Implementable Quantum Bit-String Commitment Protocol Toyohiro Tsurumaru Mitsubishi Electric Corporation, Information Technology R&D Center 5–1–1 Ofuna, Kamakura-shi, Kanagawa, 247-8501, Japan Quantumbitstringcommitment[A.Kent,Phys.Rev.Lett.,90,237901(2003)]orQBSCisavariant ofbitcommitment(BC).Inthispaper,weproposeanewQBSCprotocolthatcanbeimplemented using currently available technology, and prove its security under the same security criteria as discussed by Kent. QBSC is a generalization of BC, but has slightly weaker requirements, and our proposed protocol is not intended to break theno-go theorem of quantumBC. PACS number(s): 03.67.-a, 03.67.Dd, 89.70.+c 5 0 0 I. INTRODUCTION tum key distribution(QKD). This is mainly because BC 2 isoneimportantbuildingblockinawholelistofinterest- n ingtools,suchasmulti-partyprotocolsorzero-knowledge a Quantum bit string commitment (QBSC) was pro- J posed by Kent[3], as a generalization of bit commitment proof, rooted in classicalcryptology(see e.g., Ref.[8][9]). However, as pointed out in Ref.[3], we are not yet able 6 (BC).ThefundamentalgoalofQBSCisthesameasthat ofBC;thatis,thesenderfirstsendsevidenceofassigned even to characterizethe range of cryptographictasks for 2 whichperfectlysecurequantumprotocolsmightpossibly dataoveracommunicationchannelwithoutrevealingthe v exist. Thus, we assume here that there must be distinct actual data. Then, after an interval, the sender reveals 4 security notions that are unique to quantum cryptogra- the data and the receiver verifies that the data have not 7 phy, and seek protocols that do not necessarily have a 1 been modified. classical counterpart. 7 The difference in QBSC is that the sender commits a This paper is organized as follows. In Section II, we 0 string A = (a , ,a ) with n > 1 in a single protocol 4 1 ··· n briefly review some of the results by Kent[3], including session,andalimited(butcertain)numberofitsbitsare 0 the basic structure of QBSC and its security criteria. accessible by the receiver before the open phase. This / Subsequently, we describe the proposed protocol in Sec- h situation is referred to as (m,n) bit string commitment tion III and prove its security in Section IV. Then in p in Ref.[3], where m ( n) is the maximum number of - ≤ Section V, we briefly comment on the implementation nt accessible bits. Conventional BC schemes correspond to and finally conclude in Section VI. thecasewheren=1andm=0,andinthissenseQBSC a is a generalizationof BC. u q In this paper, we propose a new QBSC protocol that II. PREVIOUS METHOD : canbeimplementedusingcurrentlyavailabletechnology, v such as single-photon sources and detectors, and then i X prove its security. The main difference from the previ- The original QBSC was proposed in Ref.[3], with two r ous protocol is in the quantum measurement procedure example schemes, called Protocol 1 and Protocol 2. Be- a performed by the receiver to verify a commitment. In forepresentingourprotocol,webrieflyreviewtheresults our scheme, the receiver is allowed to perform the mea- by Kent in this section. Both of the example protocols surements in the commitment phase using randomized share a simple basic structure, as follows. Throughout bases, which means that it is not necessary to preserve this paper, we will call the sender Alice and the receiver the quantum state until the open phase. Bob. AlthoughQBSCisageneralizationofBC,thesecurity level that it achieves is slightly weaker than that of BC unless m=0. We would like to stress that our proposal A. Basic Structure of Kent’s Scheme isnotintendedtobreaktheno-gotheoremofLo-Chau[5] and Mayers[6], which states that if one takes full advan- 1. Procedure tageofquantumcomputersandquantumcommunication channels, any type of nonrelativistic BC scheme can be Alice and Bob proceed as follows. attacked[17]. Our ultimate goal is to devise useful and secure quantum cryptographic schemes that do not rely Commitment Phase on BC. The no-go theorem of BC often makes people think 1. Alice chooses a bit string A = (a ,...,a ) to be 1 n that it might be impossible to create any useful crypto- committed to and sends Bob the corresponding graphicprotocolsbasedonquantumtheory,exceptquan- state Ψ . A | i 2 2. Bob preserves