## 3 Practical Weak QOT and QBC
The parameters satisfy the equation_ \(H(2\epsilon_{set})<\frac{1}{2}-\left(1-e^{-\mu_{S}}-\mu_{S}e^{-\mu_{S}}\right)/2\alpha\) _to resist photon number splitting attack_ _[_2_]__._
2. _[PERSON] and [PERSON] perform two tests._ _Firstly, compare [PERSON]'s sending time_ \(t_{i}\) _with [PERSON]'s receiving time_ \(t_{i}^{\prime}\) _for each pulse. Since the distance between [PERSON] and [PERSON] is fixed, by the test they can easily get the traveling time_ \(\theta\)_, i.e.,_ \(\theta=t_{i}^{\prime}-t_{i}\)_. This test not only marks the address of each pulse, but also helps to distinguish the error caused by noises and dark counts._ _Secondly, [PERSON] sends a sequence of pulses through the quantum channel and tells [PERSON] the bases of the pulses through a classical channel. [PERSON] detects pulses in the other bases. If and only if [PERSON] detects the pulses successfully with a probability greater than_ \(\alpha\) _and an error rate less than_ \(\epsilon_{set}\)_, he agrees to continue the protocol. Otherwise, they take counsel together to adjust the parameter_ \(\alpha\) _or_ \(\epsilon_{set}\)_._
3. _[PERSON] generates a random bit string_ \((r_{1},...,r_{N})\in\{0,1\}^{N}\)_, and sends qubit string_ \(|\Psi_{r_{1}}\rangle,\ldots,|\Psi_{r_{N}}\rangle\) _to [PERSON]. She also tells [PERSON] the sending time_ \(t_{i}\) _of each pulse through the classical channel._
4. _[PERSON] records the receiving time_ \(t_{i}^{\prime}\) _of each pulse and compares with the sending time. If and only if_ \(t_{i}^{\prime}=t_{i}+\theta\)_, he admits_ \(|\Psi_{r_{i}}\rangle\) _as a receiving pulse. He chooses_ \(B_{0}\) _or_ \(B_{1}\) _randomly to measure each receiving pulse. For these receiving pulses, when his measurement results in state_ \(|\Psi_{x}\rangle^{\perp}\)_, he accepts the pulse as a conclusive pulse and takes the bit value of this pulse as_ \(x\oplus 1\)_._
5. _The parameters are agreed by [PERSON] and [PERSON]. After Step 1-4, if the number of the effective pulses detected by [PERSON] is not approximately equal to_ \(\alpha N\)_, [PERSON] has the right to abort the protocol. This step is a verification for the malicious [PERSON]._  
We regard Protocol 1 as a weak R-OT because it is similar to standard R-OT. But it is weaker in security when dishonest [PERSON] sends different states, which will be explained in Section 4.2. Then, we construct a weak quantum \(OT_{1}^{2}\) protocol based on R-OT protocol, the equivalence of R-OT and \(OT_{1}^{2}\) has been proved in [59]. **Protocol 2**. : _Practical weak quantum \(OT_{1}^{2}\) protocol._  
1. _[PERSON] and [PERSON] execute Protocol_ 1 _and an error correcting scheme. Denote [PERSON]'s probability of getting a conclusive bit as_ \(p_{con}(\mu)\)_. After Protocol_ 1_, if the number of [PERSON]'s conclusive bits is not approximately equal to_ \(Np_{con}(\mu)\)_, he regards [PERSON] as a malicious party and aborts the protocol. If [PERSON] agrees to continue, they decide on a security parameter_ \(k\) _according to an error correcting scheme and the probability_ \(p_{con}(\mu)\)_. The values of_ \(k\) _are analyzed in Section_ 4 _and listed in Table_ 1_._
2. _The error correcting scheme is applied to_ \(\alpha N\) _bits words with expected error rate_ \(\epsilon_{set}\)_, which is non-uniqueness. The following is only an example of this kind of scheme, which is based on_ \((63,57,3)\) _Hamming code._ _There are_ \(k\) _bits in sets_ \(I\) _and_ \(J\) _after the process of error correction, respectively. Let_ \(l_{obt}\) _denotes the number of the bits in_ \(I\) _or_ \(J\) _before error correction. [PERSON] divides two sequences of_ \(l_{obt}\) _bits into_ \(63\)_-bit blocks and performs the wire link permutation_ \(W\) _on it. When_ \(l_{obt}=63\left[\frac{l_{obt}}{63}\right]-\Delta\)_,_ \(\Delta\) _bits of the block in front should be added to the last block. Then, calculate the syndromes_ \(s_{A_{i}}\) _and discard the check bits of each block. Repeat above operations four times and send these syndromes to [PERSON].