Oblivious transfer, a central functionality in modern cryptography, allows a party to send two one-bit messages to another who can choose one of them to read, remaining ignorant about the other, whereas the sender does not learn the receiver's choice. Oblivious transfer the security of which is information-theoretic for both parties is known impossible to achieve from scratch. - The joint behavior of certain bi-partite quantum states is non-local, i.e., cannot be explained by shared classical information. In order to better understand such behavior, which is classically explainable only by communication, but does not allow for it, Popescu and Rohrlich have described a "non-locality machine": Two parties both input a bit, and both get a random output bit the XOR of which is the AND of the input bits. - We show a close connection, in a cryptographic sense, between OT and the "PR primitive." More specifically, unconditional OT can be achieved from a single realization of PR, and vice versa. Our reductions, which are single-copy, information-theoretic, and perfect, also lead to a simple and optimal protocol allowing for inverting the direction of OT.
We show here that the recent work of Wolf and Wullschleger (quant-ph/0502030) on oblivious transfer apparently opens the possibility that non-local correlations which are stronger than those in quantum mechanics could be used for bit-commitment. This is surprising, because it is the very existence of non-local correlations which in quantum mechanics prevents bit-commitment. We resolve this apparent paradox by stressing the difference between non-local correlations and oblivious transfer, based on the time-ordering of their inputs and outputs, which prevents bit-commitment.
Though all-or-nothing oblivious transfer and one-out-of-two oblivious transfer are equivalent in classical cryptography, we here show that due to the nature of quantum cryptography, a protocol built upon secure quantum all-or-nothing oblivious transfer cannot satisfy the rigorous definition of quantum one-out-of-two oblivious transfer.
Oblivious transfer is the cryptographic primitive where Alice sends one of two bits to Bob but is oblivious to the bit received. Using quantum communication, we can build oblivious transfer protocols with security provably better than any protocol built using classical communication. However, with imperfect apparatus one needs to consider other attacks. In this paper we present an oblivious transfer protocol which is impervious to lost messages.
We show that oblivious transfer can be seen as the classical analogue to a quantum channel in the same sense as non-local boxes are for maximally entangled qubits.
We propose a practical quantum oblivious transfer and a bit commitment protocols which replace the single-photon source with weak coherent pulses and allow error and loss in channel and detectors. These protocols can be realized with available optoelectronic apparatus.
Spacetime-constrained oblivious transfer (SCOT) extends the fundamental primitive of oblivious transfer to Minkowski space. SCOT and location oblivious data transfer (LODT) are the only known cryptographic tasks with classical inputs and outputs for which unconditional security needs both quantum theory and relativity. We give an unconditionally secure SCOT protocol that, contrasting previous SCOT and LODT protocols, is practical to implement with current technology, where distant agents need only communicate classical information, while quantum communication occurs at a single location. We al…
Due to the commonly known impossibility results, information theoretic security is considered impossible for oblivious transfer (OT) in both the classical and the quantum world. In this paper, we proposed a weak version of the all-or-nothing OT. In our protocol the honest parties do not need long term quantum memory, entanglements, or sophisticated quantum computations. We observe some difference between the classical and quantum OT impossibilities.
Here we propose a general relativistic quantum framework for cryptography that exploits the fascinating connection of quantum non-locality and special theory of relativity with cryptography. The underlying principle of unconditional security is causality and two-fold quantum non-local correlations: first entanglement swapping and then teleportation over causally independent entangled systems. We show that the proposed framework has following remarkable and novel features in mistrustful cryptography: (i) It helps in defining a new notion of oblivious transfer where both the data transferred and…
We describe efficient protocols for quantum oblivious transfer and for one-out-of-two quantum oblivious transfer. These protocols, which can be implemented with present technology, are secure against general attacks as long as the cheater can not store the bit for an arbitrarily long period of time.
Based on quantum entanglement, an all-or-nothing oblivious transfer protocol is proposed and is proven to be secure. The distinct merit of the present protocol lies in that it is not based on quantum bit commitment. More intriguingly, this OT protocol does not belong to a class of protocols denied by the Lo's no-go theorem of one-sided two-party secure computation, and thus its security can be achieved.
