Challenges
Datasets
Workspaces
Papers
Discussions
Leaderboard
Log inSign up
Challenges
Datasets
Workspaces
Papers
Discussions
Leaderboard
Blog
Job Board
Q3AS

© 2026 Aqora Quantum S.A.S.

TermsPrivacyLegal Notice

arXiv:2007.04712 · PRX Quantum

Imperfect 1-Out-of-2 Quantum Oblivious Transfer: Bounds, a Protocol, and its Experimental Implementation

Ryan Amiri, Robert Stárek, David Reichmuth, Ittoop V. Puthoor, Michal Mičuda, Ladislav Mišta, Jr., Miloslav Dušek, Petros Wallden, Erika Andersson

Published Mar 1, 2021• 32 citations
arXivHTMLPDF

Abstract

Oblivious transfer is an important primitive in modern cryptography.Applications include secure multiparty computation, oblivious sampling, e-voting, and signatures.Information-theoretically secure perfect 1-out-of 2 oblivious transfer is impossible to achieve.Imperfect variants, where both participants' ability to cheat is still limited, are possible using quantum means while remaining classically impossible.Precisely what security parameters are attainable remains unknown.We introduce a theoretical framework for studying semirandom quantum oblivious transfer, which is shown to be equivalent to regular oblivious transfer in terms of cheating probabilities.We then use it to derive bounds on cheating.We also present a protocol with lower cheating probabilities than previous schemes, together with its optical realization.We show that a lower bound of 2 3 on the minimum achievable cheating probability can be directly derived for semirandom protocols using a different method and definition of cheating than used previously.The lower bound increases from 23 to approximately 0.749 if the states output by the protocol are pure and symmetric.The oblivious transfer scheme we present uses unambiguous state elimination measurements and can be implemented with the same technological requirements as standard quantum cryptography.In particular, it does not require honest participants to prepare or measure entangled states.The cheating probabilities are 3 4 and approximately 0.729 for sender and receiver, respectively, which is lower than in existing protocols.Using a photonic testbed, we have implemented the protocol with honest parties, as well as optimal cheating strategies.Because of the asymmetry of the receiver's and sender's cheating probabilities, the protocol can be combined with a "trivial" protocol to achieve an overall protocol with lower average cheating probabilities of approximately 0.74 for both sender and receiver.This demonstrates that, interestingly, protocols where the final output states are pure and symmetric are not optimal in terms of average cheating probability.

DOI
10.1103/prxquantum.2.010335

Related papers

Incomplete quantum oblivious transfer with perfect one-sided security

David Reichmuth, Ittoop V. Puthoor, Petros Wallden +1 more

Oblivious transfer is a fundamental cryptographic primitive that is useful for secure multiparty computation. There are several variants of oblivious transfer. We consider 1-out-of-2 oblivious transfer, where a sender sends two bits of information to a receiver. The receiver receives only one of the two bits, while the sender does not know which bit the receiver has received. Perfect quantum oblivious transfer with information-theoretic security is known to be impossible. We aim to find the lowest possible cheating probabilities. Bounds on cheating probabilities have been investigated for “complete” protocols, where if both parties follow the protocol, the bit value obtained by the receiver matches the sender's bit value. We instead investigate incomplete protocols, where the receiver obtains an incorrect bit value with probability p f . We present optimal noninteractive protocols where Alice's bit values are encoded in four symmetric pure quantum states, and where she cannot cheat better than with a random guess. We find the protocols such that for a given p f , Bob's cheating probability p r is as low as possible, and vice versa. Furthermore, we show that noninteractive quantum protocols can outperform noninteractive classical protocols and give a lower bound on Bob's cheating probability in interactive quantum protocols. Importantly for optical implementations, our protocols do not require entanglement nor quantum memory.

