Bit commitment protocols, whose security is based on the laws of quantum mechanics alone, are generally held to be impossible on the basis of a concealment-bindingness tradeoff. A strengthened and explicit impossibility proof has been given in: G. M. D'Ariano, D. Kretschmann, D. Schlingemann, and R. F. Werner, Phys. Rev. A 76, 032328 (2007), in the Heisenberg picture and in a C*-algebraic framework, considering all conceivable protocols in which both classical and quantum information are exchanged. In the present paper we provide a new impossibility proof in the Schrodinger picture, greatly simplifying the classification of protocols and strategies using the mathematical formulation in terms of quantum combs, with each single-party strategy represented by a conditional comb. We prove that assuming a stronger notion of concealment--worst-case over the classical information histories--allows Alice's cheat to pass also the worst-case Bob's test. The present approach allows us to restate the concealment-bindingness tradeoff in terms of the continuity of dilations of probabilistic quantum combs with respect to the comb-discriminability distance.
The impossibility proof on unconditionally secure quantum bit commitment is critically reviewed. Different ways of obtaining secure protocols are indicated.
The nature and scope of various impossibility proofs as they relate to real-world situations are discussed. In particular, it is shown in words without technical symbols how secure quantum bit commitment protocols may be obtained with testing that exploits the multiple possibilities of cheating entanglement formation.
In a recent letter (Phys. Lett. A 377 (2013) 1076, arXiv:0905.3801), the authors presented an impossibility proof of quantum bit commitment, which attempted to cover all possible protocols that involve both quantum and classical information. Here we show that there are many errors in the proof, thus it fails to exhaust all conceivable protocols.
The desire to obtain an unconditionally secure bit commitment protocol in quantum cryptography was expressed for the first time thirteen years ago. Bit commitment is sufficient in quantum cryptography to realize a variety of applications with unconditional security. In 1993, a quantum bit commitment protocol was proposed together with a security proof. However, a basic flaw in the protocol was discovered by Mayers in 1995 and subsequently by Lo and Chau. Later the result was generalized by Mayers who showed that unconditionally secure bit commitment is impossible. A brief review on quantum bit…
Quantum key distribution (QKD) is often, more correctly, called key growing. Given a short key as a seed, QKD enables two parties, connected by an insecure quantum channel, to generate a secret key of arbitrary length. Conversely, no key agreement is possible without access to an initial key. Here, we consider another fundamental cryptographic task, commitments. While, similar to key agreement, commitments cannot be realized from scratch, we ask whether they may be grown. That is, given the ability to commit to a fixed number of bits, is there a way to augment this to commitments to strings of…
Bit-commitment is a fundamental cryptographic task, in which Alice commits a bit to Bob such that she cannot later change the value of the bit, while, simultaneously, the bit is hidden from Bob. It is known that ideal bit-commitment is impossible within quantum theory. In this work, we show that it is also impossible in generalised probabilistic theories (under a small set of assumptions) by presenting a quantitative trade-off between Alice's and Bob's cheating probabilities. Our proof relies crucially on a formulation of cheating strategies as cone programs, a natural generalisation of semide…
Bit commitment involves the submission of evidence from one party to another so that the evidence can be used to confirm a later revealed bit value by the first party, while the second party cannot determine the bit value from the evidence alone. It is widely believed that unconditionally secure quantum bit commitment is impossible due to quantum entanglement cheating, which is codified in a general impossibility theorem. In this paper, the scope of this general impossibility proof is analyzed, and gaps are found. Two variants of a bit commitment scheme utilizing anonymous quantum states and d…
The commitment of bits between two mutually distrustful parties is a powerful cryptographic primitive with which many cryptographic objectives can be achieved. It is widely believed that unconditionally secure quantum bit commitment is impossible due to quantum entanglement cheating, which is codified in a general impossibility theorem. Gaps in the proof of this impossibility theorem are found. An unconditionally secure bit commitment protocol utilizing anonymous quantum states and the no-clone theorem is presented below with a full security proof.
