Short answer: Oblivious transfer is a basic two-party cryptographic primitive, and quantum protocols for it get security from a physical assumption that the cheating party has no large, reliable quantum memory (the noisy-storage model). A 2009 arXiv paper constructs such protocols, a 2014 Nature Communications paper reports an experiment with polarization-entangled photons, and a 2018 Nature Communications paper reports a proof-of-principle continuous-variable experiment. These are laboratory demonstrations.
Why an extra assumption is needed
The 2009 arXiv paper notes that not even the laws of quantum physics allow all desirable cryptographic functionalities without further assumptions, and gives fully randomized oblivious transfer as an example: one party receives two random strings, the other receives one of them together with its index, and neither learns more than that. The paper says securely implementing oblivious transfer is desirable because any two-party computation, such as secure identification, can be based on it.
The 2018 paper says the assumption can be a limit on the adversary's ability to store information. Given any constraint on the size of the adversary's storage, security for two-party protocols can be obtained by sending more signals during the protocol than the storage can handle. It calls this the bounded and, more generally, noisy quantum-storage model. The 2014 paper adds that the noisy-storage model captures the difficulty facing an adversary because quantum memories currently suffer from problems such as noisy transfer of photonic qubits, loss of quantum information over time and photon loss.
The 2009 protocols
The 2009 authors consider two-party primitives based on the sole assumption that no large-scale reliable quantum storage is available to the cheating party. They construct novel protocols for oblivious transfer and bit commitment and prove that realistic noise levels provide security even against the most general attack. They say such unconditional results were previously known only in the bounded-storage model, a special case of their setting. They say the protocols can be implemented with present-day hardware used for quantum key distribution, and that no quantum storage is required for the honest parties. The bounded-storage model assumes noiseless but small storage, while the noisy-storage model allows possibly large storage with noise.
The 2014 experiment
The 2014 authors report an experimental 1-2 random oblivious transfer protocol using measurements on polarization-entangled photon pairs in a modified entangled quantum key distribution system, with the necessary classical postprocessing including one-way error correction. They report exchanging a 1,366-bit random oblivious transfer string in about 3 minutes, with a full security analysis under the noisy-storage model that accounts for experimental error rates and finite-size effects. They say this demonstrates the feasibility of using today's quantum technologies for secure two-party protocols.
The 2018 continuous-variable protocol
The 2018 authors present and experimentally demonstrate an oblivious transfer protocol for optical continuous-variable systems and prove its security in the noisy-storage model. The security proof uses uncertainty relations they derive for continuous-variable systems, which differ from those used in quantum key distribution. In a proof-of-principle experiment they test the protocol for various channel losses using entangled two-mode squeezed states measured with balanced homodyne detection. They say the work enables arbitrary two-party quantum cryptographic protocols with continuous-variable communication systems.
Limits
Security in all three works depends on the storage assumption about the cheating party, which is a physical assumption and not a mathematical one. The 2018 experiment is described by its authors as proof of principle, and none of the three papers reports a deployed system.
FAQ
Does oblivious transfer need an extra assumption?
According to the 2009 paper, not even quantum physics allows all such functionalities without further assumptions. These works assume the adversary lacks large-scale reliable quantum storage.
Do honest parties need quantum memory?
The 2009 authors say no quantum storage is required for the honest parties.
Has it been demonstrated experimentally?
Yes, in laboratory experiments: the 2014 paper reports a 1,366-bit string in about 3 minutes, and the 2018 paper reports a proof-of-principle continuous-variable demonstration.
What differs between bounded and noisy storage?
The 2009 paper says the bounded-storage model covers noiseless but small storage, and the noisy-storage model covers noise with possibly large storage.
Why does oblivious transfer matter?
The 2009 and 2014 papers say any two-party computation can be built from it.
All field notes