Unconditionally secure non-relativistic bit commitment is known to be impossible in both the classical and the quantum worlds. But when committing to a string of n bits at once, how far can we stretch the quantum limits? In this paper, we introduce a framework for quantum schemes where Alice commits a string of n bits to Bob in such a way that she can only cheat on a bits and Bob can learn at most b bits of information before the reveal phase. Our results are two-fold: we show by an explicit construction that in the traditional approach, where the reveal and guess probabilities form the security criteria, no good schemes can exist: a+b is at least n. If, however, we use a more liberal criterion of security, the accessible information, we construct schemes where a=4log n+O(1) and b=4, which is impossible classically. We furthermore present a cheat-sensitive quantum bit string commitment protocol for which we give an explicit tradeoff between Bob's ability to gain information about the committed string, and the probability of him being detected cheating.
This paper proposes a cheat sensitive quantum bit commitment (CSQBC) scheme based on single photons, in which Alice commits a bit to Bob. Here, Bob only can cheat the committed bit with probability close to $0$ with the increasing of used single photons' amount. And if Alice altered her committed bit after commitment phase, she will be detected with probability close to $1$ with the increasing of used single photons' amount. The scheme is easy to be realized with nowadays technology.
Cheat sensitive quantum bit commitment (CSQBC) loosens the security requirement of quantum bit commitment (QBC), so that the existing impossibility proofs of unconditionally secure QBC can be evaded. But here we analyze the common features in all existing CSQBC protocols, and show that in any CSQBC having these features, the receiver can always learn a non-trivial amount of information on the sender's committed bit before it is unveiled, while his cheating can pass the security check with a probability not less than 50%. The sender's cheating is also studied. The optimal CSQBC protocols that c…
Quantum protocols for coin-flipping can be composed in series in such a way that a cheating party gains no extra advantage from using entanglement between different rounds. This composition principle applies to coin-flipping protocols with cheat sensitivity as well, and is used to derive two results: There are no quantum strong coin-flipping protocols with cheat sensitivity that is linear in the bias (or bit-commitment protocols with linear cheat detection) because these can be composed to produce strong coin-flipping with arbitrarily small bias. On the other hand, it appears that quadratic ch…
Bit commitment is a fundamental cryptographic primitive with numerous applications. Quantum information allows for bit commitment schemes in the information theoretic setting where no dishonest party can perfectly cheat. The previously best-known quantum protocol by Ambainis achieved a cheating probability of at most 3/4[Amb01]. On the other hand, Kitaev showed that no quantum protocol can have cheating probability less than 1/sqrt{2} [Kit03] (his lower bound on coin flipping can be easily extended to bit commitment). Closing this gap has since been an important and open question. In this pape…
In this paper, we study relativistic bit commitment, which uses timing and location constraints to achieve information theoretic security. We consider the $F_Q$ multi-round bit commitment scheme introduced by Lunghi et al. [LKB+15]. This protocol was shown secure against classical adversaries as long as the number of rounds $m$ is small compared to $\sqrt{Q}$ where $Q$ is the size of the used field in the protocol [CCL15,FF16]. In this work, we study classical attacks on this scheme. We use classical strategies for the $CHSH_Q$ game described in [BS15] to derive cheating strategies for this pr…
We define cheat sensitive cryptographic protocols between mistrustful parties as protocols which guarantee that, if either cheats, the other has some nonzero probability of detecting the cheating. We give an example of an unconditionally secure cheat sensitive non-relativistic bit commitment protocol which uses quantum information to implement a task which is classically impossible; we also describe a simple relativistic protocol.
The impossibility proof on unconditionally secure quantum bit commitment is critically reviewed. Different ways of obtaining secure protocols are indicated.
The nature and scope of various impossibility proofs as they relate to real-world situations are discussed. In particular, it is shown in words without technical symbols how secure quantum bit commitment protocols may be obtained with testing that exploits the multiple possibilities of cheating entanglement formation.
Unconditionally secure two-party bit commitment based solely on the principles of quantum mechanics (without exploiting special relativistic signalling constraints, or principles of general relativity or thermodynamics) has been shown to be impossible, but the claim is repeatedly challenged. The quantum bit commitment theorem is reviewed here and the central conceptual point, that an `Einstein-Podolsky-Rosen' attack or cheating strategy can always be applied, is clarified. The question of whether following such a cheating strategy can ever be disadvantageous to the cheater is considered and an…
In a recent letter (Phys. Lett. A 377 (2013) 1076, arXiv:0905.3801), the authors presented an impossibility proof of quantum bit commitment, which attempted to cover all possible protocols that involve both quantum and classical information. Here we show that there are many errors in the proof, thus it fails to exhaust all conceivable protocols.
