Challenges
Datasets
Workspaces
Papers
Discussions
Leaderboard
Log inSign up
Challenges
Datasets
Workspaces
Papers
Discussions
Leaderboard
Blog
Job Board
Q3AS

© 2026 Aqora Quantum S.A.S.

TermsPrivacyLegal Notice

arXiv:quant-ph/9605044 · Physical Review Letters

Unconditionally Secure Quantum Bit Commitment is Impossible

Dominic Mayers

Published Apr 28, 1997• 745 citations
arXivHTMLPDF

Abstract

The claim of quantum cryptography has always been that it can provide protocols that are unconditionally secure, that is, for which the security does not depend on any restriction on the time, space, or technology available to the cheaters. We show that this claim does not hold for any quantum bit commitment protocol. Since many cryptographic tasks use bit commitment as a basic primitive, this result implies a severe setback for quantum cryptography. The model used encompasses all reasonable implementations of quantum bit commitment protocols in which the participants have not met before, including those that make use of the theory of special relativity.

DOI
10.1103/physrevlett.78.3414

Related papers

A brief review on the impossibility of quantum bit commitment

Gilles Brassard A, Claude Crépeau, Dominic Mayers +1 more

The desire to obtain an unconditionally secure bit commitment protocol in quantum cryptography was expressed for the first time thirteen years ago. Bit commitment is sufficient in quantum cryptography to realize a variety of applications with unconditional security. In 1993, a quantum bit commitment protocol was proposed together with a security proof. However, a basic flaw in the protocol was discovered by Mayers in 1995 and subsequently by Lo and Chau. Later the result was generalized by Mayers who showed that unconditionally secure bit commitment is impossible. A brief review on quantum bit commitment which focuses on the general impossibility theorem and on recent attempts to bypass this result is provided.

arXiv:quant-ph/9712023•Dec 10, 1997•25 citations

Standard quantum bit commitment - an indefinite commitment time.

Muhammad Nadeem

Currently, it is believed in the literature that unconditionally secure bit commitment is impossible in non-relativistic quantum cryptography while only a weaker notion of bit commitment with finite commitment time is achievable in relativistic quantum setting. Moreover, relativistic classical bit commitment protocols allow arbitrary long commitment time but such protocols are not practically feasible; either because of multiple rounds of communication that result in exponential increase in communication complexity or due to asymptotic nature of security argument. The impossibility of practically feasible standard bit commitment leaves an obvious skepticism on the completeness of Hilbert space quantum cryptography and its claims of unconditional security. Contrary to the previously proposed results, we demonstrate here that an information-theoretic standard bit commitment scheme can be devised by using rules of purely non-relativistic quantum mechanics only; neither additional resources from theory of relativity nor multiple rounds of communications are required. The proposed bit commitment scheme can be applied efficiently with existing quantum technologies without long term quantum memory; quantum entanglement is required only for time t+δ where t is the communication time between the committer and receiver while δ << t is the processing time at laboratory.

•Jan 1, 2016•0 citations

Unconditional security in quantum bit commitment

Horace P. Yuen

The commitment of bits between two mutually distrustful parties is a powerful cryptographic primitive with which many cryptographic objectives can be achieved. It is widely believed that unconditionally secure quantum bit commitment is impossible due to quantum entanglement cheating, which is codified in a general impossibility theorem. Gaps in the proof of this impossibility theorem are found. An unconditionally secure bit commitment protocol utilizing anonymous quantum states and the no-clone theorem is presented below with a full security proof.

arXiv:quant-ph/0106001•Jun 1, 2001•0 citations

Impossibility of unconditionally secure commitment of a certified classical bit

Adrian Kent

In a secure bit commitment protocol involving only classical physics, A commits either a $0$ or a $1$ to B. If quantum information is used in the protocol, A may be able to commit a state of the form $\ensuremath{\alpha}|0〉+\ensuremath{\beta}|1〉.$ If so, she can also commit mixed states in which the committed bit is entangled with other quantum states under her control. We introduce here a quantum cryptographic primitive, bit commitment with a certificate of classicality (BCCC), which differs from standard bit commitment in that it guarantees that the committed state has a fixed classical value. We show that no unconditionally secure BCCC protocol based on special relativity and quantum theory exists. We also propose complete definitions of security for quantum and relativistic bit commitment.

arXiv:quant-ph/9910087•Physical Review A•Mar 2, 2000•23 citations

Quantum bit commitment and unconditional security

Horace P. Yuen

It is generally believed that unconditionally secure quantum bit commitment is impossible, due to widespread acceptance of an impossibility proof that utilizes quantum entaglement cheating. In this paper, we delineate how the impossibiliy proof formulation misses various types of quantum bit commitment protocols based on two-way quantum communications. We point out some of the gaps in the impossibility proof reasoning, and present corresponding counterexamples. Four different types of bit commitment protocols are constructed with several new protocol techniques. A specific Type 4 protocol is described and proved unconditionally secure. Security analysis of a Type 1 protocol and a Type 2 protocol are also sketched. The security of Type 3 protocols is as yet open. A development of quantum statistical decision theory and quantum games is needed to provie a complete security analysis of many such protocols.

