{{\mathcal{S}}_{sim}}^{\mathit{IDEAL}}\left(\lambda \right)\right\}$$

(2)

2.2.3. Traceability

Traceability ensures the binding between the user’s identity and their query limit.

Definition 3 (Traceability).

The scheme Π is traceable provided that for every PPT attacker $\mathcal{A}$ (acting as a malicious Receiver), the likelihood of generating $k+1$ valid query transcripts such that the $\mathsf{Tracing}$ algorithm fails to identify $\mathcal{A}$ is negligible:

$$Pr[\mathsf{Tracing}({\mathcal{T}}_1,\dots ,{\mathcal{T}}_{k+1})=\perp \mid \mathit{All}{\mathcal{T}}_i\mathit{are}\mathit{valid}]\le \mathsf{negl}\left(\lambda \right)$$

(3)

3. Preliminaries

This section outlines the core cryptographic primitives and the underlying mathematical assumptions that establish the foundation of our IB-TOT framework. Throughout this paper, $\lambda$ is utilized to denote the overarching security parameter.

3.1. Bilinear Maps

The cryptographic constructions presented in this study are instantiated using bilinear pairings over elliptic curves. We introduce a probabilistic polynomial-time (PPT) group generator, denoted as ${\mathcal{G}}_{\mathrm{gen}}$, which takes the unary security parameter $1^{\lambda }$ as input and produces a configuration parameter set $(p,\mathbb{G},{\mathbb{G}}_T,e,g)$. Within this configuration, $\mathbb{G}$ acts as the source multiplicative cyclic group and ${\mathbb{G}}_T$ as the target multiplicative cyclic group, both sharing an identical prime order p. Let g denote the designated generator for $\mathbb{G}$. A valid bilinear pairing is defined as a map $e:\mathbb{G}\times \mathbb{G}\to {\mathbb{G}}_T$ satisfying the subsequent three criteria:

• Bilinear Evaluation: For any arbitrarily selected group elements $P,Q\in \mathbb{G}$ and any scalar exponents $\alpha ,\beta \in {\mathbb{Z}}_p$, the mapping preserves the algebraic structure such that

  $$e(P^{\alpha },Q^{\beta })=e{(P,Q)}^{\alpha ·\beta }$$
• Absence of Degeneracy: The self-pairing of the canonical generator g guarantees the creation of a valid generator for the target group ${\mathbb{G}}_T$. Specifically, the output does not map to the target group’s identity element (denoted herein as $1_{{\mathbb{G}}_T}$):

  $$e(g,g)\not\equiv 1_{{\mathbb{G}}_T}$$
• Algorithmic Efficiency: An efficient, deterministic algorithm exists that can compute the mapping $e(P,Q)$ in polynomial time for any given $(P,Q)\in \mathbb{G}\times \mathbb{G}$.

3.2. Security Assumptions

The robust security of our IB-TOT scheme is fundamentally grounded in two established hard problems: the Discrete Logarithm (DL) problem (which enforces the traceability binding) and the DBDH problem (which ensures the sender’s data privacy).

Definition 4 (DL Assumption).

Suppose $\mathbb{G}$ represents a prime-order cyclic group (with order p and generator g). Given a randomly sampled target element $h\leftarrow \mathbb{G}$, the computational DL challenge requires an adversary to compute the exact scalar $x\in {\mathbb{Z}}_p$ satisfying $h=g^x$. This problem is deemed computationally hard provided that, for every PPT attacker $\mathcal{A}$, the likelihood of successfully recovering x is strictly bounded by a negligible threshold:

$${\mathbf{Adv}}_{\mathcal{A}}^{DL}\left(\lambda \right)=Pr[\mathcal{A}(g,g^x)=x]\le \mathsf{negl}\left(\lambda \right)$$

(4)

in this context, the probability metric accounts for the uniform sampling of $x\in {\mathbb{Z}}_p$ alongside the internal coin tosses of the adversary $\mathcal{A}$.

Definition 5 (DBDH Assumption).

Assume $(p,\mathbb{G},{\mathbb{G}}_T,e,g)$ represents the bilinear pairing configuration. For randomly drawn scalars $a,b,c\leftarrow {\mathbb{Z}}_p$, the core DBDH challenge requires distinguishing the legitimate tuple $(g^a,g^b,g^c,e{(g,g)}^{abc})$ from a randomized counterpart $(g^a,g^b,g^c,Z)$, with Z being drawn uniformly from ${\mathbb{G}}_T$. The DBDH assumption is considered robust assuming that for every PPT distinguisher $\mathcal{A}$, the formal advantage specified below evaluates to a negligible amount:

$${\mathbf{Adv}}_{\mathcal{A}}^{DBDH}\left(\lambda \right)=\left|Pr[\mathcal{A}(g^a,g^b,g^c,e{(g,g)}^{abc})=1]-Pr[\mathcal{A}(g^a,g^b,g^c,Z)=1]\right|\le \mathsf{negl}\left(\lambda \right)$$

