Security-Enhanced Traceable OT-MP-PSI

• The paper introduces a protocol that reveals leader-held elements only if they appear in t or more parties' sets, ensuring precise holder identification.
• It leverages Shamir secret sharing, OPPRF, and OLE-based share refreshing to securely mask and update shares against collusion attacks.
• Empirical benchmarks demonstrate significant speedups over prior methods, making it applicable to network anomaly detection and digital forensics.

Security-enhanced Traceable Over-Threshold Multi-Party Private Set Intersection (ST-OT-MP-PSI) is a designated-receiver threshold MP-PSI protocol in which $n \ge 3$ parties $P_0,\dots,P_{n-1}$ hold private sets $S_0,\dots,S_{n-1}$ of size $m$, and party $P_0$ learns exactly those elements of $S_0$ that appear in at least $t$ parties’ sets, together with the number and identities of the holders. The ideal output is

$$I=\{(e_i,c_i,\{P_j\}) \mid e_i \in S_0,\ c_i \ge t\},$$

while all other parties output $\bot$. The protocol was introduced as the stronger of two traceable over-threshold MP-PSI constructions, with its defining property being semi-honest security against collusion among up to $n-1$ parties, achieved by combining conditional Shamir secret sharing, OPPRF, and an OLE-based share-update mechanism (Yang et al., 31 Dec 2025).

1. Functionality, semantics, and problem model

ST-OT-MP-PSI is formulated for threshold MP-PSI rather than ordinary all-party intersection. For an element $P_0,\dots,P_{n-1}$0, the protocol uses

$P_0,\dots,P_{n-1}$1

to denote the number of parties holding $P_0,\dots,P_{n-1}$2, and it discloses $P_0,\dots,P_{n-1}$3 iff $P_0,\dots,P_{n-1}$4. The “traceable” component is that the receiver learns not only that an element satisfies the threshold, but also the full holder set

$P_0,\dots,P_{n-1}$5

Because the holder identities are revealed, the count $P_0,\dots,P_{n-1}$6 is revealed as well (Yang et al., 31 Dec 2025).

The protocol is asymmetric. Only $P_0,\dots,P_{n-1}$7 receives the result, and the functionality is explicitly restricted to elements of $P_0,\dots,P_{n-1}$8’s set: $P_0,\dots,P_{n-1}$9 Accordingly, the construction is not a symmetric threshold intersection over the union of all parties’ sets. The paper’s complexity discussion correspondingly designates $S_0,\dots,S_{n-1}$0 as the Leader and the other participants as Clients (Yang et al., 31 Dec 2025).

The data model assumes that elements can be encoded in a field suitable for Shamir sharing and OLE. In the implementation, elements are 128-bit values, and the finite field is over a large modulus $S_0,\dots,S_{n-1}$1 chosen to accommodate 128-bit elements. The motivating applications emphasized for this functionality are network anomaly detection, digital forensics investigation, and suspicious account or anti-money-laundering analysis, all of which benefit from revealing both the qualifying element and the parties that hold it (Yang et al., 31 Dec 2025).

A common misconception is to equate traceability here with a general public-accountability notion. In this protocol family, traceability means that $S_0,\dots,S_{n-1}$2 can identify the holder set for each disclosed over-threshold element. The paper does not separately formalize “traceability,” “soundness,” “robustness,” or “reliability” as named definitions (Yang et al., 31 Dec 2025).

2. Cryptographic structure and constituent primitives

ST-OT-MP-PSI is built from four main components: Shamir secret sharing, zero-secret share refresh, OPPRF, and OLE, together with simple hashing and cuckoo hashing for binning (Yang et al., 31 Dec 2025).

