The Mayers-Lo-Chau theorem establishes that no quantum bit commitment protocol is unconditionally secure. Nonetheless, there can be non-trivial upper bounds on both Bob's probability of correctly estimating Alice's commitment and Alice's probability of successfully unveiling whatever bit she desires. In this paper, we seek to determine these bounds for generalizations of the BB84 bit commitment protocol. In such protocols, an honest Alice commits to a bit by randomly choosing a state from a specified set and submitting this to Bob, and later unveils the bit by announcing the chosen state, at which point Bob measures the projector onto the state. Bob's optimal cheating strategy can be easily deduced from well known results in the theory of quantum state estimation. We show how to understand Alice's most general cheating strategy, (which involves her submitting to Bob one half of an entangled state) in terms of the theorem of Hughston, Josza and Wootters. We also show how the problem of optimizing Alice's cheating strategy for a fixed submitted state can be mapped onto a problem of state estimation. Finally, using the Bloch ball representation of qubit states, we identify the optimal coherent attack for a class of protocols that can be implemented with just a single qubit. These results provide a tight upper bound on Alice's probability of successfully unveiling whatever bit she desires in the protocol proposed by Aharonov et al., and lead us to identify a qubit protocol with an even stronger bound.
The Mayers-Lo-Chau theorem establishes that no quantum bit commitment protocol is unconditionally secure. Nonetheless, there can be non-trivial upper bounds on both Bob's probability of correctly estimating Alice's commitment and Alice's probability of successfully unveiling whatever bit she desires. In this paper, we seek to determine these bounds for generalizations of the BB84 bit commitment protocol. In such protocols, an honest Alice commits to a bit by randomly choosing a state from a specified set and submitting this to Bob, and later unveils the bit by announcing the chosen state, at which point Bob measures the projector onto the state. Bob's optimal cheating strategy can be easily deduced from well known results in the theory of quantum state estimation. We show how to understand Alice's most general cheating strategy, (which involves her submitting to Bob one half of an entangled state) in terms of the theorem of Hughston, Josza and Wootters. We also show how the problem of optimizing Alice's cheating strategy for a fixed submitted state can be mapped onto a problem of state estimation. Finally, using the Bloch ball representation of qubit states, we identify the optimal coherent attack for a class of protocols that can be implemented with just a single qubit. These results provide a tight upper bound on Alice's probability of successfully unveiling whatever bit she desires in the protocol proposed by Aharonov et al., and lead us to identify a qubit protocol with an even stronger bound.
It is well known that no quantum bit commitment protocol is unconditionally secure. Nonetheless, there can be non-trivial upper bounds on both Bob's probability of correctly estimating Alice's commitment and Alice's probability of successfully unveiling whatever bit she desires. In this paper, we seek to determine these bounds for generalizations of the BB84 bit commitment protocol. In such protocols, an honest Alice commits to a bit by randomly choosing a state from a specified set and submitting this to Bob, and later unveils the bit to Bob by announcing the chosen state, at which point Bob measures the projector onto the state. Bob's optimal cheating strategy can be easily deduced from well known results in the theory of quantum state estimation. We show how to understand Alice's most general cheating strategy, (which involves her submitting to Bob one half of an entangled state) in terms of a theorem of Hughston, Jozsa and Wootters. We also show how the problem of optimizing Alice's cheating strategy for a fixed submitted state can be mapped onto a problem of state estimation. Finally, using the Bloch ball representation of qubit states, we identify the optimal coherent attack for a class of protocols that can be implemented with just a single qubit. These results provide a tight upper bound on Alice's probability of successfully unveiling whatever bit she desires in the protocol proposed by Aharonov et al., and lead us to identify a qubit protocol with even greater security.
It is well known that no quantum bit commitment protocol is unconditionally secure. Nonetheless, there can be non-trivial upper bounds on both Bob's probability of correctly estimating Alice's commitment and Alice's probability of successfully unveiling whatever bit she desires. In this paper, we seek to determine these bounds for generalizations of the BB84 bit commitment protocol. In such protocols, an honest Alice commits to a bit by randomly choosing a state from a specified set and submitting this to Bob, and later unveils the bit to Bob by announcing the chosen state, at which point Bob measures the projector onto the state. Bob's optimal cheating strategy can be easily deduced from well known results in the theory of quantum state estimation. We show how to understand Alice's most general cheating strategy, (which involves her submitting to Bob one half of an entangled state) in terms of a theorem of Hughston, Jozsa and Wootters. We also show how the problem of optimizing Alice's cheating strategy for a fixed submitted state can be mapped onto a problem of state estimation. Finally, using the Bloch ball representation of qubit states, we identify the optimal coherent attack for a class of protocols that can be implemented with just a single qubit. These results provide a tight upper bound on Alice's probability of successfully unveiling whatever bit she desires in the protocol proposed by Aharonov et al., and lead us to identify a qubit protocol with even greater security.
