arXiv:quant-ph/0601157v1 23 Jan 2006
Oblivious Transfer and Quantum Channels
∗Group of Applied Physics, University of Geneva, 10, rue de l’´Ecole-de-M´ edecine, CH-1211 Gen` eve 4, Switzerland.
†H. H. Wills Physics Laboratory, University of Bristol, Tyndall Avenue, Bristol BS8 1TL, U.K.
‡Hewlett-Packard Laboratories, Stoke Gifford, Bristol BS12 6QZ, U.K.
§Computer Science Department, ETH Z¨ urich, ETH Zentrum, CH-8092 Z¨ urich, Switzerland.
J¨ urg Wullschleger§
Abstract—We show that oblivious transfer can be seen as the
classical analogue to a quantum channel in the same sense as
non-local boxes are for maximally entangled qubits.
A. Quantum Entanglement and Non-Locality
One of the most interesting and surprising consequences of
the laws of quantum physics is the phenomenon of entangle-
ment. In 1935, Einstein, Podolsky, and Rosen  initiated a
discussion on non-local behavior. Let us consider, for instance,
the following, maximally entangled state, called singlet or,
alternatively, EPR or Bell state:
√2(|01? − |10?) .
The state |ψ−? has the property that when the two qubits
are measured in the same basis, the measurements lead to per-
fectly anti-correlated results—even when the two measurement
events are spatially separated. The conclusion of  was that
quantum physics was incomplete in the sense that it should
be augmented by certain hidden parameters determining the
results of measurements. However, it was shown later by von
Neumann , Gleason , Specker , Jauch and Piron ,
Bell , and Kochen and Specker  that such hidden-
parameter models fail to explain quantum-physical behavior
The behavior of a bipartite quantum state under measure-
ments can be described by a conditional probability distri-
bution PXY |UV—also called two-party information-theoretic
primitive—where U and V denote the chosen bases and X
and Y the corresponding outcomes (see Figure 1).
Fig. 1.A two-party information-theoretic primitive.
Bell  was the first to recognize that there exist pairs
of measurement bases such that the resulting behavior is not
local, i.e., cannot be explained by shared classical information
(see Figure 2). He showed that there exist certain inequalities
(now called Bell inequalities) that cannot be violated by any
local system, but which are violated when an EPR pair is
Fig. 2.A local system.
The behavior of |ψ−? is, hence, non-local. It is important to
note that non-local behavior, although explainable classically
only by communication, does not allow for signaling. In
order to understand non-locality and its consequences better,
Popescu and Rohrlich  have introduced a “non-locality
machine,” called non-local box or NL box for short. The
behavior of the NL box is inspired by the one of |ψ−?, but it
is “more non-local” than the one of any quantum state. The
(binary) inputs and outputs of the NL box are (U,V ) and
(X,Y ), respectively, and X and Y are random bits satisfying
Prob[X = Y |(U,V ) ?= (1,1)]
Prob[X = Y |(U,V ) = (1,1)]
In other words, X and Y satisfy X ⊕ Y = U · V .
Using such NL boxes, we can understand Bell’s theorem in
very intuitive way, since the CHSH Bell inequality corresponds
to an upper bound on the success probability of simulating an
Let the inputs to the NL box be chosen at random. Let us
first look at the classical simulation of an NL box. It is easy to
see that a randomization of the strategies does not improve the
probability of a correct output. Therefore, both A and B just
have two values—one for input 0 and one for input 1—that
they will output. Since there is always a pair of inputs such
that the output of the two players is wrong, they can achieve
an accuracy of at most 0.75. If the players have access to an
EPR state |ψ−?, they can carry out measurements in bases that
are rotated with respect to each other by the angle of π/8, and
get an accuracy of
≈ 0.85 .
Furthermore, it has been shown that one call to an NL box
allows for perfectly simulating the joint behavior of a singlet
state under arbitrary von Neumann measurements . It is,
therefore, fair to say that the NL box is the classical analogue
of a Bell state.
B. Oblivious Transfer
Oblivious transfer, introduced by Wiesner  under the
name of “multiplexing” and by Rabin , is a primitive
of paramount importance in cryptography, in particular two-
and multi-party computation. In chosen 1-out-of-2 oblivious
has two binary inputs b0and b1, whereas the other party, the
receiver, inputs a choice bit c. The latter then learns bc but
no additional information, while the sender remains ignorant
?−OT for short, one party, called the sender,
Fig. 3. Chosen 1-out-of-2 oblivious transfer.
