Oblivious transfer (OT) is an essential building block for secure multiparty computation. Up to now, one- and two-server OT protocols have been investigated. It has been proven that unconditionally secure one-server OT is impossible even with the quantum system. Recently, Hayashi and Song proposed the first two-server OT protocol for quantum messages [Adv. Quantum Technol. 7, 2300184 (2024)], which is the only one for two-server OT for quantum messages to our knowledge. This protocol has the assumption that two quantum servers do not communicate with each other. However, it is unrealistic to make such an assumption. In addition, an equation error occurs in the protocol description. To tackle these issues, we first point out the equation error existent in the protocol of Hayashi and Song and correct it. Then, we propose a two-server OT protocol for quantum messages by using entanglement swapping. Security analysis shows that the user privacy holds even if the two quantum servers communicate mutually.Oblivious transfer (OT) is an essential building block for secure multiparty computation. Up to now, one- and two-server OT protocols have been investigated. It has been proven that unconditionally secure one-server OT is impossible even with the quantum system. Recently, Hayashi and Song proposed the first two-server OT protocol for quantum messages [Adv. Quantum Technol. 7, 2300184 (2024)], which is the only one for two-server OT for quantum messages to our knowledge. This protocol has the assumption that two quantum servers do not communicate with each other. However, it is unrealistic to make such an assumption. In addition, an equation error occurs in the protocol description. To tackle these issues, we first point out the equation error existent in the protocol of Hayashi and Song and correct it. Then, we propose a two-server OT protocol for quantum messages by using entanglement swapping. Security analysis shows that the user privacy holds even if the two quantum servers communicate mutually.

Physical Review ASep 8, 20254 citations

Two‐Server Oblivious Transfer for Quantum Messages

Masahito Hayashi, Seunghoan Song

Abstract Oblivious transfer is considered as a cryptographic primitive task for quantum information processing over a quantum network. It is an essential building block for secure multiparty computation. It is known that one‐server oblivious transfer is impossible. When the task is the transmission of classical messages, protocols for two‐server oblivious transfer exist, i.e., existing protocols work under the assumption that two servers do not communicate with each other. However, when the task is the transmission of a quantum state, no existing method works even under the above two‐server assumption. Two‐server oblivious transfer protocols for quantum messages are proposed for the first time.Abstract Oblivious transfer is considered as a cryptographic primitive task for quantum information processing over a quantum network. It is an essential building block for secure multiparty computation. It is known that one‐server oblivious transfer is impossible. When the task is the transmission of classical messages, protocols for two‐server oblivious transfer exist, i.e., existing protocols work under the assumption that two servers do not communicate with each other. However, when the task is the transmission of a quantum state, no existing method works even under the above two‐server assumption. Two‐server oblivious transfer protocols for quantum messages are proposed for the first time.