(5)

3.3. NIZK Proofs of Knowledge

Our architecture fundamentally relies on NIZK protocols to ensure that any adversarial behavior remains identifiable, all while strictly preserving the confidentiality of the users. Let ${\mathcal{R}}_{\mathrm{NP}}$ denote an NP language relation comprised of valid instance-witness tuples $(\mathsf{st},\mathsf{wt})$. We formalize a NIZK protocol via three fundamental algorithms, denoted as ${\mathrm{\Sigma }}_{\mathrm{NIZK}}=({\mathsf{Setup}}_{\mathsf{zk}},{\mathsf{Prove}}_{\mathsf{zk}},{\mathsf{Verify}}_{\mathsf{zk}})$. This protocol achieves provable security guarantees provided it fulfills the subsequent three core criteria:

• Completeness: A protocol run involving a truthful prover and a compliant verifier must unconditionally succeed. For any correctly formed tuple $(\mathsf{st},\mathsf{wt})\in {\mathcal{R}}_{\mathrm{NP}}$, the verification algorithm unconditionally outputs accept

  $$\mathbb{P}\left[{\mathsf{Verify}}_{\mathsf{zk}}(\mathsf{st},{\mathsf{Prove}}_{\mathsf{zk}}(\mathsf{st},\mathsf{wt}))=\top \right]=1$$
• Zero-Knowledge: The resulting proof transcript must not expose any fractional knowledge regarding the hidden witness $\mathsf{wt}$. Formally expressed, one can define a probabilistic polynomial-time simulator ${\mathcal{S}}_{zk}$ capable of forging proofs ${\pi }^{*}$ without knowing the actual witness, such that these forged transcripts are computationally indistinguishable from those produced honestly:

  $$\left\{(\mathsf{st},{\mathsf{Prove}}_{\mathsf{zk}}(\mathsf{st},\mathsf{wt}))\right\}\stackrel{c}{\equiv }\left\{(\mathsf{st},{\mathcal{S}}_{zk}\left(\mathsf{st}\right))\right\}$$
• Simulation Soundness: It is computationally intractable for an adversary to fabricate a passing proof for an invalid instance, even after querying simulated proofs for arbitrary statements. Formally, an efficient knowledge extractor ${\mathcal{E}}_{ext}$ exists, ensuring that the occurrence rate of the subsequent scenario is constrained by a negligible margin:

  $$\mathbb{P}\left[(\mathsf{st},{\pi }^{*})\leftarrow {\mathcal{A}}^{{\mathcal{S}}_{zk}}\left(1^{\lambda }\right)|{\mathsf{Verify}}_{\mathsf{zk}}(\mathsf{st},{\pi }^{*})=\top \wedge (\mathsf{st},{\mathcal{E}}_{ext}(\mathsf{st},{\pi }^{*}))\notin {\mathcal{R}}_{\mathrm{NP}}\right]\le \mathrm{negl}\left(\lambda \right)$$

3.4. Cryptographic Hash Functions with Collision Resistance

To facilitate the evaluation of the tracing polynomial, our scheme deploys a cryptographic hash function $H_{trace}:{\{0,1\}}^{*}\to {\mathbb{Z}}_p$. This function strictly serves to convert blinded identity inputs into corresponding polynomial coordinates.

Definition 6 (Collision Resistance).

We classify a hash function family $\mathcal{H}$ as robustly collision-resistant under the condition that no probabilistic polynomial-time (PPT) opponent $\mathcal{A}$ can feasibly locate a pair of distinct inputs, $M_A$ and $M_B$, producing the exact same hash digest. The success probability for such an attacker is strictly constrained as defined below:

$${\mathbf{Adv}}_{\mathcal{A}}^{\mathrm{CRH}}\left(\lambda \right)=Pr\left[M_A\not\equiv M_B\wedge H\left(M_A\right)=H\left(M_B\right)|(M_A,M_B)\leftarrow \mathcal{A}\left(H\right)\right]\le \mathsf{negl}\left(\lambda \right)$$

(6)

4. One Construction of Identity-Based Traceable Oblivious Transfer Scheme

This section delineates the architectural details of the proposed IB-TOT mechanism. Our design fundamentally adopts the Blind IBE key extraction methodology introduced by Green et al. [12] to act as the underlying OT channel and integrate the polynomial-based secret sharing technique from Liu et al. [8] to enforce the query threshold.

