# Generation and Distribution of Quantum Oblivious Keys for Secure Multiparty Computation
## 2 Methods  
### Generating the OTs  
In this section, we describe how to perform oblivious transfer by exchanging qubits. The protocol \(\pi_{\mathrm{QOT}}\) shown in Figure 2 is the well known quantum oblivious transfer protocol first introduced by [PERSON], which assumes access to secure commitments. The two logical qubit states \(|0\rangle\) and \(|1\rangle\) represent the computational basis, and the states \(|+\rangle=(|0\rangle+|1\rangle)/\sqrt{2}\), \(|-\rangle=(|0\rangle-|1\rangle)/\sqrt{2}\) represent the Hadamard basis. We also define the states \(|(s_{i},a_{i})\rangle\) for \(s_{i},a_{i}\in\{0,1\}\) according to the following rule:  
\[|(0,0)\rangle =|0\rangle\quad|(0,1)\rangle=|+\rangle\] \[|(1,0)\rangle =|1\rangle\quad|(1,1)\rangle=|-\rangle.\]  
Note that these states can be physically instantiated using, for instance, a polarization encoding fiber optic quantum communication system, provided that a fast polarization encoding/decoding process and an algorithm to control random polarization drifts in optical fibers are available [30; 31]. **Protocol \(\pi_{\text{QOT}}\)**  
**Parameters:** Integers \(n,m<n\). **Parties:** The sender [PERSON] and the receiver [PERSON]. **Inputs:** [PERSON] gets two bits \(b_{0},b_{1}\) and [PERSON] gets a bit \(c\). _(Oblivious key distribution phase)_  
1. [PERSON] samples \(s,a\ \in\{0,1\}^{n+m}\). For each \(i\leq n+m\) she prepares the state \(|\phi_{i}\rangle=|(s_{i},a_{i})\rangle\) and sends \(|\phi\rangle=|\phi_{1}\phi_{2}\dots\phi_{n+m}\rangle\) to [PERSON]. 2. [PERSON] samples \(\tilde{a}\in\{0,1\}^{n+m}\) and, for each \(i\), measures \(|\phi_{i}\rangle\) in the computational basis if \(\tilde{a}_{i}=0\), otherwise measures it in the Hadamard basis. Then, he computes the string \(\tilde{s}=\tilde{s}_{1}\tilde{s}_{2}\dots\tilde{s}_{n+m}\), where \(\tilde{s}_{i}=0\) if the outcome of measuring \(|\phi_{i}\rangle\) was \(0\) or \(+\), and \(\tilde{s}_{i}=1\) if it was \(1\) or \(-\). 3. For each \(i\), [PERSON] commits \((\tilde{s}_{i},\tilde{a}_{i})\) to [PERSON]. 4. [PERSON] chooses randomly a set of indices \(T\subset\{1,\dots,n+m\}\) of size \(m\) and sends \(T\) to [PERSON]. 5. For each \(j\in T\), [PERSON] opens the commitments associated to \((\tilde{s}_{j},\tilde{a}_{j})\). 6. [PERSON] checks if \(s_{j}=\tilde{s}_{j}\) whenever \(a_{j}=\tilde{a}_{j}\) for all \(j\in T\). If the test fails [PERSON] aborts the protocol, otherwise she sends \(a^{*}=a|_{\overline{T}}\) to [PERSON] and sets \(k=s|_{\overline{T}}\). 7. [PERSON] computes \(x=a^{*}\oplus\tilde{a}|_{\overline{T}}\) and \(\tilde{k}=\tilde{s}|_{\overline{T}}\). _(Oblivious transfer phase)_  
8. [PERSON] defines the two sets \(I_{0}=\{i\ |\ x_{i}=0\}\) and \(I_{1}=\{i\ |\ x_{i}=1\}\). Then, he sends to [PERSON] the ordered pair \((I_{c},I_{c\oplus 1})\). 9. [PERSON] computes \((e_{0},e_{1})\), where \(e_{i}=b_{i}\bigoplus_{j\in I_{c\oplus i}}k_{j}\), and sends it to [PERSON]. 10. [PERSON] outputs \(\tilde{b}_{c}=e_{c}\bigoplus_{j\in I_{b}}\tilde{k}_{j}\). **Figure 2.** Quantum OT protocol based on secure commitments. The \(\bigoplus\) denotes the bit XOR of all the elements in the family. Intuitively, this protocol works because the computational and the Hadamard are conjugate bases. Performing a measurement in the preparation basis of a state, given by \(a_{i}\), yields a deterministic outcome, whereas measuring in the conjugate basis, given by \(\tilde{a}_{i}\), results in a completely random outcome. By preparing and measuring in random bases, as shown in steps 1 and 2, approximately half of the measurement outcomes will be equal to the prepared states, and half of them will have no correlation. As [PERSON] sends the information of preparation bases to [PERSON] in step 6, he gets to know which of his bits are correlated with [PERSON]'s. During steps 3 to 6, [PERSON] commits the information of his measurement basis and outcomes to [PERSON], who then chooses a random subset of them to test for correlations.