arXiv:2409.17571•Physical Review Research•Jul 23, 2025•0 citations

Lower bounds for Quantum Oblivious Transfer

André Chailloux, Iordanis Kerenidis, Jamie Sikora

Oblivious transfer is a fundamental primitive in cryptography. While perfect information theoretic security is impossible, quantum oblivious transfer protocols can limit the dishonest players' cheating. Finding the optimal security parameters in such protocols is an important open question. In this paper we show that every 1-out-of-2 oblivious transfer protocol allows a dishonest party to cheat with probability bounded below by a constant strictly larger than $1/2$. Alice's cheating is defined as her probability of guessing Bob's index, and Bob's cheating is defined as his probability of guessing both input bits of Alice. In our proof, we relate these cheating probabilities to the cheating probabilities of a coin flipping protocol and conclude by using Kitaev's coin flipping lower bound. Then, we present an oblivious transfer protocol with two messages and cheating probabilities at most $3/4$. Last, we extend Kitaev's semidefinite programming formulation to more general primitives, where the security is against a dishonest player trying to force the outcome of the other player, and prove optimal lower and upper bounds for them.

Leibniz international proceedings in informatics•Jan 1, 2010•2 citations

Noninteractive xor Quantum Oblivious Transfer: Optimal Protocols and Their Experimental Implementations

Lara Stroh, Nikola Horová, Robert Stárek +4 more

Oblivious transfer (OT) is an important cryptographic primitive.Any multiparty computation can be realized with OT as building block.XOR oblivious transfer (XOT) is a variant where the sender Alice has two bits and a receiver Bob obtains either the first bit, the second bit, or their XOR.Bob should not learn anything more than this and Alice should not learn what Bob has learnt.Perfect quantum OT with information-theoretic security is known to be impossible.We determine the smallest possible cheating probabilities for unrestricted dishonest parties in noninteractive quantum XOT protocols using symmetric pure states and present an optimal protocol, which outperforms classical protocols.We also "reverse" this protocol, so that Bob becomes sender of a quantum state and Alice the receiver who measures it, while still implementing oblivious transfer from Alice to Bob.Cheating probabilities for both parties stay the same as for the unreversed protocol.We optically implement both the unreversed and the reversed protocols, and cheating strategies, noting that the reversed protocol is easier to implement.

arXiv:2209.11300•PRX Quantum•May 4, 2023•16 citations

Lower bounds for quantum oblivious transfer

André Chailloux, Iordanis Kerenidis, Jamie Sikora

Oblivious transfer is a fundamental primitive in cryptography. While perfect information theoretic security is impossible, quantum oblivious transfer protocols can limit the dishonest player's cheating. Finding the optimal security parameters in such protocols is an important open question. In this paper we show that every 1-out-of-2 oblivious transfer protocol allows a dishonest party to cheat with probability bounded below by a constant strictly larger than $1/2$. Alice's cheating is defined as her probability of guessing Bob's index, and Bob's cheating is defined as his probability of guessing both input bits of Alice. In our proof, we relate these cheating probabilities to the cheating probabilities of a bit commitment protocol and conclude by using lower bounds on quantum bit commitment. Then, we present an oblivious transfer protocol with two messages and cheating probabilities at most $3/4$. Last, we extend Kitaev's semidefinite programming formulation to more general primitives, where the security is against a dishonest player trying to force the outcome of the other player, and prove optimal lower and upper bounds for them.

Quantum Information and Computation•Jan 1, 2013•34 citations

Lower Bounds for Quantum Oblivious Transfer

André Chailloux, Iordanis Kerenidis, Jamie Sikora

Oblivious transfer is a fundamental primitive in cryptography. While perfect information theoretic security is impossible, quantum oblivious transfer protocols can limit the dishonest players' cheating. Finding the optimal security parameters in such protocols is an important open question. In this paper we show that every 1-out-of-2 oblivious transfer protocol allows a dishonest party to cheat with probability bounded below by a constant strictly larger than 1/2. Alice's cheating is defined as her probability of guessing Bob's index, and Bob's cheating is defined as his probability of guessing both input bits of Alice. In our proof, we relate these cheating probabilities to the cheating probabilities of a coin flipping protocol and conclude by using Kitaev's coin flipping lower bound. Then, we present an oblivious transfer protocol with two messages and cheating probabilities at most 3/4. Last, we extend Kitaev's semidefinite programming formulation to more general primitives, where the security is against a dishonest player trying to force the outcome of the other player, and prove optimal lower and upper bounds for them.

