Garbled Quantum Computation

Abstract

The universal blind quantum computation protocol (UBQC) enables an almost classical client to delegate a quantum computation to an untrusted quantum server (in the form of a garbled quantum circuit) while the security for the client is unconditional. In this contribution, we explore the possibility of extending the verifiable UBQC, to achieve further functionalities following the analogous research for classical circuits (Yao 1986). First, exploring the asymmetric nature of UBQC (the client preparing only single qubits, while the server runs the entire quantum computation), we present a “Yao”-type protocol for secure two-party quantum computation. Similar to the classical setting, our quantum Yao protocol is secure against a specious (quantum honest-but-curious) garbler, but in our case, against a (fully) malicious evaluator. Unlike the previous work on quantum two-party computation of Dupuis et al., 2010, we do not require any online-quantum communication between the garbler and the evaluator and, thus, no extra cryptographic primitive. This feature will allow us to construct a simple universal one-time compiler for any quantum computation using one-time memory, in a similar way to the classical work of Goldwasser et al., 2008, while more efficiently than the previous work of Broadbent et al., 2013.

1. Introduction

Future information and communication networks will consist of both classical and quantum devices, some of which are expected to be dishonest. These devices will have various different functionalities, ranging from simple routers to servers executing quantum algorithms. Within the last few years, anticipating this development has led to the formation and growth of the field of delegated quantum computing [1,2,3,4,5,6]. Among them is the universal blind quantum computation (UBQC) protocol of [3], which is developed based on the measurement-based quantum computation model (MBQC) [7] that appears as the most promising physical implementation for a networked architecture [8]. In the UBQC framework, the only quantum requirement for the client is the offline creation of random single qubit states, which is a currently available technology and has been demonstrated experimentally [9].

The MBQC model of computation can be viewed as a set of classical instructions steering a quantum computation performed on a highly entangled quantum state. The classical outcomes of the single-system measurements that occur during the computation are in general randomly distributed bits with no significance for the final output of the computation. This enables one to use relatively basic obfuscation techniques in order to prevent an untrusted operator (that implements an MBQC computation) from obtaining access to the true flow of information. This key observation has led to an entirely new approach to quantum verification that exploits cryptographic techniques [4,5,10,11,12,13,14,15,16,17]. The core idea is to encode simple trap computations within a target computation that is run on a remote device. This is done in such a way that the computation is not affected while, at the same time, revealing no information to the server. The correctness of the overall computation is tested by verifying that the trap computations were done correctly. The latter, being significantly less costly, leads to efficient verification schemes. This approach of quantum verification has been recently used to obtain specific cryptographic primitives, such as quantum one-time program [6] and secure two-party quantum computation [18], which are also the main focus of this paper.

1.1. Our Contribution

We will explore two extensions of the verifiable universal blind quantum computing (VUBQC) protocols, which are built based on measurement-based quantum computation, in order to achieve new functionalities to be implemented in the quantum network setting [8]. The essential novelty of our approach is that the client-server setting allows different participants to have different quantum technological requirements. As a result, in our proposed two-party primitives, one party (garbler or sender) remains as classical as possible (with no need for quantum memory), while it is only the other party (evaluator or receiver) that requires access to a quantum computer. Moreover, the required offline initial quantum communication between the participants is also limited to the exchange of simple single quantum states that can be generated, for example, in any quantum key distribution network (as was proven recently in [19]). Finally, all of the utilised sub-protocols in our schemes could be reduced to the core protocols of offline preparation [19] and verifiable universal blind quantum computation [10,14] that are both proven to be composably secure in the abstract cryptography framework of [20]. For simplicity, we only present the stand-alone security proof for our protocols as we follow the framework of [21] and use simulation-based techniques. We present two new protocols:

• In Section 3, we present a protocol for secure two-party quantum computation that we refer to as QYao. This protocol involves two parties with asymmetric roles that wish to securely compute any given unitary on a joint quantum input. Similar to the classical protocol of [22], in QYao, an honest-but-curious (formally defined for the quantum setting in [21]) client capable of preparing only random single qubit and performing constant depth classical computation “garbles” the entire unitary. The fully-malicious server/evaluator receives instructions from the garbler and inserts their input either using a (classical) oblivious transfer (OT) or by a quantum input insertion scheme secure against the honest-but-curious garbler. The evaluator performs the computation, extracts its own output qubits and returns the remaining output qubits to the garbler. After the garbler verifies the computation, the encryption keys of the evaluator output qubits are released. Unlike the classical setting, our proposed QYao protocol is interactive, but importantly, only classical online communication is required. The gain we have, on the other hand, is the boosted security since apart from the initial input exchange where classical OT is needed, the rest of the protocol is unconditionally secure. If one could replace the classical OT’s in our QYao protocol with new primitives, such as the unconditionally secure relativistic primitives [23], the security would be extended to fully unconditional. In Section 4, we prove the security of the protocol in the ideal real-world paradigm using a simulation-based technique.
• In Section 5, we follow the classical approach of [24] and make our QYao protocol non-interactive by using the classical hardware primitive “one-time memory” (OTM), which is essentially a non-interactive oblivious transfer. Using OTM, the need for initial OT calls, in our QYao protocol, is also removed, leading to a one-time universal compiler for any given quantum computation. Such one-time quantum programs can be executed only once, where the input can be chosen at any time. The one-time programs have a wide range of applications ranging from program obfuscation, software protection to temporary transfer of cryptographic ability [24]. Classically, the challenge in lifting the Yao protocol for two-party computation to a one-time program is addressing the issue of a malicious adversary. However, our QYao protocol is already secure against a malicious evaluator without any extra primitive or added overhead. Our quantum one-time program is therefore a straightforward translation of QYao. The same technique is applicable to essentially any cryptographic protocols developed in the measurement-based model that require offline quantum preparation and online classical communications. In any such MBQC computation, there are exponentially many branches of computation (this expansion is the result of the non-deterministic nature of the intermediate single-qubits measurement that occurs during the computation); however, we prove that a single OTM (of constant size) per computation qubit suffices to make the QYao non-interactive. This is due to the fact that in any constant degree graph-state (the underlying entanglement resources for an MBQC computation), the flow of information acts locally. We prove that this is the case for the required entangled recourse in the verifiable UBQC introduced in [25] that is the basis of our QYao protocol. Hence, each classical message between parties, in the interactive case, depends only on the constant number of previous messages, and this allows us to remove this interaction using a simple constant-size OTM.

1.2. Related Works

Deriving new quantum cryptographic protocols for functionalities beyond the secure key exchange [26] is an active field of research (see a recent review for a summary [27]). In particular, our contributions are directly linked to the works on verifiable blind quantum computing (VUBQC) [4,5,10], secure two-party quantum computing [18,21] and quantum one-time program and quantum obfuscation [6,28]. The main focus in VUBQC research is the ability of a limited verifier to certify the correctness of the quantum computation performed by a remote server. Recently, many such protocols have been developed achieving different quantum technological requirement for the verifier or the prover [11,13,15,16,29]. We have used the optimal (from the verifier’s point of view) VUBQC that has the additional property of a local and independent trap construction [25]. This property allows us to construct a simple yet generic scheme for the server (receiver, evaluator) input insertion and output extraction that could be applicable to other VUBQC schemes and that might lead to further properties not present in the scheme of [25].

Due to the impossibility results of [6,28], having extra primitives such as OTM is unavoidable in order to achieve program hiding. However, using the MBQC framework with the verification protocol of [25] leads to a simpler procedure for removing the classical interaction compared to the initial work that pioneered this approach [6]. Furthermore, due to the direct utilisation of OTMs instead of classical one-time programs, our scheme could be applicable to other VUBQC protocols that might emerge in the future. Another way of making protocols non-interactive is based on the security of other classical primitives, as was done in [30] using fully-homomorphic encryption. However, to apply this method for non-interactive secure two-party quantum computation, it is important to enable verifiability from the side of the sender, something naturally present in our scheme, but not necessarily in other schemes. Finally, the VUBQC framework, which naturally separates the classical and quantum part of the computation, allows us to construct a client-server scheme for secure two-party quantum computation that unlike the work of [21] removes the requirement of any extra cryptographic primitive, which was an open question in [21]. Here, we need to clarify that, while in the classical Yao with an honest-but-curious garbler the primitive of OT is required for the evaluator’s input insertion, in our QYao, this is not the case. This is simply due to the fact that the notion of the quantum specious adversary that was formalised in [21] is more restrictive than classical honest-but-curious in certain cases (see Appendix B). Hence, instead of utilising a classical OT, one could simply devise a quantum communication scheme, as we present here, in order to achieve the same goal of secure input insertion against a (less powerful) adversarial garbler.

Another related issue is that the server-client setting can also be exploited to achieve simpler (implementation-wise) multiparty blind quantum computation protocols, where multiple clients use a single server to jointly and securely perform a quantum computation [31].

Finally, an interesting future direction is to try to view secure two-party quantum computation (2PQC) as a quantum game. The link of classical SMPCand game theory has been analysed, for example, in connection with the issue of fairness and rational players [32,33]. Moreover, the quantum settings with multiple parties having competing interests has also been considered in a game-theoretic way (e.g., [34] and recently [35]), which leads to the question of using these techniques in the 2PQC case.

2. Preliminaries

2.1. Verifiable Universal Blind Quantum Computation

We will assume that the reader is familiar with the measurement-based quantum computation (MBQC) model [7] that is known to be the same as any gate teleportation model [36,37]. In this section, we introduce MBQC and use it to revise a blind quantum computation (the server performs computation without learning input/output or computation) [3] and a verifiable blind quantum computation (the client can also verify that the computation was performed correctly) [10] protocols. The general idea behind the MBQC model is: start with a large and highly entangled generic multiparty state (the resource state), and then, perform the computation by carrying out single-qubit measurements. To perform a desired quantum computation, each qubit should be measured in a suitable basis, and this basis is (partly) determined by some default measurement angles ${\varphi }_i$. There is an order in which the measurements should occur, which is determined by the flow of the computation (see also later), and the basis by which each qubit is measured generally depends on the outcomes of previous measurements (and the default measurement angle ${\varphi }_i$). The resource states used are known as graph states, as they can be fully determined by a given graph (see the details in [38]). A way to construct a graph state given the graph description is by assigning to each vertex of the graph a qubit initially prepared in the state $\left|+\right.〉$ and for each edge of the graph to perform a $\mathrm{controlled}-Z$ gate for the two adjacent vertices. For completeness, in Appendix A, we give the expression for the measurement angles of each qubit and an example of measurement pattern (graph state and default measurement angles ${\varphi }_i$) that implements each gate from a universal set of gates.

