4 pages, 0 figure, RevTeX4; typos corrected, a new corollary added. Proceedings "ERATO Conference on Quantum Information Science 2005" (Tokyo, 26-30 August 2005)
The no-go theorem of unconditionally secure quantum bit commitment depends crucially on the assumption that Alice knows in detail all the probability distributions generated by Bob. We show that if a protocol is concealing, then the cheating unitary transformation is independent of any parameters (including probability distributions) secretly chosen by Bob, so that Alice can calculate it without knowing Bob's secret choices. Otherwise the protocol cannot be concealing. Our result shows that the original impossibility proof was based on an incorrect assumption, despite the fact that its conclusion remains valid within the adopted framework. Furthermore, our result eliminates a potential loophole in the no-go theorem.
The impossibility proof of unconditionally secure quantum bit commitment is crucially dependent on the assertion that Bob is not allowed to generate probability distributions unknown to Alice. This assertion is actually not meaningful, because Bob can always cheat without being detected. In this paper we prove that, for any concealing protocol involving secret probability distributions, there exists a cheating unitary transformation that is known to Alice. Our result closes a gap in the original impossibility proof.
The proof of the No-Go Theorem of unconditionally secure quantum bit commitment depends on the assumption that Alice knows every detail of the protocol, including the probability distributions associated with all the random variables generated by Bob. We argue that this condition may not be universally satisfied. In fact it can be shown that when Bob is allowed to use a secret probability distribution, the joint quantum state is inevitably mixed. It is then natural to ask if Alice can still cheat. A positive answer has been given by us [13] for the perfect concealing case. In this paper, we pr…
Quantum protocols for bit commitment have been proposed and it is largely accepted that unconditionally secure quantum bit commitment is not possible; however, it can be more secure than classical bit commitment. In despite of its usefulness, quantum bit commitment protocols have not been experimentally implemented. The main reason is the fact that all proposed quantum bit commitment protocols require quantum memory. In this work, we show a quantum bit commitment protocol that does not require quantum memory and can be implemented with present technology.
We proposed a new quantum bit commitment scheme in which secret key need not to be provided by other quantum key distribution system. We can get the bit commitment with probability p by adding a waiting time in a frame during operating the BB84 protocol. Then the measurement outcomes can be encrypted by one-time pad with the key generated by BB84 protocol. We can also obtain the redundant secret keys to encrypt other information in this quantum key distribution system.
This article describes a quantum bit commitment protocol, QBC1, based on entanglement destruction via forced measurements and proves its unconditional security.
A quantum protocol for bit commitment the security of which is based on technological limitations on nondemolition measurements and long-term quantum memory is presented.
We propose a framework of bit commitment protocol using a comparison scheme and present a compound comparison scheme based on counterfactual cryptography. Finally, we propose a counterfactual quantum bit commitment protocol. In security analysis, we give the proper security parameters for counterfactual quantum bit commitment and prove that intercept attack and intercept/resend attack are ineffective attack for our protocol. In addition, we explain that counterfactual quantum bit commitment protocol cannot be attacked with no-go theorem attack by current technology.
The desire to obtain an unconditionally secure bit commitment protocol in quantum cryptography was expressed for the first time thirteen years ago. Bit commitment is sufficient in quantum cryptography to realize a variety of applications with unconditional security. In 1993, a quantum bit commitment protocol was proposed together with a security proof. However, a basic flaw in the protocol was discovered by Mayers in 1995 and subsequently by Lo and Chau. Later the result was generalized by Mayers who showed that unconditionally secure bit commitment is impossible. A brief review on quantum bit…
We propose here a two-round relativistic bit commitment scheme where committer commits in the first round and then confirms his/her commitment in the second round. The scheme offers indefinite commitment time where both committer and receiver extract non-locally correlated measurement outcomes during the scheme that can be stored and revealed after arbitrarily long time. We show that the proposed scheme turns out to be a multiparty bit commitment scheme where both parties commit and reveal simultaneously. The multiparty generalization would have applications in business and secure multiparty c…
The commitment of bits between two mutually distrustful parties is a powerful cryptographic primitive with which many cryptographic objectives can be achieved. It is widely believed that unconditionally secure quantum bit commitment is impossible due to quantum entanglement cheating, which is codified in a general impossibility theorem. Gaps in the proof of this impossibility theorem are found. An unconditionally secure bit commitment protocol utilizing anonymous quantum states and the no-clone theorem is presented below with a full security proof.
