One-out-of-$m$ spacetime-constrained oblivious transfer

TL;DR

This paper introduces unconditionally secure protocols for one-out-of-m spacetime-constrained oblivious transfer, extending previous two-out-of-two protocols to arbitrary m, with applications in quantum cryptography and classical communication settings.

Contribution

It generalizes existing two-out-of-two SCOT protocols to one-out-of-m, introduces the concept of distributed quantum access with classical memory, and discusses potential extensions to k-out-of-m settings.

Findings

Protocols are unconditionally secure for any m ≥ 2.

Introduces the task of one-out-of-m distributed quantum access with classical memory.

Extends SCOT to k-out-of-m and discusses classical communication protocols.

Abstract

In one-out-of-$m$ spacetime-constrained oblivious transfer (SCOT), Alice and Bob agree on $m$ pairwise spacelike separated output spacetime regions $R_0,R_1,\ldots, R_{m-1}$ in an agreed reference frame in a spacetime that is Minkowski, or close to Minkowski; Alice inputs a message $x_i$ in the causal past of a spacetime point $Q_i$ of $R_i$, for $i\in\{0,1,\ldots,m-1\}$; Bob inputs $b\in\{0,1,\ldots,m-1\}$ in the intersection of the causal pasts of $Q_0,Q_1,\ldots,Q_{m-1}$ and outputs $x_b$ in $R_b$; Alice remains oblivious to $b$ anywhere in spacetime; and Bob is unable to obtain $x_i$ in $R_i$ and $x_j$ in $R_j$ for any pair of different numbers $i,j\in\{0,1,\ldots,m-1\}$. We introduce unconditionally secure one-out-of-$m$ SCOT protocols extending the one-out-of-two SCOT protocols of Pital\'ua-Garc\'ia [Phy. Rev. A 93, 062346 (2016)] and Pital\'ua-Garc\'ia and Kerenidis [Phy. Rev. A 98, 032327 (2018)], for arbitrary integers $m\geq 2$. We define the task of one-out-of-$m$ distributed quantum access with classical memory (DQACM), which works as a subroutine to implement a class $\mathcal{P}_{\text{CC}}$ of one-out-of-$m$ SCOT protocols where distant agents only need to communicate classically. We present unconditionally secure one-out-of-$m$ DQACM protocols and one-out-of-$m$ SCOT protocols of the class $\mathcal{P}_{\text{CC}}$, for arbitrary integers $m\geq2$. We discuss various generalizations of SCOT. In particular, we introduce a straightforward extension of SCOT to a $k$-out-of-$m$ setting, and suggest protocols where distant agents only need to communicate classically, while we leave the investigation of their security as an open problem.

Equations

$$\bigl{\lvert}\psi_{r_{0}^{j}r_{1}^{j}}^{s^{j}}\bigr{\rangle}_{A_{0}^{j}A_{1}^{j}}=\bigl{\lvert}\psi_{r_{0}^{j}}^{0}\bigr{\rangle}_{A_{s^{j}}^{j}}\bigotimes\bigl{\lvert}\psi_{r_{1}^{j}}^{1}\bigr{\rangle}_{A_{\bar{s}^{j}}^{j}},$$

$$\bigl{\lvert}\Psi_{\mathbb{r}}^{\mathbb{s}}\bigr{\rangle}_{A}=\bigotimes_{\begin{subarray}{c}i\in\text{I}_{m}\\ j\in[n]\end{subarray}}\bigl{\lvert}\alpha_{r_{i}^{j}}^{i}\bigr{\rangle}_{A_{s_{i}^{j}}^{j}},$$

$$A=\underset{\begin{array}{c}i\in {\text{I}}_m\\ j\in [n]\end{array}}{⨂}{A}_i^j,$$

$$\lambda=\max_{i\neq i^{\prime}}\bigl{\lvert}\bigl{\langle}\alpha_{r}^{i}|\alpha_{r^{\prime}}^{i^{\prime}}\bigr{\rangle}\bigr{\rvert}^{2},$$

$$\lambda <1.$$

$$\lvert\phi\rangle_{a^{\prime}a}=\frac{1}{\sqrt{l}}\sum_{r\in\Omega}\bigl{\lvert}\alpha_{r}^{i}\rangle_{a^{\prime}}\otimes\bigl{\lvert}\alpha_{r}^{i}\rangle_{a},$$

$$\epsilon_{\text{Bob}}=\biggl{(}\frac{m-1+\sqrt{\lambda}}{m}\biggr{)}^{n}.$$

$$\epsilon_{\text{Bob}}^{\gamma}=\Biggl{[}2^{2h(\gamma)}\biggl{(}\frac{m-1+\sqrt{\lambda}}{m}\biggr{)}\Biggr{]}^{n},$$

$$2^{2h(\Gamma_{m}^{(\lambda)})}\biggl{(}\frac{m-1+\sqrt{\lambda}}{m}\biggr{)}=1,$$

$$\lvert\Phi^{+}\rangle=\frac{1}{\sqrt{2}}\bigl{(}\lvert 0\rangle\lvert 0\rangle+\lvert 1\rangle\lvert 1\rangle\bigr{)}.$$

$$\lvert\alpha_{r}^{1}\rangle=(-1)^{r}\cos\Bigl{(}\frac{\theta}{2}\Bigr{)}\lvert r\rangle+\sin\Bigl{(}\frac{\theta}{2}\Bigr{)}\lvert\bar{r}\rangle,$$

$$\lambda=\max\Bigl{\{}\cos^{2}\Bigl{(}\frac{\theta}{2}\Bigr{)},\sin^{2}\Bigl{(}\frac{\theta}{2}\Bigr{)}\Bigr{\}}.$$

$$\epsilon^{\theta}=\biggl{(}\frac{1+\sqrt{\lambda}}{2}\biggr{)}^{n},$$

$$\epsilon^{\frac{\pi}{2}}=\biggl{(}\frac{1}{2}+\frac{1}{2\sqrt{2}}\biggr{)}^{n}.$$

$$\lvert\alpha_{r}^{i}\rangle=(-1)^{r}\cos\Bigl{(}\frac{\theta_{i}}{2}\Bigr{)}\lvert r\rangle+\sin\Bigl{(}\frac{\theta_{i}}{2}\Bigr{)}\lvert\bar{r}\rangle,$$

$${\theta }_i=i\frac{\pi }{m},$$

$$\lambda=\cos^{2}\Bigl{(}\frac{\pi}{2m}\Bigr{)},$$

$$\epsilon_{m}=\biggl{(}\frac{m-1+\cos\bigl{(}\frac{\pi}{2m}\bigr{)}}{m}\biggr{)}^{n}.$$

$$p_{n}\leq\biggl{(}\frac{m-1+\sqrt{\lambda}}{m}\biggr{)}^{n},$$

$$p_{n}^{\prime}\leq 2^{2nh(\gamma)}\biggl{(}\frac{m-1+\sqrt{\lambda}}{m}\biggr{)}^{n},$$

$$2^{2h(\Gamma_{m}^{(\lambda)})}\biggl{(}\frac{m-1+\sqrt{\lambda}}{m}\biggr{)}=1,$$

$$|{\Phi }_r^s{⟩}_{B_0{B}_1}=U_{AE}|{\Psi }_r^s{⟩}_A|\chi {⟩}_E,$$

$$p_n=\frac{1}{(l{)}^{mn}(m!{)}^n}\sum _{\begin{array}{c}s\in {\Lambda }^n\\ r\in {\Omega }^{nm}\end{array}}⟨{\Phi }_r^s|{\Pi }_{0s}^{r_{l_0}}\otimes {\Pi }_{1s}^{r_{l_1}}|{\Phi }_r^s⟩,$$

$$p_n^{\prime }=\frac{1}{(l{)}^{mn}(m!{)}^n}\sum _{\begin{array}{c}a:w(a\le n\gamma )\\ b:w(b\le n\gamma )\end{array}}\sum _{\begin{array}{c}s\in {\Lambda }^n\\ r\in {\Omega }^{nm}\end{array}}⟨{\Phi }_r^s|{\Pi }_{0s}^{r_{l_0}\oplus a}\otimes {\Pi }_{1s}^{r_{l_1}\oplus b}|{\Phi }_r^s⟩,$$

$$p_n^{\prime }$$

$$C=\underset{\begin{array}{c}i\in {\text{I}}_m\\ j\in [n]\end{array}}{⨂}{C}_i^j.$$

$$|\Phi {⟩}_{CA}=\underset{\begin{array}{c}i\in {\text{I}}_m\\ j\in [n]\end{array}}{⨂}|\varphi {⟩}_{C_i^j{A}_i^j}.$$

$$\lvert\Psi\rangle_{CB_{0}B_{1}}=\bigl{(}\mathds{1}_{C}\otimes U_{B_{0}B_{1}}\bigr{)}\lvert\Phi\rangle_{CA}\lvert\chi\rangle_{E},$$

$$p_{n}=\frac{1}{(m!)^{n}}\sum_{\mathbb{s}\in\Lambda^{n}}\text{Tr}\bigl{(}D_{\mathbb{s}}\Psi\bigr{)},$$

$$D_{\mathbb{s}}=\sum_{\mathbb{r}\in\Omega^{nm}}\bigl{(}\bigl{\lvert}\Psi_{\mathbb{r}}^{\mathbb{s}}\bigr{\rangle}\bigl{\langle}\Psi_{\mathbb{r}}^{\mathbb{s}}\bigr{\rvert}\bigr{)}_{C}\otimes\bigl{(}\Pi_{0\mathbb{s}}^{\mathbb{r}_{l_{0}}}\bigr{)}_{B_{0}}\otimes\bigl{(}\Pi_{1\mathbb{s}}^{\mathbb{r}_{l_{1}}}\bigr{)}_{B_{1}},$$

Full text

I Introduction

One-out-of-$m$ oblivious transfer is a fundamental cryptographic task that works as a primitive in secure computation Kilian (1988). Secure computation Yao (1982) is an area of cryptography in which two or more mistrustful parties compute a joint function of their private inputs in such a way that there is no information about their inputs, which does not follow from the output of the computation, revealed to the other parties. In an one-out-of-$m$ oblivious transfer protocol, Alice inputs $m\geq 2$ messages $\mathbb{x}_{0},\mathbb{x}_{1},\ldots,\mathbb{x}_{m-1}$, Bob inputs a number $b\in\{0,1,\ldots,m-1\}$, and Bob outputs the message $\mathbb{x}_{b}$. An one-out-of-$m$ oblivious transfer protocol must satisfy two security conditions: 1) the condition of security for honest Alice, also denoted as security against dishonest Bob, according to which if Alice follows the protocol honestly but Bob does not, Bob cannot obtain more than one of Alice’s messages; and 2) the condition of security for honest Bob, also denoted as security against dishonest Alice, according to which if Bob follows the protocol honestly but Alice does not, Alice remains oblivious to Bob’s input $b$.

Protocols for one-out-of-$m$ oblivious transfer and more general secure computations have been proposed, with the security being based in computational or technological assumptions, for example, the assumed difficulty of finding the prime factors of large integers Yao (1986); Kilian (1988), or the assumption that quantum memories are bounded or noisy Wehner et al. (2008). However, one-out-of-$m$ oblivious transfer and more general secure computations cannot be implemented with unconditional security in the standard setting of non-relativistic quantum cryptography Lo (1997); Colbeck (2007); Buhrman et al. (2012), i.e. it is impossible to guarantee their security only from the laws of quantum physics. In particular, Lo’s no-go theorem Lo (1997) states that if a protocol for one-out-of-$m$ oblivious transfer is unconditionally secure against dishonest Alice then, with sufficiently advanced quantum technology, Bob can obtain all messages $\mathbb{x}_{0},\mathbb{x}_{1},\ldots,\mathbb{x}_{m-1}$.

One-out-of-$m$ oblivious transfer and more general secure computations cannot achieve unconditional security even in the more general setting of relativistic quantum cryptography, introduced by Kent Kent (1999a, 2012a), in which each party in the protocol has trusted agents performing quantum computations and communications at different spacetime points, some of which are spacelike separated. For example, in the case of one-out-of-$m$ oblivious transfer, if a quantum relativistic protocol taking place in a finite region $R$ of spacetime, in some reference frame $\mathcal{F}$, is unconditionally secure against Alice, then it follows from Lo’s no-go theorem that Bob can perform the protocol honestly with an input $b=0$ and obtain $\mathbb{x}_{0}$ in $R$ and then apply a unitary operation $U$ on his global quantum system, which is spread among various locations, and complete it within the spacetime region $T$ consisting in the intersection of the causal futures of all the spacetime points of $R$ – for example, Bob can simply send all his quantum systems to a common spacetime point within $T$ and then apply $U$ there – and then apply a quantum measurement to obtain $\mathbb{x}_{1}$ and then proceed similarly to obtain $\mathbb{x}_{2}$ and so on. This is in contrast to other tasks in mistrustful cryptography, like coin tossing and bit commitment, for which unconditionally secure protocols cannot exist in non-relativistic quantum cryptography Lo and Chau (1998, 1997); Mayers (1997), but for which there are unconditionally secure protocols in relativistic quantum cryptography Kent (1999b, a, 2005, 2011a, 2012b); Lunghi et al. (2015).

Nevertheless, two relativistic variations of one-out-of-two oblivious transfer have been recently proposed, denoted as location-oblivious data transfer (LODT) Kent (2011b) and spacetime-constrained oblivious transfer (SCOT) Pitalúa-García (2016), which have been shown to achieve unconditional security Kent (2011b); Pitalúa-García (2016). In LODT, Alice transfers a message to Bob at a random location in spacetime that neither Alice nor Bob can determine in advance, and Alice remains oblivious to the location where Bob received the message. In SCOT, according to a bit $b$ input by Bob, Bob either obtains a message $\mathbb{x}_{0}$ of Alice in a spacetime region $R_{0}$ or a message $\mathbb{x}_{1}$ of Alice in a spacetime region $R_{1}$, where $R_{0}$ and $R_{1}$ are spacelike separated, and where Alice remains oblivious to Bob’s input $b$. Interestingly, LODT and SCOT are the only known cryptographic tasks that necessitate both the no-superluminal principle of relativity theory and the properties of quantum information to achieve unconditional security Kent (2011b); Pitalúa-García (2016), in contrast to coin tossing and bit commitment, for example, for which there are unconditionally secure relativistic protocols that are purely classical Kent (1999b, a, 2005); Lunghi et al. (2015).

Two unconditionally secure protocols for SCOT have been presented in the academic literature Pitalúa-García (2016); Pitalúa-García and Kerenidis (2018). The protocol of Ref. Pitalúa-García (2016) requires the preparation of random Bennett-Brassard 1984 (BB84) Bennett and Brassard (1984) states and their secure transmission to distant laboratories. The protocol of Ref. Pitalúa-García and Kerenidis (2018) requires the preparation and transmission of quantum states between adjacent laboratories, and the transmission of classical information to distant laboratories. Here, we introduce unconditionally secure protocols that generalize those of Refs. Pitalúa-García (2016); Pitalúa-García and Kerenidis (2018) to the one-out-of-$m$ setting, in which Alice inputs $m\geq 2$ messages $\mathbb{x}_{0},\mathbb{x}_{1},\ldots,\mathbb{x}_{m-1}$, there are $m\geq 2$ pairwise spacelike separated output spacetime regions $R_{0},R_{1},\ldots,R_{m-1}$, Bob inputs an integer $b\in\{0,1,\ldots,m-1\}$ and outputs $\mathbb{x}_{b}$ in $R_{b}$, Alice remains oblivious to $b$ anywhere in spacetime, and Bob cannot output $\mathbb{x}_{i}$ in $R_{i}$ and also $\mathbb{x}_{j}$ in $R_{j}$ for any pair of different numbers $i,j$ from the set $\{0,1,\ldots,m-1\}$.

Potential applications of one-out-of-$m$ SCOT include situations where Bob needs to access, at a specific location and within a short interval of time, one of various pieces of information input by Alice, and Bob requires his choice of accessed piece of information to remain secret to Alice. For example, potential applications of one-out-of-$m$ SCOT and generalizations are in high frequency trading strategies (HFT) in the stock market, where must transaction are completed within half a millisecond Wissner-Gross and Freer (2010). Consider for example in this case the following situation. Alice is a company that sells information about the stock market in real time in a set of different possible locations and Bob is a company that trades in the stock market using HFT strategies. Alice offers Bob one piece of her database $\mathbb{x}_{0},\mathbb{x}_{1},\ldots,\mathbb{x}_{m-1}$, each being information on the stock market at the respective location $\text{L}_{0},\text{L}_{1},\ldots,\text{L}_{m-1}$ at real time. Each $\text{L}_{i}$ could be the location of a stock market in some part of the world, for instance New York, Toronto, Paris, London, Tokyo, etc. Bob pays Alice a fixed amount of money to obtain an entry $\mathbb{x}_{b}$ in the location $\text{L}_{b}$ in real time. Bob requires that his choice $b$ remains private from Alice, while Alice requires that Bob cannot access her entry $\mathbb{x}_{i}$ in $\text{L}_{i}$ at real time, for more than one $i$ from the set $\{0,1,\ldots,m-1\}$. One-out-of-$m$ SCOT guarantees with unconditional security that Alice cannot learn Bob’s choice $b$ anywhere in spacetime and that within a time interval smaller than 0.5 ms, which is relevant for HFT strategies, Bob cannot obtain $\mathbb{x}_{i}$ in $\text{L}_{i}$ and also $\mathbb{x}_{j}$ in $\text{L}_{j}$ for any pair of different numbers $i,j$ from the set $\{0,1,\ldots,m-1\}$ if the distance between any pair of locations from the set $\text{L}_{0},\text{L}_{1},\ldots,\text{L}_{m-1}$ is at least 150 km, which is the maximum distance that light can travel in 0.5 ms in the approximately Minkowski spacetime near the Earth surface.

We mainly focus on a class $\mathcal{P}_{\text{CC}}$ of one-out-of-$m$ SCOT protocols extending those of Ref. Pitalúa-García and Kerenidis (2018), which require classical – but not quantum – communication among distant locations, and we show them unconditionally secure. We introduce a quantum-cryptography task denoted as one-out-of-$m$ distributed quantum access with classical memory (DQACM), which works as a fundamental primitive to construct the class $\mathcal{P}_{\text{CC}}$ of one-out-of-$m$ SCOT protocols.

Broadly speaking, a protocol for one-out-of-$m$ DQACM consists in the following steps. Alice encodes $m$ messages $\mathbb{r}_{0},\mathbb{r}_{1},\ldots,\mathbb{r}_{m-1}$ chosen randomly from predetermined sets in a quantum state $\lvert\Psi_{\mathbb{r}}^{\mathbb{s}}\rangle$, where $\mathbb{r}=(\mathbb{r}_{0},\mathbb{r}_{1},\ldots,\mathbb{r}_{m-1})$, and where $\mathbb{s}$ denotes a basis chosen randomly by Alice from a predetermined set of non-mutually orthogonal bases. Alice sends $\lvert\Psi_{\mathbb{r}}^{\mathbb{s}}\rangle$ to Bob. Bob chooses a random number $c\in\{0,1,\ldots,m-1\}$, applies a quantum measurement $\text{M}_{c}$ on $\lvert\Psi_{\mathbb{r}}^{\mathbb{s}}\rangle$, and obtains a classical measurement outcome $\mathbb{d}$. At a later time Alice gives $\mathbb{s}$ to Bob, who then uses $\mathbb{d}$ and $\mathbb{s}$ to learn Alice’s input $\mathbb{r}_{c}$. A one-out-of-$m$ DQACM protocol must satisfy a security condition against dishonest Bob, according to which, if Alice follows the protocol honestly and Bob follows a cheating strategy in which he applies an arbitrary quantum operation $O$ on $\lvert\Psi_{\mathbb{r}}^{\mathbb{s}}\rangle$ that produces at least two quantum systems $B_{0}$ and $B_{1}$, and then quantum measurements $\tilde{\text{M}}_{0}^{\mathbb{s}}$ and $\tilde{\text{M}}_{1}^{\mathbb{s}}$ are applied on $B_{0}$ and $B_{1}$ after receiving $\mathbb{s}$, giving classical outcomes $\mathbb{r}_{i}^{\prime}$ and $\mathbb{r}_{j}^{\prime}$, respectively, then the probability that $\mathbb{r}_{i}^{\prime}$ equals $\mathbb{r}_{i}$ and $\mathbb{r}_{j}^{\prime}$ equals $\mathbb{r}_{j}$ is negligible for Alice’s input messages of large size, and for any pair of different numbers $i,j$ from the set $\{0,1,\ldots,m-1\}$.

We introduce a class $\mathcal{C}$ of one-out-of-$m$ DQACM protocols. We show that by satisfying a few properties the protocols of this class are unconditionally secure. We give specific examples of unconditionally secure one-out-of-$m$ DQACM protocols from the class $\mathcal{C}$.

We also briefly discuss various generalizations of one-out-of-$m$ SCOT. In particular, we suggest a definition for $k$-out-of-$m$ SCOT, for arbitrary natural numbers $k<m$ and $m\geq 2$, according to which Alice and Bob agree on $m$ pairwise spacelike separated output spacetime regions $R_{0},R_{1},\ldots,R_{m-1}$, Alice inputs $m$ messages $\mathbb{x}_{0},\mathbb{x}_{1},\ldots,\mathbb{x}_{m-1}$, Bob obtains Alice’s input $\mathbb{x}_{b_{l}}$ in the output spacetime region $R_{b_{l}}$, for $k$ different numbers $b_{l}\in\{0,1,\ldots,m-1\}$ chosen by Bob, Bob cannot obtain $\mathbb{x}_{i}$ in $R_{i}$, for more than $k$ different elements $i$ from the set $\{0,1,\ldots,m-1\}$, and Alice remains oblivious to Bob’s inputs $b_{l}$, anywhere in spacetime. We suggest protocols for $k$-out-of-$m$ SCOT where communication between distant locations is only classical, based on the primitive of $k$-out-of-$m$ DQACM, which is a natural generalization of one-out-of-$m$ DQACM into a $k$-out-of-$m$ setting, but we leave as an open question to investigate whether they are unconditionally secure. In particular, we propose protocols for $k$-out-of-$m$ DQACM extending the class $\mathcal{C}$ of protocols for one-out-of-$m$ DQACM, and we leave as an open problem to show whether they are unconditionally secure.