4.1. System Setup

Suppose we have two cyclic groups, $\mathbb{G}$ and ${\mathbb{G}}_T$, both defined multiplicatively over a prime order p. Let an admissible bilinear pairing be given by $e:\mathbb{G}\times \mathbb{G}\to {\mathbb{G}}_T$. The system parameters are generated via the following sequence:

• Randomly sample independent generators $g,g_2,h\leftarrow \mathbb{G}$ and draw a secret scalar $\alpha \leftarrow {\mathbb{Z}}_p$.
• Establish the overarching public key as $g_1=g^{\alpha }$ while retaining $msk=g_2^{\alpha }$ as the master secret.
• Specify $H_{trace}:\mathbb{G}\to {\mathbb{Z}}_p$ as a cryptographic hash function, ensuring collision resistance, to strictly project group elements into evaluation coordinates.
• Broadcast the global configuration tuple: $params=(\mathbb{G},{\mathbb{G}}_T,p,g,g_1,g_2,h,e,H_{trace})$.

4.2. Receiver Key Generation

Each Receiver $\mathcal{R}$ establishes a traceable identity bound to a polynomial of degree k.

• $\mathcal{R}$ samples a uniform value $s{\in }_R{\mathbb{Z}}_p$ to act as their persistent identity secret. This derivation naturally yields the verifiable public key $rpk=g^s$.
• To strictly enforce the maximum limit of k data retrievals, $\mathcal{R}$ initializes a random polynomial $f\left(x\right)\in {\mathbb{Z}}_p\left[x\right]$ of degree k, such that the constant term is s:

  $$f\left(x\right)=s+\sum _{j=1}^k{a}_j{x}^j\left(\mathrm{mod}p\right)$$

  (7)

  where $a_1,\dots ,a_k{\in }_R{\mathbb{Z}}_p$.
• $\mathcal{R}$ computes commitments to the coefficients: $C_j=g^{a_j}$ for $j=1,\dots ,k$.
• The registered credential is $\mathcal{VK}=\{rpk,C_1,\dots ,C_k\}$.

4.3. Database Encryption

The Sender encrypts the database $\mathcal{M}=\{M_1,\dots ,M_N\}$ using the IBE paradigm, where the index i serves as the identity. Subsequently, for every specific item index $i\in \{1,\dots ,N\}$, the data owner picks an ephemeral scalar $t{\in }_R{\mathbb{Z}}_p$ to construct the corresponding ciphertext $C{T}_i=(X_i,Y_i,Z_i)$ according to the following formula:

$$X_i=e{(g_1,g_2)}^t·M_i,Y_i=g^t,Z_i={(h·g_1^i)}^t$$

(8)

the encrypted database $\mathcal{C}=\{C{T}_1,\dots ,C{T}_N\}$ is made public.

4.4. Transfer Protocol

To retrieve the message $M_{\sigma }$ corresponding to index $\sigma$, $\mathcal{R}$ and $\mathcal{S}$ engage in the following interactive protocol. The overall interaction flow is illustrated in Figure 1.

4.4.1. Request Generation

$\mathcal{R}$ blinds the identity $\sigma$ and computes a tracing share.

• $\mathcal{R}$ selects a random blinding factor $r\in {\mathbb{Z}}_p$ and computes the following blinded identity hash:

  $$h^{\prime }=g^r·(h·g_1^{\sigma })$$

  (9)
• $\mathcal{R}$ computes the unique session tag $x_{tag}=H_{trace}\left(h^{\prime }\right)$ and evaluates the following polynomial:

  $$y_{share}=f\left(x_{tag}\right)=s+\sum _{j=1}^k{a}_j{\left(x_{tag}\right)}^j\left(\mathrm{mod}p\right)$$

  (10)
• $\mathcal{R}$ generates a NIZK proof $\pi$ for the relation ${\mathcal{R}}_{zk}$. This proof can be standardly instantiated using Schnorr-like $\mathrm{\Sigma }$-protocols compiled with the Fiat–Shamir heuristic, which achieves simulation soundness under the Random Oracle Model (ROM) for the hash function used internally within the proof. Note that the tag generation hash $H_{trace}$, conversely, strictly requires only collision resistance:

  $${\mathcal{R}}_{zk}=\left\{(h^{\prime },y_{share});(\sigma ,r):h^{\prime }=g^{r}h{g}_1^{\sigma }\wedge g^{y_{share}}=rpk·\prod _{j=1}^k{C}_j^{{\left(x_{tag}\right)}^j}\right\}$$

  (11)
  $\mathcal{R}$ sends $\mathrm{\Psi }=(h^{\prime },y_{share},\pi )$ to $\mathcal{S}$.

4.4.2. Verification and Blind Issue

$\mathcal{S}$ verifies the request and issues a blinded key.