Shamir’s $S_0,\dots,S_{n-1}$3-secret sharing is used in its standard degree-$S_0,\dots,S_{n-1}$4 form. For a secret $S_0,\dots,S_{n-1}$5, the dealer samples

$S_0,\dots,S_{n-1}$6

assigns shares $S_0,\dots,S_{n-1}$7 with

$S_0,\dots,S_{n-1}$8

and reconstructs with Lagrange interpolation: $S_0,\dots,S_{n-1}$9 In ST-OT-MP-PSI, $m$0 does not share the element $m$1 itself. It shares a fresh random value $m$2 associated uniquely with $m$3. The paper states that this change prevents $m$4 colluding parties from reconstructing and learning $m$5’s elements directly from shares (Yang et al., 31 Dec 2025).

Zero-secret sharing is used to refresh shares without changing the underlying secret. Each updating party samples

$m$6

so adding $m$7 to an existing share preserves the same constant term. The stated role of this refresh is privacy of non-output matches: without it, $m$8 could compare originally sent and later returned values and infer whether another party holds an element even when the threshold is not met (Yang et al., 31 Dec 2025).

OPPRF acts as the equality-gated transfer mechanism. Its functionality is that a sender programs pairs $m$9, a receiver queries $P_0$0, and the receiver obtains $P_0$1 when $P_0$2, otherwise a random-looking value. In ST-OT-MP-PSI, OPPRF is used for conditional share distribution, conditional share collection, and conditional revelation of the OLE index $P_0$3 associated with a matched simple-hash position (Yang et al., 31 Dec 2025).

OLE provides the security-enhancing step. In OLE, the sender inputs $P_0$4, the receiver inputs $P_0$5, and the receiver learns

$P_0$6

The sender learns nothing about $P_0$7, and the receiver learns nothing beyond the linear output. ST-OT-MP-PSI uses OLE so that the refresh term for a share becomes reconstructible by $P_0$8 only when $P_0$9 and another party hold the same element (Yang et al., 31 Dec 2025).

Hashing supplies the protocol’s batching structure. The sender side uses simple hashing, the receiver side uses cuckoo hashing, empty cuckoo bins are filled with dummy elements, and each simple-hash bin is padded to the maximum bin size $S_0$0. This same $S_0$1 determines the number of OLE instances executed per bin (Yang et al., 31 Dec 2025).

3. Protocol workflow

The protocol proceeds in three phases after hashing and padding (Yang et al., 31 Dec 2025).

In the preprocessing stage, each party maps its set into both cuckoo-hashing bins $S_0$2 and simple-hashing bins $S_0$3. Padding hides occupancy. For each element $S_0$4, $S_0$5 generates a random associated secret $S_0$6, then performs $S_0$7-Shamir sharing to obtain

$S_0$8

Using OPPRF, $S_0$9 conditionally distributes $t$0 to $t$1: if $t$2 holds the same element, it receives the correct share; otherwise it receives a random value. Concretely, for each bin $t$3, $t$4 programs

$t$5

and $t$6 queries with

$t$7

The resulting value is denoted $t$8, with $t$9 on equality and random otherwise (Yang et al., 31 Dec 2025).

In the share-update phase, each helper party $$I=\{(e_i,c_i,\{P_j\}) \mid e_i \in S_0,\ c_i \ge t\},$$0 samples a bin-specific degree-$$I=\{(e_i,c_i,\{P_j\}) \mid e_i \in S_0,\ c_i \ge t\},$$1 polynomial with zero constant term,

$$I=\{(e_i,c_i,\{P_j\}) \mid e_i \in S_0,\ c_i \ge t\},$$2

The value $$I=\{(e_i,c_i,\{P_j\}) \mid e_i \in S_0,\ c_i \ge t\},$$3 is sent directly to $$I=\{(e_i,c_i,\{P_j\}) \mid e_i \in S_0,\ c_i \ge t\},$$4, so $$I=\{(e_i,c_i,\{P_j\}) \mid e_i \in S_0,\ c_i \ge t\},$$5’s own refreshed share for $$I=\{(e_i,c_i,\{P_j\}) \mid e_i \in S_0,\ c_i \ge t\},$$6 is

$$I=\{(e_i,c_i,\{P_j\}) \mid e_i \in S_0,\ c_i \ge t\},$$7

The crucial update for other parties is implemented with OLE. For each potential simple-hash position $$I=\{(e_i,c_i,\{P_j\}) \mid e_i \in S_0,\ c_i \ge t\},$$8, $$I=\{(e_i,c_i,\{P_j\}) \mid e_i \in S_0,\ c_i \ge t\},$$9 interacts with $\bot$0 so that $\bot$1 obtains

