Proxy OT - based on discrete log
A group Gg, generator g, a random constant c.
Chooser selects r, sets PKb=gr, PK1-b=c/PKb.
Chooser sends PK0 to sender, and r to proxy.
Sender
- computes PK1=c/PK0
- encrypts I0 with PK0, I1 with PK1, permutes, and sends to proxy.
Proxy knows PKb and can decrypt Ib.