If one starts with a graph state where qubits are prepared in a rotated basis $\left|{+}_{\theta }\right.〉=1/\sqrt{2}(\left|0\right.〉+e^{i\theta }\left|1\right.〉)$ instead, then it is possible to perform the same computation with the non-rotated graph state by preforming measurements in a similarly rotated basis. This observation led to the formulation of the universal blind quantum computation (UBQC) protocol [3], which hides the computation in a client-server setting. Here, a client prepares rotated qubits, where the rotation is only known to them. The client sends the qubits to the server, as soon as they are prepared (hence, there is no need for any quantum memory). Finally, the client instructs the server to perform entangling operations according to the graph and to carry out single qubit measurements in suitable angles in order to complete the desired computation (where an extra randomisation $r_i$ of the outcome of the measurements is added). During the protocol, the client receives the outcomes of previous measurements and can classically evaluate the next measurement angles. Due to the unknown rotation and the extra outcome randomisation, the server does not learn what computation they actually perform.

The UBQC protocol can be uplifted to a verification protocol where the client can detect a cheating server. To do so, the client for certain vertices (called dummies) sends states from the set $\{\left|0\right.〉,\left|1\right.〉\}$, which has the same effect as a Z-basis measurement on that vertex. In any graph state, if a vertex is measured in the Z-basis, it results in a new graph where that vertex and all of its adjacent edges are removed. During the protocol, the server does not know for a particular vertex if the client sent a dummy qubit (i.e., a qubit from $\{\left|0\right.〉,\left|1\right.〉\}$) or not. This enables the client to isolate some qubits (disentangled from the rest of the graph). Those qubits have fixed deterministic outcomes if the server followed the instructions honestly. The positions of those isolated qubits are unknown to the server, and the client uses them as traps to test that the server performs the quantum operations that are requested. This technique led to the first universal VUBQC protocol [10] and was subsequently extended to many other protocols depending on what optimised construction was used, what was the required quantum technology and which was the desired level of security. It is clear that the more (independent) traps we have within a graph, the higher the probability of detecting a deviation. In [25], we gave a construction that, while maintaining an overhead that is linear in the size of the computation, introduced multiple traps and in particular of the same number as the computation qubits. We will be using that construction, not only for efficiency reasons, but because this construction is “local”, and revealing to the server partial information about the graph does not compromise the security. This is important for our QYao protocol since, in this case, the server has the input and output and needs to know in which parts of the graph their input/output belongs. The construction is summarised below:

• We are given a base-graph G that has vertices $v\in V\left(G\right)$ and edges $e\in E\left(G\right)$.
• For each vertex $v_i$, we define a set of three new vertices $P_{v_i}=\{p_1^{v_i},p_3^{v_i},p_3^{v_i}\}$. These are called primary vertices.
• Corresponding to each edge $e(v_i,v_j)\in E\left(G\right)$ of the base-graph that connects the base vertices $v_i$ and $v_j$, we introduce a set of nine edges $E_{e(v_i,v_j)}$ that connect each of the vertices in the set $P_{v_i}$ with each of the vertices in the set $P_{v_j}$.
• We replace every edge in the resulted graph with a new vertex connected to the two vertices originally joined by that edge. The new vertices added in this step are called added vertices. This is the dotted triple-graph $DT\left(G\right)$.

We can see (Figure 1) that each vertex in the $DT\left(G\right)$ corresponds to either a vertex (for primary vertices) or an edge (for added vertices) of the base-graph. The precise edge/vertex of the base-graph to which each vertex $v\in DT\left(G\right)$ belongs is called base-location. The nice property of this graph is that one can reduce this graph to three copies of the base-graph by “breaking” some edges (which can be done using dummy qubits). Moreover, the choice of which vertex belongs to each of the three graphs is essentially independent (for different base-locations corresponding to vertices of the base-graph). With this construction we can eventually use one copy of the base-graph for the computation, while make multiple single traps from the two remaining copies (see Figure 1). The choice of which vertex belongs to which graph is called trap-colouring. This is a free choice made by the client, and the fact that the server is ignorant of the actual trap-colouring guarantees the security (see the details in [25]).

Definition 1 (Trap-colouring).

We define trap-colouring to be an assignment of one colour to each of the vertices of the dotted triple-graph that is consistent with the following conditions.

(i) 

Primary vertices are coloured in one of the three colours, white or black (for traps) and green (for computation). There is an exception for input base-locations (see Step (v)).

(ii) 

Added vertices are coloured in one of the four colours white, black, green or red.

(iii) 

In each primary set $P_v$, there is exactly one vertex of each colour.

(iv) 

Colouring the primary vertices fixes the colours of the added vertices: added vertices that connect primary vertices of different colour are red; added vertices that connect primary vertices of the same colour get that colour.

(v) 

For input base-locations, instead of green, we have a blue vertex (but all other rules, including how to connect with the other vertices, apply in the same way as if it were green).

For completeness, we give the basic verification protocol from [25] that we use.

Protocol 1 Verifiable universal blind quantum computation using the dotted triple graph (with fault-tolerant encoding); taken from [25].

We assume that a standard labelling of the vertices of the dotted triple-graph $DT\left(G\right)$, is known to both the client and the server. The number of qubits is at most $3N(3c+1)$ where c is the maximum degree of the base graph G. • Client’s resources – Client is given a base graph G. The corresponding dotted graph state $\left|D\left(G\right)\right.〉$ is generated by graph $D\left(G\right)$ that is obtained from G by replacing every edge with a new vertex connected to the two vertices originally joined by that edge. – Client is given an MBQC measurement pattern ${\mathbb{M}}_{\mathrm{Comp}}$ which: Applied on the dotted graph state $\left|D\left(G\right)\right.〉$ performs the desired computation, in a fault-tolerant way, that can detect or correct errors fewer than $\delta /2$. – Client generates the dotted triple-graph $DT\left(G\right)$, and selects a trap-colouring according to Definition 1 which is done by choosing independently the colours for each set $P_v$. – Client for all red vertices will send dummy qubits and thus performs break operation. – Client chooses the green graph to perform the computation. – Client for the white graph sends dummy qubits for all added qubits $a_w^e$ and thus generates white isolated qubits at each primary vertex set $P_v$. Similarly for the black graph the client sends dummy qubits for the primary qubits $p_b^v$ and thus generates black isolated qubits at each added vertex set $A_e$. – The dummy qubits position set D is chosen as defined above (fixed by the trap-colouring). – A binary string $\mathbf{s}$ of length at most $3N(3c+1)$ represents the measurement outcomes. It is initially set to all zero’s. – A sequence of measurement angles, $\varphi ={\left({\varphi }_i\right)}_{1\le i\le 3N(3c+1)}$ with ${\varphi }_i\in A=\{0,\pi /4,\cdots ,7\pi /4\}$, consistent with ${\mathbb{M}}_{\mathrm{Comp}}$. We define ${\varphi }_i^{\prime }({\varphi }_i,\mathbf{s})$ to be the measurement angle in MBQC, when corrections due to previous measurement outcomes $\mathbf{s}$ are taken into account (the function depends on the specific base-graph and its flow, see e.g., [3]). We also set ${\varphi }_i^{\prime }=0$ for all of the trap and dummy qubits. The Client chooses a measurement order on the dotted base-graph $D\left(G\right)$ that is consistent with the flow of the computation (this is known to Server). The measurements within each set $P_v,A_e$ of $DT\left(G\right)$ graph are ordered randomly. – $3N(3c+1)$ random variables ${\theta }_i$ with value taken uniformly at random from A. – $3N(3c+1)$ random variables $r_i$ and $\left|D\right|$ random variable $d_i$ with values taken uniformly at random from $\{0,1\}$. – A fixed function $C(i,{\varphi }_i,{\theta }_i,r_i,\mathbf{s})={\varphi }_i^{\prime }({\varphi }_i,\mathbf{s})+{\theta }_i+\pi r_i$ that for each non-output qubit i computes the angle of the measurement of qubit i to be sent to the Server. • Initial Step – Client’s move: Client sets all of the values in $\mathbf{s}$ to be 0 and prepares the input qubits as $$\begin{array}{c}\left|e\right.〉=X^{x_1}Z\left({\theta }_1\right)\otimes \dots \otimes X^{x_l}Z\left({\theta }_l\right)\left|I\right.〉\hfill \end{array}$$ and the remaining qubits in the following form $$\begin{array}{ccc}\forall i\in D\hfill & \hfill & \left|d_i\right.〉\hfill \\ \forall i\notin D\hfill & \hfill & \prod _{j\in N_G\left(i\right)\cap D}{Z}^{d_j}\left|{+}_{{\theta }_i}\right.〉\hfill \end{array}$$ and sends the Server all of the $3N(3c+1)$ qubits in the order of the labelling of the vertices of the graph. – Server’s move: Server receives $3N(3c+1)$ single qubits and entangles them according to $DT\left(G\right)$. – Continues to Protocol 2

Protocol 2 Continuing from Protocol 1: VUBQC with DT(G).

• Step $i:1\le i\le 3N(3c+1)$ – Client’s move: Client computes the angle ${\delta }_i=C(i,{\varphi }_i,{\theta }_i,r_i,\mathbf{s})$ and sends it to the Server. – Server’s move: Server measures qubit i with angle ${\delta }_i$ and sends the Client the result $b_i$. – Client’s move: Client sets the value of $s_i$ in $\mathbf{s}$ to be $b_i+r_i$. • Final Step: – Server’s move: Server returns the last layer of qubits (output layer) to the Client. • Verification – After obtaining the output qubits from the Server, the Client measures the output trap qubits with angle ${\delta }_t={\theta }_t+r_t\pi$ to obtain $b_t$. – Client accepts if $b_i=r_i$ for all of the white (primary) and black (added) trap qubits i.

2.2. Two-Party Quantum Protocols

The impossibility of achieving unconditionally secure two-party cryptographic protocols has led to the definition and use of simpler hardware or software primitives to form the basis for the desired functionalities. A one out of n oblivious transfer (OT) is a two-party protocol where one party (Alice) has input n messages $(x_1,\cdots ,x_n)$ and the other party (Bob) inputs a number $c\in \{1,\cdots ,n\}$ and receives the message $x_c$ with the following guarantees: Bob learns nothing about the other messages $x_i|i\ne c$, and Alice is “oblivious” (does not know) about which message Bob obtained (i.e., does not know the value c) [39]. A hardware token that implements a non-interactive OT is called one-time memory (OTM) [24]. We will utilise a one out of n OTM, where again Alice stores in the OTM n strings $(x_1,\cdots ,x_n)$, Bob specifies a value c and the OTM reveals $x_c$ to Bob and then self-destructs; i.e., the remaining strings $x_i|i\ne c$ are lost forever.