This paper is organized as follows. In section II, we describe the setting of relativistic quantum cryptography, we provide some mathematical notation and we recall the SCOT protocols of Refs. Pitalúa-García (2016); Pitalúa-García and Kerenidis (2018). We define one-out-of-$m$ SCOT in section III. In section IV, we introduce an unconditionally secure one-out-of-$m$ SCOT protocol $\mathcal{P}_{\text{QC}}$ that extends the one-out-of-two SCOT protocol of Ref. Pitalúa-García (2016), and which requires quantum communication between distant locations. We define the task of one-out-of-$m$ DQACM in section V. In section VI, we present a class $\mathcal{C}$ of unconditionally secure protocols for one-out-of-$m$ DQACM, we show that this class of protocols are unconditionally secure from the satisfaction of a few properties, and we give specific examples of this class of protocols. In section VII, we introduce a class $\mathcal{P}_{\text{CC}}$ of one-out-of-$m$ SCOT protocols where communication between distant locations is only classical, and where one-out-of-$m$ DQACM acts as a subroutine; we show the class $\mathcal{P}_{\text{CC}}$ is unconditionally secure if the one-out-of-$m$ DQACM subroutine is unconditionally secure; and we discuss specific examples of protocols from the class $\mathcal{P}_{\text{CC}}$ where the one-out-of-$m$ DQACM subroutine belongs to the class $\mathcal{C}$. Section VIII discusses generalizations of one-out-of-$m$ SCOT; in particular, definitions of $k$-out-of-$m$ SCOT and $k$-out-of-$m$ DQACM are suggested; protocols for $k$-out-of-$m$ DQACM and $k$-out-of-$m$ SCOT are outlined, with the investigation of their security being left as an open problem. We conclude in section IX with a discussion of our results and of possible connections with other research problems in quantum information and relativistic quantum cryptography.

II Preliminaries

II.1 Relativistic quantum cryptography

In relativistic quantum cryptography, security is guaranteed from 1) the no-superluminal principle of relativity theory, stating that physical systems and information cannot travel faster than light, which is satisfied by quantum theory; and 2) the properties of quantum information, for example, the no-cloning theorem Dieks (1982); Wootters and Zurek (1982), the impossibility of perfectly distingushing non-orthogonal quantum states, the monogamy of quantum entanglement Terhal (2004), the existence of quantum correlations that violate Bell inequalities Bell (1964), etc.

Relativistic-quantum cryptography is usually considered for spacetimes that are Minkowski, or close to Minkowski, as near the Earth surface. But, relativistic quantum cryptography can also apply to arbitrary curved spacetimes with well defined causal structure, if the parties participating in the cryptographic tasks have a well description of the spacetime geometry, if they cannot substantially alter the geometry of spacetime, and if within the region of spacetime where the cryptographic tasks take place, there are not wormholes or other mechanisms allowing them to send signals faster than the speed of light Kent (1999a).

In the setting of relativistic quantum cryptography, the parties participating in the cryptographic tasks, e.g. Alice and Bob, consist of various agents who process and communicate classical and quantum information at various locations in spacetime. In general, in a protocol for relativistic quantum cryptography, the participating parties must agree on spacetime regions where they should communicate classical or quantum information to each other. For this reason, the parties agree on a reference frame $\mathcal{F}$ with global spacetime coordinates $(t,x,y,z)$, where the first entry is temporal and the others are spatial, and where without loss of generality we use units in which the speed of light is unity. In the case of mistrustful cryptography, which includes the task of SCOT considered in this paper, Alice’s (Bob’s) agents work in collaboration and trust each other, but Alice’s agents are mistrustful of Bob’s agents and vice versa.

II.2 Notation

We define the sets $\text{I}_{m}=\{0,1,\ldots,m-1\}$ and $[n]=\{1,2,\ldots,n\}$ for any integer numbers $m\geq 2$ and $n\geq 1$. For a string $\mathbb{a}$ of $n$ entries, we denote the $j$th entry by $a^{j}$, for $j\in[n]$. The Hamming distance between strings of bits $\mathbb{a}$ and $\mathbb{b}$ is denoted by $d(\mathbb{a},\mathbb{b})$. The Hamming weight of a string of bits $\mathbb{a}$ is denoted by $w(\mathbb{a})$. When applied to bits (bit strings) $\oplus$ denotes (bitwise) sum modulo 2. We denote the complement of a bit $a$ by $\bar{a}=a\oplus 1$, and of a bit $a^{j}$ by $\bar{a}^{j}$. The binary entropy of $\gamma\in(0,1)$ is given by $h(\gamma)\equiv-\gamma\log_{2}\gamma-(1-\gamma)\log_{2}(1-\gamma)$, and of $\gamma\in\{0,1\}$ is defined as zero. We use the following notation for the BB84 states: $\lvert\psi_{0}^{0}\rangle=\lvert 0\rangle$, $\lvert\psi_{1}^{0}\rangle=\lvert 1\rangle$, $\lvert\psi_{0}^{1}\rangle=\lvert+\rangle$, $\lvert\psi_{1}^{1}\rangle=\lvert-\rangle$, where \lvert\pm\rangle=\frac{1}{\sqrt{2}}\bigl{(}\lvert 0\rangle\pm\lvert 1\rangle\bigr{)}. The computational and Hadamard bases are denoted by $\{\lvert 0\rangle,\lvert 1\rangle\}$ and $\{\lvert+\rangle,\lvert-\rangle\}$, respectively.

II.3 The SCOT protocols of Refs. Pitalúa-García (2016); Pitalúa-García and Kerenidis (2018)

It is useful to recall the SCOT protocols of Refs. Pitalúa-García (2016); Pitalúa-García and Kerenidis (2018), because we will extend these in following sections. We describe the common setting of these protocols before presenting them.

In the SCOT protocols of Refs. Pitalúa-García (2016); Pitalúa-García and Kerenidis (2018), Alice has three agents $\mathcal{A}$, $\mathcal{A}_{0}$, and $\mathcal{A}_{1}$; and Bob has three agents $\mathcal{B}$, $\mathcal{B}_{0}$, and $\mathcal{B}_{1}$. Alice and Bob agree in a reference frame $\mathcal{F}$ and in two spacelike separated output spacetime regions $R_{0}$ and $R_{1}$. Each of Alice’s (Bob’s) agents controls a secure laboratory. It is useful to consider that the agents $\mathcal{A}$ and $\mathcal{B}$ have adjacent laboratories, and that the agents $\mathcal{A}_{i}$ and $\mathcal{B}_{i}$ have adjacent laboratories, for $i\in\{0,1\}$. There is a quantum channel between $\mathcal{A}$ and $\mathcal{B}$. There is a classical channel between $\mathcal{A}_{i}$ and $\mathcal{B}_{i}$, for $i\in\{0,1\}$.

In the SCOT protocol of Ref. Pitalúa-García (2016), Alice’s agents share secure and authenticated classical channels, and Bob’s agents share secure and authenticated quantum channels. On the other hand, in the SCOT protocol of Ref. Pitalúa-García and Kerenidis (2018), Alice’s agents share secure and authenticated classical channels, and Bob’s agents share secure and authenticated classical channels, but Bob’s agents do not need to share quantum channels; additionally, there is a classical channel, as well as a quantum channel, between $\mathcal{A}$ and $\mathcal{B}$.

In both protocols, Alice and Bob agree on spacetime points $Q_{0}$ in $R_{0}$ and $Q_{1}$ in $R_{1}$. We define $G$ as the intersection of the causal pasts of $Q_{0}$ and $Q_{1}$. In the notation of Refs. Pitalúa-García (2016); Pitalúa-García and Kerenidis (2018), $G$ is the causal past of a spacetime point $P$, which is in the causal past of a spacetime point of $R_{0}$ and a spacetime point of $R_{1}$. Alice inputs a $n-$bit string $\mathbb{x}_{i}$ in the causal past of $Q_{i}$, for $i\in\{0,1\}$. Bob inputs a bit $b$ in $G$ and outputs $\mathbb{x}_{b}$ in $R_{b}$. An example of a setting for the SCOT protocols of Refs. Pitalúa-García (2016); Pitalúa-García and Kerenidis (2018) is given in Fig. 1.

As shown in Refs. Pitalúa-García (2016); Pitalúa-García and Kerenidis (2018), both protocols are unconditionally secure. The protocols are trivially unconditionally secure against dishonest Alice, as Alice does not receive any information from Bob. The protocols are unconditionally secure against dishonest Bob: in any cheating strategy by Bob allowed by quantum theory and relativity, the probability $p_{n}$ that Bob outputs $\mathbb{x}_{0}$ in $R_{0}$ and $\mathbb{x}_{1}$ in $R_{1}$ decreases exponentially with $n$, satisfying p_{n}\leq\bigl{(}\frac{1}{2}+\frac{1}{2\sqrt{2}}\bigr{)}^{n}. The protocols can be extended to allow a small fraction of errors in Bob’s output message, while still satisfying unconditional security for dishonest Bob.

II.3.1 The SCOT protocol of Ref. Pitalúa-García (2016)

Agent $\mathcal{A}$ encodes a random $n-$bit string $\mathbb{r}$ in a quantum state $\lvert\psi_{\mathbb{r}}^{\mathbb{s}}\rangle=\bigotimes_{j\in[n]}\lvert\psi_{r^{j}}^{s^{j}}\rangle$ of $n$ BB84 states, where the $n-$bit string $\mathbb{s}$ is random and denotes the bases. $\mathcal{A}$ sends $\lvert\psi_{\mathbb{r}}^{\mathbb{s}}\rangle$ to $\mathcal{B}$, who receives it in $G$. 2. 2.

$\mathcal{B}$ obtains his input bit $b$ in $G$ and redirects the received state $\lvert\psi_{\mathbb{r}}^{\mathbb{s}}\rangle$ to his colleague $\mathcal{B}_{b}$, who receives it in the causal past of at least one spacetime point of $R_{b}$. 3. 3.

For $i\in\{0,1\}$, $\mathcal{A}$ sends copies of $\mathbb{s}$ and $\mathbb{r}$ to her colleague $\mathcal{A}_{i}$, who receives them in the causal past of $Q_{i}$. 4. 4.

For $i\in\{0,1\}$, $\mathcal{A}_{i}$ obtains her input message $\mathbb{x}_{i}\in\{0,1\}^{n}$ in the causal past of $Q_{i}$. 5. 5.

For $i\in\{0,1\}$, $\mathcal{A}_{i}$ gives $\mathbb{s}$ and $\mathbb{t}_{i}=\mathbb{x}_{i}\oplus\mathbb{r}$ to $\mathcal{B}_{i}$ at the spacetime point $Q_{i}$. 6. 6.

$\mathcal{B}_{b}$ measures the quantum state $\lvert\psi_{\mathbb{r}}^{\mathbb{s}}\rangle$ in the basis labeled by $\mathbb{s}$ and obtains the encoded string $\mathbb{r}$ in $R_{b}$. 7. 7.

$\mathcal{B}_{b}$ computes the message $\mathbb{x}_{b}=\mathbb{r}\oplus\mathbb{t}_{b}$ and outputs it in $R_{b}$.

II.3.2 The SCOT protocol of Ref. Pitalúa-García and Kerenidis (2018)

This SCOT protocol consists of two main stages. Stage I includes quantum communication between agents $\mathcal{A}$ and $\mathcal{B}$, which can take place within their adjacent laboratories, and which can take an arbitrarilly long time, but which must be completed within $G$. For $i\in\{0,1\}$, stage II includes fast classical processing and communication between the agents $\mathcal{A}_{i}$ and $\mathcal{B}_{i}$, which again can take place within their adjacent laboratories; it also includes classical communication between the – possibly distant – pairs of agents $\mathcal{A}$ and $\mathcal{A}_{i}$, and $\mathcal{B}$ and $\mathcal{B}_{i}$. Steps 1 to 6 take place within $G$.

Stage I

For $i\in\{0,1\}$, $\mathcal{A}$ generates random $n-$bit strings $\mathbb{r}_{0},\mathbb{r}_{1},\mathbb{s}$ and sends copies to $\mathcal{A}_{i}$, who receives them in the causal past of $Q_{i}$. 2. 2.

$\mathcal{A}$ prepares a system $A=A^{1}A^{2}\cdots A^{n}$ of $n$ qubit-pairs $A^{1}=A_{0}^{1}A_{1}^{1},\ldots,A^{n}=A_{0}^{n}A_{1}^{n}$ in the quantum state \lvert\psi_{\mathbb{r}_{0},\mathbb{r}_{1}}^{\mathbb{s}}\rangle=\bigotimes_{j\in[n]}\bigl{\lvert}\psi_{r_{0}^{j}r_{1}^{j}}^{s^{j}}\bigr{\rangle}_{A_{0}^{j}A_{1}^{j}}, where

[TABLE]

for $j\in[n]$. We note that $s^{j}\in\{0,1\}$ indicates which qubit in the pair $A^{j}$ is prepared in the computational basis $(\mathcal{D}_{0})$ and which one in the Hadamard basis $(\mathcal{D}_{1})$. For $i\in\{0,1\}$, the string $\mathbb{r}_{i}$ is prepared in the basis $\mathcal{D}_{i}$. $\mathcal{A}$ sends $\lvert\psi_{\mathbb{r}_{0},\mathbb{r}_{1}}^{\mathbb{s}}\rangle$, i.e. the qubits $A^{j}_{i}$ with their labels $i,j$, to $\mathcal{B}$, for $i\in\{0,1\}$ and $j\in[n]$. 3. 3.

$\mathcal{B}$ chooses a random bit $c$, before receiving the qubits from $\mathcal{A}$. $\mathcal{B}$ measures $A^{j}_{i}$ in the basis $\mathcal{D}_{c}$, obtaining the bit outcome $d^{j}_{i}$, for $i\in\{0,1\}$ and $j\in[n]$. The outcomes define $\mathbb{d}_{i}=(d^{1}_{i},d^{2}_{i},\ldots,d^{n}_{i})$, for $i\in\{0,1\}$. For $i\in\{0,1\}$, $\mathcal{B}$ transmits $c$, $\mathbb{d}_{0}$ and $\mathbb{d}_{1}$ to $\mathcal{B}_{i}$, who receives these in the causal past of $Q_{i}$.

Stage II

$\mathcal{B}$ obtains his input $b\in\{0,1\}$ and gives the bit $b^{\prime}=c\oplus b$ to $\mathcal{A}$. 2. 5.

For $i\in\{0,1\}$, $\mathcal{B}$ transmits $b$ to $\mathcal{B}_{i}$, with the transmission being completed in the causal past of $Q_{i}$. 3. 6.

For $i\in\{0,1\}$, $\mathcal{A}$ transmits $b^{\prime}$ to $\mathcal{A}_{i}$, with the transmission being completed in the causal past of $Q_{i}$. 4. 7.

For $i\in\{0,1\}$, $\mathcal{A}_{i}$ obtains $\mathbb{x}_{i}$ in the causal past of $Q_{i}$, and transfers $\mathbb{t}_{i}=\mathbb{r}_{i\oplus b^{\prime}}\oplus\mathbb{x}_{i}$ and $\mathbb{s}$ to $\mathcal{B}_{i}$ at $Q_{i}$. 5. 8.

Within $R_{b}$, $\mathcal{B}_{b}$ uses $\mathbb{s}$, $\mathbb{d}_{0}$, $\mathbb{d}_{1}$ and $c$ to compute $(d_{s^{1}\oplus c}^{1},\ldots,d_{s^{n}\oplus c}^{n})$, which equals $\mathbb{r}_{c}$. Then, within $R_{b}$, $\mathcal{B}_{b}$ outputs $\mathbb{x}_{b}^{\prime}=\mathbb{r}_{c}\oplus\mathbb{t}_{b}$, which equals $\mathbb{x}_{b}$.

II.4 Generalizing the SCOT protocols of Refs. Pitalúa-García (2016); Pitalúa-García and Kerenidis (2018) to the one-out-of-$m$ setting

As described above, the SCOT protocols of Refs. Pitalúa-García (2016); Pitalúa-García and Kerenidis (2018) consider the one-out-of-two setting in which Alice has two input messages $\mathbb{x}_{0}$ and $\mathbb{x}_{1}$ and there are two spacelike separated output spacetime regions $R_{0}$ and $R_{1}$. In section III we generalize the definition of SCOT to the one-out-of-$m$ setting, where Alice has $m\geq 2$ input messages $\mathbb{x}_{0},\mathbb{x}_{1},\ldots,\mathbb{x}_{m-1}$, there are $m$ pair-wise spacelike separated output spacetime regions $R_{0},R_{1},\ldots,R_{m-1}$, Bob should obtain $\mathbb{x}_{b}$ in $R_{b}$ for his chosen $b\in\{0,1,\ldots,m-1\}$, Alice should not learn $b$, and Bob should not get $\mathbb{x}_{i}$ in $R_{i}$ for more than one $i$ from the set $\{0,1,\ldots,m-1\}$.

As discussed above, in the SCOT protocol of Ref. Pitalúa-García (2016), Alice encodes a message $\mathbb{r}$ in a quantum state $\lvert\psi_{\mathbb{r}}^{\mathbb{s}}\rangle$, which further encodes the messages $\mathbb{x}_{0}$ and $\mathbb{x}_{1}$. In this protocol, Bob transmits the state $\lvert\psi_{\mathbb{r}}^{\mathbb{s}}\rangle$ received from Alice to his agent $\mathcal{B}_{b}$ having access to $R_{b}$, who is then able to decode $\mathbb{r}$, after receiving the basis label $\mathbb{s}$, and then uses $\mathbb{r}$ and $\mathbb{r}\oplus\mathbb{x}_{b}$ to decode $\mathbb{x}_{b}$ in $R_{b}$. As we detail in section IV, this protocol can be straightforwardly generalized to the one-out-of-$m$ setting because the message $\mathbb{r}$ of the quantum state $\lvert\psi_{\mathbb{r}}^{\mathbb{s}}\rangle$ can be used to encode the messages $\mathbb{x}_{i}$ with the messages $\mathbb{x}_{i}\oplus\mathbb{r}$, for $i\in\{0,1,\ldots,m-1\}$.

On the other hand, generalizing the SCOT protocol of Ref. Pitalúa-García and Kerenidis (2018) to the one-out-of-$m$ setting is more complicated and interesting. We note from the discussion above, that the SCOT protocol of Ref. Pitalúa-García and Kerenidis (2018) works in two stages. Broadly, in the first stage, two messages $\mathbb{r}_{0}$ and $\mathbb{r}_{1}$ are encoded in a quantum state $\lvert\psi_{\mathbb{r}_{0},\mathbb{r}_{1}}^{\mathbb{s}}\rangle$; and, in the second stage, these messages are used to encode further messages $\mathbb{x}_{0}$ and $\mathbb{x}_{1}$. Generalizing the first stage of this protocol to the one-out-of-$m$ setting requires to find a set of quantum states $\lvert\psi_{\mathbb{r}_{0},\mathbb{r}_{1},\ldots,\mathbb{r}_{m-1}}^{\mathbb{s}}\rangle$ that encodes $m$ messages $\mathbb{r}_{0},\mathbb{r}_{1},\ldots,\mathbb{r}_{m-1}$, while satisfying some security conditions. We have identified this stage with a task that we denote as one-out-of-$m$ distributed quantum access with classical memory, which we describe in section V, with a specific class of secure protocols for this task given in section VI. Generalizing the second stage of the protocol to the one-out-of-$m$ setting is straightforward, and is done explicitly in section VII.

Finally, further generalizations are discussed in section VIII. For example, we consider the case that the number $M\geq 2$ of output spacetime regions can be different to the number $m\geq 2$ of Alice’s inputs, and we discuss protocols for $k$-out-of-$m$ SCOT.

III One-out-of-$m$ spacetime-constrained oblivious transfer

We introduce a generalization of the definition of SCOT of Ref. Pitalúa-García (2016) to a one-out-of-$m$ setting, for any integer $m\geq 2$. Alice (Bob) has trusted agents who can process and communicate classical or quantum information at various locations in spacetime. But, Alice’s agents do not trust Bob’s agents, and vice versa. We assume that spacetime is Minkowski, or very close to Minkowski, as near the Earth’s surface. Alice and Bob agree on a reference frame $\mathcal{F}$ in spacetime, and on $m$ pairwise spacelike separated output spacetime regions $R_{0},R_{1},\ldots,R_{m-1}$; they also agree on a spacetime point $Q_{i}$ of $R_{i}$, for $i\in\text{I}_{m}=\{0,1,\ldots,m-1\}$. For $i\in\text{I}_{m}$, Alice inputs a message $\mathbb{x}_{i}$ in the causal past of $Q_{i}$, chosen from a set of possible messages previously agreed with Bob. Bob inputs a number $b\in\text{I}_{m}$ in the spacetime region $G$, which is defined as the intersection of the causal pasts of the spacetime points $Q_{0},Q_{1},\ldots,Q_{m-1}$, and he outputs $\mathbb{x}_{b}$ in $R_{b}$. We illustrate an example of a setting for one-out-of-$m$ SCOT in Fig. 2.

