On the security of the quantum oblivious transfer and key distribution protocols

Dominic Mayers

Département IRO, Université de Montréal C.P. 6128, succursale “A”,Montréal (Québec), Canada H3C 3J7. e-mail: mayersd@iro.umontreal.ca.

Abstract. No quantum key distribution (QKD) protocol has been proved fully secure. A remaining problem is the eavesdropper’s ability to make coherent measurements on the joint properties of large composite systems. This problem has been recently solved by Yao in the case of the security of a quantum oblivious transfer (QOT) protocol. We consider an extended OT task which, in addition to Alice and Bob, includes an eavesdropper Eve among the participants. An honest Eve is inactive and receives no information at all about Alice’s input when Bob and Alice are honest. We prove that the security of a QOT protocol against Bob implies its security against Eve as well as the security of a QKD protocol.

1 Introduction

The goal of quantum cryptography is to design cryptographic protocols that are secure against unlimited quantum or classical computational power. At present, the quantum protocols that have been designed are commitment [BC, BCJL], oblivious transfer [Cr87, Cr94, BBCS, MS, Yao], key distribution [BB84, BBBSS, BBBW] and identification [CS]. Furthermore, prototypes for implementing some of these protocols have been built [BBBSS, MT, To94, TRT1, TRT2].

However, the full security of some of these protocols has not yet been proved. One of the difficulties in providing a full security proof is the cheaters’ ability to execute coherent measurements on many photons at a time. At present, security against coherent measurements has been obtained in the case of commitment [BCJL] and bit oblivious transfer [Yao]. The security of QKD against coherent measurements has not yet been addressed in the literature and it is not clear whether the techniques used by Yao in [Yao] for a QOT protocol may be easily used for a QKD protocol. In any case, we do not use Yao’s techniques. We show that the security against Bob of a QOT protocol implies its security against eavesdropping and, as a corollary, the security of a key distribution protocol. The level of security against eavesdropping that we obtain for QOT (and QKD) depends upon the level of security of QOT against Bob, and, in particular, full security against Bob implies full security against eavesdropping.

The security of a QOT protocol against an eavesdroper is interesting in itself because it allows the protocol to be executed securely over a long quantum channel by an honest Alice and an honest Bob. The above implication works with a string QOT protocol, that is, a QOT protocol that transfers a string rather than only a single bit. The implication requires that the QOT protocol tolerates errors in the quantum channel and that the classical announcements in the QKD protocol are made on a faithful public channel between Alice and Bob. It does not require any unrealistic physical assumption such as zero error in the quantum channel.

2 The QOT protocol and the security of OT

There are two types of OT: the ordinary OT and the \binom{1}{2}-OT. We consider the string version of both types. In the ordinary OT, Alice inputs a string s, Bob receives a random bit c ∈ \{0, 1\} and, if c = 0, the string s. In the \binom{1}{2}-OT, Alice inputs two string s_{1} and s_{2}, Bob inputs a bit c_{B} and receives the string s_{c_{B}}.

In this paper, from the security against Bob and tolerance against errors of an ordinary QOT protocol, we obtain its security against Eve and, as a corollary, the security of a QKD protocol. This is significant in particular because Yao has proved the security against Bob of an ordinary QOT protocol [Yao].

2.1 The protocol

In the discussion below, a dishonest Bob and a dishonest Eve, have been included. Both appear in the same description, but the security of the protocol against any one of them is based upon the assumption that the other is inactive.

For b, θ ∈ {0, 1}, let |b⟩_{θ} be the state of a photon polarized at b × 90 + θ × 45 degrees. In the BB84 coding scheme, b is the bit coded in the state |b⟩_{θ} and θ determines the basis used to code this bit: θ = 0 corresponds to the basis {0^{∘}, 90^{∘}} whereas θ = 1 corresponds to the basis {45^{∘}, 135^{∘}}.

Protocol OT (s)

1 Honest Bob: He chooses and commits to a random string θ̂ = (θ̂_{1}, …, θ̂_{4n}) ∈_{R} {0, 1}^{4n}. Dishonest Bob: He cannot gain any advantage from being dishonest at this step.

