Next: The EPR paradox steps Up: Heads or Tails? Quantum Previous: ``Post-Cold War'' Cryptographic Scenarios

Quantum Bit Commitment

The BB84 QBC protocol by Bennett and Brassard [1] is quite similar to the well-known BB84 QKD protocol:

BB84 Quantum Bit Commitment Protocol²

1.

Commitment Phase

(a): A chooses her bit b and s random bits $\{b_{i}\}$ . Then proceeds to send s particles to B, each one encoding b_iwith respect to the basis $\{\rightarrow ,\uparrow \}$ (if b=0) or $\{\nearrow ,\nwarrow \}$ (if b=1)
(b): B chooses s random bits $\{b_{i}'$ and measures the qubits received with respect to the basis $\{\rightarrow ,\uparrow \}$ (when $b_{i}\prime =0$ ) or $\{\nearrow ,\nwarrow \}$ (when $b_{i}\prime =1$ ).

2.

Disclosure Phase

(a): A reveals b and $\{b_{i}\}$ . B verifies that bwas measured for all i such that $b_{i}=b_{i}\prime$ .

Table 1 enumerates the probabilities of measuring either 0 or 1 depending on the values of b, b_i and $b_{i}\prime$ .

Table 1: BB84 Protocol.
b b_i qubit sent $b_{i}\prime$ measurement basis P(0 measured) P(1 measured)

0 0 $\rightarrow$ 0 $\{\rightarrow ,\uparrow \}$ 1 0

0 0 $\rightarrow$ 1 $\{\nearrow ,\nwarrow \}$ $\frac{1}{2}$ $\frac{1}{2}$

0 1 $\uparrow$ 0 $\{\rightarrow ,\uparrow \}$ 0 1

0 1 $\uparrow$ 1 $\{\nearrow ,\nwarrow \}$ $\frac{1}{2}$ $\frac{1}{2}$

1 0 $\nearrow$ 0 $\{\rightarrow ,\uparrow \}$ $\frac{1}{2}$ $\frac{1}{2}$

1 0 $\nearrow$ 1 $\{\nearrow ,\nwarrow \}$ 1 0

1 1 $\nwarrow$ 0 $\{\rightarrow ,\uparrow \}$ $\frac{1}{2}$ $\frac{1}{2}$

1 1 $\nwarrow$ 1 $\{\nearrow ,\nwarrow \}$ 0 1

**Table 1:** BB84 Protocol.
b	b_i	qubit sent	$b_{i}\prime$	measurement basis	P(0 measured)	P(1 measured)
0	0	$\rightarrow$	0	$\{\rightarrow ,\uparrow \}$	1	0
0	0	$\rightarrow$	1	$\{\nearrow ,\nwarrow \}$	$\frac{1}{2}$	$\frac{1}{2}$
0	1	$\uparrow$	0	$\{\rightarrow ,\uparrow \}$	0	1
0	1	$\uparrow$	1	$\{\nearrow ,\nwarrow \}$	$\frac{1}{2}$	$\frac{1}{2}$
1	0	$\nearrow$	0	$\{\rightarrow ,\uparrow \}$	$\frac{1}{2}$	$\frac{1}{2}$
1	0	$\nearrow$	1	$\{\nearrow ,\nwarrow \}$	1	0
1	1	$\nwarrow$	0	$\{\rightarrow ,\uparrow \}$	$\frac{1}{2}$	$\frac{1}{2}$
1	1	$\nwarrow$	1	$\{\nearrow ,\nwarrow \}$	0	1

Here b is hidden in the basis, either horizontal or rotated by 45 degrees. Alice is sending a mixture of orthogonal states to confuse Bob, who can not tell whether is receiving mixed $\rightarrow$ 's and $\uparrow$ 's or mixed $\nearrow$ 's and $\nwarrow$ 's. It all will make sense, however, when the list of initial polarizations is sent: he will have measured 50% of the particles with the correct basis, providing a certain measure. If any of those turns out to be incorrect, he will know that cheating was involved.

Before the disclosure takes place, B gains no information at all from the protocol, as illustrated by table 1. He could try to cheat by using any arbitrary basis, but whatever measurements he does, the randomness of $\{b_{i}\}$ implies that he cannot guess the value of b before the disclosure phase (table 2).

Table: $B\protect$ tries to gain early information
b b_i qubit sent measurement basis P(0 measured) P(1 measured)

0 0 $\rightarrow$ $\left\{ (\xi _{0},\xi _{1}),(\eta _{0},\eta _{1})\right\}$ $\vert\xi _{0}\vert^{2}$ $\vert\eta _{0}\vert^{2}$

0 1 $\uparrow$ $\left\{ (\xi _{0},\xi _{1}),(\eta _{0},\eta _{1})\right\}$ $\vert\xi _{1}\vert^{2}$ $\vert\eta _{1}\vert^{2}$

1 0 $\nearrow$ $\left\{ (\xi _{0},\xi _{1}),(\eta _{0},\eta _{1})\right\}$ $\frac{1}{2}+\Re (\xi _{0}\overline{\xi _{1}})$ $\frac{1}{2}+\Re (\eta _{0}\overline{\eta _{1}})$

