adversary during the simulation is *not* possible. There are two known cases where rewinding can be used for quantum adversaries, namely Watrous’ oblivious rewinding [@Wat09] and Unruh’s special rewinding [@Unr12]. We adapt and use both methods in different places in order to construct the simulators and prove the security of our protocol. This is one of the few protocols in which quantum rewinding is explicitly used and the only one, to our knowledge, that uses two types of quantum rewinding.

4.  [@DNS12; @DNS10] describe 2PQC protocols in a setting where the two parties are symmetric. Our protocol crucially differs in a number of points (other than using the Cut-and-Choose technique): (i) There is only one-way offline quantum communication between the parties, (ii) only one party (“server”) needs involved quantum technological abilities, while the other (“client”) only needs to prepare offline single qubits, (iii) minimal classical cryptographic primitives are required, namely oblivious transfer for input bits and quantum-safe commitments.

In Section \[prelims\] we present background material and introduce the notion of *quantum covert adversaries* (similarly with [@AumLin07]). In Section \[quantum cc\] we introduce the quantum-computation Cut-and-Choose technique. In Section \[prot\] we give the protocol for 2PQC and prove its security in 