Lower bounds for quantum oblivious transfer

Abstract

Oblivious transfer is a fundamental primitive in cryptography. While perfect information theoretic security is impossible, quantum oblivious transfer protocols can limit the dishonest player's cheating. Finding the optimal security parameters in such protocols is an important open question. In this paper we show that every 1-out-of-2 oblivious transfer protocol allows a dishonest party to cheat with probability bounded below by a constant strictly larger than $1/2$. Alice's cheating is defined as her probability of guessing Bob's index, and Bob's cheating is defined as his probability of guessing both input bits of Alice. In our proof, we relate these cheating probabilities to the cheating probabilities of a bit commitment protocol and conclude by using lower bounds on quantum bit commitment. Then, we present an oblivious transfer protocol with two messages and cheating probabilities at most $3/4$. Last, we extend Kitaev's semidefinite programming formulation to more general primitives, where the security is against a dishonest player trying to force the outcome of the other player, and prove optimal lower and upper bounds for them.

Check-based generation of one-time tables using qutrits

“…This matches the probability of 3 4 in [24] for Bob to guess correctly Alice's choice bit in a semi-honest oblivious transfer protocol. It can also be easily verified that the maximum mutual information obtainable by Bob about Alice's choice bit in [24] is 1 2 , again by Bob measuring his qutrit in the computational basis. Note that with this particular computational-basis measurement, Bob cannot make the distributed output of the one-time table correct.…”

“…the XOR of two bits on the two parties. It is adapted from the semi-honest oblivious transfer protocol in [23,24], by changing the entangled state to a singlequtrit state, but using two states for each logical input value to recover the comparable level of security. The security of the inputs in Protocol 1 is partial and comparable to that in the semi-honest oblivious transfer protocol in [23,24].…”

“…It is adapted from the semi-honest oblivious transfer protocol in [23,24], by changing the entangled state to a singlequtrit state, but using two states for each logical input value to recover the comparable level of security. The security of the inputs in Protocol 1 is partial and comparable to that in the semi-honest oblivious transfer protocol in [23,24]. Later we propose protocols that check the one-time tables generated from Protocol 1, to be used in the preprocessing stage in a bipartite classical or quantum computation task.…”

“…In this work, we firstly propose a simple two-party quantum protocol, using a qutrit in two directions of communication, for generating one-time tables with partial security. It is adapted from the semi-honest oblivious transfer protocol in [23,24] with significant changes. We then show that by allowing for checks and the associated possible aborts, such protocol can be enhanced to achieve asymptotic information-theoretic security.…”

Asymptotically secure All-or-nothing Quantum Oblivious Transfer

“…In 2013, Chailloux et al [29] claimed that a perfectly secure 1 2 -OT quantum protocol is impossible. They derived a lower bound for QOT based on some earlier works on coin flipping [30] and bit commitment [31].…”