One-out-of-two Quantum Oblivious Transfer based on Nonorthogonal States

This research proposes the first one-out-of-two quantum oblivious transfer (QOT) scheme that does not have a two-level structure and is not subject to Lo’s no-go theorem. Instead, the proposed scheme is a simple and efficient approach based on nonorthogonal states. The nonorthogonality causes one of a pair of messages to be unable to be measured to achieve the irreversible goal of discarding a message, resulting in a one-out-of-two selection effect. The proposed QOT protocol is therefore built directly on quantum resources rather than on a two-level structure in which two classical keys must first be created using quantum resources (all-or-nothing QOT) and then a one-out-of-two protocol is built from there. Furthermore, the proposed protocol allows Alice and Bob to test each other’s loyalty by comparing measurement results. In addition, the relationship with the no-go theorem is discussed in detail; this relationship is often overlooked in other studies. A security analysis demonstrates that the proposed protocol is secure against both external and internal attacks. In addition, an efficiency analysis shows that the proposed protocol is more efficient than other, two-level-structured protocols.

Quantum bit. The classical information carrier is called a "bit". The quantum information carrier is called a "quantum bit", or a "qubit". A qubit collapses to certain states of a basis when it is measured. Two bases are commonly used: the Z-basis and the X-basis. The Z-basis is defined as . A basis is also an orthonormal set.
Superposition. Superposition refers to the phenomenon that a qubit can simultaneously exist in both the |0〉 and |1〉 states; i.e., φ α β = + 0 1, meaning that |φ〉 will collapse to |0〉 and |1〉 with probabilities of α 2 and β 2 , respectively. In addition, the state |−〉 is also considered to be a superposition in the Z-basis. It has a probability of = of collapsing to |1〉.
Entanglement. Another important property, entanglement is the phenomenon that qubits cannot exist singly.
There are four common entangled states, called Bell states, as shown in Eq. 1. For example, when a state |Φ + 〉 is measured, as in Eq. 1, the result may be either |00〉 12 or |11〉 12 , where the subscript indicates the qubit order. As a result, in this case, it is possible to immediately learn the states of two qubits when only one is measured. Einstein referred to this as "spooky action at a distance". Operations I and Z cannot be distinguished in the Z-basis, and Y and Z cannot be distinguished in the X-basis. A single qubit cannot be observed using all four operations, which means that some information is ignored; this is a key element of the proposed protocol. For example, after a Y gate, the state |0〉 becomes −|1〉; i.e., a result of |1〉 will be obtained when the qubit is measured. This negative amplitude is called a global phase and cannot be measured. Another important gate is the Hadamard gate, as described in Eq. 2, also called the H gate. The H gate can be used to convert between two different bases (the Z-basis and the X-basis). For example, after an H gate, the state |0〉 (|+〉) H becomes |+〉 (|0〉). Table 1  The basic idea. This subsection introduces the basic idea underlying encoding and decoding in the proposed protocol. In this study, the four operations "I", "X", "Y" and "Z" represent four messages "00", "10", "11" and "01", respectively, for encoding. Each message can be mapped to m 0 and m 1 , which represent Alice's two messages. Because the properties of the two different bases (shown in Table 2) cause a negative amplitude to be unable to be measured (see the last final state in the left-hand part of Table 2), one of the two messages cannot be measured, and which one depends on the basis in which they are prepared (the receiver's choice). For example, suppose that Bob prepares the state |0〉 and performs either I or H in accordance with his choice, j 0 or j 1 , in order to learn the content of either m 0 or m 1 , respectively. In this way, Bob inputs his choice first, and the initial state |0〉 will be either |0〉 or |+〉, depending on his choice. The results are shown in Table 2; after Alice's operation, if Bob's choice is j 0 (his initial state is |0〉), he learns m 0 unambiguously (the bold text in the left-hand part of Table 2); otherwise, he learns m 1 (the bold text in the right-hand part of Table 2) unambiguously. As a result, one of the two messages is automatically discarded, thereby achieving the requirements of one-out-of-two QOT.
