# Measurement-Device-Independent Two-Party Cryptography with Error Estimation
## 5 Applications for Two Party Cryptography
### Password-Based Identification  
In this subsection, we introduce the joint measurement method to password-based protocol from [15].  
Password-based identification (PID) so far is one of the most widely-used authentication methods. In this protocol, the user and server share a series of keys and the user logs in the system server by verifying the keys. Its security definition contains two points. The first is that users who do not know the password cannot log into the system server successfully and cannot learn other users' password through this protocol. The second is that the dishonest server (eg. scam server) cannot learn the password holds by honest users. For the convenience of description, in the following, we use [PERSON] instead of user and [PERSON] instead of server. Formally, security is defined as follows.  
**Definition 6** (\((n,\lambda,\varepsilon)\)-secure PID): _An \((n,\lambda,\varepsilon)\)-secure PID is a protocol between [PERSON] and [PERSON], where [PERSON] and [PERSON] has input password \(w\in\{0,1\}^{l}\)._  
1. _Correctness: If both parties are honest, [PERSON] will always output \"accept\" at the end of the protocol;_
2. _Security for [PERSON]: If [PERSON] is honest, then for any cheating strategy of [PERSON] resulting in his state_ \(\rho_{B}\)_, we have_ \(\lambda\geq 0\)_, and:_ \[\mathrm{H}_{\min}^{\varepsilon}(w|B^{\prime})\geq\lambda;\]
3. _Security for [PERSON]: If [PERSON] is honest, then for any cheating strategy of [PERSON] resulting in her state_ \(\rho_{A}\)_, there exists_ \(\varepsilon\geq 0\)_, we have:_ \[\Pr(\text{outputs}=\text{accept}|\Lambda^{\prime})\leq\varepsilon.\]  
Next, we give our PID protocol. The input is \(w\in\{0,1\}^{l}\) for [PERSON] and the output is \(\text{ans}\in\{accept,reject\}\) for [PERSON].  
1. Preparation: [PERSON] chooses \(x^{n}\in_{R}\{0,1\}^{n}\) and \(\theta_{A}^{n}\in_{R}\{+,\times\}^{n}\), and [PERSON] also chooses \(y^{n}\in_{R}\{0,1\}^{n}\) and \(\theta_{B}^{n}\in_{R}\{+,\times\}^{n}\). Both parties send the encoding quantum state \(|x\rangle_{\theta_{A}}^{n}\) or \(|y\rangle_{\theta_{B}}^{n}\) to the third party, [PERSON];
2. Measurement: [PERSON] measures \(|x\rangle_{\theta_{A}}^{n}\) and \(|y\rangle_{\theta_{B}}^{n}\) with [PERSON] measurement, and announces the outcome;
3. Error estimation: [PERSON] chooses \(I_{check}\in_{R}2^{[n]}\) and \(|I_{check}=m\), and sends \(I_{check}\) to [PERSON]. [PERSON] sends \(y_{check}\in_{B_{check}}\theta_{B_{check}}=\{y_{i},\theta_{B_{i}}|i\in I_{check}\}\) to [PERSON]. [PERSON] calculates the error rate \(Q_{u}\): \[Q_{u}=\frac{\text{num}(x_{i}\
eq y_{i}|\theta_{B_{i}}=\theta_{A_{i}})}{\text{ num}(\theta_{B_{i}}=\theta_{A_{i}})}.\] If \(Q_{u}>e_{r}\), they stop communication, else they continue. Here, \(e_{r}\) is the error correction upper bound;
4. Key shifting: [PERSON] calculates a string \(\kappa\in\{0,1\}^{n}\) such that \(\kappa=c(w)\oplus\theta_{B}^{n}(x_{i}=0\) means basis is \(+\), anyone else). He sends the string \(\kappa\) to [PERSON], and they define the shifted code \(\hat{\theta}_{B}^{n}=c(w)\oplus\kappa\). [PERSON] sends \(\theta_{A}^{n}\) and a hash function \(f\in_{R}\mathcal{F}\) to [PERSON]. Both computes \(I_{w}=\{i|\theta_{A_{i}}=\hat{\theta}_{B_{i}}\}\);
5. Identification: [PERSON] sends \(g\in_{R}\mathcal{G}\) to [PERSON]. [PERSON] sends \(z=f(x|I_{w})\oplus g(w)\) to [PERSON]. [PERSON] accepts if and only if \(z=f(y|I_{w})\oplus g(w)\). We omit the proof part because the process is roughly similar to Ref. [17].