OT has been shown universal for multi-party computation,
i.e., any secure computation can be carried out if OT is
available. An example is secure function evaluation, which
is an important special case of multi-party computation, and
where a number of players want to secretly and correctly
evaluate a function to which each player holds an input; here,
“secretly” means that no (unnecessary) information about the
players’ inputs is revealed.
In this note, we are interested in OT from the viewpoint
of communication complexity rather than cryptography. In
particular, the described reductions are not cryptographic: a
party can obtain more information than specified.
In , it has been shown that
are roughly the same primitive in a cryptographic sense, i.e.,
one can be reduced to the other. An interesting and somewhat
surprising consequence thereof is that
NL box, is symmetric:?2
reduced to a single instance of?2
In terms of communication complexity, we have the fol-
of an NL box plus one bit of (classical) communication as
follows. Let (b0,b1) and c be the parties’ inputs for?2
Then they input b0⊕b1and c to the NL box, respectively, and
receive the outputs X and Y with X ⊕ Y = (b0⊕ b1)c. The
first party then sends X ⊕ b0to the other, who computes
(X ⊕ b0) ⊕ Y = b0⊕ (b0⊕ b1)c = bc,
?−OT and the NL box
?−OT, just as the
?−OT from A to B can be perfectly
?−OT from B to A .
?−OT can be reduced to one realization
If the inputs to the latter are u and v, then the parties input
(r,r ⊕ u) (where r is a random bit) and v to the
The sender’s output is then r, and the receiver’s output is his
r ⊕ (r ⊕ uv) = uv ,
?−OT can be used to realize an NL box.
?−OT, i.e., r ⊕ uv. We, hence, have for the
C. Classical Teleportation
Quantum teleportation  is the simulation of sending a
qubit over a quantum channel, using a shared EPR pair and two
bits of classical communication. Classical teleportation 
is the term used for the following reduction. Given a box
simulating the classical behavior of an EPR pair, e.g., a
singlet |ψ−?, and one bit of classical communication, one can
simulate sending a qubit over a quantum channel and carrying
out a von Neumann measurement on the received qubit. The
idea is as follows : Alice chooses, for her part of the EPR
pair, a measurement basis consisting of the state she wants
to send and its orthogonal complement, and communicates
the outcome to Bob, who inverts his measurement result if
and only if Alice has measured the state orthogonal to the
one to be sent. Together with the result that an NL box
allows for simulating the behavior of an EPR pair under
von Neumann measurements, this leads to a realization of
classical teleportation with one use of an NL box and one bit of
classical communication. When another—weaker—result, by
Bacon and Toner , is used stating that the EPR behavior
under projective measurements can be simulated using one bit
of communication, then one obtains the possibility of classical
teleportation using two bits of classical communication.
II. CONNECTION BETWEEN OBLIVIOUS TRANSFER AND
In this section we show that—instead of one NL box and
one classical bit of communication—one oblivious transfer
(and shared randomness) is enough to perfectly simulate a
quantum channel with a von Neumann measurement. Note
that our discussion in the previous section shows that this is
a strictly weaker primitive.
Furthermore, in the case of an NL box and EPR pairs, the
inverse is true as well, with identical success probabilities:
Using a quantum channel, one can simulate oblivious transfer
with a probability of about 0.85, whereas with a classical
channel one cannot be better than 0.75.
We can, therefore, conclude that oblivious transfer is the
classical analogue to a quantum channel, in the same way as
an NL box is for the EPR pair.
A. Simulating a Quantum Channel using Oblivious Transfer
The reduction of classical teleportation to?2
as follows. Let l1 and l2 be two random vectors on the
Poincar´ e sphere, and let l± := l1± l2. (These vectors are
the randomness shared by the two parties.) Let vA and vB
be the vectors determining the state Alice wants to send and
the measurement Bob wants to perform, respectively. Then the
the signum function.)
?−OT are as shown in Figure 4. (Here, sg denotes
sg(vB· l+) ⊕
Fig. 4. Reducing classical teleportation to oblivious transfer.
Bob’s output is the bit
z ⊕ sg(vB· l+) ⊕ 1 .
z = sg(vA·l1)⊕[sg(vA·l1)⊕sg(vA·l2)][sg(vB·l+)⊕sg(vB·l−)] .
Hence, we obtain the same expression as in  (see also ).