The first paper that studied secure two-party quantum computation is [21], and we follow their notations and conventions. We have two parties $A,B$ with registers $\mathcal{A},\mathcal{B}$ and an extra register $\mathcal{R}$ with $dim\mathcal{R}=(dim\mathcal{A}+dim\mathcal{B})$. The input state is denoted ${\rho }_{in}\in D(\mathcal{A}\otimes \mathcal{B}\otimes \mathcal{R})$, where $D\left(\mathcal{A}\right)$ is the set of all possible quantum states in register $\mathcal{A}$. We also denote with $L\left(\mathcal{A}\right)$ the set of linear mappings from $\mathcal{A}$ to itself, and the superoperator $\varphi :L\left(\mathcal{A}\right)\to L\left(\mathcal{B}\right)$ that is completely positive and trace preserving is called a quantum operation. We denote ${\mathbb{I}}_{\mathcal{A}}$ the identity operator in register $\mathcal{A}$. The ideal output is then given by ${\rho }_{out}=(U\otimes {\mathbb{I}}_{\mathcal{R}})·{\rho }_{in}$, where for simplicity, we write $U·\rho$ instead of $U\rho U^{†}$. For two states ${\rho }_0,{\rho }_1$, we denote the trace norm distance $\Delta ({\rho }_0,{\rho }_1):=\frac{1}{2}\parallel {\rho }_0-{\rho }_1\parallel$. If $\Delta ({\rho }_0,{\rho }_1)\le ϵ$, then any process applied on ${\rho }_0$ behaves as for ${\rho }_1$, except with probability at most $ϵ$.

Definition 2

(Taken from [21]). An n-step two-party strategy with oracle calls is denoted ${\Pi }^O=(A,B,O,n)$:

1. 

input spaces ${\mathcal{A}}_0,{\mathcal{B}}_0$ and memory spaces ${\mathcal{A}}_1,\cdots ,{\mathcal{A}}_n$ and ${\mathcal{B}}_1,\cdots ,{\mathcal{B}}_n$

2. 

n-tuple of quantum operations $(L_1^A,\cdots ,L_n^A)$ and $(L_1^B,\cdots ,L_n^B)$ such that $L_i^A:L\left({\mathcal{A}}_{i-1}\right)\to L\left({\mathcal{A}}_i\right)$ and similarly for $L_i^B$.

3. 

n-tuple of oracle operations $({\mathcal{O}}_1,\cdots ,{\mathcal{O}}_n)$ where each oracle is a global operation for that step, ${\mathcal{O}}_i:L({\mathcal{A}}_i\otimes {\mathcal{B}}_i)\to L({\mathcal{A}}_i\otimes {\mathcal{B}}_i)$

The trivial oracle is a communication oracle that transfers some quantum register from one party to another. Protocols that have only such oracles are called the bare model. Other oracles include calls to other cryptographic primitives. The quantum state in each step of the protocol is given by:

$$\begin{array}{ccc}\hfill {\rho }_1\left({\rho }_{in}\right)& :=& ({\mathcal{O}}_1\otimes \mathbb{I})(L_1^A\otimes L_1^B\otimes \mathbb{I})\left({\rho }_{in}\right)\hfill \\ \hfill {\rho }_{i+1}\left({\rho }_{in}\right)& :=& ({\mathcal{O}}_{i+1}\otimes \mathbb{I})(L_{i+1}^A\otimes L_{i+1}^B\otimes \mathbb{I})\left({\rho }_i\left({\rho }_{in}\right)\right)\hfill \end{array}$$

(1)

The security definitions are based on the ideal functionality of two-party quantum computation (2PQC) that takes a joint input ${\rho }_{in}\in {\mathcal{A}}_0\otimes {\mathcal{B}}_0$, obtains the state $U·{\rho }_{in}$ and returns to each party their corresponding quantum registers. A protocol ${\Pi }_U^O$ implements the protocol securely, if no possible adversary in any step of the protocol can distinguish whether they interact with the real protocol or with a simulator that has only access to the ideal functionality. When a party is malicious, we add the notation “∼”, e.g., $\tilde{A}$.

Definition 3 (Simulator).

$\mathcal{S}\left(\tilde{A}\right)=\langle ({\mathcal{S}}_1,\cdots ,{\mathcal{S}}_n),q\rangle$ is a simulator for adversary $\tilde{A}$ in ${\Pi }_U^O$ if it consists of:

1. 

operations where ${\mathcal{S}}_i:L\left({\mathcal{A}}_0\right)\to L\left(\widetilde{{\mathcal{A}}_i}\right)$,

2. 

sequence of bits $q\in {\{0,1\}}^n$ determining if the simulator calls the ideal functionality at step i ($q_i=1$ calls the ideal functionality).

For other adversaries, the simulator is defined analogously.

Given input ${\rho }_{in}$, the simulated view for step i is defined as:

$$\begin{array}{c}\hfill {\nu }_i(\tilde{A},{\rho }_{in}):={\mathrm{Tr}}_{{\mathcal{B}}_0}\left(({\mathcal{T}}_i\otimes \mathbb{I})(U^{q_i}\otimes \mathbb{I})·{\rho }_{in}\right)\end{array}$$

(2)

and similarly for the other party.

Definition 4 (Privacy).

We say that the protocol is δ-private if for all adversaries and for all steps i:

$$\begin{array}{c}\hfill \Delta ({\nu }_i(\tilde{A},{\rho }_{in}),{\mathrm{Tr}}_{{\mathcal{B}}_i}\left({\tilde{\rho }}_i(\tilde{A},{\rho }_{in})\right))\le \delta \end{array}$$

(3)

where ${\tilde{\rho }}_i(\tilde{A},{\rho }_{in})$ the state of the real protocol with corrupted party $\tilde{A}$, at step i.

In classical cryptography, a type of adversary commonly considered is the “honest-but-curious”. This adversary follows the protocol, but also keeps records of its actions and attempts to learn from those more than what it should. This type of weak adversary has been proven very useful in many protocols, since it typically constitutes the first step in constructing protocols secure against more powerful (even fully malicious) adversaries.

Since quantum states cannot be copied, one cannot have a direct analogue of honest-but-curious. Instead, we have the notion of specious adversaries [21], where they can deviate as they wish, but in every step, if requested, should be able to reproduce the honest global state by acting only on their subsystems. More formally:

Definition 5 (Specious).

An adversary $\tilde{A}$ is ϵ-specious if there exists a sequence of operations $({\mathcal{T}}_1,\cdots ,{\mathcal{T}}_n)$, where ${\mathcal{T}}_i:L\left({\tilde{\mathcal{A}}}_i\right)\to L\left({\mathcal{A}}_i\right)$, such that:

$$\begin{array}{c}\hfill \Delta \left(({\mathcal{T}}_i\otimes \mathbb{I})\left({\tilde{\rho }}_i(\tilde{A},{\rho }_{in})\right),{\rho }_i\left({\rho }_{in}\right)\right)\le ϵ\end{array}$$

(4)

Note that this (standard) definition of specious adversary allows for different interpretations that lead to stronger and weaker versions of the adversary. These subtleties are explained in Appendix B. Here, we stress that we take the weaker notion that takes Equation (4) in the stricter sense, while in [21], the authors implicitly used a stronger version. This difference led to our paper evading certain impossibility results mentioned in [21]. A detailed discussion of this is given in Appendix B.

A 2PQC protocol needs to be (by definition) private. Moreover, it may have two extra properties, verification and fairness. Verification means that each party, when they receive their output, not only is sure that nothing leaked about its input, but also it can know whether the outcome it received is correct or corrupted. Fairness is the extra property that no party should be able to obtain its output and after that cause an abort (or a corruption) for the other party. Even in classical 2PC, it is impossible to have fairness against fully-malicious adversaries (without any extra assumption). We consider two-party protocols ${\Pi }^0=(C,S,O,n)$ where C denotes the client and S the server.

3. Secure Two-Party Quantum Computation

The first extension of VUBQC that we will explore refers to its use in order to construct a 2PQC protocol similar to the classical Yao protocol of [22]. We refer to this protocol as QYao, where the sender-garbler is called the client and the receiver-evaluator is called the server. As in the Yao protocol, we assume that the client, when adversarial, is specious; however, we make no such assumption for the server, which is assumed to be fully malicious. In [22], the server needs to use OT in order to insert its input. We, instead, use a scheme to insert the quantum input that requires no such functionality. This is possible because we make the assumption that the client is specious, and in specific situations, a specious adversary is weaker than honest-but-curious (see Appendix B.1). For the specific case of classical input/output, one can modify our protocol to make it secure against the classical honest-but-curious adversary by replacing the input injection subprotocol (see below) with OT.

Our QYao protocol provides a one-time verifiable 2PQC similar to the classical setting as recently shown for the original Yao protocol in [40]. The speciousness of the client restricts any possible deviations on their side, while a malicious server would be detected through the hidden traps of the VUBQC protocol. The blindness property of VUBQC also guarantees that the server learns nothing before the client is certain that there was no deviation and returns the suitable keys for the decryption of the output.

The major difference that the QYao protocol has in comparison with regular VUBQC [25] is that the server needs to provide (part of) the input and at the end keeps (part of) the output. There are multiple ways to modify the VUBQC protocol; we use a direct approach at the cost of having two rounds of quantum communication during input preparation and two rounds of quantum communication during output read-out. However, there is no quantum communication during the evaluation stage. Note that if we restrict the protocol to classical input/output, we would avoid all quantum communication apart from the initial and offline sending of pre-rotated qubits from the client to the server (but we would then need OT, as in the classical Yao, for the server to insert its input).

3.1. Server’s Input Injection

The qubits composing the DT(G)(see Figure 1) are prepared by the client. This is crucial in order to ensure that the server is blind about the positions of the traps. However, the server should somehow insert their input in the DT(G). For simplicity, we present here the case that there is a single qubit input, but it generalises trivially. To do so, the server encrypts its input using secret keys $(m_{z,i},m_{x,i})$ and sends the state $X^{m_{x,i}}{Z}^{m_{z,i}}\left|{\mathsf{\Phi }}_S\right.〉$ to the client, to insert it randomly in the corresponding base-location. The state $\left|{\mathsf{\Phi }}_S\right.〉$ is assumed to be pure as we have included its purification in the hands of the server. The client encrypts further the server’s input by applying an extra random $Z\left({\theta }_i^{\prime }\right)$ and an $X^{x_i^{\prime }}$ correction to obtain the state:

$$\begin{array}{c}\hfill X^{x_i^{\prime }}Z\left({\theta }_i^{\prime }\right)X^{m_{x,i}}{Z}^{m_{z,i}}\left|{\mathsf{\Phi }}_S\right.〉\end{array}$$

(5)

This extra encryption is needed in order to hide the future actual measurement of the input qubit (to be performed by the server) and ensure that no information about the position of the traps is leaked. Trap hiding also requires the client to return two extra qubits for the input insertion (see Figure 2) that will belong to trap graphs (called the white-graph and black-graph). The white qubit (which is a trap qubit) is prepared in a state $\left|{\theta }_k\right.〉$, while the black qubit (which is a dummy qubit) is prepared in state $\left|d_j\right.〉$. The three qubits will be randomly permuted by the client so that the server does not know which qubit is which. A similar procedure (with no communication from the server) is applied for client’s input qubits, as well as for all of the qubits corresponding to the gate computation (see Figure 2).

