C. H. Bennett, G. Brassard, C. Cr'epeau, and M.-H. Skubiszewska. Practical quantum oblivious transfer. In Advances in Cryptology: Proceedings of Crypto '91, Lecture Notes in Computer Science, Vol. 576, pages 351--366. Springer-Verlag, 1992.  Home/Search   Document Details and Download   Summary   Related Articles   Check

....J c , # i = # i . 5: Alice computes and announces b 0 and 6: Bob receives and computes b c = i#Jc r i b c Known Security Results. The correctness and the security of the qot protocol against the sender (Alice) has been reduced to the concealing property of BBC in [3, 6]. The security against the receiver (Bob) has been provided by Yao in [25] given the commitment scheme BBC is binding. That is, given 23 BBC is a perfect black box for bit commitment then qot is secure against any dishonest Bob irrespectively of his computing power. 3.2 QBC Protocol using QOT ....

....or are such constructions inherently interactive It is also unclear whether or not perfectly concealing schemes can be based upon any quantum one way function. Although we assumed in this thesis a perfect quantum channel, our construction should also work with noisy quantum transmission [3]. It would be nice to provide the analysis for this general case. 46 ....

Bennett, C. H., G. Brassard, C. Cr epeau and M.-H. Skubiszewska, "Practical Quantum Oblivious Transfer", Advances in Cryptology : CRYPTO '91 : Proceedings, Lecture Notes in Computer Science, vol. 576, Springer-Verlag, August 1992, pp. 362 -- 371. 47

....assumption than the existence of a one way function (as for the first solution) solutions based on Oblivious Transfers are more interesting because they can be implemented in non computational scenarios. Oblivious Transfer can be implemented under the assumption that quantum mechanics is correct [9, 3] or under the assumption that reliable noisy channels exist [10] Section 5 describes a new simple and e#cient protocol based on the existence of a one out of two Oblivious Transfer. The scheme of Fagin, Naor and Winkler uses O(n ) one out of two Oblivious Transfers while ours, based on coding ....

....from Example 2.3 is indeed a trapdoor function (but not a permutation) since the extra information y = P is su#cient to calculate x from f(x) x . In non computational models, as mentioned in the introduction, OT 2 can be implemented under the assumption that quantum mechanics is correct [9, 3] or under the assumption that reliable noisy channels exist [10] 3.4 Oblivious Transfer of two bits In protocol 5 below, we use a One out of two Oblivious Transfer of two bit elements from 4 , denoted by OT 4 . Each such transfer is achieved securely (even if one party tries to cheat) ....

Bennett, C.H., G. Brassard, C. Cr epeau and M.--H. Skubiszewska, "Practical Quantum Oblivious Transfer", In Advances in Cryptology: Proceedings of Crypto '91, Lecture Notes in Computer Science, Springer-Verlag, August 1991, Berlin, pp. 351 -- 366.

....of two parties, Alice and Bob. Alice has n secret bits and Bob has a query which is an index to one of those secrets. Implementations of traditional OT were shown using cryptographic assumptions (such as the existence of one way functions [14] noisy channels [15, 16] or quantum computation [6]. The need to make some computational assumption is inherent in this model, because Alice has access to the complete transcript of the communication between her and Bob, and thus she can, information theoretically, determine exactly what Bob can infer about her data. Thus, this model does not ....

C. Bennett, G. Brassard, C. Crepeau, M. H. Skubiszewska. Practical Quantum Oblivious Transfer. CRYPTO 1991 15

....in the two party case is equivalent to complexity based classical cryptography. For example, quantum bit commitment schemes can be built from physical assumptions that are independent of the existence of one way functions [16] Moreover, bit commitment is su#cient for quantum oblivious transfer [4, 19] which would # Supported by a NSERC grant, part of this work was done while visiting BRICS and McGill SOCS. ## Part of this work was done while visiting BRICS and NEC Tsukuba Laboratory, Japan. # # # Supported by the Thomas B. Thriges Center for KvanteInformatik (CKI) Basic Research in ....

Bennett, C. H., G. Brassard, C. Cr epeau and M.-H. Skubiszewska, "Practical Quantum Oblivious Transfer", Advances in Cryptology : CRYPTO '91 : Proceedings, Lecture Notes in Computer Science, no 576, Springer--Verlag, August 1992, pp. 362 -- 371.