the received state Ψ . B. Example Protocols A | i Open Phase 1. Protocol 1 1. Alice unveils A to Bob. Define qubit states 2. Bob verifies A by a projective measurement on Ψ . If the outcome is consistent with A, he ac- A ψ = 0 , ψ =sinθ 0 +cosθ 1 . | i 0 1 cepts the commitment, otherwise he rejects it. | i | i | i Alice sends particles in the states ψ ,...,ψ for A = The exact form of the state Ψ differs depending on a1 an | Ai (a1,...,an), ai 0,1 . In other words, she transmits the type of protocol and will be given below. to Bob the state∈Ψ{ :}= ψ ψ . Here θ R | Ai | a1i⊗···⊗| ani ∈ isaconstantthatisdeterminedaccordingtothesecurity parameter. 2. Security Requirement a. ConcealingCondition FromtheHolevobound[7], the information m that is accessible by Bob is bounded ForBC,therearetwosecurityrequirements,whichare by called the concealing and binding conditions[9]. Similar n notionsarealsousedforQBSC,althoughwithsomewhat 1+sinθ m S(ρ)= H , (2) relaxed restrictions[3]. ≤ (cid:20) 2(cid:18) 2 (cid:19)(cid:21) - Concealing Condition. The receiver can access where H (x) = xlogx (1 x)log(1 x). Hence m 2 only a limited number of bits in the committed can be arbitraril−y small b−y adj−usting θ. − string A before the open phase. b. Binding Condition. InProtocol1,binding is dis- Thenumberofaccessiblebits isreferredtoasmin cussedforeachbitseparately. Letpji =hψj|ρi|ψjibethe Ref.[3]. probability of Bob accepting a revelationof j for the ith bit. We have - Binding Condition. It is unlikely that Alice will change the content of her commitment A after the p0+p1 cos2[(π 2θ)/4]+sin2[(π+2θ)/4] , (3) i i ≤ − commitment phase. where the RHS can again be chosen arbitrarily close to Note that for BC schemes, Bob is assumed to gain no 1 by choosingsuitableθ. Ingeneral,the smaller θ is, the information whatsoever regarding committed bit b until stronger the binding becomes; simultaneously, however, Alice unveilsit, whereasinQBSC perfectconcealmentis concealingbecomesweaker,ascanbe seenfromInequal- dispensed with; Bob is allowed to extract a certain but ity (2). Thus, θ needs to be chosen with this balance in limited amount of information from A. mind. The meaning of the term ‘unlikely’ in the definition of the binding condition differs in the two protocols. This point will be discussed below. 2. Protocol 2 As to the possibility of each player cheating, Alice cheatingputsthebindingatriskandBobcheatingcorre- In Protocol 1, as m in (3) is in the same order as sponds to concealment. Throughout this paper, we con- n, most bits from A are accessible by Bob, because the sideronlycaseswhereeitheroneofthemischeating,but amountofdata encoded per qubit is rather small. Thus, not both. Thus, the binding and concealing conditions anotherprotocolattheotherextremewithamuchhigher can be discussed separately. encoding rate is considered here . The basic idea here is that instead of using qubits, oneencodesAintoageneralD-dimensionalvectorspace 3. Measurement by Bob =CD/C. Thus,onechoosesO(exp(const.D))states D H Ψ out of . A D {| i} H When considering Alice’s cheating, we denote the a. Binding Condition. In Protocol 1, we discussed quantumstatesenttoBobasadensitymatrixρ,sincein bitwise security; here we take a different approach. general,Alice would be likely to use a randomizedstrat- Definition 1 Takeanarbitraryvalueofr Zandε R egy or send an entangledstate. Note here that whatever ∈ ∈ (ε,r > 0). A QBSC protocol is binding if, by choosing strategy Alice follows, once she transmits the quantum a large enough n, the following inequality holds for arbi- state to Bob, the density matrix ρ is fixed. Honest Bob trarily chosen A ,...,A and ρ, verifies Alice’s commitment by performing a projective 1 r measurement of ρ using an orthonormal basis that in- Pr[A ρ] 1+ε . (4) cludes |ΨAi. Bob then accepts it as a correct commit- Xi i| ≤ ment of string A with the probability Here, n is the length of the bit string that is to be com- Pr[Aρ]= ΨA ρΨA . (1) mitted. 