Challenges
Datasets
Workspaces
Papers
Discussions
Leaderboard
Log inSign up
Challenges
Datasets
Workspaces
Papers
Discussions
Leaderboard
Blog
Job Board
Q3AS

© 2026 Aqora Quantum S.A.S.

TermsPrivacyLegal Notice

arXiv:quant-ph/0111099 · Physical Review Letters

Quantum Bit String Commitment

Adrian Kent

Published Jun 13, 2003• 53 citations
arXivHTMLPDF

Abstract

A bit string commitment protocol securely commits N classical bits so that the recipient can extract only M<N bits of information about the string. Classical reasoning suggests that bit string commitment implies bit commitment and hence, given the Mayers-Lo-Chau theorem, that nonrelativistic quantum bit string commitment is impossible. Not so: there exist nonrelativistic quantum bit string commitment protocols, with security parameters epsilon and M, that allow A to commit N=N(M,epsilon) bits to B so that A's probability of successfully cheating when revealing any bit and B's probability of extracting more than N'=N-M bits of information about the N bit string before revelation are both less than epsilon. With a restrictive definition of security against A, N can be taken to be O(exp(CN')) for a positive constant C. I briefly discuss possible applications.

DOI
10.1103/physrevlett.90.237901

Related papers

On the (Im)Possibility of Quantum String Commitment

Harry Buhrman, Matthias Christandl, Patrick M. Hayden +2 more

Unconditionally secure non-relativistic bit commitment is known to be impossible in both the classical and quantum worlds. However, when committing to a string of n bits at once, how far can we stretch the quantum limits? We consider quantum schemes where Alice commits a string of n bits to Bob, in such a way that she can only cheat on a bits and Bob can learn at most b bits of ''information'' before the reveal phase. We show a negative and a positive result, depending on how we measure Bob's information. If we use the Holevo quantity, no good schemes exist: a+b is at least n. If, however, we use accessible information, there exists a scheme where a=4 log n+O(1) and b=4. This is classically impossible. Our protocol is not efficient, however, we also exhibit an efficient scheme when Bob's measurement circuit is restricted to polynomial size. Our scheme also implies a protocol for n simultaneous coin flips which achieves higher entropy of the resulting string than any previously known protocol.

•Jan 1, 2005•7 citations

Possibility, impossibility, and cheat sensitivity of quantum-bit string commitment

Harry Buhrman, Matthias Christandl, Patrick M. Hayden +2 more

Unconditionally secure nonrelativistic bit commitment is known to be impossible in both the classical and the quantum worlds. But when committing to a string of $n$ bits at once, how far can we stretch the quantum limits? In this paper, we introduce a framework for quantum schemes where Alice commits a string of $n$ bits to Bob in such a way that she can only cheat on $a$ bits and Bob can learn at most $b$ bits of information before the reveal phase. Our results are twofold: we show by an explicit construction that in the traditional approach, where the reveal and guess probabilities form the security criteria, no good schemes can exist: $a+b$ is at least $n$. If, however, we use a more liberal criterion of security, the accessible information, we construct schemes where $a=4\text{ }{\text{log}}_{2}\text{ }n+O(1)$ and $b=4$, which is impossible classically. We furthermore present a cheat-sensitive quantum bit string commitment protocol for which we give an explicit tradeoff between Bob's ability to gain information about the committed string, and the probability of him being detected cheating.

arXiv:quant-ph/0504078•Physical Review A•Aug 11, 2008•63 citations

Security of Quantum Bit String Commitment Depends on the Information Measure

Harry Buhrman, Matthias Christandl, Patrick M. Hayden +2 more

Unconditionally secure nonrelativistic bit commitment is known to be impossible in both the classical and the quantum world. However, when committing to a string of n bits at once, how far can we stretch the quantum limits? In this Letter, we introduce a framework of quantum schemes where Alice commits a string of n bits to Bob, in such a way that she can only cheat on a bits and Bob can learn at most b bits of information before the reveal phase. Our results are twofold: we show by an explicit construction that in the traditional approach, where the reveal and guess probabilities form the security criteria, no good schemes can exist: a + b is at least n. If, however, we use a more liberal criterion of security, the accessible information, we construct schemes where a = 4log2(n) + O(1) and b = 4, which is impossible classically. Our findings significantly extend known no-go results for quantum bit commitment.

