and use (at different parts of the proof) two quantum rewinding techniques, namely Watrous’ oblivious quantum rewinding [@Wat09] and Unruh’s special quantum rewinding [@Unr12]. Our protocol achieves the same functionality as in the previous work on secure two-party quantum computing such as the one in [@DNS12], however using the Cut-and-Choose technique on the protocol from [@KW16] leads to the following key improvements: (i) only one-way offline quantum communication is necessary , (ii) only one party (server) needs to have involved quantum technological abilities, (iii) only minimal extra cryptographic primitives are required, namely one oblivious transfer for each input bit and quantum-safe commitments.'
author:
- 'Elham Kashefi$^{1,2}$, Luka Music$^2$ and Petros Wallden$^1$'
bibliography:
- 'biblio.bib'
title: 'The Quantum Cut-and-Choose Technique and Quantum Two-Party Computation'
---

Introduction
============

A key task in modern cryptography is to compute a function of many inputs given by different parties that do not trust each other and wish to maintain the privacy of their input. This is called secure multi-party computation (to name some examples: millionaire’s problem, coin tossing, voting schemes, etc). The field started with the seminal paper of Yao [@Yao86], where two-parties that do not trust each other (they are “honest-but-curious”) compute a function 