Is quantum bit commitment possible?
- Classical Bit Commitment
- Quantum Bit Commitment
- Cheating Bob?
The classical case
Alice
Bob
Alice
Bob
b
Suppose Alice has a bit \(b\).
Alice
Bob
b
Suppose Alice has a bit \(b\) and she commits towards Bob.
Bob can't see what the bit is.
Alice
Bob
b
Suppose Alice has a bit \(b\) and she commits towards Bob.
At a later point in time, Alice opens the safe.
Alice
Bob
b
Suppose Alice has a bit \(b\) and she commits towards Bob.
Bob has the bit \( b \).
Alice
Bob
b
Suppose Alice has a bit \(b\) and she commits towards Bob.
The only way for Alice to cheat is by opening up the safe when Bob isn't looking and changes the value of \( b \).
Bob can counter with a security camera.
Alice
Bob
b'
Suppose Alice has a bit \(b\) and she commits towards Bob.
If Alice can change from \( b \to b' \) during the time we open the box, we say Alice is a cheater.
The security camera makes the protocol secure, since if Alice were to cheat Bob can detect it.Â
The quantum case
Alice
Bob
\(|b\rangle\)
Suppose Alice has a quantum bit \(|b\rangle\). We now describe a general QBC protocol.Â
\begin{aligned}
|0\rangle&=\sum \alpha_{i}\left|e_{i}\right\rangle_{A} \otimes\left|\phi_{i}\right\rangle_{B}\\
|1\rangle&=\sum_{j} \beta_{j}\left|e_{j}^{\prime}\right\rangle_{A} \otimes\left|\phi_{j}^{\prime}\right\rangle_{B}
\end{aligned}
\begin{aligned}
|0\rangle&=\sum_i \alpha_{i}\left|e_{i}\right\rangle_{A} \otimes\left|\phi_{i}\right\rangle_{B}\\
|1\rangle&=\sum_{j} \beta_{j}\left|e_{j}^{\prime}\right\rangle_{A} \otimes\left|\phi_{j}^{\prime}\right\rangle_{B}
\end{aligned}
Both Alice and Bob know the states \(|\phi_i\rangle_B, |\phi_j ' \rangle_B\)Â
\( \langle e_i|e_j'\rangle_B = \delta_{ij} \)
\(|\phi_i\rangle_B, |\phi_j ' \rangle_B\) Â not necessarily orthogonal.
|b\rangle = |b_A\rangle|b_B\rangle
Step 1
Alice
Bob
\(|b\rangle\)
An honest Alice measures the first register and determine the value of \( i \) if \( b = 0\)
(\( j\) if \( b = 1\)). Â
\(|b\rangle_A, \{i, j\}\)
\(|b\rangle_B\)
\begin{aligned}
|0\rangle&=\sum_i \alpha_{i}\left|e_{i}\right\rangle_{A} \otimes\left|\phi_{i}\right\rangle_{B}\\
|1\rangle&=\sum_{j} \beta_{j}\left|e_{j}^{\prime}\right\rangle_{A} \otimes\left|\phi_{j}^{\prime}\right\rangle_{B}
\end{aligned}
|b\rangle = |b_A\rangle|b_B\rangle
Step 2
Alice
Bob
\(|b\rangle_B\)
Alice sends the second register to Bob as evidence for commitment.
\(|b\rangle_A, \{i, j\}\)
\begin{aligned}
|0\rangle&=\sum_i \alpha_{i}\left|e_{i}\right\rangle_{A} \otimes\left|\phi_{i}\right\rangle_{B}\\
|1\rangle&=\sum_{j} \beta_{j}\left|e_{j}^{\prime}\right\rangle_{A} \otimes\left|\phi_{j}^{\prime}\right\rangle_{B}
\end{aligned}
|b\rangle = |b_A\rangle|b_B\rangle
Step 3
Alice
Bob
\(|b\rangle_B\)
At a later time, Alice opens the commitment by telling Bob the value of \( |b_A\rangle\) as well as the basis \(i\) or \(j\).
