DETAILED ACTION
Notice of Pre-AIA or AIA Status
The present application, filed on or after March 16, 2013, is being examined under the first inventor to file provisions of the AIA .
Claims, 1, 5, 12, 14-18, 20 have been amended. Claims 3-4, 6, 8-11, 13 have been canceled. Claims 21-26 are new.
Claims 1-2, 5, 7, 12, 14-26 are pending.
Response to Arguments
Applicant's arguments filed June 24, 2026 have been fully considered but they are not persuasive.
It is noted by the Examiner that the Applicant states on page 12 of Remarks “In this Amendment, claims 1, 12, 15-18, and 20 are amended, claims 4-5, 7-8, and 11 are canceled, and claims 21-26 are added, so that claims 1-2, 6, 9-10, 12, and 14-26 are pending.” This is different from the claims submitted on June 24, 2026 in which claims 3-4, 6, 8-11, 13 have been canceled, and claims 1-2, 5, 7, 12, 14-26 are pending.
On page 15 of Remarks, Applicant argues that “Dependent claim 13 is not rejected over Tzeng in the 102 or 103 rejection. As such, independent claim 12 is amended so that it includes the limitation in dependent claim 13. Dependent claim 13 is canceled. All claims depending on independent claim 12 should now be allowable as well.” Examiner respectfully disagrees; claim 13 was not rejected in the previous non-final rejection as it was canceled in the preliminary amendment along with Claim 3.
On pages 14-15 of Remarks, Applicant argues that Tzeng differs from the claimed invention in that “In Tzeng, a fresh, random number
k
i
is chosen independently for each message index
i
by the sender, like the "second random number." However, the "second random number" in the amended claims is used to form for both the first and second obfuscated messages, while Tzeng uses one random
k
i
per message, so each
k
i
is different for different messages.” It is noted by the Examiner that in the previous office action, it was argued that these random numbers can be chosen to be the same for both messages as in Naor et al. (NPL - “Efficient Oblivious Transfer Protocols”, Page 451, Col. 2) and this is permitted by the scope of Tzeng, and this is argued in the rejection below.
On page 15 of Remarks, Applicant argues that “There is further no teaching or suggestion in Tzeng of "wherein the first random number is known only to the sender computer, and the second random number is known only to the receiver computer" in the context of the current claims.” Examiner respectfully disagrees. First of all, this limitation contradicts the Applicant’s own claimed invention. Claim 1 recites that “determining, by the receiver computer, a first random number” in line 5 of Claim 1 and “a second random number determined by the sender computer” in lines 20-21 of Claim 1 on page 2 of Claims. It is unclear how the first and second random numbers can be known only to the sender/receiver computers respectively, when they are determined by the opposite entity. Second, even if this limitation were to be corrected such that the random numbers are determined and known only to their corresponding entity, the context of Tzeng and the claimed invention is oblivious transfer protocols, in which the privacy of parameter choices that the sender/receiver makes is essential. That is, the point of oblivious transfer protocols is preventing either party from receiving information of the other’s choices. For example, in pages 163-164 of Tzeng, Tzeng teaches two theorems regarding the security of information such as the receiver’s choice of
α
and the messages
m
i
where
α
≠
i
. If the first and second random numbers were known outside of their respective entity, i.e.
r
and
k
i
in the context of Tzeng, this would break the privacy of information described by these theorems and open the communication to potential eavesdropping attacks. For this reason, Tzeng strongly suggests that the random numbers generated are known only to their corresponding entity for privacy of communication.
Claim Rejections - 35 USC § 112
The following is a quotation of the first paragraph of 35 U.S.C. 112(a):
(a) IN GENERAL.—The specification shall contain a written description of the invention, and of the manner and process of making and using it, in such full, clear, concise, and exact terms as to enable any person skilled in the art to which it pertains, or with which it is most nearly connected, to make and use the same, and shall set forth the best mode contemplated by the inventor or joint inventor of carrying out the invention.
The following is a quotation of the first paragraph of pre-AIA 35 U.S.C. 112:
The specification shall contain a written description of the invention, and of the manner and process of making and using it, in such full, clear, concise, and exact terms as to enable any person skilled in the art to which it pertains, or with which it is most nearly connected, to make and use the same, and shall set forth the best mode contemplated by the inventor of carrying out his invention.
Claims 1-2, 5, 7, 20-26 are rejected under 35 U.S.C. 112(a) or 35 U.S.C. 112 (pre-AIA ), first paragraph, as failing to comply with the written description requirement. The claim(s) contains subject matter which was not described in the specification in such a way as to reasonably convey to one skilled in the relevant art that the inventor or a joint inventor, or for applications subject to pre-AIA 35 U.S.C. 112, the inventor(s), at the time the application was filed, had possession of the claimed invention.
Regarding Claim 1, the claim recites the additional limitation “wherein the first random number is known only to the sender computer, and the second random number is known only to the receiver computer”. Regarding the first and second random numbers, the specification recites instead that the first random number is determined and known only by the receiver computer (Par. [0010]-[0011]) and that the second random number is determined and known by the sender computer (Par. [0012]). Moreover as argued above, this also contradicts what Claim 1 recites previously: “determining, by the receiver computer, a first random number” in line 5 of Claim 1 and “a second random number determined by the sender computer” in lines 20-21 of Claim 1 on page 2 of Claims. No information is provided in the specification in how the random numbers are known by the opposite entities as recited in the claims versus what is described in the specification beyond what is claimed. That is, no information is provided in which one of ordinary skill in the art could predict for the random numbers to be determined by the opposite computer than the computer which the random number is supposed to be only known to. For this reason, a person of ordinary skill in the art would not view the applicant to have been in possession of the generic subject matter claimed based on the information disclosed in the specification.