In this paper, we introduce a new quantum bit commitment protocol which is practically secure against entanglement attacks. A general cheating strategy is discussed and shown to be practically ineffective against the proposed approach.
This paper considers the use an entanglement breaking channel in the construction of a secure bit-commitment protocol. It is shown that this can be done via a depolarizing quantum channel.
The impossibility proof on unconditionally secure quantum bit commitment is critically reviewed. Different ways of obtaining secure protocols are indicated.
Under rather general assumptions about the properties of a noisy quantum channel, a first quantum protocol is proposed which allows to implement the secret bit commitment with the probability arbitrarily close to unity.
It has been recently shown by Mayers that no bit commitment scheme is secure if the participants have unlimited computational power and technology. However it was noticed that a secure protocol could be obtained by forcing the cheater to perform a measurement. Similar situations had been encountered previously in the design of Quantum Oblivious Transfer. The question is whether a classical bit commitment could be used for this specific purpose. We demonstrate that, surprisingly, classical unconditionally concealing bit commitments do not help.
This article describes a quantum bit commitment protocol, QBC3, based on entanglement destruction via forced measurements and proves its unconditional security. Some comments on the current status of the field are also made.
In this work, we propose a quantum bit string commitment protocol using polarization of mesoscopic coherent states. The protocol is described and its security against brute force and quantum cloning machine attack is analyzed.
We propose a practical quantum oblivious transfer and a bit commitment protocols which replace the single-photon source with weak coherent pulses and allow error and loss in channel and detectors. These protocols can be realized with available optoelectronic apparatus.
This paper proposes a cheat sensitive quantum bit commitment (CSQBC) scheme based on single photons, in which Alice commits a bit to Bob. Here, Bob only can cheat the committed bit with probability close to $0$ with the increasing of used single photons' amount. And if Alice altered her committed bit after commitment phase, she will be detected with probability close to $1$ with the increasing of used single photons' amount. The scheme is easy to be realized with nowadays technology.
The nature and scope of various impossibility proofs as they relate to real-world situations are discussed. In particular, it is shown in words without technical symbols how secure quantum bit commitment protocols may be obtained with testing that exploits the multiple possibilities of cheating entanglement formation.
We show here that the recent work of Wolf and Wullschleger (quant-ph/0502030) on oblivious transfer apparently opens the possibility that non-local correlations which are stronger than those in quantum mechanics could be used for bit-commitment. This is surprising, because it is the very existence of non-local correlations which in quantum mechanics prevents bit-commitment. We resolve this apparent paradox by stressing the difference between non-local correlations and oblivious transfer, based on the time-ordering of their inputs and outputs, which prevents bit-commitment.
The aim of this thesis project is to investigate the bit commitment protocol in the framework of operational probabilistic theories. In particular a careful study is carried on the feasibility of bit commitment in the non-local boxes theory. New aspects of the theory are also presented.
Several kinds of qubit-string-based(QS-based) bit commitment protocols are presented, and a definition of information-theoretic concealing is given. All the protocols presented here are proved to be secure under this definition. We suggest an attack algorithm to obtain the local unitary transformation introduced in no-go theorem, which is used to attack the binding condition, then study the security of our QS-based bit commitment protocols under this attack via introducing a new concept "physical security of protocol". At last we present a practical QS-based bit commitment scheme against chann…
The ``impossibility proof'' on unconditionally secure quantum bit commitment is critically analyzed. Many possibilities for obtaining a secure bit commitment protocol are indicated, purely on the basis of two-way quantum communications, which are not covered by the impossibility proof formulation. They are classified under six new types of protocols, with security proofs for specific examples on four types. Reasons for some previously failed attempts at obtaining secure protocols are also indicated.