\(|b\rangle_A, \{i, j\}\)
\begin{aligned}
|0\rangle&=\sum_i \alpha_{i}\left|e_{i}\right\rangle_{A} \otimes\left|\phi_{i}\right\rangle_{B}\\
|1\rangle&=\sum_{j} \beta_{j}\left|e_{j}^{\prime}\right\rangle_{A} \otimes\left|\phi_{j}^{\prime}\right\rangle_{B}
\end{aligned}
|b\rangle = |b_A\rangle|b_B\rangle
Step 4
Bob
\(|b\rangle_B\)
The values of \( |b\rangle_A \) should be correlated with \(|b\rangle_B \). This is an honest Alice:
\(|b\rangle_A, \{i, j\}\)
\left|e_{i}\right\rangle_{A}
\left|\phi_{i}\right\rangle_{B}
\left|e_{j}'\right\rangle_{A}
\left|\phi_{j}'\right\rangle_{B}
|0\rangle
|1\rangle
Correlated \( i = j\)
Alice says basis is \( i\)
Alice says basis is \( j\)
\begin{aligned}
|0\rangle&=\sum_i \alpha_{i}\left|e_{i}\right\rangle_{A} \otimes\left|\phi_{i}\right\rangle_{B}\\
|1\rangle&=\sum_{j} \beta_{j}\left|e_{j}^{\prime}\right\rangle_{A} \otimes\left|\phi_{j}^{\prime}\right\rangle_{B}
\end{aligned}
|b\rangle = |b_A\rangle|b_B\rangle
Step 5
Bob
\(|b\rangle_B\)
The values of \( |b\rangle_A \) should be correlated with \(|b\rangle_B \). And a cheating Alice:
\(|b\rangle_A, \{i, j\}\)
\left|e_{i}\right\rangle_{A}
\left|\phi_{i}\right\rangle_{B}
\left|e_{j}'\right\rangle_{A}
\left|\phi_{j}'\right\rangle_{B}
Alice says basis is \( i\)
Alice says basis is \( j\)
Uncorrelated \(i \neq j\)
\begin{aligned}
|0\rangle&=\sum_i \alpha_{i}\left|e_{i}\right\rangle_{A} \otimes\left|\phi_{i}\right\rangle_{B}\\
|1\rangle&=\sum_{j} \beta_{j}\left|e_{j}^{\prime}\right\rangle_{A} \otimes\left|\phi_{j}^{\prime}\right\rangle_{B}
\end{aligned}
|b\rangle = |b_A\rangle|b_B\rangle
Step 5
Is it possible for Alice to cheat?
How to cheat Bob
(and gain money)
Alice
Bob
\(|b\rangle_B\)
Alice sends the second register to Bob as evidence for commitment.
\(|b\rangle_A, \{i, j\}\)
\begin{aligned}
|0\rangle&=\sum_i \alpha_{i}\left|e_{i}\right\rangle_{A} \otimes\left|\phi_{i}\right\rangle_{B}\\
|1\rangle&=\sum_{j} \beta_{j}\left|e_{j}^{\prime}\right\rangle_{A} \otimes\left|\phi_{j}^{\prime}\right\rangle_{B}
\end{aligned}
|b\rangle = |b_A\rangle|b_B\rangle
Step 3
For Bob to not know \(|b\rangle\) from \(|b_B\rangle \),
\(|b_B\rangle\) should contain 0 information about
\( |b\rangle = |0\rangle \) or \( |1\rangle\).
\begin{aligned}
|0\rangle&=\sum_i \alpha_{i}\left|e_{i}\right\rangle_{A} \otimes\left|\phi_{i}\right\rangle_{B}\\
|1\rangle&=\sum_{j} \beta_{j}\left|e_{j}^{\prime}\right\rangle_{A} \otimes\left|\phi_{j}^{\prime}\right\rangle_{B}
\end{aligned}
|b\rangle = |b_A\rangle|b_B\rangle
Thus, Bob's density matrix is given by:
For Bob to not know \(|b\rangle\) from \(|b_B\rangle \),
\(|b_B\rangle\) should contain 0 information about
\( |b\rangle = |0\rangle \) or \( |1\rangle\).