Bit commitment involves the submission of evidence from one party to another so that the evidence can be used to confirm a later revealed bit value by the first party, while the second party cannot determine the bit value from the evidence alone. It is widely believed that secure quantum bit commitment is impossible due to quantum entanglement cheating, which is codified in a general impossibility theorem. In this paper, the scope of this general impossibility proof is extended and analyzed, and gaps are found. Three specific protocols are described for which the entanglement cheating as given…
The ``impossibility proof'' on unconditionally secure quantum bit commitment is critically analyzed. Many possibilities for obtaining a secure bit commitment protocol are indicated, purely on the basis of two-way quantum communications, which are not covered by the impossibility proof formulation. They are classified under six new types of protocols, with security proofs for specific examples on four types. Reasons for some previously failed attempts at obtaining secure protocols are also indicated.
The impossibility proof of unconditionally secure quantum bit commitment is crucially dependent on the assertion that Bob is not allowed to generate probability distributions unknown to Alice. This assertion is actually not meaningful, because Bob can always cheat without being detected. In this paper we prove that, for any concealing protocol involving secret probability distributions, there exists a cheating unitary transformation that is known to Alice. Our result closes a gap in the original impossibility proof.
Unconditionally secure non-relativistic bit commitment is known to be impossible in both the classical and the quantum worlds. But when committing to a string of n bits at once, how far can we stretch the quantum limits? In this paper, we introduce a framework for quantum schemes where Alice commits a string of n bits to Bob in such a way that she can only cheat on a bits and Bob can learn at most b bits of information before the reveal phase. Our results are two-fold: we show by an explicit construction that in the traditional approach, where the reveal and guess probabilities form the securi…
Recently, Choi \emph{et al}. proposed an assumption on Mayers-Lo-Chau (MLC) no-go theorem that the state of the entire quantum system is invariable to both participants before the unveiling phase. This means that the theorem is only applicable to static quantum bit commitment (QBC). This paper find that the assumption is unnecessary and the MLC no-go theorem can be applied to not only static QBC, but also non-static one. A non-static QBC protocol proposed by Choi \emph{et al.} is briefly reviewed and analyzed to work as a supporting example. In addition, a novel way to prove the impossibility …
This paper addresses the controversy between Mayers, Lo and Chau on one side, and Yuen on the opposite side, on whether there exist or not unconditionally secure protocols. For such purpose, a complete classification of all possible bit commitment protocols is given, including all possible cheating attacks. For the simplest class of protocols (non-aborting and with complete and perfect verification), it is shown how naturally a game-theoretical situation arises. For these protocols, bounds for the cheating probabilities are derived, which turn out to be different from those given in the imposs…
Mayers, Lo and Chau argued that all quantum bit commitment protocols are insecure, because there is no way to prevent an Einstein-Podolsky-Rosen (EPR) cheating attack. However, Yuen presented some protocols which challenged the previous impossibility argument. Up to now, it is still debated whether there exist or not unconditionally secure protocols. In this paper the above controversy is addressed. For such purpose, a complete classification of all possible bit commitment protocols is given, including all possible cheating attacks. Focusing on the simplest class of protocols (non-aborting and…
It is generally believed that unconditionally secure quantum bit commitment is impossible, due to widespread acceptance of an impossibility proof that utilizes quantum entaglement cheating. In this paper, we delineate how the impossibiliy proof formulation misses various types of quantum bit commitment protocols based on two-way quantum communications. We point out some of the gaps in the impossibility proof reasoning, and present corresponding counterexamples. Four different types of bit commitment protocols are constructed with several new protocol techniques. A specific Type 4 protocol is d…
Quantum protocols for bit commitment have been proposed and it is largely accepted that unconditionally secure quantum bit commitment is not possible; however, it can be more secure than classical bit commitment. In despite of its usefulness, quantum bit commitment protocols have not been experimentally implemented. The main reason is the fact that all proposed quantum bit commitment protocols require quantum memory. In this work, we show a quantum bit commitment protocol that does not require quantum memory and can be implemented with present technology.
