---
title: Security-Enhanced Traceable OT-MP-PSI
url: https://www.emergentmind.com/topics/security-enhanced-traceable-ot-mp-psi-st-ot-mp-psi
type: topic
---

# Security-Enhanced Traceable OT-MP-PSI

Security-enhanced Traceable Over-Threshold Multi-Party Private Set Intersection (ST-OT-MP-PSI) is a designated-receiver threshold MP-PSI protocol in which \(n \ge 3\) parties \(P_0,\dots,P_{n-1}\) hold private sets \(S_0,\dots,S_{n-1}\) of size \(m\), and party \(P_0\) learns exactly those elements of \(S_0\) that appear in at least \(t\) parties’ sets, together with the number and identities of the holders. The ideal output is
\[
I=\{(e_i,c_i,\{P_j\}) \mid e_i \in S_0,\ c_i \ge t\},
\]
while all other parties output \(\bot\). The protocol was introduced as the stronger of two traceable over-threshold MP-PSI constructions, with its defining property being semi-honest security against collusion among up to \(n-1\) parties, achieved by combining conditional Shamir secret sharing, OPPRF, and an OLE-based share-update mechanism [2512.24652].

## 1. Functionality, semantics, and problem model

ST-OT-MP-PSI is formulated for threshold MP-PSI rather than ordinary all-party intersection. For an element \(e\), the protocol uses
\[
c_e = |\{\, P_j : e \in S_j \,\}|
\]
to denote the number of parties holding \(e\), and it discloses \(e\) iff \(c_e \ge t\). The “traceable” component is that the receiver learns not only that an element satisfies the threshold, but also the full holder set
\[
\{P_j : e \in S_j\}.
\]
Because the holder identities are revealed, the count \(c_e\) is revealed as well [2512.24652].

The protocol is asymmetric. Only \(P_0\) receives the result, and the functionality is explicitly restricted to elements of \(P_0\)’s set:
\[
e_i \in S_0.
\]
Accordingly, the construction is not a symmetric threshold intersection over the union of all parties’ sets. The paper’s complexity discussion correspondingly designates \(P_0\) as the Leader and the other participants as Clients [2512.24652].

The data model assumes that elements can be encoded in a field suitable for Shamir sharing and OLE. In the implementation, elements are 128-bit values, and the finite field is over a large modulus \(p\) chosen to accommodate 128-bit elements. The motivating applications emphasized for this functionality are network anomaly detection, digital forensics investigation, and suspicious account or anti-money-laundering analysis, all of which benefit from revealing both the qualifying element and the parties that hold it [2512.24652].

A common misconception is to equate traceability here with a general public-accountability notion. In this protocol family, traceability means that \(P_0\) can identify the holder set for each disclosed over-threshold element. The paper does not separately formalize “traceability,” “soundness,” “robustness,” or “reliability” as named definitions [2512.24652].

## 2. Cryptographic structure and constituent primitives

ST-OT-MP-PSI is built from four main components: Shamir secret sharing, zero-secret share refresh, OPPRF, and OLE, together with simple hashing and cuckoo hashing for binning [2512.24652].

Shamir’s \((t,n)\)-secret sharing is used in its standard degree-\((t-1)\) form. For a secret \(S\), the dealer samples
\[
f(x)=S+a_1x+\dots+a_{t-1}x^{t-1},
\]
assigns shares \((x_i,y_i)\) with
\[
y_i=f(x_i), \qquad x_i=i+1,
\]
and reconstructs with Lagrange interpolation:
\[
S=f(0)=\sum_{i=0}^{t-1} y_i \prod_{j=0, j\neq i}^{t-1} \left(\frac{x_j}{x_j-x_i}\right).
\]
In ST-OT-MP-PSI, \(P_0\) does not share the element \(e_k^0\) itself. It shares a fresh random value \(e_k^{0'}\) associated uniquely with \(e_k^0\). The paper states that this change prevents \(t\) colluding parties from reconstructing and learning \(P_0\)’s elements directly from shares [2512.24652].

Zero-secret sharing is used to refresh shares without changing the underlying secret. Each updating party samples
\[
f'(x)=0+b_1x+\dots+b_{t-1}x^{t-1},
\]
so adding \(f'(x_i)\) to an existing share preserves the same constant term. The stated role of this refresh is privacy of non-output matches: without it, \(P_0\) could compare originally sent and later returned values and infer whether another party holds an element even when the threshold is not met [2512.24652].