arXiv:quant-ph/0609237•Physical Review Letters•Dec 19, 2006•36 citations

Secure bit commitment based on quantum one-way function

Bo Hao Yu, Zheng-Wei Zhou, Jian Li +1 more

Although Mayers, Lo and Chau successfully showed that unconditionally secure quantum bit commitment (QBC) is impossible, we present a secure QBC protocol which is quite different from the model used in their proofs. If Alice wants to commit a bit b, she first encodes b into a series of classical bit strings of the same length. The requirement is that the modulo 2 sum of all bits in every bit string equals to b. Then Alice uses quantum one-way function to produce quantum states which are corresponding to the encoded classical bit strings and will be sent to Bob as evidence. The quantum one-way function used here is just that was successfully applied in Gottesman and Chuang's quantum digital signatures. When it comes to the unveilingtime, Alice only sends the bit strings to Bob. Finally, Bob generates quantum states form the bit strings by the same quantum one-way function and uses controlled-swap circuit to check whether the quantum states are identical with the evidence.

Proceedings of SPIE, the International Society for Optical Engineering/Proceedings of SPIE•Sep 11, 2002•2 citations

Non-static Quantum Bit Commitment

Jeong Woon Choi, Dowon Hong, Ku-Young Chang +2 more

Quantum bit commitment has been known to be impossible by the independent proofs of Mayers, and Lo and Chau, under the assumption that the whole quantum states right before the unveiling phase are static to users. We here provide an unconditionally secure non-static quantum bit commitment protocol with a trusted third party, which is not directly involved in any communications between users and can be limited not to get any information of commitment without being detected by users. We also prove that our quantum bit commitment protocol is not secure without the help of the trusted third party. The proof is basically different from the Mayers-Lo-Chau's no-go theorem, because we do not assume the staticity of the finally shared quantum states between users.

arXiv:0901.1178•Jan 9, 2009•2 citations

Is quantum bit commitment really impossible

Jeong Woon Choi, Dowon Hong, Ku-Young Chang +2 more

Quantum bit commitment has been known to be impossible by the independent proofs of Mayers, and Lo and Chau, even though several quantum bit commitment protocols have been proposed. However, we here point out that their proof is available only for one-way quantum bit commitment protocols, and present a simple and efficient quantum bit commitment protocol with two-way quantum communications. The unconditional security of our protocol is guaranteed by the additional unknownness and randomness generated by both users.

