Quantum Bit Commitment and the Reality of the Quantum State

Abstract

Quantum bit commitment is insecure in the standard non-relativistic quantum cryptographic framework, essentially because Alice can exploit quantum steering to defer making her commitment. Two assumptions in this framework are that: (a) Alice knows the ensembles of evidence E corresponding to either commitment; and (b) system E is quantum rather than classical. Here, we show how relaxing assumption (a) or (b) can render her malicious steering operation indeterminable or inexistent, respectively. Finally, we present a secure protocol that relaxes both assumptions in a quantum teleportation setting. Without appeal to an ontological framework, we argue that the protocol’s security entails the reality of the quantum state, provided retrocausality is excluded.

Appendix A: State of the Evidence

We conservatively assume that all states $\mathinner {|{\phi ^{(a)}_j}\rangle }$ for a given a are identical, say $\mathinner {|{0}\rangle }$. Under the stated assumptions, Alice’s evidence is in the state

$$\begin{aligned} \rho _B^a&= {\mathcal {C}}_W \left[ \left( \mathinner {|{0}\rangle }\mathinner {\langle {0}|}\right) ^{\otimes n} \otimes \left[ \frac{{\mathbb {I}}}{2}\right] ^{\otimes Q} \right] ,\nonumber \\&= \left( 2^{Q+n} - \sum _{j=1}^{n} {Q+n \atopwithdelims ()Q+j} \right) ^{-1} {\mathbb {I}}^*\nonumber \\&= \left( 2^{Q+n} - \sum _{j=0}^{n-1} {Q+n \atopwithdelims ()j} \right) ^{-1} {\mathbb {I}}^*\nonumber \\ \end{aligned}$$

(A1)

where ${\mathbb {I}}^*$ is the density matrix in the Hilbert space ${\mathcal {H}}_2^{\otimes (Q+n)}$ of $2^{Q+n}$ qubits, which is diagonal and equal-weighted in the computational basis, with precisely the components with Hamming weight greater than Q vanishing.

For a fixed integer t, and integer $T \rightarrow \infty$, the truncated binomial series satisfies the bound [42]:

$$\begin{aligned} \lim _{T\rightarrow \infty } {T \atopwithdelims ()t}^{-1} \sum _{j=0}^t {T \atopwithdelims ()j}&= {{T \atopwithdelims ()t} + {T \atopwithdelims ()t-1} + {T \atopwithdelims ()t-2}+\dots \over {T \atopwithdelims ()t}} \nonumber \\&= {1 + {t \over T-t+1} + {t(t-1) \over (T-t+1)(T-t+2)} + \cdots } \nonumber \\&\le {1 + {t \over T-t+1} + \left( {t \over T-t+1} \right) ^2 + \cdots }\nonumber \\&= \frac{T-t+1}{T-2t+1}. \end{aligned}$$

(A2)

Setting $T \equiv n+Q$ and $t \equiv n-1$ here, one finds

$$\begin{aligned} \sum _{j=0}^{n-1} {n+Q \atopwithdelims ()j} \le {n+Q \atopwithdelims ()n-1}\frac{Q+2}{Q-n+3}. \end{aligned}$$

(A3)

Substituting this in Eq. (A1), we find that, for large $Q \gg n$, the number of non-vanishing entries in ${\mathbb {I}}^*$ is bounded below by $\upsilon (Q,n) \equiv 2^{Q+n}-{n+Q \atopwithdelims ()n-1}\frac{Q+2}{Q-n+3} \approx 2^{Q+n}-{Q+n \atopwithdelims ()n-1} \approx 2^{Q+n} - 2^{(Q+n)H(n/Q)} = 2^{Q+n}(1 - 2^{-(Q+n)[1-H(n/Q)]}$, where the Stirling approximation ${N \atopwithdelims ()Np} \approx NH(p)$, has been used.

The fidelity between states $\rho$ and $\sigma$ is given by Tr$(\sqrt{\sqrt{\sigma }\rho \sqrt{\sigma }}$. Setting $\sigma \equiv 2^{-(Q+n)}{\mathbb {I}}$ and $\rho \equiv \rho ^a_B$ in Eq. (A1) in the above approximation, we have fidelity $F(Q,n) = 2^{-(Q+n)/2}\mathrm{Tr}(\sqrt{\rho ^a_B}) \gtrsim 2^{-(Q+n)/2}\sqrt{\upsilon (Q,n)}$, from which, one obtains Eq. (5).