## 4 The Security of QOT
### Privacy for [PERSON]
#### 4.2.1 The Attack that [PERSON] Sends Only One State Dishonestly in R-OT Protocol
Protocol 2 is a fault-tolerant quantum \(OT_{1}^{2}\) scheme with \(p\leq 20\%\). When [PERSON] does not get the correct message with a probability of \(p\), whether [PERSON] attacks successfully cannot be defined. Then, consider [PERSON]'s attack in the condition that [PERSON] gets the correct message. When [PERSON] replaces one of the pulses \((|\Psi_{r_{c}}\rangle)\) with \(|\Psi_{0}\rangle^{\perp}\) instead, the index of the fake pulse may be in Set \(I\), \(J\), or neither in \(I\) nor \(J\). If [PERSON] does not see the index \(c\) in Set \(X\) or \(Y\), she randomly guesses which message [PERSON] obtains. Suppose the probability that she guesses the correct \(m\) is \(\frac{1}{2}p[c\
otin I\wedge c\
otin J]\). If [PERSON] finds the index \(c\) in Set \(X\) or \(Y\), she believes the set which contains \(c\) is Set \(I\). In other words, when the index of the fake pulse in Set \(I\), [PERSON] knows [PERSON]'s choice with a large probability; when the index of the fake pulse in Set \(J\), she has no choice to break the protocol. Then, [PERSON] needs the following conditions to know the content of the message obtained by [PERSON]. 1. [PERSON] accepts the fake pulse as a conclusive result. 2. [PERSON] picks the index of the fake pulse into Set \(I\). 3. [PERSON]'s measuring result of \(|\Psi_{0}\rangle^{\perp}\) is consistent with [PERSON]'s conjecture of \(r_{c}\). Item (iii) ensures that [PERSON] can obtain a correct message. Suppose the probability of the above three conditions being satisfied is \(p(3 con)\). The probability that [PERSON] knows the content of the message obtained by [PERSON] is  
\[p(OT)=p(3 con)+\frac{1}{2}p(c\
otin I\wedge c\
otin J). \tag{15}\]  
The probability of Item (i) being satisfied is \(p_{(i)}\). In the practical protocol, an honest [PERSON] is supposed to obtain \(Np_{con}(\mu)\) conclusive bits, where \(p_{con}(\mu)=(1-e^{-\frac{\mu}{4}})/2\) according to Equation (5). He picks \(k\) bits from the conclusive results to form Set \(I\). Assume the number of conclusive result is still \(Np_{con}(\mu)\). The probability that [PERSON] accepts the fake pulse as the conclusive pulse and picks it in Set \(I\) is  
\[p(c\in I)=p_{(i)}\cdot\frac{C_{Np_{con}(\mu)-1}^{k-1}}{C_{Np_{con}(\mu)}^{k}}= \frac{k(2-e^{-\mu}-e^{-\frac{3\mu}{4}})}{N(1-e^{-\frac{\mu}{4}})}. \tag{16}\]  
Suppose the probability that [PERSON] measures in basis \(B_{0}\) and gets a conclusive bit \(r_{c}=1\) is \(p_{B_{0}con}(\mu)\), the probability that [PERSON] measures in basis \(B_{1}\) and gets a conclusive bit \(r_{c}=0\) is \(p_{B_{1}con}(\mu)\). It can be seen that \(p_{B_{0}con}(\mu)>p_{B_{1}con}(\mu)\). [PERSON] knows that [PERSON] is more likely to obtain \(r_{c}=1\). In the case that \(c\in I\), the conditional probability that [PERSON] accepts \(r_{c}=1\) is  
\[ \begin{split} p\big{(}r_{c}=1|c\in I\big{)}&= \frac{p\big{(}r_{c}=1|c\in I\big{)}}{p\big{(}r_{c}=1|c\in I\big{)}+p\big{(}r_{c }=0|c\in I\big{)}}\\ &=\frac{p_{B_{0}con}(\mu)}{p_{B_{0}con}(\mu)+p_{B_{1}con}(\mu)} \\ &=\frac{1-e^{-\mu}}{2-e^{-\mu}-e^{-\frac{3\mu}{4}}}.\end{split}  \tag{17}\]  
The second \"=\" holds because [PERSON] randomly picks the elements of Set \(I\) from his conclusive results in well-distributed. Therefore, the probability of the above three conditions being satisfied is  
\[p(3 con)=p(r_{c}=1\wedge c\in I)=p\big{(}r_{c}=1|c\in I\big{)}p(c\in I)=\frac{ k}{N}\cdot\frac{1-e^{-\mu}}{1-e^{-\frac{\mu}{4}}}. \tag{18}\]  
Then, we analyze the condition that the index \(c\) is neither in Set \(I\) nor \(J\). When [PERSON] does not receive the fake pulse, the index \(c\) is certainly not in the sets, the probability of which is \(p_{0}(\mu)=e^{-\mu}\). When [PERSON] receives the fake pulse, the probability that the index \(c\) is not in the two sets depends on his choice of the elements in the sets.