•Jan 9, 2009•0 citations
A bit string commitment protocol securely commits N classical bits so that the recipient can extract only M<N bits of information about the string. Classical reasoning suggests that bit string commitment implies bit commitment and hence, given the Mayers-Lo-Chau theorem, that nonrelativistic quantum bit string commitment is impossible. Not so: there exist nonrelativistic quantum bit string commitment protocols, with security parameters epsilon and M, that allow A to commit N=N(M,epsilon) bits to B so that A's probability of successfully cheating when revealing any bit and B's probability of extracting more than N'=N-M bits of information about the N bit string before revelation are both less than epsilon. With a restrictive definition of security against A, N can be taken to be O(exp(CN')) for a positive constant C. I briefly discuss possible applications.
Unconditionally secure non-relativistic bit commitment is known to be impossible in both the classical and quantum worlds. However, when committing to a string of n bits at once, how far can we stretch the quantum limits? We consider quantum schemes where Alice commits a string of n bits to Bob, in such a way that she can only cheat on a bits and Bob can learn at most b bits of ''information'' before the reveal phase. We show a negative and a positive result, depending on how we measure Bob's information. If we use the Holevo quantity, no good schemes exist: a+b is at least n. If, however, we use accessible information, there exists a scheme where a=4 log n+O(1) and b=4. This is classically impossible. Our protocol is not efficient, however, we also exhibit an efficient scheme when Bob's measurement circuit is restricted to polynomial size. Our scheme also implies a protocol for n simultaneous coin flips which achieves higher entropy of the resulting string than any previously known protocol.
Unconditionally secure nonrelativistic bit commitment is known to be impossible in both the classical and the quantum worlds. But when committing to a string of nnn bits at once, how far can we stretch the quantum limits? In this paper, we introduce a framework for quantum schemes where Alice commits a string of nnn bits to Bob in such a way that she can only cheat on aaa bits and Bob can learn at most bbb bits of information before the reveal phase. Our results are twofold: we show by an explicit construction that in the traditional approach, where the reveal and guess probabilities form the security criteria, no good schemes can exist: a+ba+ba+b is at least nnn. If, however, we use a more liberal criterion of security, the accessible information, we construct schemes where a=4 log2 n+O(1)a=4\text{ }{\text{log}}_{2}\text{ }n+O(1)a=4 log2​ n+O(1) and b=4b=4b=4, which is impossible classically. We furthermore present a cheat-sensitive quantum bit string commitment protocol for which we give an explicit tradeoff between Bob's ability to gain information about the committed string, and the probability of him being detected cheating.
Unconditionally secure nonrelativistic bit commitment is known to be impossible in both the classical and the quantum world. However, when committing to a string of n bits at once, how far can we stretch the quantum limits? In this Letter, we introduce a framework of quantum schemes where Alice commits a string of n bits to Bob, in such a way that she can only cheat on a bits and Bob can learn at most b bits of information before the reveal phase. Our results are twofold: we show by an explicit construction that in the traditional approach, where the reveal and guess probabilities form the security criteria, no good schemes can exist: a + b is at least n. If, however, we use a more liberal criterion of security, the accessible information, we construct schemes where a = 4log2(n) + O(1) and b = 4, which is impossible classically. Our findings significantly extend known no-go results for quantum bit commitment.
Although Mayers, Lo and Chau successfully showed that unconditionally secure quantum bit commitment (QBC) is impossible, we present a secure QBC protocol which is quite different from the model used in their proofs. If Alice wants to commit a bit b, she first encodes b into a series of classical bit strings of the same length. The requirement is that the modulo 2 sum of all bits in every bit string equals to b. Then Alice uses quantum one-way function to produce quantum states which are corresponding to the encoded classical bit strings and will be sent to Bob as evidence. The quantum one-way function used here is just that was successfully applied in Gottesman and Chuang's quantum digital signatures. When it comes to the unveilingtime, Alice only sends the bit strings to Bob. Finally, Bob generates quantum states form the bit strings by the same quantum one-way function and uses controlled-swap circuit to check whether the quantum states are identical with the evidence.
Quantum bit commitment has been known to be impossible by the independent proofs of Mayers, and Lo and Chau, under the assumption that the whole quantum states right before the unveiling phase are static to users. We here provide an unconditionally secure non-static quantum bit commitment protocol with a trusted third party, which is not directly involved in any communications between users and can be limited not to get any information of commitment without being detected by users. We also prove that our quantum bit commitment protocol is not secure without the help of the trusted third party. The proof is basically different from the Mayers-Lo-Chau's no-go theorem, because we do not assume the staticity of the finally shared quantum states between users.
Quantum bit commitment has been known to be impossible by the independent proofs of Mayers, and Lo and Chau, even though several quantum bit commitment protocols have been proposed. However, we here point out that their proof is available only for one-way quantum bit commitment protocols, and present a simple and efficient quantum bit commitment protocol with two-way quantum communications. The unconditional security of our protocol is guaranteed by the additional unknownness and randomness generated by both users.