\operatorname{Tr}_{A}|0\rangle\langle 0|\equiv \rho_{0}^{B}=\rho_{1}^{B} \equiv \operatorname{Tr}_{A}| 1\rangle\langle 1|
\begin{aligned}
|0\rangle&=\sum_i \alpha_{i}\left|e_{i}\right\rangle_{A} \otimes\left|\phi_{i}\right\rangle_{B}\\
|1\rangle&=\sum_{j} \beta_{j}\left|e_{j}^{\prime}\right\rangle_{A} \otimes\left|\phi_{j}^{\prime}\right\rangle_{B}
\end{aligned}
|b\rangle = |b_A\rangle|b_B\rangle
Thus, Bob's density matrix is given by:
\operatorname{Tr}_{A}|0\rangle\langle 0|\equiv \rho_{0}^{B}=\rho_{1}^{B} \equiv \operatorname{Tr}_{A}| 1\rangle\langle 1|
\begin{aligned}
|0\rangle&=\sum_{k} \sqrt{\lambda_{k}}|\hat{e}_{k}\rangle_{A} \otimes|\hat{\phi}_{k}\rangle_{B}\\
|1\rangle&=\sum_{k} \sqrt{\lambda_{k}}\left|\hat{e}_{k}^{\prime}\right\rangle_{A} \otimes|\hat{\phi}_{k}\rangle_{B}
\end{aligned}
Thus, by the Schmidt Decomposition, there are vectors
\( \lambda_k \) is the eigenvalues of Alice
\(\operatorname{Tr}_{A}|0\rangle\langle 0|= \operatorname{Tr}_{A}|1\rangle\langle 1|\)
\operatorname{Tr}_{A}|0\rangle\langle 0|\equiv \rho_{0}^{B}=\rho_{1}^{B} \equiv \operatorname{Tr}_{A}| 1\rangle\langle 1|
{\displaystyle w=\sum _{1\leq i\leq n,1\leq j\leq m}\beta _{ij}e_{i}\otimes f_{j}}
A general tensor given by:
By the Schmidt decomposition, gives you
{\displaystyle w=\sum _{k=1}^{m}\alpha _{k}u_{k}\otimes v_{k},}
\begin{aligned}
|0\rangle&=\sum_i \alpha_{i}\left|e_{i}\right\rangle_{A} \otimes\left|\phi_{i}\right\rangle_{B}\\
|1\rangle&=\sum_{j} \beta_{j}\left|e_{j}^{\prime}\right\rangle_{A} \otimes\left|\phi_{j}^{\prime}\right\rangle_{B}
\end{aligned}
|b\rangle = |b_A\rangle|b_B\rangle
\begin{aligned}
|0\rangle&=\sum_{k} \sqrt{\lambda_{k}}|\hat{e}_{k}\rangle_{A} \otimes|\hat{\phi}_{k}\rangle_{B}\\
|1\rangle&=\sum_{k} \sqrt{\lambda_{k}}\left|\hat{e}_{k}^{\prime}\right\rangle_{A} \otimes|\hat{\phi}_{k}\rangle_{B}
\end{aligned}
Thus, by the Schmidt Decomposition, there are vectors
Compare this to the definition of \(|b\rangle\):
\begin{aligned}
|0\rangle&=\sum_i \alpha_{i}\left|e_{i}\right\rangle_{A} \otimes\left|\phi_{i}\right\rangle_{B}\\
|1\rangle&=\sum_{j} \beta_{j}\left|e_{j}^{\prime}\right\rangle_{A} \otimes\left|\phi_{j}^{\prime}\right\rangle_{B}
\end{aligned}
|b\rangle = |b_A\rangle|b_B\rangle
\begin{aligned}
|0\rangle&=\sum_{k} \sqrt{\lambda_{k}}|\hat{e}_{k}\rangle_{A} \otimes|\hat{\phi}_{k}\rangle_{B}\\
|1\rangle&=\sum_{k} \sqrt{\lambda_{k}}\left|\hat{e}_{k}^{\prime}\right\rangle_{A} \otimes|\hat{\phi}_{k}\rangle_{B}
\end{aligned}
Thus, by the Schmidt Decomposition, there are vectors
Compare this to the definition of \(|b\rangle\):
Let \(U_A \) be a unitary transformation mapping \( |\hat{e}_k\rangle \to |\hat{e}_k' \rangle \).
Thus Alice can change from \( |0\rangle \to |1\rangle\) independent of Bob.