2 Until 4n pulses are detected by Bob:

2.1 Alice: She sends a pulse to Bob in which a random bit is coded using a

random base in the BB84 coding scheme. 2.2 Dishonest Eve: She transfers some information from this pulse into her own quantum system and she uses that information to modify the residual state of the pulse which is sent to Bob. The entire operation may be represented by a single unitary transformation on the product state of the photon and Eve’s system.

2.3 Let us assume that, thus far, i−1 pulses have been detected by an honest Bob or declared as such by a dishonest Bob. Honest Bob: He executes on this pulse a von Neumann measurement in the basis θ̂_{i} and, if the pulse is detected, he obtains a bit b̂_{i} that he commits to Alice. Dishonest Bob: He executes a coherent measurement on this pulse and the previous pulses in order to determine:

– whether or not he declares this pulse as detected and, if he declares this pulse as detected,

– the bit b̂_{i} that he commits to Alice.

Typically, Bob executes an incomplete measurement. The string of bits coded in these 4n detected pulses is b ∈_{R} {0, 1}^{4n} and the associated string of bases is θ ∈_{R} {0, 1}^{4n}.

3 Alice: She chooses a random string open ∈_{R} {0, 1}^{4n} and publicly announces it. For each i, if open_{i} = 1 she asks Bob to open the commitments θ̂_{i} and b̂_{i}. She publicly announces the string error where

error_{i} = \{ \begin{matrix}1 & if θ_{i} = θ̂_{i} ∧ b_{i} ≠ b̂_{i} ∧ open_{i} = 1 \\ 0 & otherwise \end{matrix}

If #error and the number of undetected pulses (another kind of error) are not too large, the remainder of protocol is executed, and Pass is set to 1 otherwise Alice refuses to continue and Pass is set to 0.

4 Alice: She publicly announces the string θ = (θ_{1}, …, θ_{4n}). 5 Honest Bob: He chooses a random bit c_{B}. He deterministically computes an

ordered pair (e_{0}, e_{1}) such that e_{0} ∪ e_{1} = {i|open_{i} = 0}, |#e_{0} − #e_{1}| ≤ 1 and

(∀i ∈ e_{c_{B}}) θ_{i} = θ̂_{i} ∨ (∀i ∈ ec̄_{B}) θ_{i} ≠ θ̂_{i},

and publicly announces this ordered pair. For our proof, it is convenient to consider that Bob’s deterministic algorithm to compute (e_{0}, e_{1}) returns the same output if θ̂ and c_{B} are both complemented (this is easy to accomplish). Dishonest Bob: Having learnt the string θ, he executes a first post-test measurement of his choice and uses the outcome to compute an ordered pair (e_{0}, e_{1}) such that e_{0} ∪ e_{1} = {i|open_{i} = 0} and |#e_{0} − #e_{1}| ≤ 1, and publicly announces the ordered pair.

For all d ∈ {0, 1}, the string coded by Alice in e_{d} is denoted w_{d}. 6 Alice: She chooses and publicly announces a random bit c_{A} and a hash

function g from {0, 1}^{#e_{c_{A}}} to {0, 1}^{r}. The integer r is the length of the string to be sent via QOT. She also publicly announces a = g(w_{c_{A}}) ⊕ s and Syn(w_{c_{A}}), the syndrome of w_{c_{A}} which is needed by Bob for error correction.

7 Honest Bob: Let c = c_{A} ⊕ c_{B} (this is the c that appears in the description of the task). If c = 0, he uses Syn(w_{c_{A}}) to correct the error in w_{c_{B}} = w_{c_{A}} and then he computes s = g(w_{c_{B}}) ⊕ a. Dishonest Bob: Using the information obtained at step 6, he executes a second and final post-test measurement and obtains the outcome jBob. This provides information about s = a ⊕ g(w_{d}), for d = 0, 1.

8 Dishonest Eve: She measures her system and obtains the outcome jEve. This provides information about s = a ⊕ g(w_{d}), for d = 0, 1.

We adopt the following notation: the random values s, b, θ, b̂, etc. associated with an execution of the protocol are values taken by random variables S, B, Θ, B̂, etc.

