## 3 Practical Weak QOT and QBC
[PERSON] divides his_ \(l_{obt}\) _bits into_ \(63\)_-bit blocks and performs the wire link permutation_ \(W\) _on it. When_ \(l_{obt}=63\left[\frac{l_{obt}}{63}\right]-\Delta\)_,_ \(\Delta\) _bits of the block in front should be added to the last block. For each round, he calculates the syndromes_ \(s_{B_{i}}\) _and_ \(s_{i}=s_{A_{i}}\oplus s_{B_{i}}\)_. Correct the error in each block and discard all check bits. After error correction, assume the error rate reduces to_ \(\epsilon_{1}^{\prime}\)_.__[PERSON] discards all check bits and selects from the remaining bits to obtain two sets 1 and \(J\), where \(I=\{i_{1},\ldots,i_{k}\}\) and \(J=\{j_{1},\ldots,j_{k}\}\) with \(I\cap J=\emptyset\). The \(k\) bits \(r_{i_{1}},\ldots,r_{i_{k}}\) are chosen from the conclusive bits. In case the conclusive bits in [PERSON]'s hand are a little less than \(k\), he adds some random bits._
4. _[PERSON] chooses a random bit \(m\). If \(m=0\), he sends \(\{X,Y\}=\{I,J\}\) to [PERSON]. Otherwise, he sends \(\{X,Y\}=\{J,I\}\)._
5. _After receiving \((X,Y)\), [PERSON] encrypts her messages \(b_{0}\) and \(b_{1}\) with \(r_{i}\),_ \[\left\{ \begin{aligned} & c_{0}=b_{0}\oplus_{i\in X}r_{i},\\ & c_{1}=b_{1}\oplus_{i\in Y}r_{i}.\end{aligned} \right.\] _Then, [PERSON] sends_ \(c_{0}\)_,_ \(c_{1}\) _to [PERSON]._
6. _[PERSON] calculates_ \(\oplus_{i\in I}r_{i}\) _and decrypts_ \(c_{m}\) _to obtain_ \(b_{m}\)_._ According to the error correcting scheme, the relation between the parameters \(k\) and \(l_{obt}\) is \[k=57\left[\frac{l_{obt}}{63}\right]-\Delta=l_{obt}-6\left[\frac{l_{obt}}{63} \right].\] (2)  
Suppose the error rate of each bit in Protocol 1 is \(\varepsilon_{1}=0.3\%\), which is a general value in practice. After error correction, the error rate can be reduced to \(\varepsilon_{1}^{\prime}=0.0757\%\)[60]. As long as there is one bit error in key used in the decryption algorithm, [PERSON] cannot obtain \(b_{m}\) in Protocol 2. The error rate of Protocol 2 is \(\varepsilon_{2}\). The relation of \(\varepsilon_{2}\) and \(\varepsilon_{1}^{\prime}\) is  
\[\varepsilon_{2}=1-(1-\varepsilon_{1}^{\prime})^{k}. \tag{3}\]  
When \(\varepsilon_{1}^{\prime}=0.0757\%\), the values of \(\varepsilon_{2}\) changing with the parameter \(k\) are shown in Figure 1.  
Protocol 2 is different from standard QOT since [PERSON] may not transfer a correct message to [PERSON]. If we set the upper bound of the error rate as \(20\%\), the parameter \(k\) should be less than \(295\) according to Equation (3). Then, we can construct a quantum bit commitment protocol by executing the quantum \(OT_{1}^{2}\) protocol \(l\) times as follows. **Protocol 3**. : _Practical quantum bit commitment protocol. Commit phase:_  
1. _[PERSON] randomly divides her commit value as_ \(b=b_{0}^{(i)}\oplus b_{1}^{(i)}\)_,_ \(i=1,\ldots,l\)_._
2. _[PERSON] generates local random numbers_ \(\{m_{i}=0,1|i=1,\ldots,l\}\)_._
3. _[PERSON] executes Protocol 2 with [PERSON] 1 times, and [PERSON] can obtain the values_ \(\{b_{m_{i}}^{(i)}|i=1,\ldots,l\}\)_._  
Figure 1: The error rate of Protocol 2 changing with the size of sets. _Opening phase:_  
1. _[PERSON] opens_ \(\{b_{0}^{(i)},b_{1}^{(i)};r_{i_{1}}^{(i)},\ldots,r_{i_{k}}^{(i)};r_{j_{1}}^{(i)}, \ldots,r_{j_{k}}^{(i)}|i=1,\ldots l\}\)_._
2. _[PERSON] verifies whether_ \(\{b_{0}^{(i)},b_{1}^{(i)};r_{i_{1}}^{(i)},\ldots,r_{i_{k}}^{(i)};r_{j_{1}}^{(i)}, \ldots,r_{j_{k}}^{(i)}|i=1,\ldots l\}\) _are consistent with his_ \(\{b_{m_{i}}^{(i)};r_{i_{1}}^{(i)},...,r_{i_{k}}^{(i)}|i=1,\ldots l\}\) _and those conclusive bits in J. If the consistency holds more than 80% of 1 rounds, he admits [PERSON]'s commitment value as_ \(b\)_. Otherwise, he regards [PERSON] as a malicious party and aborts the protocol._  
In practice, the physical system and the coded bit string in \(OT\) protocols unavoidably have some errors. In Section 3, assume \(\varepsilon_{1}=0.3\%\), \(k\leq 295\), the error rate of \(OT_{1}^{2}\) can be less than 20%. But it does not impact the construction of a BC protocol.