The proposed protocol. As seen from the basic idea presented above, the operations I and H can be regarded as representing Bob's intentions regarding his choice; this makes the proposed protocol similar to B92 22 , which has been proven unconditionally secure both in theory and in implementation 28,29 , meaning that no one  can perfectly identify all states of the qubits without any information from their creator. Another key property is that some operations cannot be distinguished in some bases, which means that it is not possible to identify all operations from a single qubit. The proposed protocol allows Alice and Bob to test each other's loyalty, because they can check whether the initial and final states are correct. In other words, if they want to lie to each other, it will create errors, which can be discovered when they test each other. Let us give a simple example at the end of every step of the protocol without channel checking. The proposed protocol consists of 7 steps as follows: Step 1. Bob creates a qubit sequence in accordance with his choice intentions j 0 and j 1 , which correspond to the states |0〉 and |+〉, respectively. The necessary I and H gates can be considered as equivalent to his choice intentions in this stage. This sequence must be longer than the OT sequence, which contains all received message qubits as well as qubits for channel checking and for testing Bob's loyalty. In addition, the channel checking and loyalty testing states are different; the former, also called decoy qubits, belong to {|0〉, |1〉, |+〉, |−〉}, and the latter belong to {|0〉, |+〉}. If N denotes the minimum length (at which Bob will receive N messages), M is the number of channel checking qubits, and K is the number of loyalty testing qubits, then the total length of the QOT sequence is N + M + 2K. Bob randomly prepares M qubits from {|0〉, |1〉, |+〉, |−〉} (each qubit is independent) and inserts them into his sequence. Subsequently, he also inserts his N and 2K candidate choice intentions ({|0〉, |+〉}) into his sequence and then sends the sequence to Alice. Let us give a simple example to describe the proposed one-out-of-two QOT protocol without channel checking, suppose that Bob prepares two qubits in |0+〉 12 (N) to represent his choices and an additional two qubits in |0+〉 34 (2K) for loyalty testing. He then sends these four qubits to Alice.
Step 2. Once she receives the sequence from Bob, Alice first checks the channel for an eavesdropper (Eve) and then tests Bob's loyalty. First, she asks Bob to publish the bases and states that he has created. If the error rate is higher than a given threshold, then an Eve is present on the channel, and Alice and Bob abort their communication; otherwise, Alice goes on to test Bob's loyalty. She discards the qubits for channel checking and then randomly selects several positions and requests that Bob publish his bases. If different results, i.e., ∉ {|0〉, |+〉}, are measured and the error rate is higher than the given error rate, then Bob is considered dishonest, and she aborts this communication; otherwise, she proceeds to the next step. Following the above example, once Alice receives the ordered sequence |0+0+〉 1234 , she randomly chooses a qubit for loyalty testing. Suppose that Alice's random choice is qubit 4; then, she asks Bob to publish the basis of qubit 4, measures it, and compares the published and measured results. If the error rate is higher than the threshold, then Bob is considered as dishonest; after that, qubit 4 is discarded.
Step 3. Since the loyalty test may disturb the order of Bob's choice intentions, Bob must ask Alice to reorder the qubits. It is for this purpose that 2K additional qubits are initially provided to prevent vacancies in the list of choice intentions. In this step, the sequence after reordering represents Bob's real choices. Following the above example, after the loyalty test, Bob asks Alice to reorder the remaining qubits in the order 21, and the states become |+0〉 21 , with qubit 3 discarded. The resulting state |+0〉 21 represents Bob's choices, j 1 and j 0 , respectively.
Step 4. Alice now inputs her secret messages m 0 and m 1 through the I, X, Y and Z operations, corresponding to the combinations "00", "10", "11" and "01", respectively. Following the above example, Alice performs Z and X in accordance with her messages "01 12 " and "10 34 ", where the subscripts indicate Alice's classical bit order, on qubits 2 and 1, respectively. This converts the state |+0〉 21 into |−1〉 21 .
Step 6. When Bob receives the sequence from Alice, he asks Alice to publish the positions and states of the decoy qubits. If the error rate is higher than the channel error rate, they abort this communication and return to step 1. Otherwise, Bob learns the contents of the classical messages by measuring the qubits with the bases he prepared. Following the above example, Bob performs X-and Z-basis measurements to learn the second and first classical messages, "1" and "1" (01 12 and 10 34 , where the subscripts indicate Alice's classical bit order), respectively.
