Consider two parties: Alice and Bob and suppose that Bob is given a qubit system in a quantum state $ϕ$, unknown to him. Alice knows $ϕ$ and she is supposed to convince Bob that she knows $ϕ$ sending some test message. Is it possible for her to convince Bob providing him "zero knowledge" i. e. no information about $ϕ$ he has? We prove that there is no "zero knowledge" protocol of that kind. In fact it turns out that basing on Alice message, Bob (or third party - Eve - who can intercept the message) can synthetize a copy of the unknown qubit state $ϕ$ with nonzero probability. This "no-go" result puts general constrains on information processing where information {\it about} quantum state is involved.
The claim of quantum cryptography has always been that it can provide protocols that are unconditionally secure, that is, for which the security does not depend on any restriction on the time, space or technology available to the cheaters. We show that this claim does not hold for any quantum bit commitment protocol. Since many cryptographic tasks use bit commitment as a basic primitive, this result implies a severe setback for quantum cryptography. The model used encompasses all reasonable implementations of quantum bit commitment protocols in which the participants have not met before, inclu…
There had been well known claims of ``provably unbreakable'' quantum protocols for bit commitment and coin tossing. However, we, and independently Mayers, showed that all proposed quantum bit commitment (and therefore coin tossing) schemes are, in principle, insecure because the sender, Alice, can always cheat successfully by using an EPR-type of attack and delaying her measurements. One might wonder if secure quantum bit commitment and coin tossing protocols exist at all. Here we prove that an EPR-type of attack by Alice will, in principle, break {\em any} realistic quantum bit commitment and…
There had been well known claims of unconditionally secure quantum protocols for bit commitment. However, we, and independently Mayers, showed that all proposed quantum bit commitment schemes are, in principle, insecure because the sender, Alice, can almost always cheat successfully by using an Einstein-Podolsky-Rosen (EPR) type of attack and delaying her measurements. One might wonder if secure quantum bit commitment protocols exist at all. We answer this question by showing that the same type of attack by Alice will, in principle, break any bit commitment scheme. The cheating strategy genera…
Unconditionally secure bit commitment and coin flipping are known to be impossible in the classical world. Bit commitment is known to be impossible also in the quantum world. We introduce a related new primitive - {\em quantum bit escrow}. In this primitive Alice commits to a bit $b$ to Bob. The commitment is {\em binding} in the sense that if Alice is asked to reveal the bit, Alice can not bias her commitment without having a good probability of being detected cheating. The commitment is {\em sealing} in the sense that if Bob learns information about the encoded bit, then if later on he is as…
In a secure bit commitment protocol involving only classical physics, A commits either a 0 or a 1 to B. If quantum information is used in the protocol, A may be able to commit a state of the form $α\ket{0} + β\ket{1}$. If so, she can also commit mixed states in which the committed bit is entangled with other quantum states under her control. We introduce here a quantum cryptographic primitive, {\it bit commitment with a certificate of classicality} (BCCC), which differs from standard bit commitment in that it guarantees that the committed state has a fixed classical value. We show that no unco…
Bit-commitment is a fundamental cryptographic task, in which Alice commits a bit to Bob such that she cannot later change the value of the bit, while, simultaneously, the bit is hidden from Bob. It is known that ideal bit-commitment is impossible within quantum theory. In this work, we show that it is also impossible in generalised probabilistic theories (under a small set of assumptions) by presenting a quantitative trade-off between Alice's and Bob's cheating probabilities. Our proof relies crucially on a formulation of cheating strategies as cone programs, a natural generalisation of semide…
Bit commitment protocols whose security is based on the laws of quantum mechanics alone are generally held to be impossible. In this paper we give a strengthened and explicit proof of this result. We extend its scope to a much larger variety of protocols, which may have an arbitrary number of rounds, in which both classical and quantum information is exchanged, and which may include aborts and resets. Moreover, we do not consider the receiver to be bound to a fixed "honest" strategy, so that "anonymous state protocols", which were recently suggested as a possible way to beat the known no-go re…
Lo and Chau showed that an ideal quantum coin flipping protocol is impossible. The proof was simply derived from the impossibility proof of quantum bit commitment. However, the proof still leaves the possibility of a quantum coin flipping protocol with arbitrary small bias. In this paper, we show that a quantum coin flipping protocol with arbitrary small bias is impossible and show the lower bound of the bias of quantum coin flipping protocol.