It is generally believed that unconditionally secure quantum bit commitment (QBC) is proven impossible by a "no-go theorem". We point out that the theorem only establishes the existence of a cheating unitary transformation in any QBC scheme secure against the receiver, but this fact alone is not sufficient to rule out unconditionally secure QBC as a matter of principle, because there exists no proof that the cheating unitary transformation must be known to the cheater in all possible cases. In this work, we show how to circumvent the "no-go theorem" and prove that unconditionally secure QBC is…
It is well known that unconditionally secure bit commitment is impossible even in the quantum world. In this paper a weak variant of quantum bit commitment, introduced independently by Aharonov et al. [STOC, 2000] and Hardy and Kent [Phys. Rev. Lett. 92 (2004)] is investigated. In this variant, the parties require some nonzero probability of detecting a cheating, i.e. if Bob, who commits a bit b to Alice, changes his mind during the revealing phase then Alice detects the cheating with a positive probability (we call this property binding); and if Alice gains information about the committed bit…
The desire to obtain an unconditionally secure bit commitment protocol in quantum cryptography was expressed for the first time thirteen years ago. Bit commitment is sufficient in quantum cryptography to realize a variety of applications with unconditional security. In 1993, a quantum bit commitment protocol was proposed together with a security proof. However, a basic flaw in the protocol was discovered by Mayers in 1995 and subsequently by Lo and Chau. Later the result was generalized by Mayers who showed that unconditionally secure bit commitment is impossible. A brief review on quantum bit…
The impossibility proof of unconditionally secure quantum bit commitment is crucially dependent on the assertion that Bob is not allowed to generate probability distributions unknown to Alice. This assertion is actually not meaningful, because Bob can always cheat without being detected. In this paper we prove that, for any concealing protocol involving secret probability distributions, there exists a cheating unitary transformation that is known to Alice. Our result closes a gap in the original impossibility proof.
Quantum bit commitment has long been known to be impossible. Nevertheless, just as in the classical case, imposing certain constraints on the power of the parties may enable the construction of asymptotically secure protocols. Here, we introduce a quantum bit commitment protocol and prove that it is asymptotically secure if cheating is restricted to Gaussian operations. This protocol exploits continuous-variable quantum optical carriers, for which such a Gaussian constraint is experimentally relevant as the high optical nonlinearity needed to effect deterministic non-Gaussian cheating is inacc…
Quantum key distribution (QKD) is often, more correctly, called key growing. Given a short key as a seed, QKD enables two parties, connected by an insecure quantum channel, to generate a secret key of arbitrary length. Conversely, no key agreement is possible without access to an initial key. Here, we consider another fundamental cryptographic task, commitments. While, similar to key agreement, commitments cannot be realized from scratch, we ask whether they may be grown. That is, given the ability to commit to a fixed number of bits, is there a way to augment this to commitments to strings of…
In this paper, we introduce a new quantum bit commitment protocol which is practically secure against entanglement attacks. A general cheating strategy is discussed and shown to be practically ineffective against the proposed approach.
Bit commitment involves the submission of evidence from one party to another so that the evidence can be used to confirm a later revealed bit value by the first party, while the second party cannot determine the bit value from the evidence alone. It is widely believed that secure quantum bit commitment is impossible due to quantum entanglement cheating, which is codified in a general impossibility theorem. In this paper, the scope of this general impossibility proof is extended and analyzed, and gaps are found. Three specific protocols are described for which the entanglement cheating as given…
Bit-commitment is a fundamental cryptographic task, in which Alice commits a bit to Bob such that she cannot later change the value of the bit, while, simultaneously, the bit is hidden from Bob. It is known that ideal bit-commitment is impossible within quantum theory. In this work, we show that it is also impossible in generalised probabilistic theories (under a small set of assumptions) by presenting a quantitative trade-off between Alice's and Bob's cheating probabilities. Our proof relies crucially on a formulation of cheating strategies as cone programs, a natural generalisation of semide…
Bit commitment involves the submission of evidence from one party to another so that the evidence can be used to confirm a later revealed bit value by the first party, while the second party cannot determine the bit value from the evidence alone. It is widely believed that unconditionally secure quantum bit commitment is impossible due to quantum entanglement cheating, which is codified in a general impossibility theorem. In this paper, the scope of this general impossibility proof is analyzed, and gaps are found. Two variants of a bit commitment scheme utilizing anonymous quantum states and d…
The commitment of bits between two mutually distrustful parties is a powerful cryptographic primitive with which many cryptographic objectives can be achieved. It is widely believed that unconditionally secure quantum bit commitment is impossible due to quantum entanglement cheating, which is codified in a general impossibility theorem. Gaps in the proof of this impossibility theorem are found. An unconditionally secure bit commitment protocol utilizing anonymous quantum states and the no-clone theorem is presented below with a full security proof.
