MOBILE AGENT SECURITY WITH EFFICIENT OBLIVIOUS

TRANSFER

Wataru Hasegawa, Masakazu Soshi and Atsuko Miyaji

School of Information Science, Japan Advanced Institute of Science and Technology

Keywords:

Mobile Agent, Security, Oblivious Transfer, Encrypted Circuit, Secure Function Evaluation.

Abstract:

Cachin et al. and Algesheimer et al. proposed schemes using secure function evaluation for protecting mobile

agents in untrusted environments. One of essential ingredients of their protocols is oblivious transfer (although

not all of them require it). Unfortunately, naive application of oblivious transfer is inefﬁcient because it must

be performed for each bit of encrypted circuit inputs. Therefore, in this paper we propose secure mobile agent

protocols with emphasis on efﬁcient oblivious transfer suitable for secure function evaluation.

1 INTRODUCTION

Mobile agents are migratable autonomous software

program and mobile agent technology has drawn

much attention as a fundamental technology in

next generation computing (Rothermel and Popescu-

Zeletin, 1997). However, realization of mobile

agents is confronted by a serious security problem:

an attack on mobile agents by malicious execution

hosts such as tampering or eavesdropping agents’

secret during their execution. So the way of ex-

ecuting an ‘encrypted’ agent without decrypting it

has been studied so far. Among such approaches,

Cachin et al. (Cachin et al., 2000) and Algesheimer

et al. (Algesheimer et al., 2001) proposed promising

methods based on secure function evaluation. In par-

ticular, Algesheimer et al. introduced Trusted Third

Party (TTP) to their protocols and succeeded in en-

hancing security of them.

One of essential ingredients of their protocols is

oblivious transfer (although not all of them require

). Unfortunately, from a viewpoint of communi-

cation cost, naive application of oblivious transfer is

inefﬁcient because it must be performed for each bit

of encrypted circuit inputs. Hence Mori et al. (Mori

For example, oblivious transfer is not needed in the ba-

sic scheme by Algesheimer et al. The scheme is discussed

in Section 4.2.

et al., 2005) proposed a mobile agent security scheme

using a new efﬁcient oblivious transfer. However it

turns out that their oblivious transfer protocol is inse-

cure in a special situation (Hasegawa et al., 2007).

In this paper we propose two secure mobile agent

protocols with emphasis on efﬁcient oblivious trans-

fer suitable for secure function evaluation. We show

that one is secure in honest-but-curios model and the

other is secure even in the malicious model. Fur-

thermore, we shall show that our proposed oblivious

transfer protocols are more efﬁcient than a naive ap-

plication of 1-out-of-2 oblivious transfer in mobile

agent security schemes. Besides, our proposed obliv-

ious transfer protocols are interesting in their own

right and they are also important because they can

be building blocks for other security protocols, espe-

cially, more sophisticated type of oblivious transfer,

i.e., Naor’s k-out-of-n oblivious transfer (Naor and

Pinkas, 1999).

2 PRELIMINARY

2.1 Assumptions and Deﬁnitions

In this section, we present some preliminaries for our

work. Let G

be an additive group of a large prime

order p and G

be a multiplicative group of the same

299

Hasegawa W., Soshi M. and Miyaji A. (2007).

MOBILE AGENT SECURITY WITH EFFICIENT OBLIVIOUS TRANSFER.

In Proceedings of the Second International Conference on Security and Cryptography, pages 299-304

DOI: 10.5220/0002129002990304

 SciTePress

order. Let e : G

× G

→ G

be a function that satis-

ﬁes the following properties: (1) Bilinearity: for any

P, Q ∈ G

and a, b ∈ Z, e(aP,bQ) = e(P,Q)

; (2)

Non-degeneration: e(P,P) 6= 1 where P is a generator

of G

Now we give the deﬁnition of NT-CDH problem

below.

Assumption 1. New Target Computational Difﬁe-

Hellman (NT-CDH) Problem

Let P be a generator of G

, s

∈

∗

P,P

= s

P, b

∈ {0,1} for i = 1, 2, ·· ·, n. Fur-

thermore, let T

(·) be a target oracle that returns

∈ G

, and

: {0, 1}

∗

→ G

be a cryptographic

hash function. The attacker A is given (p, P

, P

, s

, ..., s

) and the access to T

. Then

the advantage Adv

NT−CDH

(A) of A in attacking NT-

CDH problem is deﬁned as the probability that A out-

puts s

/∈ {s

,. .., s

}, where 1 ≤ j ≤ n, and

b ∈ {0,1}. There is no probabilistic polynomial-time

adversary A with non-negligible Adv

NT−CDH

(A).