All existing quantum oblivious transfer protocols are to realize the oblivious transfer of bit or bit-string. In this paper, p-Rabin quantum oblivious transfer of a qubit (abbr. p-Rabin qubit-OT) is achieved by using a probabilistic teleportation (abbr. PT) protocol. Here, this is the first time that the concept of qubit-OT is presented. As the PT protocol is able to transfer an (un)known pure state with a certain probability, this feature makes the PT protocol well fit for Rabin OT. Furthermore, the PT protocol can be used for OT of a bit by encoding classical bit with two pre-agreed orthogon…
When submitting ``Coin-Flipping-based Quantum Oblivious Transfer'' (quant-ph/0605027v4) to Indocrypt-2006, I received valuable reviews. Due to the attacks in these reviews, my major protocols, for cheat-sensitive and coin-flipping-based 2-1 oblivious transfers, are insecure. I would have withdrawn the paper. But I think I'd rather post the attacks made by the reviewer. Besides, as ``coin-flipping-based 2-1 OT'' is an important case-study in ``Two-party Models and the No-go Theorems'' (quant-ph/0608165), the paper is also touched by the attack. It will be reconsidered, and the case-study will b…
Oblivious transfer is a cryptographic primitive where Alice has two bits and Bob wishes to learn some function of them. Ideally, Alice should not learn Bob's desired function choice and Bob should not learn any more than what is logically implied by the function value. While decent quantum protocols for this task are known, many become completely insecure if an adversary were to control the quantum devices used in the implementation of the protocol. In this work we give a fully device-independent quantum protocol for XOR oblivious transfer.
Oblivious transfer is a fundamental primitive in cryptography. While perfect information theoretic security is impossible, quantum oblivious transfer protocols can limit the dishonest players' cheating. Finding the optimal security parameters in such protocols is an important open question. In this paper we show that every 1-out-of-2 oblivious transfer protocol allows a dishonest party to cheat with probability bounded below by a constant strictly larger than 1/2. Alice's cheating is defined as her probability of guessing Bob's index, and Bob's cheating is defined as his probability of guessin…
Cryptographic protocols are the backbone of our information society. This includes two-party protocols which offer protection against distrustful players. Such protocols can be built from a basic primitive called oblivious transfer. We present and experimentally demonstrate here the first quantum protocol for oblivious transfer for optical continuous-variable systems, and prove its security in the noisy-storage model. This model allows to establish security by sending more quantum signals than an attacker can reliably store during the protocol. The security proof is based on new uncertainty re…
We present simple protocols for oblivious transfer and password-based identification which are secure against general attacks in the noisy-quantum-storage model as defined in [KWW09]. We argue that a technical tool from [KWW09] suffices to prove security of the known protocols. Whereas the more involved protocol for oblivious transfer from [KWW09] requires less noise in storage to achieve security, our "canonical" protocols have the advantage of being simpler to implement and the security error is easier control. Therefore, our protocols yield higher OT-rates for many realistic noise parameter…
Oblivious transfer is an important primitive in modern cryptography. Applications include secure multiparty computation, oblivious sampling, e-voting, and signatures. Information-theoretically secure perfect 1-out-of 2 oblivious transfer is impossible to achieve. Imperfect variants, where both participants' ability to cheat is still limited, are possible using quantum means while remaining classically impossible. Precisely what security parameters are attainable remains unknown. We introduce a theoretical framework for studying semirandom quantum oblivious transfer, which is shown to be equiva…
In 1-out-of-2 oblivious transfer (OT), Alice inputs numbers x_0, x_1, Bob inputs a bit b and outputs x_b. Secure OT requires that Alice and Bob learn nothing about b and x_{\bar{b}}, respectively. We define spacetime-constrained oblivious transfer (SCOT) as OT in Minkowski spacetime in which Bob must output x_b within R_b, where R_0 and R_1 are fixed spacelike separated spacetime regions. We show that unconditionally secure SCOT is impossible with classical protocols in Minkowski (or Galilean) spacetime, or with quantum protocols in Galilean spacetime. We describe a quantum SCOT protocol in Mi…
Due to the commonly known impossibility results, unconditional security for oblivious transfer is seen as impossible even in the quantum world. In this paper, we try to overcome these impossibility results by proposing a protocol which is asymptotically secure. The protocol makes use of the basic properties of non-orthogonal quantum states. Apart from security, the advantages of our protocol include the fact that the honest players do not need to have quantum memory or create entanglement between individual qubits. The relation of our work to the known impossibility results is also discussed.
