Editing Quantum Oblivious Transfer (section)

==Protocol Description==

===Preparation phase===

# The receiver tells the sender the quantum efficiency <math>q</math> and the dark count rate <math>d</math> of his detectors.
# If satisfactory, the sender tells the receiver the value of <math>\mu</math>, <math>a</math>, <math>\epsilon</math> and <math>N</math>.
# Then they agree on a linear binary error-correcting code capable of correcting with very high probability N-bit words transmitted with expected error rate <math>\epsilon</math>.
# Finally, both the parties perform a test run.
## The sender sends pulses of intensity <math>\mu</math> in a prearranged sequence of polarizations.
## The receiver reads each pulse in the correct basis
## He then verifies if he can detect the pulses with probability greater than <math>a</math> and error rate less than <math>\epsilon</math>.

===Computation phase===

# The sender sends a random sequence of <math>2N/a</math> pulses in either of <math>\{|0\rangle, |1\rangle, |+\rangle, |-\rangle\}</math> states.
# The receiver obtains roughly <math>2N</math> pulses after measuring each of them randomly in the standard or the Hadamard basis. He records the basis and the measurement.
# He then reports to the sender the arrival times of all 2N pulses he received, but not the bases he used or his measurement results.
# The sender then tells the receiver the bases she used to send each of the pulses he received.
# The receiver creates two sets: a “good” set consisting of pulses he received in the correct basis, and a “bad” set consisting of pulses he received in the wrong basis.
# He tells the sender the addresses of the two sets without telling which is the good and which is the bad one.
# Now, the receiver shares with the sender a <math>N</math>-bit string corresponding to his good set and nothing with respect to his bad set of measurements.
# Using the error-correcting code, sender computes the syndromes of the words corresponding to each set, and she sends them to the receiver over an errorfree channel.
# The receiver recovers the original word corresponding to his good set and gets to know nohing about the bad set.
# The sender now computes the parity of a random subset of each set and tells the receiver the addresses defining these random subsets.
# The receiver knows one of these parities, indexed <math>\hat{c}</math>, and nothing about the other parity, and he knows which parity he knows.
# The sender knows both the parities <math>x_0</math> and <math>x_1</math>, but does not know which one the receiver knows.
# The receiver tells the sender whether or not <math>c = \hat{c}</math>.
# If <math>c = \hat{c}</math>, sender sends <math>x_0 \oplus b_0</math> and <math>x_1 \oplus b_1</math>, else, she sends <math>x_0 \oplus b_1</math> and <math>x_1 \oplus b_0</math>.
# From this, the receiver extracts <math>b_c</math>.