Step 7. At the end of this protocol, where Bob has to test Alice's loyalty to prevent Alice from cheating, she can learn Bob's choice with the probability 25%, or 29.3% by POVM. Bob chooses some random positions and asks Alice to publish her operations. Bob performs the operations according to Alice's announcement, in order to recover those qubits into {|0〉, |+〉}. If the error rate of loyalty testing is higher than the threshold, then Alice is considered as dishonest. Following the above example, Bob asks Alice to publish operation (X), which performs on qubit 1; then, Bob performs X on qubit 1 to recover the state into |0〉.

Resisting Lo's cheating strategy.
Lo's no-go theorem 15 provides a cheating strategy for learning all messages in a one-sided two-party secure computation, which doubts that one-out-of-two QOT is insecure. The key to Lo's cheating strategy 15 is requirement (A-i), namely, that "Bob learns f(i(m 0 , m 1 ), j) unambiguously" (the i(m 0 , m 1 ) represents a pair of messages in a one-out-of-two QOT scenario), which leads to a probability of 100% that the selected state will collapse. In addition, the result is obtained after reversible operations. As a result, choices can be made repeatedly to learn all messages, as shown in Eq. 3, where U j 0 , U j 1 , G and |φ〉 represent two different selected operations, any unitary operation for inputting two messages and any quantum state, respectively. Therefore, once Bob learns the content of a message, he can recover the state G × |φ〉, which is the state after Alice's input, by applying the selected operation U j k and its inverse operation ⁎ U j k , where k ∈ {|0〉, |1〉}. In this way, Bob can change his choice and learn the contents of all messages by repeating the above process.
Definition B corresponds to the one-out-of-two QOT scenario covered by Lo's proof 15 . Obviously, definition B is a special case of definition A. Definition B describes the case in which Alice inputs her messages first and then Bob inputs his choices. The important point here is that if Bob inputs his choices first and Alice subsequently input her messages, as in definition C (the proposed protocol), this scenario is not equivalent to the function considered in Lo's proof 15 . This is because the function becomes f(i(m 0 , m 1 , j), j) when Bob inputs his choices first, and f(i(m 0 , m 1 , j 0 ), j 1 ) is meaningless with respect to f(i(m 0 , m 1 , j), j). Therefore, Bob cannot change i from i(m 0 , m 1 , j 0 ) to i(m 0 , m 1 , j 1 ) without Alice's help. Following from the above relation, in the proposed protocol (definition C), the result after Bob's and Alice's actions can be expressed as , and G ∈ {I, X, Y, Z}. Eq. 4 shows that Bob cannot invert the qubit state without possessing information about G. Therefore, Bob cannot perform Lo's cheating strategy 15 . As a result, Bob cannot reverse the effects of his inputs without Alice's help. The condition of Equation 4 shows that the proposed function f(i(m 0 , m 1 , j), j) is similar to that of He's proof 19,30 . This proof shows that the order of input of the choices and messages may change the function f, which means that this protocol is not subject to Lo's no-go theorem. In addition, He 30 has extended the concept of his proof 19 to the general case; if Alice and Bob interact with each other and Bob cannot eliminate the effects of his operations independently, then the interaction is covered by He's proof 19 and resists Lo's cheating strategy 15 .

Security Analysis
Two security conditions are considered in this study: security against external and internal attacks. External attacks involve an eavesdropper, Eve, attempting to steal messages without being detected. Internal attacks involve either Alice or Bob attempting to steal the other's secret information; i.e., Alice wants to learn Bob's choices, or Bob wants to learn the contents of both of Alice's messages.
External Attack. Alice and Bob must ensure that the communication channel between them is secure, because without channel checking or reduced frequency 31 , Eve will be able to illicitly eavesdrop on their messages. In the proposed protocol, several single qubits ∈ {|0〉, |1〉, |+〉, |−〉} are randomly inserted into the transmitted sequence as decoy qubits for channel checking, as described in steps 1 and 5 of the protocol. The positions and states of these qubits are then published and measured to check whether an Eve is present. If the measured results obtained with the same bases are different and the error rate is higher than the channel error rate, then an Eve is present. Two common external attack strategies are the intercept-and-resend attack and the entangling attack. They are discussed below.
