Need help with libOTe?
Click the “chat” button below for chat support from the developer who created it, or find similar developers for support.

About the developer

144 Stars 35 Forks The Unlicense 455 Commits 4 Opened issues


A fast, portable, and easy to use Oblivious Transfer Library

Services available


Need anything else?

Contributors list

A fast and portable C++14 library for Oblivious Transfer extension (OTe). The primary design goal of this library to obtain high performance while being easy to use. This library currently implements:

  • The semi-honest 1-out-of-2 OT [IKNP03].
  • The semi-honest 1-out-of-2 Silent OT [BCGIKRS19].
  • The semi-honest 1-out-of-2 Delta-OT [IKNP03],[BLNNOOSS15].
  • The semi-honest 1-out-of-N OT [KKRT16].
  • The malicious secure 1-out-of-2 OT [KOS15].
  • The malicious secure 1-out-of-2 Delta-OT [KOS15],[BLNNOOSS15].
  • The malicious secure 1-out-of-N OT [OOS16].
  • The malicious secure approximate K-out-of-N OT [RR16].
  • The malicious secure 1-out-of-2 base OT [NP01].
  • The malicious secure 1-out-of-2 base OT [CO15] (Faster Linux ASM version disabled by default).
  • The malicious secure 1-out-of-2 base OT [MR19]


This library provides several different classes of OT protocols. First is the base OT protocol of Naor Pinkas [NP01]. This protocol bootstraps all the other OT extension protocols. Within the OT extension protocols, we have 1-out-of-2, 1-out-of-N and K-out-of-N, both in the semi-honest and malicious settings.

All implementations are highly optimized using fast SSE instructions and vectorization to obtain optimal performance both in the single and multi-threaded setting. See the Performance section for a comparison between protocols and to other libraries.

Networking can be performed using both the sockets provided by the library and external socket classes. See the networking tutorial for an example.

Example Code

A minimal working example showing how to perform

OTs using the IKNP protocol. ```cpp void minimal() { // Setup networking. See cryptoTools\frontend_cryptoTools\Tutorials\Network.cpp IOService ios; Channel senderChl = Session(ios, "localhost:1212", SessionMode::Server).addChannel(); Channel recverChl = Session(ios, "localhost:1212", SessionMode::Client).addChannel();
// The number of OTs.
int n = 100;

// The code to be run by the OT receiver. auto recverThread = std::thread(& { PRNG prng(sysRandomSeed()); IknpOtExtReceiver recver;

// Choose which messages should be received.
BitVector choices(n);
choices[0] = 1;

// Receive the messages
std::vector<block> messages(n);
recver.receiveChosen(choices, messages, prng, recverChl);

// messages[i] = sendMessages[i][choices[i]];


PRNG prng(sysRandomSeed()); IknpOtExtSender sender;

// Choose which messages should be sent. std::vector<:array>> sendMessages(n); sendMessages[0] = { toBlock(54), toBlock(33) }; //...

// Send the messages. sender.sendChosen(sendMessages, prng, senderChl); recverThread.join(); </:array>

} ```


The running time in seconds for computing n=224 OTs on a single Intel Xeon server (

2 36-cores Intel Xeon CPU E5-2699 v3 @ 2.30GHz and 256GB of RAM
) as of 11/16/2016. All timings shown reflect a "single" thread per party, with the expection that network IO in libOTe is performed in the background by a separate thread.

| Type | Security | Protocol | libOTe (SHA1/AES) | Encrypto Group (SHA256) | Apricot (AES-hash) | OOS16 (blake2) | emp-toolkit (AES-hash) | |--------------------- |----------- |-------------- |---------------- |---------------- |--------- |--------- |------------ | | 1-out-of-N (N=276) | malicious | OOS16 | 10.6 / 9.2 | ~ | ~ | 24** | ~ | | 1-out-of-N (N=2128)| passive| KKRT16 | 9.2 / 6.7 | ~ | ~ | ~ | ~ | | 1-out-of-2 Delta-OT | malicious | KOS15 | 1.9* | ~ | ~ | ~ | ~ | | 1-out-of-2 Delta-OT | passive | KOS15 | 1.7* | ~ | ~ | ~ | ~ | | 1-out-of-2 | malicious | ALSZ15 | ~ | 17.3 | ~ | ~ | 10 | | 1-out-of-2 | malicious | KOS15 | 3.9 / 0.7 | ~ | 1.1 | ~ | 2.9 | | 1-out-of-2 | passive | IKNP03 | 3.7 / 0.6 | 11.3 | 0.6 | ~ | 2.7 | | 1-out-of-2 Base | malicious | CO15 | 1,592/~ | ~ |~ | ~ | ~ | | 1-out-of-2 Base | malicious | NP00 | 12,876/~ | ~ | ~ | ~ | ~ |


The library is cross platform and has been tested on Windows, Mac and Linux. There is one mandatory dependency on Boost 1.69 (networking), and three optional dependencies on, Miracl, Relic or SimplestOT (Unix only) for Base OTs. Any or all of these dependenies can be enabled. See below.