....3 An important primitive in secure computation is the so called bit commitment. 3 The optimism in unconditional secure quantum two party computation was largely contributed by well known claims of unconditional secure quantum bit commitment protocols [16] and also oblivious transfer [17,18]) However, such optimism has recently been put into serious question due to the surprising demonstration of the insecurity of quantum bit commitment (against an EPR type of attack with delayed measurements) by Mayers [20,21] and also by Chau and me [22,23] Yet an important question remains: ....

C. H. Bennett, G. Brassard, C. Cr'epeau, and M.-H. Skubiszewska, "Practical quantum oblivious transfer," in Advances in Cryptology: Proceedings of Crypto '91, Lecture Notes in Computer Science, Vol. 576, p. 351-366. Springer-Verlag, 1992.

....transmitted by a party just disappear; the other party receives a . It has been proven that Oblivious Transfer is sufficient for obtaining a pmpc protocol [15, 29, 30, 35, 26, 13] More practically, Oblivious Transfer can be implemented on top of a Noisy Channel [17, 16] or on a Quantum Channel [5]. It turns out that most protocols represent the function f by a Boolean circuit and they often exhibit the following overall structure: Initialization phase: All participants agree on the circuit to be evaluated and on all parameters of the protocol. Some protocols use pre computations to speed ....

C. H. Bennett, G. Brassard, C. Cr' epeau, & M.-H. Skubiszewska (1992). Practical quantum oblivious transfer. In J. Feigenbaum, editor, Proc. CRYPTO 91, pages 351--366. Springer. Lecture Notes in Computer Science No. 576.

....by a party just disappear; the other party receives a . It has been proven that Oblivious Transfer is sufficient for obtaining a pmpc protocol [15, 29, 30, 35, 26, 13] More practically, Oblivious Transfer can be implemented on top of a Noisy Channel [17, 16] or on a Quantum Channel [5]. It turns out that the overall structure of most protocols is quite similar: Initialization phase: All participants agree on the circuit to be evaluated and on all parameters of the protocol. Some protocols use pre computations to speed up the computation phase. Input phase: Each participant ....

C. H. Bennett, G. Brassard, C. Cr'epeau, and M.-H. Skubiszewska. Practical quantum oblivious transfer. In J. Feigenbaum, editor, Proc. CRYPTO 91, pages 351--

....protocol involving two parties [Ki] Oblivious Tranfer allows one party Alice to send a string fi 2 f0; 1g l in such a way that Bob will receive it with probability 1 2 and will know whether he received it or not. Alice knows nothing about what happened to her string. The BBCS protocol [BBCS] implements this primitive in the quantum model. In the first part of this protocol, Alice sends to Bob photons polarized using either the rectilinear or the diagonal basis to encode some bits. A secure realisation of oblivious transfer in the continuation of the protocol relies on the fact that ....

C.H. Bennett, G. Brassard, C. Cr'epeau, M.-H. Skubiszewska, Practical Quantum Oblivious Transfer, In proceedings of CRYPTO'91, Lecture Notes in Computer Science, vol 576, Springer Verlag, Berlin, 1992, pp 351--366.

....information about any other secret and the buyer does not want the merchant to learn anything about the string he has chosen. Oblivious transfer, and consequently ANDOS, can be based on various assumptions like the existence of trapdoor functions [16] of noisy channels [12] or of quantum channels [3]. From a practical point of view, efficient implementation can be based on the quadratic residuosity problem [7, 25] or on the Diffie Hellman assumption [1, 23] In this paper we use ANDOS as a cryptographic primitive. In order to formalize its properties, let us consider that Alice sells a secret ....

C.H. Bennett, G. Brassard, C. Cr'epeau, and M.-H. Skubiszewska. Practical Quantum Oblivious Transfer. In Crypto '91, LNCS 576, pages 351--366. Springer-Verlag, 1992.

....assumption than the existence of a one way function (as for the first solution) solutions based on Oblivious Transfers are more interesting because they can be implemented in non computational scenarios. Oblivious Transfer can be implemented under the assumption that quantum mechanics is correct [9, 3] or under the assumption that reliable noisy channels exist [10] for the 10th anniversary of the CWI Crypto course. 3 Section 5 describes a new simple and e#cient protocol based on the existence of a one out of two Oblivious Transfer. The scheme of Fagin, Naor and Winkler uses O(n 2 ) ....

....2.3 is indeed a trapdoor function (but not a permutation) since the extra information y = P is su#cient to calculate x from f(x) x 2 . In non computational models, as mentioned in the introduction, 2 1 OT 2 can be implemented under the assumption that quantum mechanics is correct [9, 3] or under the assumption that reliable noisy channels exist [10] 3.4 Oblivious Transfer of two bits In protocol 5 below, we use a One out of two Oblivious Transfer of two bit elements from F 4 , denoted by 2 1 OT 4 . Each such transfer is achieved securely (even if one party tries to ....