Note that NT-CDH Problem is deﬁned for the ﬁrst

time in this paper and we believe that it is reasonable

to consider that the problem is computationally difﬁ-

cult to solve.

Finally, we deﬁne the attack model (Algesheimer

et al., 2001; Cachin et al., 2000; Chu and Tzeng,

2005) supposed in this paper.

Deﬁnition 1. Attack Model

Attack models for a mobile agent security proto-

col are classiﬁed into two types: honest-but-curious

(semi-honest) model and malicious model. Honest-

but-curious hosts follow the protocol, but seek to steal

some useful information about secrets of agents. On

the other hand, malicious hosts can do whatever they

want in order to obtain secret information.

2.2 Oblivious Transfer

One of key tools in security protocols is oblivious

transfer (Naor and Pinkas, 1999), which often means

1-out-of-2 oblivious transfer. A (1-out-of-2) oblivious

transfer is an interactive protocol between a sender

(Alice) with two secret messages m

and m

and a re-

ceiver (Bob) with a bit b. By oblivious transfer, Bob

gets m

, but learns nothing about m

b⊕1

. Furthermore,

Alice does not learn anything about b.

More general form of oblivious transfer, namely,

k-out-of-n oblivious transfer (Chu and Tzeng, 2005;

Naor and Pinkas, 1999) is also useful. As the name

implies, in k-out-of-n oblivious transfer, Alice has n

secrets m

,. .., m

and Bob has k choices i

,. .., i

As we will see later, in mobile agent security

schemes, we basically need to repeat 1-out-of-2 obliv-

ious transfer n times for some n. That is, Alice has

n pairs of secret messages (m

1,0

, m

1,1

), (m

2,0

, m

2,1

.. ., (m

n,0

, m

n,1

) and Bob has n choices (1, b

), (2,b

·· ·, (n,b

), where b

∈ {0,1} (1 ≤ i ≤ n). After com-

pletion of n times 1-out-of-2 oblivious transfer, Bob

receives m

1,b

, m

2,b

, ··· , m

n,b

. Hence an oblivious

transfer scheme for mobile agent security must satisfy

the following three requirements

Deﬁnition 2. Correctness

An scheme is correct if the receiver R (Bob) ob-

tains the chosen messages when both of the sender

S (Alice) and R do not deviate from the steps of the

scheme.

Deﬁnition 3. The Receiver’s privacy - indistinguisha-

bility

For any two choice sets of R, say, C = {(1, b

(2,b

), ···, (n,b

)} and C

′

= {(1,b

′

), (2,b

′

), ···,

(n,b

′

)}, the transcripts of the protocol execution cor-

responding to C and C

′

, which S sees, are indistin-

guishable. Furthermore, if the received messages of

S for C and C

′

are identically distributed, then the

choices of R are said to be unconditionally secure.

Deﬁnition 4. The Sender’s privacy

This property is deﬁned according to the type of

the attack model.

• The Sender’s privacy in the honest-but-curious

model - indistinguishability:

For any choices of R, the unchosen secret mes-

sages of S are indistinguishable from random

ones.

• The Sender’s privacy in the malicious model -

compared with the Ideal Model:

In the Ideal model, ﬁrst S sends all secret mes-

sages to TTP

. Next R sends his choices to TTP

and then TTP sends the chosen secret messages

of S to R. The Ideal model, as its name implies, is

the most secure scheme. We achieve the sender’s

privacy if for any R in the real world, there exists

another probabilistic polynomial-time Turing Ma-

chine (PPTM) R

∗

(called simulator) in the Ideal

model such that the outputs of R and R

∗

are indis-

tinguishable.

2.3 Mobile Agent Computation based

on Secure Function Evaluation

Secure function evaluation (Yao, 1986) is closely re-

lated to the model of mobile agent computation in this

The requirements are adopted from (Chu and Tzeng,

2005), but with slight modiﬁcation.

TTP in the Ideal model is a different entity from TTP

involved in secure mobile agent protocols in the following

sections.

SECRYPT 2007 - International Conference on Security and Cryptography

300

paper. This section formalizes the basic idea. For

more details on secure function evaluation, refer to

(Yao, 1986).