So-called non-local boxes, which have been introduced as an idealization-in different respects-of the behavior of entangled quantum states, have been known to allow for unconditional bit commitment between the two involved parties. We show that, actually, any possible non-local correlation which produces random bits on both sides can be used to implement bit commitment, and that this holds even when the parties are allowed to delay their inputs to the box. Since a particular example is the behavior of an EPR pair, this resource allows for implementing unconditionally secure bit commitment as l…
We provide a non-interactive quantum bit commitment scheme which has statistically-hiding and computationally-binding properties from any quantum one-way function. Our protocol is basically a parallel composition of the previous non-interactive quantum bit commitment schemes (based on quantum one-way permutations, due to Dumais, Mayers and Salvail (EUROCRYPT 2000)) with pairwise independent hash functions. To construct our non-interactive quantum bit commitment scheme from any quantum one-way function, we follow the procedure below: (i) from Dumais-Mayers-Salvail scheme to a weakly-hiding and …
Bit commitment is a fundamental cryptographic primitive with numerous applications. Quantum information allows for bit commitment schemes in the information theoretic setting where no dishonest party can perfectly cheat. The previously best-known quantum protocol by Ambainis achieved a cheating probability of at most 3/4[Amb01]. On the other hand, Kitaev showed that no quantum protocol can have cheating probability less than 1/sqrt{2} [Kit03] (his lower bound on coin flipping can be easily extended to bit commitment). Closing this gap has since been an important and open question. In this pape…
We investigate the existence of secure bit commitment protocols in the convex framework for probabilistic theories. The framework makes only minimal assumptions, and can be used to formalize quantum theory, classical probability theory, and a host of other possibilities. We prove that in all such theories that are locally non-classical but do not have entanglement, there exists a bit commitment protocol that is exponentially secure in the number of systems used.
In a recent letter (Phys. Lett. A 377 (2013) 1076, arXiv:0905.3801), the authors presented an impossibility proof of quantum bit commitment, which attempted to cover all possible protocols that involve both quantum and classical information. Here we show that there are many errors in the proof, thus it fails to exhaust all conceivable protocols.
Quantum bit-string commitment[A.Kent, Phys.Rev.Lett., 90, 237901 (2003)] or QBSC is a variant of bit commitment (BC). In this paper, we propose a new QBSC protocol that can be implemented using currently available technology, and prove its security under the same security criteria as discussed by Kent. QBSC is a generalization of BC, but has slightly weaker requirements, and our proposed protocol is not intended to break the no-go theorem of quantum BC.
We introduce a new setting for two-party cryptography with temporarily trusted third parties. In addition to Alice and Bob in this setting, there are additional third parties, which Alice and Bob both trust to be honest during the protocol. However, once the protocol concludes, there is no guarantee over the behaviour of these third parties. It is possible that they collaborate and act adversarially. Our goal is to use these third parties to facilitate protocols which are impossible in two-party cryptography. We implement a variant of bit commitment in this setting, which we call erasable bit …
Quantum bit commitment has been known to be impossible by the independent proofs of Mayers, and Lo and Chau, under the assumption that the whole quantum states right before the unveiling phase are static to users. We here provide an unconditionally secure non-static quantum bit commitment protocol with a trusted third party, which is not directly involved in any communications between users and can be limited not to get any information of commitment without being detected by users. We also prove that our quantum bit commitment protocol is not secure without the help of the trusted third party.…
Bit-commitment is a fundamental cryptographic task, in which Alice commits a bit to Bob such that she cannot later change the value of the bit, while, simultaneously, the bit is hidden from Bob. It is known that ideal bit-commitment is impossible within quantum theory. In this work, we show that it is also impossible in generalised probabilistic theories (under a small set of assumptions) by presenting a quantitative trade-off between Alice's and Bob's cheating probabilities. Our proof relies crucially on a formulation of cheating strategies as cone programs, a natural generalisation of semide…
Quantum bit commitment has long been known to be impossible. Nevertheless, just as in the classical case, imposing certain constraints on the power of the parties may enable the construction of asymptotically secure protocols. Here, we introduce a quantum bit commitment protocol and prove that it is asymptotically secure if cheating is restricted to Gaussian operations. This protocol exploits continuous-variable quantum optical carriers, for which such a Gaussian constraint is experimentally relevant as the high optical nonlinearity needed to effect deterministic non-Gaussian cheating is inacc…
Based on the fact that the entanglement can not be created locally, we proposed a quantum bit commitment protocol, in which entangled states and quantum algorithms is used. The bit is not encoded with the form of the quantum states, and delaying the measurement is required. Therefore the protocol will not be denied by the Mayers-Lo-Chau no-go theorem, and unconditional security is achieved.