Claims 2, 5, 7, 21-26 are rejected for similar reasons as above by virtue of depending upon Claim 1.
Claim 21 is rejected for similar reasons as above as Claim 21 also recites “wherein the first random number is known only to the sender computer, and the second random number is known only to the receiver computer” in a contradictory manner compared to what is recited in the rest of Claim 21 and the specification.
The following is a quotation of 35 U.S.C. 112(b):
(b) CONCLUSION.—The specification shall conclude with one or more claims particularly pointing out and distinctly claiming the subject matter which the inventor or a joint inventor regards as the invention.
The following is a quotation of 35 U.S.C. 112 (pre-AIA ), second paragraph:
The specification shall conclude with one or more claims particularly pointing out and distinctly claiming the subject matter which the applicant regards as his invention.
Claims 1-2, 5, 7, 20-26 are rejected under 35 U.S.C. 112(b) or 35 U.S.C. 112 (pre-AIA ), second paragraph, as being indefinite for failing to particularly point out and distinctly claim the subject matter which the inventor or a joint inventor (or for applications subject to pre-AIA 35 U.S.C. 112, the applicant), regards as the invention.
Claim 1 is rejected under 35 U.S.C. 112(b) or 35 U.S.C. 112 (pre-AIA ), second paragraph, as being incomplete for omitting essential steps, such omission amounting to a gap between the necessary steps. See MPEP § 2172.01. The omitted essential steps are how the first random number is known only to the sender computer and how the second random number is known only to the receiver computer, when each random number is determined by the opposite computer respectively. As argued previously, the lack of written description in the specification, i.e. omission of these steps, prevent one of ordinary skill in the art to predict how to have the random numbers be determined by the opposite computer than the computer which the random number is supposed to be only known to, rendering the scope of the claim indefinite.
Claims 2, 5, 7, 21-26 are rejected for similar reasons as above by virtue of depending upon Claim 1.
Claim 21 is rejected for similar reasons as above as Claim 21 also recites “wherein the first random number is known only to the sender computer, and the second random number is known only to the receiver computer” in a contradictory manner compared to what is recited in the rest of Claim 21 and the specification.
Claim Rejections - 35 USC § 102
In the event the determination of the status of the application as subject to AIA 35 U.S.C. 102 and 103 (or as subject to pre-AIA 35 U.S.C. 102 and 103) is incorrect, any correction of the statutory basis for the rejection will not be considered a new ground of rejection if the prior art relied upon, and the rationale supporting the rejection, would be the same under either status.
The following is a quotation of the appropriate paragraphs of 35 U.S.C. 102 that form the basis for the rejections under this section made in this Office action:
A person shall be entitled to a patent unless –
(a)(1) the claimed invention was patented, described in a printed publication, or in public use, on sale, or otherwise available to the public before the effective filing date of the claimed invention.
Claim 12 is rejected under 35 U.S.C. 102(a)(1) as being anticipated by Tzeng et al. (NPL – “Efficient 1-Out-n Oblivious Transfer Schemes”), hereinafter referred to as “Tzeng”.
For the sake of clarity, the following table is included for reference regarding the differences between Tzeng and the claimed application:
Claims
Specification/Drawings
Tzeng
intermediate group element (also the second oblivious transfer message)
u
=
g
r
*
h
-
b
y
=
g
r
*
h
α
receiver choice bit
b
α
first random number
r
r
first group element
g
g
second group element
h
h
third oblivious transfer message (third group element, first + second obfuscated messages together)
(
v
,
σ
0
,
σ
1
)
c
i
=
g
k
i
,
σ
i
,
i
=
1
,
2
third group element
v
=
g
s
g
k
i
second random number
s
k
i
first obfuscated message
σ
0
=
H
u
s
⊕
m
0
σ
1
=
H
1
y
h
k
1
⊕
m
1
second obfuscated message
σ
1
=
H
(
u
*
h
s
)
⊕
m
1
σ
2
=
H
2
y
h
2
k
2
⊕
m
2
first plaintext message
m
0
m
1
second plaintext message
m
1
m
2
recomputed plaintext message
m
b
=
H
(
v
r
)
⊕
σ
b
m
α
=
H
α
g
k
i
r
⊕
σ
α
Note 1: Tzeng uses 1-indexing while the claimed application uses 0-indexing and are mathematically equivalent using the same indexing system.
Note 2: The second random number
k
i
in Tzeng may vary across indices in generating obfuscated messages. This number however can be chosen to be the same as taught by Naor later below.
Note 3: The receiver choice bit is a negative exponent in the intermediate group element in the claimed invention, but is a positive exponent in Tzeng: these are actually mathematically equivalent in modular arithmetic since h is chosen to be a random number as argued below.
