Is quantum bit commitment possible?

  • Classical Bit Commitment
  • Quantum Bit Commitment
  • Cheating Bob?

The classical case

Alice

Bob

Alice

Bob

b

Suppose Alice has a bit \(b\).

Alice

Bob

b

Suppose Alice has a bit \(b\) and she commits towards Bob.

Bob can't see what the bit is.

Alice

Bob

b

Suppose Alice has a bit \(b\) and she commits towards Bob.

At a later point in time, Alice opens the safe.

Alice

Bob

b

Suppose Alice has a bit \(b\) and she commits towards Bob.

Bob has the bit \( b \).

Alice

Bob

b

Suppose Alice has a bit \(b\) and she commits towards Bob.

The only way for Alice to cheat is by opening up the safe when Bob isn't looking and changes the value of \( b \).

Bob can counter with a security camera.

Alice

Bob

b'

Suppose Alice has a bit \(b\) and she commits towards Bob.

If Alice can change from \( b \to b' \) during the time we open the box, we say Alice is a cheater.

The security camera makes the protocol secure, since if Alice were to cheat Bob can detect it. 

The quantum case

Alice

Bob

\(|b\rangle\)

Suppose Alice has a quantum bit \(|b\rangle\). We now describe a general QBC protocol. 

\begin{aligned} |0\rangle&=\sum \alpha_{i}\left|e_{i}\right\rangle_{A} \otimes\left|\phi_{i}\right\rangle_{B}\\ |1\rangle&=\sum_{j} \beta_{j}\left|e_{j}^{\prime}\right\rangle_{A} \otimes\left|\phi_{j}^{\prime}\right\rangle_{B} \end{aligned}
\begin{aligned} |0\rangle&=\sum_i \alpha_{i}\left|e_{i}\right\rangle_{A} \otimes\left|\phi_{i}\right\rangle_{B}\\ |1\rangle&=\sum_{j} \beta_{j}\left|e_{j}^{\prime}\right\rangle_{A} \otimes\left|\phi_{j}^{\prime}\right\rangle_{B} \end{aligned}

Both Alice and Bob know the states \(|\phi_i\rangle_B, |\phi_j ' \rangle_B\) 

\( \langle e_i|e_j'\rangle_B = \delta_{ij} \)

\(|\phi_i\rangle_B, |\phi_j ' \rangle_B\)  not necessarily orthogonal.

|b\rangle = |b_A\rangle|b_B\rangle

Step 1

Alice

Bob

\(|b\rangle\)

An honest Alice measures the first register and determine the value of \( i \) if \( b = 0\)

(\( j\) if \( b = 1\)).  

\(|b\rangle_A, \{i, j\}\)

\(|b\rangle_B\)

\begin{aligned} |0\rangle&=\sum_i \alpha_{i}\left|e_{i}\right\rangle_{A} \otimes\left|\phi_{i}\right\rangle_{B}\\ |1\rangle&=\sum_{j} \beta_{j}\left|e_{j}^{\prime}\right\rangle_{A} \otimes\left|\phi_{j}^{\prime}\right\rangle_{B} \end{aligned}
|b\rangle = |b_A\rangle|b_B\rangle

Step 2

Alice

Bob

\(|b\rangle_B\)

Alice sends the second register to Bob as evidence for commitment.

\(|b\rangle_A, \{i, j\}\)

\begin{aligned} |0\rangle&=\sum_i \alpha_{i}\left|e_{i}\right\rangle_{A} \otimes\left|\phi_{i}\right\rangle_{B}\\ |1\rangle&=\sum_{j} \beta_{j}\left|e_{j}^{\prime}\right\rangle_{A} \otimes\left|\phi_{j}^{\prime}\right\rangle_{B} \end{aligned}
|b\rangle = |b_A\rangle|b_B\rangle

Step 3

Alice

Bob

\(|b\rangle_B\)

At a later time, Alice opens the commitment by telling Bob the value of \( |b_A\rangle\) as well as the basis \(i\) or \(j\).