$\bot$2

and with $\bot$3 so that $\bot$4 obtains

$\bot$5

where

$\bot$6

Summing over all $\bot$7, $\bot$8 gets

$\bot$9

and $n-1$0 gets

$n-1$1

Party $n-1$2 then forms

$n-1$3

This value is sent back conditionally to $n-1$4 through OPPRF, and a second OPPRF reveals the matching OLE index $n-1$5 if the elements are equal (Yang et al., 31 Dec 2025).

In the reconstruction phase, $n-1$6 receives from each $n-1$7 a candidate updated share $n-1$8, then adds the appropriate $n-1$9 determined by the recovered index: $P_0,\dots,P_{n-1}$00 For each $P_0,\dots,P_{n-1}$01, $P_0,\dots,P_{n-1}$02 considers subsets of $P_0,\dots,P_{n-1}$03 shares among its $P_0,\dots,P_{n-1}$04 candidates, always including its own share, reconstructs a degree-$P_0,\dots,P_{n-1}$05 polynomial,

$P_0,\dots,P_{n-1}$06

and accepts iff

$P_0,\dots,P_{n-1}$07

Once such a polynomial is found, holder identification is performed by checking

$P_0,\dots,P_{n-1}$08

If the equality holds, $P_0,\dots,P_{n-1}$09 is identified as a holder of $P_0,\dots,P_{n-1}$10 (Yang et al., 31 Dec 2025).

4. OLE-based cancellation and the meaning of “security-enhanced”

The distinguishing technical idea in ST-OT-MP-PSI is that share refreshing is made contingent on element equality through OLE-based masking. When $P_0,\dots,P_{n-1}$11, the update assembled by $P_0,\dots,P_{n-1}$12 satisfies

$P_0,\dots,P_{n-1}$13

The $P_0,\dots,P_{n-1}$14 term vanishes exactly on equality, and the result becomes the correctly refreshed Shamir share. If $P_0,\dots,P_{n-1}$15, the residual term remains and the value is random-looking rather than a valid share (Yang et al., 31 Dec 2025).

This construction is presented as the remedy to the collusion weakness of ET-OT-MP-PSI. In ET-OT-MP-PSI, the updated share for an honest $P_0,\dots,P_{n-1}$16 has the direct form

$P_0,\dots,P_{n-1}$17

which allows colluding parties to test whether the OPPRF output equals

$P_0,\dots,P_{n-1}$18

The paper’s claim is that this inference attack limits ET-OT-MP-PSI to security against at most $P_0,\dots,P_{n-1}$19 semi-honest colluding parties. ST-OT-MP-PSI removes that direct test by splitting the update into a piece bound to $P_0,\dots,P_{n-1}$20’s element and a piece bound to $P_0,\dots,P_{n-1}$21’s element, with correctness recovered only when the elements are equal (Yang et al., 31 Dec 2025).

The resulting security theorem is that ST-OT-MP-PSI realizes $P_0,\dots,P_{n-1}$22 and is secure against collusion among up to $P_0,\dots,P_{n-1}$23 parties in the semi-honest model. The proof is simulation-based and treats two cases: first, $P_0,\dots,P_{n-1}$24 honest and all others corrupted; second, exactly one $P_0,\dots,P_{n-1}$25 honest and all others, including $P_0,\dots,P_{n-1}$26, corrupted. In the first case, the simulator uses random OPPRF outputs, random OLE inputs and outputs, and the fact that the corrupted parties see no output from $P_0,\dots,P_{n-1}$27. In the second case, the simulator is given the final output $P_0,\dots,P_{n-1}$28, simulates random values when an honest party’s element should remain hidden, and reconstructs the correct OPPRF and OLE-index outputs only for elements legitimately revealed by the ideal functionality (Yang et al., 31 Dec 2025).