A one-out-of-$m$ SCOT protocol must satisfy correctness and security properties. Broadly speaking, the correctness property states that Bob obtains $\mathbb{x}_{b}$ in $R_{b}$, according to his input $b$, if Alice and Bob follow the protocol honestly. The security properties state: that if Bob follows the protocol honestly and Alice follows any dishonest strategy, Alice cannot learn Bob’s input $b$ anywhere in spacetime; and that if Alice follows the protocol honestly and Bob follows any dishonest strategy, Bob cannot obtain $\mathbb{x}_{i}$ in $R_{i}$ and $\mathbb{x}_{j}$ in $R_{j}$, for any pair of different numbers $i$ and $j$ from the set $\text{I}_{m}$. We state these properties more precisely below in the ideal case in which Bob’s outputs do not have any errors, and then in a scenario in which Bob’s outputs have a small fraction of errors. We consider that $b$ is initially completely unknown to Alice, i.e. from her perspective, Bob chooses $b$ randomly from $\text{I}_{m}$. Similarly, we consider that $\mathbb{x}_{i}$ is initially completely unknown to Bob, i.e. from his perspective, Alice chooses $\mathbb{x}_{i}$ randomly from the previously agreed set, for $i\in\text{I}_{m}$.

III.1 The ideal case of no errors

III.1.1 Correctness

For $\epsilon_{\text{cor}}\geq 0$, we say a SCOT protocol is $\epsilon_{\text{cor}}-$correct if, when Alice and Bob follow the protocol honestly, the probability $P$ that Bob outputs $\mathbb{x}_{b}$ in $R_{b}$ satisfies $P\geq 1-\epsilon_{\text{cor}}$, for any inputs $\mathbb{x}_{0},\mathbb{x}_{1},\ldots,\mathbb{x}_{m-1}$ by Alice from the agreed sets, and for any input $b\in\text{I}_{m}$ by Bob. We say a SCOT protocol is perfectly correct if it is $0-$correct.

III.1.2 Security

For $\epsilon_{\text{Alice}}\geq 0$, we say a SCOT protocol is $\epsilon_{\text{Alice}}-$secure against dishonest Alice if, when Bob follows the protocol honestly and Alice follows any cheating strategy, the probability $P_{\text{Alice}}$ that Alice guesses Bob’s input $b$ anywhere in spacetime satisfies $P_{\text{Alice}}\leq\frac{1}{m}+\epsilon_{\text{Alice}}$. We say a SCOT protocol is perfectly secure against dishonest Alice if it is $0-$secure against dishonest Alice. We say a SCOT protocol is unconditionally secure against dishonest Alice if it is $\epsilon_{\text{Alice}}-$secure against dishonest Alice with $\epsilon_{\text{Alice}}$ approaching zero by increasing some security parameter, for any cheating strategy by Alice that is allowed by quantum theory and relativity.

For $\epsilon_{\text{Bob}}\geq 0$, we say a SCOT protocol is $\epsilon_{\text{Bob}}-$secure against dishonest Bob if, when Alice follows the protocol honestly and Bob follows any cheating strategy, the probability $P_{\text{Bob}}$ that Bob outputs $\mathbb{x}_{i}$ in $R_{i}$ and $\mathbb{x}_{j}$ in $R_{j}$ satisfies $P_{\text{Bob}}\leq\epsilon_{\text{Bob}}$, for any pair of different numbers $i,j$ from the set $\text{I}_{m}$. Ideally, we would define a SCOT protocol to be unconditionally secure against dishonest Bob if it is $\epsilon_{\text{Bob}}-$secure against dishonest Bob with $\epsilon_{\text{Bob}}$ approaching $\frac{1}{d}$ by increasing some security parameter, for any cheating strategy by Bob that is allowed by quantum theory and relativity, where $d$ is the minimum of the number of possible values of $\mathbb{x}_{i}$, for $i\in\text{I}_{m}$. That is, ideally, we would like to guarantee that when a security parameter tends to infinity, Bob should not be able to do better than following the honest protocol to obtain some $\mathbb{x}_{b}$ in $R_{b}$ and to make a random guess of some other $\mathbb{x}_{j}$ in $R_{j}$. However, here we can satisfy a weaker definition of security: we say a SCOT protocol is unconditionally secure against dishonest Bob if it is $\epsilon_{\text{Bob}}-$secure against dishonest Bob with $\epsilon_{\text{Bob}}$ approaching zero by increasing the size of Alice’s input messages and possibly by increasing some other security parameters, for any cheating strategy by Bob that is allowed by quantum theory and relativity.

III.2 Tolerating a small fraction of errors

We generalize the previous definition of one-out-of-$m$ SCOT to allow a small fraction of errors in Bob’s output. We consider that Alice and Bob agree that Alice’s inputs are of the form $\mathbb{x}_{i}\in\{0,1\}^{n_{i}}$, for an agreed number $n_{i}\in\mathbb{N}$, and for $i\in\text{I}_{m}$. Alice and Bob agree on parameters $\gamma_{i}\geq 0$, for $i\in\text{I}_{m}$. In following sections we present protocols to implement one-out-of-$m$ SCOT considering the particular case $n_{i}=n$ and $\gamma_{i}=\gamma$, for $i\in\text{I}_{m}$.

III.2.1 Correctness

For $\epsilon_{\text{cor}}\geq 0$, we say a SCOT protocol is $\epsilon_{\text{cor}}-$correct if, when Alice and Bob follow the protocol honestly, the probability $P$ that Bob outputs a message $\mathbb{x}_{b}^{\prime}$ in $R_{b}$ satisfying $d(\mathbb{x}_{b}^{\prime},\mathbb{x}_{b})\leq n_{b}\gamma_{b}$ satisfies $P\geq 1-\epsilon_{\text{cor}}$, for any inputs $\mathbb{x}_{0},\mathbb{x}_{1},\ldots,\mathbb{x}_{m-1}$ by Alice from the agreed sets, and for any input $b\in\text{I}_{m}$ by Bob. We say a SCOT protocol is perfectly correct if it is $0-$correct.

III.2.2 Security

For $\epsilon_{\text{Bob}}\geq 0$, we say a SCOT protocol is $\epsilon_{\text{Bob}}-$secure against dishonest Bob if, when Alice follows the protocol honestly and Bob follows any cheating strategy, the probability $P_{\text{Bob}}$ that Bob outputs messages $\mathbb{x}_{i}^{\prime}$ in $R_{i}$ and $\mathbb{x}_{j}^{\prime}$ in $R_{j}$ satisfying $d(\mathbb{x}_{i}^{\prime},\mathbb{x}_{i})\leq n_{i}\gamma_{i}$ and $d(\mathbb{x}_{j}^{\prime},\mathbb{x}_{j})\leq n_{j}\gamma_{j}$ satisfies $P_{\text{Bob}}\leq\epsilon_{\text{Bob}}$, for any pair of different numbers $i$ and $j$ from the set $\text{I}_{m}$. We say a SCOT protocol is unconditionally secure against dishonest Bob if it is $\epsilon_{\text{Bob}}-$secure against dishonest Bob with $\epsilon_{\text{Bob}}$ approaching zero by increasing the size of Alice’s input messages and possibly some other security parameters, for any cheating strategy by Bob that is allowed by quantum theory and relativity. Security against dishonest Alice is defined as in the ideal case of no errors.

IV An unconditionally secure one-out-of-$m$ SCOT protocol $\mathcal{P}_{\text{QC}}$ with long-distance quantum communication

We introduce the protocol $\mathcal{P}_{\text{QC}}$ for one-out-of-$m$ SCOT, which extends straightforwardly the protocol for one-out-of-two SCOT of Ref. Pitalúa-García (2016). The label ‘QC’ stands for ‘quantum communication’, as the protocol $\mathcal{P}_{\text{QC}}$ requires quantum communication among Bob’s distant agents. The protocol $\mathcal{P}_{\text{QC}}$ uses a subroutine $\mathcal{P}_{\text{SR}}$ introduced below.

The setting is the following. Alice has trusted agents $\mathcal{A}$ and $\mathcal{A}_{i}$, for $i\in\text{I}_{m}$. Bob has trusted agents $\mathcal{B}$ and $\mathcal{B}_{i}$, for $i\in\text{I}_{m}$. Alice and Bob agree in a reference frame $\mathcal{F}$ and in $m$ pairwise spacelike separated output spacetime regions $R_{0},R_{1},\ldots,R_{m-1}$. Each of Alice’s (Bob’s) agents controls a secure laboratory. It is useful to consider that the agents $\mathcal{A}$ and $\mathcal{B}$ have adjacent laboratories, and that the agents $\mathcal{A}_{i}$ and $\mathcal{B}_{i}$ have adjacent laboratories, for $i\in\text{I}_{m}$. Alice’s agents share secure and authenticated classical channels, and Bob’s agents share secure and authenticated quantum channels. There is a quantum channel between $\mathcal{A}$ and $\mathcal{B}$. There is a classical channel between $\mathcal{A}_{i}$ and $\mathcal{B}_{i}$, for $i\in\text{I}_{m}$.

IV.1 The subroutine $\mathcal{P}_{\text{SR}}$

The following protocol was used as a subroutine in Ref. Pitalúa-García (2016) for the case $m=2$. We extend this protocol here for the case $m\geq 2$ and denote it as $\mathcal{P}_{\text{SR}}$.

Alice’s agent $\mathcal{A}$ encodes a random $n-$bit string $\mathbb{r}$ in a quantum state $\lvert\psi_{\mathbb{r}}^{\mathbb{s}}\rangle=\bigotimes_{j\in[n]}\lvert\psi_{r^{j}}^{s^{j}}\rangle$ of $n$ BB84 states, where $\mathbb{s}$ is a random $n-$bit string denoting the bases. $\mathcal{A}$ sends $\lvert\psi_{\mathbb{r}}^{\mathbb{s}}\rangle$ to $\mathcal{B}$, who receives it in $G$. 2. 2.

$\mathcal{B}$ obtains his input number $b\in\text{I}_{m}$ in $G$ and redirects the received state $\lvert\psi_{\mathbb{r}}^{\mathbb{s}}\rangle$ to his colleague $\mathcal{B}_{b}$, who receives it in the causal past of at least one spacetime point of $R_{b}$. 3. 3.

For $i\in\text{I}_{m}$, $\mathcal{A}$ sends a copy of $\mathbb{s}$ to her colleague $\mathcal{A}_{i}$, who receives it in the causal past of $Q_{i}$. 4. 4.

For $i\in\text{I}_{m}$, $\mathcal{A}_{i}$ gives $\mathbb{s}$ to $\mathcal{B}_{i}$ at the spacetime point $Q_{i}$. 5. 5.

$\mathcal{B}_{b}$ measures the quantum state $\lvert\psi_{\mathbb{r}}^{\mathbb{s}}\rangle$ in the basis labeled by $\mathbb{s}$, and obtains a $n-$bit string $\mathbb{r}^{\prime}$ in $R_{b}$.

IV.1.1 Correctness

In the ideal case in which there are not any errors nor any losses, Bob’s output $\mathbb{r}^{\prime}$ equals $\mathbb{r}$ with unit probability.

IV.1.2 Security against dishonest Alice

Since Bob does not transmit any physical systems to Alice, Alice cannot obtain any information about Bob’s input $b$. Thus, Alice cannot guess Bob’s input $b$ with probability greater than $\frac{1}{m}$.

IV.1.3 Security against dishonest Bob

For the case $m=2$, it was shown in Ref. Pitalúa-García (2016) that if Alice follows the protocol honestly and Bob follows an arbitrary cheating strategy allowed by quantum theory and relativity, the probability $P_{\text{Bob}}$ that Bob outputs $n-$bit strings $\mathbb{r}_{0}=\mathbb{r}$ in $R_{0}$ and $\mathbb{r}_{1}=\mathbb{r}$ in $R_{1}$ satisfies P_{\text{Bob}}\leq\bigl{(}\frac{1}{2}+\frac{1}{2\sqrt{2}}\bigr{)}^{n}. It was also shown that for a sufficiently small positive parameter $\gamma$, the probability $P_{\text{Bob}}^{\gamma}$ that Bob outputs $n-$bit strings $\mathbb{r}_{0}$ in $R_{0}$ and $\mathbb{r}_{1}$ in $R_{1}$ satisfying $d(\mathbb{r}_{0},\mathbb{r})\leq n\gamma$ and $d(\mathbb{r}_{1},\mathbb{r})\leq n\gamma$ decreases exponentially with $n$. In particular, we have $P_{\text{Bob}}^{\gamma}\leq(q_{\gamma})^{n}$, where q_{\gamma}=2^{2h(\gamma)}\bigl{(}\frac{1}{2}+\frac{1}{2\sqrt{2}}\bigr{)}<1, for $\gamma<0.015$, and where $h(\gamma)=-\gamma\log_{2}\gamma-(1-\gamma)\log_{2}(1-\gamma)$ denotes the binary entropy of $\gamma$ Pitalúa-García (2016). As we show below, these security properties hold for all $m\geq 2$.

Consider any pair of different numbers $i,j\in\text{I}_{m}$. In an arbitrary cheating strategy by Bob allowed by quantum theory and relativity in which he tries to output $\mathbb{r}_{i}=\mathbb{r}$ in $R_{i}$ and $\mathbb{r}_{j}=\mathbb{r}$ in $R_{j}$, $\mathcal{B}$ applies some quantum operation on the quantum state received from Alice and outputs two quantum systems $B_{0}$ and $B_{1}$ that he sends to his colleagues $\mathcal{B}_{i}$ and $\mathcal{B}_{j}$, respectively. Then, after receiving $\mathbb{s}$ form Alice’s agents, $\mathcal{B}_{i}$ and $\mathcal{B}_{j}$ apply respective measurements $\tilde{\text{M}}_{0,\mathbb{s}}$ and $\tilde{\text{M}}_{1,\mathbb{s}}$, and obtain respective measurement outcomes $\mathbb{r}_{i}$ and $\mathbb{r}_{j}$. This cheating strategy is the same as for the case $m=2$, where $i=0$ and $j=1$. Thus, we see that the security conditions stated in the previous paragraph hold for any pair of different numbers $i,j\in\text{I}_{m}$, both in the case of perfect outcomes, for which we have P_{\text{Bob}}\leq\bigl{(}\frac{1}{2}+\frac{1}{2\sqrt{2}}\bigr{)}^{n}; and in the case in which a small fraction of errors $\gamma\geq 0$ is tolerated, in particular $P_{\text{Bob}}^{\gamma}\leq(q_{\gamma})^{n}$, where q_{\gamma}=2^{2h(\gamma)}\bigl{(}\frac{1}{2}+\frac{1}{2\sqrt{2}}\bigr{)}<1, for $\gamma<0.015$.

IV.2 The one-out-of-$m$ SCOT protocol $\mathcal{P}_{\text{QC}}$

Alice and Bob implement the subroutine $\mathcal{P}_{\text{SR}}$, where $\mathbb{r}\in\{0,1\}^{n}$ is the message encoded by $\mathcal{A}$ in $G$ and $b\in\text{I}_{m}$ is $\mathcal{B}$’s input in $G$, and where $\mathbb{r}^{\prime}\in\{0,1\}^{n}$ is $\mathcal{B}_{b}$’s output in $R_{b}$. 2. 2.

For $i\in\text{I}_{m}$, $\mathcal{A}$ sends a copy of $\mathbb{r}$ to $\mathcal{A}_{i}$, who receives it in the causal past of $Q_{i}$. 3. 3.

For $i\in\text{I}_{m}$, $\mathcal{A}_{i}$ obtains her input message $\mathbb{x}_{i}\in\{0,1\}^{n}$ in the causal past of $Q_{i}$. 4. 4.

For $i\in\text{I}_{m}$, $\mathcal{A}_{i}$ gives $\mathbb{t}_{i}=\mathbb{x}_{i}\oplus\mathbb{r}$ to $\mathcal{B}_{i}$ at the spacetime point $Q_{i}$. 5. 5.

$\mathcal{B}_{b}$ computes the message $\mathbb{x}_{b}^{\prime}=\mathbb{r}^{\prime}\oplus\mathbb{t}_{b}$ and outputs it in $R_{b}$.

IV.2.1 Comments

Different variations of this protocol can be considered. For example, Bob’s agents having quantum memories have more freedom on the time at which they receive, process and transmit classical and quantum information. On the other hand, if Bob does not have any quantum memories, Bob’s agent $\mathcal{B}$ must redirect the quantum states as soon as he receives them from Alice’s agent $\mathcal{A}$; and the transmission of the quantum state from $\mathcal{A}$ to $\mathcal{B}$ must be completed within a sufficiently short time interval so that Bob’s agent $\mathcal{B}_{b}$ is able to complete the corresponding quantum measurement on it within the output spacetime region $R_{b}$; a physical implementation of this protocol seems plausible in some scenarios using photons as the physical systems encoding the quantum states, for example. Additionally, here we have considered that the subroutine $\mathcal{P}_{\text{SR}}$ is implemented with BB84 states, but generalizations with other sets of non-mutually orthogonal states can be devised. Furthermore, we note that Bob’s secure and authenticated quantum channels can be implemented via the teleportation Bennett et al. (1993) protocol if Bob’s agents share entangled states and authenticated classical channels, or via the quantum one-time pad Ambainis et al. (2000) if Bob’s agents share secret classical keys and authenticated quantum channels.

IV.2.2 Correctness

In the ideal case that there are not any errors nor any losses, Bob outputs $\mathbb{r}^{\prime}=\mathbb{r}$ in $R_{b}$ in the subroutine $\mathcal{P}_{\text{SR}}$, hence, Bob outputs $\mathbb{x}_{b}^{\prime}=\mathbb{x}_{b}$ in $R_{b}$ in the protocol $\mathcal{P}_{\text{QC}}$. In an implementation of $\mathcal{P}_{\text{SR}}$ in which Bob outputs $\mathbb{r}^{\prime}$ in $R_{b}$ satisfying $d(\mathbb{r}^{\prime},\mathbb{r})\leq\gamma n$, Bob’s output $\mathbb{x}_{b}^{\prime}$ in $R_{b}$ satisfies $d(\mathbb{x}_{b}^{\prime},\mathbb{x}_{b})\leq\gamma n$, for $\gamma\geq 0$.

IV.2.3 Security against dishonest Alice

Like in the subroutine $\mathcal{P}_{\text{SR}}$, Bob does not transmit any physical systems to Alice in the protocol $\mathcal{P}_{\text{QC}}$, hence, Alice cannot obtain any information about Bob’s input $b$. Thus, Alice cannot guess Bob’s input $b$ with probability greater than $\frac{1}{m}$. Therefore the protocol $\mathcal{P}_{\text{QC}}$ is perfectly secure against dishonest Alice.

IV.2.4 Security against dishonest Bob

For any pair of different numbers $i,j\in\text{I}_{m}$, the probability $P_{\text{Bob}}$ that Bob outputs $\mathbb{x}_{i}^{\prime}\in\{0,1\}^{n}$ in $R_{i}$ and $\mathbb{x}_{j}^{\prime}\in\{0,1\}^{n}$ in $R_{j}$ in the protocol $\mathcal{P}_{\text{QC}}$ satisfying $d(\mathbb{x}_{i}^{\prime},\mathbb{x}_{i})\leq n\gamma$ and $d(\mathbb{x}_{j}^{\prime},\mathbb{x}_{j})\leq n\gamma$ is equal to the probability that Bob outputs $\mathbb{r}_{i}\in\{0,1\}^{n}$ in $R_{i}$ and $\mathbb{r}_{j}\in\{0,1\}^{n}$ in $R_{j}$ in the subroutine $\mathcal{P}_{\text{SR}}$ satisfying $d(\mathbb{r}_{i},\mathbb{r})\leq n\gamma$ and $d(\mathbb{r}_{j},\mathbb{r})\leq n\gamma$. Thus, from the security properties of the subroutine $\mathcal{P}_{\text{SR}}$, it follows straightforwardly that if errors are not tolerated, i.e. if $\gamma=0$, the protocol $\mathcal{P}_{\text{QC}}$ is $\epsilon-$secure against dishonest Bob, with \epsilon=\bigl{(}\frac{1}{2}+\frac{1}{2\sqrt{2}}\bigr{)}^{n}. Since $\epsilon$ decreases exponentially with $n$, $\mathcal{P}_{\text{QC}}$ is unconditionally secure against dishonest Bob.

Similarly, if the protocol $\mathcal{P}_{\text{QC}}$ tolerates a fraction of errors $\gamma$, the protocol $\mathcal{P}_{\text{QC}}$ is $\epsilon_{\gamma}-$secure against dishonest Bob, with $\epsilon_{\gamma}=(q_{\gamma})^{n}$, where q_{\gamma}=2^{2h(\gamma)}\bigl{(}\frac{1}{2}+\frac{1}{2\sqrt{2}}\bigr{)}<1, for $\gamma<0.015$. Since $\epsilon_{\gamma}$ decreases exponentially with $n$, for $\gamma<0.015$, $\mathcal{P}_{\text{QC}}$ is unconditionally secure against dishonest Bob in this case too.

V One-out-of-$m$ distributed quantum access with classical memory

In this section we introduce a task that we denote as one-out-of-$m$ distributed quantum access with classical memory (DQACM), which for simplicity of the exposition we often refer to simply as DQACM. This task works as a primitive to construct one-out-of-$m$ SCOT protocols in which Bob’s agents only need to communicate classical information.

We define one-out-of-$m$ DQACM as follows. Previous to implementing a DQACM protocol, Alice and Bob agree on the integer $m\geq 2$; on finite sets of classical messages $\Omega_{0},\Omega_{1},\ldots,\Omega_{m-1}$, $\Omega_{\text{outcome}}\subseteq\Omega_{0}\times\Omega_{1}\times\cdots\times\Omega_{m-1}$, and $\Lambda_{\text{basis}}$; and on a set of quantum states \Delta=\{\bigl{\lvert}\Psi_{\mathbb{r}}^{\mathbb{s}}\bigr{\rangle}\big{|}\mathbb{r}\in\Omega_{\text{outcome}},\mathbb{s}\in\Lambda_{\text{basis}}\}. In general, we may set $\Omega_{\text{outcome}}\subseteq\Omega_{0}\times\Omega_{1}\times\cdots\times\Omega_{m-1}$, but here we consider $\Omega_{\text{outcome}}=\Omega_{0}\times\Omega_{1}\times\cdots\times\Omega_{m-1}$. A DQACM protocol consists of two stages.