Intercept-and-resend attack. Eve intercepts all qubits during transmission when the sender sends the qubit sequence to the receiver, measures them to obtain the message contents, and then resends those qubits to the receiver. This action should disturb the states of the qubits, including the decoy qubits, because Eve does not know which bases have been prepared by Alice and Bob. According to the detection rate of BB84 6 , each qubit has a probability of 1 4 of detecting Eve's presence, and the detection rate increases with an increasing number of decoy qubits M. As a result, the security level can be assessed based on the detection rate by legal agents, ξ 1 , as expressed in Eq. 5. Entangling attack. Eve may instead use a different method that does not disturb the qubit states, namely, the entangling attack. In this attack, she intercepts the transmitted sequence, prepares an ancillary qubit |E〉, and performs a unitary operation U e on the intercepted qubit to entangle it with her qubit |E〉 during transmission. The unitary operation U e is defined as shown in Eq. 6, where |e 00 〉, |e 01 〉, |e 10 〉, and |e 11 〉 are four states determined by the unitary operation U e , + = a b 1 2 2 , and + = c d 1 2 2 . If Eve wishes to avoid detection, the operation U e must satisfy a = d = 1, b = c = 0, and |e 00 〉 = |e 11 〉, and as a result, the proposed protocol ensures that no information can be obtained in this way.  Internal Attack. Internal attacks involve the legal agents Alice and Bob attempting to steal each other's secret information; i.e., Alice wants to learn Bob's choices, or Bob wants to learn the contents of all messages sent by Alice. Therefore, two conditions must be discussed, namely, Alice's and Bob's cheating strategies.
Alice's cheating strategy. There are two conditions to be discussed. The first condition is that Alice has no ability of entanglement. In this condition, Alice only has the ability to perform a single qubit gate such as {I, X, Y, Z, H} etc., and she has 25% or 29.3% chance to learn Bob's choices; however, this kind of attack can be always detected in our protocol. The second condition is that Alice has the ability of entanglement. In this condition, Alice has the ability to perform two or more qubit gates, which leads to diverse attacks. However, Bob is also required to have the ability of entanglement to resist attacks from Alice, and a dishonest Alice will be detected by the discussion below.
Alice has no ability of entanglement. A dishonest Alice can learn 25% of Bob's choices, as in B92 22 , because a measurement in the incorrect basis can yield incorrect measurement results that nevertheless help Alice to determine Bob's initial state. For example, if Bob sends the state 0 to Alice, she has a probability of 1 2 of using the incorrect basis (X-basis), and when she does so, the incorrect state (|−〉) will be obtained with a probability of 1 2 , resulting in a total probability of = .   1 2 In other word, the remaining 70.7% of Bob's choices will be unknown, which means that Alice should randomly create several state ∈ {|0〉, |1〉, |+〉, |−〉} to send to Bob. However, she cannot know Bob's final measurement results, as he does not publish any information about the bases. In other words, for each bit, he will be unable to correctly decrypt with a probability of − . × × = . at the Alice's loyalty testing stage, which will make him aware of Alice's dishonesty with where ξ 2 can be decided by the user through the number of qubit D for loyalty testing. Therefore, Bob can detect that Alice is cheating. If Alice does not use POVM, the total detection rate is − . × × = . with a single qubit. Indeed, while the detection rate dropped by 18.75% − 17.675% = 1.075% with POVM, it does not change the number of particles too much.