The remainder of the section contains the formal definitions of security that we use in our proof. As for the definition of security for \binom{1}{2}-OT found in [Cr94], our definitions are formulated in terms of the amount of information received by a given participant. Any initial information about s that may have this participant, Bob in sections 2.2 and 2.4 and Eve in section 2.3, corresponds to an apriori probability distribution on S which is implicit in our definitions.

Due to their relative complexity, we understand that the reader may have the impression that the following definitions are more complicated than necessary. However, these are the most simple and yet complete definitions that we could express in terms of mutual information. A more complete discussion on this subject, including a connection with definitions expressed in terms of statistical indistinguishability, will appear in another paper.

2.2 Security of OT against Bob

Let VBob represents all the information received or generated by Bob in the protocol. A QOT protocol is secure against Bob if (∃α > 0)(∃n_{0}) such that, (∀n > n_{0}), for every Bob, for every Channel, there exists a binary random variable C̃ (defined when P ass = 1) such that

I(S; VBob|C̃ = 1 ∧ P ass = 1) × Pr(P ass = 1) ≤ 2^{−αn}  (1)
Pr(C̃ = 1|P ass = 1) = 1/2  (2)
I(S; VBob|P ass = 0) × Pr(P ass = 0) ≤ 2^{−αn}  (3)
I(S; C̃, P ass) ≤ 2^{−αn}  (4)

Let us remark that at step 5 a dishonest Bob does not even have to choose a bit C_{B}. If Bob does not choose a bit C_{B}, the bit C = C_{A} ⊕ C_{B} associated with an honest Bob is meaningless. Therefore, in the above definition, C̃ has, in general, nothing to do with the bit C associated with an honest Bob.

Statement 1 says that, if Bob passes the test with a significant probability, then, in the context where Bob passes the test and C̃ = 1, Bob learns almost nothing about S. Statement 2 says that, in the context where Bob passes the test, C̃ is perfectly random. Statement 3 says that, if Bob fails the test with a significant probability, then, in the context where Bob fails the test, Bob learns almost nothing about S. Statement 4 says that the information (C̃, P ass), where C̃ is not given to Bob in the protocol but could eventually be given to Bob outside the protocol, says almost nothing about S.

2.3 Security of the extended OT against Eve

Let VEve represents all the information that is available to an eavesdropper Eve. The protocol is secure against Eve, if (∃n_{0}) such that, (∀n > n_{0}), for every Channel, for every Eve,

I(S; VEve) ≤ 2^{−αn}.

2.4 Tolerance against errors in OT

The protocol is tolerant against errors (the tolerated error rate being indirectly specified by the test) if, (∃α > 0) (∃n_{0}) such that, (∀n > n_{0}), for every Channel, if Pr(P ass = 1) > 2^{−αn}, then

I(S; VBob|C = 0 ∧ P ass = 1) > r − 2^{−αn}  (5)
Pr(C = 0|P ass = 1) > 1/2 − 2^{−αn}  (6)

where C is the bit that is received by an honest Bob.

The condition Pr(P ass = 1) > 2^{−αn} is needed because, if the expected rate of errors in the quantum channel is so high that the probability that Bob passes the test is almost zero, then the protocol does not have to compensate for errors, even in the rare cases where Bob does pass the test. Statement 5 says that, in the context where C = 0 and Bob passes the test, Bob must receive almost everything about the string S. This means that the protocol compensates for errors in the quantum channel. Statement 6 says that, in the context where Bob passes the test, the bit C must almost be perfectly random.

3 From Bob to Eve

In this section we prove the following theorem.

Theorem 1. The security against Bob and tolerance against errors of the above protocol implies its security against Eve.

Looking ahead to an extension of this result to QKD, we shall be generous and assume that Eve receives Θ̂ and C_{B} at the same time as she receives the pair (E_{0}, E_{1}) (which is thus redundant). The following general purpose lemma is useful.

Lemma 2. Let A, B,C be any random variables. We have

I(A; B) = I(A; C) + I(B; C) − I(A, B; C) + ∑_{c} I(A; B|C = c) Pr(C = c).