Mixed states of a quantum system, represented by density operators, can be decomposed as a statistical mixture of pure states in a number of ways where each decomposition can be viewed as a different preparation recipe. However the fact that the density matrix contains full information about the ensemble makes it impossible to estimate the preparation basis for the quantum system. Here we present a measurement scheme to (seemingly) improve the performance of unsharp measurements. We argue that in some situations this scheme is capable of providing statistics from a single copy of the quantum s…
We give a simple proof that it is impossible to guarantee the classicality of inputs into any mistrustful quantum cryptographic protocol. The argument illuminates the impossibility of unconditionally secure quantum implementations of essentially classical tasks such as bit commitment with a certified classical committed bit, classical oblivious transfer, and secure classical multi-party computations of secret classical data. It applies to both non-relativistic and relativistic protocols.
Unconditionally secure non-relativistic bit commitment is known to be impossible in both the classical and the quantum worlds. But when committing to a string of n bits at once, how far can we stretch the quantum limits? In this paper, we introduce a framework for quantum schemes where Alice commits a string of n bits to Bob in such a way that she can only cheat on a bits and Bob can learn at most b bits of information before the reveal phase. Our results are two-fold: we show by an explicit construction that in the traditional approach, where the reveal and guess probabilities form the securi…
The commitment of bits between two mutually distrustful parties is a powerful cryptographic primitive with which many cryptographic objectives can be achieved. It is widely believed that unconditionally secure quantum bit commitment is impossible due to quantum entanglement cheating, which is codified in a general impossibility theorem. Gaps in the proof of this impossibility theorem are found. An unconditionally secure bit commitment protocol utilizing anonymous quantum states and the no-clone theorem is presented below with a full security proof.
Unconditionally secure non-relativistic bit commitment is known to be impossible in both the classical and the quantum world. However, when committing to a string of n bits at once, how far can we stretch the quantum limits? In this letter, we introduce a framework of quantum schemes where Alice commits a string of n bits to Bob, in such a way that she can only cheat on a bits and Bob can learn at most b bits of information before the reveal phase. Our results are two-fold: we show by an explicit construction that in the traditional approach, where the reveal and guess probabilities form the s…
Though it was proven that secure quantum sealing of a single classical bit is impossible in principle, here we propose an unconditionally secure quantum sealing protocol which seals a classical bit string. Any reader can obtain each bit of the sealed string with an arbitrarily small error rate, while reading the string is detectable. The protocol is simple and easy to be implemented. The possibility of using this protocol to seal a single bit in practical is also discussed.