In this paper, we suppose that agents travel only

one-hop away and back. That is, an agent which

works on behalf of a user is generated on the site

where the user resides. In particular the site is called

the originator O of the agent. Next the agent moves

to a host H to perform a task on behalf of the user.

Then the agent runs on H and returns to O along with

the result. This is the scenario for one-hop agents,

but it is straightforward to extend it into multi-hop

cases (Algesheimer et al., 2001; Cachin et al., 2000).

Therefore in the subsequent sections, for simplicity

we consider one-hop agents only.

Now we give a formalization of mobile agent

computations based on secure function evaluation.

Suppose that the task that the agent carries out on

behalf of the user is represented by function f :

X ×

Y → Z for some sets X and Y . Furthermore, let x ∈ X

and y ∈ Y be two inputs of O and H into f, respec-

tively. Let n

, n

, and n

be the lengths of x, y, and z,

respectively. Furthermore, (x

,. . .,x

), (y

,. . .,y

and (z

,. . .,z

) denote the binary representations of

x, y, and z, respectively. Let C be a polynomial-size

circuit to compute f.

Mobile agent computation proceeds as fol-

lows. First O executes

construct to obtain a tuple

(

C ,K ,L ,U ), where C is an encrypted circuit for C,

and

K , L , and U are “key pairs” for x, y, and z, re-

spectively:

K = ((K

1,0

, K

1,1

), ..., (K

, K

)), L =

((L

1,0

, L

1,1

), . . ., (L

, L

)), and

U = ((U

1,0

1,1

.. ., (U

)). Inputs x and y and output z of

C are

represented in an ‘encrypted’ form in terms of

K , L ,

and

U . Namely, x, y, and z are expressed as (K

1,x

, ...,

), (L

1,y

, .. ., L

), and (U

1,z

, .. .,U

), re-

spectively.

Next O performs

transfer procedure. That is,

it repeats 1-out-of-2 oblivious transfer with H n

times to securely send the encrypted input for y, i.e.,

1,y

,. . .,L

), to H. Then O also transfers

C and

1,x

,. . .,K

) to H. Essentially speaking, it can

be considered that the mobile agent consists of

C ,

1,x

,. . .,K

), and (L

1,y

,. . .,L

Finally the mobile agent runs on H. This

means that

evaluate(C , (K

1,x

, . .., K

), (L

1,y

.. ., L

)) is executed on H and the output

1,z

,. . .,U

) is obtained. Then the agent returns

to O along with the output. From this, O can recover

the ﬁnal result z.

3 OUR SCHEMES

In this section we propose two secure mobile agent

protocols with emphasis on efﬁcient oblivious trans-

fer suitable for secure function evaluation. Actually

in the two protocols, two novel oblivious transfer pro-

tocols, each of which is based on its own security as-

sumption, are devised.

Our model of mobile agent computation is basi-

cally the same as presented in Section 2.3, but with

one additional participant involved, i.e., a trusted third

party (TTP). The reason for the introduction of TTP

in our mobile agent computation is that no secure mo-

bile computing schemes exist without TTP as shown

in (Algesheimer et al., 2001). We call TTP T. In

this paper we suppose that T utilizes a secure pub-

lic key cryptosystem. E

and D

denote the corre-

sponding encryption and decryption operations, re-

spectively. The symbols in the subsequent sections

follow the deﬁnitions given in Section 2.

3.1 Our Scheme 1

In this section we propose a secure mobile agent

scheme in the honest-but-curious model.

Protocol 1

Step 1. 1. O chooses a unique string id for the mobile

computation.

2. O executes

construct(C) and has the output

(

C ,L ,K ,U ).

3. Using encryption with T’s public key, O gen-

erates

L = E

(idk1k(L

1,0

1,1

)k2k ... kn

)), where ‘k’ means concatenation

operation.

4. Let K

′

be K

i,x

for i = 1, 2, .. . , n

and x = (x

, .. ., x

5. O sends id,

C , K

′

, K

′

, ..., K

′

L to the host H.

Step 2. H forwards id and

L to T.

Step 3. 1. T decrypts

L with its own private key and

checks whether or not the decrypted message

includes id. If it does not, T quits the proto-

col. Otherwise, if id is used in some previous

computation, then T also aborts.

2. T chooses s

∈

∗

and computes s

P, s

Then it sends s

P,s

P to H.

