Optimal bounds for semi-honest quantum oblivious transfer

Abstract

Oblivious transfer is a fundamental cryptographic primitive in which Bob transfers one of two bits to Alice in such a way that Bob cannot know which of the two bits Alice has learned. We present an optimal security bound for quantum oblivious transfer protocols, in the information theoretic setting, under a natural and arguably demanding definition of what it means for Alice to cheat. Our lower bound is a smooth tradeoff between the probability P Bob with which Bob can guess Alice's bit choice and the probability P Alice with which Alice can guess both of Bob's bits given that she learns one of the bits with certainty. We prove that 2P Bob + P Alice ≥ 2 in any quantum protocol for oblivious transfer, from which it follows that one of the two parties must be able to cheat with probability at least 2/3. We prove that this bound is optimal by exhibiting a family of protocols whose cheating probabilities can be made arbitrarily close to any point on the tradeoff curve.

Assumptions in Quantum Cryptography

“…As with coin flipping, this protocol cannot be implemented perfectly: Alice may learn which messages Bob requested and Bob may be able to get access to some of Alice's messages he did not request [May97,LC98]. The minimum probability that Alice or Bob can cheat in this protocol and not be detected is 2/3 [CGS13]. If additional assumptions are made, such as that the adversary has a limit on her computational power (in the classical case) or can only store a certain size of quantum system (in the quantum case) then oblivious transfer is possible [DFSS06].…”

Secure quantum weak oblivious transfer against individual measurements

“…To mend the problem, weak OT is proposed [9], with an improved definition on Bob's cheating. Define the symbols P * Alice : The maximum probability with which cheating-Alice can get honest-Bob's choice bit b and honest-Bob does not abort.…”

“…However, unconditionally secure OT was shown to be impossible even in quantum cryptography, because the adversary can always cheat with the so-called honest-but-curious attack [4][5][6][7][8]. To evade the problem, the concept "weak OT" was proposed recently [9], in which the security goals of OT are slightly modified, so that the honest-butcurious attack is no longer considered a successful cheating. Even so, it was found that a security bound exists for weak OT [9], thus it cannot be unconditionally secure either.…”

“…To evade the problem, the concept "weak OT" was proposed recently [9], in which the security goals of OT are slightly modified, so that the honest-butcurious attack is no longer considered a successful cheating. Even so, it was found that a security bound exists for weak OT [9], thus it cannot be unconditionally secure either.…”

Quantum coin hedging, and a counter measure

“…Although this would not be relevant for our work, analysis of coin flipping protocols was adapted, and later implemented, for experimental setups [PCDK11, PJL + 14]. There is also a strong connection between coin-flipping and bit-commitment protocols [SR01,CK11], and to a lesser extent to oblivious transfer [CGS16].…”