∑Impossibility of Quantum Bit Commitment

CPSC 519/619: Quantum Computation John Watrous, University of Calgary Lecture 19: Impossibility of Quantum Bit Commitment March 30, 2006 In the previous lecture we discussed the BB84 quantum key-distribution protocol, which al- lows two physically separated parties to construct a secure private key, and therefore communicate privately by means of the one-time pad. Although the problem of communicating privately is of paramount importance in cryptography, there are other cryptographic tasks that one may consider that key distribution protocols do not address. In this lecture we will discuss one of them: bit com- mitment. This is a particularly interesting problem from the point of view of quantum information because it turns out to be impossible, and this impossibility is due to a fundamental fact about bipartite quantum states (which we have already discussed). Bit commitment First let us define what bit commitment is. Alice has a bit b that she wishes to commit to Bob, but she doesn’t want Bob to know what it is until she chooses to reveal it. Although Bob should not be able to determine b before Alice reveals, he should be sure that Alice cannot change the bit after it is committed. The two key properties of any bit commitment protocol are therefore that it must be: Binding. Alice should not be able to change the bit she committed. • Concealing. Bob should not be able to identify the bit that Alice committed until she reveals it. • One can imagine a “mechanical” implementation of bit commitment as follows. Alice writes b on a piece of paper, locks it in a safe, and sends the safe to Bob. Bob receives the safe, but he doesn’t have the key. He cannot open the safe without the key, so he cannot determine b, and therefore the concealing property holds. Because the safe is in Bob’s possession, Alice cannot open it and change the bit, so the binding property also holds. When Alice wishes to reveal the bit, she sends the key to Bob. Of course this mechanical interpretation is not satisfactory with respect to information process- ing purposes—we would like an implementation based on information. (It could also be argued that the binding and concealing properties, and in particular the concealing property, are based on strong physical assumptions. It is probably impossible to build a safe that can only be opened with a unique key. This is beside the point, however, because our real interest is with an information- based implementation.) Similar to key distribution, it is impossible to implement bit commitment using classical infor- mation without using assumptions about computational intractability. It is a natural question to ask whether quantum information allows one to implement bit commitment. 115

Before addressing this question, it may be helpful to briefly motivate bit commitment. Why would we want to implement bit commitment? The answer is that it is a very interesting cryp- tographic primitive from which several interesting protocols can be built. For example, bit com- mitment allows for secure multi-party computations (such as voting), zero-knowledge proofs for NP-complete problems, and coin-flipping (as well as more complicated variants, such as playing poker). Sketch of impossibility proof The impossibility of quantum bit commitment relies on the following fact, which we proved in Lecture 15. Fact. Suppose satisfy = Then there exists a unitary |φ⟩, |ψ⟩∈A ⊗B TrA |φ⟩⟨φ| TrA |ψ⟩⟨ψ|.operator U such that (U ∈L(A) ⊗I) |φ⟩= |ψ⟩. It happens to be the case that there are approximate versions of the above fact, but because we have not discussed meaningful distance measures for quantum states it will not be possible to go into greater detail about this. Expressed informally, the approximate versions are of this form: if TrA |φ⟩⟨φ| ≈TrA |ψ⟩⟨ψ| then there exists a unitary operator U such that (U ∈L(A) ⊗I) |φ⟩≈|ψ⟩. Now let us apply the above fact to the problem of bit commitment. To begin, suppose that Alice and Bob use a “purely quantum” protocol to supposedly implement bit commitment. What we mean by this is that Alice and Bob apply only unitary operations and send quantum information back and forth—so assuming Alice and Bob are both being honest there are no measurements made until the end of the protocol, and there is no noise or other non-unitary transformations during the protocol. There are necessarily two phases of any bit commitment protocol: the commit phase and the reveal phase. During the commit phase, Alice and Bob may perform some sequence of unitary operations and send qubits back and forth to one another any number of times. Assume that Alice and Bob’s quantum systems at the end of the commit phase have corresponding vector spaces A and B. There are two possible pure states of the entire system at this point: |ψ0⟩or |ψ1⟩, dependingon whether Alice intended to commit 0 or 1, respectively. Under the assumption that the protocol is perfectly concealing, it is the case that TrA |ψ0⟩⟨ψ0| = TrA |ψ1⟩⟨ψ1| ; if this were not so, Bob would be able to perform some measurement of his portion of |ψ0⟩or |ψ1⟩and gain at least partial information about which bit Alice committed. This implies the existence of a unitary operation U that Alice can perform on her qubits alone that would transform ∈L(A) |ψ0⟩to |ψ1⟩: (U ⊗I) |ψ0⟩= |ψ1⟩. Therefore, the binding property must completely fail to hold—Alice can switch back and forth between |ψ0⟩and |ψ1⟩without Bob’s help or knowledge. For example, Alice may simply run the 116