Regarding Claim 12:
Tzeng teaches the following limitations:
A method for obliviously transferring either a first message or a second message to a receiver computer, the method comprising: generating, by a sender computer, a first oblivious transfer message (Introduction, Page 159; Section 2.2).
transmitting, by the sender computer, the first oblivious transfer message to the receiver computer (Section 2.1, Pages 163-164).
wherein the receiver computer determines a first random number, retrieves a receiver choice bit, and generates a second oblivious transfer message based on the first oblivious transfer message, the first random number, and the receiver choice bit, wherein the receiver choice bit is unknown to the sender computer (Section 2.1, Page 163; Section 2.3, Page 164).
receiving, by the sender computer, from the receiver computer, the second oblivious transfer message (Section 2.3, Page 164).
determining, by the sender computer, a second random number (Section 2.1, Pages 162-163; Section 2.3, Pages 164-165).
generating, by the sender computer, a third oblivious transfer message based on the second random number and the second oblivious transfer message, wherein the third oblivious transfer message comprises a first obfuscated message and a second obfuscated message (Section 2.1, Pages 162-163; Section 2.3, Pages 164-165).
and transmitting, by the sender computer, the third oblivious transfer message to the receiver computer, wherein the receiver computer uses the first obfuscated message or the second obfuscated message to generate an output message, wherein the output message comprises either the first message or the second message (Section 2.1, Pages 162-163; Section 2.3, Pages 164-165).
wherein the first oblivious transfer message comprises a first group element and a second group element (Section 2.1, Page 162; Section 2.2, Section 2.2, Page 164).
wherein generating by the sender computer the first group element and the second group element comprises randomly sampling, by the sender computer, the first group element and the second group element from a group [S chooses g and h and sends them to R] (Section 2.1, Page 162; Section 2.2, Page 164).
Claim Rejections - 35 USC § 103
In the event the determination of the status of the application as subject to AIA 35 U.S.C. 102 and 103 (or as subject to pre-AIA 35 U.S.C. 102 and 103) is incorrect, any correction of the statutory basis for the rejection will not be considered a new ground of rejection if the prior art relied upon, and the rationale supporting the rejection, would be the same under either status.
The following is a quotation of 35 U.S.C. 103 which forms the basis for all obviousness rejections set forth in this Office action:
A patent for a claimed invention may not be obtained, notwithstanding that the claimed invention is not identically disclosed as set forth in section 102, if the differences between the claimed invention and the prior art are such that the claimed invention as a whole would have been obvious before the effective filing date of the claimed invention to a person having ordinary skill in the art to which the claimed invention pertains. Patentability shall not be negated by the manner in which the invention was made.
For the sake of compact prosecution, the limitation of “wherein the first random number is known only to the sender computer, and the second random number is known only to the receiver computer” will be interpreted as “wherein the first random number is known only to the receiver computer, and the second random number is known only to the sender computer” in the prior art rejections below.
Claims 1-2, 5, 7, 14-19, 21-26 are rejected under 35 U.S.C. 103 as being obvious under Tzeng et al. (NPL – “Efficient 1-Out-n Oblivious Transfer Schemes”), hereinafter referred to as “Tzeng”, in view of Naor et al. (NPL - “Efficient Oblivious Transfer Protocols”) hereinafter referred to as “Naor”.
Regarding Claim 1:
Tzeng teaches the following limitations:
A method for obliviously transferring either a first plaintext message or a second plaintext message to a receiver computer, the method comprising: receiving, by the receiver computer, from a sender computer, a first oblivious transfer message comprising a first group element and second group element [send parameters g and h] (Introduction, Page 159; Section 2.2, Page 164). Tzeng teaches oblivious transfer protocols, generalizing the 1-out-2 oblivious transfer to the 1-out-n case. The specific case of the 1-out-2 oblivious transfer according to the algorithm of Tzeng is substantially equivalent to the claimed invention. Tzeng teaches a sender transmitting initial parameters as a step 0, i.e. a first oblivious transfer message.
determining, by the receiver computer, a first random number [randomly select r] (Section 2.1, Pages 163-164). Tzeng teaches the receiver picking a random number r.
retrieving, by the receiver computer, a receiver choice bit [R’s choice α], wherein the receiver choice bit is unknown to the sender computer (Section 2.1, Page 163). Tzeng teaches the receiver choosing a message through a parameter α. In the case of the 1-out-2 oblivious transfer, this can only be one of two values, i.e. a choice bit.
generating, by the receiver computer, based on the first oblivious transfer message, the first random number, and the receiver choice bit, a second oblivious transfer message [R sends y] (Section 2.3, Page 164). Tzeng teaches the receiver generating and sending a message, y, which is constructed using the previous parameters.
transmitting, by the receiver computer, to the sender computer, the second oblivious transfer message (Section 2.3, Page 164).
wherein the sender computer generates a third oblivious transfer message using the second oblivious transfer message, wherein the third oblivious transfer message [ci] comprises a first obfuscated message and a second obfuscated message [mi] (Section 2.1, Pages 162-163; Section 2.3, Pages 164-165). Tzeng teaches the sender generating and sending ci values which are constructed from mi values, secrets/messages which are obfuscated using a hash function as in section 2.3.
receiving, by the receiver computer, from the sender computer, the third oblivious transfer message (Section 2.1, Pages 162-163; Section 2.3, Pages 164-165).
and generating, by the receiver computer, an output message by de-obfuscating the first obfuscated message or the second obfuscated message, wherein the output message is equivalent to either the first plaintext message or the plaintext second message [R computes mα] (Section 2.1, Pages 162-163; Section 2.3, Pages 164-165). Tzeng teaches the receiver calculating mα, i.e. the message corresponding to the choice bit.