B. Simulating Oblivious Transfer using a Quantum Channel
Let now Alice and Bob be connected by a quantum channel
over which they are allowed to send exactly one qubit. They
want to simulate OT (with an error as small as possible) with
Alice as sender and Bob as receiver. Alice has inputs b0and
b1and Bob c, i.e., Bob wants to know bc. Alice takes a qubit
|φ? = |0? and rotates it by an angle of
8(2b0+ 4b1− 3) .
|φ? = cos(φ(b0,b1))|0? + sin(φ(b0,b1))|1?
and send |φ? to Bob. If c = 1, Bob applies a Hadamard
transform on |φ? and leaves it unchanged otherwise. He then
measures |φ? in the computational basis and outputs the
outcome of this measurement. It is easy to verify that his
output is equal to bcwith a probability of
which is the same as for the simulation of an NL box using
an EPR pair.
If Alice and Bob are only allowed to communicate one
classical bit, the best Alice can do is to choose one of the
two input bits and send it to Bob. Therefore, Bob will only be
able to output the correct value bcwith probability 0.75, if all
inputs are random. Again, we get the same success probability
as for the NL box without an EPR pair. Results related to ours
were obtained in .
≈ 0.85 ,
III. CONCLUDING REMARKS AND OPEN PROBLEMS
We have shown that bit oblivious transfer can be seen as the
classical analogue of sending a qubit over a quantum channel
in the same sense as the NL box is for measuring an EPR
Note that our simulation of a quantum channel does not
preserve privacy, i.e. the players get more information than
they would get if they had only black-box access to a quantum
channel. It is an open problem if there is an efficient simulation
that would also be private.
This work was supported by the Swiss National Science
 A. Ambainis, A. Nayak, A. Ta-Shma, and U. Vazirani, Dense Quan-
tum Coding and a Lower Bound for 1-way Quantum Automata,
 J. S. Bell, On the Einstein-Podolsky-Rosen paradox, Physics, Vol. 1,
pp. 195–200, 1964.
 C. H. Bennett, G. Brassard, C. Cr´ epeau, R. Jozsa, A. Peres, and W.
Wootters, Teleporting an unknown quantum state via dual classical and
EPR channels, Phys. Rev. Lett., Vol. 70, pp. 1895-1899, 1993.
 N. Cerf, N. Gisin, and S. Massar, Classical teleportation of a quantum
bit, Phys. Rev. Lett., Vol. 84, No. 11, 2000.
 N. Cerf, N. Gisin, S. Massar, and S. Popescu, Simulating maximal
quantum entanglement without communication, Phys. Rev. Lett., Vol.
94, 2005. See also quant-ph/0410027.
 A. Einstein, B. Podolsky, and N. Rosen, Can quantum-mechanical
description of physical reality be considered complete?, Phys. Rev., Vol.
 A. M. Gleason, Measures on the closed subspaces of a Hilbert space,
J. Math. Mech., Vol. 6, 885, 1957.
 J. M. Jauch and C. Piron, Can hidden variables be excluded in quantum
mechanics?, Helv. Phys. Acta, Vol. 36, 827, 1963.
 S. Kochen and E. Specker, The problem of hidden variables in quantum
mechanics, Journal of Mathematics and Mechanics, Vol. 17, No. 1,
 S. Popescu and D. Rohrlich, Causality and nonlocality as axioms for
quantum mechanics, quant-ph/9709026, 1997.
 M. Rabin, How to exchange secrets by oblivious transfer, Technical
Report TR-81, Harvard Aiken Computation Laboratory, 1981.
 E. Specker, Die Logik nicht gleichzeitig entscheidbarer Aussagen,
Dialectica, Vol. 14, pp. 239–246, 1960.
 B. Toner and D. Bacon, Communication cost of simulating Bell corre-
lations, Phys. Rev. Lett., Vol. 91, No. 18, 2003.
 W. van Dam, On quantum computation theory, Ph.D. thesis, University
of Oxford, 2000.
 J. von Neumann, Mathematische Grundlagen der Quanten-Mechanik,
Verlag Julius-Springer, Berlin, 1932. Mathematial Foundations of Quan-
tum Mechanics, Princeton University, Princeton, 1955.
 S. Wiesner, Conjugate coding, Sigact News, Vol. 15, No. 1, 1983.
 S. Wolf and J. Wullschleger, Oblivious transfer and quantum non-
locality, quant-ph/0502030, 2005.
 S. Wolf and J. Wullschleger, Oblivious transfer is symmetric,
http://ePrint.iacr.org 2004/336, 2004.