U^{\dagger}$ and we will sometimes denote $[b] := \dyad{b}$. Let $U_f$ be the unitary which when applied to classical inputs (computational basis) $(x, y)$, returns the classical output $f(x, y) = (f_1(x, y), f_2(x, y))$. The ideal output is $\rho_{out} = (U_f \otimes \bbbone) \cdot \rho_{in}$. Given two states $\rho_{0}$ and $\rho_{1}$, the trace norm distance is $\Delta(\rho_{0}, \rho_{1}):= \frac{1}{2}\norm{\rho_{0} - \rho_{1}}$. When $\Delta(\rho_{0}, \rho_{1}) \leq \epsilon$ then any process applied to $\rho_{0}$ behaves the same as it would on $\rho_{1}$ except with probability at most $\epsilon$. A function $\mu$ is *negligible in $n$* if, for every polynomial $p$, for sufficiently large $n$’s it holds that $\mu(n) < \frac{1}{p(n)}$.

All the proofs of security in this paper will be in the *real/ideal simulation paradigm*: when considering a party as corrupted, we will construct a simulator interacting with the ideal functionality such that they are not able to detect that they are not in fact interacting directly with a real world honest party instead.

The standard definition of security means that the simulated and real states are exponentially close and so indistinguishable for the adversary.

We say that the $n$-step two party strategy is $\epsilon$-private for $B$ if there exists $\epsilon(n)$ 