Quantum oblivious transfer (QOT) is an essential cryptographic primitive. But unconditionally secure QOT is known to be impossible. Here we propose a practical QOT protocol, which is perfectly secure against dishonest sender without relying on any technological assumption. Meanwhile, it is also secure against dishonest receiver in the absence of long-term quantum memory and complicated collective measurements. The protocol is extremely feasible, as it can be implemented using currently available Mach-Zehnder interferometer, and no quantum memory, collective measurements nor entanglement are ne…
Cryptography's importance in our everyday lives continues to grow in our increasingly digital world. Oblivious transfer (OT) has long been a fundamental and important cryptographic primitive since it is known that general two-party cryptographic tasks can be built from this basic building block. Here we show the experimental implementation of a 1-2 random oblivious transfer (ROT) protocol by performing measurements on polarization-entangled photon pairs in a modified entangled quantum key distribution system, followed by all of the necessary classical post-processing including one-way error co…
Quantum cryptography is the field of cryptography that explores the quantum properties of matter. Its aim is to develop primitives beyond the reach of classical cryptography or to improve on existing classical implementations. Although much of the work in this field is dedicated to quantum key distribution (QKD), some important steps were made towards the study and development of quantum oblivious transfer (QOT). It is possible to draw a comparison between the application structure of both QKD and QOT primitives. Just as QKD protocols allow quantum-safe communication, QOT protocols allow quant…
In quantum weak oblivious transfer, Alice sends Bob two bits and Bob can learn one of the bits at his choice. It was found that the security of such a protocol is bounded by $2P_{Alice}^{\ast }+P_{Bob}^{\ast }\geq 2$, where $P_{Alice}^{\ast }$ is the probability with which Alice can guess Bob's choice, and $P_{Bob}^{\ast }$ is the probability with which Bob can guess both of Alice's bits\ given that he learns one of the bits with certainty. Here we propose a protocol and show that as long as Alice is restricted to individual measurements, then both $P_{Alice}^{\ast }$ and $P_{Bob}^{\ast }$ can…
We prove the unconditional security of a quantum key distribution (QKD) protocol on a noisy channel against the most general attack allowed by quantum physics. We use the fact that in a previous paper we have reduced the proof of the unconditionally security of this QKD protocol to a proof that a corresponding Quantum String Oblivious Transfer (String-QOT) protocol would be unconditionally secure against Bob if implemented on top of an unconditionally secure bit commitment scheme. We prove a lemma that extends a security proof given by Yao for a (one bit) QOT protocol to this String-QOT protoc…
While unconditionally secure bit commitment (BC) is considered impossible within the quantum framework, it can be obtained under relativistic or experimental constraints. Here we study whether such BC can lead to secure quantum oblivious transfer (QOT). The answer is not completely negative. On one hand, we provide a detailed cheating strategy, showing that the "honest-but-curious adversaries" in some of the existing no-go proofs on QOT still apply even if secure BC is used, enabling the receiver to increase the average reliability of the decoded value of the transferred bit. On the other hand…
Among the most studied tasks in Quantum Cryptography one can find Bit Commitment (BC) and Oblivious Transfer (OT), two central cryptographic primitives. In this paper we propose for the first time protocols for these tasks in the measurement-device independent (MDI) settings and analyze their security. We analyze two different cases: first we assume the parties have access to perfect single photon sources (but still in the presence of noise and losses), and second we assume that they only have imperfect single photon sources. In the first case we propose a protocol for both BC and OT and prove…
A simple and efficient protocol for quantum oblivious transfer is proposed. The protocol can easily be implemented with present technology and is secure against cheaters with unlimited computing power provided the receiver does not have the technology to store the particles for an arbitrarily long period of time. The proposed protocol is a significant improvement over the previous protocols. Unlike the protocol of Crépeau and Kilian which is secure if only if the spin of the particle is measured along the $x$ or the $y$ axis, the present protocol is perfectly secure no matter along which axes …
We study the cryptographic primitive Oblivious Transfer; a composable construction of this resource would allow arbitrary multi-party computation to be carried out in a secure way, i.e. to compute functions in a distributed way while keeping inputs from different parties private. First we review a framework that allows us to analyze composability of classical and quantum cryptographic protocols in special relativity: Abstract Cryptography implemented with Causal Boxes. We then (1) explore and formalize different versions of oblivious transfer found in the literature, (2) prove that their equiv…
Oblivious transfer protocols (R-OT and OT$_{1}^{2}$) are presented based on non-orthogonal states transmission, and the bit commitment protocols on the top of OT$_{1}^{2}$ are constructed. Although these OT protocols are all unconditional secure, the bit commitment protocols based on OT protocols are not secure against attack similar to that presented by no-go theorem.
