An oblivious transfer (OT) channel takes as input a pair of bits (s0, s1) from the sender and delivers (c, sc) to the receiver, where c ∈ {0, 1} is chosen uniformly at random. A secure implementation of such a channel hides c from the sender and s1-cfrom the receiver. These secrecy properties make OT channels very useful for cryptography; for example, they can be used to perform general secure multi-party computation.

We provide bounds on the efficiency of secure one-sided output two-party computation of arbitrary finite functions from trusted distributed randomness in the statistical case. From these results, we derive bounds on the efficiency of protocols that use different variants of oblivious transfer (OT) as a black box. When applied to implementations of OT, these bounds generalize most known results to the statistical case. Our results hold in particular for transformations between a finite number of primitives and for any error. In the second part, we study the efficiency of quantum protocols implementing OT. While most classical lower bounds for perfectly secure reductions of OT to distributed randomness still hold in the quantum setting, we present a statistically secure protocol that violates these bounds by an arbitrarily large factor. We then prove a weaker lower bound that does hold in the statistical quantum setting and implies that even quantum protocols cannot extend OT. Finally, we present two lower bounds for reductions of OT to commitments and a protocol based on string commitments that is optimal with respect to both of these bounds.

We consider the implementation of two-party cryptographic primitives based on the sole assumption that no large-scale reliable quantum storage is available to the cheating party. We construct novel protocols for oblivious transfer and bit commitment, and prove that realistic noise levels provide security even against the most general attack. Such unconditional results were previously only known in the so-called bounded-storage model which is a special case of our setting. Our protocols can be implemented with present-day hardware used for quantum key distribution. In particular, no quantum storage is required for the honest parties.

Central cryptographic functionalities such as encryption, authentication, or secure two-party computation cannot be realized in an information-theoretically secure way from scratch. This serves as a motivation to study what (possibly weak) primitives they can be based on. We consider as such starting points general two-party input-output systems that do not allow for message transmission and show that they can be used for realizing unconditionally secure bit commitment as soon as they are nontrivial, i.e., cannot be securely realized from distributed randomness only.

Since oblivious transfer, a primitive of paramount importance in secure two- and multiparty computation, cannot be realized in an unconditionally secure way for both parties from scratch, reductions to weak information-theoretic primitives as well as between different variants of the functionality are of great interest. In this context, various monotones-quantities that cannot be increased by any protocol-are introduced and then used to derive lower bounds on the possibility and efficiency of such reductions.

A fundamental result in information-theoretic fault-tolerant distributed computing is that unconditionally secure broadcast (or Byzantine agreement) among three players is impossible if one player is misbehaving. In particular, imperfect broadcast with failure probability epsi is achievable if and only if epsi ges (3 - radic5)/2. In this paper, we examine to what extent the failure probability of imperfect broadcast can be reduced. As a main result, we show that, among three players, broadcast with failure probability epsi can be turned into broadcast with negligible failure probability if and only if epsi < 1/3. This result is finally extended to the more general case of n players and any number of misbehaving players

In this paper we provide the answer to the following question: given a noisy channel PY|Xand epsi > 0, how many bits can be transmitted with an error of at most epsi by a single use of the channel

We show that oblivious transfer can be seen as the classical analogue to a quantum channel in the same sense as non-local boxes are for maximally entangled qubits.

Oblivious transfer, a central functionality in modern cryptography, allows a party to send two one-bit messages to another who can choose one of them to read, remaining ignorant about the other, whereas the sender does not learn the receiver's choice. Oblivious transfer the security of which is information-theoretic for both parties is known impossible to achieve from scratch. The joint behavior of certain bi-partite quantum states is non-local, i.e., cannot be explained by shared classical information. In order to better understand such behavior, which is classically explainable only by communication, but does not allow for it, Popescu and Rohrlich have described a "non-locality machine": Two parties both input a bit, and both get a random output bit the XOR of which is the AND of the input bits. We show a close connection, in a cryptographic sense, between OT and the "PR primitive." More specifically, unconditional OT can be achieved from a single realization of PR, and vice versa. Our reductions, which are single-copy, information-theoretic, and perfect, also lead to a simple and optimal protocol allowing for inverting the direction of OT

This paper introduces the ambiguity of a channel, which characterizes the possibility in principle of a zero-error channel to simulate any other zero-error channel. We show how to calculate the ambiguity of a virtual channel connecting two arbitrary players in a network of potential malicious players.

In analogy to the zero-error variant of the channel capacity, the zero-error information between two random variables is defined. We show that our definition is natural in the sense that the representation of the channel capacity with respect to mutual information carries over to the zero-error variants of the quantities. It is shown that the new notion, together with two operators introduced in the same context, namely the common random variable of two random variables and the dependent part of a random variable with respect to another, is useful for giving characterizations of the possibility of realizing cryptographic tasks - such as bit commitment, coin tossing, or oblivious transfer - from correlated pieces of information.