wherein the first obfuscated message is generated by generating a first hash by inputting an intermediate group element to a power of a second random number determined by the sender computer into a hash function, and computing a bitwise exclusive-or (XOR) of the first hash with the first plaintext message to produce the first obfuscated message [
σ
1
=
H
1
y
h
k
1
⊕
m
1
] (Section 2.1, Pages 162-163; Section 2.3, Pages 164-165). Tzeng teaches using a random exponent k_i. Note that this random number of Tzeng can be the same for both messages, as this is done similarly in Naor (NPL - “Efficient Oblivious Transfer Protocols”, Page 451, Col. 2).
and wherein the second obfuscated message is generated by generating a second hash by inputting a second exponentiated product comprising a product of the intermediate group element and the second group element to a power of the second random number determined by the sender computer into the hash function [
σ
2
=
H
2
y
h
2
k
2
⊕
m
2
] (Section 2.1, Pages 162-163; Section 2.3, Pages 164-165).
and wherein the intermediate group element is determined by determining a product of a first exponentiated group element and a second exponentiated group element [
y
=
g
r
*
h
α
] (Section 2.1, Pages 162-163; Section 2.3, Pages 164-165).
wherein the first exponentiated group element is the first group element with an exponent based on the first random number [
g
r
] and the second exponentiated group element is based on the second group element with an exponent based on the receiver choice bit [
h
α
] (Section 2.1, Pages 162-163; Section 2.3, Pages 164-165).
wherein the first random number is known only to the receiver computer, and the second random number is known only to the sender computer (Theorems 1 & 2, Pages 163-164). As argued above, Tzeng strongly suggests that the random numbers are known only to their respective entities for the sake of privacy in oblivious transfer protocols.
Naor teaches the following limitation:
second random number (Page 451, Col. 2). Naor teaches that a sender can choose the same random number r for both encryptions.
Tzeng teaches a sender generating random numbers through
k
i
, but as addressed by the Applicant’s arguments in Remarks, this random number is indexed and can be different. Naor however shows that it is well known in the art in an oblivious transfer protocol for this random number to be the same across encryptions. Therefore, it would have been obvious to one of ordinary skill in the art before the effective filing date of the claimed invention to modify the second random number of Tzeng, i.e. the exponent
k
i
, to be the same across indices like in Naor in order to gain the predictable result of the second random number being used to generate both the first and second obfuscated message. One of ordinary skill in the art would have recognized that both Tzeng and Naor regard 1 out of 2 oblivious transfer protocols, and that such a modification would have been a predictable implementation by one of ordinary skill in the art, as Naor further describes that reusing such a random number reduces the overhead regarding exponentiation (Page 451, Col. 2).
Regarding Claim 2:
Tzeng teaches the following limitations:
wherein if the receiver choice bit is zero or false, in the method, the receiver computer selects the first obfuscated message (Section 2.1, Pages 162-164; Section 2.3, Pages 164-165). Tzeng teaches the message being selected according to the value of α. While Tzeng uses 1-indexing to describe their algorithm for the 1-out-n oblivious transfer, one of ordinary skill in the art would have recognized that the algorithm of Tzeng is still operable with 0-indexing, and in the specific case of the 1-out-2 oblivious transfer, this corresponds to α being 0 or 1. This is further supported by Naor (Naor, Section 2.3, Page 450).
and wherein if the receiver choice bit is one or true, the receiver computer selects the second obfuscated message, thereby determining a selected obfuscated message, wherein the output message is generated by de-obfuscating the selected obfuscated message (Section 2.1, Pages 162-164; Section 2.3, Pages 164-165).
Regarding Claim 5:
Tzeng teaches the following limitations:
wherein the second oblivious transfer message comprises the intermediate group element (Section 2.1, Pages 162-163; Section 2.3, Pages 164-165). Previously, the value y was drawn to the intermediate group element and the second oblivious transfer message.
and wherein generating, by the receiver computer, the second oblivious transfer message comprises: generating, by the receiver computer, the first exponentiated group element by exponentiating the first group element using the first random number [gr] (Section 2.1, Pages 162-163; Section 2.3, Pages 164-165).
generating, by the receiver computer, the second exponentiated group element by exponentiating the second group element using an additive inverse of the receiver choice bit [hα] (Section 2.1, Pages 162-163; Section 2.3, Pages 164-165). Tzeng teaches exponentiating a group element according to the receiver bit. One of ordinary skill in the art however would have recognized that a group element has a unique corresponding inverse, and as the group elements are randomly chosen, this is mathematically equivalent to what is claimed.
and generating, by the receiver computer, the intermediate group element by determining a product of the first exponentiated group element and the second exponentiated group element (Section 2.1, Pages 162-163; Section 2.3, Pages 164-165). These values are multiplied together in Tzeng.
Regarding Claim 7:
Tzeng teaches the following limitations:
wherein the receiver computer samples the first random number from an interval of integers defined by a prime number and wherein the sender computer samples the second random number from the interval of integers defined by the prime number (Section 2.1, Page 162; Section 2.2).