Bit commitment is a fundamental cryptographic primitive with numerous applications. Quantum information allows for bit commitment schemes in the information theoretic setting where no dishonest party can perfectly cheat. The previously best-known quantum protocol by Ambainis achieved a cheating probability of at most 3/4. On the other hand, Kitaev showed that no quantum protocol can have cheating probability less than 1/√2 (his lower bound on coin flipping can be easily extended to bit commitment). Closing this gap has since been an important open question. In this paper, we provide the optimal bound for quantum bit commitment. First, we show a lower bound of approximately 0.739, improving Kitaev's lower bound. For this, we present some generic cheating strategies for Alice and Bob and conclude by proving a new relation between the trace distance and fidelity of two quantum states. Second, we present an optimal quantum bit commitment protocol which has cheating probability arbitrarily close to 0.739. More precisely, we show how to use any weak coin flipping protocol with cheating probability 1/2 + ε in order to achieve a quantum bit commitment protocol with cheating probability 0.739 + O(ε). We then use the optimal quantum weak coin flipping protocol described by Mochon. Last, in order to stress the fact that our protocol uses quantum effects beyond the weak coin flip, we show that any classical bit commitment protocol with access to perfect weak (or strong) coin flipping has cheating probability at least 3/4.
It is well known that unconditionally secure bit commitment is impossible even in the quantum world. In this paper a weak variant of quantum bit commitment, introduced independently by Aharonov et al. [STOC, 2000] and Hardy and Kent [Phys. Rev. Lett. 92 (2004)] is investigated. In this variant, the parties require some nonzero probability of detecting a cheating, i.e. if Bob, who commits a bit b to Alice, changes his mind during the revealing phase then Alice detects the cheating with a positive probability (we call this property binding); and if Alice gains information about the committed bit before the revealing phase then Bob discovers this with positive probability (sealing). In our paper we give quantum bit commitment scheme that is simultaneously binding and sealing and we show that if a cheating gives epsilon advantage to a malicious Alice then Bob can detect the cheating with a probability Omega(epsilon^2). If Bob cheats then Alice's probability of detecting the cheating is greater than some fixed constant lambda>0. This improves the probabilities of cheating detections shown by Hardy and Kent and the scheme by Aharonov et al. who presented a protocol that is either binding or sealing, but not simultaneously both. To construct a cheat sensitive quantum bit commitment scheme we use a protocol for a weak quantum one-out-of-two oblivious transfer.
There had been well known claims of unconditionally secure quantum protocols for bit commitment. However, we, and independently Mayers, showed that all proposed quantum bit commitment schemes are, in principle, insecure because the sender, Alice, can almost always cheat successfully by using an Einstein-Podolsky-Rosen (EPR) type of attack and delaying her measurements. One might wonder if secure quantum bit commitment protocols exist at all. We answer this question by showing that the same type of attack by Alice will, in principle, break any bit commitment scheme. The cheating strategy generally requires a quantum computer. We emphasize the generality of this ``no-go theorem'': Unconditionally secure bit commitment schemes based on quantum mechanics---fully quantum, classical or quantum but with measurements---are all ruled out by this result. Since bit commitment is a useful primitive for building up more sophisticated protocols such as zero-knowledge proofs, our results cast very serious doubt on the security of quantum cryptography in the so-called ``post-cold-war'' applications. We also show that ideal quantum coin tossing is impossible because of the EPR attack. This no-go theorem for ideal quantum coin tossing may help to shed some lights on the possibility of non-ideal protocols.
Mayers, Lo and Chau argued that all quantum bit commitment protocols are insecure, because there is no way to prevent an Einstein-Podolsky-Rosen (EPR) cheating attack. However, Yuen presented some protocols which challenged the previous impossibility argument. Up to now, it is still debated whether there exist or not unconditionally secure protocols. In this paper the above controversy is addressed. For such purpose, a complete classification of all possible bit commitment protocols is given, including all possible cheating attacks. Focusing on the simplest class of protocols (non-aborting and with complete and perfect verification), it is shown how naturally a game-theoretical situation arises. For these protocols, bounds for the cheating probabilities are derived, involving the two quantum operations encoding the bit values and their respective alternate Kraus decompositions. Such bounds are different from those given in the impossibility proof. The whole classification and analysis has been carried out using a "finite open system" approach. The discrepancy with the impossibility proof is explained on the basis of the implicit adoption of a "closed system approach"--equivalent to modeling the commitment as performed by two fixed machines interacting unitarily in a overall "closed system"--according to which it is possible to assume as "openly known" both the initial state and the probability distributions for all secret parameters, which can be then "purified". This approach is also motivated by existence of unitary extensions for any open system. However, it is shown that the closed system approach for the classification of commitment protocols unavoidably leads to infinite dimensions, which then invalidate the continuity argument at the basis of the impossibility proof.