arXiv:2211.03308Advanced Quantum TechnologiesFeb 8, 20242 citations

Quantum message exchanging network using entanglement swapping and decoy photons

Negin Fatahi

Scientific Research and EssaysMar 9, 20120 citations

One-Out-of-q OT Combiners

Oriol Farràs, Jordi Ribes-González

In 1-out-of- $q$ Oblivious Transfer (OT) protocols, a sender Alice is able to send one of $q\ge 2$ messages to a receiver Bob, all while being oblivious to which message was transferred. Moreover, the receiver learns only one of these messages. Oblivious Transfer combiners take $n$ instances of OT protocols as input, and produce an OT protocol that is secure if sufficiently many of the $n$ original OT instances are secure. We present new 1-out-of- $q$ OT combiners that are perfectly secure against active adversaries. Our combiners arise from secret sharing techniques. We show that given an $\mathbb {F}_{q}$ -linear secret sharing scheme on a set of $n$ participants and adversary structure $\mathcal {A}$ , we can construct an $n$ -server, 1-out-of- $q$ OT combiner that is secure against an adversary corrupting either Alice and a set of servers in $\mathcal {A}$ , or Bob and a set of servers $B$ with $\bar {B}\notin \mathcal {A}$ . If the normalized total share size of the scheme is$\ell $, then the resulting OT combiner requires$ \ell $calls to OT protocols, and the total amount of bits exchanged during the protocol is$ (q^{2}+q+1)\ell \log q $. We also present a construction based on 1-out-of-2 OT combiners that uses the protocol of Crépeau, Brassard and Robert (FOCS 1986). This construction provides smaller communication costs for certain adversary structures, such as threshold ones: For any prime power$ q\geq n $, there are$ n $-server, 1-out-of-$ q $OT combiners that are perfectly secure against active adversaries corrupting either Alice or Bob, and a minority of the OT candidates, exchanging$ O(qn\log q)$bits in total.In 1-out-of-$q$Oblivious Transfer (OT) protocols, a sender Alice is able to send one of$q\ge 2$messages to a receiver Bob, all while being oblivious to which message was transferred. Moreover, the receiver learns only one of these messages. Oblivious Transfer combiners take$n$instances of OT protocols as input, and produce an OT protocol that is secure if sufficiently many of the$n$original OT instances are secure. We present new 1-out-of-$q$OT combiners that are perfectly secure against active adversaries. Our combiners arise from secret sharing techniques. We show that given an$\mathbb {F}_{q}$-linear secret sharing scheme on a set of$n$participants and adversary structure$\mathcal {A}$, we can construct an$n$-server, 1-out-of-$q$OT combiner that is secure against an adversary corrupting either Alice and a set of servers in$\mathcal {A}$, or Bob and a set of servers$B$with$\bar {B}\notin \mathcal {A}$. If the normalized total share size of the scheme is$\ell $, then the resulting OT combiner requires$\ell $calls to OT protocols, and the total amount of bits exchanged during the protocol is$(q^{2}+q+1)\ell \log q$. We also present a construction based on 1-out-of-2 OT combiners that uses the protocol of Crépeau, Brassard and Robert (FOCS 1986). This construction provides smaller communication costs for certain adversary structures, such as threshold ones: For any prime power$q\geq n$, there are$n$-server, 1-out-of-$q$OT combiners that are perfectly secure against active adversaries corrupting either Alice or Bob, and a minority of the OT candidates, exchanging$O(qn\log q)$bits in total.

IEEE Transactions on Information TheoryDec 7, 20232 citations

Two Way Quantum Direct Communication Protocol Using Entanglement Swapping

Hyung-Jin Yang, Changho Hong, Jong In Lim +1 more

Journal of the Korean Physical SocietyJun 14, 201010 citations

In 1-out-of-

q

Oblivious Transfer (OT) protocols, a sender Alice is able to send one of

q\ge 2

messages to a receiver Bob, all while being oblivious to which message was transferred. Moreover, the receiver learns only one of these messages. Oblivious Transfer combiners take

n

instances of OT protocols as input, and produce an OT protocol that is secure if sufficiently many of the

n

original OT instances are secure. We present new 1-out-of-

q

OT combiners that are perfectly secure against active adversaries. Our combiners arise from secret sharing techniques. We show that given an

\mathbb {F}_{q}

-linear secret sharing scheme on a set of

n

participants and adversary structure

\mathcal {A}

, we can construct an

n

-server, 1-out-of-

q

OT combiner that is secure against an adversary corrupting either Alice and a set of servers in

\mathcal {A}

, or Bob and a set of servers

B

with

\bar {B}\notin \mathcal {A}

. If the normalized total share size of the scheme is$\ell

, then the resulting OT combiner requires

\ell

calls to OT protocols, and the total amount of bits exchanged during the protocol is

(q^{2}+q+1)\ell \log q

. We also present a construction based on 1-out-of-2 OT combiners that uses the protocol of Crépeau, Brassard and Robert (FOCS 1986). This construction provides smaller communication costs for certain adversary structures, such as threshold ones: For any prime power

q\geq n

, there are

-server, 1-out-of-

OT combiners that are perfectly secure against active adversaries corrupting either Alice or Bob, and a minority of the OT candidates, exchanging

O(qn\log q)$bits in total.