3. H chooses a

∈

∗

and compute A

(i)

P +a

P (i = 1, 2, ..., n

4. H sends A

to T (i = 1, 2,... , n

5. For i = 1, 2, ... , n

, T calculates D

i,0

= s

−

P), D

i,1

= s

− s

P). Next it also chooses

i,0

, r

i,1

∈

∗

and computes C

i,0

= (r

i,0

MOBILE AGENT SECURITY WITH EFFICIENT OBLIVIOUS TRANSFER

301

i,0

× e(H

(i), s

i,0

), C

i,1

= (r

i,1

P, L

i,1

(i), s

i,1

6. T sends D

i,0

, D

i,1

, C

i,0

, C

i,1

to H (1 ≤ i ≤ n

7. H computes D

′

i,y

= D

i,y

− a

P and ob-

tains L

i,y

= C

i,y

[2]/e(D

′

i,y

, C

i,y

[1]) = e(

(i),

i,y

/ e(D

′

i,y

, r

i,y

P) (i = 1, 2, ... , n

). Here

i,y

[1] and C

i,y

[2] denote the ﬁrst and the sec-

ond part of the tuple C

i,y

respectively.

Step 4. Let L

′

be L

i,y

(i = 1, 2, . . ., n

). H executes

evaluate(C , K

′

, K

′

, ..., K

′

, L

′

, L

′

, ..., L

′

which yields the output U

′

, U

′

, . .., U

′

. H sends

them to O.

Step 5. O obtains the ﬁnal result z = (z

, z

, ... , z

)

by comparing U

′

, U

′

, .. ., U

′

with

U .

Our protocol 1 is almost the same as (Algesheimer

et al., 2001; Cachin et al., 2000; Mori et al., 2005) ex-

cept for Step 3, which is the large difference between

ours and the previous work.

3.2 Our Scheme 2

In our scheme 1, if H is malicious and sends some

queries A

in some special form in Step 3.4, it would

be able to get extra information. Therefore we im-

prove our scheme 1 and propose scheme 2 which is

secure even in the malicious model.

Protocol 2 The difference between Protocol 1 and 2

lies in Step 3. Other steps of Protocol 2 are the same

as those of Protocol 1. Below

is a cryptographic

hash function over G

× {0, 1}

∗

× {0, 1}.

Step 3. 1. T decrypts

L with its own private key and

checks whether or not the decrypted message

includes id. If it does not, T quits the proto-

col. Otherwise, if id is used in some previous

computation, then T also aborts.

2. T chooses s

∈

∗

and computes s

P, s

It then sends s

P, s

P to H.

3. H chooses a

∈

∗

and computes A

(i)

+ s

P + a

P (i = 1, 2, ..., n

4. H sends A

to T (i = 1, 2, . . ., n

5. For i = 1, 2, . .., n

, T computes D

i,0

= s

− s

P), D

i,1

= s

− s

P) and computes

i,0

= L

i,0

⊕

(i), i, 0), C

i,1

= L

i,1

⊕

(i), i, 1).

6. T sends D

i,0

i,1

i,0

i,1

to H (i = 1, 2, ... ,

7. H obtains L

i,y

= C

i,y

⊕

i,y

− a

P), i,

) (i = 1, 2, .. . , n

The property, security, and efﬁciency of our pro-

tocol 2 are extensively discussed in Section 4.

4 EVALUATION

4.1 General Discussion on Our

Protocols

Our scheme 1 and 2 are almost the same as

(Algesheimer et al., 2001; Cachin et al., 2000; Mori

et al., 2005). However, each Step 3. of them deviates

far from the previous work. As stated in Section 2, in

the previous mobile agent security schemes we need

to repeat 1-out-of-2 oblivious transfer n

times be-

tween Alice and Bob. On the other hand, in this paper

in each Step 3. of our protocol 1 and 2 we have pro-

posed two novel oblivious transfer protocol suitable

for mobile agent security. This is one of the reasons

why our protocols are efﬁcient compared with the pre-

vious work. More detailed analysis on performance is

given in Section 4.4.

Our oblivious transfer protocols modify k-out-of-

n oblivious transfer proposed in (Chu and Tzeng,

2005). Note that we cannot use k-out-of-n oblivious

transfer in mobile agent security schemes in a naive

manner because in k-out-of-n oblivious transfer, it is

possible to choose k indices arbitrarily.

Another important point to note is that in our pro-

tocols T can be less trusted. For example, in the basic

scheme in (Algesheimer et al., 2001), if T and O col-

lude, then the secret y of H is revealed. However, even

in such a case, our two protocols are secure.