The ``impossibility proof'' on unconditionally secure quantum bit commitment is critically analyzed. Many possibilities for obtaining a secure bit commitment protocol are indicated, purely on the basis of two-way quantum communications, which are not covered by the impossibility proof formulation. They are classified under six new types of protocols, with security proofs for specific examples on four types. Reasons for some previously failed attempts at obtaining secure protocols are also indicated.
Bit commitment protocols, whose security is based on the laws of quantum mechanics alone, are generally held to be impossible on the basis of a concealment-bindingness tradeoff. A strengthened and explicit impossibility proof has been given in: G. M. D'Ariano, D. Kretschmann, D. Schlingemann, and R. F. Werner, Phys. Rev. A 76, 032328 (2007), in the Heisenberg picture and in a C*-algebraic framework, considering all conceivable protocols in which both classical and quantum information are exchanged. In the present paper we provide a new impossibility proof in the Schrodinger picture, greatly si…
Impossibility of perfect cheating for single-qubit position verification
National Institute of Standards and Technology（美国国家标准与技术研究院）；Joint Center for Quantum Information and Computer Science (QuICS), University of Maryland（马里兰大学量子信息与计算联合中心）；Department of Computing, Arabian Gulf University（阿拉伯海湾大学计算系）
Unconditionally secure bit commitment and coin flipping are known to be impossible in the classical world. Bit commitment is known to be impossible also in the quantum world. We introduce a related new primitive - {\em quantum bit escrow}. In this primitive Alice commits to a bit $b$ to Bob. The commitment is {\em binding} in the sense that if Alice is asked to reveal the bit, Alice can not bias her commitment without having a good probability of being detected cheating. The commitment is {\em sealing} in the sense that if Bob learns information about the encoded bit, then if later on he is as…
It is well known that no quantum bit commitment protocol is unconditionally secure. Nonetheless, there can be non-trivial upper bounds on both Bob's probability of correctly estimating Alice's commitment and Alice's probability of successfully unveiling whatever bit she desires. In this paper, we seek to determine these bounds for generalizations of the BB84 bit commitment protocol. In such protocols, an honest Alice commits to a bit by randomly choosing a state from a specified set and submitting this to Bob, and later unveils the bit to Bob by announcing the chosen state, at which point Bob …
Mayers, Lo and Chau argued that all quantum bit commitment protocols are insecure, because there is no way to prevent an Einstein-Podolsky-Rosen (EPR) cheating attack. However, Yuen presented some protocols which challenged the previous impossibility argument. Up to now, it is still debated whether there exist or not unconditionally secure protocols. In this paper the above controversy is addressed. For such purpose, a complete classification of all possible bit commitment protocols is given, including all possible cheating attacks. Focusing on the simplest class of protocols (non-aborting and…
It has been recently shown by Mayers that no bit commitment scheme is secure if the participants have unlimited computational power and technology. However it was noticed that a secure protocol could be obtained by forcing the cheater to perform a measurement. Similar situations had been encountered previously in the design of Quantum Oblivious Transfer. The question is whether a classical bit commitment could be used for this specific purpose. We demonstrate that, surprisingly, classical unconditionally concealing bit commitments do not help.