\(|b\rangle_A, \{i, j\}\)

\begin{aligned} |0\rangle&=\sum_i \alpha_{i}\left|e_{i}\right\rangle_{A} \otimes\left|\phi_{i}\right\rangle_{B}\\ |1\rangle&=\sum_{j} \beta_{j}\left|e_{j}^{\prime}\right\rangle_{A} \otimes\left|\phi_{j}^{\prime}\right\rangle_{B} \end{aligned}
|b\rangle = |b_A\rangle|b_B\rangle

Step 4

Bob

\(|b\rangle_B\)

The values of \( |b\rangle_A \) should be correlated with \(|b\rangle_B \). This is an honest Alice:

\(|b\rangle_A, \{i, j\}\)

\left|e_{i}\right\rangle_{A}
\left|\phi_{i}\right\rangle_{B}
\left|e_{j}'\right\rangle_{A}
\left|\phi_{j}'\right\rangle_{B}
|0\rangle
|1\rangle

Correlated \( i = j\)

Alice says basis is \( i\)

Alice says basis is \( j\)

\begin{aligned} |0\rangle&=\sum_i \alpha_{i}\left|e_{i}\right\rangle_{A} \otimes\left|\phi_{i}\right\rangle_{B}\\ |1\rangle&=\sum_{j} \beta_{j}\left|e_{j}^{\prime}\right\rangle_{A} \otimes\left|\phi_{j}^{\prime}\right\rangle_{B} \end{aligned}
|b\rangle = |b_A\rangle|b_B\rangle

Step 5

Bob

\(|b\rangle_B\)

The values of \( |b\rangle_A \) should be correlated with \(|b\rangle_B \). And a cheating Alice:

\(|b\rangle_A, \{i, j\}\)

\left|e_{i}\right\rangle_{A}
\left|\phi_{i}\right\rangle_{B}
\left|e_{j}'\right\rangle_{A}
\left|\phi_{j}'\right\rangle_{B}

Alice says basis is \( i\)

Alice says basis is \( j\)

Uncorrelated \(i \neq j\)

\begin{aligned} |0\rangle&=\sum_i \alpha_{i}\left|e_{i}\right\rangle_{A} \otimes\left|\phi_{i}\right\rangle_{B}\\ |1\rangle&=\sum_{j} \beta_{j}\left|e_{j}^{\prime}\right\rangle_{A} \otimes\left|\phi_{j}^{\prime}\right\rangle_{B} \end{aligned}
|b\rangle = |b_A\rangle|b_B\rangle

Step 5

Is it possible for Alice to cheat?

How to cheat Bob

(and gain money)

Alice

Bob

\(|b\rangle_B\)

Alice sends the second register to Bob as evidence for commitment.

\(|b\rangle_A, \{i, j\}\)

\begin{aligned} |0\rangle&=\sum_i \alpha_{i}\left|e_{i}\right\rangle_{A} \otimes\left|\phi_{i}\right\rangle_{B}\\ |1\rangle&=\sum_{j} \beta_{j}\left|e_{j}^{\prime}\right\rangle_{A} \otimes\left|\phi_{j}^{\prime}\right\rangle_{B} \end{aligned}
|b\rangle = |b_A\rangle|b_B\rangle

Step 3

For Bob to not know \(|b\rangle\) from \(|b_B\rangle \),

\(|b_B\rangle\) should contain 0 information about

\( |b\rangle = |0\rangle \) or \( |1\rangle\).

\begin{aligned} |0\rangle&=\sum_i \alpha_{i}\left|e_{i}\right\rangle_{A} \otimes\left|\phi_{i}\right\rangle_{B}\\ |1\rangle&=\sum_{j} \beta_{j}\left|e_{j}^{\prime}\right\rangle_{A} \otimes\left|\phi_{j}^{\prime}\right\rangle_{B} \end{aligned}
|b\rangle = |b_A\rangle|b_B\rangle

Thus, Bob's density matrix is given by:

For Bob to not know \(|b\rangle\) from \(|b_B\rangle \),

\(|b_B\rangle\) should contain 0 information about

\( |b\rangle = |0\rangle \) or \( |1\rangle\).