We present a device independently secure quantum scheme for p-threshold all-or-nothing oblivious transfer. Novelty of the scheme is that, its security does not depend -- unlike the usual case -- on any quantum bit commitment protocol, rather it depends on Hardy's argument for two-qubit system. This scheme is shown to be unconditionally secure against any strategy allowed by quantum mechanics. By providing a secure scheme for all-or-nothing quantum oblivious transfer, we have answered a long standing open problem, other than the quantum key distribution, whether there is any two-party quantum c…
The oblivious transfer primitive is sufficient to implement secure multiparty computation. However, secure multiparty computation based only on classical cryptography is severely limited by the security and efficiency of the oblivious transfer implementation. We present a method to efficiently and securely generate and distribute oblivious keys by exchanging qubits and by performing commitments using classical hash functions. With the presented hybrid approach, quantum and classical, we obtain a practical and high-speed oblivious transfer protocol, secure even against quantum computer attacks.…
This study proposes a simple and efficient one-out-of-two quantum oblivious transfer (QOT) protocol based on nonorthogonal states. The nonorthogonal property grants quantum bit immunity to some operations in order to achieve the irreversible goal of discarding a message, resulting in a one-out-of-two selection effect. In addition, it can also prevent entangled cheating from an illegal agent. The resulting QOT protocol is therefore built directly on quantum resources, rather than on a two-level structure which must first create two classical keys using the quantum resources (all-or-nothing QOT)…
In the m-out-of-n oblivious transfer (OT) model, one party Alice sends n bits to another party Bob, Bob can get only m bits from the n bits. However, Alice cannot know which m bits Bob received. Y.Mu[MJV02]} and Naor[Naor01] presented classical m-out-of-n oblivious transfer based on discrete logarithm. As the work of Shor [Shor94], the discrete logarithm can be solved in polynomial time by quantum computers, so such OTs are unsafe to the quantum computer. In this paper, we construct a quantum m-out-of-n OT (QOT) scheme based on the transmission of polarized light and show that the scheme is ro…
Oblivious transfer is a fundamental cryptographic primitive in which Bob transfers one of two bits to Alice in such a way that Bob cannot know which of the two bits Alice has learned. We present an optimal security bound for quantum oblivious transfer protocols under a natural and demanding definition of what it means for Alice to cheat. Our lower bound is a smooth tradeoff between the probability B with which Bob can guess Alice's bit choice and the probability A with which Alice can guess both of Bob's bits given that she learns one of the bits with certainty. We prove that 2B + A is greater…
Higher security and lower failure probability have always been people's pursuits in quantum-oblivious-key-transfer-based private query (QOKT-PQ) protocols since Jacobi \emph{et al}. [Phys. Rev. A 83, 022301 (2011)] proposed the first protocol of this kind. However, higher database security generally has to be obtained at the cost of a higher failure probability, and vice versa. Recently, based on a round-robin differential-phase-shift quantum key distribution protocol, Liu \emph{et al}. [Sci. China-Phys. Mech. Astron.58, 100301 (2015)] presented a private query protocol (RRDPS-PQ protocol) uti…
We present a bit-string quantum oblivious transfer protocol based on single-qubit rotations. Our protocol is built upon a previously proposed quantum public-key protocol and its practical security relies on the laws of Quantum Mechanics. Practical security is reflected in the fact that, due to technological limitations, the receiver (Bob) of the transferred bit-string is restricted to performing only "few-qubit" coherent measurements. We also present a single-bit oblivious transfer based on the proposed bit-string protocol. The protocol can be implemented with current technology based on optic…
Oblivious Transfer, a fundamental problem in the field of secure multi-party computation is defined as follows: A database DB of N bits held by Bob is queried by a user Alice who is interested in the bit DB_b in such a way that (1) Alice learns DB_b and only DB_b and (2) Bob does not learn anything about Alice's choice b. While solutions to this problem in the classical domain rely largely on unproven computational complexity theoretic assumptions, it is also known that perfect solutions that guarantee both database and user privacy are impossible in the quantum domain. Jakobi et al. [Phys. Re…
MiniQCrypt is a world where quantum-secure one-way functions exist, and quantum communication is possible. We construct an oblivious transfer (OT) protocol in MiniQCrypt that achieves simulation-security in the plain model against malicious quantum polynomial-time adversaries, building on the foundational work of Bennett, Brassard, Crépeau and Skubiszewska (CRYPTO 1991). Combining the OT protocol with prior works, we obtain secure two-party and multi-party computation protocols also in MiniQCrypt. This is in contrast to the classical world, where it is widely believed that one-way functions al…
We investigate the situation in which no information can be transferred from a quantum system B to a quantum system A, even though both interact with a common system C.
In one-out-of-$m$ spacetime-constrained oblivious transfer (SCOT), Alice and Bob agree on $m$ pairwise spacelike separated output spacetime regions $R_0,R_1,\ldots, R_{m-1}$ in an agreed reference frame in a spacetime that is Minkowski, or close to Minkowski; Alice inputs a message $x_i$ in the causal past of a spacetime point $Q_i$ of $R_i$, for $i\in\{0,1,\ldots,m-1\}$; Bob inputs $b\in\{0,1,\ldots,m-1\}$ in the intersection of the causal pasts of $Q_0,Q_1,\ldots,Q_{m-1}$ and outputs $x_b$ in $R_b$; Alice remains oblivious to $b$ anywhere in spacetime; and Bob is unable to obtain $x_i$ in $R…
Due to the impossibility results of Mayers and Lo/Chau it is generally thought that a quantum channel is cryptographically strictly weaker than oblivious transfer. In this paper we prove that in a three party scenario a quantum channel can be strictly stronger than oblivious transfer. With the protocol introduced in this paper we can completely classify the cryptographic strength of quantum multi party protocols.