2 | h | | i 3 Intuitively, this definition can be illustrated as follows. Therefore, we cosider here whether Bob can distinguish A cheating Alice might want to postpone her decision ρ sufficiently accurately without knowing A, because if by selecting x patterns of bit strings A ,...,A in the that is the case, Bob does not need to preserve ρ for a 1 x commitment phase. Then, later in the open phase, she long period. could unveil any desired string among them. In such a In order to actually do this, we change Bob’s verifica- case,themaximumprobabilityofhersuccessislessthan tion procedure. That is, Bob measures ρ as soon as he 1/x if xr. receives it using randomly chosen orthogonal bases, and Infact,itcanbeshown[3]thatifthecommittedstates then stores the result until the open phase. Although Ψ are chosen to be approximately orthogonal: much less information is obtained in this way than is A | i obtained by directly comparing ρ with Ψ Ψ , it is A A | ih | ΨA ΨA′ sinθ =ǫ 1 for A= A′ (5) enough to detect cheating by Alice, as we will show in |h | i|≤ ≪ ∀ 6 ∀ Section IV. the above binding condition (4) is true for ε (r 1)ǫ. ≤ − That is, if one can construct approximately orthogonal states ΨA ,the bindingconditionis automaticallyguar- A. Quantum State for Encoding | i anteed. b. Approximately Orthogonal States. In this proto- First we define the quantum state Ψ , which is used A col, one needs to choose exp(const.D) states Ψ out of | i A as a commitment of the string A. | i D-dimensional vector space while keeping approximate orthogonality as in (5). Although this seems impossible at first sight, interestingly, it can in fact be eas- 1. Error-Correcting Code ily achieved by using classical error-correctingcodes[11]. One example is as follows. Throughout this section, we assume that string A is Take an error-correcting code E : 0,1 n 0,1 m { } → { } notnecessarilyabitstringbutisingeneralaq-arystring with information rate R = n/m and minimum distance A=(a1,...,an′), ai 0,...,q 1 . Iftheoriginaldata d and let δ = d/m. Next choose quantum states h ∈{ − } C2m/C corresponding to string A 0,1 n as: | Ai ∈ are a bit string, one needs to transform them into a q- ∈{ } arystringusingsomeappropriatesurjectivemapping. In this case, A stands for the data of n= n log q bits. 1 m ⌈ ′ 2 ⌉ Thenwe fix a q-aryclassical(N,n,d)error-correcting h := i E (A) . (6) ′ A i | i √m | i⊗| i code : Xi=1 E :A E(A)=(e ,...,e ) , e 0,...,q 1 . Then, as hA hA′ (1 δ) for A = A′, an arbitrarily 7→ 1 N i ∈{ − } |h | i| ≤ − 6 smallǫcanbechosenbydefining ΨA as ΨA := hA The sender stretches the string A into a q-ary string E | i | i | i⊗ hA . of length N using this error-correctingcode. ···⊗| i III. PROPOSED PROTOCOL 2. Quantum States of ‘Particles’ Theprotocolsdescribedintheprevioussectionarecer- The commitment Ψ takes the form A | i tainly significant, in that they achieve a completely new Ψ = Ψ := e e , (7) type of security by using quantum mechanics. However, A E(A) 1 N | i | i | i⊗···⊗| i itseemsalmostimpossibletoimplementthemusingcur- where each e is a D-dimensional vector. That is, the i rent technology. There are two main reasons. | i sender commits by sending N ‘particles’ having inter- nal degrees of freedom in a D-dimensional vector space 1. Bob needs to preserve the quantum state Ψ as | Ai = CD/C. Each q-ary value e is encoded into this it was created by Alice, until the open phase. HDD-dimensional space of the ith pariticle. 2. InProtocol2,highlyentangledstates,suchas h We use the same set of D-dimensional states for each A | i given in (6), are necessary. particle and denote them as In particular, the first point seems the more difficult to 0 , , q 1 D . (8) | i ··· | − i ∈H overcome. Thus,weproposeamodifiedversionofQBSC Hence,Eqn.(7)meansthattheith particlehase th states that can be implemented, and subsequently prove its se- i of (8). The q states of (8) are all distinct but do not curity. necessarily form an orthonormal basis. In Kent’s protocol, Bob needs to preserve the quan- It is assumed here that D satisfies q = lD for l Z, tum state ρ as it wassentfromAlice inthe commitment ∈ and that the states of (8) can be groupedtogether into l phase until the open phase. This is because Bob verifies types of orthonormalbasis M(i), i=0,...,l 1 ρ by projective measurements using an orthonormal ba- − sisincluding Ψ Ψ ,afterAlicehasunveiledstringA. M(i):= i;0 ,..., i;D 1 , i;j i;k =δ (9) A A jk | ih | {| i | − i} h | i 4 Previous Protocol Proposed Protocol Alice Bob Alice