arXiv:1007.1875•Jul 12, 2010•4 citations

Mixed States in Quantum Rabin Oblivious Transfer

James T. Peat, Lara Stroh, Kenny Campbell +1 more

Oblivious transfer (OT) is a fundamental cryptographic primitive that is useful for realizing any two-party computation. Since information-theoretically secure perfect OT is impossible classically and quantumly, research has focused on imperfect protocols, exploring how close to perfect one can get against unbounded dishonest parties. While current approaches often make use of pure quantum states, recent work suggests that mixed quantum states may improve performance. In this paper, we investigate the use of mixed quantum states in Rabin oblivious transfer, where a sender holds one bit and a receiver learns its value with a certain probability while the sender remains ignorant of whether the receiver learned it. We present three mixed-state protocols constructed with two distinct methods, extending an existing pure-state scheme and employing a probabilistic approach, and demonstrate improved performance compared to classical and quantum pure-state protocols across varying parameters.

quant-pharXiv:2610.09796•Oct 8, 2026•0 citations
Oblivious transfer is an important primitive in modern cryptography.Applications include secure multiparty computation, oblivious sampling, e-voting, and signatures.Information-theoretically secure perfect 1-out-of 2 oblivious transfer is impossible to achieve.Imperfect variants, where both participants' ability to cheat is still limited, are possible using quantum means while remaining classically impossible.Precisely what security parameters are attainable remains unknown.We introduce a theoretical framework for studying semirandom quantum oblivious transfer, which is shown to be equivalent to regular oblivious transfer in terms of cheating probabilities.We then use it to derive bounds on cheating.We also present a protocol with lower cheating probabilities than previous schemes, together with its optical realization.We show that a lower bound of 2 3 on the minimum achievable cheating probability can be directly derived for semirandom protocols using a different method and definition of cheating than used previously.The lower bound increases from 23 to approximately 0.749 if the states output by the protocol are pure and symmetric.The oblivious transfer scheme we present uses unambiguous state elimination measurements and can be implemented with the same technological requirements as standard quantum cryptography.In particular, it does not require honest participants to prepare or measure entangled states.The cheating probabilities are 3 4 and approximately 0.729 for sender and receiver, respectively, which is lower than in existing protocols.Using a photonic testbed, we have implemented the protocol with honest parties, as well as optimal cheating strategies.Because of the asymmetry of the receiver's and sender's cheating probabilities, the protocol can be combined with a "trivial" protocol to achieve an overall protocol with lower average cheating probabilities of approximately 0.74 for both sender and receiver.This demonstrates that, interestingly, protocols where the final output states are pure and symmetric are not optimal in terms of average cheating probability.
Oblivious transfer is a fundamental cryptographic primitive that is useful for secure multiparty computation. There are several variants of oblivious transfer. We consider 1-out-of-2 oblivious transfer, where a sender sends two bits of information to a receiver. The receiver receives only one of the two bits, while the sender does not know which bit the receiver has received. Perfect quantum oblivious transfer with information-theoretic security is known to be impossible. We aim to find the lowest possible cheating probabilities. Bounds on cheating probabilities have been investigated for “complete” protocols, where if both parties follow the protocol, the bit value obtained by the receiver matches the sender's bit value. We instead investigate incomplete protocols, where the receiver obtains an incorrect bit value with probability p f . We present optimal noninteractive protocols where Alice's bit values are encoded in four symmetric pure quantum states, and where she cannot cheat better than with a random guess. We find the protocols such that for a given p f , Bob's cheating probability p r is as low as possible, and vice versa. Furthermore, we show that noninteractive quantum protocols can outperform noninteractive classical protocols and give a lower bound on Bob's cheating probability in interactive quantum protocols. Importantly for optical implementations, our protocols do not require entanglement nor quantum memory.
