If I’m not mistaken classical OT is not regarded quanum-safe. However I’ve been reading (not really understanding) some papers [1,2] and some reviews[3] on quantum OT and/or post-quantum OT, it seems to be possible.

I do have an engineering background, so that’s the reason why I don’t get quantum cryptography papers.

Can you please explain briefly in layman (engineer) terms if and how post-quantum OT is possible?

[1] https://www.computer.org/csdl/proceedings/phycmp/1994/6715/00/00363696.pdf

[2] http://citeseerx.ist.psu.edu/viewdoc/download?doi=

[3] https://www.quantiki.org/wiki/oblivious-transfer

  • 3
    $\begingroup$ Do you just want an OT protocol secure against a quantum attacker? If so, there are post-quantum secure OT protocols based on lattices or coding theory assumptions, which don't require any quantum cryptography. $\endgroup$
    – pscholl
    Sep 13 '18 at 9:34
  • $\begingroup$ @pscholl Yes, I’m very much interested in post-quantum secure OT protocols. The only reason I mentioned quantum OT is, those were the ones I came across. Any OT protocol secure against a quantum attacker is more than good enough for what I’m trying to build. If you know of a simple and practical one, can you point me towards one (1-2 or even something like Rabin OT is simply good enough for my use-case) $\endgroup$
    – zetaprime
    Sep 13 '18 at 9:56
  • 2
    $\begingroup$ Also isogeny based ones: eprint.iacr.org/2018/459 $\endgroup$ Sep 13 '18 at 10:03

Post-quantum oblivious transfer protocols are possible. If you base the security of the OT in a post-quantum assumption, this should give you an OT conjectured to be robust to quantum attackers. Besides the already mentioned OT based on supersingular isogeny (in comments), I can give you some other examples:

Code-based: https://eprint.iacr.org/2008/138.pdf , https://ieeexplore.ieee.org/document/6089575

Lattice-based: https://eprint.iacr.org/2018/530

There are also some constructions for OT ,secure in the Universally Composable framework and based on post-quantum assumptions, such as


based on the LPN assumption, and the ones that can be instantiated using the frameworks of:




using post-quantum encryption schemes.


Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.