In stage I, Alice encodes a string of messages $\mathbb{r}=(\mathbb{r}_{0},\mathbb{r}_{1},\ldots,\mathbb{r}_{m-1})\in\Omega_{\text{outcome}}$ in a quantum state \bigl{\lvert}\Psi_{\mathbb{r}}^{\mathbb{s}}\bigr{\rangle}_{A}\in\Delta of a quantum system $A$, using the extra classical message $\mathbb{s}\in\Lambda_{\text{basis}}$. The message $\mathbb{s}$ may indicate, for example, the basis used by Alice to prepare the state \bigl{\lvert}\Psi_{\mathbb{r}}^{\mathbb{s}}\bigr{\rangle}, from a set of possibly non-mutually orthogonal bases. Alice gives the quantum state \bigl{\lvert}\Psi_{\mathbb{r}}^{\mathbb{s}}\bigr{\rangle}_{A} to Bob. We consider that Alice’s inputs are initially secret to Bob, i.e. from Bob’s perspective, Alice chooses $\mathbb{r}_{i}$ randomly from $\Omega_{i}$, for $i\in\text{I}_{m}$, and $\mathbb{s}$ randomly from $\Lambda_{\text{basis}}$. Bob inputs a number $c\in\text{I}_{m}$, initially secret to Alice, i.e. from Alice’s perspective, Bob chooses $c$ randomly from $\text{I}_{m}$. Bob applies a quantum measurement $\text{M}_{c}$ on the received quantum state \bigl{\lvert}\Psi_{\mathbb{r}}^{\mathbb{s}}\bigr{\rangle}_{A} and obtains a classical measurement outcome $\mathbb{d}$.

Stage II consists of two steps. In the first step, Alice gives the classical message $\mathbb{s}$ to Bob. In the second step, Bob applies a function $f$ on $(c,\mathbb{d},\mathbb{s})$ giving as output a classical message $\mathbb{r}_{c}^{\prime}$, i.e. $\mathbb{r}_{c}^{\prime}=f(c,\mathbb{d},\mathbb{s})$.

Ideally, a protocol for one-out-of-$m$ DQACM should satisfy a correctness and a security condition. Broadly speaking, the correctness property says that if Alice and Bob follow the protocol honestly, Bob’s output $\mathbb{r}_{c}^{\prime}$ is equal to Alice’s input $\mathbb{r}_{c}$, or is sufficiently close to Alice’s input $\mathbb{r}_{c}$, according to a predetermined threshold. The security condition states that in distributed cheating strategies by Bob involving two agents of Bob, $\mathcal{B}_{0}$ and $\mathcal{B}_{1}$, who receive Alice’s message $\mathbb{s}$, and who cannot communicate with each other after receiving $\mathbb{s}$, $\mathcal{B}_{0}$ and $\mathcal{B}_{1}$ cannot both output Alice’s inputs $\mathbb{r}_{i}$ and $\mathbb{r}_{j}$ – or messages sufficiently close to $\mathbb{r}_{i}$ and $\mathbb{r}_{j}$, according to a predetermined threshold – respectively, for any pair of different numbers $i,j\in\text{I}_{m}$. Fig. 3 illustrates the task of one-out-of-$m$ DQACM.

We see that by construction, in the defined task of one-out-of-$m$ DQACM, Alice remains oblivious to Bob’s input $c$, as she does not receive any physical system from Bob. This obliviousness property, as well as the properties of correctness and security against dishonest Bob allow us to use one-out-of-$m$ DQACM to construct correct and secure one-out-of-$m$ SCOT.

We explain why we have denoted this task as ‘one-out-of-$m$ distributed quantum access with classical memory’. First, in the honest protocol Bob chooses to access one out of $m$ messages that Alice encodes in a quantum state. Second, in the honest protocol, we can consider that Bob has only classical memory, as he receives the quantum state from Alice and is forced to apply a quantum measurement and then apply further classical processing on his outcomes after receiving the classical message $\mathbb{s}$ from Alice. Third, in a dishonest cheating strategy by Bob, we can consider that he outputs two quantum systems $B_{0}$ and $B_{1}$ and distributes them to his agents $\mathcal{B}_{0}$ and $\mathcal{B}_{1}$, who without communicating – because they must obtain their outputs at spacelike separated spacetime regions, for instance – must respectively output Alice’s inputs $\mathbb{r}_{i}$ and $\mathbb{r}_{j}$ after receiving Alice’s classical message $\mathbb{s}$, for some pair of different numbers $i,j\in\text{I}_{m}$.

We define precisely the correctness and security conditions in two broad scenarios: an ideal scenario in which there are not errors in Bob’s output, and a more general scenario in which there is a small fraction of errors in Bob’s output.

V.1 The ideal case of no errors

V.1.1 Correctness

For $\epsilon_{\text{cor}}\geq 0$, we say a protocol to implement one-out-of-$m$ DQACM is $\epsilon_{\text{cor}}-$correct if, when Alice and Bob follow the protocol honestly, the probability $P$ that Bob outputs $\mathbb{r}_{c}$ satisfies $P\geq 1-\epsilon_{\text{cor}}$, for any input $c\in\text{I}_{m}$ by Bob. We say a protocol to implement one-out-of-$m$ DQACM is perfectly correct if it is $0-$correct.

V.1.2 Security

For $\epsilon_{\text{Bob}}\geq 0$, we say a protocol to implement one-out-of-$m$ DQACM is $\epsilon_{\text{Bob}}-$secure against dishonest Bob if, when Alice follows the protocol honestly, for any pair of different numbers $i$ and $j$ from the set $\text{I}_{m}$, for any quantum operation $O$ independent of $\mathbb{r}$ and independent of $\mathbb{s}$ applied by Bob on the quantum state $\lvert\Psi_{\mathbb{r}}^{\mathbb{s}}\rangle_{A}$ that produces at least two quantum systems $B_{0}$ and $B_{1}$, and for any sets of quantum measurements \bigl{\{}\tilde{\text{M}}_{0}^{\mathbb{s}}\bigr{\}}_{\mathbb{s}\in\Lambda_{\text{basis}}} and \bigl{\{}\tilde{\text{M}}_{1}^{\mathbb{s}}\bigr{\}}_{\mathbb{s}\in\Lambda_{\text{basis}}}, the probability to obtain respective outcomes $\mathbb{r}_{i}$ and $\mathbb{r}_{j}$, by respectively applying $\tilde{\text{M}}_{0}^{\mathbb{s}}$ on $B_{0}$ and $\tilde{\text{M}}_{1}^{\mathbb{s}}$ on $B_{1}$, is not greater than $\epsilon_{\text{Bob}}$. We say a protocol to implement one-out-of-$m$ DQACM is unconditionally secure against dishonest Bob if it is $\epsilon_{\text{Bob}}-$secure against dishonest Bob with $\epsilon_{\text{Bob}}$ approaching zero by increasing the size of Alice’s input messages and possibly some other security parameters.

V.2 Tolerating a small fraction of errors

We generalize the previous definition of one-out-of-$m$ DQACM to allow a small fraction of errors in Bob’s output. We consider that Alice and Bob agree that Alice’s inputs are of the form $\mathbb{r}_{i}\in\{0,1\}^{n_{i}}$, for an agreed number $n_{i}\in\mathbb{N}$, and for $i\in\text{I}_{m}$. Alice and Bob agree on parameters $\gamma_{i}\geq 0$, for $i\in\text{I}_{m}$.

V.2.1 Correctness

For $\epsilon_{\text{cor}}\geq 0$, we say a protocol to implement one-out-of-$m$ DQACM is $\epsilon_{\text{cor}}-$correct if, when Alice and Bob follow the protocol honestly, the probability $P$ that Bob outputs a message $\mathbb{r}_{c}^{\prime}$ satisfying $d(\mathbb{r}_{c}^{\prime},\mathbb{r}_{c})\leq n_{c}\gamma_{c}$ satisfies $P\geq 1-\epsilon_{\text{cor}}$, for any input $c\in\text{I}_{m}$ by Bob. We say a protocol to implement one-out-of-$m$ DQACM is perfectly correct if it is $0-$correct.

V.2.2 Security

For $\epsilon_{\text{Bob}}\geq 0$, we say a protocol to implement one-out-of-$m$ DQACM is $\epsilon_{\text{Bob}}-$secure against dishonest Bob if, when Alice follows the protocol honestly, for any pair of different numbers $i,j\in\text{I}_{m}$, for any quantum operation $O$ independent of $\mathbb{r}$ and independent of $\mathbb{s}$ applied by Bob on the quantum state $\lvert\Psi_{\mathbb{r}}^{\mathbb{s}}\rangle_{A}$ that produces at least two quantum systems $B_{0}$ and $B_{1}$, and for any sets of quantum measurements \bigl{\{}\tilde{\text{M}}_{0}^{\mathbb{s}}\bigr{\}}_{\mathbb{s}\in\Lambda_{\text{basis}}} and \bigl{\{}\tilde{\text{M}}_{1}^{\mathbb{s}}\bigr{\}}_{\mathbb{s}\in\Lambda_{\text{basis}}}, the probability to obtain respective outcomes $\mathbb{r}_{i}^{\prime}$ and $\mathbb{r}_{j}^{\prime}$ satisfying $d(\mathbb{r}_{i}^{\prime},\mathbb{r}_{i})\leq\gamma_{i}n_{i}$ and $d(\mathbb{r}_{j}^{\prime},\mathbb{r}_{j})\leq\gamma_{j}n_{j}$, by respectively applying $\tilde{\text{M}}_{0}^{\mathbb{s}}$ on $B_{0}$ and $\tilde{\text{M}}_{1}^{\mathbb{s}}$ on $B_{1}$, is not greater than $\epsilon_{\text{Bob}}$. We say a protocol to implement one-out-of-$m$ DQACM is unconditionally secure against dishonest Bob if it is $\epsilon_{\text{Bob}}-$secure against dishonest Bob with $\epsilon_{\text{Bob}}$ approaching zero by increasing the size of Alice’s input messages and possibly some other security parameters.

VI A class $\mathcal{C}$ of unconditionally secure protocols for one-out-of-$m$ DQACM

We introduce a class $\mathcal{C}$ of protocols to implement one-out-of-$m$ DQACM. We define a set $\Omega$ with $l$ distinct elements, for some integer $l\geq 2$. We define $\Lambda=\{(a_{0},a_{1},\ldots,a_{m-1})|a_{i}\in\text{I}_{m}~{}\text{and}~{}a_{i}\neq a_{i^{\prime}}~{}\text{if}~{}i\neq{i^{\prime}},~{}\text{for}~{}i,i^{\prime}\in\text{I}_{m}\}$, i.e. the set $\Lambda$ is in one-to-one correspondence with the set of permutations of $m$ distinct elements. We define $\Omega_{\text{outcome}}=\Omega^{nm}$ and $\Lambda_{\text{basis}}=\Lambda^{n}$. This means that we consider strings $\mathbb{s}=(s^{1},s^{2},\ldots,s^{n})\in\Lambda^{n}$, $\mathbb{r}_{i}=(r_{i}^{1},r_{i}^{2},\ldots,r_{i}^{n})\in\Omega^{n}$ and $\mathbb{r}=(\mathbb{r}_{0},\mathbb{r}_{1},\ldots,\mathbb{r}_{m-1})\in\Omega^{nm}$, i.e. with $s^{j}=(s_{0}^{j},s_{1}^{j},\ldots,s^{j}_{m-1})\in\Lambda$ and $r_{i}^{j}\in\Omega$, for $j\in[n]$ and $i\in\text{I}_{m}$. We note that the number of elements of the set $\Lambda$ is $m!$, hence, the number of elements of the set $\Lambda^{n}$ is $(m!)^{n}$. Similarly, as the number of elements of the set $\Omega$ is $l$, the number of elements of the set $\Omega^{n}$ is $(l)^{n}$.

Alice generates the quantum state $\lvert\Psi_{\mathbb{r}}^{\mathbb{s}}\rangle_{A}$ encoded in a quantum system with Hilbert space $A$, where the strings $\mathbb{s}\in\Lambda^{n}$ and $\mathbb{r}_{i}\in\Omega^{n}$ are randomly generated by her, for $i\in\text{I}_{m}$. Alice gives the quantum state $\lvert\Psi_{\mathbb{r}}^{\mathbb{s}}\rangle_{A}$ to Bob. The quantum state is of the form

[TABLE]

where $\mathbb{r}=(\mathbb{r}_{0},\mathbb{r}_{1},\ldots,\mathbb{r}_{m-1})$ denotes the string of $m$ messages encoded by Alice, and where the Hilbert space $A$ is a tensor product of $mn$ Hilbert spaces $A_{i}^{j}$, as follows,

[TABLE]

with the dimension of the Hilbert space $A_{i}^{j}$ being equal to $l$ for all $j\in[n]$ and all $i\in\text{I}_{m}$, and where $\mathcal{D}_{i}=\{\lvert\alpha_{r}^{i}\rangle\}_{r\in\Omega}$ is an orthonormal basis of an $l$-dimensional Hilbert space, for $i\in\text{I}_{m}$. We define

[TABLE]

where the maximum is taken over all $r,r^{\prime}\in\Omega$ and over all $i,i^{\prime}\in\text{I}_{m}$ with $i\neq i^{\prime}$.

Bob generates his input $c\in\text{I}_{m}$ and applies a quantum measurement $\text{M}_{c}$ on the received quantum state $\lvert\Psi_{\mathbb{r}}^{\mathbb{s}}\rangle_{A}$. The quantum measurement $\text{M}_{c}$ consists in measuring the quantum subsystem $A_{i}^{j}$ of $A$ in the basis $\mathcal{D}_{c}$, whose classical measurement outcome is denoted by $d_{i}^{j}$, for $j\in[n]$ and $i\in\text{I}_{m}$. We denote $d^{j}=(d_{0}^{j},d_{1}^{j},\ldots,d_{m-1}^{j})$, for $j\in[n]$, and Bob’s total classical measurement outcome by $\mathbb{d}=(d^{1},d^{2},\ldots,d^{n})$. We note that the outcomes satisfy $d^{j}_{s^{j}_{c}}=r^{j}_{c}$, because the quantum system $A^{j}_{s^{j}_{c}}$ is prepared by Alice in the quantum state \bigl{\lvert}\alpha_{r_{c}^{j}}^{c}\bigr{\rangle}, i.e. in the basis $\mathcal{D}_{c}$ encoding the classical outcome $r_{c}^{j}$, for $j\in[n]$. Thus, for $c\in\text{I}_{m}$, following the protocol honestly and using $c$, $\mathbb{d}$ and $\mathbb{s}$, Bob can decode Alice’s input $\mathbb{r}_{c}$, i.e. there exists a function $f$ that when applied on $(c,\mathbb{d},\mathbb{s})$ gives as output Alice’s input $\mathbb{r}_{c}$. Therefore, in the ideal case that there are not errors nor losses, the protocols of this class are perfectly correct.

In order to guarantee security against dishonest Bob, the set of bases $\{\mathcal{D}_{i}\}_{i\in\text{I}_{m}}$ is chosen to satisfy the constraint

[TABLE]

For fixed values of $l$ and $m$, the smaller the value of $\lambda$ is, the greater the security that can be guaranteed. For this reason, it is preferable that the bases $\mathcal{D}_{i}$ are mutually unbiased, i.e. that $\lvert\langle\alpha_{r}^{i}|\alpha_{r^{\prime}}^{i^{\prime}}\rangle\rvert^{2}=l^{-1}$ for all $r,r^{\prime}\in\Omega$ and all $i,i^{\prime}\in\text{I}_{m}$ with $i\neq i^{\prime}$, in which case $\lambda=l^{-1}$. For example, in the case $m=2$, we can set $l=2$, and a pair of mutually unbiased bases can be given by the computational and Hadamard bases.

In order to quantitatively prove the security against dishonest Bob in the examples given in this section, we also require that the set of bases $\{\mathcal{D}_{i}\}_{i\in\text{I}_{m}}$ satisfies the constraint that there exists a maximally entangled state $\lvert\phi\rangle$ of two $l$-dimensional quantum systems $a$ and $a^{\prime}$ such that $\lvert\phi\rangle$ can be expressed by

[TABLE]

for all $i\in\text{I}_{m}$.

From (2) – (6), we show below that if the protocols of the class defined above do not tolerate any errors in Bob’s output then they are $\epsilon_{\text{Bob}}-$secure against dishonest Bob, with

[TABLE]

Thus, since $\lambda<1$ as given by (5), we have that $\epsilon_{\text{Bob}}\rightarrow 0$ exponentially with $n$, meaning that the protocol is unconditionally secure against dishonest Bob.

We can straightforwardly extend the class of protocols above to tolerate a small fraction of errors. For example, consider protocols with $\Omega=\{0,1\}$, i.e. $\mathbb{r}_{i}$ is a string of $n$ bits, for $i\in\text{I}_{m}$. Bob’s output $\mathbb{r}_{c}^{\prime}$ may be considered correct if $d(\mathbb{r}_{c}^{\prime},\mathbb{r}_{c})\leq n\gamma$ for some small allowed error rate $\gamma\geq 0$, i.e. if the number of bit errors in $\mathbb{r}_{c}^{\prime}$ with respect to $\mathbb{r}_{c}$ is not greater than $n\gamma$, for $c\in\text{I}_{m}$. In this case, we show below that the considered protocols are $\epsilon_{\text{Bob}}^{\gamma}-$secure against dishonest Bob with

[TABLE]

for some $\gamma\in(0,\Gamma_{m}^{(\lambda)})$, where $\Gamma_{m}^{(\lambda)}$ is the smallest solution to the following equation

[TABLE]

which satisfies $\Gamma_{m}^{(\lambda)}\leq\frac{1}{2}$, where we recall that $h(\gamma)$ denotes the binary entropy of $\gamma$. We note from (9) that since $\gamma<\Gamma_{m}^{(\lambda)}$, the term inside the brackets in (8) is smaller than unity, hence, $\epsilon_{\text{Bob}}^{\gamma}$ given by (8) decreases exponentially with $n$. Thus, the protocols are unconditionally secure against dishonest Bob.

We give two specific examples below of protocols for one-out-of-$m$ DQACM of the previous class that satisfy (2) – (6), from which the security bounds (7) and (8) follow.

VI.1 Example 1

We consider the case $m=l=2$ with $\Omega=\{0,1\}$. We set the state $\lvert\phi\rangle=\lvert\Phi^{+}\rangle$, where $\lvert\Phi^{+}\rangle$ is the Bell state

[TABLE]

Since $l=2$, $\mathcal{D}_{0}$ and $\mathcal{D}_{1}$ are qubit orthogonal bases, which without loss of generality we fix on the same plane of the Bloch sphere. Without loss of generality we set $\mathcal{D}_{0}$ to be the computational basis, given by the states $\lvert\alpha_{r}^{0}\rangle=\lvert r\rangle$, for $r\in\{0,1\}$. The basis $\mathcal{D}_{1}$ is defined by the states

[TABLE]

for $r\in\{0,1\}$ and for some \theta\in\bigl{(}0,\pi\bigr{)}. In this example, we have

[TABLE]

Since \theta\in\bigl{(}0,\pi\bigr{)}, we have $\lambda<1$, hence, (5) holds. It is easy to see that $\lvert\alpha_{0}^{1}\rangle\lvert\alpha_{0}^{1}\rangle+\lvert\alpha_{1}^{1}\rangle\lvert\alpha_{1}^{1}\rangle=\lvert 0\rangle\lvert 0\rangle+\lvert 1\rangle\lvert 1\rangle$ for any $\theta$, hence, by setting $\lvert\phi\rangle=\lvert\Phi^{+}\rangle$, (6) holds too. From (7), in this example we have that the DQACM protocol is $\epsilon^{\theta}-$secure against dishonest Bob, with

[TABLE]

where $\lambda$ is given by (12). Since $\epsilon^{\theta}$ decreases exponentially with $n$, the DQACM protocol is unconditionally secure against dishonest Bob, for $\theta\in(0,\pi)$.

In this example, in order to enhance the security, it is preferable to have $\theta=\frac{\pi}{2}$, in which case $\mathcal{D}_{0}$ and $\mathcal{D}_{1}$ correspond respectively to the computational and Hadamard bases, which are mutually unbiased, giving from (12) the value $\lambda=\frac{1}{2}$. In this case, it follows from (13) that the DQACM protocol is $\epsilon^{\frac{\pi}{2}}-$secure against dishonest Bob, with

[TABLE]

VI.2 Example 2

We set arbitrary $m\geq 2$, with $\Omega=\{0,1\}$, hence $l=2$. Since $l=2$, $\mathcal{D}_{i}$ are qubit orthogonal bases, for $i\in\text{I}_{m}$. We set the bases to lie on the same plane of the Bloch sphere. Without loss of generality we set this plane to be the $x$-$z$ plane, and we set the basis $\mathcal{D}_{0}$ to lie on the $z$ axis, i.e. $\mathcal{D}_{0}$ is the computational basis, which is given by the states $\lvert\alpha_{r}^{0}\rangle=\lvert r\rangle$, for $r\in\{0,1\}$. The other bases can be expressed by the states

[TABLE]

for $r\in\{0,1\}$, for different parameters \theta_{i}\in\bigl{(}0,\pi\bigr{)}, for $i\in\{1,2,\ldots,m-1\}$, which without loss of generality we order like $\theta_{1}<\theta_{2}<\cdots<\theta_{m-1}$. In this example, we can set

[TABLE]

for $i\in\{1,2,\ldots,m-1\}$, which gives

[TABLE]

satisfying (5), for $m\geq 2$. As in the Example 1 above, we set $\lvert\phi\rangle=\lvert\Phi^{+}\rangle$, given by (10), which as above satisfies (6). From (7), in this example we have that the DQACM protocol is $\epsilon_{m}-$secure against dishonest Bob, with

[TABLE]

Since $\epsilon_{m}$ decreases exponentially with $n$, the DQACM protocol is unconditionally secure against dishonest Bob, for $m\geq 2$.

