Version 1
---------

-- It was brought to our attention that there is an error in one of the
experimental results in Section 4.2. In particular, in Table 1, the
communication reported for Party 2 in Protocol 2 (malicious server) is only of
33KB. This should be roughly 100KB instead. We will update the online version
of the paper with new experimental results as soon as possible.  

Thanks to Hank Carter and Patrick Traynor from Georgia Tech for pointing this
out to us.