We show that three fundamental information-theoretic constraints--the impossibility of superluminal information transfer between two physical systems by performing measurements on one of them, the impossibility of broadcasting the information contained in an unknown physical state, and the impossibility of unconditionally secure bit commitment--suffice to entail that the observables and state space of a physical theory are quantum-mechanical. We demonstrate the converse derivation in part, and consider the implications of alternative answers to a remaining open question about nonlocality and b…
This article describes a quantum bit commitment protocol, QBC1, based on entanglement destruction via forced measurements and proves its unconditional security.
A quantum protocol for bit commitment the security of which is based on technological limitations on nondemolition measurements and long-term quantum memory is presented.
We propose a framework of bit commitment protocol using a comparison scheme and present a compound comparison scheme based on counterfactual cryptography. Finally, we propose a counterfactual quantum bit commitment protocol. In security analysis, we give the proper security parameters for counterfactual quantum bit commitment and prove that intercept attack and intercept/resend attack are ineffective attack for our protocol. In addition, we explain that counterfactual quantum bit commitment protocol cannot be attacked with no-go theorem attack by current technology.
We propose here a two-round relativistic bit commitment scheme where committer commits in the first round and then confirms his/her commitment in the second round. The scheme offers indefinite commitment time where both committer and receiver extract non-locally correlated measurement outcomes during the scheme that can be stored and revealed after arbitrarily long time. We show that the proposed scheme turns out to be a multiparty bit commitment scheme where both parties commit and reveal simultaneously. The multiparty generalization would have applications in business and secure multiparty c…
In this paper, we introduce a new quantum bit commitment protocol which is practically secure against entanglement attacks. A general cheating strategy is discussed and shown to be practically ineffective against the proposed approach.
This paper considers the use an entanglement breaking channel in the construction of a secure bit-commitment protocol. It is shown that this can be done via a depolarizing quantum channel.
Under rather general assumptions about the properties of a noisy quantum channel, a first quantum protocol is proposed which allows to implement the secret bit commitment with the probability arbitrarily close to unity.
It has been recently shown by Mayers that no bit commitment scheme is secure if the participants have unlimited computational power and technology. However it was noticed that a secure protocol could be obtained by forcing the cheater to perform a measurement. Similar situations had been encountered previously in the design of Quantum Oblivious Transfer. The question is whether a classical bit commitment could be used for this specific purpose. We demonstrate that, surprisingly, classical unconditionally concealing bit commitments do not help.
This article describes a quantum bit commitment protocol, QBC3, based on entanglement destruction via forced measurements and proves its unconditional security. Some comments on the current status of the field are also made.
In this work, we propose a quantum bit string commitment protocol using polarization of mesoscopic coherent states. The protocol is described and its security against brute force and quantum cloning machine attack is analyzed.
We propose a practical quantum oblivious transfer and a bit commitment protocols which replace the single-photon source with weak coherent pulses and allow error and loss in channel and detectors. These protocols can be realized with available optoelectronic apparatus.
This paper proposes a cheat sensitive quantum bit commitment (CSQBC) scheme based on single photons, in which Alice commits a bit to Bob. Here, Bob only can cheat the committed bit with probability close to $0$ with the increasing of used single photons' amount. And if Alice altered her committed bit after commitment phase, she will be detected with probability close to $1$ with the increasing of used single photons' amount. The scheme is easy to be realized with nowadays technology.
We show here that the recent work of Wolf and Wullschleger (quant-ph/0502030) on oblivious transfer apparently opens the possibility that non-local correlations which are stronger than those in quantum mechanics could be used for bit-commitment. This is surprising, because it is the very existence of non-local correlations which in quantum mechanics prevents bit-commitment. We resolve this apparent paradox by stressing the difference between non-local correlations and oblivious transfer, based on the time-ordering of their inputs and outputs, which prevents bit-commitment.
The aim of this thesis project is to investigate the bit commitment protocol in the framework of operational probabilistic theories. In particular a careful study is carried on the feasibility of bit commitment in the non-local boxes theory. New aspects of the theory are also presented.