Correctness is likewise threshold-sensitive. If $P_0,\dots,P_{n-1}$29 is held by at least $P_0,\dots,P_{n-1}$30 parties, then $P_0,\dots,P_{n-1}$31 receives at least $P_0,\dots,P_{n-1}$32 correct updated shares and reconstructs the secret corresponding to $P_0,\dots,P_{n-1}$33; if fewer than $P_0,\dots,P_{n-1}$34 parties hold $P_0,\dots,P_{n-1}$35, then fewer than $P_0,\dots,P_{n-1}$36 correct shares are available and reconstruction fails with overwhelming probability. This combines threshold detection and holder identification in a single polynomial-consistency test (Yang et al., 31 Dec 2025).

5. Complexity and empirical performance

The principal asymptotic cost of ST-OT-MP-PSI lies in OLE-heavy updating and subset-based reconstruction (Yang et al., 31 Dec 2025).

Communication complexity is reported as

$P_0,\dots,P_{n-1}$37

for the Leader $P_0,\dots,P_{n-1}$38, and

$P_0,\dots,P_{n-1}$39

for each Client $P_0,\dots,P_{n-1}$40. The paper attributes the leader’s quadratic factor to the share-update procedure, which requires $P_0,\dots,P_{n-1}$41 additional OLE protocols and exchange of $P_0,\dots,P_{n-1}$42 ciphertexts (Yang et al., 31 Dec 2025).

Computation complexity is given as

$P_0,\dots,P_{n-1}$43

for the Leader, and

$P_0,\dots,P_{n-1}$44

for each Client. The reconstruction component alone costs

$P_0,\dots,P_{n-1}$45

using the bound

$P_0,\dots,P_{n-1}$46

According to the experimental discussion, runtime grows roughly linearly in set size $P_0,\dots,P_{n-1}$47, the ST share phase grows quadratically in the number of parties $P_0,\dots,P_{n-1}$48 because of OLE, and the reconstruction phase grows exponentially with $P_0,\dots,P_{n-1}$49, peaking near $P_0,\dots,P_{n-1}$50 where $P_0,\dots,P_{n-1}$51 is maximized (Yang et al., 31 Dec 2025).

The implementation was written in C++, using NTL for large-number operations and Shamir sharing, Boost for communication, OPPRF based on the table-based construction of Kolesnikov et al., and OLE from de Castro et al., based on RLWE. Because the OLE code did not support a 128-bit plaintext modulus directly, the implementation represented the modulus as

$P_0,\dots,P_{n-1}$52

for four 32-bit primes $P_0,\dots,P_{n-1}$53. As a consequence, each 128-bit share was decomposed into four residues, and ST-OT-MP-PSI executed four independent OPPRF evaluations per share distribution and reconstruction. Benchmarks were run on an Intel Xeon CPU @ 3.1 GHz, 80 vCores, 192 GB RAM, Ubuntu 22.04, with communication over a local network and no bandwidth or latency constraints (Yang et al., 31 Dec 2025).