• $\mathcal{S}$ computes $x_{tag}=H_{trace}\left(h^{\prime }\right)$ and verifies $\pi$.
• $\mathcal{S}$ verifies the consistency of the polynomial share against $\mathcal{VK}$ using the homomorphic property in the exponent. Substituting $f\left(x_{tag}\right)=s+{\sum }_{j=1}^k{a}_j{\left(x_{tag}\right)}^j$ into the base g yields

  $$g^{y_{share}}=g^{s+{\sum }_{j=1}^k{a}_j{\left(x_{tag}\right)}^j}=g^s·\prod _{j=1}^k{\left(g^{a_j}\right)}^{{\left(x_{tag}\right)}^j}\stackrel{?}{=}rpk·\prod _{j=1}^k{C}_j^{{\left(x_{tag}\right)}^j}$$

  (12)
• If valid, $\mathcal{S}$ stores $(x_{tag},y_{share})$ in $\mathcal{R}$’s log.
• $\mathcal{S}$ chooses random $u\in {\mathbb{Z}}_p$ and computes the blinded private key:

  $$d_0^{\prime }=msk·{\left(h^{\prime }\right)}^u=g_2^{\alpha }·{\left(h^{\prime }\right)}^u,d_1^{\prime }=g^u$$

  (13)
  $\mathcal{S}$ sends $(d_0^{\prime },d_1^{\prime })$ to $\mathcal{R}$.

4.4.3. Unblinding and Decryption

$\mathcal{R}$ unblinds the key to obtain the valid private key for identity $\sigma$.

• $\mathcal{R}$ removes the blinding factor r:

  $$d_0=d_0^{\prime }·{\left(d_1^{\prime }\right)}^{-r}=g_2^{\alpha }{\left(h^{\prime }\right)}^u·g^{-ru}=g_2^{\alpha }{\left(g^{r}h{g}_1^{\sigma }\right)}^u{g}^{-ru}=g_2^{\alpha }{\left(h{g}_1^{\sigma }\right)}^u$$

  (14)

  the tuple $(d_0,d_1)$ is a valid IBE private key for identity $\sigma$.
• $\mathcal{R}$ decrypts the ciphertext $C{T}_{\sigma }$:

  $$M_{\sigma }=X_{\sigma }·{\displaystyle \frac{e(Z_{\sigma },d_1)}{e(Y_{\sigma },d_0)}}$$

  (15)

4.5. Tracing Algorithm

If the Receiver exceeds the query limit, the Sender will possess $k+1$ valid log entries $\{(x_1,y_1),\dots ,(x_{k+1},y_{k+1})\}$. The Sender performs the following steps:

• Construct the Vandermonde matrix $\mathbf{V}$ and solve the linear system $\mathbf{V}·\mathbf{a}=\mathbf{y}$ for the coefficient vector $\mathbf{a}={(s,a_1,\dots ,a_k)}^T$:

  $$\left(\begin{array}{cccc}1& x_1& \dots & x_1^k\\ ⋮& ⋮& \ddots & ⋮\\ 1& x_{k+1}& \dots & x_{k+1}^k\end{array}\right)\left(\begin{array}{c}s\\ a_1\\ ⋮\\ a_k\end{array}\right)=\left(\begin{array}{c}{y}_1\\ ⋮\\ y_{k+1}\end{array}\right)$$

  (16)

  because $H_{trace}$ is a collision-resistant hash function, any $k+1$ independent valid queries will inherently yield $k+1$ strictly distinct evaluation points $x_i$. Over the prime field ${\mathbb{Z}}_p$, a Vandermonde matrix constructed from distinct elements is strictly non-singular. Therefore, the matrix $\mathbf{V}$ is invertible, ensuring a unique mathematical solution for the coefficient vector $\mathbf{a}$.
• Extract the constant term s.
• Compute $K_{check}=g^s$ and compare it with the registered $rpk$ to identify the cheater.

Remark on Revocation and Key Update: Upon successfully tracing a violator and recovering the secret s, the Sender can actively blacklist the corresponding public key $rpk=g^s$. Upon successfully tracing a violator and recovering the secret s, the Sender can actively blacklist the corresponding public key $rpk=g^s$. Any subsequent requests attempting to prove knowledge associated with this blacklisted $\mathcal{VK}$ will be automatically rejected by the Sender, achieving local revocation without relying on a centralized Certificate Revocation List (CRL). In events of key leakage or for routine key rotation, the Receiver is required to re-execute the $\mathsf{KeyGen}$ algorithm to initialize a fresh identity secret and tracing polynomial.

5. Formal Security Analysis

A comprehensive theoretical evaluation of the presented IB-TOT architecture is conducted herein. Operating strictly within the boundaries of the half-simulation model, formal proofs are established to validate four fundamental cryptographic properties: the inherent correctness of the protocol, unconditional privacy for the receiver, computational privacy for the sender, and strict identity traceability for policy violators.

5.1. Protocol Correctness

Theorem 1.

Assuming the underlying cryptographic primitives are secure, the presented IB-TOT framework achieves strict functional correctness.

