---
title: Efficient Traceable OT-MP-PSI Protocol
url: https://www.emergentmind.com/topics/efficient-traceable-ot-mp-psi-et-ot-mp-psi
type: topic
---

# Efficient Traceable OT-MP-PSI Protocol

Searching arXiv for the specified paper and closely related prior work on traceable over-threshold MP-PSI.
Efficient Traceable OT-MP-PSI (ET-OT-MP-PSI) is a protocol for **Traceable Over-Threshold Multi-Party Private Set Intersection (T-OT-MP-PSI)** in which an element is disclosed when it appears in at least \(t\) out of \(n\) participants’ sets, and the output additionally reveals **which parties hold it**. In the formulation studied in "Practical Traceable Over-Threshold Multi-Party Private Set Intersection" [2512.24652], the protocol is centralized around a designated leader \(P_0\), with \(P_0\) outputting tuples of the form \((e_i,c_i,\{P_j\})\) for elements \(e_i \in S_0\) whose multiplicity satisfies \(c_i \ge t\), while all other parties output \(\bot\). ET-OT-MP-PSI combines **Shamir secret sharing**, an **oblivious programmable pseudorandom function (OPPRF)**, and **share refreshing using zero-secret sharing** to provide traceability and improved efficiency while remaining secure against collusion among up to \(t-2\) semi-honest parties [2512.24652].

## 1. Formal setting and traceability requirement

In ordinary **multi-party private set intersection (MP-PSI)**, there are \(n\) parties \(P_0,\dots,P_{n-1}\), each holding a private set \(S_i\), and the objective is to compute
\[
\bigcap_{i=0}^{n-1} S_i.
\]
Threshold MP-PSI generalizes this by disclosing an element \(e\) whenever its multiplicity \(c(e)\) satisfies
\[
c(e) \ge t.
\]
This is the \(t\)-out-of-\(n\) or over-threshold condition [2512.24652].

T-OT-MP-PSI strengthens threshold MP-PSI by requiring **traceability**. The output must reveal not only the qualifying element but also the identities of the holders. The ideal functionality \(\mathcal{F}_{\text{T-OT-MP-PSI}^{n,m,t}}\) described in [2512.24652] takes as input private sets \(S_i\) of size \(m\) and a threshold \(t\) with \(1 < t \le n\), and returns to \(P_0\)
\[
I=\{(e_i,c_i,\{P_j\}) \mid e_i \in S_0,\ c_i \ge t\},
\]
while all other parties output \(\bot\).

This traceability requirement distinguishes ET-OT-MP-PSI from ordinary threshold PSI. A normal threshold PSI may reveal only the set
\[
\{e : c(e)\ge t\},
\]
but not the corresponding holders. In contrast, T-OT-MP-PSI reveals the holder set \(\{P_j\}\), making the result attributable and, in the terminology of [2512.24652], making the intersection elements **traceable** and the result **verifiable**.

## 2. System model, adversary model, and corruption threshold

ET-OT-MP-PSI is defined in a system centered on a designated **leader** \(P_0\), with the remaining parties \(P_1,\dots,P_{n-1}\) acting as clients [2512.24652]. The protocol is analyzed in the standard **semi-honest / honest-but-curious** model: parties follow the protocol correctly but may attempt to infer additional information from their local state and received messages. A party’s view consists of its private input, random tape, and all received messages, and security is defined via simulation by a simulator \(\mathsf{Sim}\) that produces a computationally indistinguishable view [2512.24652].

In this setting, **traceability** means that if an element is output as part of the threshold intersection, the protocol also identifies the set of parties that hold it. The paper explicitly connects this property to scenarios such as digital forensics, anomaly attribution, and AML, where evidence must be attributed to specific holders [2512.24652].

The protocol family in [2512.24652] contains two security regimes. For ET-OT-MP-PSI, the corruption threshold is up to
\[
t-2
\]
semi-honest parties. The paper states that if \(t-1\) parties collude in ET-OT-MP-PSI, they can reconstruct enough information from Shamir shares and updated shares to infer whether an honest party holds a specific element, even without full reconstruction; consequently, the security threshold is \(t-2\) [2512.24652]. A second protocol, ST-OT-MP-PSI, strengthens this to security against up to \(n-1\) semi-honest participants by further leveraging the oblivious linear evaluation protocol, but ET-OT-MP-PSI itself retains the \(t-2\) bound [2512.24652].