Average runtimes over 10 trials were reported as follows for ST-OT-MP-PSI: for $P_0,\dots,P_{n-1}$54, $P_0,\dots,P_{n-1}$55s at $P_0,\dots,P_{n-1}$56 and $P_0,\dots,P_{n-1}$57s at $P_0,\dots,P_{n-1}$58; for $P_0,\dots,P_{n-1}$59, $P_0,\dots,P_{n-1}$60s at $P_0,\dots,P_{n-1}$61 and $P_0,\dots,P_{n-1}$62s at $P_0,\dots,P_{n-1}$63; for $P_0,\dots,P_{n-1}$64, $P_0,\dots,P_{n-1}$65s at $P_0,\dots,P_{n-1}$66 and $P_0,\dots,P_{n-1}$67s at $P_0,\dots,P_{n-1}$68. The paper highlights that for $P_0,\dots,P_{n-1}$69, $P_0,\dots,P_{n-1}$70, and $P_0,\dots,P_{n-1}$71, Mahdavi et al.’s protocol took $P_0,\dots,P_{n-1}$72s while ST-OT-MP-PSI took $P_0,\dots,P_{n-1}$73s, yielding a reported $P_0,\dots,P_{n-1}$74 speedup. For $P_0,\dots,P_{n-1}$75 and $P_0,\dots,P_{n-1}$76, Mahdavi’s share, reconstruction, and total times were $P_0,\dots,P_{n-1}$77s, $P_0,\dots,P_{n-1}$78s, and $P_0,\dots,P_{n-1}$79s, whereas ST’s were $P_0,\dots,P_{n-1}$80s, $P_0,\dots,P_{n-1}$81s, and $P_0,\dots,P_{n-1}$82s, corresponding to a reported $P_0,\dots,P_{n-1}$83 total speedup (Yang et al., 31 Dec 2025).

6. Relation to OT research and principal limitations

In ST-OT-MP-PSI, “OT” denotes over-threshold, not oblivious transfer. This matters because the protocol itself is a traceable threshold MP-PSI construction built from OPPRF, OLE, Shamir sharing, and hashing, whereas separate arXiv lines of work study oblivious transfer as a foundational primitive for PSI-style systems (Yang et al., 31 Dec 2025).

One such line is a 2-round UC-secure oblivious transfer framework in the ROM that is secure against active adaptive adversaries and can be instantiated from any OW-CPA public-key encryption scheme satisfying two structural properties. Its direct relevance to ST-OT-MP-PSI is as a base OT layer for OT extension or UC-style composition, but it does not provide traceability, PSI functionality, multi-party PSI orchestration, set encoding, OPRF design, identifiable abort, blame assignment, transcript adjudication, or participant tracing (Barreto et al., 2017).

A second line develops UC-secure OT from Smooth Projective Hash Functions with Grey Zone, with instantiations from Diffie-Hellman and LWE and a post-quantum OT interpretation in the random-oracle-style setup. The paper is explicitly a foundational OT paper rather than a traceability or PSI paper; it contributes a UC-secure, post-quantum 1-out-of-2 OT building block and the SPHFwG abstraction, but it likewise does not provide traceability, malicious receiver identification, transcript accountability, OT extension, PSI, MP-PSI, or adaptive corruption security (Bettaieb et al., 2022).

These comparisons delimit the scope of ST-OT-MP-PSI. Its contribution is the traceable over-threshold functionality

$P_0,\dots,P_{n-1}$84

together with semi-honest security against collusion among up to $P_0,\dots,P_{n-1}$85 parties. It is not a maliciously secure protocol, and the paper does not claim adaptive security. The functionality is receiver-centric and asymmetric, only $P_0,\dots,P_{n-1}$86 learns the result, and the disclosed elements are restricted to $P_0,\dots,P_{n-1}$87. Reconstruction remains exponential in $P_0,\dots,P_{n-1}$88, the leader bears $P_0,\dots,P_{n-1}$89 communication, and the implementation inherits nontrivial CRT complexity from the OLE backend (Yang et al., 31 Dec 2025).

Within those boundaries, ST-OT-MP-PSI occupies a specific position in the literature: it strengthens collusion resistance for traceable over-threshold MP-PSI by making share refresh conditional on element equality through OLE, while remaining substantially faster than the earlier traceable protocol of Mahdavi et al. under the reported experimental settings (Yang et al., 31 Dec 2025).