Reexamination of quantum bit commitment: The possible and the impossible

Bit commitment protocols whose security is based on the laws of quantum mechanics alone are generally held to be impossible. We give a strengthened and explicit proof of this result. We extend its scope to a much larger variety of protocols, which may have an arbitrary number of rounds, in which both classical and quantum information is exchanged, and which may include aborts and resets. Moreover, we do not consider the receiver to be bound to a fixed “honest” strategy, so that “anonymous state protocols,” which were recently suggested as a possible way to beat the known no-go results, are also covered. We show that any concealing protocol allows the sender to find a cheating strategy, which is universal in the sense that it works against any strategy of the receiver. Moreover, if the concealing property holds only approximately, the cheat goes undetected with a high probability, which we explicitly estimate. The proof uses an explicit formalization of general two-party protocols, which is applicable to more general situations, and an estimate about the continuity of the Stinespring dilation of a general quantum channel. The result also provides a natural characterization of protocols that fall outside the standard setting of unlimited available technology and thus may allow secure bit commitment. We present such a protocol whose security, perhaps surprisingly, relies on decoherence in the receiver’s laboratory.

Figure 1

Alice’s basic strategic choices. Decisions she must take are indicated by diamonds, some actions necessary for a typical cheating strategy by squares. The cheating strategies $a_0^{♯}$ and $a_1^{♯}$ are identical throughout the commitment phase and might be equal to a purification of the honest strategy $a_0$. Then $U$ indicates a unitary cheating transformation and $D$ the introduction of suitable decoherence to reverse purification. In the opening phase the cheating strategies are identical to their honest counterparts.

Figure 2

(Color online) Example of a communication tree. Each node corresponds to one history of classical communications, with the different lines from each node representing a possible classical signal. The dashed lines represent the holding phase, in which no communication occurs, followed by the opening move (open circle) by Alice and a measurement by Bob.

Figure 3

(Color online) Part of a path in a continuous-communication tree. The layer $X_t$ belongs to Alice’s move. She sends the message $\mathbf{(}{\varphi }_{t+1}\left(x\right),{\varphi }_t{\varphi }_{t+1}\left(x\right)\mathbf{)}$ to Bob. The next layer is Bob’s turn and consists in sending the message $\mathbf{(}x,{\varphi }_{t+1}\left(x\right)\mathbf{)}$ to Alice.

Figure 4

A quantum bit commitment protocol with local decoherence in Bob’s lab. The rubbish bin symbolizes an entanglement-breaking channel acting on Bob’s reference system. The figure shows the flow of quantum (solid) and classical (dashed) information if both Alice and Bob play honestly. Alice controls all systems on the left-hand side of the figure, Bob those on the right-hand side. Time flows upwards. The protocol starts with Bob submitting some pure quantum state $\mid \psi ⟩∊{\mathbb{C}}^d$ to Alice and ends with Bob’s measurement $M$.

Figure 5

Alice’s cheating strategy consists of applying some quantum channel $T^{♯}$ in the commitment phase and then another quantum channel $T_k^{♯}$ to commit to the bit value $k∊\{0,1\}$ only before the opening. Her goal is to pass Bob’s projective measurement $M$.