VI.3 Security against dishonest Bob

We show below that the class $\mathcal{C}$ of DQACM protocols described in this section satisfying (2) – (6) are $\epsilon_{\text{Bob}}-$secure against dishonest Bob in the case that errrors in Bob’s output are not tolerated, and $\epsilon_{\text{Bob}}^{\gamma}-$secure against dishonest Bob in the case that a small fraction $\gamma$ of errors is tolerated, with $\epsilon_{\text{Bob}}$ and $\epsilon_{\text{Bob}}^{\gamma}$ given by (7) and (8), respectively.

By definition, security against dishonest Bob is analyzed with respect to cheating strategies of the following form. Bob receives the quantum state \bigl{\lvert}\Psi_{\mathbb{r}}^{\mathbb{s}}\bigr{\rangle}_{A} from Alice in the quantum system $A$. Bob then applies any quantum operation $O$ on the quantum state \bigl{\lvert}\Psi_{\mathbb{r}}^{\mathbb{s}}\bigr{\rangle}_{A}, and possibly and ancillary quantum system $E$ or arbitrary finite Hilbert space dimension. Bob then partitions his total system $AE$ into two quantum systems $B_{0}$ and $B_{1}$. After receiving $\mathbb{s}$ from Alice, Bob applies a quantum measurement $\tilde{\text{M}}_{0}^{\mathbb{s}}$ on $B_{0}$ and a quantum measurement $\tilde{\text{M}}_{1}^{\mathbb{s}}$ on $B_{1}$, whose respective outcomes are denoted by $\mathbb{e}_{0}$ and $\mathbb{e}_{1}$. We show below that the probability $p_{n}$ that Bob’s outputs satisfy $\mathbb{e}_{0}=\mathbb{r}_{l_{0}}$ and $\mathbb{e}_{1}=\mathbb{r}_{l_{1}}$ satisfies

[TABLE]

for any pair of different numbers $l_{0},l_{1}\in\text{I}_{m}$. We also show that for Alice’s inputs of the form $\mathbb{r}_{0},\mathbb{r}_{1},\ldots,\mathbb{r}_{m-1}\in\{0,1\}^{n}$, the probability $p_{n}^{\prime}$ that Bob’s outputs satisfiy $d(\mathbb{e}_{0},\mathbb{r}_{l_{0}})\leq n\gamma$ and $d(\mathbb{e}_{1},\mathbb{r}_{l_{1}})\leq n\gamma$ satisfies

[TABLE]

for any pair of different numbers $l_{0},l_{1}\in\text{I}_{m}$, and for some $\gamma\in(0,\Gamma_{m}^{(\lambda)})$, where $\Gamma_{m}^{(\lambda)}$ is the smallest solution to the equation

[TABLE]

which satisfies $\Gamma_{m}^{(\lambda)}\leq\frac{1}{2}$. Thus, from (7) – (9), and from (19) – (21), it follows that the class of DQACM protocols described in this section satisfying (2) – (6) are $\epsilon_{\text{Bob}}-$secure against dishonest Bob in the case that errors in Bob’s output are not tolerated, and $\epsilon_{\text{Bob}}^{\gamma}-$secure against dishonest Bob in the case that a small fraction $\gamma$ of errors is tolerated, with $\epsilon_{\text{Bob}}$ and $\epsilon_{\text{Bob}}^{\gamma}$ given by (7) and (8), respectively.

The most general quantum operation $O$ consists in performing some joint unitary operation $U$, independent of $\mathbb{s}$ and independent of $\mathbb{r}$, on the quantum state $\lvert\Psi_{\mathbb{r}}^{\mathbb{s}}\rangle$ of the quantum system $A$ and a fixed quantum state $\lvert\chi\rangle$ of an ancillary system $E$, which we assume to be of arbitrary finite Hilbert space dimension, to obtain the state

[TABLE]

where for simplifying notation we have written $\mathbb{r}=(\mathbb{r}_{0},\mathbb{r}_{1},\ldots,\mathbb{r}_{m-1})$, where $AE=B_{0}B_{1}$, and where the quantum systems $B_{0}$ and $B_{1}$ have arbitrary finite dimensions. Bob partitions the global system $AE$ into two quantum systems $B_{0}$ and $B_{1}$. Then, for $i\in\{0,1\}$, Bob applies a projective measurement $\tilde{\text{M}}_{i}^{\mathbb{s}}=\{\Pi_{i\mathbb{s}}^{\mathbb{e}_{i}}\}_{\mathbb{e}_{i}\in\Omega^{n}}$ on $B_{i}$ and obtains the outcome $\mathbb{e}_{i}$. Bob’s cheating probability $p_{n}$ is given by

[TABLE]

where $\mathbb{r}\in\Omega^{nm}$ denotes that $\mathbb{r}_{i}\in\Omega^{n}$ for $i\in\text{I}_{m}$, as we have used the notation $\mathbb{r}=(\mathbb{r}_{0},\mathbb{r}_{1},\ldots,\mathbb{r}_{m-1})$, and where we recall that $l_{0},l_{1}\in\text{I}_{m}$ with $l_{0}\neq l_{1}$. Then, using (2) – (6), and in particular, using the property of non-perfect distinguishability of non-orthogonal quantum states exploited in Alice’s quantum state preparation (2), as quantified by (4) and (5), we show the bound (19) below.

From (19) and (23), it is straightforward to derive (20). Consider a projective measurement $\tilde{\text{M}}_{i}^{\mathbb{s},\mathbb{a}}=\{\Pi_{i\mathbb{s}}^{\mathbb{e}_{i}\oplus\mathbb{a}}\}_{\mathbb{e}_{i}\in\Omega^{n}}$ on $B_{i}$ for any $n-$bit string $\mathbb{a}$ in the case $\Omega=\{0,1\}$ and $\lvert\Omega\rvert=l=2$, where we recall that ‘$\oplus$’ denotes bit-wise sum modulo 2. Extending (23), Bob’s cheating probability $p_{n}^{\prime}$ is given by

[TABLE]

where we recall that $w(\mathbb{a})$ denotes the Hamming weight of the $n-$bit string $\mathbb{a}$, i.e. the number of bit entries of $\mathbb{a}$ equal to ‘1’. The bound (19) applies for any pair of projective measurements on $B_{0}$ and $B_{1}$, hence, in particular for the projective measurement $\tilde{\text{M}}_{i}^{\mathbb{s},\mathbb{a}}=\{\Pi_{i\mathbb{s}}^{\mathbb{e}_{i}\oplus\mathbb{a}}\}_{\mathbb{e}_{i}\in\Omega^{n}}$ on $B_{i}$, for $\mathbb{a}\in\{0,1\}^{n}$ and $i\in\{0,1\}$. It follows from (19), (23) and (24) that

[TABLE]

where in the second line we have used that the number of $n-$bit strings $\mathbb{a}$ with Hamming weight not greater than $n\gamma$ is upper bounded by $2^{nh(\gamma)}$, for $\gamma\leq\frac{1}{2}$, which is shown in section 1.4 of Ref. van Lint (1999), and where $h(\gamma)$ is the binary entropy of $\gamma$. The bound (20) follows.

VI.3.1 Proof of the bound (19)

We note that our protocol is mathematically equivalent to the following procedure. First, Alice takes the following actions. She prepares a pair of $l$-dimensional quantum systems $C^{j}_{i}$ and $A^{j}_{i}$ in the state $\lvert\phi\rangle_{C^{j}_{i}A^{j}_{i}}$ given by (6) , for $i\in\text{I}_{m}$ and $j\in[n]$. More precisely, Alice prepares a global quantum system with Hilbert space $C\otimes A$, where $A$ is given by (3), and similarly $C$ is given by

[TABLE]

The quantum system $CA$ is prepared in the quantum state

[TABLE]

Alice keeps the system $C$ and she sends the system $A$ to Bob. Then, Alice measures $C$ in the orthonormal basis \bigl{\{}\bigl{\lvert}\Psi_{\mathbb{r}}^{\mathbb{s}}\bigr{\rangle}\bigr{\}}_{\mathbb{r}\in\Omega^{nm}} according to her random value of $\mathbb{s}\in\Lambda^{n}$, where $\mathbb{r}=(\mathbb{r}_{0},\mathbb{r}_{1},\ldots,\mathbb{r}_{m-1})\in\Omega^{nm}$ means that $\mathbb{r}_{i}\in\Omega^{n}$, for $i\in\text{I}_{m}$. With probability $l^{-mn}$, Alice measures \bigl{\lvert}\Psi_{\mathbb{r}}^{\mathbb{s}}\bigr{\rangle}_{C} and $A$ projects into the state $\lvert\Psi_{\mathbb{r}}^{\mathbb{s}}\rangle_{A}$. Bob’s unitary operation $U$ in his cheating strategy commutes with Alice’s measurements. Thus, we can consider that the global system $CB_{0}B_{1}$, before Alice’s and Bob’s measurement are implemented, is in the state

[TABLE]

where we recall that $B_{0}B_{1}=AE$, $E$ is an ancilla, and $B_{0}$ and $B_{1}$ have arbitrary finite Hilbert space dimensions. Then, Alice measures $C$ in the orthonormal basis \bigl{\{}\bigl{\lvert}\Psi_{\mathbb{r}}^{\mathbb{s}}\bigr{\rangle}\bigr{\}}_{\mathbb{r}\in\Omega^{nm}} according to her random value of $\mathbb{s}\in\Lambda^{n}$. With probability $l^{-mn}$, Alice measures \bigl{\lvert}\Psi_{\mathbb{r}}^{\mathbb{s}}\bigr{\rangle}_{C} and $B_{0}B_{1}$ projects into the state $\lvert\Phi_{\mathbb{r}}^{\mathbb{s}}\rangle_{B_{0}B_{1}}$. After receiving $\mathbb{s}$, Bob applies the projective measurement $\tilde{\text{M}}_{i}^{\mathbb{s}}$ on $B_{i}$, for $i\in\{0,1\}$.

Thus, Bob’s cheating probability $p_{n}$ given by (23) equals

[TABLE]

where \Psi=\bigl{(}\lvert\Psi\rangle\langle\Psi\rvert\bigr{)}_{CB_{0}B_{1}} and

[TABLE]

where we recall that $l_{0},l_{1}\in\text{I}_{m}$ and $l_{0}\neq l_{1}$.

We derive the bound (19) with the help of two lemmas of Ref. Tomamichel et al. (2013). Before stating these lemmas we provide some useful notation. We denote by $\mathcal{H}$ the Hilbert space of the global system $CB_{0}B_{1}$, which as said before is arbitrary but finite dimensional. We denote by $\mathcal{L}(\mathcal{H})$ and by $\mathcal{P}(\mathcal{H})$ the sets of linear operators and of positive semi-definite operators on $\mathcal{H}$, respectively. For $A,B\in\mathcal{L}(\mathcal{H})$, the expression $A\geq B$ means that $A-B\in\mathcal{P}(\mathcal{H})$. For $A\in\mathcal{L}(\mathcal{H})$, $\lVert A\rVert$ denotes the Schatten $\infty-$norm of $A$, which gives the largest singular value of $A$, and which coincides with its largest eigenvalue if $A\in\mathcal{P}(\mathcal{H})$.

Lemma 1**.**

*(Ref. Tomamichel et al. (2013))

Let $A,B,L\in\mathcal{L}(\mathcal{H})$ such that $A^{\dagger}A\geq B^{\dagger}B$. Then, it holds that $\lVert AL\rVert\geq\lVert BL\rVert$.*

Lemma 2**.**

*(Ref. Tomamichel et al. (2013))

Let $D_{1},D_{2},\ldots,D_{N}\in\mathcal{P}(\mathcal{H})$, and let $\{s_{k}\}_{k\in[N]}$ be a set of $N$ mutually orthogonal permutations of $[N]$. Then*

[TABLE]

It follows from Lemma 1 that for $A,A^{\prime},B,B^{\prime}\in\mathcal{P}(\mathcal{H})$ satisfying $A^{\prime}\geq A$ and $B^{\prime}\geq B$, it holds that $\lVert\sqrt{A^{\prime}}\sqrt{B^{\prime}}\rVert\geq\lVert\sqrt{A^{\prime}}\sqrt{B}\lVert\geq\lVert\sqrt{A}\sqrt{B}\rVert$ Tomamichel et al. (2013). Thus, if $A,A^{\prime},B,B^{\prime}$ are projectors on $\mathcal{H}$ satisfying $A^{\prime}\geq A$ and $B^{\prime}\geq B$ then $\lVert A^{\prime}B^{\prime}\rVert\geq\lVert AB\rVert$. We use this property below.

To use Lemma 2, we consider the set of permutations of $\mathbb{s}\in\Lambda^{n}$ labeled by $\mathbb{v}=(v^{1},v^{2},\ldots,v^{n})\in\Lambda^{n}$ and given by $\mathbb{s}\rightarrow\mathbb{s}_{\mathbb{v}}=(s_{\mathbb{v}}^{1},s_{\mathbb{v}}^{2},\ldots,s_{\mathbb{v}}^{n})$ with s_{\mathbb{v}}^{j}=\bigl{(}s_{v^{j},0}^{j},s_{v^{j},1}^{j},\ldots,s_{v^{j},m-1}^{j}\bigr{)} being a permutation $v^{j}\in\Lambda$ of $s^{j}=(s_{0}^{j},s_{1}^{j},\ldots,s_{m-1}^{j})$, for $j\in[n]$. This is a set of $(m!)^{n}$ mutually orthogonal permutations, that is, $\mathbb{s}_{\mathbb{v}}\neq\mathbb{s}_{\mathbb{w}}$ if $\mathbb{v}\neq\mathbb{w}$, for all $\mathbb{s}\in\Lambda^{n}$. To see this, consider a pair of different elements $\mathbb{v},\mathbb{w}$ from the set $\Lambda^{n}$ and any $\mathbb{s}\in\Lambda^{n}$. Since $\mathbb{v}\neq\mathbb{w}$, there exists at least a $j^{\prime}\in[n]$ such that $v^{j^{\prime}}\neq w^{j^{\prime}}$, hence, s_{\mathbb{v}}^{j^{\prime}}=\bigl{(}s_{v^{j^{\prime}},0}^{j^{\prime}},s_{v^{j^{\prime}},1}^{j^{\prime}},\ldots,s_{v^{j^{\prime}},m-1}^{j^{\prime}}\bigr{)} and s_{\mathbb{w}}^{j^{\prime}}=\bigl{(}s_{w^{j^{\prime}},0}^{j^{\prime}},s_{w^{j^{\prime}},1}^{j^{\prime}},\ldots,s_{w^{j^{\prime}},m-1}^{j^{\prime}}\bigr{)} are different permutations of $s^{j^{\prime}}=(s_{0}^{j^{\prime}},s_{1}^{j^{\prime}},\ldots,s_{m-1}^{j^{\prime}})$, which means that $s_{\mathbb{v}}^{j^{\prime}}\neq s_{\mathbb{w}}^{j^{\prime}}$ and therefore that $\mathbb{s}_{\mathbb{v}}\neq\mathbb{s}_{\mathbb{w}}$.

We have

[TABLE]

where in the first line we used the linearity of the trace, in the second line we used the definition of the Schatten $\infty-$norm, and in the last line we used Lemma 2 and the fact that $D_{\mathbb{s}}$ and $D_{\mathbb{s}_{\mathbb{v}}}$ are projectors.

In the following we use the notation $\mathbb{r}=(\mathbb{r}_{0},\mathbb{r}_{1},\ldots,\mathbb{r}_{m-1})\in\Omega^{nm}$, where $\mathbb{r}_{i}\in\Omega^{n}$, for $i\in\text{I}_{m}$. We define the projectors

[TABLE]

for $\mathbb{s},\mathbb{v}\in\Lambda^{n}$. We see that $F_{\mathbb{s}}$ and $G_{\mathbb{s}_{\mathbb{v}}}$ satisfy $D_{\mathbb{s}}\leq F_{\mathbb{s}}$ and $D_{\mathbb{s}_{\mathbb{v}}}\leq G_{\mathbb{s}_{\mathbb{v}}}$, for $\mathbb{s},\mathbb{v}\in\Lambda^{n}$. Thus, we have from Lemma 1 that

[TABLE]

where the equality follows from the property $\lVert A\rVert^{2}=\lVert AA^{\dagger}\rVert=\lVert A^{\dagger}A\rVert$ for any $A\in\mathcal{L}(\mathcal{H})$ Tomamichel et al. (2013) and from the fact that $F_{\mathbb{s}}$ and $G_{\mathbb{s}_{\mathbb{v}}}$ are projectors. Then we show in the Appendix A that

[TABLE]

where \omega_{\mathbb{v}}=\bigl{\lvert}\{j\in[n]|s_{v^{j},l_{1}}^{j}=s_{l_{0}}^{j}\}\bigr{\rvert}, that is, $\omega_{\mathbb{v}}$ is the number of entries $v^{j}$ of $\mathbb{v}$ corresponding to a permutation that takes $(a_{0},a_{1},\ldots,a_{m-1})\in\Lambda$ into $(?,\ldots,?,a_{l_{0}},?,\ldots,?)\in\Lambda$, where $a_{l_{0}}$ is in the $l_{1}$th entry, and where ‘?’ denotes any allowed entry after the permutation. For example, in the case $l_{0}=0$ and $l_{1}=1$, \omega_{\mathbb{v}}=\bigl{\lvert}\{j\in[n]|s_{v^{j},1}^{j}=s_{0}^{j}\}\bigr{\rvert} is the number of entries $v^{j}$ of $\mathbb{v}$ corresponding to a permutation that takes $(a_{0},a_{1},\ldots,a_{m-1})\in\Lambda$ into $(?,a_{0},?,\ldots,?)\in\Lambda$, where ‘?’ denotes any allowed entry after the permutation. As explicitly stated by the notation, we see that $\omega_{\mathbb{v}}$ only depends on $\mathbb{v}$, but not on $\mathbb{s}$. Thus, since for a fixed $\mathbb{v}\in\Lambda^{n}$, the upper bound on $\lVert F_{\mathbb{s}}G_{\mathbb{s}_{\mathbb{v}}}F_{\mathbb{s}}\rVert$ given by (34) is the same for any $\mathbb{s}\in\Lambda^{n}$, we have from (31), (33) and (34) that

[TABLE]

We also note that the value of $\omega_{\mathbb{v}}$ does not depend on the values of $l_{0},l_{1}$, for any pair of different numbers $l_{0},l_{1}\in\text{I}_{m}$; hence, the bound (35) holds for any pair of different numbers $l_{0},l_{1}\in\text{I}_{m}$.

We compute the sum in (35). There are exactly \bigl{(}\begin{smallmatrix}n\\ \omega\end{smallmatrix}\bigr{)}\bigl{(}(m-1)!\bigr{)}^{\omega}\bigl{(}m!-(m-1)!\bigr{)}^{n-\omega} values of $\mathbb{v}\in\Lambda^{n}$ satisfying $\omega_{\mathbb{v}}=\omega$. We can see this as follows. Consider a $\mathbb{v}\in\Lambda^{n}$ such that $\omega_{\mathbb{v}}=\omega$. For this $\mathbb{v}$, there are $\omega$ entries $v^{j}$ which are permutations of $m$ distinct elements that take $(a_{0},a_{1},\ldots,a_{m-1})\in\Lambda$ into $(?,\ldots,?,a_{l_{0}},?,\ldots,?)\in\Lambda$, where $a_{l_{0}}$ is in the $l_{1}$th entry. There are $(m-1)!$ possible permutations that take $(a_{0},a_{1},\ldots,a_{m-1})\in\Lambda$ into $(?,\ldots,?,a_{l_{0}},?,\ldots,?)\in\Lambda$, where $a_{l_{0}}$ is in the $l_{1}$th entry, and $m!-(m-1)!$ that do not. Let us write a $n$-bit string $f_{\mathbb{v}}$ whose $j$th entry is $1$ if $v^{j}$ is a permutation of the form $(a_{0},a_{1},\ldots,a_{m-1})\rightarrow(?,\ldots,?,a_{l_{0}},?,\ldots,?)\in\Lambda$, where $a_{l_{0}}$ is in the $l_{1}$th entry, or [math] otherwise. Thus, the number of elements $\mathbb{v}\in\Lambda^{n}$ for which $f_{\mathbb{v}}$ has $\omega$ entries equal to $1$ and the rest $n-\omega$ entries equal to [math] is \bigl{(}\begin{smallmatrix}n\\ \omega\end{smallmatrix}\bigr{)}\bigl{(}(m-1)!\bigr{)}^{\omega}\bigl{(}m!-(m-1)!\bigr{)}^{n-\omega}. Thus, from (35), we have

[TABLE]

which is the claimed bound (19).

VII A class $\mathcal{P}_{CC}$ of unconditionally secure one-out-of-$m$ SCOT protocols with long-distance classical communication

By implementing one-out-of-$m$ DQACM as a subroutine, the following class $\mathcal{P}_{\text{CC}}$ of one-out-of-$m$ SCOT protocols only requires classical communication among Bob’s distant agents. Alice and Bob agree on a reference frame $\mathcal{F}$ in spacetime, on $m$ pairwise spacelike separated output spacetime regions $R_{0},R_{1},\ldots,R_{m-1}$, and on a spacetime point $Q_{i}$ of $R_{i}$, for $i\in\text{I}_{m}$; they also agree on Alice’s message $\mathbb{x}_{i}$ in the causal past of $Q_{i}$ being from the set $\Omega_{i}=\{0,1\}^{n}$, for some $n\in\mathbb{N}$, and on a maximum allowed error rate $\gamma_{i}=\gamma\geq 0$ on Bob’s outputs, for $i\in\text{I}_{m}$. We recall that $G$ is the spacetime region consisting in the intersection of the causal pasts of the spacetime points $Q_{0},Q_{1},\ldots,Q_{m-1}$. We consider that from Bob’s perspective, Alice’s inputs $\mathbb{x}_{i}\in\{0,1\}^{n}$ are random, for $i\in\{0,1\}^{n}$; and that from Alice’s perspective, Bob’s input $b\in\text{I}_{m}=\{0,1,\ldots,m-1\}$ is random.