This paper studies secure multiparty quantum computation (SMQC) without nonlocal measurements. Firstly, this task is reduced to secure two-party quantum computation of nonlocal controlled-NOT (NL-CNOT) gate. Then, in the passive adversaries model, the secure computation of NL-CNOT is reduced to bit commitment. Thus, a SMQC scheme can be constructed based on bit commitment. This scheme does not depend on trusted third party, and is secure in the passive adversaries model. It is also pointed out that a vulnerability exists in any secure two-party quantum computation protocol of NL-CNOT gate.
The claim of quantum cryptography has always been that it can provide protocols that are unconditionally secure, that is, for which the security does not depend on any restriction on the time, space or technology available to the cheaters. We show that this claim does not hold for any quantum bit commitment protocol. Since many cryptographic tasks use bit commitment as a basic primitive, this result implies a severe setback for quantum cryptography. The model used encompasses all reasonable implementations of quantum bit commitment protocols in which the participants have not met before, inclu…
Bit commitment involves the submission of evidence from one party to another so that the evidence can be used to confirm a later revealed bit value by the first party, while the second party cannot determine the bit value from the evidence alone. It is widely believed that secure quantum bit commitment is impossible due to quantum entanglement cheating, which is codified in a general impossibility theorem. In this paper, the scope of this general impossibility proof is extended and analyzed, and gaps are found. Three specific protocols are described for which the entanglement cheating as given…
Security trade-offs have been established for one-way bit commitment in quant-ph/0106019. We study this trade-off in two superselection settings. We show that for an `abelian' superselection rule (exemplified by particle conservation) the standard trade-off between sealing and binding properties still holds. For the non-abelian case (exemplified by angular momentum conservation) the security trade-off can be more subtle, which we illustrate by showing that if the bit-commitment is forced to be ancilla-free an asymptotically secure quantum bit commitment is possible.
This paper has been withdrawn by the authors,because the proposed protocol is still coverd by the no-go theorem of Mayers, Lo and Chau. We thank H-K. Lo and HF Chau for helpful correspondences.
A class of quantum protocols of bit commitment is constructed based on the nonorthogonal states coding and the correlation immunity of some Boolean functions. The binding condition of these protocols is guaranteed mainly by the law of causality and the concealing condition is guaranteed by the indistinguishability between nonorthogonal quantum states and the correlation immunity of Boolean functions. We also give out an oblivious transfer protocol based on two-nonorthogonal states coding and build a bit commitment protocol on top of it. The relationship between these protocols and the well kno…
A new relativistic quantum protocol is proposed allowing to implement the bit commitment scheme. The protocol is based on the idea that in the relativistic case the field propagation to the region of space accessible to measurement requires, contrary to the non-relativistic case, a finite non-zero time which depends on the structure of the particular state of the field. In principle, the secret bit can be stored for arbitrarily long time with the probability arbitrarily close to unit.
It is shown how the evidence state space in quantum bit commitment may be made to depend on the bit value 0 or 1 with split entangled pairs. As a consequence, one can obtain a protocol that is perfectly concealing, but is also $ε$-binding because the bit-value dependent evidence space prevents the committing party from cheating by means of a local transformation that is independent of the part of evidence state space that has never been in his possession.