original protocol and “commit” to 0, and later right before the reveal phase, she may either apply U (to switch her commitment to 1) or do nothing (leaving the commitment as 0). Now, you might ask what happens when a protocol specifies that Alice and Bob must perform certain measurements or exchange classical rather than quantum information. It turns out that the situation is essentially the same. This is because the cheating party can decide to simulate all measurements and other non-unitary operations by using only unitary operations, which is always possible using auxiliary qubits as we discussed a few lectures ago. The fact that the non-cheating party may perform measurements or other non-unitary operations will not affect the cheater’s abil- ity to cheat—we may view that the non-cheater uses only unitary operations and simply chooses not to interact with the auxiliary qubits that would be used to do this. Finally, you might ask what happens if perfect security is not required, but in instead only approximate security is permitted. This is indeed the more interesting situation, and it is handled by the approximate versions of the fact that was used above. Specifically, if it is the case that after the commit phase that Bob can learn a little bit, but not too much, about Alice’s commitment, then we must have TrA |ψ0⟩⟨ψ0| ≈TrA |ψ1⟩⟨ψ1| , where “≈” has some technical meaning that we have not discussed. (Usually one uses eitherthe notion of fidelity or trace distance to quantify the notion of approximate equality in such a situation.) This will not necessarily allow Alice complete freedom to change her commitment, but she will have almost complete freedom. There will exist U such that (U meaning ⊗I) |ψ0⟩≈|ψ1⟩,that Alice will be able to change her commitment in a way that Bob will probably not be able to notice. Example of an incorrect protocol In order to illustrate the above discussion, let us consider a protocol that may initially appear to implement bit commitment (in a way that is perfectly concealing and approximately binding). This example, including a cheating strategy, was given in the same paper that proposed the BB84 key exchange protocol (so it was never really believed to be a correct protocol). Example 23. Consider the following protocol, where we assume Alice wishes to commit to the bit b ∈{0, 1}. Commit phase. Let S0 = and S1 = Alice prepares a qubit X in a uniformly {|0⟩, |1⟩}X {|+⟩, |−⟩}.chosen state |φ⟩∈Sb, and sends to Bob. (Bob does not need to do anything in the commit phaseother than store the qubit sent by Alice.) Reveal phase. When Alice wishes to reveal her commitment to Bob, she reveals a classical speci- fication of |φ⟩, for instance: 00 ↔ |φ⟩= |0⟩ 01 ↔ |φ⟩= |+⟩ 10 ↔ |φ⟩= |1⟩ 11 ↔ |φ⟩= |−⟩. 117

In other words, the second bit is b, while the first bit specifies which element of Sb was selected. To check that Alice was being truthful, Bob measures the qubit X sent by Alice in the basis Sb. If the measurement result does not match with the state |φ⟩sent by Alice, then Bob has caught Alicecheating. (Otherwise he has not.) Let us examine the protocol to see what is wrong. (There has to be something wrong if we believe the previous argument that bit commitment is impossible.) First we check to see if it is concealing. If Alice wishes to commit 0, she sends Bob the qubit X in state |0⟩or state |1⟩, eachwith equal probability. As Bob does not know which one Alice chooses, his description of the state of X is given by the density matrix 1 1 1 + = 2 |0⟩⟨0| 2 |1⟩⟨1| 2I, which is the totally mixed state. On the other hand, if Alice wishes to commit a 1, she sends either the state |+⟩or the state |−⟩, againX each with probability 1/2. In this case, the density matrixdescribing Bob’s knowledge of is 1 1 1 + = 2 |+⟩⟨+| 2 |−⟩⟨−| 2I, which is identical to the first case. So, the protocol is indeed perfectly concealing—Bob cannot determine any information about b at any time before the reveal phase. This means the binding property must not hold. It is not difficult to come up with a faulty argument for why the binding property should hold (where Bob catches Alice cheating with some nonzero probability when she does so), under the assumption that Alice prepares X in some state |φ⟩. This is a bad assumption, though. W X One way that Alice can cheat is as follows. She starts by preparing two qubits and in the state √12 √12 and sends X to Bob. The reduced state of Bob’s qubit X at this point |00⟩+ |11⟩,happens to be the totally mixed state, but this doesn’t really matter—Bob is being honest, so he would not measure his qubit until the reveal phase. Alice has not really committed to anything. Time passes and the reveal phase comes. At this point, Alice may effectively decide to reveal that she “committed” b = 0 or b = 1, whichever she wants. If she wishes to reveal b = 0, she measures W in the standard basis. If she gets the result 0, she sends 00 to Bob, and if she gets 1, she sends 10 to Bob. Bob measures and gets precisely the same outcome as Alice, leading him to believe that she was being honest and had committed b = 0 all along. If Alice instead wishes to reveal b = 1, she measures W in the basis, interpreting {|+⟩, |−⟩}the result as 0 or 1 respectively. (Alternately, she performs a Hadamard transform on W and measures.) She then sends the measurement outcome followed by b = 1 to Bob. Suppose Alice’s measurement outcome was 0. Then the state of X becomes |+⟩. Similarly, if Alice measures 1, the state of X becomes |−⟩. This is because 1 1 1 1 1 (H ⊗I) √ 2 |00⟩+ √ 2 |11⟩ = 2 |00⟩+ 2 |10⟩+ 2 |01⟩−12 |11⟩ 1 1 = √ 2 |0⟩|+⟩+ √ 2 |1⟩|−⟩. 118

When Bob measures to “check” Alice’s honesty, he gets always gets the outcome that leads him to believe Alice was honest. The binding property has failed completely as we suspected. There have been many attempts to bypass the proof that bit commitment is impossible using quantum information, but they never succeed. Indeed, there are some people who continue to write papers arguing that the proof of the impossibility of quantum bit commitment is possible to circumvent. It isn’t—their arguments are always based on a misunderstanding of quantum information, cryptography, or mathematics more generally. 119