## 4 The Security of QOT
### Privacy for [PERSON]
#### 4.2.2 The Attack that [PERSON] Sends All States Dishonestly in R-OT Protocol  
The attack that [PERSON] sends all states dishonestly may be detected by [PERSON] through the different ratio of conclusive results. She should generate different proportions of different states. For example, [PERSON] sends states in Breidbart basis to increase the proportion of [PERSON]'s conclusive (inconclusive) bits. Consider the ideal case, for \(\left|\Psi_{0}\right\rangle=\left|0\right\rangle\) and \(\left|\Psi_{1}\right\rangle=\left|\pi/6\right\rangle\), the states in Breidbart basis are \(\left|\frac{\pi}{12}\right\rangle\) and \(\left|\frac{\sqrt{3}}{12}\right\rangle\). If [PERSON] sends the state \(\left|\frac{\pi}{12}\right\rangle\) and [PERSON] randomly chooses the measurement basis \(B_{0}\) or \(B_{1}\), the probability that [PERSON] obtains a conclusive bit is  
\[p_{c}=\frac{1}{2}\left\langle\frac{\pi}{12}\left|\frac{\pi}{2}\right\rangle \left\langle\frac{\pi}{2}\right|\frac{\pi}{12}\right\rangle+\frac{1}{2}\left \langle\frac{7}{12}\left|\frac{2\pi}{3}\right\rangle\left\langle\frac{2\pi}{3 }\right|\frac{\pi}{12}\right\rangle=\frac{1}{2}-\frac{\sqrt{3}}{4}. \tag{24}\]  
\begin{table}
\begin{tabular}{c c c c} \hline \(\mu\) & \(k\) & \(p(OT)_{min}\) & \(p(OT)_{max}\) \\ \hline
2 & 131 & 0.4462 & 0.5129 \\
3 & 172 & 0.4227 & 0.5070 \\
4 & 210 & 0.4238 & 0.5034 \\
5 & 236 & 0.4174 & 0.5015 \\
6 & 259 & 0.4194 & 0.5007 \\ \hline \end{tabular}
\end{table}
Table 2: The probabilities of [PERSON] breaking [PERSON]’s privacy in our \(OT_{1}^{2}\) protocol. \(p(OT)_{min}\) and \(p(OT)_{max}\) denote the maximum probabilities that [PERSON] breaks Protocol 2 with different \(\mu\) when \(N=800\).  
If [PERSON] sends the state \(|\frac{7\pi}{12}\rangle\) and [PERSON] randomly chooses the measurement basis \(B_{0}\) or \(B_{1}\), the probability that [PERSON] obtains a conclusive bit is  
\[p_{c}^{\prime}=\frac{1}{2}\left\langle\frac{7\pi}{12}\left|\frac{\pi}{2}\right. \right\rangle\left\langle\frac{\pi}{2}\right|\frac{7\pi}{12}\right\rangle+ \frac{1}{2}\left\langle\frac{7\pi}{12}\left|\frac{2\pi}{3}\right\rangle\left \langle\frac{2\pi}{3}\right|\frac{7\pi}{12}\right\rangle=\frac{1}{2}+\frac{ \sqrt{3}}{4}. \tag{25}\]  
It is clear that when [PERSON] sends \(|\frac{\pi}{12}\rangle\), she knows that [PERSON] is likely to get an inconclusive bit. When [PERSON] sends \(|\frac{7\pi}{12}\rangle\), she knows that [PERSON] is likely to get a conclusive bit. In order to ensure the ratio of the conclusive result is \(1/8\) according to Equation (1), [PERSON] should set the proportion of \(|\frac{\pi}{12}\rangle\) as \(\frac{1}{2}+\frac{\sqrt{3}}{4}\) and the proportion of \(|\frac{7\pi}{12}\rangle\) as \(\frac{1}{2}-\frac{\sqrt{3}}{4}\). According to Equation (25), the ratio of state \(|\frac{7\pi}{12}\rangle\) accepted as conclusive results and inconclusive results is \(\frac{\frac{1}{2}+\frac{\sqrt{3}}{4}}{\frac{1}{2}-\frac{\sqrt{3}}{4}}\) in \(OT_{1}^{2}\) protocol, which is around \(13.9\). When [PERSON] receives the index set \(X\) and \(Y\), she regards the set contains more index of \(|\frac{7\pi}{12}\rangle\) as the set \(I\). By this attack, she can know the value of \(m\) chosen by [PERSON] with a large probability.  
However, \(\left\langle\frac{7\pi}{12}\left|\frac{\pi}{2}\right.\right\rangle\left\langle \frac{\pi}{2}\right|\frac{7\pi}{12}\rangle=\left\langle\frac{7\pi}{12}\left| \frac{2\pi}{3}\right\rangle\left\langle\frac{2\pi}{3}\right|\frac{7\pi}{12}\right\rangle\) means that [PERSON] has no idea about [PERSON]'s the measurement results by this attack. [PERSON] cannot obtain the correct bit in \(OT_{1}^{2}\) protocol, while [PERSON] cannot disclose the correct \(r_{i}\) in the opening phase of QBC protocol.