Alice has trusted agents $\mathcal{A},\mathcal{A}_{0},\mathcal{A}_{1},\ldots,\mathcal{A}_{m-1}$, and Bob has trusted agents $\mathcal{B},\mathcal{B}_{0},\mathcal{B}_{1},\ldots,\mathcal{B}_{m-1}$. Each of Alice’s (Bob’s) agents controls a secure laboratory. It is helpful to consider that $\mathcal{A}$ and $\mathcal{B}$ have adjacent laboratories, and that $\mathcal{A}_{i}$ and $\mathcal{B}_{i}$ have adjacent laboratories, for $i\in\text{I}_{m}$. Alice’s (Bob’s) agents share secure and authenticated classical channels. There is a classical channel and a quantum channel between $\mathcal{A}$ and $\mathcal{B}$, and there is a classical channel between $\mathcal{A}_{i}$ and $\mathcal{B}_{i}$, for $i\in\text{I}_{m}$. It is possible that $\mathcal{A}$ and $\mathcal{A}_{j}$ ($\mathcal{B}$ and $\mathcal{B}_{j}$) are the same agent, for some $j\in\text{I}_{m}$.

The class $\mathcal{P}_{\text{CC}}$ of one-out-of-$m$ SCOT protocols extends the one-out-of-two SCOT protocol of Ref. Pitalúa-García and Kerenidis (2018). It consists of two stages. Stage I includes quantum communication between the agents $\mathcal{A}$ and $\mathcal{B}$, which can take place within their adjacent laboratories, and which can take an arbitrarily long time, but which must be completed within $G$. For $i\in\text{I}_{m}$, stage II includes fast classical processing and communication between the agents $\mathcal{A}_{i}$ and $\mathcal{B}_{i}$, which can take place within their adjacent laboratories; it also includes classical communication between the – possibly distant – pairs of agents $\mathcal{A}$ and $\mathcal{A}_{i}$, and $\mathcal{B}$ and $\mathcal{B}_{i}$. The actions performed in the steps 1 to 6 take place within $G$, unless otherwise stated. Fig. 4 illustrates the class $\mathcal{P}_{\text{CC}}$ of one-out-of-$m$ SCOT protocols.

VII.1 Stage I

Alice’s agent $\mathcal{A}$ and Bob’s agent $\mathcal{B}$ implement the stage I of a one-out-of-$m$ DQACM protocol with random inputs $\mathbb{s}\in\Lambda_{\text{basis}}$ and $\mathbb{r}_{i}\in\{0,1\}^{n}$ by Alice, and a random input $c\in\text{I}_{m}$ by Bob, for $i\in\text{I}_{m}$. This consists in $\mathcal{A}$ sending to $\mathcal{B}$ a quantum state $\lvert\Psi_{\mathbb{r}}^{\mathbb{s}}\rangle$ encoding $\mathbb{r}=(\mathbb{r}_{0},\mathbb{r}_{1},\ldots,\mathbb{r}_{m-1})$ in a basis labeled by $\mathbb{s}$, $\mathcal{B}$ applying a quantum measurement $\text{M}_{c}$ on the received quantum state, and $\mathcal{B}$ obtaining a classical measurement outcome $\mathbb{d}$. The stage I of the DQACM protocol is completed in the spacetime region $G$. 2. 2.

$\mathcal{A}$ sends copies of $\mathbb{s},\mathbb{r}_{0},\mathbb{r}_{1},\ldots,\mathbb{r}_{m-1}$ to $\mathcal{A}_{i}$, who receives them in the causal past of $Q_{i}$, for $i\in\text{I}_{m}$. 3. 3.

$\mathcal{B}$ transmits $c$ and $\mathbb{d}$ to $\mathcal{B}_{i}$, who receives these in the causal past of $Q_{i}$, for $i\in\text{I}_{m}$.

VII.2 Stage II

Within $G$, $\mathcal{B}$ generates his SCOT input $b\in\text{I}_{m}$, and transmits the number $b^{\prime}=b+c$ modulo $m$ to $\mathcal{A}$, who receives it within $G$. 2. 5.

For $i\in\text{I}_{m}$, $\mathcal{B}$ transmits $b$ to $\mathcal{B}_{i}$, who receives it in the causal past of $Q_{i}$. 3. 6.

For $i\in\text{I}_{m}$, $\mathcal{A}$ transmits $b^{\prime}$ to $\mathcal{A}_{i}$, who receives it in the causal past of $Q_{i}$. 4. 7.

For $i\in\text{I}_{m}$, $\mathcal{A}_{i}$ generates $\mathbb{x}_{i}$ in the causal past of $Q_{i}$, and gives $\mathbb{t}_{i}=\mathbb{r}_{b^{\prime}-i}\oplus\mathbb{x}_{i}$ to $\mathcal{B}_{i}$ at $Q_{i}$, where $b^{\prime}-i$ is modulo $m$. 5. 8.

For $i\in\text{I}_{m}$, $\mathcal{A}_{i}$ gives $\mathbb{s}$ to $\mathcal{B}_{i}$ at $Q_{i}$. This corresponds to the first step in stage II of the DQACM protocol. 6. 9.

Within the spacetime region $R_{b}$, $\mathcal{B}_{b}$ uses $\mathbb{s}$, $\mathbb{d}$ and $c$ to obtain the output $\mathbb{r}_{c}$ (or $\mathbb{r}_{c}^{\prime}$ close to $\mathbb{r}_{c}$ according to a predetermined threshold) of the DQACM protocol. This corresponds to the second step in stage II of the DQACM protocol. 7. 10.

Within $R_{b}$, $\mathcal{B}_{b}$ outputs $\mathbb{x}_{b}=\mathbb{r}_{c}\oplus\mathbb{t}_{b}$ (or $\mathbb{x}_{b}^{\prime}=\mathbb{r}_{c}^{\prime}\oplus\mathbb{t}_{b}$, which is close to $\mathbb{x}_{b}$ according to a predetermined threshold).

VII.3 Comments and variations

We note that the class $\mathcal{P}_{\text{CC}}$ of one-out-of-$m$ SCOT protocols shares various important properties with the one-out-of-two SCOT protocol of Ref. Pitalúa-García and Kerenidis (2018). First, $\mathcal{B}$ has the freedom to choose $b$ after he has measured the quantum state received from $\mathcal{A}$. Thus, the quantum communication and quantum measurement steps can take an arbitrarily long time, but they must be completed within $G$. Second, Alice has the freedom to choose her inputs $\mathbb{x}_{0}$, $\mathbb{x}_{1},\ldots,\mathbb{x}_{m-1}$ in real time, i.e. $\mathcal{A}_{i}$ can generate $\mathbb{x}_{i}$ anywhere in the causal past of $Q_{i}$, for $i\in\text{I}_{m}$. Third, different variations of the protocols can be considered. For example, if $\mathcal{B}$ does not send $b$ to $\mathcal{B}_{i}$, $\mathcal{B}_{i}$ can act assuming that $b=i$, for $i\in\text{I}_{m}$. In particular, for $i\in\text{I}_{m}$, independently of whether $\mathcal{B}$ sends $b$ to $\mathcal{B}_{i}$, $\mathcal{B}_{i}$ can output a message $\mathbb{r}_{c}^{\prime}$ that is equal to (or close to) Alice’s input $\mathbb{r}_{c}$ (see Fig. 4); although this does not allow $\mathcal{B}_{i}$ to obtain $\mathbb{x}_{i}$ (or a message $\mathbb{x}_{i}^{\prime}$ close to $\mathbb{x}_{i}$, unless $i=b$) as shown below.

VII.4 Correctness

We assume that the DQACM subroutine is $\epsilon_{\text{cor}}-$correct in the case that an error rate $\gamma\geq 0$ on Bob’s output $\mathbb{r}_{c}^{\prime}$ is tolerated, for $c\in\text{I}_{m}$. This means that $d(\mathbb{r}_{c}^{\prime},\mathbb{r}_{c})\leq\gamma n$ with probability not smaller than $1-\epsilon_{\text{cor}}$, for $c\in\text{I}_{m}$. Therefore, $d(\mathbb{x}_{b}^{\prime},\mathbb{x}_{b})\leq\gamma n$ with probability not smaller than $1-\epsilon_{\text{cor}}$, for $b\in\text{I}_{m}$. It follows that the one-out-of-$m$ SCOT protocols from the class $\mathcal{P}_{\text{CC}}$ are $\epsilon_{\text{cor}}-$correct in the case that an error rate $\gamma\geq 0$ on Bob’s output $\mathbb{x}_{b}^{\prime}$ is tolerated, for $b\in\text{I}_{m}$.

VII.5 Security against dishonest Alice

Neither in the DQACM subroutine, nor in the whole one-out-of-$m$ SCOT protocol, Bob gives Alice any physical systems. Thus, Alice cannot obtain any information about Bob’s SCOT input $b\in\text{I}_{m}$. It follows that the SCOT protocol is perfectly secure against dishonest Alice.

VII.6 Security against dishonest Bob

We assume that the DQACM subroutine is $\epsilon_{\text{Bob}}-$secure against dishonest Bob. We show that the one-out-of-$m$ SCOT protocol from the class $\mathcal{P}_{\text{CC}}$ is $\epsilon_{\text{Bob}}-$secure against dishonest Bob. It follows that if the DQACM subroutine is unconditionally secure against dishonest Bob, i.e. if $\epsilon_{\text{Bob}}$ goes to zero by increasing the number of bits $n$ of Alice’s input messages and possibly some other security parameters, then the SCOT protocol is unconditionally secure.

In order to show security against dishonest Bob, we assume that Alice follows the one-out-of-$m$ SCOT protocol honestly and Bob applies an arbitrary cheating strategy allowed by quantum theory and relativity. Consider a general cheating strategy by Bob in which he outputs a message $\mathbb{x}_{i}^{\prime}\in\{0,1\}^{n}$ in $R_{i}$ and a message $\mathbb{x}_{j}^{\prime}\in\{0,1\}^{n}$ in $R_{j}$, which in a successful cheating strategy are equal to – or very close to – Alice’s inputs $\mathbb{x}_{i}$ and $\mathbb{x}_{j}$, respectively, for some pair of different numbers $i,j\in\text{I}_{m}$. Given that Alice’s inputs $\mathbb{r}_{0},\mathbb{r}_{1},\ldots,\mathbb{r}_{m-1}\in\{0,1\}^{n}$ are random, and that $\mathcal{A}_{i}$ gives the message $\mathbb{t}_{i}=\mathbb{r}_{b^{\prime}-i}\oplus\mathbb{x}_{i}$ to $\mathcal{B}_{i}$ at $Q_{i}$, and $\mathcal{A}_{j}$ gives the message $\mathbb{t}_{j}=\mathbb{r}_{b^{\prime}-j}\oplus\mathbb{x}_{j}$ to $\mathcal{B}_{j}$ at $Q_{j}$, the goal of Bob’s cheating strategy is that $\mathcal{B}_{i}$ and $\mathcal{B}_{j}$ obtain respective strings $\mathbb{r}_{b^{\prime}-i}^{\prime}$ and $\mathbb{r}_{b^{\prime}-j}^{\prime}$, in $R_{i}$ and $R_{j}$, that are equal to – or close to – $\mathbb{r}_{b^{\prime}-i}$ and $\mathbb{r}_{b^{\prime}-j}$ with high probability, so that $\mathcal{B}_{i}$ outputs $\mathbb{x}_{i}^{\prime}=\mathbb{r}_{b^{\prime}-i}^{\prime}\oplus\mathbb{t}_{i}$ in $R_{i}$ and $\mathcal{B}_{j}$ outputs $\mathbb{x}_{j}^{\prime}=\mathbb{r}_{b^{\prime}-j}^{\prime}\oplus\mathbb{t}_{j}$ in $R_{j}$, which are equal to – or close to – $\mathbb{x}_{i}$ and $\mathbb{x}_{j}$, respectively, with high probability.

Therefore, Bob’s general strategy consists of three main steps. In the first step, Bob’s agent $\mathcal{B}$ receives the quantum state $\lvert\Psi_{\mathbb{r}}^{\mathbb{s}}\rangle$ in a quantum system $A$ from Alice’s agent $\mathcal{A}$ and applies a quantum operation $O$ on $A$ and an extra ancillary system $E$ consisting in a unitary operation $U$ on $AE$, independent of $\mathbb{r}$ and independent of $\mathbb{s}$, producing two quantum systems $B_{0}$ and $B_{1}$, including also a measurement $\tilde{\text{M}}^{\prime}$ producing a classical outcome $(b^{\prime},i,j)\in\Gamma$ encoded in a system $B^{\prime\prime}$, where we define $\Gamma=\{(k,i,j)\in\text{I}_{m}\times\text{I}_{m}\times\text{I}_{m}|i\neq j\}$. $\mathcal{B}$ then sends $b^{\prime}$ to $\mathcal{A}$ (who sends $b^{\prime}$ to $\mathcal{A}_{k}$, for $k\in\text{I}_{m}$) and he sends the classical message $(b^{\prime},i,j)$ encoded in a classical system $B_{0}^{\prime\prime}$ and the quantum system $B_{0}$ to Bob’s agent $\mathcal{B}_{i}$, and the classical message $(b^{\prime},i,j)$ encoded in a classical system $B_{1}^{\prime\prime}$ and the quantum system $B_{1}$ to Bob’s agent $\mathcal{B}_{j}$. Thus, $\mathcal{B}$ sends $B_{0}B_{0}^{\prime\prime}$ to $\mathcal{B}_{i}$ and $B_{1}B_{1}^{\prime\prime}$ to $\mathcal{B}_{j}$, while $B^{\prime\prime}$ is held by $\mathcal{B}$, except for $b^{\prime}$, which $\mathcal{B}$ sends to $\mathcal{A}$.

In the second step, after reception of $\mathbb{s}$ from $\mathcal{A}_{i}$, and after reception of the classical message $(b^{\prime},i,j)$ and of the quantum system $B_{0}$ from $\mathcal{B}$, $\mathcal{B}_{i}$ applies a quantum measurement $\tilde{\text{M}}_{0,b^{\prime},i,j}^{\mathbb{s}}$ – depending on both $\mathbb{s}$ and $(b^{\prime},i,j)$ – on $B_{0}$ and obtains the guess $\mathbb{r}_{b^{\prime}-i}^{\prime}$ of $\mathbb{r}_{b^{\prime}-i}$. Similarly, after reception of $\mathbb{s}$ from $\mathcal{A}_{j}$, and after reception of the classical message $(b^{\prime},i,j)$ and of the quantum system $B_{1}$ from $\mathcal{B}$, $\mathcal{B}_{j}$ applies a quantum measurement $\tilde{\text{M}}_{1,b^{\prime},i,j}^{\mathbb{s}}$ on $B_{1}$ and obtains the guess $\mathbb{r}_{b^{\prime}-j}^{\prime}$ of $\mathbb{r}_{b^{\prime}-j}$.

As shown in the Appendix B, the two steps above are mathematically equivalent to the following situation. More precisely, for any pair of different numbers $i,j\in\text{I}_{m}$, we show that the joint probability that Bob’s agent $\mathcal{B}_{i}$ obtains a particular outcome $\mathbb{r}_{b^{\prime}-i}^{\prime}$ as his guess of $\mathbb{r}_{b^{\prime}-i}$ and Bob’s agent $\mathcal{B}_{j}$ obtains a particular outcome $\mathbb{r}_{b^{\prime}-j}^{\prime}$ as his guess of $\mathbb{r}_{b^{\prime}-j}$ in the procedure of the two steps above is the same in the procedure described in the paragraph below.

Bob’s agent $\mathcal{B}$ applies a quantum operation $O^{\prime}$ on the received quantum state $\lvert\Psi_{\mathbb{r}}^{\mathbb{s}}\rangle_{A}$ and an extra ancillary system $E^{\prime}=EB_{0}^{\prime\prime}B_{1}^{\prime\prime}B^{\prime\prime}$, producing two quantum systems $B_{0}^{\prime}=B_{0}B_{0}^{\prime\prime}B^{\prime\prime}$ and $B_{1}^{\prime}=B_{1}B_{1}^{\prime\prime}$. The operation $O^{\prime}$ consists in $\mathcal{B}$ applying the unitary operation $U$ on $AE$ of the quantum operation $O$ above, partitioning $AE$ into two subsystems $B_{0}$ and $B_{1}$, applying the quantum measurement $\tilde{\text{M}}^{\prime}$ on $B_{0}B_{1}$ and preparing each of the quantum systems $B_{0}^{\prime\prime}$, $B_{1}^{\prime\prime}$ and $B^{\prime\prime}$ in a quantum state $\lvert\mu_{b^{\prime},i,j}\rangle$, conditioned on the outcome of $\tilde{\text{M}}^{\prime}$ being $(b^{\prime},i,j)$, for $(b^{\prime},i,j)\in\Gamma$, where $\{\lvert\mu_{b^{\prime},i,j}\rangle\}_{(b^{\prime},i,j)\in\Gamma}$ is an orthonormal basis of each of the quantum systems $B_{0}^{\prime\prime}$, $B_{1}^{\prime\prime}$ and $B^{\prime\prime}$. Conditioned on the outcome of $\tilde{\text{M}}^{\prime}$ being $(b^{\prime},i,j)$, $\mathcal{B}$ sends $b^{\prime}$ to Alice’s agent $\mathcal{A}$ in part of the system $B^{\prime\prime}$, and $\mathcal{B}$ sends the joint system $B_{0}B_{0}^{\prime\prime}$ ($B_{1}B_{1}^{\prime\prime}$) to Bob’s agent $\mathcal{B}_{i}$ ($\mathcal{B}_{j}$). A quantum measurement $\tilde{\text{M}}_{0}^{\mathbb{s}}$ is applied on the joint system $B_{0}^{\prime}=B_{0}B_{0}^{\prime\prime}B^{\prime\prime}$, with $\mathcal{B}_{i}$ obtaining the outcome $r_{b^{\prime}-i}^{\prime}$ from $B_{0}B_{0}^{\prime\prime}$, which is his guess of $\mathbb{r}_{b^{\prime}-i}$. Bob’s agent $\mathcal{B}_{j}$ applies a quantum measurement $\tilde{\text{M}}_{1}^{\mathbb{s}}$ on the joint system $B_{1}^{\prime}=B_{1}B_{1}^{\prime\prime}$ and obtains a classical outcome $r_{b^{\prime}-j}^{\prime}$, which is his guess of $\mathbb{r}_{b^{\prime}-j}$.

Finally, in the third step, after reception of the message $\mathbb{t}_{i}$ from $\mathcal{A}_{i}$, $\mathcal{B}_{i}$ computes his guess $\mathbb{x}_{i}^{\prime}=\mathbb{r}_{b^{\prime}-i}^{\prime}\oplus\mathbb{t}_{i}$ of $\mathbb{x}_{i}$ and outputs it in $R_{i}$. Similarly, after reception of $\mathbb{t}_{j}$ from $\mathcal{A}_{j}$, $\mathcal{B}_{j}$ computes his guess $\mathbb{x}_{j}^{\prime}=\mathbb{r}_{b^{\prime}-j}^{\prime}\oplus\mathbb{t}_{j}$ of $\mathbb{x}_{j}$ and outputs it in $R_{j}$.

By assumption, the DQACM subroutine is $\epsilon_{\text{Bob}}-$secure against dishonest Bob. By definition, since we assume that Alice follows the protocol honestly, for any pair of different numbers $k$ and $l$ from the set $\text{I}_{m}$, for any quantum operation $O^{\prime}$ independent of $\mathbb{r}$ and independent of $\mathbb{s}$ applied by Bob on the quantum state $\lvert\Psi_{\mathbb{r}}^{\mathbb{s}}\rangle_{A}$ that produces at least two quantum systems $B_{0}^{\prime}$ and $B_{1}^{\prime}$, and for any sets of quantum measurements \bigl{\{}\tilde{\text{M}}_{0}^{\mathbb{s}}\bigr{\}}_{\mathbb{s}\in\Lambda_{\text{basis}}} and \bigl{\{}\tilde{\text{M}}_{1}^{\mathbb{s}}\bigr{\}}_{\mathbb{s}\in\Lambda_{\text{basis}}}, the probability to obtain respective outcomes $\mathbb{r}_{k}^{\prime}$ and $\mathbb{r}_{l}^{\prime}$ satisfying $d(\mathbb{r}_{k}^{\prime},\mathbb{r}_{k})\leq\gamma n$ and $d(\mathbb{r}_{l}^{\prime},\mathbb{r}_{l})\leq\gamma n$, by respectively applying $\tilde{\text{M}}_{0}^{\mathbb{s}}$ on $B_{0}^{\prime}$ and $\tilde{\text{M}}_{1}^{\mathbb{s}}$ on $B_{1}^{\prime}$, is not greater than $\epsilon_{\text{Bob}}$. Thus, by considering $k=b^{\prime}-i$ and $l=b^{\prime}-j$, we see from the first and second steps of Bob’s general cheating strategy in the one-out-of-$m$ SCOT protocol, that the probability that Bob’s agents $\mathcal{B}_{i}$ and $\mathcal{B}_{j}$ output $\mathbb{r}_{b^{\prime}-i}^{\prime}$ in $R_{i}$ and $\mathbb{r}_{b^{\prime}-j}^{\prime}$ in $R_{j}$ satisfying $d(\mathbb{r}_{b^{\prime}-i}^{\prime},\mathbb{r}_{b^{\prime}-i})\leq\gamma n$ and $d(\mathbb{r}_{b^{\prime}-j}^{\prime},\mathbb{r}_{b^{\prime}-j})\leq\gamma n$, respectively, is not greater than $\epsilon_{\text{Bob}}$. Since in the third step of Bob’s cheating strategy $\mathcal{B}_{i}$ outputs $\mathbb{x}_{i}^{\prime}=\mathbb{r}_{b^{\prime}-i}^{\prime}\oplus\mathbb{t}_{i}$ in $R_{i}$ and $\mathcal{B}_{j}$ outputs $\mathbb{x}_{j}^{\prime}=\mathbb{r}_{b^{\prime}-j}^{\prime}\oplus\mathbb{t}_{j}$ in $R_{j}$, and since $\mathbb{x}_{i}=\mathbb{r}_{b^{\prime}-i}\oplus\mathbb{t}_{i}$ and $\mathbb{x}_{j}=\mathbb{r}_{b^{\prime}-j}\oplus\mathbb{t}_{j}$, it follows that the probability that Bob’s agents $\mathcal{B}_{i}$ and $\mathcal{B}_{j}$ output $\mathbb{x}_{i}^{\prime}$ in $R_{i}$ and $\mathbb{x}_{j}^{\prime}$ in $R_{j}$ satisfying $d(\mathbb{x}_{i}^{\prime},\mathbb{x}_{i})\leq\gamma n$ and $d(\mathbb{x}_{j}^{\prime},\mathbb{x}_{j})\leq\gamma n$, respectively, is not greater than $\epsilon_{\text{Bob}}$. This means, by definition, that the one-out-of-$m$ SCOT protocol is $\epsilon_{\text{Bob}}-$secure against dishonest Bob, as claimed.

