© 2026 Aqora Quantum S.A.S.

Terms Privacy Legal Notice

arXiv:quant-ph/0106019 · Physical Review A

Degrees of concealment and bindingness in quantum bit commitment protocols

Robert W. Spekkens, Terry Rudolph

Published Dec 11, 2001• 194 citations

Abstract

Although it is impossible for a bit commitment protocol to be both arbitrarily concealing and arbitrarily binding, it is possible for it to be both partiallyconcealing and partiallybinding. This means that Bob cannot, prior to the beginning of the unveiling phase, find out everything about the bit committed, and Alice cannot, through actions taken after the end of the commitment phase, unveil whatever bit she desires. We determine upper bounds on the degrees of concealment and bindingness that can be achieved simultaneously in anybit commitment protocol, although it is unknown whether these can be saturated. We do, however, determine the maxima of these quantities in a restricted class of bit commitment protocols, namely, those wherein all the systems that play a role in the commitment phase are supplied by Alice. We show that these maxima can be achieved using a protocol that requires Alice to prepare a pair of systems in an entangled state, submit one of the pair to Bob at the commitment phase, and the other at the unveiling phase. Finally, we determine the form of the trade off that exists between the degree of concealment and the degree of bindingness given various assumptions about the purity and dimensionality of the states used in the protocol.

DOI: 10.1103/physreva.65.012310

Related papers

A Secured Quantum Two-Bit Commitment Protocol for Communication Systems

Manal Khawasik, Wagdy Gomaa El-Sayed, Magdi Z. Rashad +1 more

Bit commitment is an essential primitive in quantum cryptography. It is the basic building block of many cryptographic protocols in which it provides security over distrustful parties. This paper proposes a secured quantum two-bit commitment protocol for any two classical bits. The protocol contains two parties - a committer and a receiver - who share both quantum and classical communication channels. The main phases of this protocol are commitment and revealing phases where the concealing and binding conditions are proved in order to accept the commitment message. The proposed framework utilizes different security layers to hide specific quantum states in a superposition alongside trivial one qubit operations. The secured unitary transformations are applied by the two parties to meet the concealing and binding conditions. To verify the success of the proposed protocol, the measured output of the two parties are compared. The protocol operates under the assumption that the two parties might cheat and the possible existence of an eavesdropper.

IEEE Access•Jan 1, 2022•8 citations

Secret parameters in quantum bit commitment

Chi-Yee Cheung

The no-go theorem of unconditionally secure quantum bit commitment depends crucially on the assumption that Alice knows in detail all the probability distributions generated by Bob. We show that if a protocol is concealing, then the cheating unitary transformation is independent of any parameters (including probability distributions) secretly chosen by Bob, so that Alice can calculate it without knowing Bob's secret choices. Otherwise the protocol cannot be concealing. Our result shows that the original impossibility proof was based on an incorrect assumption, despite the fact that its conclusion remains valid within the adopted framework. Furthermore, our result eliminates a potential loophole in the no-go theorem.

arXiv:quant-ph/0508180•Aug 24, 2005•5 citations

Another simple unconditionally secure quantum bit commitment protocol -- beating entanglement with entanglement

Horace P. Yuen

It is shown how the evidence state space in quantum bit commitment may be made to depend on the bit value 0 or 1 with split entangled pairs. As a consequence, one can obtain a protocol that is perfectly concealing, but is also $ε$-binding because the bit-value dependent evidence space prevents the committing party from cheating by means of a local transformation that is independent of the part of evidence state space that has never been in his possession.

arXiv:quant-ph/0305143•May 23, 2003•0 citations

An Information-Theoretic Perspective on the Quantum Bit Commitment Impossibility Theorem

Marius Nagy, Naya Nagy

This paper proposes a different approach to pinpoint the causes for which an unconditionally secure quantum bit commitment protocol cannot be realized, beyond the technical details on which the proof of Mayers' no-go theorem is constructed. We have adopted the tools of quantum entropy analysis to investigate the conditions under which the security properties of quantum bit commitment can be circumvented. Our study has revealed that cheating the binding property requires the quantum system acting as the safe to harbor the same amount of uncertainty with respect to both observers (Alice and Bob) as well as the use of entanglement. Our analysis also suggests that the ability to cheat one of the two fundamental properties of bit commitment by any of the two participants depends on how much information is leaked from one side of the system to the other and how much remains hidden from the other participant.