OPPRF acts as the equality-gated transfer mechanism. Its functionality is that a sender programs pairs \(\{(x_j,y_j)\}\), a receiver queries \(\{q_i\}\), and the receiver obtains \(y_j\) when \(q_i=x_j\), otherwise a random-looking value. In ST-OT-MP-PSI, OPPRF is used for conditional share distribution, conditional share collection, and conditional revelation of the OLE index \(v\) associated with a matched simple-hash position [2512.24652].

OLE provides the security-enhancing step. In OLE, the sender inputs \(a,b \in \mathbb F\), the receiver inputs \(x \in \mathbb F\), and the receiver learns
\[
y=ax+b.
\]
The sender learns nothing about \(x\), and the receiver learns nothing beyond the linear output. ST-OT-MP-PSI uses OLE so that the refresh term for a share becomes reconstructible by \(P_0\) only when \(P_0\) and another party hold the same element [2512.24652].

Hashing supplies the protocol’s batching structure. The sender side uses simple hashing, the receiver side uses cuckoo hashing, empty cuckoo bins are filled with dummy elements, and each simple-hash bin is padded to the maximum bin size \(\beta\). This same \(\beta\) determines the number of OLE instances executed per bin [2512.24652].

## 3. Protocol workflow

The protocol proceeds in three phases after hashing and padding [2512.24652].

In the preprocessing stage, each party maps its set into both cuckoo-hashing bins \(B_C[\cdot]\) and simple-hashing bins \(B_S[\cdot]\). Padding hides occupancy. For each element \(e_k^0 \in S_0\), \(P_0\) generates a random associated secret \(e_k^{0'}\), then performs \((t,n)\)-Shamir sharing to obtain
\[
s_k^{0,0}, s_k^{0,1}, \dots, s_k^{0,n-1}.
\]
Using OPPRF, \(P_0\) conditionally distributes \(s_k^{0,i}\) to \(P_i\): if \(P_i\) holds the same element, it receives the correct share; otherwise it receives a random value. Concretely, for each bin \(b\), \(P_0\) programs
\[
\{(e_k^0, s_k^{0,i}) \mid e_k^0 \in B_S[b]\},
\]
and \(P_i\) queries with
\[
\{e_k^i \mid e_k^i \in B_C[b]\}.
\]
The resulting value is denoted \(\hat s_k^{0,i}\), with \(\hat s_k^{0,i}=s_k^{0,i}\) on equality and random otherwise [2512.24652].

In the share-update phase, each helper party \(P_j\) samples a bin-specific degree-\((t-1)\) polynomial with zero constant term,
\[
f_{j,b}(x).
\]
The value \(f_{j,b}(1)\) is sent directly to \(P_0\), so \(P_0\)’s own refreshed share for \(e_k^0 \in B_C[b]\) is
\[
y_k^0 = s_k^{0,0} + f_{1,b}(1)+\cdots+f_{n-1,b}(1).
\]
The crucial update for other parties is implemented with OLE. For each potential simple-hash position \(v \in [\beta]\), \(P_j\) interacts with \(P_0\) so that \(P_0\) obtains
\[
e_k^0 \cdot r_j^v + a_j^{0,v},
\]
and with \(P_i\) so that \(P_i\) obtains
\[
e_k^i \cdot (-r_j^v) + a_j^{1,v},
\]
where
\[
a_j^{0,v} + a_j^{1,v} = f_{j,b}(i+1).
\]
Summing over all \(j\), \(P_0\) gets
\[
z_0^v = (r_1^v+\cdots+r_{n-1}^v)\cdot e_k^0 + (a_1^{0,v}+\cdots+a_{n-1}^{0,v}),
\]
and \(P_i\) gets
\[
z_1^v = -(r_1^v+\cdots+r_{n-1}^v)\cdot e_k^i + (a_1^{1,v}+\cdots+a_{n-1}^{1,v}).
\]
Party \(P_i\) then forms
\[
\mu_k^{0,i} = \hat s_k^{0,i} + z_1^v.
\]
This value is sent back conditionally to \(P_0\) through OPPRF, and a second OPPRF reveals the matching OLE index \(v\) if the elements are equal [2512.24652].

In the reconstruction phase, \(P_0\) receives from each \(P_i\) a candidate updated share \(y_k^i\), then adds the appropriate \(z_0^{v'}\) determined by the recovered index:
\[
y_k^i = \mu_k^{0,i} + z_0^{v'}.
\]
For each \(e_k^0\), \(P_0\) considers subsets of \(t\) shares among its \(n\) candidates, always including its own share, reconstructs a degree-\((t-1)\) polynomial,
\[
Recon(y_k^i)=f_k(\cdot),
\]
and accepts iff
\[
f_k(0) = e_k^{0'}.
\]
Once such a polynomial is found, holder identification is performed by checking
\[
f_k(i+1)=y_k^i.
\]
If the equality holds, \(P_i\) is identified as a holder of \(e_k^0\) [2512.24652].