Finally, after the server has received all of the qubits, he/she announces the secret keys $(m_{x,i},m_{z,i})$ for each input i to the client, so that the client can update the encryption for these qubits and have $(x_i,{\theta }_i):=\left(x_i^{\prime }+m_{x,i},{(-1)}^{m_{x,i}}{\theta }_i^{\prime }+\pi m_{z,i}\right)$. With the updated encryption, the client computes the suitable measurement angles ${\delta }_i$. It is worth pointing out that the key releasing step from server to client could be avoided by using classical OT to compute the measurement angles as a function of the secret parameters of the server ${\delta }_i(m_{x,i},m_{z,i})$ for the first two layers (that have dependency on $m_{x,i},m_{z,i}$). To construct protocols dealing with a malicious client, the use of OTs may be necessary. For our case, however, the client is (weak) specious, and using OTs is not necessary.

3.2. Server’s Output Extraction

In the standard VUBQC protocol, the server returns all of the output qubits to the client. The client measures the final layer’s traps to check for any deviation and then obtains the output of the computation by decrypting the output computation qubits using their secret keys. In the 2PQC, part of the output (of known base-locations) should remain in the hands of the server. This, however, would not allow the client to check for the related traps (that could have effects on other output qubits). Similar to the input injection, the solution is obtained via an extra layer of encryption by the server followed by a delayed key releasing. The server will encrypt using two classical bits $(k_x,k_z)$: $E_k\left(\left|\psi \right.〉\right)=X^{k_x}{Z}^{k_z}\left|\psi \right.〉$, all of the output qubits that correspond to the server’s output base-locations and then return all of the output qubits to the client. Due to the encryption, the client obtains no information about the output of the server, while it now has access to all of the final trap qubits for the verification. The client returns to the server only the computation qubits corresponding to the server’s output base-locations, while keeping the traps and all of the qubits from other base-locations. The server reveals their keys (note that the client, being specious, has not kept the computation output qubits, because it would be impossible to reconstruct the ideal state by acting only on their systems). The client checks all of the traps and, if all of them are correct, reveals the final computation output keys to the server (${\theta }_i,r_i$). The server undoes the padding to reveal their output.

3.3. The QYao Protocol

We combine Protocols 3 and 4 with the core VUBQC, Protocol 1, to obtain a secure two-party protocol to compute unitaries given as Protocol 5. An illustration of a simple example is given in Appendix C.1.

Protocol 3 Server’s input injection

Setting: • The server has input $\left|{\mathsf{\Phi }}_S\right.〉$ that corresponds to specific positions $I_S$ of the input layer of the base-graph. For each i qubit, server chooses pair of secret bits $(m_{x,i},m_{z,i})$. Instructions: The server sends to the client the states $X^{m_{x,i}}{Z}^{m_{z,i}}\left|{\mathsf{\Phi }}_S\right.〉$ for all $i\in I_S$. The client prepares all of the states of the DT(G) as in Protocol 1 (see [25]) apart from the computation qubits of the server’s input. The client chooses at random $x_i^{\prime },{\theta }_i^{\prime }$ for each of the server’s input and obtains the states: $X^{x_i^{\prime }}Z\left({\theta }_i^{\prime }\right)X^{m_{x,i}}{Z}^{m_{z,i}}\left|{\mathsf{\Phi }}_S\right.〉$. The client mixes the computation qubit of the server’s input, with a dummy and a trap qubit to return the three qubits of server’s input base-locations. The server, after receiving the qubits, returns to the client the secret bits $(m_{x,i},m_{z,i})$ for all i of their input. The client computes $x_i:=x_i^{\prime }+m_{x,i}$ and ${\theta }_i:={(-1)}^{m_{x,i}}{\theta }_i^{\prime }+\pi m_{z,i}$ and uses these $(x_i,{\theta }_i)$ for computing the measurement angles as in Protocol 1. Outcome: • The server receives a DT(G), where the quantum input is the joint input of the client and server and the related measurement angles instructions perform the desired unitary operation, if the client is honest.

Protocol 4 Server’s output extraction.

Setting: • The server has the state ${\mathrm{Tr}}_C\left(\left|\psi \left(f\right)\right.〉\right)$ at the corresponding positions $O_S$ of their output base-locations of the DT(G). For each i qubit, server chooses pair of secret bits $(m_{x,i},m_{z,i})$. Instructions: The server sends to the client the states $X^{m_{x,i}}{Z}^{m_{z,i}}{\mathrm{Tr}}_C\left(\left|\psi \left(f\right)\right.〉\right)$ for all $i\in O_S$. The client keeps the qubits that correspond to traps and dummies in the final layer of server’s output, while returns the computation qubits of server’s output. The server returns to the client $(m_{x,i},m_{z,i})$. The client checks the traps and if correct returns to the server the final layer paddings for their output locations $({\theta }_i,r_i,r_{j<i})$ and $(m_{x,i},m_{z,i})$ (that the server sent earlier). The server undoes the final layer paddings and obtains the output. Outcome: • The server obtains the computation qubits of their output base-locations unpadded ${\mathrm{Tr}}_C\left(U({\left|\mathsf{\Psi }\right.〉}_C,{\left|\mathsf{\Phi }\right.〉}_S)\right)$.

Theorem 1 (Correctness).

If both the client and server follow the steps of Protocol 5, then the output is correct, and the computation is accepted.

Proof. 

If the client and server follow Protocol 5, after Step 1, where the server injected its input, we are in exactly the same situation as in Protocol 1, with (overall) input ${\rho }_{in}={\left|\mathsf{\Psi }\right.〉}_C\otimes {\left|\mathsf{\Phi }\right.〉}_S$.

During Step 2, the client and server run exactly Protocol 1, and the correctness follows from the correctness of that protocol; the proof is given in [25]. The positions of dummies result in having isolated traps measured on the correct basis, and thus, there is never an abort. From the remaining qubits, one copy of the dotted base-graph G, where the measurement pattern ${\mathbb{M}}_{\mathrm{Comp}}$ is applied, results in the state $E_{k^S,k^C}(U·{\rho }_{in})$. This is the honest global final state, encrypted with keys of both the client (secret parameters) and the server (the padding $(m_{x,i},m_{z,i})$ from the output extraction protocol, which applies to server’s output registers only).

Protocol 5 Secure 2PQC-QYao.

Input: The client and server know the unitary operator U that they wish to compute. The client has a description of U in MBQC using resource $\left|G\right.〉$, and maps it to the DT(G) (see Protocol 1 and [25]). For each qubit the client knows the angles ${\varphi }_i$ and dependencies. The base-locations of the inputs and outputs of both parties are public. The inputs of client and server are denoted correspondingly as ${\left|\mathsf{\Psi }\right.〉}_C$ and ${\left|\mathsf{\Phi }\right.〉}_S$. Output: The client receives the subset $C_o$ of the output qubits of the final quantum state $U({\left|\mathsf{\Psi }\right.〉}_C,{\left|\mathsf{\Phi }\right.〉}_S)$. The server receives the subset $S_o$ of the output qubits of the final quantum state $U({\left|\mathsf{\Psi }\right.〉}_C,{\left|\mathsf{\Phi }\right.〉}_S)$. The protocol Client sends all qubits of the DT(G) (choosing the random parameters $r_i,{\theta }_i,d_i$ and trap-colouring), where for base-locations that corresponds to the server’s input, the input injection Protocol 3 is used. Server and client follow the verification protocol 1 until the step that the output is returned. Client and server interact according to Protocol 4 so that the server extracts their own output.

During Step 3, the client keeps the registers of its output, while returning the registers of the server’s output. The protocol finishes with the server returning its keys $(m_{x,i},m_{z,i})$ to the client (to check for traps), while the client returns the keys (secret parameters) involved with the final decryption of the server’s output registers. ☐

Since the protocol we give is generic for any quantum computation, the complexity of the 2PQC protocol with respect to the input size depends on the specific computation/algorithm used, and it is against this that it should be compared. At this point, we should stress that the number of qubits required for the 2PQC protocol is exactly the same as those to perform the same computation using VUBQC where all input and output are of the client. From [25], the number of qubits and classical messages to be exchanged is linear to the number of qubits required to perform the quantum computation using MBQC (i.e., without blindness or verification). Finally, the only extra “cost” for 2PQC is the extra quantum communication (and related classical exchanges) during the input injection and the output extraction. This extra communication is simply one extra qubit communication per server input qubits and similarly one extra qubit communication per server output qubit.

Due to the simple composition of input injection and output extraction, the verification property of our QYao is directly inherited from the VUBQC. We prove this first, before presenting and proving the main privacy property of the QYao protocol in the next section (which exploits the verifiability).

Definition 6.

We define a 2PQC protocol to be $ϵ$-verifiable for the client, if for any (potentially malicious) server, the probability of obtaining a corrupt output and not an abort is bounded by ϵ. The output of the real protocol with malicious server $\tilde{S}$ is $\tilde{\rho }(\tilde{S},{\rho }_{in})$, and we have:

$$\begin{array}{ccc}\hfill \Delta (\tilde{\rho }(\tilde{S},{\rho }_{in}),{\rho }_{ideal}\left({\rho }_{in}^{\prime }\right))& \le & ϵ\hfill \end{array}$$

(6)

where

$$\begin{array}{ccc}{\rho }_{ideal}\left({\rho }_{in}\right)\hfill & :=\hfill & p_{ok}({\mathbb{I}}_{{\mathcal{H}}_C}\otimes {\mathcal{C}}_{{\mathcal{H}}_S})·U·\left({\rho }_{in}\right)+(1-p_{ok})\left(\left|fail\right.〉\left.〈fail\right|\right)\hfill \end{array}$$

and ${\mathcal{C}}_{{\mathcal{H}}_S}$ is the deviation that acts on the server’s systems after it receives its outcome (a CP-map, but can be purified if we include ancilla). Furthermore, ${\rho }_{in}^{\prime }=({\mathbb{I}}_{{\mathcal{H}}_C}\otimes D_{{\mathcal{H}}_S})·{\rho }_{in}$ is an initial state compatible with the client’s input, with $D_{{\mathcal{H}}_S}$ the deviation on the input by the server.