Quantum bit commitment has long been known to be impossible. Nevertheless, just as in the classical case, imposing certain constraints on the power of the parties may enable the construction of asymptotically secure protocols. Here, we introduce a quantum bit commitment protocol and prove that it is asymptotically secure if cheating is restricted to Gaussian operations. This protocol exploits continuous-variable quantum optical carriers, for which such a Gaussian constraint is experimentally relevant as the high optical nonlinearity needed to effect deterministic non-Gaussian cheating is inacc…
The desire to obtain an unconditionally secure bit commitment protocol in quantum cryptography was expressed for the first time thirteen years ago. Bit commitment is sufficient in quantum cryptography to realize a variety of applications with unconditional security. In 1993, a quantum bit commitment protocol was proposed together with a security proof. However, a basic flaw in the protocol was discovered by Mayers in 1995 and subsequently by Lo and Chau. Later the result was generalized by Mayers who showed that unconditionally secure bit commitment is impossible. A brief review on quantum bit…
Bit commitment involves the submission of evidence from one party to another so that the evidence can be used to confirm a later revealed bit value by the first party, while the second party cannot determine the bit value from the evidence alone. It is widely believed that secure quantum bit commitment is impossible due to quantum entanglement cheating, which is codified in a general impossibility theorem. In this paper, the scope of this general impossibility proof is extended and analyzed, and gaps are found. Three specific protocols are described for which the entanglement cheating as given…
Unconditionally secure two-party bit commitment based solely on the principles of quantum mechanics (without exploiting special relativistic signalling constraints, or principles of general relativity or thermodynamics) has been shown to be impossible, but the claim is repeatedly challenged. The quantum bit commitment theorem is reviewed here and the central conceptual point, that an `Einstein-Podolsky-Rosen' attack or cheating strategy can always be applied, is clarified. The question of whether following such a cheating strategy can ever be disadvantageous to the cheater is considered and an…
Using unstable particles which decay by emitting neutrinos, we propose a quantum bit commitment protocol that is humanly impossible to break. Neutrinos carry away quantum information, but their interaction with matter is so weak that it would take an astronomically-sized machine just to catch them, not to mention performing controlled unitary operations on them. As a result quantum information is lost, and cheating is not possible even if the participants had access to the most powerful quantum computers that could ever be built. Therefore, for all practical purposes, our new protocol is as go…
It is generally believed that unconditionally secure quantum bit commitment (QBC) is proven impossible by a "no-go theorem". We point out that the theorem only establishes the existence of a cheating unitary transformation in any QBC scheme secure against the receiver, but this fact alone is not sufficient to rule out unconditionally secure QBC as a matter of principle, because there exists no proof that the cheating unitary transformation must be known to the cheater in all possible cases. In this work, we show how to circumvent the "no-go theorem" and prove that unconditionally secure QBC is…
Classical information encoded in composite quantum states can be completely hidden from the reduced subsystems and may be found only in the correlations. Can the same be true for quantum information? If quantum information is hidden from subsystems and spread over quantum correlation, we call it as masking of quantum information. We show that while this may still be true for some restricted sets of non-orthogonal quantum states, it is not possible for arbitrary quantum states. This result suggests that quantum qubit commitment -- a stronger version of the quantum bit commitment is not possible…
Quantum bit commitment has been known to be impossible by the independent proofs of Mayers, and Lo and Chau, under the assumption that the whole quantum states right before the unveiling phase are static to users. We here provide an unconditionally secure non-static quantum bit commitment protocol with a trusted third party, which is not directly involved in any communications between users and can be limited not to get any information of commitment without being detected by users. We also prove that our quantum bit commitment protocol is not secure without the help of the trusted third party.…
Unconditionally secure quantum bit commitment (QBC) was considered impossible. But the no-go proofs are based on the Hughston-Jozsa-Wootters (HJW) theorem (a.k.a. the Uhlmann theorem). Recently it was found that in high-dimensional systems, there exist some states which can display a chaos effect in quantum steering, so that the attack strategy based on the HJW theorem has to require the capability of discriminating quantum states with very subtle difference, to the extent that is not allowed by the uncertainty principle. With the help of this finding, here we propose a simple QBC protocol whi…
It is generally believed that unconditionally secure quantum bit commitment is impossible, due to widespread acceptance of an impossibility proof that utilizes quantum entaglement cheating. In this paper, we delineate how the impossibiliy proof formulation misses various types of quantum bit commitment protocols based on two-way quantum communications. We point out some of the gaps in the impossibility proof reasoning, and present corresponding counterexamples. Four different types of bit commitment protocols are constructed with several new protocol techniques. A specific Type 4 protocol is d…
Coin tossing is a cryptographic task in which two parties who do not trust each other aim to generate a common random bit. Using classical communication this is impossible, but non trivial coin tossing is possible using quantum communication. Here we consider the case when the parties do not want to toss a single coin, but many. This is called bit string generation. We report the experimental generation of strings of coins which are provably more random than achievable using classical communication. The experiment is based on the ``plug and play'' scheme developed for quantum cryptography, and…
We show that a secure quantum protocol for coin tossing exist. The existence of quantum coin tossing support the conjecture of D.Mayers [Phys.Rev.Lett. 78, 3414(1997)] that only asymmetrical tasks as quantum bit commitment are impossible.