, this will set up the project
git clone --recursive
cd libOTe/cryptoTools/thirdparty/win
cd ../../..

Not all protocols will be built by default. Which protocol are built is controlled by the

file. Manually edit this file to enable the desired protocol.

To see all the command line options, execute the program


Boost and visual studio 2017: If boost does not build with visual studio 2017 follow these instructions.

Enabling Relic (for base OTs): * Build the library in the folder next libOTe (i.e. share the same parent directory):

git clone
cd relic
cmake --build .
cmake --install .
* Edit the config file libOTe/cryptoTools/cryptoTools/Common/config.h to include

Linux / Mac

In short, this will build the project

git clone --recursive
cd libOTe/cryptoTools/thirdparty/linux
bash boost.get
cd ../../..


should be replaced by
depending on which protocol(s) should be enabled. See the output of
cmake .
for a complete list. You will also need to enable one one of the base OT protocols (see below). The libraries will be placed in
and the binary
will be placed in
To see all the command line options, execute the program


Enable Base OTs using: *

: Build the library with integration to the Relic library. Requires that relic is built with
and installed. * Linux Only:
: Build the library with integration to the SimplestOT library implementing a base OT.

Other Options: Several other compile time options exists. See the output of

cmake .
for a complete list.

Note: In the case boost is already installed, the steps

cd libOTe/cryptoTools/thirdparty/linux; bash boost.get
can be skipped and CMake will attempt to find them instead. Boost is found with the CMake findBoost package and miracl is found with the
command. If there is a version mismatch then you will still need to run the provided boost build script.


You can either

make install
on linux or link libOTe's source tree. In the latter case, you will need to include the following:

1) .../libOTe 2) .../libOTe/cryptoTools 3) .../libOTe/cryptoTools/thirdparty/linux/boost 4) .../libOTe/cryptoTools/thirdparty/linux/miracl/miracl (if enabled) 5) [Relic includes] (if enabled)

and link: 1) .../libOTe/bin/liblibOTe.a 2) .../libOTe/bin/libcryptoTools.a 3) .../libOTe/bin/libSimplestOT.a (if enabled) 3) .../libOTe/bin/libKyberOT.a (if enabled) 4) .../libOTe/cryptoTools/thirdparty/linux/boost/stage/lib/libboostsystem.a 5) .../libOTe/cryptoTools/thirdparty/linux/boost/stage/lib/libboostthread.a 6) .../libOTe/cryptoTools/thirdparty/linux/miracl/miracl/source/libmiracl.a (if enabled) 7) [Relic binary] (if enabled)

Note: On windows the linking paths follow a similar pattern.


Contact Peter Rindal [email protected] for any assistance on building or running the library.


Spread the word!

    author = {Peter Rindal},
    title = {{libOTe: an efficient, portable, and easy to use Oblivious Transfer Library}},
    howpublished = {\url{}},

## License

This project has been placed in the public domain. As such, you are unrestricted in how you use it, commercial or otherwise. However, no warranty of fitness is provided. If you found this project helpful, feel free to spread the word and cite us.


[IKNP03] - Yuval Ishai and Joe Kilian and Kobbi Nissim and Erez Petrank, Extending Oblivious Transfers Efficiently.

[KOS15] - Marcel Keller and Emmanuela Orsini and Peter Scholl, Actively Secure OT Extension with Optimal Overhead. eprint/2015/546

[OOS16] - Michele Orrù and Emmanuela Orsini and Peter Scholl, Actively Secure 1-out-of-N OT Extension with Application to Private Set Intersection. eprint/2016/933

[KKRT16] - Vladimir Kolesnikov and Ranjit Kumaresan and Mike Rosulek and Ni Trieu, Efficient Batched Oblivious PRF with Applications to Private Set Intersection. eprint/2016/799

[RR16] - Peter Rindal and Mike Rosulek, Improved Private Set Intersection against Malicious Adversaries. eprint/2016/746

[BLNNOOSS15] - Sai Sheshank Burra and Enrique Larraia and Jesper Buus Nielsen and Peter Sebastian Nordholt and Claudio Orlandi and Emmanuela Orsini and Peter Scholl and Nigel P. Smart, High Performance Multi-Party Computation for Binary Circuits Based on Oblivious Transfer. eprint/2015/472

[ALSZ15] - Gilad Asharov and Yehuda Lindell and Thomas Schneider and Michael Zohner, More Efficient Oblivious Transfer Extensions with Security for Malicious Adversaries. eprint/2015/061

[NP01] - Moni Naor, Benny Pinkas, Efficient Oblivious Transfer Protocols.

We use cookies. If you continue to browse the site, you agree to the use of cookies. For more information on our use of cookies please see our Privacy Policy.