1 1 $\nwarrow$ $\left\{ (\xi _{0},\xi _{1}),(\eta _{0},\eta _{1})\right\}$ $\frac{1}{2}-\Re (\xi _{0}\overline{\xi _{1}})$ $\frac{1}{2}-\Re (\eta _{0}\overline{\eta _{1}})$

**Table:** $B\protect$ tries to gain early information
b	b_i	qubit sent	measurement basis	P(0 measured)	P(1 measured)
0	0	$\rightarrow$	$\left\{ (\xi _{0},\xi _{1}),(\eta _{0},\eta _{1})\right\}$	$\vert\xi _{0}\vert^{2}$	$\vert\eta _{0}\vert^{2}$
0	1	$\uparrow$	$\left\{ (\xi _{0},\xi _{1}),(\eta _{0},\eta _{1})\right\}$	$\vert\xi _{1}\vert^{2}$	$\vert\eta _{1}\vert^{2}$
1	0	$\nearrow$	$\left\{ (\xi _{0},\xi _{1}),(\eta _{0},\eta _{1})\right\}$	$\frac{1}{2}+\Re (\xi _{0}\overline{\xi _{1}})$	$\frac{1}{2}+\Re (\eta _{0}\overline{\eta _{1}})$
1	1	$\nwarrow$	$\left\{ (\xi _{0},\xi _{1}),(\eta _{0},\eta _{1})\right\}$	$\frac{1}{2}-\Re (\xi _{0}\overline{\xi _{1}})$	$\frac{1}{2}-\Re (\eta _{0}\overline{\eta _{1}})$

Due to the orthogonality of the measurement basis, we know that $\vert\xi _{0}\vert^{2}=(1-\vert\eta _{0}\vert^{2})=\vert\eta _{1}\vert^{2}=(1-\vert\xi _{1}\vert^{2})$ and also $\Re (\xi _{0}\overline{\xi _{1}})=-\Re (\xi _{0}\overline{\xi _{1}})$ , so the probabilities of measuring 0 and 1 when b_i=0 are reciprocal to those obtained when b_i=1. All put together, whatever measurement B does, he gains no information on b without knowing b_i³.

When A reveals the list of $\{b_{i}\}$ , B is able to confirm that indeed all his measurements gave the right value for the approximately $\frac{s}{2}$ times that b_i was equal to $b_{i}\prime$ .

Also, A cannot cheat, for table 3 suggests that whatever she sends will have a probability equal to $\vert\beta \vert^{2}$ of being caught if she tries to make believe it was a zero, and of $\frac{1}{2}-\Re (\alpha \overline{\beta )}$ if she tries to make believe it was a one (when it happens to be measured with the aligned basis). The only way to be certain that B will accept the protocol is to either make $\vert\beta \vert^{2}=0$ by sending $\rightarrow$ and committing to zero or make $\frac{1}{2}-\Re (\alpha \overline{\beta )}=0$ by sending $\nwarrow$ and committing to one.

Table 3: Alice sends Bob treacherous data
qubit sent $b_{i}\prime$ measurement basis P(0 measured) P(1 measured)

$(\alpha ,\beta )$ 0 $\{\rightarrow ,\uparrow \}$ $\vert\alpha \vert^{2}$ $\vert\beta \vert^{2}$

$(\alpha ,\beta )$ 1 $\{\nearrow ,\nwarrow \}$ $\frac{1}{2}-\Re (\alpha \overline{\beta )}$ $\frac{1}{2}+\Re (\alpha \overline{\beta )}$

**Table 3:** Alice sends Bob treacherous data
qubit sent	$b_{i}\prime$	measurement basis	P(0 measured)	P(1 measured)
$(\alpha ,\beta )$	0	$\{\rightarrow ,\uparrow \}$	$\vert\alpha \vert^{2}$	$\vert\beta \vert^{2}$
$(\alpha ,\beta )$	1	$\{\nearrow ,\nwarrow \}$	$\frac{1}{2}-\Re (\alpha \overline{\beta )}$	$\frac{1}{2}+\Re (\alpha \overline{\beta )}$

If A would be willing to take risks, she would face a situation as in figure 2, where we have set $(\alpha ,\beta )=(\cos (\theta ),\sin (\theta ))$ ⁴. With $\theta =\frac{\pi }{8}$ for example, the probability of error is $\cong 0.15$ for both measurements, so A would not be caught with a probability of $\cong (.15)^{s/2}$ which rapidly approaches zero when the protocol is done with a sufficiently large number s of iterations.

**Figure 2:** Alice's chances of being caught, per qubit sent.
$\resizebox*{0.7\columnwidth}{!}{\includegraphics{fig1.eps}}$

This protocol looks as secure as Quantum Key Distribution, at a first glance. It does have a failure, however, as Bennett and Brassard realized from the beginning.

Next: The EPR paradox steps Up: Heads or Tails? Quantum Previous: ``Post-Cold War'' Cryptographic Scenarios

1999-11-04