For a simple example regarding the detection rate with a remaining qubit, which Alice randomly prepared, Alice prepares a qubit in state |0〉 and guesses Bob's choice. In this case, she can only publish operation {I, Z} to escape this testing, and there are two branches: 1. Bob uses Z-basis as his choice; in this case, Alice can always escape the testing; 2. Bob uses X-basis as his choice; in this case, Bob has a 50% to get |+〉 or |−〉. When he gets |+〉, the operation Z cannot restore the state |+〉 to |+〉. Otherwise, when he gets |−〉, operation I cannot restore the state |−〉 to |+〉. Therefore, Bob always has a probability to detect Alice's dishonesty. Alice has the ability of entanglement. A dishonest Alice can prepare Bell states in |Φ + 〉 AB to perform a teleportation attack. In this way, she can pass Alice's loyalty testing, and then, learn Bob's choices with 25% or 29.3% chance without being detected. For a simple example to explain the teleportation attack, in step 3, the qubit from Bob after Bob's loyalty testing is called |ϕ〉 C . In step 4, instead of inputting her secret message into qubit C, Alice creates a Bell state in Φ + AB , distributes qubit B to Bob to replace qubit C, and holds qubit A. After that, Alice performs a Bell measurement (a controlled-not gate and a Hadamard gate, which can transfer four Bell states |Φ + 〉, |Φ − 〉, |Ψ + 〉 and |Ψ − 〉 into |00〉, |10〉, |01〉 and |11〉, respectively), BM for short, on qubit C and A, and publishes one of four operations I, X, Y or Z as her secret message according to BM results |00〉 CA , |01〉 CA , |11〉 CA and |10〉 CA , respectively. Bob can then perform one of four operations I, Z, X or Y to recover state |0〉 B or |+〉 B according to a result that Alice published. As shown in Eqs 10 and 11, Bob can always recover the qubit state |0〉 B or |+〉 B , because the BM results |00〉 CA , |10〉 CA , |01〉 CA and |11〉 CA can always match operations I, Z, X and Y, respectively. and sends qubit A 1 to Alice. Under normal conditions, we can know that Alice will do honest behavior. After Alice performs an operation in {I, X, Y, Z} on qubit A 1 , the entangled state will be Eq. 12. We can divide those states into two bases (Eqs 13 and 14), called IY basis and XZ basis, respectively, of which the IY/XZ basis can perfectly distinguish the states after I A 1 /X A 1 and Y A 1 /Z A 1 . Obviously, these two bases are not orthogonal. That is to say, Bob will measure qubits A 1 and B 1 with one of two bases {IY, XZ} according to Alice's operations to check Alice's loyalty.
However, Alice may be dishonest and perform a teleportation attack. Alice creates an entangled state in Φ + AB and sends qubit B to Bob for the teleportation attack. Alice will perform the BM on qubit A 1 and A, which leads the entire system to be Eq. 15. As a result, we can determine the probabilities of the four qubit states in Eq. in the XZ basis, where the bold numbers are the probabilities of dishonest Alice evading detection. After the above discussion of the defense strategy, we can determine the probability of Alice's average escape detection of each entangled qubits pair is Eq. 20, and security level ξ 3 is as given in Eq. 21, where F is the number of detected entangled qubit pairs. Therefore, Alice and Bob can decide security level ξ 3 , and whether they will continue the protocol according to the detection result. In summary, if the dishonest Alice only has the ability to perform single-qubit operations, then follow this protocol Bob can always have a probability to detect dishonesty one. Moreover, if the dishonest Alice can prepare Bell states or perform teleportation attacks, Alice's cheating becomes more and more difficult because she has to have the technology to store the qubits received from Bob. However, such a long-term quantum storage technology is still a technical challenge and an open issue today. Even though when the long-term quantum storage technology can be built, the protocol still can intentionally delay the operation time between step 4 and step 7 to prevent these attacks.  . . .  Bob's cheating strategy. A dishonest Bob can prepare entangled qubits of the form |Φ + 〉, as given in Eq. 1. In this way, he can learn the contents of all messages from Alice, with the results shown in Eq. 22, where the subscripts represent the qubit order; i.e., he can perfectly identify which operation Alice performed on qubit 1. However, only two states, |0〉 and |+〉, can be measured in the proposed protocol. Alice randomly selects K positions and asks Bob to publish the bases he prepared in step 2. If different measurement results are given, i.e., ∉ {|0〉, |+〉}, Bob is dishonest. The detection rate by legal agents, or the security level ξ 4 , is as given in Eq. 23.
Efficiency Analysis. This section presents a performance comparison of the proposed protocol with three modern two-level-structured one-out-of-two QOT protocols 21,24,25 based on Crépeau's reduction 3 . The protocols of Wei Yang et al. 20 and Yu-Guang Yang et al. 23,27 are not considered because that of Wei Yang et al. may not work, whereas the first protocol of Yu-Guang Yang et al. 23 involves an untrusted third party, and the second 27 is a one-out-of-n QOT protocol for which the resource consumption for one-out-of-two QOT is similar to that of Li Yang's protocol 21 . The three protocols considered for comparison 21,24,25 have two-level structures in which one-out-of-two OT is built on all-or-nothing QOT. However, the probability p of all-or-nothing QOT (where p is the probability of the unambiguous key) is not always 50%. Significant quantum resources are required to build two classical keys (one unambiguous and the other unknown) using all-or-nothing QOT for one-out-of-two OT.
