# Generation and Distribution of Quantum Oblivious Keys for Secure Multiparty Computation
## 3 Results and Discussion  
### Security  
In this section, we analyse the security of the proposed composition of protocols. The main result is encapsulated in the following theorem. **Theorem 1**: _The protocol \(\pi_{\text{HOK}}\) is secure as long as the hash function is collision resistant. Moreover, if the hash function models a Random Oracle, a simple modification of the protocol can make it universally-composable secure._  
The security proof relies on several well-established results in cryptography. First, notice that the \(\pi_{\text{HOK}}\) protocol is closely related to the standard Quantum OT protocol \(\pi_{\text{QOT}}\), which is proven statistically secure in [PERSON]'s original paper [33] and later universally composable in the quantum composability framework [34]. The difference between the two is that \(\pi_{\text{QOT}}\) uses ideal commitments, as opposed to the hash-based commitments in \(\pi_{\text{HOK}}\). We start by showing that the protocol \(\pi_{\text{HOK}}\) is standalone secure. For this case, we only need to replace the ideal commitment of \(\pi_{\text{QOT}}\) with a standalone secure commitment protocol, such as the Halevi and Micali [29], which is depicted in \(\pi_{\text{COMH}}\). Since the latter is secure whenever the hash function is collision resistant, we conclude that \(\pi_{\text{HOK}}\) is secure whenever the hash function is collision resistant. Finally, we provide the simple modification of \(\pi_{\text{HOK}}\) that makes it universally-composable secure when the hash function models a Random Oracle. The modification is only required to improve upon the commitment protocol, as [PERSON]'s protocol with ideal commitments is universally-composable [34]. Indeed, we need to consider universally composable commitment scheme instead of \(\pi_{\text{COMH}}\). This is achieved by the HMQ construction [35] which, given a standalone secure commitment scheme and a Random Oracle, outputs a universally-composable commitment scheme, which is perfectly hiding and computationally binding, that is, secure as far as collisions cannot be found. So we just need to replace \(\pi_{\text{COMH}}\) with the output of the HMQ construction, when \(\pi_{\text{COMH}}\) and \(H\) are given as inputs and \(H\) models a Random Oracle. Figure 4: Commitment protocol based on collision resistant hash functions. Regarding the above theorem we note that, for the composable security, the HMQ construction mentioned in the proof formally requires access to a random oracle, which is an abstract object used for studying security and cannot be realized in the real world. Hence, we leave it as an additional security property, as hash functions are traditionally modelled as random oracles. Stand alone security of the \(\pi_{HOK}\) protocol does not require the hash function to be a random oracle. The use of collision resistant hash functions is acceptable in the quantum setting, as it has been shown that there exist functions for which a quantum computer does not have any significant advantage in finding collisions when compared with a classical one [36]. One point to note about the security of \(\pi_{OKD}\) is that it is not susceptible to intercept now-decrypt later style of attacks. [PERSON] can attempt an attack in which he does not properly measure the qubits sent by [PERSON] at step 2, and instead waits until [PERSON] reveals the test subset in step 4 to measure honestly only those qubits. For that he must be able to control the openings of the commitment scheme such that [PERSON] opens the values of his measurement outcomes for those qubits. In order to do this, he must be able find collisions for \(H\) before step 5. This means that attacking the protocol by finding collisions of the hash function is only effective if it is done in real time, that is, between steps 3 and 5 of the protocol. This is in contrast to asymmetric cryptography based OT, in which [PERSON] can obtain both bits if he is able to overcome the computational security at a later stage.