What is Quantum Oblivious Transfer (QOT) ?

Quantum Oblivious Transfer (QOT) is a quantum cryptographic primitive enabling a sender, Alice, to convey information to a receiver, Bob, while ensuring that Alice is unaware of the specific piece of information received by Bob, who, in turn, accesses only his selected information without acquiring knowledge of the other information possessed by Alice. The initial notion that contributed to QOT was “quantum multiplexing”, introduced by Wiesner in 1983.

How does Oblivious Transfer work?

A specific variant of the QOT protocol described is the “ideal one-photon standard QOTP.” This protocol, characterized as perfectly safe under optimal conditions (flawless transmissions and detectors, with no deceit from either party), includes the following steps:

1. Alice’s Preparation: Alice owns two secret bits, x₀ and x₁. She also generates two random bits, a and b. Based on these bits, she prepares a single photon in one of four polarization states and sends it to Bob:
   • If a=0 and b=0, the photon is polarized at 0⁰ (state |0⟩).
   • If a=0 and b=1, the photon is polarized at 90⁰(state |1⟩).
   • If a=1 and b=0, the photon is polarized at 45⁰ (state |+⟩ = (|0⟩ + |1⟩) / √2)
   • If a=1 and b=1, the photon is polarized at 135⁰ (state |-⟩ = (|0⟩ – |1⟩) / √2)
2. Bob’s Measurement: Bob wants to learn one of Alice’s bits, say x_c, where c is either 0 or 1, without learning the other bit x_1-c. To achieve this, Bob chooses a random bit c̄ and another random bit d. He then measures the photon he received from Alice in one of two bases, determined by c̄ :
   • If c̄= 0, Bob measures in the rectilinear basis |0⟩, |1⟩ (0⁰/90⁰).
   • If c̄= 1, Bob measures in the diagonal basis {|+⟩, |-⟩ (45⁰/135⁰).
   • Bob records the outcome of his measurement as m.
3. Announcement: Bob announces his choice of basis c̄ to Alice but keeps his choices of d and the measurement outcome m secret.
4. Alice’s Response: Alice reveals her choice of basis a to Bob.
5. Information Transfer: The crucial part of the oblivious transfer happens here:

• If Alice’s chosen basis a matches Bob’s chosen basis c̄(a ≠  c̄), Bob can infer information related to his desired bit x_c. Specifically:
  • If a = c̄= 0, then his measurement outcome m is related to x_c by m = x_c ⊕  b ⊕ d.
  • If a = c̄= 1, then his measurement outcome m is related to x_c by m = x_c ⊕  b ⊕ d.
  • Since b and d are random bits unknown to Alice, she remains ignorant of what Bob has learned about x_c.
• If Alice’s basis a is different from Bob’s basis c̄ (a≠ c̄), Bob’s measurement outcome m will be uncorrelated with Alice’s secret bits x₀ and x₁, thus providing him with no information about them.

Oblivious Transfer Phase: The “ideal” protocol notes that further steps are required for Bob to obtain x_c without Alice knowing his choice c, and without Bob learning x_1-c. These subsequent steps are not detailed in this specific description. However, a remark in the source mentions that a paper by Bennett et al. (1991) discusses how to derive and verify the parameters of the initial photon preparation and considers a more realistic situation using dim light pulses instead of single photons. This paper likely expands on the subsequent phases necessary for a complete oblivious transfer.

Security of Quantum Oblivious Transfer

The meaning of oblivious transfer in cryptography lies in its nature. It has been established in the classical setting that a 1-out-of-2 oblivious transfer protocol can serve as a building block to securely implement any two-way cryptographic protocol. The existence of a secure QOT primitive highly desirable for quantum cryptography.

However, the situation in the quantum is more complex. It is not clear whether an unconditionally secure QOT protocol exists. It is also uncertain if the standard reduction of a general quantum cryptographic protocol to oblivious transfer works securely in the quantum setting.

The security of quantum cryptographic protocols, in general, depends on principles of quantum mechanics, such as the no-cloning theorem, which prevents the perfect copying of unknown quantum states. Any attempt by an eavesdropper, often called Eve, to intercept and measure the quantum signals will, in general, introduce a detectable disturbance due to the act of measurement. This allows the genuine parties, Alice and Bob, to detect potential eavesdropping.

However, the security of QOT specifically has been a subject of wide research. Early protocols, such as the one by Crépeau and Kilian (1988), were considered secure under certain assumptions, like the inability of either party to store photons for extended periods and Eve’s use of only measurements. Mayers (1998) made significant progress by showing that an unconditionally secure QOT might be achievable if an unconditionally secure Quantum Bit Commitment Protocol (QBCP) exists. At the time, the existence of totally secure QBCP was believed to be a promising direction for quantum cryptography.

The ideal one-photon standard QOTP described is secure under perfect conditions and assuming no cheating. However, real-world implementations face challenges such as defective photon sources, lossy channels, and defective detectors, which can open liabilities. Moreover, the possibility of more cultured eavesdropping strategies needs to be considered for proving unconditional security.

Quantum Oblivious Transfer Compared with Other cryptographic protocols

In contrast to oblivious transfer, the quantum cryptographic protocols like Quantum Key Distribution (QKD) and quantum teleportation. QKD efforts on establishing a shared secret key between two parties that can be used for encryption. Quantum teleportation, on the other hand, allows for the transfer of an unknown quantum state from one location to another using an entangled pair and classical communication. Both these protocols, along with oblivious transfer and bit commitment, form the foundation of quantum cryptography to achieve security based on the laws of quantum physics rather than computational assumptions.

Finally, Quantum Oblivious Transfer is a cryptographic primitive that aims to achieve a secure transfer of select information while preserving the sender’s inexperience of the receiver’s choice and the receiver’s inexperience of the unchosen information. While ideal protocols exist, the question of unconditional security and the implications for more complex quantum cryptographic tasks are still active areas of research. The connection between classical oblivious transfer and general cryptography underscores the importance of realizing a secure quantum counterpart. The examination of QOT, alongside other quantum protocols like QKD and teleportation, highlights the ongoing development of quantum cryptography as a field for information-theoretically secure communication.