Entropy•Mar 13, 2018•7 citations

On minimal assumptions to obtain a universally composable quantum bit commitment

Mariano Lemus, Preeti Yadav, Paulo Mateus +2 more

It is well known, due to the no-go theorems, that perfectly secure bit commitment is impossible. For that reason, there exist many proposals for bit commitment protocols that are secure under certain assumptions (such as the existence of a trusted party, computational hardness, or noisy memories). In this paper, we investigate the minimal assumptions required to obtain a secure bit commitment protocol. We show that it is possible to construct a bit commitment scheme with two parties Alice and Bob as long as there is a third party that is willing to broadcast either entangled qubits for the parties or to produce classical strings that are xor-correlated. We also show that the bit commitment scheme proposed is universally composable.

International Conference on Transparent Optical Networks•Jul 1, 2019•3 citations

Using quantum oblivious transfer to cheat sensitive quantum bit commitment

Andreas Jakoby, Maciej Liśkiewicz, Aleksander Mądry

It is well known that unconditionally secure bit commitment is impossible even in the quantum world. In this paper a weak variant of quantum bit commitment, introduced independently by Aharonov et al. [STOC, 2000] and Hardy and Kent [Phys. Rev. Lett. 92 (2004)] is investigated. In this variant, the parties require some nonzero probability of detecting a cheating, i.e. if Bob, who commits a bit b to Alice, changes his mind during the revealing phase then Alice detects the cheating with a positive probability (we call this property binding); and if Alice gains information about the committed bit before the revealing phase then Bob discovers this with positive probability (sealing). In our paper we give quantum bit commitment scheme that is simultaneously binding and sealing and we show that if a cheating gives epsilon advantage to a malicious Alice then Bob can detect the cheating with a probability Omega(epsilon^2). If Bob cheats then Alice's probability of detecting the cheating is greater than some fixed constant lambda>0. This improves the probabilities of cheating detections shown by Hardy and Kent and the scheme by Aharonov et al. who presented a protocol that is either binding or sealing, but not simultaneously both. To construct a cheat sensitive quantum bit commitment scheme we use a protocol for a weak quantum one-out-of-two oblivious transfer.

arXiv:quant-ph/0605150•May 17, 2006•1 citation

Although it is impossible for a bit commitment protocol to be both arbitrarily concealing and arbitrarily binding, it is possible for it to be both partiallyconcealing and partiallybinding. This means that Bob cannot, prior to the beginning of the unveiling phase, find out everything about the bit committed, and Alice cannot, through actions taken after the end of the commitment phase, unveil whatever bit she desires. We determine upper bounds on the degrees of concealment and bindingness that can be achieved simultaneously in anybit commitment protocol, although it is unknown whether these can be saturated. We do, however, determine the maxima of these quantities in a restricted class of bit commitment protocols, namely, those wherein all the systems that play a role in the commitment phase are supplied by Alice. We show that these maxima can be achieved using a protocol that requires Alice to prepare a pair of systems in an entangled state, submit one of the pair to Bob at the commitment phase, and the other at the unveiling phase. Finally, we determine the form of the trade off that exists between the degree of concealment and the degree of bindingness given various assumptions about the purity and dimensionality of the states used in the protocol.