In addition, every transmission should include decoy qubits for channel checking. Some protocols may need many transmissions, and many decoy qubits, to complete all-or-nothing QOT. For fairness, the security level ξ 1 is ensured to be at least 99.9999% by using 50 decoy qubits for each transmission. Then, the most important indicators are the conversion efficiency between two OT protocols and the number of transmissions (which indirectly affects the number of decoy qubits). The total cost of each protocol, as calculated under the requirement that R message bits are received, is given in Table 3. Here, only the quantum cost without loyalty testing is considered; for fairness, we do not include the cost for loyalty testing because two of the other one-out-of-two QOT protocols 21,24 do not consider any loyalty testing, which means that the sender and receiver may not truly trust each other, whereas the loyalty testing of the third protocol 24 requires the consumption of a large number of qubits, making the quantum cost difficult to calculate. Detailed descriptions of the protocols considered for comparison 21,24,25 are given below.
Yang's protocol. This protocol 21 uses the B92 22 protocol as the all-or-nothing QOT protocol on which it is based. Therefore, it requires four qubits on average to obtain an unambiguous key and only one transmission. However, the cited study focused more on the bit-commitment protocol than on the OT protocol, with no further security analysis of the QOT protocol or strategies for detecting eavesdroppers. Therefore, no strategy was provided for loyalty testing between Alice and Bob. In addition, the number of decoy qubits is computed as described above because the original detection strategy of B92 22 is less efficient. Therefore, the same detection strategy with decoy qubits is used. As a result, the total quantum cost is 4 × R + 50. YYLSZ protocol. This protocol 24 also requires at least four qubits on average to obtain an unambiguous key using its all-or-nothing QOT strategy, i.e., = p 1 4 . In the all-or-nothing QOT protocol, Alice first sends a sequence to Bob, and Bob then sends it back after his measurement, which requires two transmissions. After this, Alice can test Bob's loyalty by observing the probability of occurrence of states |+〉 and |−〉. Note that this strategy is based on the law of large number and will consume a large number of qubits. By contrast, Bob cannot really test Alice's loyalty; he is only able to detect errors in the later application of the one-out-of-two OT protocol. The overall cost of the protocol is 4 × R + 2 × 50.
YSW protocol. This protocol 25 reduces BB84 6 to B92 22 . It uses the BB84 6 strategy and the publication of additional state information to allow Bob to generate unambiguous keys as in B92 22 . It also requires four qubits for the generation of an unambiguous key. In addition, it requires one transmission to complete all-or-nothing QOT. However, it does not include a loyalty testing method for the all-or-nothing QOT stage. Errors may be detected at the application level. The overall cost of the protocol is 4 × R + 50.
Proposed protocol. The proposed protocol is based directly on quantum resources and consumes one qubit for each received bit. The proposed protocol is more efficient than the others 21,24,25 , with a probability p of 1 4 . The proposed protocol requires two transmissions between Alice and Bob. The overall cost of the proposed protocol is R + 2 × 50.
As seen from Table 3, the proposed protocol is the most efficient among all of the compared protocols 21,24,25 ; this is also shown in Fig. 1. This result demonstrates that building a one-out-of-two QOT protocol directly is more efficient than Crépeau's reduction 3 , which requires a two-level structure.

Discussion
In conclusion, there three important contributions of the proposed method. First, to the best of our knowledge, the proposed protocol is the first one-out-of-two QOT protocol to be designed directly based on quantum properties without relying on all-or-nothing QOT, and it has been proven to be secure and not subject to Lo's no-go theorem 15 . A simple and efficient one-out-of-two QOT protocol with single nonorthogonal qubits, in which one of the two messages is discarded automatically, has been successfully developed based on the most basic properties of quantum machines. Second, the proposed protocol can effectively prevent both external and internal attacks, as proven by a detailed security analysis. Regarding internal attacks, an important feature of the proposed   protocol is that loyalty testing is applied to provide security against internal attacks by a dishonest Alice or Bob; the dishonest one can always be detected at the loyalty testing stages with safety parameters ξ 2 , ξ 3 and ξ 4 , respectively. Finally, the proposed protocol has a lower cost and is more efficient than many traditional protocols based on a two-level structure. In addition, as this protocol uses only a single qubit, it is easily implemented.

Data Availability
No datasets were generated or analysed during the current study.