## 4. OLE-based cancellation and the meaning of “security-enhanced”

The distinguishing technical idea in ST-OT-MP-PSI is that share refreshing is made contingent on element equality through OLE-based masking. When \(e_k^0=e_k^i\), the update assembled by \(P_0\) satisfies
\[
\begin{aligned}
y_k^i &= s_k^{0,i} + z_1^v + z_0^v \\
&= s_k^{0,i} + (r_1^v+\cdots+r_{n-1}^v)(e_k^0-e_k^i)
   + \sum_{j=1}^{n-1}(a_j^{0,v}+a_j^{1,v}) \\
&= s_k^{0,i} + \sum_{j=1}^{n-1} f_{j,b}(i+1).
\end{aligned}
\]
The \((r_1^v+\cdots+r_{n-1}^v)(e_k^0-e_k^i)\) term vanishes exactly on equality, and the result becomes the correctly refreshed Shamir share. If \(e_k^0 \ne e_k^i\), the residual term remains and the value is random-looking rather than a valid share [2512.24652].

This construction is presented as the remedy to the collusion weakness of ET-OT-MP-PSI. In ET-OT-MP-PSI, the updated share for an honest \(P_i\) has the direct form
\[
y_i' = y_i + f_1(i+1) + \dots + f_{n-1}(i+1), \tag{1}
\]
which allows colluding parties to test whether the OPPRF output equals
\[
x_i + f_1(i+1)+\dots+f_{n-1}(i+1). \tag{2}
\]
The paper’s claim is that this inference attack limits ET-OT-MP-PSI to security against at most \(t-2\) semi-honest colluding parties. ST-OT-MP-PSI removes that direct test by splitting the update into a piece bound to \(P_0\)’s element and a piece bound to \(P_i\)’s element, with correctness recovered only when the elements are equal [2512.24652].

The resulting security theorem is that ST-OT-MP-PSI realizes \(\mathcal{F}_{\text{T-OT-MP-PSI}^{n,m,t}}\) and is secure against collusion among up to \(n-1\) parties in the semi-honest model. The proof is simulation-based and treats two cases: first, \(P_0\) honest and all others corrupted; second, exactly one \(P_i\) honest and all others, including \(P_0\), corrupted. In the first case, the simulator uses random OPPRF outputs, random OLE inputs and outputs, and the fact that the corrupted parties see no output from \(P_0\). In the second case, the simulator is given the final output \(I\), simulates random values when an honest party’s element should remain hidden, and reconstructs the correct OPPRF and OLE-index outputs only for elements legitimately revealed by the ideal functionality [2512.24652].

Correctness is likewise threshold-sensitive. If \(e_k^0\) is held by at least \(t\) parties, then \(P_0\) receives at least \(t\) correct updated shares and reconstructs the secret corresponding to \(e_k^0\); if fewer than \(t\) parties hold \(e_k^0\), then fewer than \(t\) correct shares are available and reconstruction fails with overwhelming probability. This combines threshold detection and holder identification in a single polynomial-consistency test [2512.24652].

## 5. Complexity and empirical performance

The principal asymptotic cost of ST-OT-MP-PSI lies in OLE-heavy updating and subset-based reconstruction [2512.24652].

Communication complexity is reported as
\[
O(n^2 m \lambda)
\]
for the Leader \(P_0\), and
\[
O(n m \lambda)
\]
for each Client \(P_i\). The paper attributes the leader’s quadratic factor to the share-update procedure, which requires \(n^2 m_b\) additional OLE protocols and exchange of \(O(n^2 m\lambda)\) ciphertexts [2512.24652].

Computation complexity is given as
\[
O\!\left(
\max\left\{
t^2\left(\frac{e(n-1)}{t-1}\right)^{t-1},
n^2\lambda,
n\kappa
\right\} m
\right)
\]
for the Leader, and
\[
O\!\left(
\max\{\kappa, nt\lambda\} m
\right)
\]
for each Client. The reconstruction component alone costs
\[
O\!\left(m t^2 \binom{n-1}{t-1}\right),
\]
using the bound
\[
\binom{n-1}{t-1} \le \left(\frac{e(n-1)}{t-1}\right)^{t-1}.
\]
According to the experimental discussion, runtime grows roughly linearly in set size \(m\), the ST share phase grows quadratically in the number of parties \(n\) because of OLE, and the reconstruction phase grows exponentially with \(t\), peaking near \(t \approx (n+1)/2\) where \(\binom{n-1}{t-1}\) is maximized [2512.24652].

