Editing Quantum Oblivious Transfer (section)

==Outline==

This section describes the quantum OT protocol [https://link.springer.com/chapter/10.1007/3-540-46766-1_29 Bennett et al.] under realistic experimental assumptions in two phases. The preparation phase, followed by the computation phase. 

===Preparation phase===

The protocol is adjusted to the physical limitations of the receiver's detection apparatus.

The receiver conveys to the sender the experimental imperfections of his detectors i.e. the quantum efficiency and dark count rate.

The sender conveys the intensity of the light pulses she will use which conveys the information about the fraction of sender's pulses that will be detected successfully by the receiver, and the bit error rate she will be willing to correct in his data to compensate for his dark counts and other noise sources in the detector.

The sender and receiver agree on the security parameter of the OT protocol and on the linear binary error-correcting code.

Finally, they perform a test run to verify that the receiver indeed detects the sender pulses with the said probability and error rate.

===Computation phase===

The sender sends a random sequence of highly attenuated coherent pulses of the four canonical polarizations from the standard basis and the Hadamard basis.

The receiver randomly decides for each pulse whether to measure it in the standard or the Hadamard basis, and records the basis and measurement results. The receiver then reports the arrival times of all pulses he received to the sender, but not the bases or the measurement results.

The sender then conveys to the receiver the bases measurement she used for each of the pulses received by the receiver. 

The receiver partitions his pulses into two sets: a “good” set consisting of pulses he received in the correct basis, and a “bad” set consisting of pulses he received in the incorrect basis.
He tells the sender the addresses of the two sets without telling which is the good and which is the bad one.
Now, the receiver shares with the sender a word corresponding to his good set of measurements; he shares nothing with her with respect to his bad set of measurements.
The sender does not know which word she shares with the receiver.

Using the error-correcting code, sender computes the syndromes of the words corresponding to each set, and she sends them to the receiver over an error free channel.
Given this data, the receiver is able to recover the original word corresponding to his good set but not that corresponding to his bad set.
Furthermore, the sender computes the parity of a random subset of each set, and tells the receiver the addresses defining these random subsets, but not the resulting parities.
At this point, the receiver knows one of these parities exactly, and nothing about the other parity, and he knows which parity he knows.
The sender knows both parities, but she does not know which one the receiver knows.

The receiver tells the sender whether the index of the parity he knows and the index of the bit he wishes to know are equal.
If they are equal, sender gives the xor of same indexed bit and the parity, otherwise she gives him the xor of opposite indexed bit and the parity.
From this, the receiver extracts the desired bit.