Proof. 

To formally validate the operational integrity of our design, we independently evaluate three distinct procedural dimensions: the inherent completeness of the Zero-Knowledge Proof of Knowledge (PoK), the accurate recovery of the requested payload during decryption, and the deterministic reliability of the cheater-tracing algorithm.

1.

Correctness of Zero-Knowledge Proof (Completeness): The protocol requires the Receiver to generate a NIZK proof $\pi$ for the relation ${\mathcal{R}}_{zk}$. According to the completeness property of the underlying $\mathrm{\Sigma }$-protocol (and its Fiat–Shamir transformation), if an honest Receiver possesses valid witnesses $(\sigma ,r)$ and follows the key generation procedure to construct the polynomial share $y_{share}=f\left(H_{trace}\left(h^{\prime }\right)\right)$, then the generated proof $\pi$ will always satisfy the verification equations checked by the Sender. Specifically, the verification algorithm $\mathsf{Verify}(\pi ,h^{\prime },y_{share},\mathcal{VK})$ outputs 1 with probability 1. Consequently, an honest request will always be accepted by the Sender.

2.

Correctness of Message Decryption: Upon successful verification, the Receiver obtains the blinded key pair $(d_0^{\prime },d_1^{\prime })$. The unblinding process yields

$$d_0=d_0^{\prime }·{\left(d_1^{\prime }\right)}^{-r}=g_2^{\alpha }{\left(h^{\prime }\right)}^u·g^{-ru}=g_2^{\alpha }{\left(g^{r}h{g}_1^{\sigma }\right)}^u{g}^{-ru}=g_2^{\alpha }{\left(h{g}_1^{\sigma }\right)}^u$$

(17)

the resulting $(d_0,d_1)$ is a valid private key for identity $\sigma$. The decryption correctness is verified by explicitly expanding the bilinear pairings:

$$\begin{array}{cc}\hfill e(Z_{\sigma },d_1)& =e({\left(h{g}_1^{\sigma }\right)}^t,g^u)=e{(h{g}_1^{\sigma },g)}^{tu}\hfill \end{array}$$

(18)

$$\begin{array}{cc}\hfill e(Y_{\sigma },d_0)& =e(g^t,g_2^{\alpha }{\left(h{g}_1^{\sigma }\right)}^u)=e{(g,g_2)}^{t\alpha }·e{(g,h{g}_1^{\sigma })}^{tu}=e{(g_1,g_2)}^t·e{(h{g}_1^{\sigma },g)}^{tu}\hfill \end{array}$$

(19)

by taking the quotient of these two pairings, the term $e{(h{g}_1^{\sigma },g)}^{tu}$ perfectly cancels out

$${\displaystyle \frac{e(Z_{\sigma },d_1)}{e(Y_{\sigma },d_0)}}={\displaystyle \frac{e{(h{g}_1^{\sigma },g)}^{tu}}{e{(g_1,g_2)}^t·e{(h{g}_1^{\sigma },g)}^{tu}}}={\displaystyle \frac{1}{e{(g_1,g_2)}^t}}$$

(20)

substituting this directly into the ciphertext equation yields the following original message:

$$M_{\sigma }^{\prime }=X_{\sigma }·{\displaystyle \frac{e(Z_{\sigma },d_1)}{e(Y_{\sigma },d_0)}}=(e{(g_1,g_2)}^t·M_{\sigma })·{\displaystyle \frac{1}{e{(g_1,g_2)}^t}}=M_{\sigma }$$

(21)

thus, the Receiver correctly recovers the intended message $M_{\sigma }$.

3.

Correctness of Tracing: Suppose that a Receiver generates $k+1$ valid requests. The Sender collects $k+1$ tuples ${\left\{(x_i,y_i)\right\}}_{i=1}^{k+1}$. Since the hash function $H_{trace}$ is collision-resistant, distinct requests yield distinct evaluation points $x_i$. Because each request passed the ZKP verification (specifically the consistency check $g^{y_i}=rpk·\prod C_j^{{\left(x_i\right)}^j}$), all points $(x_i,y_i)$ strictly lie on the unique degree-k polynomial $f\left(x\right)$ committed in $\mathcal{VK}$. The Vandermonde matrix $\mathbf{V}$ formed by distinct $x_i$ is non-singular (invertible). Therefore, the linear system $\mathbf{V}\mathbf{a}=\mathbf{y}$ yields a unique solution for the constant term s. Since $rpk=g^s$, the recovered secret correctly identifies the Receiver.

□

5.2. Receiver’s Privacy

Theorem 2.

Our IB-TOT framework fundamentally ensures query confidentiality for any legitimate receiver, strictly bounded by the zero-knowledge property of the underlying NIZK protocol.

Proof. 