The implementation was written in C++, using NTL for large-number operations and Shamir sharing, Boost for communication, OPPRF based on the table-based construction of Kolesnikov et al., and OLE from de Castro et al., based on RLWE. Because the OLE code did not support a 128-bit plaintext modulus directly, the implementation represented the modulus as
\[
p = \prod_{i=0}^{3} p_i
\]
for four 32-bit primes \(p_i\). As a consequence, each 128-bit share was decomposed into four residues, and ST-OT-MP-PSI executed four independent OPPRF evaluations per share distribution and reconstruction. Benchmarks were run on an Intel Xeon CPU @ 3.1 GHz, 80 vCores, 192 GB RAM, Ubuntu 22.04, with communication over a local network and no bandwidth or latency constraints [2512.24652].

Average runtimes over 10 trials were reported as follows for ST-OT-MP-PSI: for \(m=2^{12}\), \(14.67\)s at \((n,t)=(5,3)\) and \(60.04\)s at \((10,5)\); for \(m=2^{14}\), \(53.22\)s at \((5,3)\) and \(229.09\)s at \((10,5)\); for \(m=2^{16}\), \(207.78\)s at \((5,3)\) and \(903.28\)s at \((10,5)\). The paper highlights that for \(n=5\), \(t=3\), and \(m=2^{14}\), Mahdavi et al.’s protocol took \(26800.44\)s while ST-OT-MP-PSI took \(53.02\)s, yielding a reported \(505\times\) speedup. For \((n,t)=(10,5)\) and \(m=2^7\), Mahdavi’s share, reconstruction, and total times were \(672.90\)s, \(3165.06\)s, and \(3837.96\)s, whereas ST’s were \(5.79\)s, \(0.23\)s, and \(6.02\)s, corresponding to a reported \(637\times\) total speedup [2512.24652].

## 6. Relation to OT research and principal limitations

In ST-OT-MP-PSI, “OT” denotes **over-threshold**, not oblivious transfer. This matters because the protocol itself is a traceable threshold MP-PSI construction built from OPPRF, OLE, Shamir sharing, and hashing, whereas separate arXiv lines of work study oblivious transfer as a foundational primitive for PSI-style systems [2512.24652].

One such line is a 2-round UC-secure oblivious transfer framework in the ROM that is secure against active adaptive adversaries and can be instantiated from any OW-CPA public-key encryption scheme satisfying two structural properties. Its direct relevance to ST-OT-MP-PSI is as a base OT layer for OT extension or UC-style composition, but it does **not** provide traceability, PSI functionality, multi-party PSI orchestration, set encoding, OPRF design, identifiable abort, blame assignment, transcript adjudication, or participant tracing [1710.08256].

A second line develops UC-secure OT from Smooth Projective Hash Functions with Grey Zone, with instantiations from Diffie-Hellman and LWE and a post-quantum OT interpretation in the random-oracle-style setup. The paper is explicitly a foundational OT paper rather than a traceability or PSI paper; it contributes a UC-secure, post-quantum 1-out-of-2 OT building block and the SPHFwG abstraction, but it likewise does **not** provide traceability, malicious receiver identification, transcript accountability, OT extension, PSI, MP-PSI, or adaptive corruption security [2209.04149].

These comparisons delimit the scope of ST-OT-MP-PSI. Its contribution is the traceable over-threshold functionality
\[
I=\{(e_i,c_i,\{P_j\}) \mid e_i \in S_0,\ c_i \ge t\}
\]
together with semi-honest security against collusion among up to \(n-1\) parties. It is not a maliciously secure protocol, and the paper does not claim adaptive security. The functionality is receiver-centric and asymmetric, only \(P_0\) learns the result, and the disclosed elements are restricted to \(S_0\). Reconstruction remains exponential in \(t\), the leader bears \(O(n^2 m\lambda)\) communication, and the implementation inherits nontrivial CRT complexity from the OLE backend [2512.24652].

Within those boundaries, ST-OT-MP-PSI occupies a specific position in the literature: it strengthens collusion resistance for traceable over-threshold MP-PSI by making share refresh conditional on element equality through OLE, while remaining substantially faster than the earlier traceable protocol of Mahdavi et al. under the reported experimental settings [2512.24652].

Source: https://www.emergentmind.com/topics/security-enhanced-traceable-ot-mp-psi-st-ot-mp-psi