This paper addresses the controversy between Mayers, Lo and Chau on one side, and Yuen on the opposite side, on whether there exist or not unconditionally secure protocols. For such purpose, a complete classification of all possible bit commitment protocols is given, including all possible cheating attacks. For the simplest class of protocols (non-aborting and with complete and perfect verification), it is shown how naturally a game-theoretical situation arises. For these protocols, bounds for the cheating probabilities are derived, which turn out to be different from those given in the imposs…
We study cheating strategies against a practical four-state quantum bit-commitment protocol and its two-state variant when the underlying quantum channels are noisy and the cheating party is constrained to using single-qubit measurements only. We show that simply inferring the transmitted photons' states by using the Breidbart basis, optimal for ambiguous (minimum-error) state discrimination, does not directly produce an optimal cheating strategy for this bit-commitment protocol. We introduce a new strategy, based on certain post-measurement processes, and show it to have better chances at che…
Recently, Choi \emph{et al}. proposed an assumption on Mayers-Lo-Chau (MLC) no-go theorem that the state of the entire quantum system is invariable to both participants before the unveiling phase. This means that the theorem is only applicable to static quantum bit commitment (QBC). This paper find that the assumption is unnecessary and the MLC no-go theorem can be applied to not only static QBC, but also non-static one. A non-static QBC protocol proposed by Choi \emph{et al.} is briefly reviewed and analyzed to work as a supporting example. In addition, a novel way to prove the impossibility …
The ``impossibility proof'' on unconditionally secure quantum bit commitment is examined. It is shown that the possibility of juxtaposing quantum and classical randomness has not been properly taken into account. A specific protocol that beats entanglement cheating with entanglement is proven to be unconditionally secure.
It is generally believed that unconditionally secure quantum bit commitment is impossible, due to widespread acceptance of an impossibility proof that utilizes quantum entaglement cheating. In this paper, we delineate how the impossibiliy proof formulation misses various types of quantum bit commitment protocols based on two-way quantum communications. We point out some of the gaps in the impossibility proof reasoning, and present corresponding counterexamples. Four different types of bit commitment protocols are constructed with several new protocol techniques. A specific Type 4 protocol is d…
We simplified our previously proposed quantum bit commitment (QBC) protocol based on the Mach-Zehnder interferometer, by replacing symmetric beam splitters with asymmetric ones. It eliminates the need for random sending time of the photons; thus, the feasibility and efficiency are both improved. The protocol is immune to the cheating strategy in the Mayers-Lo-Chau no-go theorem of unconditionally secure QBC, because the density matrices of the committed states do not satisfy a crucial condition on which the no-go theorem holds.
The relationship between the quantum bit commitment (QBC) and quantum seal (QS) is studied. It is elaborated that QBC and QS are not equivalent, but QS protocols satisfying a stronger unconditional security requirement can lead to an unconditionally secure QBC. In this sense, QS is strictly stronger than QBC in security requirements. Based on an earlier proposal on sealing a single bit, a feasible QBC protocol is also put forward, which is secure in practice even if the cheater has a strong quantum computational power.
It is shown how the evidence state space in quantum bit commitment may be made to depend on the bit value 0 or 1 with split entangled pairs. As a consequence, one can obtain a protocol that is perfectly concealing, but is also $ε$-binding because the bit-value dependent evidence space prevents the committing party from cheating by means of a local transformation that is independent of the part of evidence state space that has never been in his possession.
A protocol for quantum bit commitment is proposed. The protocol is feasible with present technology and is secure against cheaters with unlimited computing power as long as the sender does not have the technology to store an EPR particle for an arbitrarily long period of time. The protocol is very efficient, requiring only tens of particles.