We should note that the server can always choose any input from its side, and the security of the protocol is defined with respect to this “deviated” input. Moreover, since the deviation ${\mathcal{C}}_{{\mathcal{H}}_S}$ is performed at the final step of the protocol, we also have that the global state (before that deviation, i.e., at step $n-1$) obeys:

$$\begin{array}{ccc}\hfill \Delta ({\tilde{\rho }}^{n-1}(\tilde{S},{\rho }_{in}),{\rho }_{ideal}^{n-1}\left({\rho }_{in}^{\prime }\right))& \le & ϵ\hfill \end{array}$$

(7)

where

$$\begin{array}{ccc}{\rho }_{ideal}^{n-1}\left({\rho }_{in}\right)\hfill & :=\hfill & p_{ok}U·\left({\rho }_{in}\right)+(1-p_{ok})\left(\left|fail\right.〉\left.〈fail\right|\right)\hfill \end{array}$$

Theorem 2 (ϵ-verification for the client).

Protocol 5 is ϵ-verifiable for the client, where $ϵ={\left(\frac{8}{9}\right)}^d$ and $d=\lceil \frac{\delta }{2(2c+1)}\rceil$, c is the maximum degree of the base graph and δ is the number of errors tolerated on the base graph G.

Proof. 

In order to prove the verifiability for the client, we assume that the client is honest, while the server is malicious.

During Step 1 of Protocol 5, the server sends his/her input and also gives the keys of the one-time padding encryption $(m_{x,i},m_{z,i})$ from the input injection phase. It follows that any deviation on these affects only the computation qubits of the server’s input base-location; in other words, it results in a state: ${\rho }_{in}^{\prime }=({\mathbb{I}}_{{\mathcal{H}}_C}\otimes D_{{\mathcal{H}}_S})·{\rho }_{in}$

During Step 2, the protocol proceeds exactly as the VUBQC, Protocol 1, with the only difference that the qubits with the base-location of the server’s output have an extra encryption with keys known to the server. This means that the client delays the measurement of the traps in those base-locations, until the next step, where it receives from the server these keys. Note, however, that the client can already check all of the past traps and the ones corresponding to base-location of the clients’ output.

In Step 3, the server returns the keys $(m_{x,i},m_{z,i})$ for all of its output base-locations qubit and also receives the computation qubits of those base-locations encrypted with both the client’s and server’s keys. Any deviation by the server at this stage either returns different (wrong) keys to the client or acts only on the server’s output. Returning wrong keys increases the chance of an abort, but in any case, it is equivalent to this deviation happening before the return of the output to the server. The only remaining, extra deviation is a possible deviation acting on the computation output qubits of the server, i.e., a deviation of the form $({\mathbb{I}}_{{\mathcal{H}}_C}\otimes {\mathcal{C}}_{{\mathcal{H}}_S})$.

It follows that this protocol has the same verification properties as Protocol 1, with the modified input and (server’s part) of the output given by Equation (6). From [25], we have that Protocol 1 is $ϵ$-verifiable with $ϵ={\left(\frac{8}{9}\right)}^d$ and $d=\lceil \frac{\delta }{2(2c+1)}\rceil$, and this completes the proof. ☐

It is worth mentioning that this verification property essentially restricts the server to behave similarly as a specious adversary, with the extra ability to abort the protocol.

4. Proof of the Privacy of the QYao Protocol

Recall that we defined a protocol to be secure if no possible adversary in any step of the protocol can distinguish whether it interacts with the real protocol or with a simulator that has access only to the ideal functionality (see Definition 4).

Theorem 3.

The QYao protocol, Protocol 5, which is ${ϵ}_1$-verifiable for the client, is $O\left(\sqrt{{ϵ}_2}\right)$-private against an ${ϵ}_2$-specious client and ${ϵ}_1$-private against a malicious server.

To prove the theorem, we need to introduce simulators for each step of the protocol and each possible adversary. Below, we define those simulators and prove that they are as close to the real protocol as requested from Theorem 3. Since in our setting, the two parties have different roles and maliciousness, we consider the simulators for each party separately.

4.1. Client’s Simulators

The client is $ϵ$-specious, and this means that for each step i, there exist a map ${\mathcal{T}}_i:L\left({\mathcal{H}}_{{\tilde{V}}_i}\right)\to L\left({\mathcal{H}}_{V_i}\right)$, such that:

$$\begin{array}{c}\hfill \Delta \left(({\mathcal{T}}_i\otimes \mathbb{I})\left({\tilde{\rho }}_i(\tilde{V},{\rho }_{in})\right),{\rho }_i\left({\rho }_{in}\right)\right)\le ϵ\end{array}$$

(8)

Following the proof of the “rushing lemma” of [21], we obtain a similar lemma for each step of the protocol, where it shows that there is no extra information stored in the ancillas of the specious adversary:

Lemma 1 (No-extra information).

Let ${\Pi }_U=(A,B,n)$ be a correct protocol for the two-party evaluation of U. Let $\tilde{A}$ be any ϵ-specious adversary. Then, there exists an isometry $T_i:{\tilde{A}}_i\to A_i\otimes \widehat{A}$ and a (fixed) mixed state $\widehat{{\rho }_i}\in D\left(\widehat{A_i}\right)$, such that for all joint input states ${\rho }_{in}$,

$$\begin{array}{c}\hfill \Delta \left((T_i\otimes \mathbb{I})\left({\tilde{\rho }}_i(\tilde{A},{\rho }_{in})\right),\widehat{{\rho }_i}\otimes {\rho }_i\left({\rho }_{in}\right)\right)\le 12\sqrt{2ϵ}\end{array}$$

(9)

where ${\rho }_i\left({\rho }_{in}\right)$ is the state in the honest run and ${\tilde{\rho }}_i(\tilde{A},{\rho }_{in})$ is the real state (with the specious adversary $\tilde{A}$).

Proof. 

This proof follows closely the proof of the “rushing lemma” of [21], where one can find further details. For simplicity, we assume pure ${\rho }_{in}$ (where it holds in general by convexity). Consider two different states $\left|{\psi }_1\right.〉,\left|{\psi }_2\right.〉$ in ${\mathcal{A}}_0\otimes {\mathcal{B}}_0\otimes \mathcal{R}$, and we extend the space ${\mathcal{R}}^{\prime }=\mathcal{R}\otimes {\mathcal{R}}_2$ with ${\mathcal{R}}_2=\mathrm{span}\{\left|0\right.〉,\left|1\right.〉\}$. We define the state $\left|\psi \right.〉=1/\sqrt{2}(\left|{\psi }_1\right.〉\left|1\right.〉+\left|{\psi }_2\right.〉\left|2\right.〉)$. Due to the speciousness of $\tilde{A}$ and using Ulmann’s theorem, there is an isometry $T_i:{\tilde{\mathcal{A}}}_i\to {\mathcal{A}}_i\otimes \widehat{\mathcal{A}}$ and a state $\tilde{\rho }\in D\left(\widehat{\mathcal{A}}\right)$, such that:

$$\begin{array}{c}\hfill \Delta \left((T_i\otimes \mathbb{I})·\widetilde{{\rho }_i}(\tilde{A},\psi ),\tilde{\rho }\otimes {\rho }_i\left(\psi \right)\right)\le 2\sqrt{2ϵ}\end{array}$$

(10)

The state $\tilde{\rho }$ in general is not independent of the input $\psi$, so there are a few more steps required. By noting that the projection and partial trace are trace non-increasing maps (by projecting on the $\left|1\right.〉$ subspace and tracing out the ${\mathcal{R}}^{\prime }$ subspace), we obtain:

$$\begin{array}{c}\hfill \Delta \left((T_i\otimes \mathbb{I})·\widetilde{{\rho }_i}(\tilde{A},{\psi }_1),\tilde{\rho }\otimes {\rho }_i\left({\psi }_1\right)\right)\le 4\sqrt{2ϵ}\end{array}$$

(11)

and similarly for ${\psi }_2$. We repeat the same using ${\psi }_1,{\psi }_3$ and with initial state $\left|{\psi }^{\prime }\right.〉=1/\sqrt{2}(\left|{\psi }_1\right.〉\left|1\right.〉+\left|{\psi }_3\right.〉\left|2\right.〉)$ and obtain:

$$\begin{array}{c}\hfill \Delta \left((T_i\otimes \mathbb{I})·\widetilde{{\rho }_i}(\tilde{A},{\psi }_1),\widetilde{{\rho }^{\prime }}\otimes {\rho }_i\left({\psi }_1\right)\right)\le 4\sqrt{2ϵ}\end{array}$$

(12)

By the triangular inequality, we get $\Delta (\tilde{\rho },\widetilde{{\rho }^{\prime }})\le 8\sqrt{2ϵ}$. This means that for any state $\left|\chi \right.〉$, there exists a state $\widehat{\rho }\in \widehat{\mathcal{A}}$ with $\Delta (\tilde{\rho },\widehat{\rho })\le 8\sqrt{2ϵ}$, such that:

$$\begin{array}{c}\hfill \Delta \left((T_i\otimes \mathbb{I})·\widetilde{{\rho }_i}(\tilde{A},\chi ),\widehat{\rho }\otimes {\rho }_i\left(\chi \right)\right)\le 4\sqrt{2ϵ}\end{array}$$

(13)

and the lemma follows by using once more the triangle inequality. ☐

Before introducing the simulators, we give some intuitive arguments. The client, during the input-injection step, receives a fully-one-time padded quantum state, while in later steps (up until the last), it has no legitimate quantum state (all of the quantum states are in the server’s side). Therefore, using the above lemma, we can already see that the client has no information about the actual quantum state during any step before the last. This is illustrated by the fact that the simulators for these steps can run the honest protocol with a random (but fixed) input, and the client’s view is the same (they cannot distinguish a run with the correct or different input in any step before the last). The simulator for the final step (after receiving the quantum states from the server) is more subtle, as it necessarily involves a call to the ideal functionality.

Proof of Theorem 3.

Simulator upon receiving the server’s encoded input: There is a full one-time pad on the server’s input; thus, a simulator can use a random fixed state ${\phi }^{\ast }$ instead of the real state ${\mathrm{Tr}}_C\left({\rho }_{in}\right)$, and the client cannot distinguish them.