The proof is left to the reader. When we refer to this lemma, we say that the mutual information I(A; B) is partitioned over C. Note that, if C is a function of B, we obtain I(B; C) = I(A, B; C) = H(C) and, therefore,

I(A; B) = I(A; C) + ∑_{c} I(A; B|C = c) Pr(C = c).

Proof of Theorem 1. Let α and n_{0} be the parameters for the security against Bob. Let α′ and n′_{0} be the parameters for the tolerance. Let α_{m} = Max{α, α′} and n_{m} be such that

r × 2^{−(α_{m}/3)n_{m}} < \frac{1}{6}.  (7)

We shall see that n′′_{0} = Max{n_{0}, n′_{0}, n_{m}} and α′′ = α_{m}/3 are adequate parameters for the security against Eve. Partitioning I(S; VEve) over P ass we obtain

I(S; VEve)
= I(S; VEve|P ass = 0) Pr(P ass = 0)
+I(S; VEve|P ass = 1) Pr(P ass = 1)
+I(S; P ass)

Using 3 and 4 and the fact that VEve is a subset of VBob we obtain

I(S; VEve) = 2 × 2^{−α_{m}n} + I(S; VEve|P ass = 1) Pr(P ass = 1).

We only have to take care of the last term. Partitioning the last term over C = C_{A} ⊕ C_{B}, we obtain

I(S; VEve|P ass = 1) Pr(P ass = 1)

= \frac{1}{2}I(S; VEve|C = 0) Pr(P ass = 1)

+\frac{1}{2}I(S; VEve|C = 1) Pr(P ass = 1)

We now use the two following propositions.

Proposition 3. For every Eve, for every Channel, (∀n > n′′_{0}),

I(S; VEve|C = 1) × Pr(P ass = 1) ≤ 2^{−α′′n}.

Proposition 4. For every Eve, for every Channel, (∀n > n′′_{0}),

I(S; VEve|C = 0) × Pr(P ass = 1) ≤ 2^{−α′′n}.

Using propositions 3 and 4 we obtain the security against Eve. We shall prove these propositions in the remainder of this section.

Proof of Proposition 3. Let us consider any integer n > n′′_{0}, any Channel and any Eve. Let us consider a Bob that executes Eve’s actions in addition to his honest actions. Because VEve is a subset of VBob, it will be enough to show that

I(S; VBob|C = 1) × Pr(P ass = 1) ≤ 2^{−α′′n}.

The basic idea of the proof is simply that, because tolerance against error implies that Bob must receive S each time that C = 0 and security against Bob implies that he cannot receive S more than half of the time, then Bob cannot receive S when C = 1. The remainder of the proof expresses this idea more formally in a way that takes care of additional points related to the test. By contradiction, let us assume that

I(S; VBob|C = 1) × Pr(P ass = 1) > 2^{−α′′n} = 2^{−(α_{m}/3)n}.

This implies

P r(P ass = 1) > (1/r)2^{−(α_{m}/3)n}  (8)

and

I(S; VBob|C = 1) > 2^{−(α_{m}/3)n}  (9)

To obtain the contradiction, we show that

I(S; VBob|P ass = 1) ≥ (r/2) + \frac{11}{24}2^{−(α_{m}/3)n}  (10)

and

I(S; VBob|P ass = 1) < (r/2) + \frac{6}{24}2^{−(α_{m}/3)n}.  (11)

First, we show 10. If we partition I(S; VBob|P ass = 1) over C, we obtain

I(S; VBob|P ass = 1)

≥ \frac{I(S; VBob|C = 1)}{2}

+\frac{I(S; VBob|C = 0)}{2}.