Bit commitment is an essential primitive in quantum cryptography. It is the basic building block of many cryptographic protocols in which it provides security over distrustful parties. This paper proposes a secured quantum two-bit commitment protocol for any two classical bits. The protocol contains two parties - a committer and a receiver - who share both quantum and classical communication channels. The main phases of this protocol are commitment and revealing phases where the concealing and binding conditions are proved in order to accept the commitment message. The proposed framework utilizes different security layers to hide specific quantum states in a superposition alongside trivial one qubit operations. The secured unitary transformations are applied by the two parties to meet the concealing and binding conditions. To verify the success of the proposed protocol, the measured output of the two parties are compared. The protocol operates under the assumption that the two parties might cheat and the possible existence of an eavesdropper.

The no-go theorem of unconditionally secure quantum bit commitment depends crucially on the assumption that Alice knows in detail all the probability distributions generated by Bob. We show that if a protocol is concealing, then the cheating unitary transformation is independent of any parameters (including probability distributions) secretly chosen by Bob, so that Alice can calculate it without knowing Bob's secret choices. Otherwise the protocol cannot be concealing. Our result shows that the original impossibility proof was based on an incorrect assumption, despite the fact that its conclusion remains valid within the adopted framework. Furthermore, our result eliminates a potential loophole in the no-go theorem.

It is shown how the evidence state space in quantum bit commitment may be made to depend on the bit value 0 or 1 with split entangled pairs. As a consequence, one can obtain a protocol that is perfectly concealing, but is also

ε

-binding because the bit-value dependent evidence space prevents the committing party from cheating by means of a local transformation that is independent of the part of evidence state space that has never been in his possession.

This paper proposes a different approach to pinpoint the causes for which an unconditionally secure quantum bit commitment protocol cannot be realized, beyond the technical details on which the proof of Mayers' no-go theorem is constructed. We have adopted the tools of quantum entropy analysis to investigate the conditions under which the security properties of quantum bit commitment can be circumvented. Our study has revealed that cheating the binding property requires the quantum system acting as the safe to harbor the same amount of uncertainty with respect to both observers (Alice and Bob) as well as the use of entanglement. Our analysis also suggests that the ability to cheat one of the two fundamental properties of bit commitment by any of the two participants depends on how much information is leaked from one side of the system to the other and how much remains hidden from the other participant.

It is well known, due to the no-go theorems, that perfectly secure bit commitment is impossible. For that reason, there exist many proposals for bit commitment protocols that are secure under certain assumptions (such as the existence of a trusted party, computational hardness, or noisy memories). In this paper, we investigate the minimal assumptions required to obtain a secure bit commitment protocol. We show that it is possible to construct a bit commitment scheme with two parties Alice and Bob as long as there is a third party that is willing to broadcast either entangled qubits for the parties or to produce classical strings that are xor-correlated. We also show that the bit commitment scheme proposed is universally composable.

It is well known that unconditionally secure bit commitment is impossible even in the quantum world. In this paper a weak variant of quantum bit commitment, introduced independently by Aharonov et al. [STOC, 2000] and Hardy and Kent [Phys. Rev. Lett. 92 (2004)] is investigated. In this variant, the parties require some nonzero probability of detecting a cheating, i.e. if Bob, who commits a bit b to Alice, changes his mind during the revealing phase then Alice detects the cheating with a positive probability (we call this property binding); and if Alice gains information about the committed bit before the revealing phase then Bob discovers this with positive probability (sealing). In our paper we give quantum bit commitment scheme that is simultaneously binding and sealing and we show that if a cheating gives epsilon advantage to a malicious Alice then Bob can detect the cheating with a probability Omega(epsilon^2). If Bob cheats then Alice's probability of detecting the cheating is greater than some fixed constant lambda>0. This improves the probabilities of cheating detections shown by Hardy and Kent and the scheme by Aharonov et al. who presented a protocol that is either binding or sealing, but not simultaneously both. To construct a cheat sensitive quantum bit commitment scheme we use a protocol for a weak quantum one-out-of-two oblivious transfer.