Simulator after returning the server’s input and before receiving output: The simulator runs the honest protocol using instead of ${\rho }_{in}$ a fixed random input ${\phi }^{\ast }$. The honest state with input $\chi$ at this stage is:

$$\begin{array}{cc}\hfill {\rho }_i\left(\chi \right)& :=\hfill \\ & {\left(\left|k_i\right.〉\left.〈k_i\right|\otimes \left|b_i\right.〉\left.〈b_i\right|\right)}_{{\mathcal{H}}_C}\otimes {\left(E_{k_i}\left({\sigma }_i\left(\chi \right)\right)\otimes \left|d_i\right.〉\left.〈d_i\right|\otimes \left|{+}_{{\theta }_{t_i}}\right.〉\left.〈{+}_{{\theta }_{t_i}}\right|\right)}_{{\mathcal{H}}_S}\hfill \end{array}$$

(14)

where ${\sigma }_i\left(\chi \right)$ is the evolution of the input state, when the gates corresponding to the i-th step have been performed (here, we collectively call the secret parameters used to encrypt the state in each step as $k_i$). Later, we will be more specific about the different secret parameters. Furthermore, $d_i,{\theta }_{t_i}$ are the dummy and trap qubits of the i-th layer (we can include the qubits of future layers, as well with no difference in the remaining argument). It is easy to see that the reduced state on the client’s side ${\mathcal{H}}_C$ is independent of the input state $\chi$. The simulator is then constructed:

• The simulator runs the protocol with fixed but random input ${\phi }^{\ast }$, to obtain ${\rho }_i\left({\phi }^{\ast }\right)$.
• The simulator obtains the fixed state $\widehat{{\rho }_i}$ and the isometry $T_i$, which are both independent of the input.
• The simulated view is then defined to be:

  $$\begin{array}{c}\hfill {\nu }_i(\tilde{C},{\rho }_{in}):={\mathrm{Tr}}_{{\mathcal{H}}_{S_i}}\left((T_i^{†}\otimes \mathbb{I})(\widehat{{\rho }_i}\otimes {\rho }_i\left({\phi }^{\ast }\right))\right)\end{array}$$

  (15)

We can easily see that:

$$\begin{array}{c}\hfill {\nu }_i(\tilde{C},{\rho }_{in})={\mathrm{Tr}}_{{\mathcal{H}}_{S_i}}\left((T_i^{†}\otimes \mathbb{I})(\widehat{{\rho }_i}\otimes {\rho }_i\left({\rho }_{in}\right))\right)={\mathrm{Tr}}_{{\mathcal{H}}_{S_i}}\left((T_i^{†}\otimes \mathbb{I})(\widehat{{\rho }_i}\otimes {\rho }_i\left({\phi }^{\ast }\right))\right)\end{array}$$

as $T_i^{†}$ does not acts on ${\mathcal{H}}_{S_i}$ and thus commutes with the partial trace, while tracing out ${\mathcal{H}}_{S_i}$ leaves the reduced state independent from the input (see Equation (14)). Since isometries leave invariant the trace distance, while the partial trace is non-increasing, we use Equation (9), and we have:

$$\begin{array}{c}\hfill \Delta \left({\mathrm{Tr}}_{{\mathcal{H}}_{S_i}}\left({\tilde{\rho }}_i(\tilde{C},{\rho }_{in})\right),{\nu }_i(\tilde{C},{\rho }_{in})\right)\le 12\sqrt{2ϵ}\end{array}$$

(16)

Simulator after receiving client’s output: First, we need to introduce some notation and conventions:

• By $k^S,k^C$, we define the padding of the server’s and client’s output, respectively. In more detail, these keys are functions of the trap-colouring (trap positions) of the last layer, the rotations $\theta$, the secret parameters r’s and measurement results b’s of the previous two layers. We collectively denote the rest, i.e., all of the other secret keys, as $k^R$.
• We also assume that the classical measurement outcomes b’s are in the Hilbert space of the client, while being classical and public, could be copied to the server’s Hilbert space as well (adding this copy does not affect the client’s simulators and complicates the notation). Moreover, classical results corresponding to trap measurements are denoted $b_t$, while other results are simply denoted b. The trap measurements outcomes (in the honest run) are $b_t=r_t$, where $r_t$ is one of the secret parameters included in $k^R$.
• The final layer (unmeasured) qubits are separated into: (i) output qubits (those of the server and the client; and it includes the purification of their inputs), (ii) dummy qubits collectively denoted $d^S,d^C$ for server/client unmeasured dummies and (iii) trap qubits denoted as ${\theta }_t^S,{\theta }_t^C$. The dummies and trap qubits are in the tensor product with the rest (in the honest run).
• The Hilbert spaces containing the output qubits (and the related purification of honest run) are denoted ${\mathcal{H}}_{S_o},{\mathcal{H}}_{C_o}$, while the remaining qubits are ${\mathcal{H}}_S,{\mathcal{H}}_C$.
• For brevity, we denote $\left[b\right]:=\left|b\right.〉\left.〈b\right|$ and use the analogous notation for other states.

With the above notations, the honest run of the protocol at this step, with some input $\chi$, is:

$$\begin{array}{ccc}\hfill {\rho }_i\left(\chi \right)& =& {\left(E_{k_i^C,k_i^S}\left(U\left(\chi \right)\right)\right)}_{{\mathcal{H}}_{C_o}\otimes {\mathcal{H}}_{S_o}}\hfill \\ & & \otimes {\left(\left[k^S\right]\otimes \left[k^C\right]\otimes \left[k^R\right]\otimes \left[b\right]\otimes \left[b_t\right]\otimes \left[d^C\right]\otimes \left[{\theta }_t^C\right]\right)}_{{\mathcal{H}}_C}\hfill \\ & & \otimes {\left(\left[d^S\right]\otimes \left[{\theta }_t^S\right]\right)}_{{\mathcal{H}}_S}\hfill \end{array}$$

(17)

We define:

$$\begin{array}{ccc}\hfill \varrho (\chi ,k^C,k^S)& :=& {\left(E_{k_i^C,k_i^S}\left(U\left(\chi \right)\right)\right)}_{{\mathcal{H}}_{C_o}\otimes {\mathcal{H}}_{S_o}}\hfill \\ \hfill \sigma & :=& {\left(\left[k^S\right]\otimes \left[k^C\right]\otimes \left[k^R\right]\otimes \left[b\right]\otimes \left[b_t\right]\otimes \left[d^C\right]\otimes \left[{\theta }_t^C\right]\right)}_{{\mathcal{H}}_C}\otimes {\left(\left[d^S\right]\otimes \left[{\theta }_t^S\right]\right)}_{{\mathcal{H}}_S}\hfill \\ \hfill {\rho }_i\left(\chi \right)& =& \varrho (\chi ,k^C,k^S)\otimes \sigma \hfill \end{array}$$

(18)

It is worth pointing out that $\sigma$ is independent of the input $\chi$. Now, the simulator is constructed in the following steps:

• The simulator obtains from the client the choice of secret keys $k^C,k^S,k^R$ (that can be viewed as part of the client’s input).
• The simulator sets $b_t=r_t$. For the other measurement outcomes b, the simulator chooses randomly a bit value (to ensure that the b’s obtained are indistinguishable from the real honest protocol, the simulator can run the full protocol with some random input $\phi$. Since in the honest run, the values of b’s do not depend on (are not correlated to) the input, the outcomes that the simulator returns would be indistinguishable from those of a run with the correct input. Finally, speciousness ensures that this state is also close to the real protocol).
• The simulator, using the previous steps, constructs the state $\sigma$.
• The simulator uses the state $\widehat{{\rho }_i}$ from Lemma 1 for the i-th step, which is a fixed state (independent of the input).
• The simulator calls the ideal functionality and receives the state ${\mathrm{Tr}}_{{\mathcal{H}}_{S_o}}\left({\rho }_i\left({\rho }_{in}\right)\right)$.
• The simulator uses the keys and the state received from the ideal functionality and constructs ${\mathrm{Tr}}_{{\mathcal{H}}_{S_o}}\left(\varrho ({\rho }_{in},k^C,k^S)\right)$.
• The simulator obtains the operator ${\mathcal{T}}_i$ from the definition of specious and constructs the isometry $T_i$ acting from ${\mathcal{H}}_{\tilde{C}}\to {\mathcal{H}}_C\otimes {\mathcal{H}}_{\widehat{C}}$.
• The simulated view is then:

  $$\begin{array}{c}\hfill \nu (\tilde{C},{\rho }_{in}):={\mathrm{Tr}}_{{\mathcal{H}}_S}\left((T_i^{†}\otimes \mathbb{I})\left(\widehat{{\rho }_i}\otimes {\mathrm{Tr}}_{{\mathcal{H}}_{S_o}}\left(\varrho ({\rho }_{in},k^C,k^S)\right)\otimes \sigma \right)\right)\end{array}$$

  (19)

It is clear that in all of this construction, ${\rho }_{in}$ appears only through ${\mathrm{Tr}}_{{\mathcal{H}}_{S_o}}\left({\rho }_i\left({\rho }_{in}\right)\right)$, which is the ideal output of the client. Now, we prove that this simulated view is $\delta$-close to the view of the client in the real protocol.

We start from Equation (9), and we obtain:

$$\begin{array}{c}\hfill \Delta \left({\mathrm{Tr}}_{{\mathcal{H}}_S,{\mathcal{H}}_{S_o}}\left({\tilde{\rho }}_i(\tilde{C},{\rho }_{in})\right),{\mathrm{Tr}}_{{\mathcal{H}}_S,{\mathcal{H}}_{S_o}}\left(\left(T_i^{†}\otimes \mathbb{I}\right)\left(\widehat{{\rho }_i}\otimes {\rho }_i\left({\rho }_{in}\right)\right)\right)\right)\le 12\sqrt{2ϵ}\end{array}$$

Now, since $T_i^{†}$ does not act on either of the server’s Hilbert spaces, it commutes with the partial trace (see Appendix D). We can then see that:

$$\begin{array}{c}\hfill \nu (\tilde{C},{\rho }_{in})={\mathrm{Tr}}_{{\mathcal{H}}_S,{\mathcal{H}}_{S_o}}\left(\left(T_i^{†}\otimes \mathbb{I}\right)\left(\widehat{{\rho }_i}\otimes {\rho }_i\left({\rho }_{in}\right)\right)\right)\end{array}$$

(20)

and this concludes the first part of the proof, as we have a $\left(12\sqrt{2ϵ}\right)$-private protocol.