We define cheat sensitive cryptographic protocols between mistrustful parties as protocols which guarantee that, if either cheats, the other has some nonzero probability of detecting the cheating. We give an example of an unconditionally secure cheat sensitive non-relativistic bit commitment protocol which uses quantum information to implement a task which is classically impossible; we also describe a simple relativistic protocol.
We argue, through some philosophical considerations, on (i)dependent or (ii) an independent existence of physical reality underlying quantum states. According these simple considerations, we conclude that is impossible to have a clear independent existence of physical reality, we need to search the reasons in the relationship between our questions (the observers) and the consequent answers (always estimated by the same observers). Finally, we infer that every theory is affected by our "questions", so we cannot speak about an unconditional and independent theory underlying physical reality. Pla…
Bit commitment involves the submission of evidence from one party to another so that the evidence can be used to confirm a later revealed bit value by the first party, while the second party cannot determine the bit value from the evidence alone. It is widely believed that unconditionally secure quantum bit commitment is impossible due to quantum entanglement cheating, which is codified in a general impossibility theorem. In this paper, the scope of this general impossibility proof is analyzed, and gaps are found. Two variants of a bit commitment scheme utilizing anonymous quantum states and d…
While unconditionally secure bit commitment (BC) is considered impossible within the quantum framework, it can be obtained under relativistic or experimental constraints. Here we study whether such BC can lead to secure quantum oblivious transfer (QOT). The answer is not completely negative. On one hand, we provide a detailed cheating strategy, showing that the "honest-but-curious adversaries" in some of the existing no-go proofs on QOT still apply even if secure BC is used, enabling the receiver to increase the average reliability of the decoded value of the transferred bit. On the other hand…
Bit commitment is a fundamental cryptographic task that guarantees a secure commitment between two mutually mistrustful parties and is a building block for many cryptographic primitives, including coin tossing, zero-knowledge proofs, oblivious transfer and secure two-party computation. Unconditionally secure bit commitment was thought to be impossible until recent theoretical protocols that combine quantum mechanics and relativity were shown to elude previous impossibility proofs. Here we implement such a bit commitment protocol. In the experiment, the committer performs quantum measurements u…
Bit commitment is a fundamental cryptographic primitive in which Alice wishes to commit a secret bit to Bob. Perfectly secure bit commitment between two mistrustful parties is impossible through asynchronous exchange of quantum information. Perfect security is however possible when Alice and Bob each split into several agents exchanging classical information at times and locations suitably chosen to satisfy specific relativistic constraints. In this Letter we first revisit a previously proposed scheme that realizes bit commitment using only classical communication. We prove that the protocol i…
For more than a decade, it was believed that unconditionally secure quantum bit commitment (QBC) is impossible. But basing on a previously proposed quantum key distribution scheme using orthogonal states, here we build a QBC protocol in which the density matrices of the quantum states encoding the commitment do not satisfy a crucial condition on which the no-go proofs of QBC are based. Thus the no-go proofs could be evaded. Our protocol is fault-tolerant and very feasible with currently available technology. It reopens the venue for other "post-cold-war" multi-party cryptographic protocols, e.…
Although it is impossible for a bit commitment protocol to be both arbitrarily concealing and arbitrarily binding, it is possible for it to be both partially concealing and partially binding. This means that Bob cannot, prior to the beginning of the unveiling phase, find out everything about the bit committed, and Alice cannot, through actions taken after the end of the commitment phase, unveil whatever bit she desires. We determine upper bounds on the degrees of concealment and bindingness that can be achieved simultaneously in any bit commitment protocol, although it is unknown whether these…
A bit string commitment protocol securely commits $N$ classical bits in such a way that the recipient can extract only $M<N$ bits of information about the string. Classical reasoning might suggest that bit string commitment implies bit commitment and hence, given the Mayers-Lo-Chau theorem, that non-relativistic quantum bit string commitment is impossible. Not so: there exist non-relativistic quantum bit string commitment protocols, with security parameters $ε$ and $M$, that allow $A$ to commit $N = N(M, ε)$ bits to $B$ so that $A$'s probability of successfully cheating when revealing any bit …
We prove the unconditional security of a quantum key distribution (QKD) protocol on a noisy channel against the most general attack allowed by quantum physics. We use the fact that in a previous paper we have reduced the proof of the unconditionally security of this QKD protocol to a proof that a corresponding Quantum String Oblivious Transfer (String-QOT) protocol would be unconditionally secure against Bob if implemented on top of an unconditionally secure bit commitment scheme. We prove a lemma that extends a security proof given by Yao for a (one bit) QOT protocol to this String-QOT protoc…
