Question on Simplest Oblivious Transfer Protocol
As you have said, let's say the receiver chooses $c = 1$. Then his $B = Ag^b$. So In Alice's case, the $k_0 = H(B^a) = H((Ag^b)^a) = H(g^{a a} g^{a  b}) = H(g^{a a + a b})$. Similarly, $k_1 = H((\frac{B}{A})^a) = H(g^{ab})$. Receiver's own key $k_R$ is also, $H(A^b) = H(g^{ab})$. So you see, his key is similar to the senders key $k_1$. That is why, even though the sender is sending both encryptions, the receiver can only decrypt one of these. The one for which the keys are the same, i.e. message 1!