Formula 7 and 8 give us Pr(P ass = 1) > 2^{−α_{m}n} which is the required hypothesis in tolerance against errors. Formula 5 and 6 give us that

I(S; VBob|C = 0) Pr(C = 0|P ass) > (r/2) − (r + \frac{1}{2})2^{−α_{m}n}.  (12)

Using equation 9, we obtain

I(S; VBob|C = 1) Pr(C = 0|P ass) ≥ \frac{1}{2}2^{−(α_{m}/3)n}.  (13)

Summing inequalities 12 and 13, one easily obtain 10. Now, we show 11. Let C̃ be the random bit whose existence is required by the security against Bob. Partitioning I(S; VBob|P ass = 1) over C̃ and using 2, we obtain

I(S; VBob|P ass = 1)

= \frac{I(S; VBob|C̃ = 0 ∧ P ass = 1)}{2}

+\frac{I(S; VBob|C̃ = 1 ∧ P ass = 1)}{2}

+I(S; C̃|P ass = 1)

Clearly,

\frac{I(S; VBob|C̃ = 0 ∧ P ass = 1)}{2} ≤ \frac{r}{2}.  (14)

Also, using 1, we obtain

\frac{I(S; VBob|C̃ = 1 ∧ P ass = 1)}{2} Pr(P ass = 1) < \frac{1}{2}2^{−α_{m}n}.

from which, using 8, we get

\frac{I(S; VBob|C̃ = 1 ∧ P ass = 1)}{2} < \frac{r}{2}2^{−(2α_{m}/3)n} ≤ \frac{1}{12}2^{−(α_{m}/3)n}.  (15)

Now, partitioning I(S; C̃, P ass) over P ass, we obtain that

I(S; C̃, P ass) ≥ I(S; C̃|P ass = 1) Pr(P ass = 1).

Therefore, using 8 and 4, we obtain

I(S; C̃|P ass = 1)\frac{2^{−(α_{m}/3)n}}{r} ≤ 2^{−α_{m}n}

which implies

I(S; C̃|P ass = 1) ≤ r2^{−(2α_{m}/3)n} ≤ \frac{1}{6}2^{−(α_{m}/3)n}.  (16)

Summing inequalities 14, 15 and 16, one easily obtains 11. This concludes the proof of proposition 3.

To prove proposition 4, the following lemma is useful.

Lemma 5. Let A, B,C and D be any random variables such that C is a function of D. For every d, we have

I(A; B, C|D = d) = I(A; B|D = d).

The proof of this lemma is left to the reader.

Proof of Proposition 4. Let us consider any n > n′′_{0}, any eavesdropper Eve_{0} and any channel Channel. Our proof consists of finding an eavesdropper Eve_{1} such that

I(S^{(1)}; VEve^{(1)}|C^{(1)} = 1) = I(S^{(0)}; VEve^{(0)}|C^{(0)} = 0),

where the upper index (i) on a random variable means that it is associated with the eavesdropper Eve_{i}. Let

X = (Open, Θ̂, C_{B}),
U = (B, Θ, E_{0}, E_{1}, C_{A}, G, S),
Y = (Error, JEve)

and

Z = (Θ, Error, C_{A}, G, Syn(W_{C_{A}}), A, JEve).

Note that Eve’s view on the execution is VEve = (X, Z). Let F be the transformation that maps x = (open, θ̂, c_{B}) into x′ = (open, θ̂′, c̄_{B}) where

θ̂′_{i} = \{ \begin{matrix}θ̂_{i} & if open_{i} = 1 \\ θ̂_{i} ⊕ 1 & if open_{i} = 0 \end{matrix} .

Let p_{n} = Pr(X = x) = \frac{1}{2×4^{4n}}. For every Eve_{1}, using a partition over X and the relation I(S, X|C = c) = 0 to obtain the first equality, lemma 5 to obtain the second equality and the bijectivity of F on X to obtain the third equality, we have:

I(S^{(1)}; VEve^{(1)}|C^{(1)} = 1)

= ∑_{x} I(S^{(1)}; VEve^{(1)}|X^{(1)} = x ∧ C^{(1)} = 1) × p_{n}
= ∑_{x} I(S^{(1)}; Z^{(1)}|X^{(1)} = x ∧ C^{(1)} = 1) × p_{n}
= ∑_{x} I(S^{(1)}; Z^{(1)}|X^{(1)} = F (x) ∧ C^{(1)} = 1) × p_{n}

Similarly, we have

I(S^{(0)}; VEve^{(0)}|C^{(0)} = 0)

