# Measurement-Device-Independent Two-Party Cryptography with Error Estimation
## 4 1-2 Random Oblivious Transfer
### Security Proof of 1-2 ROT  
According to the definition, we will prove the security of our proposed ROT protocol from the perspective of correctness, security for [PERSON], and security for [PERSON] successively. For correctness, if both parties are honest, [PERSON] can calculate \(I_{0}\), \(I_{1}\) according to \(c\), and \(S_{c}\), and [PERSON] can also get \(S_{0},S_{1}\). The focus is mainly on security for [PERSON] and [PERSON]. **Lemma 6** (Security for [PERSON]). : _In 1-2 ROT protocol, \(n\) represents the number of bits transmitted during the protocol. \(\sigma_{\mathcal{F}^{\mathit{syn}}}\) represents the state generated in the ideal protocol operation which consists of dishonest [PERSON] and the variable \(X^{n}\) of \(n\) transmitted bits. \(\rho_{X_{n}B^{\prime}}\) represents the joint state generated in the actual protocol operation which consists of dishonest [PERSON] and the variable \(x_{n}\) of \(n\) transmitted bits. If [PERSON] is honest, \(n\rightarrow\infty\) and the trace distance between these two states \(||\sigma_{B^{\prime}X^{n}}-\rho_{B^{\prime}X^{n}}||\leq\varepsilon\) with \(\varepsilon=2\text{exp}\left(-\frac{\delta^{2}}{32(2+\log_{2}\delta)^{2}}\right)\). Then we fix \(\delta\in\{0,\frac{1}{4}\}\), we can get :  
1) \(\text{H}_{\min}(S_{1-D}|B^{\prime})\geq(\frac{1}{4}-\delta-v)n-1\),  
2) \(l\leq\left(\frac{1}{4}-\delta-2e_{r}\right)n+1-\log_{2}\frac{1}{\varepsilon^{ 2}}\). Proof. : With uncertainty relation theorem, we have:  
\[\text{H}_{\min}^{\varepsilon}(X^{n}|M\theta_{A}^{n})\geq\left(\frac{1}{2}-2 \delta\right)n,\]  
where \(M\) is the outcome that announced by [PERSON]. According to entropy sampling theorem:  
\[\text{H}_{\min}^{\varepsilon}(X_{1-D}|DM\theta_{A}^{n})\geq\left(\frac{1}{4}- \delta\right)n-1,\]  
and in our protocol, according to Lemma 3, we have the storage rate \(v=2e_{r}\), then:  
\[\text{H}_{\min}^{\varepsilon}(X_{1-D}|DM\theta_{A}^{n}Q(\rho_{A}))\geq\text{ H}_{\min}^{\varepsilon}(X_{1-D}|DM\theta_{A}^{n})-vn=(\frac{1}{4}-\delta-v)n-1\]  
By using privacy amplification theorem:  
\[\text{d}(f_{1-D}(S_{1-D})|D\theta_{A}f_{D}\rho_{A}MQ(\rho_{A}))\leq 2^{-\frac{ 1}{2}\left[(\frac{1}{4}-\delta-2e_{r})-1-l\right]-1}+\varepsilon,\]  
and let the above formula be less than \(2\varepsilon\), we can get:  
\[l\leq\left(\frac{1}{4}-\delta-2e_{r}\right)n+1-\log_{2}\frac{1}{\varepsilon^{ 2}}.\]  
**Lemma 7** (Security for [PERSON]). : _In 1-2 ROT protocol, \(n\) represents the number of bits transmitted during the protocol. \(\sigma_{A^{\prime}c}\) represents the state generated in the ideal protocol operation which consists of dishonest [PERSON] and commit bit \(c\). \(\rho_{A^{\prime}}\otimes\tau\{0,1\}\) represents the joint state generated in the actual protocol operation which consists of dishonest [PERSON] and commit bit \(c\) that is uniformly distributed on \(\{0,1\}\). If [PERSON] is honest, \(n\rightarrow\infty\) and the trace distance between these two states \(||(\sigma_{A^{\prime}c})-\rho_{A^{\prime}}\otimes\tau\{0,1\}||\leq\varepsilon\), and there exits \(\varepsilon\geq 0\), then the conditional entropy with respect to \(c\) and \(A^{\prime}\), we have:_  
(1) \(\text{H}(c|A^{\prime})\geq 1-\varepsilon\)__  
Proof. : According to the definition of ROT protocol, if [PERSON] is dishonest, then her purpose is to get \(c\) chosen by [PERSON]. In our protocol, [PERSON]'s information leakage to [PERSON] are \(\rho_{B},y_{check},\theta_{check},I_{0}\) and \(I_{1}\).