☐

4.2. Server’s Simulators

Our QYao protocol is secure against a fully-malicious server that can deviate in any possible way and can also cause an abort. We will use the fact that the QYao protocol is $ϵ$-verifiable for the client, i.e., Equations (6) and (7) hold. In many classical protocols, to prove security against malicious adversaries, one has to restrict his or her actions to essentially honest-but-curious adversaries. Here, the verification property plays such a role, as the condition obtained can be used in a similar way as the speciousness of the client.

We can see that, before the client sends the secret parameters, the server is totally blind, i.e., the server’s reduced state at all times is the totally mixed state (for all qubits in the DT(G), including their own input qubits, after they are injected). This is highlighted by the fact that one can run the full protocol (before releasing the keys), without choosing the (client’s) input (see simulator below). After receiving the keys from the client, to simulate the server’s view, we need a call to the ideal functionality and, at this point, to use Equation (6).

Continuation of the proof of Theorem 3:

Simulator before receiving keys: The simulator, instead of sending qubits in one of these states $\{\left|{+}_{\theta }\right.〉,\left|0\right.〉,\left|1\right.〉\}$, sends one side of an EPRpair $\left|\psi \right.〉=\frac{1}{\sqrt{2}}(\left|01\right.〉+\left|10\right.〉)$ for each qubit to the server; then chooses an angle ${\delta }_i$ at random for each of the measurement angles. The simulator can measure (if it wishes) its qubits (of the EPR pairs) in a suitable way and angles that insert any input it wishes and performs any computation. This can be done after all measurements of the server have taken place (see [14]). It follows that the server cannot obtain any information about the client’s input.

Simulator after receiving keys: The simulator is constructed using the following steps:

• The simulator prepares multiple Bell states $\left|\psi \right.〉=\frac{1}{\sqrt{2}}(\left|01\right.〉+\left|10\right.〉)$, sends the one qubit of each pair to the server and instructs them to entangle the qubits as it would in the normal protocol.
• The simulator for each qubit chooses randomly an angle ${\delta }_i$ and instructs the server to measure in this angle.
• The simulator obtains from the server’s (malicious) strategy the parameter $p_{ok}$ (see Equation (6)).
• With probability $(1-p_{ok})$, the simulator returns an abort. Otherwise, it performs the remaining steps.
• The simulator calls the ideal functionality and obtains the state ${\mathrm{Tr}}_{{\mathcal{H}}_C}\left(U\left({\rho }_{in}^{\prime }\right)\right)$, where ${\rho }_{in}^{\prime }=({\mathbb{I}}_{{\mathcal{H}}_C}\otimes D_{{\mathcal{H}}_S})·{\rho }_{in}$ is the deviated input that the corrupted server inputs.
• The simulator encrypts the outcome using $k^S$, and sends the output qubits of the server back in the state: $E_{k^S}\left({\mathrm{Tr}}_{{\mathcal{H}}_C}\left(U\left({\rho }_{in}^{\prime }\right)\right)\right)$
• The simulator returns the keys $k^S$ to the server.

The last step of the protocol is that the server decrypts its output. The decryption is denoted as $D_{k^S}(·)$, where we have by definition that $D_{k^S}\left(E_{k^S}(·)\right)=\mathbb{I}$. It follows that the server’s view of the real protocol after the key exchange is:

$$\begin{array}{c}\hfill {\mathrm{Tr}}_{{\mathcal{H}}_C}\left(E_{k^S}\left({\tilde{\rho }}^{n-1}(\tilde{S},{\rho }_{in}^{\prime })\right)\right)\end{array}$$

(21)

From Equation (7), we obtain:

$$\begin{array}{c}\hfill \Delta \left({\mathrm{Tr}}_{{\mathcal{H}}_C}\left(E_{k^S}\left({\tilde{\rho }}^{n-1}(\tilde{S},{\rho }_{in})\right)\right),{\mathrm{Tr}}_{{\mathcal{H}}_C}\left(E_{k^S}\left({\rho }_{ideal}^{n-1}\left({\rho }_{in}^{\prime }\right)\right)\right)\right)\le ϵ\end{array}$$

(22)

as the partial trace is a distance non-increasing operation. Using the definition of ${\rho }_{ideal}^{n-1}\left({\rho }_{in}^{\prime }\right)$ from Equation (7), we see that:

$$\begin{array}{ccc}\hfill {\mathrm{Tr}}_{{\mathcal{H}}_C}\left(E_{k^S}\left({\rho }_{ideal}^{n-1}\left({\rho }_{in}^{\prime }\right)\right)\right)& =& {\mathrm{Tr}}_{{\mathcal{H}}_C}\left(E_{k^S}\left(p_{ok}U·\left({\rho }_{in}^{\prime }\right)+(1-p_{ok})\left(\left|fail\right.〉\left.〈fail\right|\right)\right)\right)\hfill \\ \hfill {\mathrm{Tr}}_{{\mathcal{H}}_C}\left(E_{k^S}\left({\rho }_{ideal}^{n-1}\left({\rho }_{in}^{\prime }\right)\right)\right)& =& \nu (\tilde{P},{\rho }_{in})\hfill \end{array}$$

(23)

We have now proven that the simulated view is $ϵ$-close to the real view of the server, just after the key exchange, thus proving that the protocol is $ϵ$-private against malicious server $\tilde{S}$. ☐

5. Non-Interactive QYao

Following the classical approach of [24], we exploit our QYao protocol to construct the one-time program. To do so, we simply need to remove the classical online communication of the QYao protocol using the classical hardware primitive of secure “one-time memory” (OTM), which is essentially a non-interactive oblivious transfer. The obtained one-time quantum programs can be executed only once, where the input can be chosen at any time. Classically, the challenge in lifting the Yao protocol for two-party computation to the one-time program was the issue of the malicious adversary. However, our QYao protocol is already secure against a malicious evaluator without any extra primitive or added overhead.

Recall that the interaction in our QYao is required for two reasons. First, from the server’s perspective, this is done to obtain the measurement angles ${\delta }_i$ that perform the correct computation, while these could not be computed offline as they depend on the measurement outcomes $b_{j<i}$ of certain qubits measured before i, but after the preparation stage (and on secret parameters $({\theta }_i,r_i,r_{j<i},T)$ and computation angle ${\varphi }_i$ that are known from start). Second, from the client’s perspective, the results of measurements needed to be provide with a “proof” that the output is correct, by testing for deviation from the trap outcomes.

Removing the interaction: An obvious solution for the first issue raised is to have the client compute ${\delta }_i$ for all combinations of previous outcomes $b_{j<i}$ and then store in an OTM the different values, while the server chooses and learns the entry of the OTM corresponding to the outcomes obtained. This solution, at first, appears to suffer from an efficiency issue as one may think that for each qubit, the client needs to compute ${\delta }_i$ for all combinations of past outcomes, which grows exponentially (as would the size of the OTM used). However, a closer look at the dependencies of corrections in MBQC for the typical graphs used shows that the measurement angle of qubit i depends on at most a constant number of qubits. Those dependencies are within the two previous “layers” (past neighbours or past neighbours of past neighbours). This is evident from the flow construction [41,42], which guarantees that corrections can be done, and the explicit form of dependencies involves only neighbours and next-to neighbours in the graph G. A flow is defined by a function ($f:O^c\to I^c$) from measured qubits to non-input qubits and a partial order $(⪯)$ over the vertices of the graph such that $\forall i:i⪯f\left(i\right)$ and $\forall j\in N_G\left(i\right):f\left(i\right)⪯j$, where $N_G\left(i\right)$ denotes the neighbours of i in G. Each qubit i is X-dependent on $f^{-1}\left(i\right)$ and Z-dependent on all qubits j, such that $i\in N_G\left(j\right)$.

Definition 7 (Past of qubit i).

We define $P_i=Z_i\cup X_i$ to be the set of qubits j that have X or Z dependency on i.

Definition 8 (Influence-past of qubit i).

We define influence-past $c_i$ of qubit i to be an assignment of an outcome $b_j\in \{0,1\}$ for all qubits $j\in P_i$.

For each influence-past $c_i$, there exists a unique value of ${\delta }_i\left(c_i\right)$. While $c_i$ provides all of the necessary dependencies for the client to compute ${\delta }_i$, this is not known to the server. This could be problematic, as the server is expected to open the OTM using the past outcomes with a labelling consistent with its own knowledge. The true dependencies depend on the actual flow of the computation, which is hidden from the server, as the positions of dummies (that break the DT(G) to the three graphs) are not known to the server. From here on, we restrict attention to DT(G). This is resolved by defining:

Definition 9 (Extended-past of qubit i).

We define the extended past $E{P}_i$ of qubit i to be the set of all qubits that for some trap-colouring are in the past of i.

Similarly we define the extended-influence-past (EIP) of qubit i (it is clear that ${\delta }_i$ has trivial dependency on all outcomes of EIP that are not in the actual influence-past). The extended past has also finite cardinality, as it is evident that the only qubits that can affect a qubit with base-location i are those that belong to (the finite) base-locations that contain the qubits that have true dependency (i.e., neighbours or next-to neighbours base-locations).

Ensuring verification: The interaction is also important from the clients’ perspective, in order to verify that the server did not deviate. Again, one could naively suggest that the server can return all of the measurement outcomes at the end. However, this suffers from a potential attack (not present in normal VUBQC). The underlying reason is that there is nothing to force the server to commit that the $b_i$’s that will return are the same as the ones used for selecting measuring angles. For example, the server measures Qubit 1 at ${\delta }_1$ and obtains $b_1$ (which will be returned at the end), but uses $b_1^{\prime }=b_1\oplus 1$ when opening the OTM corresponding to qubit j where $1\in E{P}_j$. If qubit j is a computation qubit, this leads to measuring at a wrong angle, while if qubit j is a trap qubit, it has no (real) dependence on $b_1$; thus, the angle recovered is the correct one, and the server never causes an abort, while corrupting the computation. To avoid this problem, we introduce a method that uses some flag bit-string $l_i$.

The client provides for each qubit the angle ${\delta }_i$ and a flag bit-string $l_i$ of length m. This flag bit-string is a (one-time-padded) flag of whether a trap failed in the (extended) past of qubit i or not. At the final step of the protocol, the server returns the final layer qubits and all of the flags $l_i$. Here, we will denote $b_{j;i}$ to mean the outcome of qubit j measurement that the client uses for the computation of the measurement angle for qubit i, i.e., the value of $b_j$ selected by the server when opening the i-th OTM.

For each qubit i, the client chooses uniformly at random an m-bit string $l_i^0$ to denote that none of its past qubits ($j\in P_i$) was a failed trap. The string $l_i^0$ will be called the “accept” flag, while all other strings $l_i\ne l_i^0$ are the “reject” flags. The OTMs are prepared according to Protocol 6.