VII.7 Examples

We consider that the DQACM subroutine belongs to the class $\mathcal{C}$ introduced in section VI with $l=2$, i.e. with inputs by Alice $\mathbb{r}_{i}\in\{0,1\}^{n}$ for $i\in\text{I}_{m}$. We consider separately the case where no errors in Bob’s output are tolerated and the case where a small fraction of errors is tolerated in Bob’s outputs.

We consider first the ideal case of no errors. In this case, the DQACM subroutine is perfectly correct, i.e $0-$correct. It follows that a one-out-of-$m$ SCOT protocol of the class $\mathcal{P}_{\text{CC}}$ using this DQACM subroutine is perfectly correct in the ideal case of no errors.

The class $\mathcal{C}$ of DQACM protocols with $l=2$ is $\epsilon_{\text{Bob}}-$secure against dishonest Bob, with $\epsilon_{\text{Bob}}$ given by (7), hence, unconditionally secure against dishonest Bob, as $\epsilon_{\text{Bob}}$ decreases exponentially with $n$. It follows that a one-out-of-$m$ SCOT protocol of the class $\mathcal{P}_{\text{CC}}$ using this DQACM subroutine is $\epsilon_{\text{Bob}}-$secure against dishonest Bob, with $\epsilon_{\text{Bob}}$ given by (7), hence, unconditionally secure against dishonest Bob. For example, consider that the DQACM subroutine is given by the protocol of Example 2 in section VI.2. In this case, the DQACM protocol is $\epsilon_{m}-$secure against dishonest Bob, with $\epsilon_{m}$ given by (18). Thus, from the arguments above, the one-out-of-$m$ SCOT protocol is $\epsilon_{m}-$secure against dishonest Bob, with $\epsilon_{m}$ given by (18). Since $\epsilon_{m}$ decreases exponentially with $n$, the SCOT protocol is unconditionally secure against dishonest Bob.

Now we consider the case where a small fraction of errors is tolerated in Bob’s outputs. In the case that the fraction of bit errors in Bob’s output in the DQACM subroutine is below a threshold $\gamma^{\prime\prime}\geq 0$, the DQACM subroutine is perfectly correct by setting the allowed error rate $\gamma^{\prime}$ equal or greater than $\gamma^{\prime\prime}$. Thus, the SCOT protocol of the class $\mathcal{P}_{\text{CC}}$ using this DQACM subroutine is perfectly correct in the case that a maximum allowed error rate $\gamma$ on Bob’s SCOT outputs is set to a value equal or greater than $\gamma^{\prime}$.

The class $\mathcal{C}$ of DQACM protocols with $l=2$ is $\epsilon_{\text{Bob}}^{\gamma}-$secure against dishonest Bob, with $\epsilon_{\text{Bob}}^{\gamma}$ given by (8), hence, unconditionally secure against dishonest Bob, as $\epsilon_{\text{Bob}}^{\gamma}$ decreases exponentially with $n$, if $\gamma\leq\Gamma_{m}^{(\lambda)}$, where $\Gamma_{m}^{(\lambda)}$ is the smallest solution of the equation (9). It follows that a one-out-of-$m$ SCOT protocol of the class $\mathcal{P}_{\text{CC}}$ using this DQACM subroutine is $\epsilon_{\text{Bob}}^{\gamma}-$secure against dishonest Bob, with $\epsilon_{\text{Bob}}^{\gamma}$ given by (8), hence, unconditionally secure against dishonest Bob, if $\gamma\leq\Gamma_{m}^{(\lambda)}$, where $\Gamma_{m}^{(\lambda)}$ is the smallest solution of the equation (9).

VIII Generalizations

We note that the one-out-of-$m$ SCOT protocols of the class $\mathcal{P}_{\text{CC}}$ use one-out-of-$m$ DQACM protocols as a fundamental primtive. In the one-out-of-$m$ DQACM protocols, Alice’s agent $\mathcal{A}$ encodes $m$ random messages $\mathbb{r}_{0},\mathbb{r}_{1},\ldots,\mathbb{r}_{m-1}$ from the agreed sets in a quantum state that she gives to Bob’s agent $\mathcal{B}$ in a spacetime region $G$, in such a way that the probability that Bob obtains Alice’s input $\mathbb{r}_{i}$ – or a message $\mathbb{r}_{i}^{\prime}$ very close to $\mathbb{r}_{i}$ – in a spacetime region $R$, and also Alice’s input $\mathbb{r}_{j}$ – or a message $\mathbb{r}_{j}^{\prime}$ very close to $\mathbb{r}_{j}$ – in a spacetime region $R^{\prime}$ that is spacelike separated from $R$, is very small, for any pair of different numbers $i,j$ from the set $\text{I}_{m}$. We can then use the one-out-of-$m$ DQACM primitive to consider more general SCOT schemes, as we illustrate below. We can also extend the definition of DQACM, which allows us to further generalize the definition of SCOT.

VIII.1 Using a one-out-of-$m$ DQACM subroutine to implement generalized versions of SCOT

Consider a more general setting for SCOT in a spacetime that is Minkowski or close to Minkowski. Alice and Bob agree on a reference frame $\mathcal{F}$ in spacetime. Alice and Bob agree on $M\geq 2$ pairwise spacelike separated output spacetime regions $R_{0},R_{1},\ldots,R_{M-1}$, and on a spacetime point $Q_{i}$ of $R_{i}$, for $i\in\text{I}_{M}$. Alice inputs messages $\mathbb{x}_{i}^{j}\in\Omega_{i}^{j}$ in the causal past of $Q_{i}$, for $j\in[N_{i}]$, where the set $\Omega_{i}^{j}$ and the number $N_{i}\in\mathbb{N}$ are previously agreed by Alice and Bob, for $i\in\text{I}_{M}$.

For some previously agreed integer $m\geq 2$, Alice and Bob perform a one-out-of-$m$ DQACM subroutine. Alice encodes random messages $\mathbb{r}_{0},\mathbb{r}_{1},\ldots,\mathbb{r}_{m-1}$ from sets previously agreed with Bob in a quantum state $\lvert\Psi_{\mathbb{r}}^{\mathbb{s}}\rangle$, where $\mathbb{s}$ denotes a basis randomly chosen by Alice from a set $\Lambda_{\text{basis}}$ of non-mutually orthogonal bases previously agreed with Bob, and where we denote $\mathbb{r}=(\mathbb{r}_{0},\mathbb{r}_{1},\ldots,\mathbb{r}_{m-1})$. Bob receives the quantum state $\lvert\Psi_{\mathbb{r}}^{\mathbb{s}}\rangle$ from Alice in the spacetime region $G$, which is the intersection of the causal pasts of $Q_{0},Q_{1},\ldots,Q_{M-1}$. Bob inputs a number $b\in\text{I}_{m}$ in $G$ and obtains a message $\mathbb{r}_{b}$ of his choice in any number of the output spacetime regions. Alice applies a classical encoding $\mathbb{t}_{i}^{j}=\mathcal{E}(\mathbb{x}_{i}^{j},\mathbb{r}_{l_{i}^{j}})$ of $\mathbb{x}_{i}^{j}$ using $\mathbb{r}_{l_{i}^{j}}$, with the encoding being previously agreed with Bob, for some $l_{i}^{j}\in\text{I}_{m}$, for $j\in[N_{i}]$ and $i\in\text{I}_{M}$. For example, if $\mathbb{x}_{i}^{j},\mathbb{r}_{l_{i}^{j}}\in\{0,1\}^{n_{i}^{j}}$ for some $n_{i}^{j}\in\mathbb{N}$, then we can set $\mathbb{t}_{i}^{j}=\mathbb{x}_{i}^{j}\oplus\mathbb{r}_{l_{i}^{j}}$. Alice then gives $\mathbb{s}$ to Bob in $Q_{i}$, for $i\in\text{I}_{M}$. Bob is then able to complete the DQACM protocol and obtain the message $\mathbb{r}_{b}$ of his choice (or a message $\mathbb{r}_{b}^{\prime}$ close to $\mathbb{r}_{b}$) in any number of the output spacetime regions. Alice also gives the encoding message $\mathbb{t}_{i}^{j}$ to Bob at $Q_{i}$, for $j\in[N_{i}]$ and $i\in\text{I}_{M}$. Bob is then able to decode Alice’s message $\mathbb{x}_{i}^{j}=\mathcal{D}(\mathbb{t}_{i}^{j},\mathbb{r}_{l_{i}^{j}})$ (or a message ${\mathbb{x}_{i}^{j}}^{\prime}=\mathcal{D}(\mathbb{t}_{i}^{j},\mathbb{r}_{l_{i}^{j}}^{\prime})$ close to $\mathbb{x}_{i}^{j}$) in the output spacetime region $R_{i}$ via a decoding $\mathcal{D}$ using $\mathbb{t}_{i}^{j}$ and $\mathbb{r}_{b}$ (or $\mathbb{r}_{b}^{\prime}$) if $b=l_{i}^{j}$. For example, if $\mathbb{x}_{i}^{j},\mathbb{r}_{l_{i}^{j}}\in\{0,1\}^{n_{i}^{j}}$ for some $n_{i}^{j}\in\mathbb{N}$ and $\mathbb{t}_{i}^{j}=\mathbb{x}_{i}^{j}\oplus\mathbb{r}_{l_{i}^{j}}$ then Bob computes $\mathbb{x}_{i}^{j}=\mathbb{t}_{i}^{j}\oplus\mathbb{r}_{l_{i}^{j}}$ (or ${\mathbb{x}_{i}^{j}}^{\prime}=\mathbb{t}_{i}^{j}\oplus\mathbb{r}_{l_{i}^{j}}^{\prime}$).

The security guarantee of the one-out-of-$m$ DQACM subroutine is that Bob cannot obtain with non-negligible probability Alice’s input $\mathbb{r}_{i}$ – or a message $\mathbb{r}_{i}^{\prime}$ very close to $\mathbb{r}_{i}$ – in one output spacetime region and also Alice’s input $\mathbb{r}_{j}$ – or a message $\mathbb{r}_{j}^{\prime}$ very close to $\mathbb{r}_{j}$ – in another output spacetime region, for any pair of different numbers $i,j$ from the set $\text{I}_{m}$. Thus, with unconditional security, it is guaranteed in this generalized version of SCOT that Bob cannot obtain a message $\mathbb{x}_{i}^{j}$ – or a message ${\mathbb{x}_{i}^{j}}^{\prime}$ very close to $\mathbb{x}_{i}^{j}$ – in the output spacetime region $R_{i}$ and a message $\mathbb{x}_{k}^{h}$ – or a message ${\mathbb{x}_{k}^{h}}^{\prime}$ very close to $\mathbb{x}_{k}^{h}$ – in the output spacetime region $R_{k}$, for any pair of different numbers $i,k$ from the set $\text{I}_{M}$ for which it holds that $l_{i}^{j}\neq l_{k}^{h}$. Therefore, in order to satisfy specific security constraints, Alice and Bob must previously agree on the classical encodings $\mathbb{t}_{i}^{j}=\mathcal{E}(\mathbb{x}_{i}^{j},\mathbb{r}_{l_{i}^{j}})$ and decodings $\mathcal{D}(\mathbb{t}_{i}^{j},\mathbb{r}_{l_{i}^{j}})$, and particularly on the messages $\mathbb{r}_{l_{i}^{j}}$ of these encodings in order to satisfy the desired security conditions.

VIII.2 $k$-out-of-$m$ DQACM and SCOT

We can consider generalizations of one-out-of-$m$ DQACM to a $k$-out-of-$m$ setting for arbitrary natural numbers $k<m$ and $m\geq 2$. Broadly speaking, a $k$-out-of-$m$ DQACM protocol involves the following steps. Alice prepares a quantum state $\lvert\Psi_{\mathbb{r}}^{\mathbb{s}}\rangle$ that she gives to Bob, where $\mathbb{r}=(\mathbb{r}_{0},\mathbb{r}_{1},\ldots,\mathbb{r}_{m-1})$ and $\mathbb{s}$ are randomly chosen by Alice from predetermined sets $\Omega_{\text{outcome}}$ and $\Lambda_{\text{basis}}$, respectively. Bob chooses $k$ different numbers $c_{0},c_{1},\ldots,c_{k-1}$ from the set $\text{I}_{m}$ and applies a quantum measurement $\text{M}_{c}$ labeled by $c=(c_{0},c_{1},\ldots,c_{k-1})$ on the quantum state $\lvert\Psi_{\mathbb{r}}^{\mathbb{s}}\rangle$ and obtains a classical measurement outcome $\mathbb{d}$. Alice then gives $\mathbb{s}$ to Bob. Bob then uses $c$, $\mathbb{s}$ and $\mathbb{d}$ to decode Alice’s inputs $\mathbb{r}_{c_{0}},\mathbb{r}_{c_{1}},\ldots,\mathbb{r}_{c_{k-1}}$. A $k$-out-of-$m$ DQACM protocol must satisfy a security condition against dishonest Bob, according to which, for any subset $\{l_{i}\}_{i=0}^{k}$ of $k+1$ different elements from the set $\text{I}_{m}$, for any quantum operation $O$ independent of $\mathbb{r}$ and independent of $\mathbb{s}$ applied by Bob on the received quantum state $\lvert\Psi_{\mathbb{r}}^{\mathbb{s}}\rangle$ that produces at least $k+1$ quantum systems $B_{0},B_{1},\ldots,B_{k}$, and for any quantum measurement $\tilde{\text{M}}_{i}^{\mathbb{s}}$ applied on $B_{i}$ depending on $\mathbb{s}$, the probability that the measurement outcome $\mathbb{r}_{l_{i}}^{\prime}$ is equal to $\mathbb{r}_{l_{i}}$ - or very close to $\mathbb{r}_{l_{i}}$ according to a predetermined threshold – for all $i\in\{0,1,\ldots,k\}$ is not greater than a small security bound $\epsilon>0$, which ideally decreases by increasing the size of Alice’s input messages and possibly by increasing some other security parameters.

We can then use a $k$-out-of-$m$ DQACM protocol as a fundamental primitive to implement more general SCOT protocols. For example, we may consider the following definition of $k$-out-of-$m$ SCOT, for natural numbers $k<m$ and $m\geq 2$. We may consider that spacetime is Minkowski or close to Minkowski. Alice and Bob agree on a reference frame $\mathcal{F}$ in spacetime. Alice and Bob agree on $m\geq 2$ pairwise spacelike separated output spacetime regions $R_{0},R_{1},\ldots,R_{m-1}$, and on a spacetime point $Q_{i}$ of $R_{i}$, for $i\in\text{I}_{m}$. Alice inputs a message $\mathbb{x}_{i}\in\Omega_{i}$ in the causal past of $Q_{i}$, where the set $\Omega_{i}$ is previously agreed by Alice and Bob, for $i\in\text{I}_{m}$. Bob inputs $k$ different numbers $b_{0},b_{1},\ldots,b_{k-1}$ from the set $\text{I}_{m}$. In a correct $k$-out-of-$m$ SCOT protocol Bob outputs $\mathbb{x}_{b_{i}}$ – or a message very close to it according to a predetermined threshold– in $R_{b_{i}}$, for $i\in\text{I}_{k}$. We may define security against dishonest Alice as the guarantee that Alice cannot obtain any information about Bob’s input $b=(b_{0},b_{1},\ldots,b_{k-1})$ anywhere in spacetime, when Bob follows the honest protocol and Alice implements an arbitrary cheating strategy allowed by quantum theory and relativity. We define a $k$-out-of-$m$ SCOT protocol to be secure against dishonest Bob if, when Alice follows the protocol honestly and Bob implements an arbitrary cheating strategy allowed by quantum theory and relativity, the probability that Bob outputs $\mathbb{x}_{i}$ – or a message very close to $\mathbb{x}_{i}$ according to a predetermined threshold – in $R_{i}$, for any $k+1$ different numbers $i$ from the set $\text{I}_{m}$, is not greater than a small security bound $\epsilon>0$, which ideally decreases by increasing the size of Alice’s input messages and possibly by increasing some other security parameters.

We outline a way to construct $k$-out-of-$m$ DQACM protocols by extending the one-out-of-$m$ DQACM protocols of the class $\mathcal{C}$ given in section VI. In the one-out-of-$m$ DQACM protocols of the class $\mathcal{C}$, for $j\in[n]$, the quantum system $A^{j}=A^{j}_{0}A^{j}_{1}\cdots A^{j}_{m-1}$ encodes the $j$th entries $r^{j}_{i}\in\Omega$ of the messages $\mathbb{r}_{i}$, in a quantum state $\lvert\psi_{r^{j}}^{s^{j}}\rangle_{A^{j}}=\bigotimes_{i\in\text{I}_{m}}\lvert\alpha^{i}_{r^{j}_{i}}\rangle_{A^{j}_{s^{j}_{i}}}$, where $r^{j}=(r^{j}_{0},r^{j}_{1},\ldots,r^{j}_{m-1})$, where the orthogonal bases $\mathcal{D}_{i}=\{\lvert\alpha^{i}_{r}\rangle\}_{r\in\Omega}$ are not mutually orthogonal, for $i\in\text{I}_{m}$, and where $s^{j}=(s^{j}_{0},s^{j}_{1},\ldots,s^{j}_{m-1})$ indicates which subsystem of $A^{j}$ encodes the number $r^{j}_{i}$ in the basis $\mathcal{D}_{i}$, for $i\in\text{I}_{m}$.

We suggest to extend the class $\mathcal{C}$ to $k$-out-of-$m$ DQACM protocols as follows. For $j\in[n]$, Alice and Bob perform the following actions. In the stage I, Alice randomly chooses $s^{j}\in\Lambda$ and $r^{j}_{i}\in\Omega$, for $i\in\text{I}_{m}$. Alice prepares $k$ copies of the quantum state $\lvert\psi_{r^{j}}^{s^{j}}\rangle_{A^{j}}$. More precisely, Alice prepares a quantum system $\tilde{A}^{j}=A^{j,0}A^{j,1}\cdots A^{j,k-1}$, with $A^{j,l}=A^{j,l}_{0}A^{j,l}_{1}\cdots A^{j,l}_{m-1}$ for $l\in\text{I}_{k}$, in the quantum state $\lvert\tilde{\psi}_{r^{j}}^{s^{j}}\rangle_{\tilde{A}^{j}}=\bigotimes_{l\in\text{I}_{k}}\lvert\psi_{r^{j}}^{s^{j}}\rangle_{A^{j,l}}$ that she gives to Bob. Bob measures each subsystem $A^{j,l}_{0},A^{j,l}_{1},\ldots,A^{j,l}_{m-1}$ of $A^{j,l}$ in the basis $\mathcal{D}_{c_{l}}$ and obtains classical measurement outcomes $d^{j,l}=(d^{j,l}_{0},d^{j,l}_{1},\ldots,d^{j,l}_{m-1})$, for $l\in\text{I}_{k}$, where $c_{0},c_{1},\ldots,c_{k-1}$ are different numbers input by Bob from the set $\text{I}_{m}$ indicating that Bob wishes to learn Alice’s inputs $\mathbb{r}_{c_{0}},\mathbb{r}_{c_{1}},\ldots,\mathbb{r}_{c_{k-1}}$. In the stage II, Alice gives $s^{j}$ to Bob. Bob then uses $c_{0},c_{1},\ldots,c_{k-1}$, $s^{j}$ and his outcome $d^{j,l}$ to obtain $r^{j}_{c_{l}}$, for $l\in\text{I}_{k}$. Thus, we see that Bob obtains $\mathbb{r}_{c_{0}},\mathbb{r}_{c_{1}},\ldots,\mathbb{r}_{c_{k-1}}$, as required. We leave as an open problem to investigate whether the $k$-out-of-$m$ DQACM protocols of this class are unconditionally secure against dishonest Bob.

VIII.3 Further generalizations of SCOT

More generally, we can consider SCOT settings in which Alice inputs some messages in specific regions of spacetime, Bob generates inputs in some regions of spacetime, and Bob obtains some outputs correlated to some of Alice’s inputs in some specific regions of spacetime. Alice and Bob previously agree on spacetime constraints indicating regions of spacetime where Alice should be unable, or able, to obtain specific information about Bob’s inputs; and indicating also regions of spacetime where Bob should be able or unable to obtain specific information about Alice’s inputs. The SCOT settings and protocols that we have discussed in this paper are particular examples within this general setting.

One could consider generalizations with more than two parties. Additionally, although we have focused here in output spacetime regions that are pairwise spacelike separated, one could also consider that some output spacetime regions are timelike separated. We expect that in the latter case the security guarantees would be softened.