\operatorname{Tr}_{A}|0\rangle\langle 0|\equiv \rho_{0}^{B}=\rho_{1}^{B} \equiv \operatorname{Tr}_{A}| 1\rangle\langle 1|
\begin{aligned} |0\rangle&=\sum_i \alpha_{i}\left|e_{i}\right\rangle_{A} \otimes\left|\phi_{i}\right\rangle_{B}\\ |1\rangle&=\sum_{j} \beta_{j}\left|e_{j}^{\prime}\right\rangle_{A} \otimes\left|\phi_{j}^{\prime}\right\rangle_{B} \end{aligned}
|b\rangle = |b_A\rangle|b_B\rangle

Thus, Bob's density matrix is given by:

\operatorname{Tr}_{A}|0\rangle\langle 0|\equiv \rho_{0}^{B}=\rho_{1}^{B} \equiv \operatorname{Tr}_{A}| 1\rangle\langle 1|
\begin{aligned} |0\rangle&=\sum_{k} \sqrt{\lambda_{k}}|\hat{e}_{k}\rangle_{A} \otimes|\hat{\phi}_{k}\rangle_{B}\\ |1\rangle&=\sum_{k} \sqrt{\lambda_{k}}\left|\hat{e}_{k}^{\prime}\right\rangle_{A} \otimes|\hat{\phi}_{k}\rangle_{B} \end{aligned}

Thus, by the Schmidt Decomposition, there are vectors

\( \lambda_k \) is the eigenvalues of Alice

\(\operatorname{Tr}_{A}|0\rangle\langle 0|= \operatorname{Tr}_{A}|1\rangle\langle 1|\)

\operatorname{Tr}_{A}|0\rangle\langle 0|\equiv \rho_{0}^{B}=\rho_{1}^{B} \equiv \operatorname{Tr}_{A}| 1\rangle\langle 1|
{\displaystyle w=\sum _{1\leq i\leq n,1\leq j\leq m}\beta _{ij}e_{i}\otimes f_{j}}

A general tensor given by:

By the Schmidt decomposition, gives you

{\displaystyle w=\sum _{k=1}^{m}\alpha _{k}u_{k}\otimes v_{k},}
\begin{aligned} |0\rangle&=\sum_i \alpha_{i}\left|e_{i}\right\rangle_{A} \otimes\left|\phi_{i}\right\rangle_{B}\\ |1\rangle&=\sum_{j} \beta_{j}\left|e_{j}^{\prime}\right\rangle_{A} \otimes\left|\phi_{j}^{\prime}\right\rangle_{B} \end{aligned}
|b\rangle = |b_A\rangle|b_B\rangle
\begin{aligned} |0\rangle&=\sum_{k} \sqrt{\lambda_{k}}|\hat{e}_{k}\rangle_{A} \otimes|\hat{\phi}_{k}\rangle_{B}\\ |1\rangle&=\sum_{k} \sqrt{\lambda_{k}}\left|\hat{e}_{k}^{\prime}\right\rangle_{A} \otimes|\hat{\phi}_{k}\rangle_{B} \end{aligned}

Thus, by the Schmidt Decomposition, there are vectors

Compare this to the definition of \(|b\rangle\):

\begin{aligned} |0\rangle&=\sum_i \alpha_{i}\left|e_{i}\right\rangle_{A} \otimes\left|\phi_{i}\right\rangle_{B}\\ |1\rangle&=\sum_{j} \beta_{j}\left|e_{j}^{\prime}\right\rangle_{A} \otimes\left|\phi_{j}^{\prime}\right\rangle_{B} \end{aligned}
|b\rangle = |b_A\rangle|b_B\rangle
\begin{aligned} |0\rangle&=\sum_{k} \sqrt{\lambda_{k}}|\hat{e}_{k}\rangle_{A} \otimes|\hat{\phi}_{k}\rangle_{B}\\ |1\rangle&=\sum_{k} \sqrt{\lambda_{k}}\left|\hat{e}_{k}^{\prime}\right\rangle_{A} \otimes|\hat{\phi}_{k}\rangle_{B} \end{aligned}

Thus, by the Schmidt Decomposition, there are vectors

Compare this to the definition of \(|b\rangle\):

Let \(U_A \) be a unitary transformation mapping \( |\hat{e}_k\rangle \to |\hat{e}_k' \rangle \).

Thus Alice can change from \( |0\rangle \to |1\rangle\) independent of Bob.

Alice

Bob

An honest Alice measures the first register and determine the value of \( i \) if \( b = 0\)

(\( j\) if \( b = 1\)).  