Unconditionally secure bit commitment is forbidden by quantum mechanics. We extend this no-go theorem to continuous-variable protocols where both players are restricted to use Gaussian states and operations, which is a reasonable assumption in current-state optical implementations. Our Gaussian no-go theorem also provides a natural counter-example to a conjecture that quantum mechanics can be rederived from the assumption that key distribution is allowed while bit commitment is forbidden in Nature.
Using a neutron double-slit setup, we construct a quantum bit commitment scheme in which time development of quantum states plays an essential role. Our scheme evades the widely accepted no-go theorem by the fact that it is neither possible to stop the time evolution of spreading wave packets, nor is it possible to evolve them backward in time. Moreover, for unstable particles such as neutrons, one cannot delay detecting their positions indefinitely, or they would disintegrate spontaneously and escape detection. We find that using non-stationary states instead of stationary ones, unconditional…
Unconditionally secure two-party bit commitment based solely on the principles of quantum mechanics (without exploiting special relativistic signalling constraints, or principles of general relativity or thermodynamics) has been shown to be impossible, but the claim is repeatedly challenged. The quantum bit commitment theorem is reviewed here and the central conceptual point, that an `Einstein-Podolsky-Rosen' attack or cheating strategy can always be applied, is clarified. The question of whether following such a cheating strategy can ever be disadvantageous to the cheater is considered and an…
Bit commitment is a fundamental cryptographic task that guarantees a secure commitment between two mutually mistrustful parties and is a building block for many cryptographic primitives, including coin tossing, zero-knowledge proofs, oblivious transfer and secure two-party computation. Unconditionally secure bit commitment was thought to be impossible until recent theoretical protocols that combine quantum mechanics and relativity were shown to elude previous impossibility proofs. Here we implement such a bit commitment protocol. In the experiment, the committer performs quantum measurements u…
There had been well known claims of ``provably unbreakable'' quantum protocols for bit commitment and coin tossing. However, we, and independently Mayers, showed that all proposed quantum bit commitment (and therefore coin tossing) schemes are, in principle, insecure because the sender, Alice, can always cheat successfully by using an EPR-type of attack and delaying her measurements. One might wonder if secure quantum bit commitment and coin tossing protocols exist at all. Here we prove that an EPR-type of attack by Alice will, in principle, break {\em any} realistic quantum bit commitment and…
Although it is impossible for a bit commitment protocol to be both arbitrarily concealing and arbitrarily binding, it is possible for it to be both partially concealing and partially binding. This means that Bob cannot, prior to the beginning of the unveiling phase, find out everything about the bit committed, and Alice cannot, through actions taken after the end of the commitment phase, unveil whatever bit she desires. We determine upper bounds on the degrees of concealment and bindingness that can be achieved simultaneously in any bit commitment protocol, although it is unknown whether these…
Bit commitment is a fundamental cryptographic primitive in which Alice wishes to commit a secret bit to Bob. Perfectly secure bit commitment between two mistrustful parties is impossible through asynchronous exchange of quantum information. Perfect security is however possible when Alice and Bob each split into several agents exchanging classical information at times and locations suitably chosen to satisfy specific relativistic constraints. In this Letter we first revisit a previously proposed scheme that realizes bit commitment using only classical communication. We prove that the protocol i…
Einstein-Podolsky-Rosen- (EPR) and the more powerful Mayers-Lo-Chau attack impose a serious constraint on quantum bit commitment (QBC). As a way to circumvent them, it is proposed that the quantum system encoding the commitment chosen by the committer (Alice) should be initially prepared in a seperable quantum state known to and furnished by the acceptor (Bob), rather than Alice. Classical communication is used to conclude the commitment phase and bind Alice's subsequent unveiling. Such a class of secure protocols can be built upon currently proposed QBC schemes impervious to a simple EPR atta…
The relationship between the quantum bit commitment (QBC) and quantum seal (QS) is studied. It is elaborated that QBC and QS are not equivalent, but QS protocols satisfying a stronger unconditional security requirement can lead to an unconditionally secure QBC. In this sense, QS is strictly stronger than QBC in security requirements. Based on an earlier proposal on sealing a single bit, a feasible QBC protocol is also put forward, which is secure in practice even if the cheater has a strong quantum computational power.