4.2 Security Analysis of Scheme 1

In this section we conduct security analysis of our

protocol 1. It is obvious that our protocol 1 is as se-

cure as the original secure function evaluation except

for Step 3. Therefore in order to prove the security

of our protocol 1, what we have to do is only to show

that Step 3. actually satisﬁes the requirements given

in Section 2.2.

1. Correctness

The proof is omitted because the readers should

easily verify the correctness of the protocol.

2. The Receiver’s privacy

For privacy of the receiver, H, we can prove The-

orem 1:

Theorem 1. For our scheme1, the choices made by

H are unconditionally secure.

The proof is omitted. Theorem 1 can be proved in

a similar way as in (Chu and Tzeng, 2005).

3. The Sender’s privacy

Theorem 2. Our scheme1 meets the Sender’s privacy

requirement. That is, by the DBDH assumption, if

SECRYPT 2007 - International Conference on Security and Cryptography

302

H has honest-but-curious behavior (semi-honest), he

gets no information about unchosen messages.

The proof is also omitted due to space limitation.

It would be straightforward to prove Theorem 2 by

consulting (Chu and Tzeng, 2005).

4.3 Security Analysis of Scheme 2

In this section we consider the security of our protocol

2. As stated in Section 4.2, here we consider the Step

3. of our protocol 2.

1. Correctness

It is easily proved and the proof is omitted.

2. The Receiver’s privacy

We introduce Theorem 3 without proof. It can be

proved almost in the same way as in (Chu and Tzeng,

2005).

Theorem 3. For our scheme2, the choices made by

H are unconditionally secure.

3. The Sender’s privacy

Theorem 4. In the malicious model our scheme2 sat-

isﬁes The Sender’s privacy under the assumption of

NT-CDH and the random oracle model.

Proof. First remember that

is considered as a ran-

dom oracle. So in order to query the oracle to ob-

tain

(i), i, y

), the malicious H must have

(i) beforehand. Now given any malicious H, we

construct a simulator H

∗

in the Ideal model, whose

output is indistinguishable from that of H. H

∗

works

in the following way:

Step 1. H

∗

simulates H to obtain its output A

∗

(i = 1,

2, .. . , n

). If H submits query with index i to

then H

∗

feeds into H a random Q

∗

, which should

be consistent with the previous queries.

Step 2. H

∗

simulates T. First it generates s

∗

and s

∗

Then for i = 1, 2, .. ., n

, with input A

∗

, H

∗

obtains

∗

i,0

= s

∗

− s

∗

P) and D

∗

i,1

= s

∗

− s

∗

P).

Step 3. H

∗

outputs (C

∗

i,0

, C

∗

i,1

) at random (i = 1, 2,

.. ., n

Step 4. H

∗

simulates H with inputs s

∗

P, s

∗

P, {D

∗

i,0

∗

i,1

, C

∗

i,0

, C

∗

i,1

} (i = 1, 2, . .., n

). If H issues a

query with (x, i, b) to

(b ∈ {0, 1}), then H

∗

veriﬁes x

= s

∗

. If it holds, then H

∗

obtains L

i,b

from the TTP in the Ideal model and returns C

∗

i,b

⊕ L

i,b

to H as the hash value (consistent with the

previous queries).

Step 5. Outputs s

∗

P, s

∗

P, {A

∗

, D

∗

i,0

, D

∗

i,1

, C

∗

i,0

, C

∗

i,1

}

(i = 1, 2, ..., n

First note that if for some i, H can obtain both

of decryption keys for the i-th key pair L

i,0

and L

i,1

then H

∗

cannot exactly know the indices chosen by H

and the simulation would not succeed. This situation

could arise if H sends to

two queries (x

, i, 0) and

, i, 1) such that x

= s

∗

and x

= s

∗

. How-

ever, it contradicts to the assumption of the hardness

of NT-CDH problem and hence the situation above

cannot occur.

For i = 1, 2, . .., n

, if (x, i, y

) is queried and

legal at the same time, thenC

i,0

andC

i,1

are consistent

with the returned hash values. Since no other (s

∗

j, b) where s

∗

6∈ {s

∗

, s

∗

, ···, s

∗

} can

be queried to the

hash oracle, C

j,0

and C

j,1

have

the right distribution due to the random oracle model.

Thus, the output distribution is indistinguishable from

that of H.