Bennett, C.H., G. Brassard, C. Cr epeau and M.--H. Skubiszewska, "Practical Quantum Oblivious Transfer", In Advances in Cryptology: Proceedings of Crypto '91, Lecture Notes in Computer Science, Springer-Verlag, August 1991, Berlin, pp. 351 -- 366.

No context found.

C. H. Bennett, G. Brassard, C. Cr'epeau, and M.-H. Skubiszewska. Practical quantum oblivious transfer. In Advances in Cryptology: Proceedings of Crypto '91, Lecture Notes in Computer Science, Vol. 576, pages 351--366. Springer-Verlag, 1992.

....or are such constructions inherently interactive It is also unclear whether or not perfectly concealing schemes can be based upon any quantum one way function. Although we assumed in this paper a perfect quantum channel, our construc tion should also work with noisy quantum transmission [3]. It would be nice to provide the analysis for this general case. ....

BENNETT, C. H., G. BRASSARD, C. CROPEAU and M.-H. SKUBSZEWSKA, "Practical Quantum Oblivious Transfer", Advances in Cryptology : CRYPTO '91: Proceedings, Lecture Notes in Computer Science, vol. 576, Springer-Verlag, August 1992, pp. 362-371.

....x Gamma (1 Gamma x) lg(1 Gamma x) be the binary entropy function. It is shown in [1] that Theorem 2.1 For any ffi 0 and all sufficiently large n H(G(W )jBS ffl (W ) G) r Gamma Gammas where s = n(H(ffl) Gamma ffi) Gamma r. Let syn : f0; 1g be a linear function. According to [2, 5, 1] for the special case where syn is a rank t linear function we have Theorem 2.2 For any oe 2 f0; 1g , ffi 0 and all sufficiently large n H(G(W )jBS ffl (W ) syn(W ) oe; G) r Gamma t Gammas where s = n(H(ffl) Gamma ffi) Gamma r. Since H(G(W )jBS ffl (W ) syn(W ) oe; G) r ....

....bit is 2ffl = 1 Gamma ff. If no extra checks are performed, Alice could send bad pairs and figure out in Protocol 4.2 which set is good and which set is bad by the fact that good pairs are more likely to have been received. 6 The errors are first solved (in Protocol 4. 2) by the same trick as in [2] using codes to fix them, while the cheating by Alice is later taken care of (in Protocol 4.3) by running statistics on the frequency of bb pairs. Protocol 4.2 introduces another kind of cheating Alice could perform that is also solved in Protocol 4.3. For this first protocol we assume Alice ....

C. H. Bennett, G. Brassard, C. Cr'epeau, and M.-H. Skubiszewska. Practical quantum oblivious transfer. In Advances in Cryptology: Proceedings of Crypto '91, Lecture Notes in Computer Science, Vol. 576, pages 351--366. Springer-Verlag, 1992.

....it was natural to hope that quantum mechanics might provide such an unconditionally secure scheme. A protocol for quantum bit commitment, henceforth referred to as BCJL, was proposed in 1993 and claimed to be provably secure [5] which would also have allowed secure quantum oblivious transfer [2], another fundamental primitive in classical cryptography. Because of this, the future of quantum cryptography looked very bright indeed, with new applications such as the identification protocol of Crepeau and Salvail [8] coming up regularly. Trouble began in October 1995 when Mayers found a ....

Bennett, Charles H., Gilles Brassard, Claude Cr epeau and Marie--Helene Skubiszewska, "Practical quantum oblivious transfer", Advances in Cryptology: Proceedings of Crypto '91, August 1991, pp. 351 -- 366.

....it was natural to hope that quantum mechanics might provide such an unconditionally secure scheme. A protocol for quantum bit commitment, henceforth referred to as BCJL, was proposed in 1993 and claimed to be provably secure [5] which would also have allowed secure quantum oblivious transfer [2], another fundamental primitive in classical cryptography. Because of this, the future of quantum cryptography looked very bright indeed, with new applications such as the identification protocol of Cr epeau and Salvail [8] coming up regularly. Trouble began in October 1995 when Mayers found a ....

Bennett, Charles H., Gilles Brassard, Claude Cr' epeau and Marie--H'el`ene Skubiszewska, "Practical quantum oblivious transfer", Advances in Cryptology: Proceedings of Crypto '91, August 1991, pp. 351 -- 366.