According to this protocol, the flag that the server obtains when opening the OTM at qubit i, is rejected if and only if in the extended past of this qubit, there is a failed trap outcome (we can see that returning a wrong outcome for some measurement $b_i$ implies opening an entry of the OTM with the wrong flag only if the qubit is a trap one (as in regular VUBQC), while it still returns the accept flag if it is a dummy or computation qubit). Here, we should note that even if the client knows that one flag is a reject flag (i.e., has one particular $l_i\ne l_i^0$), the probability of guessing the correct flag is only ${ϵ}_f:={(2^m-1)}^{-1}$. This, intuitively, will force the client to return the flag obtained from the OTM (or abort with high probability), provided that m is chosen suitably. We can now give the non-interactive QYao Protocol 7 (see Appendix C.2 for a simple example).

Protocol 6 Preparation of OTMs for non-interactive QYao.

Description of OTM’s: We will use an (at most) one out of K OTM, where $K=2^{{max}_i\left|E{P}_i\right|}$. Note, that the first layer does not need an OTM, since (i) we give the angle directly (does not depend on anything) and (ii) there is no trap in the previous layer and thus no need to give a flag. Moreover, for the last layer, while the qubits are not measured (and thus there is no corresponding angle $\delta$) we will use an OTM to obtain the last flags (that correspond to testing traps in the previous layers). Labels of the cells of the OTM at i: Each qubit is labelled according to the outcomes of the extended past qubits $b_{j;i}|j\in E{P}_i$, in other words according to the extended influence past $c_i$. Content of the cells of the OTM at i: In each cell of the OTM we have a pair of numbers (We could view this as a single string with the convention that the first three bits give $\delta$ and the remaining the flag.) $({\delta }_i,l_i)$. The ${\delta }_i$ is the unique correct $\delta$ for the particular outcomes of past qubits $b_j|j\in P_i$. $$\begin{array}{c}\hfill {\delta }_i\left(c_i\right)={(-1)}^{s_i^{X_i}}{\varphi }_i+{\theta }_i+\pi (r_i\oplus s_i^{Z_i})\end{array}$$ (24) The flag $l_i$ depends on the outcomes $b_j$ of the extended past $j\in E{P}_i$. In particular: If for all traps t in the extended past of i, i.e., $t\in E{P}_i$, $b_{t;i}=r_t$, we return $l_i^0$, i.e., accept flag. Otherwise, we return a random string $l_i\ne l_i^0$, i.e., reject flag.

Protocol 7 Non-interactive QYao.

Assumptions Client and server want to jointly compute a unitary as in Protocol 5. The client has N OTM’s that are 1-out-of-K, i.e., one OTM per qubit, with sufficient entries to store a pair of $({\delta }_i,l_i)$ measurement angle and flag bit-string (of length at least $m\ge log(\frac{1}{ϵ}+1)$), for each extended influence past of the qubit. Protocol Client and server interact according to Protocol 3 to obtain the server’s input locations. Client also sends the qubits of DT(G) after choosing secret parameters ($r_i,{\theta }_i,d_i$ and trap-colouring). The client, for each qubit and each extended influence past, computes ${\delta }_i\left(c_i\right)$. Then prepares one OTM per qubit as described in Protocol 6. Server performs the measurements according to the first layer of angles received ${\delta }_i$ (directly as in Protocol 3). Then open the next layer OTM’s using the outcomes $b_i$ of their measurements. Uses the new measurement angle revealed ${\delta }_j$, while records the flag bit-string $l_j$. Iterates until the last layer OTM is opened (and the second last layer is measured). The final layer OTM’s return only a flag. Server and client interact according to Protocol 4 so that the server obtains their output. The only difference is that the client, before returning the keys, in order to accept checks the flags (instead of checking the trap outcomes of measured qubits) and the final layer traps.

This protocol requires exactly the same number of qubits as Protocol 5. The only extra “cost” is that we require one OTM per qubit. The size of the labels of the OTM is one-out-of-K (where $K={max}_i\left|E{P}_i\right|$), while the size of the content of each cell is $3+m\ge 3+log(\frac{1}{ϵ}+1)$ bits as described in Protocol 6.

Theorem 4.

Protocol 7 is ϵ-verifiable for the client, with ϵ the same as the VUBQC protocol that is used.

Proof. 

This proof consists of three stages. First, similarly to the proof of theorem 2, we show that the verifiability for the client of the non-interactive QYao reduces to the verifiability of the same VUBQC protocol with modifications for the server’s input and output. The second stage is to observe that the optimal strategy for an adversarial server is to return the flags from the opened OTMs. This makes the verifiability property for this protocol identical to an interactive protocol with the only modification that the server can return different values for the measurement outcome $b_i$ depending on which future qubit the client needs the outcome ($b_{i;j}$). The final stage, is to show that this modified (interactive) verification protocol is $ϵ$-verifiable with the same $ϵ$ as Protocol 1.

Stage 1: Following the proof of Theorem 2, we can see that the non-interactive QYao Protocol 7 is $ϵ$-verifiable for the client if the corresponding non-interactive VUBQC protocol that is used during Step 3 of Protocol 7 is $ϵ$-verifiable, with deviated input ${\rho }_{in}^{\prime }$ and a final deviation $({\mathbb{I}}_{{\mathcal{H}}_C}\otimes {\mathcal{C}}_{{\mathcal{H}}_S})$ on the server’s output (computation) qubits.

Stage 2: If the server attempts to guess a flag (given the extra knowledge of one bit-string $l_i\ne l_i^0$), it causes an abort with high probability ($1-{ϵ}_f$, where ${ϵ}_f:={(2^m-1)}^{-1}$). However, since by assumption $m\ge log(\frac{1}{ϵ}+1)$, the probability of an abort is so high that it makes the protocol trivially verifiable, as it is $ϵ$-close to the ideal state Equation (6) with $(1-p_{ok})=(1-{ϵ}_f)$.

It follows that the adversary (trying to maximising its cheating chances) should return the flags found in the OTMs. This is equivalent to an interactive VUBQC protocol, for which= (i) the server for each qubit i returns multiple values of the measurement outcome $b_{i;j}$, one for each j in the extended future qubit of i, (ii) the client uses those outcomes to compute the ${\delta }_i$’s and (iii) the client aborts only when it receives at least one trap outcome wrong $b_{t;j}\ne r_t$ for any j.

Stage 3: We should now show the $ϵ$-verifiability of the modified interactive VUBQC protocol described above. The proof follows the same steps of the proof of the verifiability of Protocol 1 in [25]. The first steps exploit the blindness to reduce the possible attacks (of the adversarial server) to a convex combination of Pauli attacks. Then, it is noted that since the computation is encoded in an error-correcting code (that corrects up to $\delta /2$ errors), there is a minimum number ($d=\lceil \frac{\delta }{2(2c+1)}\rceil$) of independent base-locations that need to be corrupted to cause an error.

For the proof of verifiability, as in [10,25], we make the assumption that if the minimum number of attacks that could corrupt the computation occurs, then the computation is corrupted. This is clearly not true, but is sufficient to provide a bound on the probability of corrupt and accept (which is the “bad” case that the server manages to cheat). Then, given this minimum number of attacks, the probability of abort is computed and found to be greater than $1-ϵ$, and thus, the protocol is verifiable.

In our case, there is the difference that for each measured qubit $b_i$ of the original protocol, we have multiple qubits $b_{i;j}$. Once again, we make the assumption of minimum corrupted qubits; we need at least $d=\lceil \frac{\delta }{2(2c+1)}\rceil$ independent base-locations; and we can allow for each base-location to corrupt a single $b_{i;j}$ for one specific j. However, this does not change the probability of hitting a trap, as it suffices to give the wrong value $b_{t,j}$ for one j to cause an abort. We then obtain again that the probability of an abort (in the minimum corruptible attack) is at least $(1-ϵ)$ (for $ϵ={\left(\frac{8}{9}\right)}^d$), and the protocol is indeed $ϵ$-verifiable. ☐

Theorem 5.

Protocol 7 that is ${ϵ}_1$-verifiable for the client is $O\left(\sqrt{{ϵ}_2}\right)$-private against an ${ϵ}_2$-specious client and ${ϵ}_1$-private against a malicious server.

Proof. 

We need simulators for the client only during input injection and output extraction (since the client does not participate in the evaluation phase, in the non-interactive protocol). During these steps, the simulators are identical to those in Protocol 5.

The server’s simulators until before the output extraction can be identical with the ones of Protocol 5, where the interaction is replaced with the preparation of OTMs. It is important to note that all OTMs can be constructed with no information about the client’s input and thus from the simulator. Finally, the simulator for the final step of Protocol 5 needs to only use the property that the protocol is $ϵ$-verifiable for the client. We proved in Theorem 4 that this is the case for Protocol 7, and thus, we can use the same simulator. ☐

6. Conclusions

We gave a protocol for 2PQC, secure against specious adversaries. Our protocol differs significantly from [21] since it has an asymmetric treatment of the two parties. There are two approaches for classical S2PC, that of Yao [22] and that of Goldreich et al. [43]. While our protocol can be seen as the quantum version of [22] (that also has asymmetry between parties), the protocol of [21] is a quantum version of [43]. In the quantum case, our approach provides the extra advantage of being more practical in terms of technological requirements. This is because the client requires only basic quantum technologies (preparing single qubits), and there is no online quantum communication among the parties.

Furthermore, due to a subtle difference in the definition of specious adversaries, our protocol requires no extra primitives (see the details in Appendix B). Typically, considering weaker adversaries such as the specious adversaries is a first step towards protocols secure against malicious adversaries. This is why it is not crucial whether we take the stronger or weaker form of the specious adversaries. There are standard techniques, such as the cut-and-choose technique and the GMWcompiler [43], that turn protocols from secure against honest-but-curious to secure against malicious adversaries. However, the quantum generalisations are considerably more involved, as these techniques cannot be directly applied due to no-cloning and quantum inseparability. We have recently extended our results towards this direction, in the specific case of classical input/output, by generalising the cut-and-choose technique [44].

Finally, we obtained a one-time compiler for any quantum computation using one-time memories. This was done following the classical work of Goldwasser et al. [24] and more efficiently than the quantum work of Broadbent et al. [6]. An important difficulty to use the classical Yao protocol directly to construct one-time programs is the case where the evaluator is malicious (rather than honest-but-curious). However, in our QYao, the protocol is secure against an evaluator that is fully malicious, and thus, we can obtain the one-time program directly once we remove the interaction (which is present in the quantum case). To overcome this difficulty, we used OTMs to replace the interaction and introduced an extra “flag” register to ensure the security of the protocol.