There had been well known claims of unconditionally secure quantum protocols for bit commitment. However, we, and independently Mayers, showed that all proposed quantum bit commitment schemes are, in principle, insecure because the sender, Alice, can almost always cheat successfully by using an Einstein-Podolsky-Rosen (EPR) type of attack and delaying her measurements. One might wonder if secure quantum bit commitment protocols exist at all. We answer this question by showing that the same type of attack by Alice will, in principle, break any bit commitment scheme. The cheating strategy genera…
We show that three fundamental information-theoretic constraints--the impossibility of superluminal information transfer between two physical systems by performing measurements on one of them, the impossibility of broadcasting the information contained in an unknown physical state, and the impossibility of unconditionally secure bit commitment--suffice to entail that the observables and state space of a physical theory are quantum-mechanical. We demonstrate the converse derivation in part, and consider the implications of alternative answers to a remaining open question about nonlocality and b…
Using unstable particles which decay by emitting neutrinos, we propose a quantum bit commitment protocol that is humanly impossible to break. Neutrinos carry away quantum information, but their interaction with matter is so weak that it would take an astronomically-sized machine just to catch them, not to mention performing controlled unitary operations on them. As a result quantum information is lost, and cheating is not possible even if the participants had access to the most powerful quantum computers that could ever be built. Therefore, for all practical purposes, our new protocol is as go…
The claim of quantum cryptography has always been that it can provide protocols that are unconditionally secure, that is, for which the security does not depend on any restriction on the time, space or technology available to the cheaters. We show that this claim does not hold for any quantum bit commitment protocol. Since many cryptographic tasks use bit commitment as a basic primitive, this result implies a severe setback for quantum cryptography. The model used encompasses all reasonable implementations of quantum bit commitment protocols in which the participants have not met before, inclu…
Coin-flipping is a fundamental cryptographic task where a spatially separated Alice and Bob wish to generate a fair coin-flip over a communication channel. It is known that ideal coin-flipping is impossible in both classical and quantum theory. In this work, we give a short proof that it is also impossible in generalized probabilistic theories under the Generalized No-Restriction Hypothesis. Our proof relies crucially on a formulation of cheating strategies as semi-infinite programs, i.e., cone programs with infinitely many constraints. This introduces a new formalism which may be of independe…
We present a two-state practical quantum bit commitment protocol, the security of which is based on the current technological limitations, namely the nonexistence of either stable long-term quantum memories or nondemolition measurements. For an optical realization of the protocol, we model the errors, which occur due to the noise and equipment (source, fibers, and detectors) imperfections, accumulated during emission, transmission, and measurement of photons. The optical part is modeled as a combination of a depolarizing channel (white noise), unitary evolution (e.g., systematic rotation of th…
The no-go theorem of unconditionally secure quantum bit commitment depends crucially on the assumption that Alice knows in detail all the probability distributions generated by Bob. We show that if a protocol is concealing, then the cheating unitary transformation is independent of any parameters (including probability distributions) secretly chosen by Bob, so that Alice can calculate it without knowing Bob's secret choices. Otherwise the protocol cannot be concealing. Our result shows that the original impossibility proof was based on an incorrect assumption, despite the fact that its conclus…
Lucerne School of Computer Science and Information Technology, Lucerne University of Applied Sciences and Arts（卢塞纳应用科学与艺术大学计算机科学与信息技术学院）；Ergon Informatik AG（Ergon信息科技股份公司）
By using local quantum teleportation of a fixed state to one qubit of an entangled pair sent from the other party, it is shown how one party can commit a bit with only classical information as evidence that results in an unconditionally secure protocol. The well-known ``impossibility proof'' does not cover such protocols due to its different commitment and opening prescriptions, which necessitate actual quantum measurements among different possible systems that cannot be entangled as a consequence.
The proof of the No-Go Theorem of unconditionally secure quantum bit commitment depends on the assumption that Alice knows every detail of the protocol, including the probability distributions associated with all the random variables generated by Bob. We argue that this condition may not be universally satisfied. In fact it can be shown that when Bob is allowed to use a secret probability distribution, the joint quantum state is inevitably mixed. It is then natural to ask if Alice can still cheat. A positive answer has been given by us [13] for the perfect concealing case. In this paper, we pr…
We reconsider the concept of multi-prover commitments, as introduced in the late eighties in the seminal work by Ben-Or et al. As was recently shown by Crépeau et al., the security of known two-prover commitment schemes not only relies on the explicit assumption that the provers cannot communicate, but also depends on their information processing capabilities. For instance, there exist schemes that are secure against classical provers but insecure if the provers have quantum information processing capabilities, and there are schemes that resist such quantum attacks but become insecure when con…
We further study the security of the quantum bit commitment (QBC) protocol we previously proposed [Phys. Rev. A 74, 022332 (2006).], by analyzing the reduced density matrix ρ_{b}^{B} which describes the quantum state at Bob's side corresponding to Alice's committed bit b. It is shown that Alice will find ρ_{0}^{B}\perp ρ_{1}^{B} while the protocol remains concealing to Bob. On the contrary, the existing no-go theorem of unconditionally secure QBC is based on the condition ρ_{0}^{B}\simeq ρ_{1}^{B}. Thus the specific cheating strategy proposed in the no-go theorem does not necessarily applies t…
We show that all proposed quantum bit commitment schemes are insecure because the sender, Alice, can almost always cheat successfully by using an Einstein-Podolsky-Rosen type of attack and delaying her measurement until she opens her commitment.