To establish receiver privacy without relying on narrative arguments, we formalize the proof via a sequence of computational games played between a challenger $\mathcal{C}$ and a malicious PPT sender adversary $\mathcal{A}$. Let ${\sigma }_0$ and ${\sigma }_1$ denote two distinct choice indices submitted by the receiver.

Game 0: This corresponds to the real protocol execution. The challenger $\mathcal{C}$ interacts with $\mathcal{A}$ using the true choice ${\sigma }_0$. $\mathcal{A}$ receives the authentic transcript $\mathrm{\Psi }=(h^{\prime },y_{share},\pi )$.

Game 1: $\mathcal{C}$ alters the transcript generation. Instead of computing the genuine NIZK proof $\pi$ using the witness $({\sigma }_0,r)$, $\mathcal{C}$ invokes the formal zero-knowledge simulator ${\mathcal{S}}_{zk}$ to generate a simulated proof ${\pi }^{*}$. By the zero-knowledge property of the NIZK protocol, the transcripts in Game 0 and Game 1 are computationally indistinguishable. Thus, the difference in $\mathcal{A}$’s distinguishing advantage is bounded by

$$|Pr[\mathcal{A}\left(\mathrm{Game}0\right)=1]-Pr[\mathcal{A}\left(\mathrm{Game}1\right)=1]|\le {\mathbf{Adv}}_{\mathcal{A}}^{ZK}\left(\lambda \right)$$

(22)

Game 2: $\mathcal{C}$ now switches the underlying encoded choice from ${\sigma }_0$ to ${\sigma }_1$. Recall the blinded identity construction: $h^{\prime }=g^r·(h·g_1^{\sigma })$. Because the blinding factor $r{\in }_R{\mathbb{Z}}_p$ is drawn uniformly at random by the honest receiver, $g^r$ functions as a perfect one-time pad within the group $\mathbb{G}$. Consequently, the distribution of $h^{\prime }$ is perfectly uniform and strictly independent of the choice $\sigma$. Since the proof ${\pi }^{*}$ is simulated (independent of the witness), the entire transcript distribution in Game 2 is statistically identical to that in Game 1:

$$Pr\left[\mathcal{A}\right(\mathrm{Game}1)=1]=Pr\left[\mathcal{A}\right(\mathrm{Game}2)=1]$$

(23)

Therefore, any PPT adversary $\mathcal{A}$’s total advantage in distinguishing ${\sigma }_0$ from ${\sigma }_1$ is entirely constrained by its advantage in breaking the zero-knowledge simulator, which is negligible:

$${\mathbf{Adv}}_{\mathcal{A},\Pi }^{IND-REC}\left(\lambda \right)\le {\mathbf{Adv}}_{\mathcal{A}}^{ZK}\left(\lambda \right)\le \mathsf{negl}\left(\lambda \right)$$

(24)

□

5.3. Sender’s Privacy

Theorem 3.

Our IB-TOT construction satisfies sender privacy under the half-simulation model, provided that the underlying Identity-Based Encryption (IBE) scheme achieves IND-ID-CPA security (which reduces to the standard DBDH assumption).

Proof. 

We eschew narrative arguments by providing an explicit adversary-to-solver mapping. We construct a PPT simulator ${\mathcal{S}}_{sim}$ (acting as the solver $\mathcal{B}$) that interacts with the ideal functionality ${\mathcal{F}}_{OT}$ and utilizes a malicious receiver ${\mathcal{R}}^{*}$ (acting as the adversary $\mathcal{A}$) as a subroutine.

Assume ${\mathcal{R}}^{*}$ can distinguish the real execution from the ideal simulation with a non-negligible advantage $ϵ$. We construct an algorithm $\mathcal{B}$ that leverages ${\mathcal{R}}^{*}$ to break the IND-ID-CPA security of the underlying IBE scheme. $\mathcal{B}$ interacts with an external IBE challenger ${\mathcal{C}}_{IBE}$ through the following mapped stages:

1.

Setup Mapping: ${\mathcal{C}}_{IBE}$ generates the global IBE parameters $params$ and master secret, retaining $msk$ internally. It sends $params$ to $\mathcal{B}$. $\mathcal{B}$ transparently forwards $params$ to ${\mathcal{R}}^{*}$.

2.

Query Extraction: When ${\mathcal{R}}^{*}$ submits an OT request transcript $\mathrm{\Psi }=(h^{\prime },y_{share},\pi )$, $\mathcal{B}$ verifies $\pi$. Upon successful verification, $\mathcal{B}$ exploits the Simulation Soundness of the NIZK protocol by invoking the knowledge extractor ${\mathcal{E}}_{ext}$ to rewind ${\mathcal{R}}^{*}$ and extract the hidden witness $({\sigma }^{*},r)$. Here, ${\sigma }^{*}$ explicitly reveals the receiver’s target index.

3.