## 3. Construction of ET-OT-MP-PSI

ET-OT-MP-PSI combines three components: **Shamir secret sharing**, **OPPRF**, and **share refreshing using zero-secret sharing** [2512.24652]. Its construction is organized into three phases.

In the **conditional secret sharing** phase, for each element \(e_k^0 \in S_0\), the leader \(P_0\) treats \(e_k^0\) as a secret and applies \((t,n)\)-Shamir secret sharing over a field \(\mathbb{F}_p\):
\[
f(x)=e_k^0+a_1x+\cdots+a_{t-1}x^{t-1},
\]
producing shares
\[
s_k^{0,0},\dots,s_k^{0,n-1}.
\]
To ensure that only parties holding the same element receive the relevant share, \(P_0\) uses OPPRF with each client \(P_i\). The sender input is
\[
\{(e_k^0,s_k^{0,i}) \mid e_k^0 \in B_S[b]\},
\]
and the receiver input is
\[
\{e_k^i \mid e_k^i \in B_C[b]\}.
\]
If \(e_k^i = e_k^0\), then \(P_i\) obtains
\[
\hat{s}_k^{0,i} = s_k^{0,i};
\]
otherwise it receives a random-looking value [2512.24652].

In the **secret share update** phase, the protocol refreshes shares to prevent privacy leakage from comparing pre-update and post-update values. For each party \(P_i\) with \(i\in[1,n-1]\) and each bin \(b\), the party constructs a zero-secret Shamir polynomial
\[
f_{i,b}(x)=0+a_1x+\cdots+a_{t-1}x^{t-1}.
\]
Each party computes update shares \(f_{i,b}(j+1)\) for all recipients \(P_j\), and recipients sum all received updates:
\[
\delta_b = f_{1,b}(j+1)+\cdots+f_{n-1,b}(j+1).
\]
The leader updates its share for \(e_k^0\) by
\[
y_k^0 = s_k^{0,0} + \delta_b.
\]
Because the added shares encode the zero secret, the underlying secret is preserved while the shares are refreshed [2512.24652].

In the **conditional collection and reconstruction** phase, each client \(P_i\) conditionally returns the updated share to \(P_0\) via OPPRF. The sender input at \(P_i\) is
\[
\{(e_k^i,\mu_k^{0,i}) \mid e_k^i \in B_S[b]\},
\]
where
\[
\mu_k^{0,i} = \hat{s}_k^{0,i} + \delta_b.
\]
The receiver input at \(P_0\) is
\[
\{e_k^0 \mid e_k^0 \in B_C[b]\}.
\]
If \(e_k^i = e_k^0\), then \(P_0\) receives the correct updated share \(y_k^i\) [2512.24652].

The leader then reconstructs by trying all subsets of \(t\) shares among the \(n\) updated shares, always including its own share, using Lagrange interpolation. If for some subset
\[
f_k(0)=e_k^0,
\]
then \(e_k^0\) is in the threshold intersection. To identify holders, \(P_0\) checks for each party \(P_i\) whether
\[
f_k(i+1)=y_k^i.
\]
Those satisfying the equality are identified as holders of the element [2512.24652].

## 4. Data structures, hashing, and protocol flow

Before the main protocol, each party hashes its set into bins. The paper uses **Cuckoo hashing** on the receiver side, with one element per bin and dummy padding for empty bins, and **Simple hashing** on the sender side, with bins padded to a maximum size \(\beta\) [2512.24652]. This arrangement hides the distribution of elements across bins.

The protocol uses the following data structures and share variables [2512.24652]:

| Symbol | Meaning |
|---|---|
| \(B_S[b]\) | bins from Simple hashing for sender-side data |
| \(B_C[b]\) | bins from Cuckoo hashing for receiver-side data |
| \(\beta\) | maximum bin size in Simple hashing |
| \(s_k^{0,i}\) | original Shamir shares |
| \(\hat{s}_k^{0,i}\) | OPPRF-delivered shares |
| \(\delta_b\) | accumulated zero-share updates |
| \(\mu_k^{0,i}\) | updated share before collection |
| \(y_k^i\) | final received share at \(P_0\) |

The message flow has four steps. First, for each bin \(b\), \(P_0\) programs OPPRF with shares of elements in \(B_S[b]\), and each client \(P_i\) queries using its elements in \(B_C[b]\). Second, clients generate zero-secret Shamir shares and send them to all parties. Third, each client \(P_i\) uses OPPRF again to conditionally send the updated share back to \(P_0\). Fourth, \(P_0\) performs interpolation across subsets of size \(t\) among the received shares; if reconstruction succeeds, the element is in the threshold intersection, and the holder identities are then read off from the matching shares [2512.24652].