Bit commitment protocols whose security is based on the laws of quantum mechanics alone are generally held to be impossible. In this paper we give a strengthened and explicit proof of this result. We extend its scope to a much larger variety of protocols, which may have an arbitrary number of rounds, in which both classical and quantum information is exchanged, and which may include aborts and resets. Moreover, we do not consider the receiver to be bound to a fixed "honest" strategy, so that "anonymous state protocols", which were recently suggested as a possible way to beat the known no-go re…
Bit commitment is a fundamental cryptographic task that guarantees a secure commitment between two mutually mistrustful parties and is a building block for many cryptographic primitives, including coin tossing, zero-knowledge proofs, oblivious transfer and secure two-party computation. Unconditionally secure bit commitment was thought to be impossible until recent theoretical protocols that combine quantum mechanics and relativity were shown to elude previous impossibility proofs. Here we implement such a bit commitment protocol. In the experiment, the committer performs quantum measurements u…
There had been well known claims of ``provably unbreakable'' quantum protocols for bit commitment and coin tossing. However, we, and independently Mayers, showed that all proposed quantum bit commitment (and therefore coin tossing) schemes are, in principle, insecure because the sender, Alice, can always cheat successfully by using an EPR-type of attack and delaying her measurements. One might wonder if secure quantum bit commitment and coin tossing protocols exist at all. Here we prove that an EPR-type of attack by Alice will, in principle, break {\em any} realistic quantum bit commitment and…
Summoning is a task between two parties, Alice and Bob, with distributed networks of agents in space-time. Bob gives Alice a random quantum state, known to him but not her, at some point. She is required to return the state at some later point, belonging to a subset defined by communications received from Bob at other points. Many results about summoning, including the impossibility of unrestricted summoning tasks and the necessary conditions for specific types of summoning tasks to be possible, follow directly from the quantum no-cloning theorem and the relativistic no-superluminal-signalling…
We focus on a family of quantum coin-flipping protocols based on bit-commitment. We discuss how the semidefinite programming formulations of cheating strategies can be reduced to optimizing a linear combination of fidelity functions over a polytope. These turn out to be much simpler semidefinite programs which can be modelled using second-order cone programming problems. We then use these simplifications to construct their point games as developed by Kitaev. We also study the classical version of these protocols and use linear optimization to formulate optimal cheating strategies. We then cons…
While unconditionally secure bit commitment (BC) is considered impossible within the quantum framework, it can be obtained under relativistic or experimental constraints. Here we study whether such BC can lead to secure quantum oblivious transfer (QOT). The answer is not completely negative. On one hand, we provide a detailed cheating strategy, showing that the "honest-but-curious adversaries" in some of the existing no-go proofs on QOT still apply even if secure BC is used, enabling the receiver to increase the average reliability of the decoded value of the transferred bit. On the other hand…
String commitment schemes are similar to the well studied bit commitment schemes in cryptography with the difference that the committing party, say Alice, is supposed to commit a long string instead of a single bit, to another party say Bob. Similar to bit commitment schemes, such schemes are supposed to be binding, i.e Alice cannot change her choice after committing, and concealing i.e. Bob cannot find Alice's committed string before Alice reveals it. Ideal commitment schemes are known to be impossible. Even if some degrees of cheating is allowed, Buhrman, Christandl, Hayden, Lo and Wehner (q…
It is believed that superselection rules in quantum mechanics can restrict the possible operation on a qbit. If this was true, the model used by Mayers for the impossibility of bit commitment and by Kitaev for the impossibility of coin flipping would be inadequate. We explain why this is not the case. We show that a charge superselection rule implies no restriction on the operations that can be executed on any individual qbit.
Unconditionally secure non-relativistic bit commitment is known to be impossible in both the classical and the quantum world. However, when committing to a string of n bits at once, how far can we stretch the quantum limits? In this letter, we introduce a framework of quantum schemes where Alice commits a string of n bits to Bob, in such a way that she can only cheat on a bits and Bob can learn at most b bits of information before the reveal phase. Our results are two-fold: we show by an explicit construction that in the traditional approach, where the reveal and guess probabilities form the s…
