of the protocol, we also have that the global state (before the final step deviation, i.e. at step $n-1$) follows:

where $\rho^{n-1}_{ideal}(\rho_{in}) := p_{ok} U_f \cdot (\rho_{in})+(1-p_{ok})([\mathsf{abort}_1])$ During our protocol we will use bit commitment and 1-out-of-2 oblivious transfer (or OT).

Bit commitment consists of two phases, Commit and Reveal, such that after the Commit the receiver has no information about the value that has been committed (hiding), while during the Reveal the sender cannot reveal a value different from the one committed previously (binding). Both these properties can be either computationally or unconditionally verified depending on the scheme (but not both unconditionally). We suppose that all the commitments used verify the following *strict binding* property.

\[strict bind\] Let $COM$ be a commitment scheme, a deterministic polynomial-time function taking two arguments: the opening information $a$ and the message $y$. We say $COM$ is strictly binding if for all $a, y, a', y'$ with $(a, y) \neq (a', y')$, we have that $COM(a, y) \neq COM(a', y')$. It means that the sender is committed to the (unique) opening information *and* the message that is being committed.

A 1-out-of-2 oblivious transfer is a two party functionality in which one party ($P_1$ in 