Several kinds of qubit-string-based(QS-based) bit commitment protocols are presented, and a definition of information-theoretic concealing is given. All the protocols presented here are proved to be secure under this definition. We suggest an attack algorithm to obtain the local unitary transformation introduced in no-go theorem, which is used to attack the binding condition, then study the security of our QS-based bit commitment protocols under this attack via introducing a new concept "physical security of protocol". At last we present a practical QS-based bit commitment scheme against chann…
So-called non-local boxes, which have been introduced as an idealization-in different respects-of the behavior of entangled quantum states, have been known to allow for unconditional bit commitment between the two involved parties. We show that, actually, any possible non-local correlation which produces random bits on both sides can be used to implement bit commitment, and that this holds even when the parties are allowed to delay their inputs to the box. Since a particular example is the behavior of an EPR pair, this resource allows for implementing unconditionally secure bit commitment as l…
We provide a non-interactive quantum bit commitment scheme which has statistically-hiding and computationally-binding properties from any quantum one-way function. Our protocol is basically a parallel composition of the previous non-interactive quantum bit commitment schemes (based on quantum one-way permutations, due to Dumais, Mayers and Salvail (EUROCRYPT 2000)) with pairwise independent hash functions. To construct our non-interactive quantum bit commitment scheme from any quantum one-way function, we follow the procedure below: (i) from Dumais-Mayers-Salvail scheme to a weakly-hiding and …
Bit commitment is a fundamental cryptographic primitive with numerous applications. Quantum information allows for bit commitment schemes in the information theoretic setting where no dishonest party can perfectly cheat. The previously best-known quantum protocol by Ambainis achieved a cheating probability of at most 3/4[Amb01]. On the other hand, Kitaev showed that no quantum protocol can have cheating probability less than 1/sqrt{2} [Kit03] (his lower bound on coin flipping can be easily extended to bit commitment). Closing this gap has since been an important and open question. In this pape…
We investigate the existence of secure bit commitment protocols in the convex framework for probabilistic theories. The framework makes only minimal assumptions, and can be used to formalize quantum theory, classical probability theory, and a host of other possibilities. We prove that in all such theories that are locally non-classical but do not have entanglement, there exists a bit commitment protocol that is exponentially secure in the number of systems used.
We proposed a new quantum bit commitment scheme in which secret key need not to be provided by other quantum key distribution system. We can get the bit commitment with probability p by adding a waiting time in a frame during operating the BB84 protocol. Then the measurement outcomes can be encrypted by one-time pad with the key generated by BB84 protocol. We can also obtain the redundant secret keys to encrypt other information in this quantum key distribution system.
Quantum bit-string commitment[A.Kent, Phys.Rev.Lett., 90, 237901 (2003)] or QBSC is a variant of bit commitment (BC). In this paper, we propose a new QBSC protocol that can be implemented using currently available technology, and prove its security under the same security criteria as discussed by Kent. QBSC is a generalization of BC, but has slightly weaker requirements, and our proposed protocol is not intended to break the no-go theorem of quantum BC.
We introduce a new setting for two-party cryptography with temporarily trusted third parties. In addition to Alice and Bob in this setting, there are additional third parties, which Alice and Bob both trust to be honest during the protocol. However, once the protocol concludes, there is no guarantee over the behaviour of these third parties. It is possible that they collaborate and act adversarially. Our goal is to use these third parties to facilitate protocols which are impossible in two-party cryptography. We implement a variant of bit commitment in this setting, which we call erasable bit …
Quantum bit commitment has been known to be impossible by the independent proofs of Mayers, and Lo and Chau, under the assumption that the whole quantum states right before the unveiling phase are static to users. We here provide an unconditionally secure non-static quantum bit commitment protocol with a trusted third party, which is not directly involved in any communications between users and can be limited not to get any information of commitment without being detected by users. We also prove that our quantum bit commitment protocol is not secure without the help of the trusted third party.…
Quantum bit commitment has long been known to be impossible. Nevertheless, just as in the classical case, imposing certain constraints on the power of the parties may enable the construction of asymptotically secure protocols. Here, we introduce a quantum bit commitment protocol and prove that it is asymptotically secure if cheating is restricted to Gaussian operations. This protocol exploits continuous-variable quantum optical carriers, for which such a Gaussian constraint is experimentally relevant as the high optical nonlinearity needed to effect deterministic non-Gaussian cheating is inacc…
Based on the fact that the entanglement can not be created locally, we proposed a quantum bit commitment protocol, in which entangled states and quantum algorithms is used. The bit is not encoded with the form of the quantum states, and delaying the measurement is required. Therefore the protocol will not be denied by the Mayers-Lo-Chau no-go theorem, and unconditional security is achieved.