Regarding Claim 14:
Tzeng teaches the following limitations:
wherein the third oblivious transfer message additionally comprises a third group element, and wherein the method further comprises: generating, by the sender computer, the third group element using the first group element and the second random number [a = gk_i] (Section 2.1, Pages 162-163; Section 2.3, Pages 164-165). Tzeng teaches a third group element in the form of an exponentiated form of g using a random exponent k_i.
generating, by the sender computer, the first obfuscated message using a hash function, an intermediate group element, the second random number, and the first message [
σ
1
=
H
1
y
h
k
1
⊕
m
1
] (Section 2.1, Pages 162-163; Section 2.3, Pages 164-165).
and generating, by the sender computer, the second obfuscated message using the hash function, the intermediate group element, the second group element, the second random number, and the second message, and further [
σ
2
=
H
2
y
h
2
k
2
⊕
m
2
] (Section 2.1, Pages 162-163; Section 2.3, Pages 164-165).
wherein: the second oblivious transfer message comprises the intermediate group element (Section 2.1, Pages 162-163; Section 2.3, Pages 164-165).
the receiver computer generates a first exponentiated group element by exponentiating the first group element using the first random number (Section 2.1, Pages 162-163; Section 2.3, Pages 164-165).
the receiver computer generates a second exponentiated group element by exponentiating the second group element using an additive inverse of the receiver choice bit (Section 2.1, Pages 162-163; Section 2.3, Pages 164-165).
and the receiver computer generates the intermediate group element by computing a product of the first exponentiated group element and the second exponentiated group element (Section 2.1, Pages 162-163; Section 2.3, Pages 164-165).
Naor teaches the following limitation:
second random number (Page 451, Col. 2). Naor teaches that a sender can choose the same random number r for both encryptions.
Tzeng teaches a sender generating random numbers through
k
i
, but as addressed by the Applicant’s arguments in Remarks, this random number is indexed and can be different. Naor however shows that it is well known in the art in an oblivious transfer protocol for this random number to be the same across encryptions. Therefore, it would have been obvious to one of ordinary skill in the art before the effective filing date of the claimed invention to modify the second random number of Tzeng, i.e. the exponent
k
i
, to be the same across indices like in Naor in order to gain the predictable result of the second random number being used to generate both the first and second obfuscated message. One of ordinary skill in the art would have recognized that both Tzeng and Naor regard 1 out of 2 oblivious transfer protocols, and that such a modification would have been a predictable implementation by one of ordinary skill in the art, as Naor further describes that reusing such a random number reduces the overhead regarding exponentiation (Page 451, Col. 2).
Regarding Claim 15:
Tzeng teaches the following limitations:
wherein the third oblivious transfer message additionally comprises a third group element, and wherein the method further comprises: generating, by the sender computer, the third group element using the first group element and the second random number [a = gk_i] (Section 2.1, Pages 162-163; Section 2.3, Pages 164-165).
generating, by the sender computer, the first obfuscated message using a hash function, an intermediate group element, the second random number, and the first message [
σ
1
=
H
1
y
h
k
1
⊕
m
1
] (Section 2.1, Pages 162-163; Section 2.3, Pages 164-165).
and generating, by the sender computer, the second obfuscated message using the hash function, the intermediate group element, the second group element, the second random number, and the second message, and further [
σ
2
=
H
2
y
h
2
k
2
⊕
m
2
] (Section 2.1, Pages 162-163; Section 2.3, Pages 164-165).
wherein the method further comprises: generating, by the sender computer, the third group element by exponentiating the first group element using the second random number (Section 2.1, Pages 162-163; Section 2.3, Pages 164-165).
Naor teaches the following limitation:
second random number (Page 451, Col. 2). Naor teaches that a sender can choose the same random number r for both encryptions.
Tzeng teaches a sender generating random numbers through
k
i
, but as addressed by the Applicant’s arguments in Remarks, this random number is indexed and can be different. Naor however shows that it is well known in the art in an oblivious transfer protocol for this random number to be the same across encryptions. Therefore, it would have been obvious to one of ordinary skill in the art before the effective filing date of the claimed invention to modify the second random number of Tzeng, i.e. the exponent
k
i
, to be the same across indices like in Naor in order to gain the predictable result of the second random number being used to generate both the first and second obfuscated message. One of ordinary skill in the art would have recognized that both Tzeng and Naor regard 1 out of 2 oblivious transfer protocols, and that such a modification would have been a predictable implementation by one of ordinary skill in the art, as Naor further describes that reusing such a random number reduces the overhead regarding exponentiation (Page 451, Col. 2).
Regarding Claim 16:
Tzeng teaches the following limitations:
wherein the third oblivious transfer message additionally comprises a third group element, and wherein the method further comprises: generating, by the sender computer, the third group element using the first group element and the second random number [a = gk_i] (Section 2.1, Pages 162-163; Section 2.3, Pages 164-165).
generating, by the sender computer, the first obfuscated message using a hash function, an intermediate group element, the second random number, and the first message [
σ
1
=
H
1
y
h
k
1
⊕
m
1
] (Section 2.1, Pages 162-163; Section 2.3, Pages 164-165).
and generating, by the sender computer, the second obfuscated message using the hash function, the intermediate group element, the second group element, the second random number, and the second message, and further [
σ
2
=
H
2
y
h
2
k
2
⊕
m
2
] (Section 2.1, Pages 162-163; Section 2.3, Pages 164-165).
wherein the second oblivious transfer message comprises the intermediate group element (Section 2.1, Pages 162-163; Section 2.3, Pages 164-165).
and wherein the method further comprises: exponentiating, by the sender computer, the intermediate group element using the second random number, thereby generating an exponentiated intermediate group element (Section 2.1, Pages 162-163; Section 2.3, Pages 164-165).
generating, by the sender computer, a first hash using the exponentiated intermediate group element and the hash function (Section 2.1, Pages 162-163; Section 2.3, Pages 164-165).
and generating, by the sender computer, the first obfuscated message by computing an XOR of the first hash and the first message (Section 2.1, Pages 162-163; Section 2.3, Pages 164-165).