arXiv:quant-ph/0207089•Jul 16, 2002•4 citations

How unconditionally secure quantum bit commitment is possible

Horace P. Yuen

Bit commitment involves the submission of evidence from one party to another so that the evidence can be used to confirm a later revealed bit value by the first party, while the second party cannot determine the bit value from the evidence alone. It is widely believed that unconditionally secure quantum bit commitment is impossible due to quantum entanglement cheating, which is codified in a general impossibility theorem. In this paper, the scope of this general impossibility proof is analyzed, and gaps are found. Two variants of a bit commitment scheme utilizing anonymous quantum states and decoy states are presented. In the first variant, the exact verifying measurement is independent of the committed bit value, thus the second party can make it before the first party opens, making possible an unconditional security proof based on no-cloning. In the second variant, the impossibility proof fails because quantum entanglement purification of a mixed state does not render the protocol determinate. Whether impossibility holds in this or similar protocols is an open question, although preliminary results already show that the impossibility proof cannot work as it stands.

arXiv:quant-ph/0109055•Sep 13, 2001•0 citations
The claim of quantum cryptography has always been that it can provide protocols that are unconditionally secure, that is, for which the security does not depend on any restriction on the time, space, or technology available to the cheaters. We show that this claim does not hold for any quantum bit commitment protocol. Since many cryptographic tasks use bit commitment as a basic primitive, this result implies a severe setback for quantum cryptography. The model used encompasses all reasonable implementations of quantum bit commitment protocols in which the participants have not met before, including those that make use of the theory of special relativity.
The desire to obtain an unconditionally secure bit commitment protocol in quantum cryptography was expressed for the first time thirteen years ago. Bit commitment is sufficient in quantum cryptography to realize a variety of applications with unconditional security. In 1993, a quantum bit commitment protocol was proposed together with a security proof. However, a basic flaw in the protocol was discovered by Mayers in 1995 and subsequently by Lo and Chau. Later the result was generalized by Mayers who showed that unconditionally secure bit commitment is impossible. A brief review on quantum bit commitment which focuses on the general impossibility theorem and on recent attempts to bypass this result is provided.
Currently, it is believed in the literature that unconditionally secure bit commitment is impossible in non-relativistic quantum cryptography while only a weaker notion of bit commitment with finite commitment time is achievable in relativistic quantum setting. Moreover, relativistic classical bit commitment protocols allow arbitrary long commitment time but such protocols are not practically feasible; either because of multiple rounds of communication that result in exponential increase in communication complexity or due to asymptotic nature of security argument. The impossibility of practically feasible standard bit commitment leaves an obvious skepticism on the completeness of Hilbert space quantum cryptography and its claims of unconditional security. Contrary to the previously proposed results, we demonstrate here that an information-theoretic standard bit commitment scheme can be devised by using rules of purely non-relativistic quantum mechanics only; neither additional resources from theory of relativity nor multiple rounds of communications are required. The proposed bit commitment scheme can be applied efficiently with existing quantum technologies without long term quantum memory; quantum entanglement is required only for time t+δ where t is the communication time between the committer and receiver while δ << t is the processing time at laboratory.
The commitment of bits between two mutually distrustful parties is a powerful cryptographic primitive with which many cryptographic objectives can be achieved. It is widely believed that unconditionally secure quantum bit commitment is impossible due to quantum entanglement cheating, which is codified in a general impossibility theorem. Gaps in the proof of this impossibility theorem are found. An unconditionally secure bit commitment protocol utilizing anonymous quantum states and the no-clone theorem is presented below with a full security proof.
In a secure bit commitment protocol involving only classical physics, A commits either a 000 or a 111 to B. If quantum information is used in the protocol, A may be able to commit a state of the form $\ensuremath{\alpha}|0〉+\ensuremath{\beta}|1〉.$ If so, she can also commit mixed states in which the committed bit is entangled with other quantum states under her control. We introduce here a quantum cryptographic primitive, bit commitment with a certificate of classicality (BCCC), which differs from standard bit commitment in that it guarantees that the committed state has a fixed classical value. We show that no unconditionally secure BCCC protocol based on special relativity and quantum theory exists. We also propose complete definitions of security for quantum and relativistic bit commitment.
It is generally believed that unconditionally secure quantum bit commitment is impossible, due to widespread acceptance of an impossibility proof that utilizes quantum entaglement cheating. In this paper, we delineate how the impossibiliy proof formulation misses various types of quantum bit commitment protocols based on two-way quantum communications. We point out some of the gaps in the impossibility proof reasoning, and present corresponding counterexamples. Four different types of bit commitment protocols are constructed with several new protocol techniques. A specific Type 4 protocol is described and proved unconditionally secure. Security analysis of a Type 1 protocol and a Type 2 protocol are also sketched. The security of Type 3 protocols is as yet open. A development of quantum statistical decision theory and quantum games is needed to provie a complete security analysis of many such protocols.
Bit commitment involves the submission of evidence from one party to another so that the evidence can be used to confirm a later revealed bit value by the first party, while the second party cannot determine the bit value from the evidence alone. It is widely believed that unconditionally secure quantum bit commitment is impossible due to quantum entanglement cheating, which is codified in a general impossibility theorem. In this paper, the scope of this general impossibility proof is analyzed, and gaps are found. Two variants of a bit commitment scheme utilizing anonymous quantum states and decoy states are presented. In the first variant, the exact verifying measurement is independent of the committed bit value, thus the second party can make it before the first party opens, making possible an unconditional security proof based on no-cloning. In the second variant, the impossibility proof fails because quantum entanglement purification of a mixed state does not render the protocol determinate. Whether impossibility holds in this or similar protocols is an open question, although preliminary results already show that the impossibility proof cannot work as it stands.