Alice
Bob
Alice
Bob
b
Suppose Alice has a bit \(b\).
Alice
Bob
b
Suppose Alice has a bit \(b\) and she commits towards Bob.
Bob can't see what the bit is.
Alice
Bob
b
Suppose Alice has a bit \(b\) and she commits towards Bob.
At a later point in time, Alice opens the safe.
Alice
Bob
b
Suppose Alice has a bit \(b\) and she commits towards Bob.
Bob has the bit \( b \).
Alice
Bob
b
Suppose Alice has a bit \(b\) and she commits towards Bob.
The only way for Alice to cheat is by opening up the safe when Bob isn't looking and changes the value of \( b \).
Bob can counter with a security camera.
Alice
Bob
b'
Suppose Alice has a bit \(b\) and she commits towards Bob.
If Alice can change from \( b \to b' \) during the time we open the box, we say Alice is a cheater.
The security camera makes the protocol secure, since if Alice were to cheat Bob can detect it.Â
Alice
Bob
\(|b\rangle\)
Suppose Alice has a quantum bit \(|b\rangle\). We now describe a general QBC protocol.Â
Both Alice and Bob know the states \(|\phi_i\rangle_B, |\phi_j ' \rangle_B\)Â
\( \langle e_i|e_j'\rangle_B = \delta_{ij} \)
\(|\phi_i\rangle_B, |\phi_j ' \rangle_B\) Â not necessarily orthogonal.
Alice
Bob
\(|b\rangle\)
An honest Alice measures the first register and determine the value of \( i \) if \( b = 0\)
(\( j\) if \( b = 1\)). Â
\(|b\rangle_A, \{i, j\}\)
\(|b\rangle_B\)
Alice
Bob
\(|b\rangle_B\)
Alice sends the second register to Bob as evidence for commitment.
\(|b\rangle_A, \{i, j\}\)
Alice
Bob
\(|b\rangle_B\)
At a later time, Alice opens the commitment by telling Bob the value of \( |b_A\rangle\) as well as the basis \(i\) or \(j\).
\(|b\rangle_A, \{i, j\}\)
Bob
\(|b\rangle_B\)
The values of \( |b\rangle_A \) should be correlated with \(|b\rangle_B \). This is an honest Alice:
\(|b\rangle_A, \{i, j\}\)
Correlated \( i = j\)
Alice says basis is \( i\)
Alice says basis is \( j\)
Bob
\(|b\rangle_B\)
The values of \( |b\rangle_A \) should be correlated with \(|b\rangle_B \). And a cheating Alice:
\(|b\rangle_A, \{i, j\}\)
Alice says basis is \( i\)
Alice says basis is \( j\)
Uncorrelated \(i \neq j\)
Is it possible for Alice to cheat?
(and gain money)
Alice
Bob
\(|b\rangle_B\)
Alice sends the second register to Bob as evidence for commitment.
\(|b\rangle_A, \{i, j\}\)
For Bob to not know \(|b\rangle\) from \(|b_B\rangle \),
\(|b_B\rangle\) should contain 0 information about
\( |b\rangle = |0\rangle \) or \( |1\rangle\).
Thus, Bob's density matrix is given by:
For Bob to not know \(|b\rangle\) from \(|b_B\rangle \),
\(|b_B\rangle\) should contain 0 information about
\( |b\rangle = |0\rangle \) or \( |1\rangle\).
Thus, Bob's density matrix is given by:
Thus, by the Schmidt Decomposition, there are vectors
\( \lambda_k \) is the eigenvalues of Alice
\(\operatorname{Tr}_{A}|0\rangle\langle 0|= \operatorname{Tr}_{A}|1\rangle\langle 1|\)
A general tensor given by:
By the Schmidt decomposition, gives you
Thus, by the Schmidt Decomposition, there are vectors
Compare this to the definition of \(|b\rangle\):
Thus, by the Schmidt Decomposition, there are vectors
Compare this to the definition of \(|b\rangle\):
Let \(U_A \) be a unitary transformation mapping \( |\hat{e}_k\rangle \to |\hat{e}_k' \rangle \).
Thus Alice can change from \( |0\rangle \to |1\rangle\) independent of Bob.
Alice
Bob
An honest Alice measures the first register and determine the value of \( i \) if \( b = 0\)
(\( j\) if \( b = 1\)). Â
\(|0\rangle_A, \{i, j\}\)
\(|b\rangle_B\)
Suppose Alice always prepares \(|0\rangle\). We said Alice had to measure her qubit, but she can just do nothing until Step 4.
Alice
Bob
\(|b\rangle_B\)
Alice sends the second register to Bob as evidence for commitment.
\(|0\rangle_A, \{i, j\}\)
Suppose Alice always prepares \(|0\rangle\). We said Alice had to measure her qubit, but she can just do nothing until Step 4.
Alice
Bob
\(|b\rangle_B\)
At a later time, Alice opens the commitment by telling Bob the value of \( |b_A\rangle\) as well as the basis \(i\) or \(j\).
\(|0\rangle_A, \{i, j\}\)
Suppose Alice always prepares \(|0\rangle\). We said Alice had to measure her qubit, but she can just do nothing until Step 4.
Alice
Bob
\(|b\rangle_B\)
At a later time, Alice opens the commitment by telling Bob the value of \( |b_A\rangle\) as well as the basis \(i\) or \(j\).
\(|b\rangle_A, \{i, j\}\)
Suppose Alice always prepares \(|0\rangle\). We said Alice had to measure her qubit, but she can just do nothing until Step 4.
Alice
Bob
\(|b\rangle_B\)
At a later time, Alice opens the commitment by telling Bob the value of \( |b_A\rangle\) as well as the basis \(i\) or \(j\).
\(|b\rangle_A, \{i, j\}\)
Suppose Alice always prepares \(|0\rangle\). We said Alice had to measure her qubit, but she can just do nothing until Step 4.
We just duped Bob.
We just duped Bob.
Imagine \( |0\rangle \) corresponds to buying Bitcoin, and \(|1\rangle\) is sell.
Can use quantum bit commitment to trick people into giving me money.
The paper talks about non-ideal case where \(|b_B\rangle \) contains some information about whether \(|b\rangle\) is \(|0\rangle ,|1\rangle \), but the proof is almost the exact same.
This strategy has a name: EPR attack
[1] H.-K. Lo and H. F. Chau, Is Quantum Bit Commitment Really Possible?, Phys. Rev. Lett. 78, 3410 (1997).