4.4 Performance Evaluation

In this section we compare our schemes with

Cachin’s scheme (Cachin et al., 2000) and Mori’s

scheme (Mori et al., 2005) in terms of communica-

tion cost and the computational complexity

. Table 1

and Table 2 depict the communication cost between

sender S and receiver R and the computational com-

plexity of S and R, respectively. Note that in Cachin’s

scheme, S and R correspond to O and H. On the other

hand, in our schemes S and R correspond to T and H.

The communication cost is estimated by the num-

ber of required messages, each of which is in G

. For

the computational complexity, ﬁrst we interpret oper-

ations of the protocol in (Cachin et al., 2000) as those

in G

. Then we take into consideration the number

of the most expensive operations, that is, the scalar

multiplication in G

and bilinear map (pairing) e over

× G

. Note that for good legibility n

is written as

n in Table 1 and 2.

From Table 1 and 2, it should be clear that our

schemes are more efﬁcient than Cachin’s scheme with

respect to the communication cost and the computa-

tional complexity. Furthermore, our schemes are al-

most as efﬁcient as Mori’s scheme, but note that the

latter is insecure. On the other hand, as we showed,

our protocol 1 is secure in the semi-honest model and

our protocol 2 is secure in the malicious model.

From the viewpoint of the communication cost and

the computational complexity, (Cachin et al., 2000) and

(Algesheimer et al., 2001) are almost the same. Therefore

due to space constraints here we compare ours with the for-

mer only.

MOBILE AGENT SECURITY WITH EFFICIENT OBLIVIOUS TRANSFER

303

Table 1: Comparison on the communication cost.

Communication cost

S → R R → S S → R Total

C. Cachin, etc. (Cachin et al., 2000) n 2n 4n 7n

Mori, etc. (Mori et al., 2005) n n 3n+ 2 5n+ 2

Our scheme 1 2 n 4n 5n+ 2

Our scheme 2 2 n 4n 5n+ 2

Table 2: Comparison on the computational complexity.

Computational complexity

S R Total

C. Cachin, etc. (Cachin et al., 2000) 5nM 2nM 7nM

Mori, etc. (Mori et al., 2005) 4n+ 2M 2nM (6n+ 2)M

Our scheme 1 (4n+ 2)M + 2nE 2nM + nE (6n+ 2)M + 3nE

Our scheme 2 (4n+ 2)M 2nM (6n+ 2)M

M: one scalar multiplication, E: one paring

5 CONCLUSION

In this paper we proposed two secure mobile agent

protocols with emphasis on efﬁcient oblivious trans-

fer suitable for secure function evaluation in untrusted

environments. Actually in the two protocols, two

novel oblivious transfer protocols were devised. We

showed that one is secure in honest-but-curios model

and the other is secure even in the malicious model.

Furthermore, we showed that our proposed oblivious

transfer protocols are more efﬁcient than the previous

work.

ACKNOWLEDGEMENTS

We would like to thank anonymous referees for their

valuable comments.

REFERENCES

Algesheimer, J., Cachin, C., Camenisch, J., and Karjoth, G.

(2001). Cryptographic security for mobile code. In

Proc. IEEE Symp. Security and Privacy, pages 2–11.

Cachin, C., Camenisch, J., Kilian, J., and M

uller, J.

(2000). One-round secure computation and secure au-

tonomous mobile agents. In Proc. ICALP, vol. 1853

of LNCS, pages 512–523. Springer-Verlag.

Chu, C.-K. and Tzeng, W.-G. (2005). Efﬁcient k-out-of-

n oblivious transfer schemes with adaptive and non-

adaptive queries. In PKC 2005, vol. 3386 of LNCS,

pages 172–183. Springer-Verlag.

Hasegawa, W., Soshi, M., and Miyaji, A. (2007). Efﬁ-

cient communication on mobile agent security. In

Symposium on Cryptography and Information Secu-

rity (SCIS2007), 4F1-5.

Mori, M., Soshi, M., and Miyaji, A. (2005). Consideration

for mobile agent security. IPSJ SIG Technical Reports

2005-CSEC-28. pp. 123–128.

Naor, M. and Pinkas, B. (1999). Oblivious transfer and

polynomial evaluation. In Proc. STOC ’99, pages

245–254.

Rothermel, K. and Popescu-Zeletin, R., editors (1997). Mo-

bile Agents: First International Workshop (MA ’97),

vol. 1219 of LNCS. Springer-Verlag.

Yao, A. C. (1986). How to generate and exchange secrets.

In Proc. FOCS, pages 162–167.

SECRYPT 2007 - International Conference on Security and Cryptography

304