Key Issue Simulation: Without knowing $msk$, $\mathcal{B}$ queries the ${\mathcal{C}}_{IBE}$ key extraction oracle for the specific identity ${\sigma }^{*}$. ${\mathcal{C}}_{IBE}$ returns a valid, unblinded private key tuple $(d_0,d_1)$. Utilizing the extracted blinding factor r, $\mathcal{B}$ constructs the blinded response for ${\mathcal{R}}^{*}$ algebraically, perfectly simulating the issuer’s response without requiring the master secret.

4.

Database Simulation (Challenge Phase): $\mathcal{B}$ queries the ideal functionality ${\mathcal{F}}_{OT}$ with the extracted choice ${\sigma }^{*}$ to obtain the legitimate plaintext message $M_{{\sigma }^{*}}$. To simulate the database $\mathcal{C}$:

• For the target index (${\sigma }^{*}$): $\mathcal{B}$ explicitly encrypts $M_{{\sigma }^{*}}$ to generate the authentic ciphertext $C{T}_{{\sigma }^{*}}$.
• For all unqueried indices ($j\ne {\sigma }^{*}$): $\mathcal{B}$ defines $M_{j,0}=M_j$ (the real message, if known) and $M_{j,1}=R_j$ (a random message). $\mathcal{B}$ submits $(M_{j,0},M_{j,1})$ to ${\mathcal{C}}_{IBE}$ as the challenge phase inputs. ${\mathcal{C}}_{IBE}$ returns challenge ciphertexts $C{T}_j^{*}$ based on a hidden coin $b\in \{0,1\}$. $\mathcal{B}$ embeds these $C{T}_j^{*}$ into the published database.

Output and analysis: $\mathcal{B}$ outputs whatever decision ${\mathcal{R}}^{*}$ makes. If the IBE challenger’s coin is $b=0$, the database contains valid encryptions of all real messages, making the view of ${\mathcal{R}}^{*}$ statistically identical to the real environment. If $b=1$, the database contains valid encryptions only for ${\sigma }^{*}$ and random garbage for $j\ne {\sigma }^{*}$, precisely matching the ideal environment.

Consequently, if ${\mathcal{R}}^{*}$ distinguishes the real view from the ideal view with advantage $ϵ$, algorithm $\mathcal{B}$ successfully wins the IND-ID-CPA game against ${\mathcal{C}}_{IBE}$ with the exact same advantage $ϵ$. Since the underlying IBE is IND-ID-CPA secure under the DBDH assumption, $ϵ$ must be negligible. □

5.4. Traceability Analysis

Theorem 4.

The presented IB-TOT architecture guarantees deterministic traceability against malicious clients.

Proof. 

Assume a malicious receiver, denoted as ${\mathcal{R}}^{*}$, manages to complete $k+1$ successful interactive sessions with the data owner. Consequently, the sender gathers a set of $k+1$ legitimate session records, represented as $\{(x_1,y_1),\dots ,(x_{k+1},y_{k+1})\}$.

Following the formal verification procedures:

• Every recorded value $y_i$ inherently passes the structural verification equation: $g^{y_i}=rpk·{\prod }_{j=1}^k{C}_j^{{\left(x_i\right)}^j}$.
• Because the Pedersen commitment scheme utilized within the credential $\mathcal{VK}$ is computationally binding, it is infeasible for the receiver to map these specific commitments to an alternative polynomial. Consequently, every collected coordinate pair $(x_i,y_i)$ is strictly constrained to reside on a single, invariant k-degree polynomial $f\left(x\right)$.

Relying on the collision resistance of the hash function $H_{trace}$, we can assert that the derived evaluation inputs $x_i$ are mutually exclusive. Following the procedures outlined in the identity recovery mechanism (Section 4.5), the data owner formulates the linear system corresponding to Equation (16).

Given that the constructed matrix $\mathbf{V}$ operates as a Vandermonde matrix formed by strictly distinct values $x_i$, its determinant is mathematically guaranteed to be invertible. Therefore, solving this system yields exactly one valid coefficient vector $\mathbf{a}$, which enables the sender to seamlessly extract the underlying constant term s.

In the concluding step, the sender performs the check $g^s\stackrel{?}{=}rpk$. Because the malicious user explicitly demonstrated knowledge of s throughout the initial credential registration and all subsequent zero-knowledge proofs, this extracted value s indisputably matches the cheater’s core identity key. As a result, the violator is deterministically unmasked. □

5.5. Complexity

To evaluate the performance of the proposed IB-TOT framework, we assess the computational and communication overheads across all protocol stages. We operate under the premise that the pairing operation $e(g_1,h)$ can be computed in advance, and the system initialization incurs a minimal performance penalty.