A plausible implication is that the protocol’s practical efficiency depends not only on the cryptographic primitives but also on the binning-and-padding strategy, since OPPRF is executed on binned data rather than on all pairwise comparisons. The paper explicitly attributes part of the efficiency to “binning / padding techniques to reduce comparisons” [2512.24652].

## 5. Correctness, privacy, and proof structure

The central security claim for ET-OT-MP-PSI is stated as Theorem 1 in [2512.24652]: ET-OT-MP-PSI realizes \(\mathcal{F}_{\text{T-OT-MP-PSI}^{n,m,t}}\) and is secure against collusion among up to \(t-2\) semi-honest parties.

The correctness proof distinguishes two cases. If an element is in the intersection, then at least \(t\) parties obtain correct shares, the refreshed shares remain consistent, and reconstruction succeeds. If an element is not in the intersection, then fewer than \(t\) correct shares exist, so reconstruction fails except with negligible probability [2512.24652]. This aligns the threshold semantics directly with Shamir reconstruction: successful interpolation serves as the test for threshold membership.

The privacy proof is simulation-based under the semi-honest model. When \(P_0\) is honest and only clients are corrupted, the simulator produces OPPRF outputs as random field elements and simulates zero-share updates with random polynomials; indistinguishability follows from OPPRF obliviousness and Shamir security. When \(P_0\) is corrupted, the simulator uses the ideal output \(I\), returns random values for non-intersection items, and computes correct outputs for actual intersection items [2512.24652].

The proof relies on the security of Shamir secret sharing, the security and obliviousness of OPPRF, computational indistinguishability in \(\mathbb{F}_p\), and the semi-honest adversary model [2512.24652]. The paper’s notion of “reliability of intersection” is that the output is **verifiable**: an element is not merely anonymously reported as satisfying the threshold, but is reconstructible through secret-sharing consistency and accompanied by a holder list that can be checked [2512.24652].

## 6. Complexity and empirical performance

The notation used in the complexity analysis includes \(n\) for the number of parties, \(m\) for set size, \(t\) for threshold, \(\lambda\) for the statistical security parameter, \(\kappa\) for the computational security parameter, \(\beta\) for the maximum bin size of Simple hashing, and \(p\) for the prime defining \(\mathbb{F}_p\) [2512.24652].

For ET-OT-MP-PSI, the communication costs are divided into conditional secret sharing via OPPRF, share update, and conditional collection. The first two are each
\[
O(nm\lambda),
\]
and the third is
\[
O(m\lambda).
\]
The overall summary gives leader and client communication as
\[
O(nm\lambda)
\]
for ET [2512.24652].

The computation cost for the leader includes Shamir sharing and evaluation,
\[
O(nmt),
\]
reconstruction,
\[
O\!\left(mt^2\binom{n-1}{t-1}\right)
\approx O\!\left(mt^2\left(\frac{e(n-1)}{t-1}\right)^{t-1}\right),
\]
and OPPRF overhead,
\[
O(nm\kappa).
\]
The client computation cost is
\[
O(\max\{\kappa, nt\lambda\}m)
\]
[2512.24652].

The reconstruction formulas stated in the paper are the standard Shamir expressions:
\[
f(x)=S+a_1x+\cdots+a_{t-1}x^{t-1},
\]
\[
S=f(0)=\sum_{i=0}^{t-1} y_i \prod_{j=0, j\neq i}^{t-1}\frac{x_j}{x_j-x_i},
\]
with refresh polynomial
\[
f'(x)=0+b_1x+\cdots+b_{t-1}x^{t-1},
\]
and refresh update represented as
\[
(x_i,y_i+y_i').
\]
The OPPRF functionality is described as programming
\[
\{(x_1,y_1),\dots,(x_u,y_u)\}
\]
for sender inputs, while the receiver queries
\[
(q_1,\dots,q_v)
\]
and receives the programmed \(y_j\) whenever \(q_i=x_j\) [2512.24652].