Naor teaches the following limitation:
second random number (Page 451, Col. 2). Naor teaches that a sender can choose the same random number r for both encryptions.
Tzeng teaches a sender generating random numbers through
k
i
, but as addressed by the Applicant’s arguments in Remarks, this random number is indexed and can be different. Naor however shows that it is well known in the art in an oblivious transfer protocol for this random number to be the same across encryptions. Therefore, it would have been obvious to one of ordinary skill in the art before the effective filing date of the claimed invention to modify the second random number of Tzeng, i.e. the exponent
k
i
, to be the same across indices like in Naor in order to gain the predictable result of the second random number being used to generate both the first and second obfuscated message. One of ordinary skill in the art would have recognized that both Tzeng and Naor regard 1 out of 2 oblivious transfer protocols, and that such a modification would have been a predictable implementation by one of ordinary skill in the art, as Naor further describes that reusing such a random number reduces the overhead regarding exponentiation (Page 451, Col. 2).
Regarding Claim 17:
Tzeng teaches the following limitations:
wherein the third oblivious transfer message additionally comprises a third group element, and wherein the method further comprises: generating, by the sender computer, the third group element using the first group element and the second random number [a = gk_i] (Section 2.1, Pages 162-163; Section 2.3, Pages 164-165).
generating, by the sender computer, the first obfuscated message using a hash function, an intermediate group element, the second random number, and the first message [
σ
1
=
H
1
y
h
k
1
⊕
m
1
] (Section 2.1, Pages 162-163; Section 2.3, Pages 164-165).
and generating, by the sender computer, the second obfuscated message using the hash function, the intermediate group element, the second group element, the second random number, and the second message, and further [
σ
2
=
H
2
y
h
2
k
2
⊕
m
2
] (Section 2.1, Pages 162-163; Section 2.3, Pages 164-165).
wherein the method further comprises: computing, by the sender computer, a product of the intermediate group element and the second group element (Section 2.1, Pages 162-163; Section 2.3, Pages 164-165). As argued in claim 5, as one of ordinary skill in the art would have recognized that a group element uniquely corresponds to an inverse, the product of the group elements as claimed is equivalent to the computation in Tzeng.
generating, by the sender computer, an exponentiated product by exponentiating the product of the intermediate group element and the second group element using the second random number (Section 2.1, Pages 162-163; Section 2.3, Pages 164-165).
generating, by the sender computer, a second hash using the exponentiated product and the hash function (Section 2.1, Pages 162-163; Section 2.3, Pages 164-165).
and generating, by the sender computer, the second obfuscated message by computing an XOR of the second hash and the second message (Section 2.1, Pages 162-163; Section 2.3, Pages 164-165).
Naor teaches the following limitation:
second random number (Page 451, Col. 2). Naor teaches that a sender can choose the same random number r for both encryptions.
Tzeng teaches a sender generating random numbers through
k
i
, but as addressed by the Applicant’s arguments in Remarks, this random number is indexed and can be different. Naor however shows that it is well known in the art in an oblivious transfer protocol for this random number to be the same across encryptions. Therefore, it would have been obvious to one of ordinary skill in the art before the effective filing date of the claimed invention to modify the second random number of Tzeng, i.e. the exponent
k
i
, to be the same across indices like in Naor in order to gain the predictable result of the second random number being used to generate both the first and second obfuscated message. One of ordinary skill in the art would have recognized that both Tzeng and Naor regard 1 out of 2 oblivious transfer protocols, and that such a modification would have been a predictable implementation by one of ordinary skill in the art, as Naor further describes that reusing such a random number reduces the overhead regarding exponentiation (Page 451, Col. 2).
Regarding Claim 18:
Tzeng teaches the following limitations:
wherein the third oblivious transfer message additionally comprises a third group element, and wherein the method further comprises: generating, by the sender computer, the third group element using the first group element and the second random number [a = gk_i] (Section 2.1, Pages 162-163; Section 2.3, Pages 164-165).
generating, by the sender computer, the first obfuscated message using a hash function, an intermediate group element, the second random number, and the first message [
σ
1
=
H
1
y
h
k
1
⊕
m
1
] (Section 2.1, Pages 162-163; Section 2.3, Pages 164-165).
and generating, by the sender computer, the second obfuscated message using the hash function, the intermediate group element, the second group element, the second random number, and the second message, and further [
σ
2
=
H
2
y
h
2
k
2
⊕
m
2
] (Section 2.1, Pages 162-163; Section 2.3, Pages 164-165).
wherein: the receiver computer generates a third hash using the first random number, the third group element, and the hash function (Section 2.1, Pages 162-163; Section 2.3, Pages 164-165)
and the receiver computer generates the output message by computing an XOR of the first obfuscated message and/or the second obfuscated message and the third hash (Section 2.1, Pages 162-163; Section 2.3, Pages 164-165).
Naor teaches the following limitation:
second random number (Page 451, Col. 2). Naor teaches that a sender can choose the same random number r for both encryptions.