= ∑_{x} I(S^{(0)}; Z^{(0)}|X^{(0)} = x ∧ C^{(0)} = 0) × p_{n}

Note that (S, Z) is a function of (U, Y). Therefore, we are done if we may define Eve_{1}’s strategy at steps 2 and 8 such that the distribution of (U^{(0)}, Y^{(0)}) given (X, C)^{(0)} = (x, 0) is identical to the distribution of (U^{(1)}, Y^{(1)}) given (X, C)^{(1)} = (F (x), 1). Let us consider an execution under Eve_{0} where (X, C)^{(0)} = (x, c) and an execution under Eve_{1} where (X, C)^{(1)} = (F (x), c̄) = F (x, c). For every Eve_{1}’s strategy, because Alice acts exactly in the same way in both executions and U is invariant under F, we have that U^{(0)} in Eve_{0} execution is identical to U^{(1)} in Eve_{1} execution. Now, we fix the value of U and consider the random variable Y. We must construct Eve_{1}’s strategy such that the distribution of Y^{(0)} given (U, X, C)^{(0)} = (u, x, c) is the same as the distribution of Y^{(1)} given F (U, X, C)^{(1)} = (u, x, c). At step 2, we define Eve_{1} such that she executes the same transfer of information as Eve_{0}. This is a natural choice because, at this step, (Y, C) is unknown and Eve_{1} cannot make use of the difference between the above conditions. We obtain that the random variable Error behaves in the same way in both executions because

– Bob’s outcomes at positions that are used for the test are independent of Bob’s choice of bases at positions that are not used for the test and

– Eve_{1} has tampered the photons in the same way as Eve_{0}.

We now fix the value of Error. At step 8, Eve_{1} with the view VEve^{(1)} executes

what Eve_{0} executes with the view F (VEve^{(1)}) = VEve^{(0)}. In other words, in these two distinct executions, Eve_{0} and Eve_{1} act in exactly the same way. The distribution of the random variable JEve must be the same in both case, because they have executed the same transfer of information and the same measurement, and Alice has sent the same state. This concludes the proof of proposition 4 and theorem 1.

4 Security of QKD

The QKD protocol is exactly the QOT protocol, where Bob announces Θ̂ and C_{B}, and Alice always chooses C = 0 (C_{A} = C_{B}). The security of this QKD protocol is a direct consequence of proposition 4.

5 Conclusion

In this paper, we have shown that the security of an ordinary QOT protocol and its tolerance against error implies its security against eavesdropping and, as a corollary, the security of a QKD protocol. In the \binom{1}{2}-OT case, security against an eavesdropper means that, if Alice and Bob are honest, Eve cannot find out anything new about (s_{1}, s_{2}). A \binom{1}{2}-QOT protocol is similar to an ordinary OT protocol, except that Alice transfers two random strings w_{0} and w_{1} using the sets e_{0} and e_{1} respectively. One may wonder, if we could obtain the security against eavesdropping of a \binom{1}{2}-QOT protocol via a similar approach. This would be interesting because, if efficiency is a concern, the \binom{1}{2}-OT task is more powerful than the ordinary OT task: one execution of a \binom{1}{2}-OT protocol is enough to construct an ordinary OT protocol, but Kn executions of an ordinary OT protocol, for some K > 0, is required to construct a \binom{1}{2}-OT protocol [Cr87].

Unfortunately, there is an additional problem in the \binom{1}{2}-OT case which is related to the fact that Eve may be aware of some correlation between s_{1} and s_{2} before the protocol begins. This correlation becomes a correlation between w_{0} and w_{1} at the time Eve measures her system and, in principle, this may help her to execute a better measurement. In a more elaborate version of this paper, we shall provide a proof for the \binom{1}{2} case where s_{1} and s_{2} are independent in Eve’s initial information.

It would have been reasonnable to better explain our formal definitions of security that appear in section 2. Ideally, we should have explained the connection between these definitions and previous definitions found in the literature such as those found in [Cr90]. As mentioned before, an analysis of these definitions will be presented in a subsequent paper.

Finally, now that we know that security may be obtained, it will be useful to determine the maximal error rate that can be tolerated and, for a given error rate, how much resource is required to guarantee a desired level of security. We need this information to find out what kind of technology is required to realize quantum protocols that are efficient and secure. To our knowledge, some theoretical work remains yet to be done at this level, at the least for QOT and QKD.