Oblivious transfer is a fundamental primitive in cryptography. While perfect information theoretic security is impossible, quantum oblivious transfer protocols can limit the dishonest players' cheating. Finding the optimal security parameters in such protocols is an important open question. In this paper we show that every 1-out-of-2 oblivious transfer protocol allows a dishonest party to cheat with probability bounded below by a constant strictly larger than 1/21/21/2. Alice's cheating is defined as her probability of guessing Bob's index, and Bob's cheating is defined as his probability of guessing both input bits of Alice. In our proof, we relate these cheating probabilities to the cheating probabilities of a coin flipping protocol and conclude by using Kitaev's coin flipping lower bound. Then, we present an oblivious transfer protocol with two messages and cheating probabilities at most 3/43/43/4. Last, we extend Kitaev's semidefinite programming formulation to more general primitives, where the security is against a dishonest player trying to force the outcome of the other player, and prove optimal lower and upper bounds for them.
Oblivious transfer (OT) is an important cryptographic primitive.Any multiparty computation can be realized with OT as building block.XOR oblivious transfer (XOT) is a variant where the sender Alice has two bits and a receiver Bob obtains either the first bit, the second bit, or their XOR.Bob should not learn anything more than this and Alice should not learn what Bob has learnt.Perfect quantum OT with information-theoretic security is known to be impossible.We determine the smallest possible cheating probabilities for unrestricted dishonest parties in noninteractive quantum XOT protocols using symmetric pure states and present an optimal protocol, which outperforms classical protocols.We also "reverse" this protocol, so that Bob becomes sender of a quantum state and Alice the receiver who measures it, while still implementing oblivious transfer from Alice to Bob.Cheating probabilities for both parties stay the same as for the unreversed protocol.We optically implement both the unreversed and the reversed protocols, and cheating strategies, noting that the reversed protocol is easier to implement.
Oblivious transfer is a fundamental primitive in cryptography. While perfect information theoretic security is impossible, quantum oblivious transfer protocols can limit the dishonest player's cheating. Finding the optimal security parameters in such protocols is an important open question. In this paper we show that every 1-out-of-2 oblivious transfer protocol allows a dishonest party to cheat with probability bounded below by a constant strictly larger than 1/21/21/2. Alice's cheating is defined as her probability of guessing Bob's index, and Bob's cheating is defined as his probability of guessing both input bits of Alice. In our proof, we relate these cheating probabilities to the cheating probabilities of a bit commitment protocol and conclude by using lower bounds on quantum bit commitment. Then, we present an oblivious transfer protocol with two messages and cheating probabilities at most 3/43/43/4. Last, we extend Kitaev's semidefinite programming formulation to more general primitives, where the security is against a dishonest player trying to force the outcome of the other player, and prove optimal lower and upper bounds for them.
Oblivious transfer is a fundamental primitive in cryptography. While perfect information theoretic security is impossible, quantum oblivious transfer protocols can limit the dishonest players' cheating. Finding the optimal security parameters in such protocols is an important open question. In this paper we show that every 1-out-of-2 oblivious transfer protocol allows a dishonest party to cheat with probability bounded below by a constant strictly larger than 1/2. Alice's cheating is defined as her probability of guessing Bob's index, and Bob's cheating is defined as his probability of guessing both input bits of Alice. In our proof, we relate these cheating probabilities to the cheating probabilities of a coin flipping protocol and conclude by using Kitaev's coin flipping lower bound. Then, we present an oblivious transfer protocol with two messages and cheating probabilities at most 3/4. Last, we extend Kitaev's semidefinite programming formulation to more general primitives, where the security is against a dishonest player trying to force the outcome of the other player, and prove optimal lower and upper bounds for them.
Oblivious transfer (OT) is a fundamental cryptographic primitive that is useful for realizing any two-party computation. Since information-theoretically secure perfect OT is impossible classically and quantumly, research has focused on imperfect protocols, exploring how close to perfect one can get against unbounded dishonest parties. While current approaches often make use of pure quantum states, recent work suggests that mixed quantum states may improve performance. In this paper, we investigate the use of mixed quantum states in Rabin oblivious transfer, where a sender holds one bit and a receiver learns its value with a certain probability while the sender remains ignorant of whether the receiver learned it. We present three mixed-state protocols constructed with two distinct methods, extending an existing pure-state scheme and employing a probabilistic approach, and demonstrate improved performance compared to classical and quantum pure-state protocols across varying parameters.