During the Setup phase, the sender is required to compute 2 exponentiations within the group $\mathbb{G}$. In the KeyGen phase, establishing the verifiable credential $\mathcal{VK}$ requires the receiver to perform $k+1$ modular exponentiations in $\mathbb{G}$. For the DBEncrypt phase, assuming pre-calculated pairings, encrypting a database of size N demands $2N$ exponentiations in $\mathbb{G}$ alongside N exponentiations in the target group ${\mathbb{G}}_T$. The resulting N ciphertext tuples are then published globally.

Formulating a query in the Request phase necessitates approximately $O\left(k\right)$ exponentiations in $\mathbb{G}$ by the receiver. This covers the creation of the blinded identity, the polynomial share evaluation, and the generation of the zero-knowledge proof $\pi$. Upon receiving a query during the Verification & Issue phase, the sender validates the NIZK proof and the polynomial share consistency, utilizing $O\left(k\right)$ exponentiations in $\mathbb{G}$. Subsequently, issuing the blinded key takes an additional 2 exponentiations in $\mathbb{G}$. In the Unblinding & Decryption phase, the receiver extracts the plaintext message and the valid private key by executing 2 pairing operations and a single exponentiation in $\mathbb{G}$. Finally, the Tracing phase strictly relies on basic linear algebraic operations over ${\mathbb{Z}}_p$ to solve the Vandermonde system, imposing an essentially negligible computational burden.

Comprehensive summaries of these metrics are detailed in

Table 2. Summary of computational overhead.

Protocol Phase	Executing Entity	Computational Cost
Setup	Sender	2 e in $\mathbb{G}$
KeyGen	Receiver	$(k+1)$ e in $\mathbb{G}$
DBEncrypt	Sender	$2N$ e in $\mathbb{G}$, N e in ${\mathbb{G}}_T$
Request	Receiver	$O\left(k\right)$ e in $\mathbb{G}$
Verification & Issue	Sender	$O\left(k\right)$ e in $\mathbb{G}$
Unblinding & Decryption	Receiver	2 p, 1 e in $\mathbb{G}$
Tracing	Sender	Negligible (linear operations over ${\mathbb{Z}}_p$)

and

Table 3. Summary of communication overhead.

Protocol Phase	Data Transmission
Setup	None
KeyGen	$(k+1)$E (Receiver → Public)
DBEncrypt	$N{E}_T+2NE$ (Sender → Public)
Request	1 E + 1 $E_p$ + $\left|\pi \right|$ (Receiver → Sender)
Verification & Issue	2 E (Sender → Receiver)
Unblinding & Decryption	None
Tracing	None

. Here, e and p denote a single exponentiation and a pairing operation, respectively. The bit lengths of elements in $\mathbb{G}$, ${\mathbb{G}}_T$, and ${\mathbb{Z}}_p$ are represented by E, $E_T$, and $E_p$, while $\left|\pi \right|$ indicates the communication size of the NIZK proof.

It is worth noting that the complexity metrics evaluated herein are based on theoretical operation counts (i.e., the number of pairings and exponentiations), which provide a hardware-independent baseline for cryptographic efficiency. The exact computational latency in practical deployments will inherently depend on the specific choice of elliptic curves (e.g., BN254 or BLS12-381), hardware specifications, and optimization of the underlying cryptographic libraries. Comprehensive software implementation, concrete parameterization, and empirical benchmarking of the IB-TOT protocol are designated as crucial directions for our future research.

6. Conclusions

In this work, we address the critical challenge of balancing absolute privacy with accountability in data exchange services by proposing IB-TOT, an efficient Identity-Based Traceable Oblivious Transfer scheme. Unlike prior approaches that depend on heavy dynamic assumptions or external credential issuers, our solution leverages the structural advantages of Blind Identity-Based Encryption (Blind IBE) combined with polynomial secret sharing. This synergy allows us to construct a robust protocol that strictly enforces a k-times query threshold.

The primary contributions of this paper are threefold. First, we achieve TTP-free traceability during the transfer phase; the sender can independently identify abusive users who exceed their quota without third-party intervention, significantly reducing system complexity and communication latency. Second, our security relies on static and standard assumptions (DBDH and DL) rather than stronger dynamic assumptions (such as q-SDH), thereby enhancing the scheme’s practicality and efficiency. Third, the identity-based architecture simplifies key management, as database indices naturally serve as public keys.

We have provided a comprehensive security analysis under the half-simulation model, proving that IB-TOT guarantees computational privacy for honest receivers, simulation-based security for senders, and deterministic traceability against threshold-violating adversaries. We acknowledge that the current static nature of the threshold k, fixed during key generation, presents limitations for highly dynamic access control environments. Therefore, future work will focus on extending this framework to support more expressive and dynamically adaptive access control policies without sacrificing the TTP-free property, as well as elevating the security proof to the Universally Composable (UC) framework to ensure robustness under concurrent composition.