The experimental setup reported in [2512.24652] uses an implementation in **C++** with **NTL for big-number arithmetic**, **Boost for communication**, **table-based OPPRF**, and **RLWE-based OLE for ST-OT-MP-PSI**. The experiments were conducted on a machine with **Intel Xeon 3.1GHz**, **80 vCores**, **192GB RAM**, and **Ubuntu 22.04**. The element length was
\[
128 \text{ bits}
\]
and runtimes were averaged over **10 trials** [2512.24652].

The headline benchmark reported in the abstract and conclusion is for \(n=5\), \(t=3\), and set size \(m=2^{14}\). Under these conditions, ET-OT-MP-PSI achieves **15056× faster** runtime than Mahdavi et al.’s protocol, while ST-OT-MP-PSI achieves **505× faster** runtime [2512.24652]. Additional reported results include the case \(n=10\), \(t=5\), \(m=2^7\), where ET-OT-MP-PSI is **4312× faster** and ST-OT-MP-PSI is **637× faster** than Mahdavi et al.’s protocol; for reconstruction specifically at \(n=10\), \(t=5\), \(m=2^7\), the speedups are **45215×** for ET and **13761×** for ST [2512.24652].

Concrete runtime examples for ET-OT-MP-PSI are **1.73s** for \((n,t)=(5,3)\), \(m=2^{14}\); **6.23s** for \((5,3)\), \(m=2^{16}\); and **24.76s** for \((5,3)\), \(m=2^{18}\). For ST-OT-MP-PSI, the reported examples are **53.22s** for \((5,3)\), \(m=2^{14}\), and **207.78s** for \((5,3)\), \(m=2^{16}\) [2512.24652]. The paper highlights linear scaling in set size and roughly exponential growth in reconstruction with threshold, attributing the latter to the enumeration of
\[
\binom{n-1}{t-1}
\]
subsets [2512.24652].

## 7. Relation to prior traceable OT-MP-PSI and practical significance

The paper identifies **Mahdavi et al.** as the main prior traceable OT-MP-PSI scheme and characterizes its limitations in three dimensions [2512.24652]. First, the prior protocol is secure against up to \(t-2\) semi-honest participants **under the assumption that certain designated special parties do not collude**. Second, its computational complexity is
\[
O\!\left(m(n\log(m/t))^{2t}\right),
\]
which the paper describes as expensive and poorly scaling with threshold. Third, the paper reports that for \(n=10\), \(t=7\), \(m=2^5\), runtime exceeds **9 hours** [2512.24652].

ET-OT-MP-PSI preserves the \(t-2\) corruption tolerance but removes the additional assumption that designated special parties do not collude. ST-OT-MP-PSI goes further by raising corruption tolerance to \(n-1\), again without relying on designated non-colluding parties [2512.24652]. The paper emphasizes that its protocols reduce the exponent from \(2t\) to essentially \(t\), and use symmetric-key style primitives rather than heavy homomorphic encryption in the main path [2512.24652].

The end-to-end intuition given in [2512.24652] is that \(P_0\) secret-shares each candidate element with Shamir sharing; OPPRF ensures that only parties who actually hold the element receive the corresponding share; all parties refresh shares by adding zero-secret Shamir shares so that the leader cannot compare before-and-after values to infer non-intersection membership; \(P_0\) collects updated shares via OPPRF; and reconstruction by Lagrange interpolation simultaneously determines threshold membership and enables holder identification. This suggests that ET-OT-MP-PSI is best understood as a threshold PSI protocol in which **membership evidence** is encoded directly in the algebraic consistency of refreshed secret shares.

The protocol’s stated guarantees are the correctness of threshold intersection output, traceability of holders, privacy of non-intersecting elements, and semi-honest security up to \(t-2\) colluding parties for ET-OT-MP-PSI [2512.24652]. In applications such as digital forensics, where each participant remains responsible for its own dataset and attribution of evidence matters, the combination of threshold disclosure and holder revelation is the defining property that distinguishes ET-OT-MP-PSI from ordinary MP-PSI.

Source: https://www.emergentmind.com/topics/efficient-traceable-ot-mp-psi-et-ot-mp-psi