....flaws (eg Bob can get too much partial information by measuring the polarization along an intermediate axis such as 22:5 ffi ) which can overcome at the expense of making the scheme more complicated and using more photons. A fully practical version of quantum oblivious transfer been described[10], and can be implemented with apparatus similar to that used for quantum key distribution. Quantum oblivious transfer has the advantage of being useful over short distances (discreet decisions are often sought by parties occupying the same room) and the disadvantage of being rather inefficient ....

Bennett, C. H., G. Brassard, C. Cr'epeau, and M.-H. Skubiszewska "Practical Quantum Oblivious Transfer" Advances in Cryptology---Crypto--91 proceedings, edited by J. Feigenbaum, Lecture Notes in Computer Science vol. 576, pp. 351366 (Springer, Berlin Heidelberg, 1992).

....to bit b . At the end Bob is committed to a b and knows nothing about a b . Alice learns nothing about b. The current paper presents an efficient cot protocol. This protocol makes no assumption on the type of bcs and ots that are used. For instance, with ot and bc based on the Quantum Channel [2, 3] we can perform cot without any computational assumption. Our protocol uses some elements of coding theory and simple Zero Knowledge sub protocols. It uses O(n) ots and O(n 2 ) bcs, where n denotes the security parameter, but uses only O(n) bcs if they have a special xor property. The global ....

....1 prepared by Alice but she does not learn his choice b. Bob learns a b and obtains no information about a b . Implementations of ot can only exist under some assumption. For instance, ot can be constructed if trapdoor functions exist [16] from a noisy channel [11, 12] or from a quantum channel [2, 10]. It is also a well known fact that using O(n) of Rabin s Oblivious Transfers [26] one can construct one out of two Oblivious Transfer [7] In a Bit Commitment Alice sends a committed bit a to Bob in such a way that she is able to reveal it later in a unique way (a) but Bob is not able to find ....

C.H. Bennett, G. Brassard, C. Cr'epeau, M.-H. Skubiszewska, Practical Quantum Oblivious Transfer, Advances in Cryptology - CRYPTO'91, Springer-Verlag, 1992, pp. 351--366.

....x) lg(1 Gamma x) be the binary entropy function. It is shown in [1] that Theorem 2.1 For any ffi 0 and all sufficiently large n H(G(W )jBS ffl (W ) G) r Gamma 2 Gammas ln 2 where s = n(H(ffl) Gamma ffi) Gamma r. Let syn : f0; 1g n f0; 1g t be a linear function. According to [2, 5, 1] for the special case where syn is a rank t linear function we have Theorem 2.2 For any oe 2 f0; 1g t , ffi 0 and all sufficiently large n H(G(W )jBS ffl (W ) syn(W ) oe; G) r Gamma 2 t Gammas ln 2 : where s = n(H(ffl) Gamma ffi) Gamma r. Since H(G(W )jBS ffl (W ) syn(W ) oe; ....

....a bit is 2ffl = 1 Gamma ff. If no extra checks are performed, Alice could send bad pairs and figure out in Protocol 4.2 which set is good and which set is bad by the fact that good pairs are more likely to have been received. The errors are first solved (in Protocol 4. 2) by the same trick as in [2] using codes to fix them, while the cheating by Alice is later taken care of (in Protocol 4.3) by running statistics on the frequency of bb pairs. Protocol 4.2 introduces another kind of cheating Alice could perform that is also solved in Protocol 4.3. 4.1.2 Intuition behind Protocol ( 2 1 ) d ....

C. H. Bennett, G. Brassard, C. Cr'epeau, and M.-H. Skubiszewska. Practical quantum oblivious transfer. In Advances in Cryptology: Proceedings of Crypto '91, Lecture Notes in Computer Science, Vol. 576, pages 351--366. Springer-Verlag, 1992.

....is comparable to finding efficient decodable error correcting codes. This is due to similarities between these two problems when a non interactive protocol such as protocol 1 is being considered. The noninteractive scheme is relevant for some applications such as quantum oblivious transfer [BBCS]. We will see that using H 3 (defined below, for more details consult [CW] yields a decoding time complexity equivalent to that of solving the general problem of decoding linear codes. Definition 7. An R p reconciliation protocol is: 1. efficient if there is a polynomial t(n) such that T R ....