IX Discussion

In addition to the LODT protocol of Ref. Kent (2011b) and the one-out-of-two SCOT protocols of Refs. Pitalúa-García (2016); Pitalúa-García and Kerenidis (2018), the one-out-of-$m$ SCOT protocols and generalizations presented here are further examples of unconditionally secure spacetime-constrained secure computations. Spacetime-constrained secure computation is a research problem initially outlined by Kent Kent (2011b), in which, in addition to the requirements of standard secure computations Yao (1982), the inputs and outputs of the computation are restricted to be within constrained regions of spacetime. By definition, in these tasks the inputs and outputs consist in classical information.

It would be interesting to investigate connections between SCOT and other quantum relativistic cryptographic tasks that have some intrinsically quantum inputs, for example, summoning Kent (2013), in its various versions Kent (2013); Hayden and May (2016); Adlam and Kent (2016); Kent (2018); Hayden and May (2018), where a given quantum state must be returned at specific regions of spacetime. In particular, in the localize-exclude task introduced in Ref. Hayden and May (2018), a quantum state must be localized to a collection of authorized spacetime regions while guaranteeing that the state cannot be localized to unauthorized spacetime regions. It would be interesting to investigate connections between SCOT and the localize-exclude task, or other versions of summoning. For example, can SCOT be used as a subroutine to implement a summoning task, or vice versa?

The defined task of one-out-of-$m$ DQACM allowed us to construct an unconditionally secure class $\mathcal{P}_{\text{CC}}$ of one-out-of-$m$ SCOT protocols that do not require to transmit quantum states between distant locations. We provided examples of unconditionally secure one-out-of-$m$ DQACM protocols, hence of unconditionally secure one-out-of-$m$ SCOT protocols. We believe that one-out-of-$m$ DQACM and one-out-of-$m$ SCOT, and generalizations (e.g. in the $k$-out-of-$m$ setting), may be useful primitives to build other cryptographic tasks with no-communication constraints, due to spacelike separation or otherwise. For example, our proposed (or other) unconditionally secure protocols for one-out-of-$m$ DQACM can be used to implement the task of bit string coordination, which is a primitive to perform some supermoney schemes: virtual tokens that are capable to guarantee unconditional security based on the laws of quantum physics and relativity Kent (2019).

The tasks of one-out-of-$m$ and $k$-out-of-$m$ distributed quantum access with classical memory (DQACM) introduced here seem related to quantum random access codes, with security conditions similar to those of one-out-of-$m$ and $k$-out-of-$m$ oblivious transfer, hence the name we chose to denote these tasks. Broadly speaking, in a quantum random access code (QRAC) Wiesner (1983); Ambainis et al. (1999), Alice encodes various classical messages in a quantum state, and Bob decides which message to access. For example, a $(n,m,p)$ quantum random access code is a scheme in which Alice encodes $n$ bits into $m$ qubits in such a way that Bob can recover any bit of his choice with a probability $p>\frac{1}{2}$, where in general one considers $n>m$. The first motivation to study QRACs was given by Wiesner Wiesner (1983), who introduced the concept of QRACs with the name of ‘conjugate coding’, in quantum cryptography: quantum money that is impossible to counterfeit. In the literature of QRACs, the questions that are mainly investigated relate to the efficiency of the encodings. For example, one investigates for which values of $m$ and $n$ with $n>m$ there exist $(n,m,p)$ QRACs with $p>\frac{1}{2}$ Ambainis et al. (1999, 2002); Hayashi et al. (2006), the maximum achievable values of $p$ given $m$ and $n$, how extra resources like randomness Ambainis et al. (2009) and entanglement Pawłowski and Żukowski (2010) improve the efficiency of the encodings, etc. Extensions in which Alice encodes $n$ dits in $m$ qudits, where Bob can retrieve any dit of his choice with probability $p>\frac{1}{d}$, for $d\geq 2$, are considered in Ref. Liabøtrø (2017). Extensions of QRACs codes in which Alice encodes, and Bob decodes, intrinsically quantum information were introduced in Ref. Pitalúa-García (2013). In Ref. Spekkens et al. (2009), a variation of QRACs denoted as parity oblivious multiplexing was investigated within a framework of operational theories containing quantum theory as a particular case, and an experimental demonstration of QRACs was performed. It would be interesting to investigate these questions for DQACM, and to investigate further connections between QRACs and DQACM. In particular, can we use results, or intuitions, gained from QRACs to construct unconditionally secure DQACM protocols?

Our proposed protocols for one-out-of-$m$ DQACM and SCOT tolerate small error rates, but they do not consider losses. Although dealing with losses is standard in quantum cryptography, it would be interesting to investigate explicit protocols, as in the lines suggested in Ref. Pitalúa-García and Kerenidis (2018) for the one-out-of-two case, for instance. Obtaining unconditionally secure protocols with higher allowed error rated would be helpful too. Furthermore, it would be interesting to prove, or disprove, that our proposed $k$-out-of-$m$ DQACM protocols are unconditionally secure. More generally, it would be interesting to find further unconditionally secure SCOT protocols, for example, for the generalized versions of SCOT suggested in section VIII.

Acknowledgements.

The author acknowledges financial support from the European Research Council project QCC and from the project SPACE17RPSMT-SATT1PITKER during his work at IRIF, Université Paris Diderot, and from the UK Quantum Communications Hub grant no. EP/M013472/1 during his work at the CQIF, DAMTP, University of Cambridge.

Appendix A Proof of the bound (34)

We show the bound (34) for the case $l_{0}=0$ and $l_{1}=1$. The proof follows straightforwardly for the general case $l_{0},l_{1}\in\text{I}_{m}$ with $l_{0}\neq l_{1}$.

For fixed $\mathbb{s}$ and $\mathbb{v}$, we define the sets \tau=\bigl{\{}j\in[n]\big{|}s^{j}_{v^{j},1}=s^{j}_{0}\bigr{\}} and \tau_{c}=\bigl{\{}j\in[n]\big{|}s^{j}_{v^{j},1}\neq s^{j}_{0}\bigr{\}}. We define $\omega_{\mathbb{v}}=\lvert\tau\rvert$, that is, $\omega_{\mathbb{v}}$ is the number of entries $v^{j}$ of $\mathbb{v}$ corresponding to a permutation that takes $(a_{0},a_{1},\ldots,a_{m-1})\in\Lambda$ to $(?,a_{0},?,?,\ldots,?)\in\Lambda$ where ‘?’ denotes any allowed entry after the permutation. As explicitly stated by the notation, we see that $\omega_{\mathbb{v}}$ only depends on $\mathbb{v}$, but not on $\mathbb{s}$. Using the definitions (2) and (VI.3.1), we express $F_{\mathbb{s}}$ and $G_{\mathbb{s}_{\mathbb{v}}}$ by

[TABLE]

Below we compute $F_{\mathbb{s}}G_{\mathbb{s}_{\mathbb{v}}}F_{\mathbb{s}}$. We express the left hand operator $F_{\mathbb{s}}$ in terms of the dummy variables $\mathbb{r}=(\mathbb{r}_{0},\mathbb{r}_{1},\ldots,\mathbb{r}_{m-1})\in\Omega^{nm}$ and the right hand one in terms of $\mathbb{z}=(\mathbb{z}_{0},\mathbb{z}_{1},\ldots,\mathbb{z}_{m-1})\in\Omega^{nm}$. The operator $G_{\mathbb{s}_{\mathbb{v}}}$ is expressed in terms of $\mathbb{w}=(\mathbb{w}_{0},\mathbb{w}_{1},\ldots,\mathbb{w}_{m-1})\in\Omega^{nm}$. For this computation we use the following properties: 1) from the definitions of $\tau$ and $\tau_{c}$, we have that $s^{j}_{v^{j},1}=s^{j}_{0}$ for $j\in\tau$, and $s^{j}_{v^{j},1}\neq s^{j}_{0}$ for $j\in\tau_{c}$; 2) summing over $\mathbb{z}_{0}$ we obtain $\mathbb{z}_{0}\rightarrow\mathbb{r}_{0}$ because $\Pi^{\mathbb{r}_{0}}_{0\mathbb{s}}\Pi^{\mathbb{z}_{0}}_{0\mathbb{s}}=\delta_{\mathbb{r}_{0},\mathbb{z}_{0}}\Pi^{\mathbb{r}_{0}}_{0\mathbb{s}}$, since \bigl{\{}\Pi^{\mathbb{r}_{0}}_{0\mathbb{s}}\bigr{\}}_{\mathbb{r}_{0}\in\Omega^{n}} is a projective measurement; and 3) $\sum_{a\in\Omega}\lvert\alpha_{a}^{i}\rangle\langle\alpha_{a}^{i}\rvert=\mathds{1}$ (the identity on a $l$-dimensional Hilbert space) because $\mathcal{D}_{i}=\{\lvert\alpha_{a}^{i}\rangle\}_{a\in\Omega}$ is an orthonormal basis of a $l$-dimensional Hilbert space, for $i\in\text{I}_{m}$. Thus, after summing over $\mathbb{r}_{i},\mathbb{w}_{i^{\prime}},\mathbb{z}_{i^{\prime\prime}}$, for $i,i^{\prime},i^{\prime\prime}\in\text{I}_{m}$ with $i\neq 0$ and $i^{\prime}\neq 1$, we obtain

[TABLE]

where \text{I}_{v^{j}}=\bigl{\{}i\in[m-1]\big{|}s_{i}^{j}\neq s^{j}_{v^{j},1}\bigr{\}}.

Using \Bigl{\lvert}\Bigl{\langle}\alpha_{r_{0}^{j}}^{0}\Big{|}\alpha_{w_{1}^{j}}^{1}\Bigr{\rangle}\Bigr{\rvert}^{2}\leq\lambda from (4) and $\lvert\tau\rvert=\omega_{\mathbb{v}}$, we obtain

[TABLE]

Using that \bigl{\{}\Pi^{\mathbb{r}_{0}}_{0\mathbb{s}}\bigr{\}}_{\mathbb{r}_{0}\in\Omega^{n}} and \bigl{\{}\Pi^{\mathbb{w}_{1}}_{1\mathbb{s}_{\mathbb{v}}}\bigr{\}}_{\mathbb{w}_{1}\in\Omega^{n}} are projective measurements, it is straightforward to see that the right-hand term of (39) times $(\lambda)^{-\omega_{\mathbb{v}}}$ is a projector. Thus, $\lVert(\lambda)^{-\omega_{\mathbb{v}}}F_{\mathbb{s}}G_{\mathbb{s}_{\mathbb{v}}}F_{\mathbb{s}}\rVert\leq 1$, which implies (34).

We have shown (34) for the particular case $l_{0}=0$ and $l_{1}=1$. But, since from (4) we have \bigl{\lvert}\bigl{\langle}\alpha_{r}^{l_{0}}\big{|}\alpha_{w}^{l_{1}}\bigr{\rangle}\Bigr{\rvert}^{2}\leq\lambda for any pair of different numbers $l_{0},l_{1}\in\text{I}_{m}$, and for any $r,\omega\in\Omega$, it is straightforward to see from the derivation above that the bound (34) holds for any pair of different numbers $l_{0},l_{1}\in\text{I}_{m}$.

Appendix B Details about the quantum measurements of Bob’s agents

Here we show that the following two procedures (1) and (2) described below are mathematically equivalent. More precisely, for any pair of different numbers $i,j\in\text{I}_{m}$, we show that the joint probability that Bob’s agent $\mathcal{B}_{i}$ obtains a particular outcome $\mathbb{e}_{i}$ as his guess of $\mathbb{r}_{b^{\prime}-i}$ and Bob’s agent $\mathcal{B}_{j}$ obtains a particular outcome $\mathbb{e}_{j}$ as his guess of $\mathbb{r}_{b^{\prime}-j}$ in procedure (1) is the same in procedure (2), for any $\mathbb{e}_{i},\mathbb{e}_{j}\in\tilde{\Omega}$, where it is assumed that $\Omega_{k}=\tilde{\Omega}$ is the set of possible values of $\mathbb{r}_{k}$, for $k\in I_{m}$.

In the procedure (1), Bob’s agent $\mathcal{B}$ receives the quantum state $\lvert\Psi_{\mathbb{r}}^{\mathbb{s}}\rangle_{A}$ in a quantum system $A$ from Alice’s agent $\mathcal{A}$, he introduces an ancillary system $E$ and applies a unitary operation $U$ on $AE$, then he applies a quantum measurement $\tilde{\text{M}}^{\prime}$ on $AE$ obtaining a classical outcome $(b^{\prime},i,j)\in\Gamma$, with $(b^{\prime},i,j)$ being recorded in systems $B_{0}^{\prime\prime}$, $B_{1}^{\prime\prime}$ and $B^{\prime\prime}$, where $\Gamma=\{(k,i,j)\in\text{I}_{m}\times\text{I}_{m}\times\text{I}_{m}|i\neq j\}$. $\mathcal{B}$ partitions the joint system $AE$ into $B_{0}$ and $B_{1}$. $\mathcal{B}$ inspects $(b^{\prime},i,j)$ from his system $B^{\prime\prime}$ and then he sends $b^{\prime}$ to Alice’s agent $\mathcal{A}$, and $B_{0}$ ($B_{1}$) and $B_{0}^{\prime\prime}$ ($B_{1}^{\prime\prime}$) to Bob’s agent $\mathcal{B}_{i}$ ($\mathcal{B}_{j}$). Bob’s agent $\mathcal{B}_{i}$ ($\mathcal{B}_{j}$) obtains the value $(b^{\prime},i,j)$ from the system $B_{0}^{\prime\prime}$ ($B_{1}^{\prime\prime}$) and then applies a projective measurement $\tilde{\text{M}}_{0,b^{\prime},i,j}^{\mathbb{s}}$ ($\tilde{\text{M}}_{1,b^{\prime},i,j}^{\mathbb{s}}$) on $B_{0}$ ($B_{1}$) and obtains a classical outcome $\mathbb{e}_{i}$ ($\mathbb{e}_{j}$) which is his guess of $\mathbb{r}_{b^{\prime}-i}$ ($\mathbb{r}_{b^{\prime}-j}$).

In the procedure (2), $\mathcal{B}$ applies the following quantum operation $O^{\prime}$ on $AE^{\prime}$, where $E^{\prime}=EB_{0}^{\prime\prime}B_{1}^{\prime\prime}B^{\prime\prime}$: $\mathcal{B}$ prepares the quantum system $B_{0}^{\prime\prime}B_{1}^{\prime\prime}B^{\prime\prime}$ in a quantum state $\lvert\mu_{0,0,1}\rangle_{B_{0}^{\prime\prime}}\otimes\lvert\mu_{0,0,1}\rangle_{B_{1}^{\prime\prime}}\otimes\lvert\mu_{0,0,1}\rangle_{B^{\prime\prime}}$, he applies a unitary operation $U$ on $AE$, and then he applies a unitary operation $U^{\prime}$ on the total system $B_{0}B_{1}B_{0}^{\prime\prime}B_{1}^{\prime\prime}B^{\prime\prime}$, where the joint system $AE$ is partitioned into the subsystems $B_{0}$ and $B_{1}$ (as in the procedure (1)). The unitary operation $U^{\prime}$ consists in $\mathcal{B}$ applying the quantum measurement $\tilde{\text{M}}^{\prime}$ on $B_{0}B_{1}$ and preparing each of the quantum systems $B_{0}^{\prime\prime}$, $B_{1}^{\prime\prime}$ and $B^{\prime\prime}$ in a quantum state $\lvert\mu_{b^{\prime},i,j}\rangle$, conditioned on the outcome of $\tilde{\text{M}}^{\prime}$ being $(b^{\prime},i,j)$, where $\{\lvert\mu_{b^{\prime},i,j}\rangle\}_{(b^{\prime},i,j)\in\Gamma}$ is an orthonormal basis of each of the quantum systems $B_{0}^{\prime\prime}$, $B_{1}^{\prime\prime}$ and $B^{\prime\prime}$, for $(b^{\prime},i,j)\in\Gamma$. Conditioned on the outcome of $\tilde{\text{M}}^{\prime}$ being $(b^{\prime},i,j)$, $\mathcal{B}$ sends $b^{\prime}$ to Alice’s agent $\mathcal{A}$ in part of the system $B^{\prime\prime}$, and $\mathcal{B}$ sends the joint system $B_{0}B_{0}^{\prime\prime}$ ($B_{1}B_{1}^{\prime\prime}$) to Bob’s agent $\mathcal{B}_{i}$ ($\mathcal{B}_{j}$). A quantum measurement $\tilde{\text{M}}_{0}^{\mathbb{s}}$ is applied on the joint system $B_{0}^{\prime}=B_{0}B_{0}^{\prime\prime}B^{\prime\prime}$, with $\mathcal{B}_{i}$ obtaining the outcome $\mathbb{e}_{i}$ from $B_{0}B_{0}^{\prime\prime}$, which is his guess of $\mathbb{r}_{b^{\prime}-i}$. Bob’s agent $\mathcal{B}_{j}$ applies a quantum measurement $\tilde{\text{M}}_{1}^{\mathbb{s}}$ on the joint system $B_{1}^{\prime}=B_{1}B_{1}^{\prime\prime}$ and obtains a classical outcome $\mathbb{e}_{j}$, which is his guess of $\mathbb{r}_{b^{\prime}-j}$.

We give details of the procedures (1) and (2) described above. The quantum state $\lvert\Psi_{\mathbb{r}}^{\mathbb{s}}\rangle_{A}$ is transmitted to Bob’s agent $\mathcal{B}$. Bob’s agent $\mathcal{B}$ introduces an ancillary system $E^{\prime}$, which includes a system $E$ of arbitrary finite Hilbert space dimension and extra ancillary systems $B_{0}^{\prime\prime}$, $B_{1}^{\prime\prime}$ and $B^{\prime\prime}$, each one of Hilbert space dimension $m^{2}(m-1)$. The system $E$ is set initially to an arbitrary quantum state $\lvert\chi\rangle$, and the systems $B_{0}^{\prime\prime}$, $B_{1}^{\prime\prime}$ and $B^{\prime\prime}$ are set initially to the state $\lvert\mu_{0,0,1}\rangle$, where $\{\lvert\mu_{k,i,j}\rangle|(k,i,j)\in\Gamma\}$ is an orthonormal basis of $B_{0}^{\prime\prime}$, $B_{1}^{\prime\prime}$ and $B^{\prime\prime}$, and where $\Gamma=\{(k,i,j)\in\text{I}_{m}\times\text{I}_{m}\times\text{I}_{m}|i\neq j\}$. Bob’s agent $\mathcal{B}$ applies an arbitrary unitary operation $U$ on the joint quantum system $AE$. The global state is transformed into the state $\lvert\Phi_{\mathbb{r}}^{\mathbb{s}}\rangle_{B_{0}B_{1}}\lvert\mu_{0,0,1}\rangle_{B_{0}^{\prime\prime}}\lvert\mu_{0,0,1}\rangle_{B_{1}^{\prime\prime}}\lvert\mu_{0,0,1}\rangle_{B^{\prime\prime}}$, where

[TABLE]

and where the joint quantum system $AE$ is partitioned into two subsystems $B_{0}$ and $B_{1}$.

Consider the unitary operation $U^{\prime}$ applied on the whole system $AE^{\prime}=B_{0}B_{1}B_{0}^{\prime\prime}B_{1}^{\prime\prime}B^{\prime\prime}$:

[TABLE]

where $W_{b^{\prime},i,j}$ is a unitary operation acting on a Hilbert space of dimension $m^{2}(m-1)$ satisfying $W_{b^{\prime},i,j}\lvert\mu_{0,0,1}\rangle=\lvert\mu_{b^{\prime},i,j}\rangle$, for $(b^{\prime},i,j)\in\Gamma$; and where $\tilde{\text{M}}^{\prime}=\{R_{b^{\prime},i,j}\}_{(b^{\prime},i,j)\in\Gamma}$ is a projective measurement on $B_{0}B_{1}$. Consider the projective measurement $\tilde{\text{M}}_{a,b^{\prime},i,j}^{\mathbb{s}}=\{\Pi_{a,\mathbb{s},b^{\prime},i,j}^{\mathbb{e}}\}_{\mathbb{e}\in\tilde{\Omega}}$ on $B_{a}$, for $a\in\{0,1\}$, $(b^{\prime},i,j)\in\Gamma$ and $\mathbb{s}\in\Lambda_{\text{basis}}$, where $\Lambda_{\text{basis}}$ is the set of possible values of $\mathbb{s}$.

Consider the projectors

[TABLE]

acting on $B_{0}^{\prime}=B_{0}B_{0}^{\prime\prime}B^{\prime\prime}$, and the projectors

[TABLE]

acting on $B_{1}^{\prime}=B_{1}B_{1}^{\prime\prime}$, for $\mathbb{e}\in\tilde{\Omega}$ and $\mathbb{s}\in\Lambda_{\text{basis}}$. It is straightforward to see that $\tilde{\text{M}}_{a}^{\mathbb{s}}=\{\Pi_{a\mathbb{s}}^{\mathbb{e}}\}_{\mathbb{e}\in\tilde{\Omega}}$ is a projective measurement acting on $B_{a}^{\prime}$, for $a\in\{0,1\}$ and $\mathbb{s}\in\Lambda_{\text{basis}}$.

It is straightforward to see that, for any pair of different numbers $i,j\in\text{I}_{m}$, the joint probability that $\mathcal{B}_{i}$ obtains a particular outcome $\mathbb{e}_{i}$ as his guess of $\mathbb{r}_{b^{\prime}-i}$ and $\mathcal{B}_{j}$ obtains a particular outcome $\mathbb{e}_{j}$ as his guess of $\mathbb{r}_{b^{\prime}-j}$ in procedure (1) is the same in procedure (2), for any $\mathbb{e}_{i},\mathbb{e}_{j}\in\tilde{\Omega}$, as claimed.