Acknowledgement

The author gratefully acknowledge fruitful discussions with Charles Bennett, Gilles Brassard, Claude Crépeau and Louis Salvail, and the support of the Institute for Scientific Interchange at Torino under whose auspice much of this work was done. This research was partially supported by Québec’s FCAR.

References

[BB84] C.H. Bennett, G. Brassard, Quantum Cryptography: Public key distribution and coin tossing, Proc. of IEEE International Conference on Computers, Systems, and Signal Processing, Banglore, India, December 1984, pp. 175 – 179.

[BBBSS] C.H. Bennett, F. Bessette, G. Brassard, L. Salvail, and J. Smolin, Experimental quantum cryptography, Journal of Cryptology, vol. 5, no. 1, 1992, pp. 3 – 28. Previous version in Advances in Cryptology — Eurocrypt ’90 Proceeding, May 1990, Springer – Verlag, pp. 253 – 265.

[BBBW] C.H. Bennett, G. Brassard, S. Breidbart and S. Wiesner, Quantum cryptography, or unforgeable subway tokens, Advances in Cryptology: Crypto ’82 Proceeding, August 1982, Plenum Press pp. 267 – 275.

[BBCS] C.H. Bennett, G. Brassard, C. Crépeau, M.-H. Skubiszewska, Practical Quantum Oblivious Transfer, In proceedings of CRYPTO’91, Lecture Notes in Computer Science, vol. 576, Springer – Verlag, Berlin, 1992, pp. 351 – 366.

[BC] G. Brassard and C. Crépeau, Quantum bit commitmemt and coin tossing protocols, in Advances in Cryptology: Proceeding of CRYPTO’90, Lecture Notes in Computer Science, vol. 537, Springer – Verlag, Berlin, 1991, pp. 49 – 61.

[BCJL] G. Brassard, C. Crépeau, R. Jozsa, D. Langlois, A quantum bit commitment scheme provably unbreakable by both parties, in Proceeding of the 34th annual IEEE Symposium on Foundations of Computer Science, November 1993, pp. 362 – 371.

[Cr87] C. Crépeau, Equivalence Between Two Flavors of Oblivious Transfers, Advances in Cryptology — Crypto ’87 Proceeding, August 1987, Springer – Verlag, pp. 350 – 354.

[Cr90] C. Crépeau, Correct and Private Reductions among Oblivious Transfers, Ph.D. Thesis, Massachusetts Institute of Technology, 1990.

[Cr94] C. Crépeau, Quantum oblivious transfer, Journal of Modern Optics, vol. 41, no. 12, December 1994, pp. 2445 – 2454.

[CS] C. Crépeau, and L. Salvail, Quantum Oblivious Mutual Identification, Advances in Cryptology: Proceedings of Eurocrypt’95, May 1995, Springer – Verlag, to appear.

[MS] D. Mayers and L. Salvail, Quantum Oblivious Transfer is Secure Against All Individual Measurements, Proceedings of the workshop on Physics and Computation, PhysComp ’94, Dallas, Nov 1994, pp. 69 – 77.

[MT] Marand, C. and P. Townsend, Quantum key distribution over distances up to 30km, Optics Letters, to appear.

[To94] P.D. Townsend, Secure key distribution system based on quantum cryptography, Electronics Letters, Vol. 30, no. 10, 12 May 1994.

[TRT1] P.D. Townsend, J.G. Rarity and P.R. Tapster, Single pulse interference in a 10 km long optical fibre interferometer, Electronics Letters, vol. 29, no. 7, 1 April 1993, pp. 634 – 635.

[TRT2] P.D. Townsend, J.G. Rarity and P.R. Tapster, Enhanced single photon fringe visibility in a 10 km-long prototype quantum cryptography channel, Electronics Letters, vol. 29, no. 14, 8 July 1993, pp. 1291 – 1293.

[Yao] A. Yao, Security of Quantum Protocols Against Coherent Measurements, in Proceedings of the 26th Symposium on the Theory of Computing, June 1995, to appear.

This article was processed using the LaTEX macro package with LLNCS style