This paper studies secure multiparty quantum computation (SMQC) without nonlocal measurements. Firstly, this task is reduced to secure two-party quantum computation of nonlocal controlled-NOT (NL-CNOT) gate. Then, in the passive adversaries model, the secure computation of NL-CNOT is reduced to bit commitment. Thus, a SMQC scheme can be constructed based on bit commitment. This scheme does not depend on trusted third party, and is secure in the passive adversaries model. It is also pointed out that a vulnerability exists in any secure two-party quantum computation protocol of NL-CNOT gate.
The claim of quantum cryptography has always been that it can provide protocols that are unconditionally secure, that is, for which the security does not depend on any restriction on the time, space or technology available to the cheaters. We show that this claim does not hold for any quantum bit commitment protocol. Since many cryptographic tasks use bit commitment as a basic primitive, this result implies a severe setback for quantum cryptography. The model used encompasses all reasonable implementations of quantum bit commitment protocols in which the participants have not met before, inclu…
Security trade-offs have been established for one-way bit commitment in quant-ph/0106019. We study this trade-off in two superselection settings. We show that for an `abelian' superselection rule (exemplified by particle conservation) the standard trade-off between sealing and binding properties still holds. For the non-abelian case (exemplified by angular momentum conservation) the security trade-off can be more subtle, which we illustrate by showing that if the bit-commitment is forced to be ancilla-free an asymptotically secure quantum bit commitment is possible.
The ``impossibility proof'' on unconditionally secure quantum bit commitment is examined. It is shown that the possibility of juxtaposing quantum and classical randomness has not been properly taken into account. A specific protocol that beats entanglement cheating with entanglement is proven to be unconditionally secure.
By using local quantum teleportation of a fixed state to one qubit of an entangled pair sent from the other party, it is shown how one party can commit a bit with only classical information as evidence that results in an unconditionally secure protocol. The well-known ``impossibility proof'' does not cover such protocols due to its different commitment and opening prescriptions, which necessitate actual quantum measurements among different possible systems that cannot be entangled as a consequence.
This paper has been withdrawn by the authors,because the proposed protocol is still coverd by the no-go theorem of Mayers, Lo and Chau. We thank H-K. Lo and HF Chau for helpful correspondences.
A class of quantum protocols of bit commitment is constructed based on the nonorthogonal states coding and the correlation immunity of some Boolean functions. The binding condition of these protocols is guaranteed mainly by the law of causality and the concealing condition is guaranteed by the indistinguishability between nonorthogonal quantum states and the correlation immunity of Boolean functions. We also give out an oblivious transfer protocol based on two-nonorthogonal states coding and build a bit commitment protocol on top of it. The relationship between these protocols and the well kno…
A new relativistic quantum protocol is proposed allowing to implement the bit commitment scheme. The protocol is based on the idea that in the relativistic case the field propagation to the region of space accessible to measurement requires, contrary to the non-relativistic case, a finite non-zero time which depends on the structure of the particular state of the field. In principle, the secret bit can be stored for arbitrarily long time with the probability arbitrarily close to unit.
It is shown how the evidence state space in quantum bit commitment may be made to depend on the bit value 0 or 1 with split entangled pairs. As a consequence, one can obtain a protocol that is perfectly concealing, but is also $ε$-binding because the bit-value dependent evidence space prevents the committing party from cheating by means of a local transformation that is independent of the part of evidence state space that has never been in his possession.