Alice
Bob
An honest Alice measures the first register and determine the value of \( i \) if \( b = 0\)
(\( j\) if \( b = 1\)). Â
\(|0\rangle_A, \{i, j\}\)
\(|b\rangle_B\)
\begin{aligned}
|0\rangle&=\sum_i \alpha_{i}\left|e_{i}\right\rangle_{A} \otimes\left|\phi_{i}\right\rangle_{B}\\
|1\rangle&=\sum_{j} \beta_{j}\left|e_{j}^{\prime}\right\rangle_{A} \otimes\left|\phi_{j}^{\prime}\right\rangle_{B}
\end{aligned}
|b\rangle = |b_A\rangle|b_B\rangle
Step 2
Suppose Alice always prepares \(|0\rangle\). We said Alice had to measure her qubit, but she can just do nothing until Step 4.
Alice
Bob
\(|b\rangle_B\)
Alice sends the second register to Bob as evidence for commitment.
\(|0\rangle_A, \{i, j\}\)
\begin{aligned}
|0\rangle&=\sum_i \alpha_{i}\left|e_{i}\right\rangle_{A} \otimes\left|\phi_{i}\right\rangle_{B}\\
|1\rangle&=\sum_{j} \beta_{j}\left|e_{j}^{\prime}\right\rangle_{A} \otimes\left|\phi_{j}^{\prime}\right\rangle_{B}
\end{aligned}
|b\rangle = |b_A\rangle|b_B\rangle
Step 3
Suppose Alice always prepares \(|0\rangle\). We said Alice had to measure her qubit, but she can just do nothing until Step 4.
Alice
Bob
\(|b\rangle_B\)
At a later time, Alice opens the commitment by telling Bob the value of \( |b_A\rangle\) as well as the basis \(i\) or \(j\).
\begin{aligned}
|0\rangle&=\sum_i \alpha_{i}\left|e_{i}\right\rangle_{A} \otimes\left|\phi_{i}\right\rangle_{B}\\
|1\rangle&=\sum_{j} \beta_{j}\left|e_{j}^{\prime}\right\rangle_{A} \otimes\left|\phi_{j}^{\prime}\right\rangle_{B}
\end{aligned}
|b\rangle = |b_A\rangle|b_B\rangle
Step 4
U_A
\(|0\rangle_A, \{i, j\}\)
Suppose Alice always prepares \(|0\rangle\). We said Alice had to measure her qubit, but she can just do nothing until Step 4.
Alice
Bob
\(|b\rangle_B\)
At a later time, Alice opens the commitment by telling Bob the value of \( |b_A\rangle\) as well as the basis \(i\) or \(j\).
\begin{aligned}
|0\rangle&=\sum_i \alpha_{i}\left|e_{i}\right\rangle_{A} \otimes\left|\phi_{i}\right\rangle_{B}\\
|1\rangle&=\sum_{j} \beta_{j}\left|e_{j}^{\prime}\right\rangle_{A} \otimes\left|\phi_{j}^{\prime}\right\rangle_{B}
\end{aligned}
|b\rangle = |b_A\rangle|b_B\rangle
Step 4
\(|b\rangle_A, \{i, j\}\)
Suppose Alice always prepares \(|0\rangle\). We said Alice had to measure her qubit, but she can just do nothing until Step 4.
Alice
Bob
\(|b\rangle_B\)
At a later time, Alice opens the commitment by telling Bob the value of \( |b_A\rangle\) as well as the basis \(i\) or \(j\).
\(|b\rangle_A, \{i, j\}\)
\begin{aligned}
|0\rangle&=\sum_i \alpha_{i}\left|e_{i}\right\rangle_{A} \otimes\left|\phi_{i}\right\rangle_{B}\\
|1\rangle&=\sum_{j} \beta_{j}\left|e_{j}^{\prime}\right\rangle_{A} \otimes\left|\phi_{j}^{\prime}\right\rangle_{B}
\end{aligned}
|b\rangle = |b_A\rangle|b_B\rangle
Step 4
Suppose Alice always prepares \(|0\rangle\). We said Alice had to measure her qubit, but she can just do nothing until Step 4.
We just duped Bob.
We just duped Bob.
Imagine \( |0\rangle \) corresponds to buying Bitcoin, and \(|1\rangle\) is sell.
Can use quantum bit commitment to trick people into giving me money.
The paper talks about non-ideal case where \(|b_B\rangle \) contains some information about whether \(|b\rangle\) is \(|0\rangle ,|1\rangle \), but the proof is almost the exact same.
This strategy has a name: EPR attack
[1] H.-K. Lo and H. F. Chau, Is Quantum Bit Commitment Really Possible?, Phys. Rev. Lett. 78, 3410 (1997).
References
qbc
By Zhi Han