....ideal reconciliation schemes exist. If we consider other classes of hash functions, it is possible to obtain ideal protocols based on weaker hypotheses. High performance non interactive reconciliation protocols would be useful for efficient implementation of quantum oblivious transfer [BBCS]. From a practical point of view, Cascade is an efficient protocol that leaks less information than the best error correcting codes based reconciliation protocols. It is an improvement on the protoocol used in [BBBSS] in a true quantum setting. It would be of interest to have a detailed analysis ....

C. H. Bennett, G. Brassard, C. Cr'epeau, M.--H. Skubiszewska, Practical Quantum Oblivious Transfer, In proceedings of Crypto '91, Lecture Notes in Computer Science, vol 576, Springer Verlag, Berlin, 1992, pp. 351--366.

....von Neumann measurements were allowed [25, 26] The vulnerability to photon storage was easy to circumvent if only a secure bit commitment scheme were available. A more robust version of this protocol, capable of dealing with transmission errors on the quantum channel, was subsequently developed [10]. Then Mayers and Salvail [61] analysed the security of quantum oblivious transfer against the most general attacks allowed by quantum mechanics, under the sole restriction that the legitimate photons are measured one at a time, and they found that the protocol is secure provided a secure bit ....

....(computational for instance) in order to restrict the behaviour of the players and later drop this short term assumption to obtain a quantum bit commitment not relying on any long term assumption. This idea is very natural since the bit commitment required for the oblivious transfer protocols of [29, 10] is only used on a short term basis. Similarly, a protocol for quantum bit commitment, inspired by these oblivious transfer protocols, is described in [27] The resulting scheme also requires to rely temporarily on a different kind of bit commitment. The first approach that comes to mind to ....

Bennett, C. H., G. Brassard, C. Cr' epeau and M.--H. Skubiszewska, "Practical quantum oblivious transfer", Advances in Cryptology --- Proceedings of Crypto '91, August 1991, Springer -- Verlag, pp. 351 -- 366.

....neither parties can store photons for long periods of time and if only Von Neumann measurements are allowed. Alternatively, the first restriction may be dropped if we have a secure bit commitment protocol. A more robust version of this protocol that deals with transmission errors may be found in [2]. Mayers and Salvail [22] have later shown that the second restriction may be reduced to general measurements involving only one photon at a time, and finally Yao [30] showed that no restrictions on the type of measurements is necessary. Lately, Mayers [21] has shown a result similar to Yao s for ....

....later shown that the second restriction may be reduced to general measurements involving only one photon at a time, and finally Yao [30] showed that no restrictions on the type of measurements is necessary. Lately, Mayers [21] has shown a result similar to Yao s for the more robust protocol of [2]. Similarly, a new protocol for quantum bit commitment has been developed by Brassard and Cr epeau [6] in order to close the gap and obtain a secure one out of two Oblivious Transfer. Moreover, an extension due to Brassard, Cr epeau, Jozsa and Langlois of this protocol that deals with transmission ....

C. H. Bennett, G. Brassard, C. Cr'epeau and M.--H. Skubiszewska, "Practical quantum oblivious transfer", Advances in Cryptology: Crypto '91 Proceedings, Springer-Verlag, 1992, pp. 351 -- 366.

No context found.

C. H. Bennett, G. Brassard, C. Cr'epeau, and M.-H. Skubiszewska, "Practical quantum oblivious transfer," in Advances in Cryptology: Proceedings of Crypto '91, Lecture Notes in Computer Science, Vol. 576, p. 351-366. Springer-Verlag, 1992.

No context found.

Charles H. Bennett, Gilles Brassard, Claude Crepeau, and Marie-Helene Skubiszewska. Practical quantum oblivious transfer. In Proceedings of Advances in Cryptology - CRYPTO '91, volume 576 of LNCS, pages 351--366. Springer-Verlag, 1991.

No context found.

Charles H. Bennett, Gilles Brassard, Claude Crepeau, and MarieH elene Skubiszewska. Practical quantum oblivious transfer. In Proceedings of Advances in Cryptology - CRYPTO '91, volume 576 of LNCS, pages 351--366. Springer-Verlag, 1991.

No context found.

Bennett, C. H., G. Brassard, C. Cr epeau and M.-H. Skubiszewska, "Practical Quantum Oblivious Transfer", Advances in Cryptology : CRYPTO '91 : Proceedings, Lecture Notes in Computer Science, vol. 576, Springer-Verlag, August 1992, pp. 362 -- 371. 47

First 50 documents

Online articles have much greater impact   More about CiteSeer.IST   Add search form to your site   Submit documents   Feedback  

CiteSeer.IST - Copyright Penn State and NEC