Tzeng teaches a sender generating random numbers through
k
i
, but as addressed by the Applicant’s arguments in Remarks, this random number is indexed and can be different. Naor however shows that it is well known in the art in an oblivious transfer protocol for this random number to be the same across encryptions. Therefore, it would have been obvious to one of ordinary skill in the art before the effective filing date of the claimed invention to modify the second random number of Tzeng, i.e. the exponent
k
i
, to be the same across indices like in Naor in order to gain the predictable result of the second random number being used to generate both the first and second obfuscated message. One of ordinary skill in the art would have recognized that both Tzeng and Naor regard 1 out of 2 oblivious transfer protocols, and that such a modification would have been a predictable implementation by one of ordinary skill in the art, as Naor further describes that reusing such a random number reduces the overhead regarding exponentiation (Page 451, Col. 2).
Regarding Claim 19:
Tzeng teaches the following limitations:
wherein: the receiver computer generates an exponentiated third group element by exponentiating the third group element using the first random number (Section 2.1, Pages 162-163; Section 2.3, Pages 164-165).
and the receiver computer generates the third hash using the exponentiated third group element and the hash function (Section 2.1, Pages 162-163; Section 2.3, Pages 164-165).
Regarding Claim 21:
Tzeng teaches the following limitations:
wherein the sender computer generates the first group element and the second group element by randomly sampling the first group element and the second group element from a group (Section 2.1, Page 162; Section 2.2). Tzeng teaches these parameters being chosen from the group.
Regarding Claim 22:
Tzeng teaches the following limitations:
wherein the group is a cyclic group defined by a prime number (Section 2.1, Page 162; Section 2.2). The group corresponds to a prime number q, making the group cyclic.
Regarding Claim 23:
Tzeng teaches the following limitations:
wherein the exponent based on the receiver choice bit is an additive inverse of the receiver choice bit [hα] (Section 2.1, Pages 162-163; Section 2.3, Pages 164-165). Tzeng teaches exponentiating a group element according to the receiver bit. One of ordinary skill in the art however would have recognized that a group element has a unique corresponding inverse, and as the group elements are randomly chosen, this is mathematically equivalent to what is claimed.
Regarding Claim 24:
Tzeng teaches the following limitations:
wherein: the third oblivious transfer message additionally comprises a third group element; and the sender computer generates the third group element using the first group element and the second random number [a = gki] (Section 2.1, Pages 162-163; Section 2.3, Pages 164-165). Tzeng teaches a third group element in the form of an exponentiated form of g using a random exponent k_i.
Regarding Claim 25:
Tzeng teaches the following limitations:
wherein the sender computer generates the third group element by exponentiating the first group element using the second random number (Section 2.1, Pages 162-163; Section 2.3, Pages 164-165).
Regarding Claim 26:
Tzeng teaches the following limitations:
wherein generating, by the receiver computer, the output message comprises: exponentiating, by the receiver computer, the third group element using the first random number, thereby generating an exponentiated third group element [
a
r
] (Section 2.1, Pages 162-163; Section 2.3, Pages 164-165).
generating, by the receiver computer, a third hash by inputting the exponentiated third group element into the hash function [
H
(
a
r
,
α
)
] (Section 2.3, Pages 164-165).
and generating, by the receiver computer, the output message by computing an XOR of the third hash and the first obfuscated message and/or the second obfuscated message [
m
α
=
b
⨁
H
(
a
r
,
α
)
] (Section 2.1, Pages 162-163; Section 2.3, Pages 164-165).
Claim 20 is rejected under 35 U.S.C. 103 as being unpatentable over Tzeng in view of Masny et al. (U.S. Pub. No. 2020/0259800 A1) hereinafter referred to as “Masny”, and further in view of Naor.
Regarding Claim 20:
Tzeng teaches the following limitations:
(taught by Masny below)
a method of obliviously transferring either a first plaintext message or a second plaintext message to the receiver computer, the method comprising receiving, from a sender computer, a first oblivious transfer message comprising a first group element and a second group element (Introduction, Page 159; Section 2.2, Page 164).
determining a first random number (Section 2.1, Pages 163-164).
retrieving a receiver choice bit, wherein the receiver choice bit is unknown to the sender computer (Section 2.1, Page 163).
generating, based on the first oblivious transfer message, the first random number, and the receiver choice bit, a second oblivious transfer message (Section 2.3, Page 164).
transmitting to the sender computer, the second oblivious transfer message (Section 2.3, Page 164).
wherein the sender computer generates a third oblivious transfer message using the second oblivious transfer message, wherein the third oblivious transfer message comprises a first obfuscated message and a second obfuscated message (Section 2.1, Pages 162-163; Section 2.3, Pages 164-165).
receiving, from the sender computer, the third oblivious transfer message (Section 2.1, Pages 162-163; Section 2.3, Pages 164-165).
and generating, an output message by de-obfuscating the first obfuscated message or the second obfuscated message, wherein the output message is equivalent to either the first plaintext message or the second plaintext message (Section 2.1, Pages 162-163; Section 2.3, Pages 164-165).
wherein the first obfuscated message is generated by generating a first hash by inputting an intermediate group element to a power of a second random number determined by the sender computer into a hash function, and computing a bitwise exclusive-or (XOR) of the first hash with the first plaintext message to produce the first obfuscated message [
σ
1
=
H
1
y
h
k
1
⊕
m
1
] (Section 2.1, Pages 162-163; Section 2.3, Pages 164-165). Tzeng teaches using a random exponent k_i. Note that this random number of Tzeng can be the same for both messages, and this is done similarly in Naor et al. (NPL “Efficient Oblivious Transfer Protocols”, Page 451, Col. 2) hereinafter referred to as “Naor”
and wherein the second obfuscated message is generated by generating a second hash by inputting a second exponentiated product comprising a product of the intermediate group element and the second group element to a power of the second random number determined by the sender computer into the hash function [
σ
2
=
H
2
y
h
2
k
2
⊕
m
2
] (Section 2.1, Pages 162-163; Section 2.3, Pages 164-165).
