Hybrid KEM Base OT

[robinhundt]

Now that we have an ML-KEM based post quantum secure base OT (see #48) it might be interesting to also have a hybrid KEM base OT. I'm not aware of this existing in any implementation and haven't researched whether there are papers on this topic.

Intuitively, the MR19 protocol should also work with a hybrid KEM, but I think there might be interesting details/problems if one wants to actually implement this.

@dartdart26 this might be of interest to you :)

(I had this idea after reading A Cryptography Engineer’s Perspective on Quantum Computing Timelines)

[dartdart26]

Thanks, will look into it!

[dartdart26]

Just to note that I am still planning to look into it, just haven't found the time yet, but will do so.

[robinhundt]

I did some research into this some time ago (claude assisted) that surfaced some potentially relevant literature:

• On Robust Combiners for Oblivious Transfer and other Primitives
  • shows that there are no "transparent black-box" combiners for OT
• Robuster Combiners for Oblivious Transfer
  • if I understood correctly, sidesteps the impossibility result and has constructions for some classes of combiners

It has been some time since I looked into this and I only briefly looked into the second paper (and did not fully understand it). But it seems like it might be a better approach to combine two OTs, one standard and one PQ, than to use a hybrid KEM with MR19.