\(|0\rangle_A, \{i, j\}\)

\(|b\rangle_B\)

\begin{aligned} |0\rangle&=\sum_i \alpha_{i}\left|e_{i}\right\rangle_{A} \otimes\left|\phi_{i}\right\rangle_{B}\\ |1\rangle&=\sum_{j} \beta_{j}\left|e_{j}^{\prime}\right\rangle_{A} \otimes\left|\phi_{j}^{\prime}\right\rangle_{B} \end{aligned}
|b\rangle = |b_A\rangle|b_B\rangle

Step 2

Suppose Alice always prepares \(|0\rangle\). We said Alice had to measure her qubit, but she can just do nothing until Step 4.

Alice

Bob

\(|b\rangle_B\)

Alice sends the second register to Bob as evidence for commitment.

\(|0\rangle_A, \{i, j\}\)

\begin{aligned} |0\rangle&=\sum_i \alpha_{i}\left|e_{i}\right\rangle_{A} \otimes\left|\phi_{i}\right\rangle_{B}\\ |1\rangle&=\sum_{j} \beta_{j}\left|e_{j}^{\prime}\right\rangle_{A} \otimes\left|\phi_{j}^{\prime}\right\rangle_{B} \end{aligned}
|b\rangle = |b_A\rangle|b_B\rangle

Step 3

Suppose Alice always prepares \(|0\rangle\). We said Alice had to measure her qubit, but she can just do nothing until Step 4.

Alice

Bob

\(|b\rangle_B\)

At a later time, Alice opens the commitment by telling Bob the value of \( |b_A\rangle\) as well as the basis \(i\) or \(j\).

\begin{aligned} |0\rangle&=\sum_i \alpha_{i}\left|e_{i}\right\rangle_{A} \otimes\left|\phi_{i}\right\rangle_{B}\\ |1\rangle&=\sum_{j} \beta_{j}\left|e_{j}^{\prime}\right\rangle_{A} \otimes\left|\phi_{j}^{\prime}\right\rangle_{B} \end{aligned}
|b\rangle = |b_A\rangle|b_B\rangle

Step 4

U_A

\(|0\rangle_A, \{i, j\}\)

Suppose Alice always prepares \(|0\rangle\). We said Alice had to measure her qubit, but she can just do nothing until Step 4.

Alice

Bob

\(|b\rangle_B\)

At a later time, Alice opens the commitment by telling Bob the value of \( |b_A\rangle\) as well as the basis \(i\) or \(j\).

\begin{aligned} |0\rangle&=\sum_i \alpha_{i}\left|e_{i}\right\rangle_{A} \otimes\left|\phi_{i}\right\rangle_{B}\\ |1\rangle&=\sum_{j} \beta_{j}\left|e_{j}^{\prime}\right\rangle_{A} \otimes\left|\phi_{j}^{\prime}\right\rangle_{B} \end{aligned}
|b\rangle = |b_A\rangle|b_B\rangle

Step 4

\(|b\rangle_A, \{i, j\}\)

Suppose Alice always prepares \(|0\rangle\). We said Alice had to measure her qubit, but she can just do nothing until Step 4.

Alice

Bob

\(|b\rangle_B\)

At a later time, Alice opens the commitment by telling Bob the value of \( |b_A\rangle\) as well as the basis \(i\) or \(j\).

\(|b\rangle_A, \{i, j\}\)

\begin{aligned} |0\rangle&=\sum_i \alpha_{i}\left|e_{i}\right\rangle_{A} \otimes\left|\phi_{i}\right\rangle_{B}\\ |1\rangle&=\sum_{j} \beta_{j}\left|e_{j}^{\prime}\right\rangle_{A} \otimes\left|\phi_{j}^{\prime}\right\rangle_{B} \end{aligned}
|b\rangle = |b_A\rangle|b_B\rangle

Step 4

Suppose Alice always prepares \(|0\rangle\). We said Alice had to measure her qubit, but she can just do nothing until Step 4.

We just duped Bob.

We just duped Bob.

Imagine \( |0\rangle \) corresponds to buying Bitcoin, and \(|1\rangle\) is sell.

Can use quantum bit commitment to trick people into giving me money.

The paper talks about non-ideal case where \(|b_B\rangle \) contains some information about whether \(|b\rangle\) is \(|0\rangle ,|1\rangle \), but the proof is almost the exact same.

This strategy has a name: EPR attack

[1] H.-K. Lo and H. F. Chau, Is Quantum Bit Commitment Really Possible?, Phys. Rev. Lett. 78, 3410 (1997).

References