and wherein the intermediate group element is determined by determining a product of a first exponentiated group element and a second exponentiated group element [
y
=
g
r
*
h
α
] (Section 2.1, Pages 162-163; Section 2.3, Pages 164-165).
wherein the first exponentiated group element is the first group element with an exponent based on the first random number [
g
r
] and the second exponentiated group element is based on the second group element with an exponent based on the receiver choice bit [
h
α
] (Section 2.1, Pages 162-163; Section 2.3, Pages 164-165).
wherein the first random number is known only to the receiver computer, and the second random number is known only to the sender computer (Theorems 1 & 2, Pages 163-164).
Masny teaches the following limitation:
A receiver computer comprising: a processor; and a non-transitory computer readable medium coupled to the processor, the non-transitory computer readable medium comprising code, executable by the processor for implementing (Par. [0129], Par. [0130]). Masny teaches hardware structure for implementing oblivious transfers on a computer system.
Tzeng teaches a method for oblivious transfers, but does not explicitly teach the hardware components for implementing such a method. Masny however describes that a system for oblivious transfers can be implementing using hardware connected to a non-transitory storage medium. Therefore, it would have been obvious to one of ordinary skill in the art before the effective filing date of the claimed invention to combine the oblivious transfer algorithm of Tzeng with the hardware structure of Masny in order to gain the predictable result of using computer hardware to implement the oblivious transfer algorithm described by Tzeng. One of ordinary skill in the art would have realized that the system of Masny is compatible with the algorithm of Tzeng since Masny is also directed to performing oblivious transfers, and that such hardware could be predictably used to implement the oblivious transfer algorithm of Tzeng.
Naor teaches the following limitation:
second random number (Page 451, Col. 2). Naor teaches that a sender can choose the same random number r for both encryptions.
Tzeng/Masny teaches a sender generating random numbers through
k
i
, but as addressed by the Applicant’s arguments in Remarks, this random number is indexed and can be different. Naor however shows that it is well known in the art in an oblivious transfer protocol for this random number to be the same across encryptions. Therefore, it would have been obvious to one of ordinary skill in the art before the effective filing date of the claimed invention to modify the second random number of Tzeng/Masny, i.e. the exponent
k
i
, to be the same across indices like in Naor in order to gain the predictable result of the second random number being used to generate both the first and second obfuscated message. One of ordinary skill in the art would have recognized that both Tzeng/Masny and Naor regard 1 out of 2 oblivious transfer protocols, and that such a modification would have been a predictable implementation by one of ordinary skill in the art, as Naor further describes that reusing such a random number reduces the overhead regarding exponentiation (Page 451, Col. 2).
Related Art
The following prior art made of record and cited on PTO-892, but not relied upon, is considered pertinent to applicant’s disclosure:
Kolesnikov (U.S. Pub. No. 2010/0306543 A1) – Includes methods regarding oblivious transfers
Conclusion
Applicant's amendment necessitated the new ground(s) of rejection presented in this Office action. Accordingly, THIS ACTION IS MADE FINAL. See MPEP § 706.07(a). Applicant is reminded of the extension of time policy as set forth in 37 CFR 1.136(a).
A shortened statutory period for reply to this final action is set to expire THREE MONTHS from the mailing date of this action. In the event a first reply is filed within TWO MONTHS of the mailing date of this final action and the advisory action is not mailed until after the end of the THREE-MONTH shortened statutory period, then the shortened statutory period will expire on the date the advisory action is mailed, and any nonprovisional extension fee (37 CFR 1.17(a)) pursuant to 37 CFR 1.136(a) will be calculated from the mailing date of the advisory action. In no event, however, will the statutory period for reply expire later than SIX MONTHS from the mailing date of this final action.
Any inquiry concerning this communication or earlier communications from the examiner should be directed to ETHAN V VO whose telephone number is (571)272-2505. The examiner can normally be reached M-F 8am-5pm.
Examiner interviews are available via telephone, in-person, and video conferencing using a USPTO supplied web-based collaboration tool. To schedule an interview, applicant is encouraged to use the USPTO Automated Interview Request (AIR) at http://www.uspto.gov/interviewpractice.
If attempts to reach the examiner by telephone are unsuccessful, the examiner’s supervisor, Lynn Feild can be reached on (571)272-2092. The fax phone number for the organization where this application or proceeding is assigned is 571-273-8300.
Information regarding the status of published or unpublished applications may be obtained from Patent Center. Unpublished application information in Patent Center is available to registered users. To file and manage patent submissions in Patent Center, visit: https://patentcenter.uspto.gov. Visit https://www.uspto.gov/patents/apply/patent-center for more information about Patent Center and https://www.uspto.gov/patents/docx for information about filing in DOCX format. For additional questions, contact the Electronic Business Center (EBC) at 866-217-9197 (toll-free). If you would like assistance from a USPTO Customer Service Representative, call 800-786-9199 (IN USA OR CANADA) or 571-272-1000.
/E.V.V./Examiner, Art Unit 2431
/MICHAEL R VAUGHAN/Primary Examiner, Art Unit 2431