We introduce a new setting for two-party cryptography with temporarily trusted third parties. In addition to Alice and Bob in this setting, there are additional third parties, which Alice and Bob both trust to be honest during the protocol. However, once the protocol concludes, there is no guarantee over the behaviour of these third parties. It is possible that they collaborate and act adversarially. Our goal is to use these third parties to facilitate protocols which are impossible in two-party cryptography. We implement a variant of bit commitment in this setting, which we call erasable bit …
A well known cryptographic primitive is so called random access code. Namely, Alice is to send to Bob one of two bits, so that Bob has the choice which bit he wants to learn about. However at any time Alice should not learn Bob's choice, and Bob should learn only the bit of his choice. The task is impossible to accomplish by means of either classical or quantum communication. On the other hand, a concept of correlations stronger than quantum ones, exhibited by so called Popescu- Rohrlich box, was introduced and widely studied. In particular, it is known that Popescu-Rohrlich box enables simula…
Bit commitment is a fundamental cryptographic primitive in which Bob wishes to commit a secret bit to Alice. Perfectly secure bit commitment has been proven impossible through asynchronous exchange of classical and quantum information. Perfect security is however possible by restraining the exchange of classical and quantum information to suitably chosen relativistic constraints. This requires Alice (and Bob) to split into two remote agents performing space-like separated classical communication, and in one agent exchanging quantum bits with the other party. The duration of the commitment is g…
Bit commitment protocols, whose security is based on the laws of quantum mechanics alone, are generally held to be impossible on the basis of a concealment-bindingness tradeoff. A strengthened and explicit impossibility proof has been given in: G. M. D'Ariano, D. Kretschmann, D. Schlingemann, and R. F. Werner, Phys. Rev. A 76, 032328 (2007), in the Heisenberg picture and in a C*-algebraic framework, considering all conceivable protocols in which both classical and quantum information are exchanged. In the present paper we provide a new impossibility proof in the Schrodinger picture, greatly si…
Oblivious transfer, a central functionality in modern cryptography, allows a party to send two one-bit messages to another who can choose one of them to read, remaining ignorant about the other, whereas the sender does not learn the receiver's choice. Oblivious transfer the security of which is information-theoretic for both parties is known impossible to achieve from scratch. - The joint behavior of certain bi-partite quantum states is non-local, i.e., cannot be explained by shared classical information. In order to better understand such behavior, which is classically explainable only by com…
Relativistic protocols have been proposed to overcome some impossibility results in classical and quantum cryptography. In such a setting, one takes the location of honest players into account, and uses the fact that information cannot travel faster than the speed of light to limit the abilities of dishonest agents. For example, various relativistic bit commitment protocols have been proposed. Although it has been shown that bit commitment is sufficient to construct oblivious transfer and thus multiparty computation, composing specific relativistic protocols in this way is known to be insecure…
The existence of entangled quantum states gives extra power to quantum computers over their classical counterparts. Quantum entanglement shows up qualitatively at the level of two qubits. We show that if no entanglement is envolved then whatever one can do with qubits can also be done with classical optical systems. We demonstrate that the one- and the two-bit Deutsch-Jozsa algorithm does not require entanglement and can be mapped onto a classical optical scheme. It is only for three and more input bits that the DJ algorithm requires the implementation of entangling transformations and in thes…
Bit commitment schemes are at the basis of modern cryptography. Since information-theoretic security is impossible both in the classical and the quantum regime, we need to look at computationally secure commitment schemes. In this paper, we study worst-case complexity assumptions that imply quantum bit-commitment schemes. First, we show that QSZK not included in QMA implies a computationally hiding and statistically binding auxiliary-input quantum commitment scheme. Additionally, we give auxiliary-input commitment schemes using quantum advice that depend on the much weaker assumption that QIP …
We find a protocol transmitting two quantum states crossly in the butterfly network only with prior entanglement between two senders. This protocol requires only one qubit transmission or two classical bits transmission in each channel in the butterfly network. It is also proved that it is impossible without prior entanglement. More precisely, an upper bound of average fidelity is given in the butterfly network when prior entanglement is not allowed.
