## 4 The Security of QOT
### Privacy for [PERSON]
#### 4.2.1 The Attack that [PERSON] Sends Only One State Dishonestly in R-OT Protocol
Suppose the probability that the index \(c\) is not in the two sets when [PERSON] receives the fake pulse is  
\[p_{1}[c\
otin I\wedge c\
otin J]=p_{(i)}p[c\
otin I\wedge c\
otin J|Con]+(1-p_ {0}(\mu)-p_{(i)})p[c\
otin I\wedge c\
otin J|Inc], \tag{19}\]  
where \(p[c\
otin I\wedge c\
otin J|Con]\) denotes the probability of the condition where [PERSON] accepts the fake pulse as a conclusive result but does not choose it in Set \(I\) nor \(J\); \(p[c\
otin I\wedge c\
otin J|Inc]\) denotes the probability of the condition where [PERSON] accepts the fake pulse as an inconclusive result but does not choose it in Set \(J\). Assume that [PERSON] chooses \(x\) bits of the conclusive results into Set \(J\) while \(k-x\) bits of the inconclusive results into Set \(J\), where \(0\leq x\leq p_{con}(\mu)N-k\). Then, the number of conclusive results neither in Set \(I\) nor \(J\) is \(p_{con}(\mu)N-k-x\), the number of inconclusive results not in Set \(J\) is \([1-p_{0}(\mu)-p_{con}(\mu)]N-(k-x)\). Therefore, the probability \(p_{1}[c\
otin I\wedge c\
otin J]\) is  
\[ \begin{split}& p_{1}[c\
otin I\wedge c\
otin J]\\ =& p_{(i)}\frac{p_{con}(\mu)N-k-x}{p_{con}(\mu)N}+[1-p_ {0}(\mu)-p_{(i)}]\frac{[1-p_{0}(\mu)-p_{con}(\mu)]N-(k-x)}{[1-p_{0}(\mu)-p_{ con}(\mu)]N}\\ =& 1-e^{-\mu}-\frac{2+2e^{-\frac{\mu}{4}}-8e^{-\mu}+2e^{ -\frac{7p}{4}}+2e^{-2\mu}}{(1-e^{-\frac{\mu}{4}})(1-2e^{-\mu}+e^{-\frac{\mu}{4 }})}\frac{k}{N}-\frac{2(1-e^{-\mu})(1+e^{-\frac{\mu}{4}}-e^{-\frac{3\mu}{4}}-e ^{-\mu})}{(1-e^{-\frac{\mu}{4}})(1-2e^{-\mu}+e^{-\frac{\mu}{4}})}\frac{x}{N}. \end{split}  \tag{20}\]Then, the probability that [PERSON] attacks Protocol 2 successfully is  
\[ \begin{split} p(OT)&=p(3 con)+\frac{1}{2}p_{0}(\mu)+\frac{1 }{2}p_{1}[c\
otin I\wedge c\
otin J]\\ &=\frac{1}{2}+\frac{e^{-\mu}-e^{\frac{5\mu}{4}}-e^{-\frac{7\mu}{4 }}+e^{-2\mu}}{(1-e^{-\frac{\mu}{4}})(1-2e^{-\mu}+e^{-\frac{p}{4}})}\frac{k}{N} -\frac{(1-e^{-\mu})(1+e^{-\frac{\mu}{4}}-e^{-\frac{3\mu}{4}}-e^{-\mu})}{(1-e^{- \frac{\mu}{4}})(1-2e^{-\mu}+e^{-\frac{p}{4}})}\frac{x}{N}.\end{split}  \tag{21}\]  
When \(x=\lfloor p_{con}(\mu)N-k\rfloor\), the minimum of \(p(OT)\) is  
\[ \begin{split} p(OT)_{min}=&\frac{1}{2}-\frac{ \left\lfloor\frac{1}{2}(1-e^{-\frac{\mu}{4}})N\right\rfloor(1-e^{-\mu})(1+e^ {-\frac{\mu}{4}}-e^{-\frac{3\mu}{4}}-e^{-\mu})}{(1-e^{-\frac{\mu}{4}})(1-2e^ {-\mu}+e^{-\frac{p}{4}})N}\\ &+\frac{(1-e^{-\frac{3\mu}{4}})(1+e^{-\frac{\mu}{4}}-2e^{-\frac {5\mu}{4}})}{(1-e^{-\frac{\mu}{4}})(1-2e^{-\mu}+e^{-\frac{p}{4}})}\frac{k}{N}.\end{split}  \tag{22}\]  
When \(x=0\), the maximum of \(p(OT)\) is  
\[p(OT)_{max}=\frac{1}{2}+\frac{(e^{-\mu}-e^{-\frac{5\mu}{4}}-e^{-\frac{7\mu}{4 }}+e^{-2\mu})}{(1-e^{-\frac{\mu}{4}})(1-2e^{-\mu}+e^{-\frac{p}{4}})}\frac{k}{N}. \tag{23}\]  
The minimum and the maximum probabilities that [PERSON] attacks Protocol 2 successfully with different \(\mu\) are listed in Table 2. Actually, [PERSON] putting more index of conclusive results in Set \(I\) and \(J\) is beneficial for him to get more information about \(b_{0}\) and \(b_{1}\). [PERSON] should prefer to select \(x=\lfloor p_{con}(\mu)N-k\rfloor\). Even if [PERSON] guesses which message [PERSON] obtains without any trick, she has a probability of \(1/2\) to get the right answer. It can be seen from Table 2 that when [PERSON] chooses \(x=\lfloor p_{con}(\mu)N-k\rfloor\), the probability that [PERSON] breaks the \(OT_{1}^{2}\) protocol is \(p(OT)_{min}<1/2\), which causes that [PERSON] replaces one of the states with \(\left|\Psi_{0}\right\rangle^{\perp}\) is not an effective attack. In addition, we will show in Section 5.2 that even [PERSON] chooses \(x=0\), [PERSON] cannot break the binding of our QBC protocol.