In coin tossing two remote participants want to share a uniformly distributed random bit. At the least in the quantum version, each participant test whether or not the other has attempted to create a bias on this bit. It is requested that, for b = 0,1, the probability that Alice gets bit b and pass the test is smaller than 1/2 whatever she does, and similarly for Bob. If the bound 1/2 holds perfectly against any of the two participants, the task realised is called an exact coin tossing. If the bound is actually $1/2 + ξ$ where the bias $ξ$ vanishes when a security parameter m defined by the pr…
Quantum cryptographic key distribution (QKD) uses extremely faint light pulses to carry quantum information between two parties (Alice and Bob), allowing them to generate a shared, secret cryptographic key. Autocompensating QKD systems automatically and passively compensate for uncontrolled time dependent variations of the optical fiber properties by coding the information as a differential phase between orthogonally-polarized components of a light pulse sent on a round trip through the fiber, reflected at mid-course using a Faraday mirror. We have built a prototype system based on standard te…
It is well known that unconditionally secure bit commitment is impossible even in the quantum world. In this paper a weak variant of quantum bit commitment, introduced independently by Aharonov et al. [STOC, 2000] and Hardy and Kent [Phys. Rev. Lett. 92 (2004)] is investigated. In this variant, the parties require some nonzero probability of detecting a cheating, i.e. if Bob, who commits a bit b to Alice, changes his mind during the revealing phase then Alice detects the cheating with a positive probability (we call this property binding); and if Alice gains information about the committed bit…
Information causality states that the information obtainable by a receiver cannot be greater than the communication bits from a sender, even if they utilize no-signaling resources. This physical principle successfully explains some boundaries between quantum and post-quantum nonlocal correlations, where the obtainable information reaches the maximum limit. We show that no-signaling resources of pure partially entangled states produce randomness (or noise) in the communication bits, and achievement of the maximum limit is impossible, i.e., the information causality principle is insufficient for…
In the postprocessing of quantum key distribution, the raw key bits from the mismatched-basis measurements, where two parties use different bases, are normally discarded. Here, we propose a postprocessing method that exploits measurement statistics from mismatched-basis cases, and prove that incorporating these statistics enables uncharacterized qubit sources to be used in the measurement-device-independent quantum key distribution protocol and the Bennett-Brassard 1984 protocol, a case which is otherwise impossible.
String commitment schemes are similar to the well studied bit commitment schemes in cryptography with the difference that the committing party, say Alice, is supposed to commit a long string instead of a single bit, to another party say Bob. Similar to bit commitment schemes, such schemes are supposed to be binding, i.e Alice cannot change her choice after committing, and concealing i.e. Bob cannot find Alice's committed string before Alice reveals it. Ideal commitment schemes are known to be impossible. Even if some degrees of cheating is allowed, Buhrman, Christandl, Hayden, Lo and Wehner (q…
Counterfactual quantum communication is unique in its own way that allows remote parties to transfer information without sending any message carrier in the channel. Although no message carrier travels in the channel at the time of successful information transmission, it is impossible to transmit information faster than the speed of light, thus without an information carrier. In this paper, we address an important question What carries the information in counterfactual quantum communication? and optimize the resource efficiency of the counterfactual quantum communication in terms of the number …