Bob Ψ Ψ A A Ψ Ψ ρ ρ A A Measurement Commitment without knowing A Phase Preserve Open Phase A A A A ρ Compare Aand the Measurement using A result of measurement FIG. 1: Differences between theprevious and proposed protocols. with 1. Alice reveals A to Bob. 2. Bob computes the codeword E(A). iD+j = i;j . | i | i 3. Bobverifiesthefollowingconditionforeachparticle Also, for the sake of simplicity, we assume that the or- 1 i N : thogonal bases M(i) are symmetric under a finite group ≤ ≤ Gthatactson . Inotherwords,forany0 i l 1, - If the basis that he chose is correct, i.e., D H ≤ ≤ − g G, there exists 0 i l 1 satisfying e M(s ), he obtains e as a result of ∈ ≤ ′ ≤ − | ii ∈ i | ii his measurement. gM(i):= R(g)i;0 , ..., R(g)i;D 1 =M(i′) , { | i | − i} 4. If the abovecondition does not holdfor anyi, Bob (10) rejects the commitment, otherwise, he accepts it. where R is a representation of G in . In Eqn.(10), states are identified if they differ onlyHuDp to a phase of complex number. C. Differences from Kent’s Protocols B. Protocol As stated earlier, Bob does not need to preserve the quantum state ρ until the open phase as he examines ρ inthecommitmentphase. Byusingrandomizedbases,he Alice and Bob proceed as follows. selects correct bases in a probabilistic way, and is therefore able to verify Alice’s commitment confidently. Commitment Phase In addition, players only need to be able to create 1. Alice chooses a q-ary string A = (a1,...,an′) to and detect D-dimensional quantum states, and thus the which she is committed and computes the corre- highly entangled states, e.g., hA given in (6), are un- | i sponding codeword E(A)=(e ,...,e ). necessary. For instance, the case of D =2 can be imple- 1 N mented using single-photons. 2. Bob chooses a l-ary random string Error-correcting code is used here to ensure approxi- S =(s1,...,sN) 0,...,l 1 N. mate orthogonality of states |ΨE(A)i as in Kent’s proto- ∈{ − } col (c.f., Eqn.(5)). Indeed in our protocol, Alice sends 3. Alice sends N particles e ,..., e to Bob. Ψ := e e , which satisfies | 1i | Ni | E(A)i | 1i⊗···⊗| Ni 4. Bobperformsmeasurementsoneachreceivedparti- A A′ A=A′ ΨE(A) ΨE(A′) <β¯d . (11) ∀ ∀ 6 → | cle|eiiwiththebasisM(si)andrecordstheresult. Hereβ¯is th(cid:0)e maximum(cid:12)(cid:12)(cid:10)value ofthe in(cid:11)n(cid:12)(cid:12)er pro(cid:1)ductofthe Open Phase particle states defined in (8), i.e., ee β¯ for e=e ′ ′ |h | i|≤ ∀ 6 5 (seealsoParagraphIVB2c). Inthenextsection,wewill if he chooses a wrong basis, he may accept Alice’s com- exploit this property to prove the binding condition. mitment no matter what he obtains as a result of his measurement. Thus, averaged over the random variable S, the acceptance rate by Bob takes the form IV. SECURITY EVALUATION 1 1 Pr [Aρ]:= 1 + e ρe =Trρπ(e ), (12) N=1 1 1 1 | (cid:18) − l(cid:19) lh | | i Nowwewillprovethesecurityoftheproposedscheme. Throughoutthissection,weconsideranidealcasewitha where noiselesschannelanderror-freedetection. (Fornon-ideal cases, see Section V.) 1 1 π(e) := 1 I + e e As to what each player can do in quantum proto- (cid:18) − l(cid:19) D l| ih | cols, we follow the definition given by Yao[14] and Lo- 1 1 Chau[15]. That is, quantum protocol is formalized in a = 1 I + i;j i;j =:π(i;j) . (13) D (cid:18) − l(cid:19) l| ih | Hilbert space = , where (resp. T A B C A H H ⊗H ⊗H H ) refers to the space in which Alice (resp. Bob) can HopBerate. HC is the communication channel. Every step HeSriemIiDlarislyafourniNt m>a1tr,iix.ei.n, iHf DA.lice sends more than one ofthe protocolisdone byunitary operationsby Alice on particle, the acceptance rate takes the form and those by Bob on , alternately. A C B C H ⊗H H ⊗H Pr[Aρ]=TrρP E(A) | A. Concealing condition with Intheproposedprotocol,nlog q-bitdataareencoded PE =π(e1) π(eN) . (14) 2 ⊗···⊗ in Nlog D qubits. Thus, the number of bits accessi- 2 b. What We Need to Prove. The sum of the accep- ble by Bob, m, satisfies m Nlog D owing to the ≤ 2 tance rates for A ,...,A , which appears on the LHS of Holevo bound. Hence, the protocol is concealing when 1 r (4), takes the form the bitnumberofAisgreaterthanthe qubitnumber,or NlogD 0 and differentiating by S, we see 1 2 3 that which corresponds to q = 4, D = 2, l = 2, and β = 3/4. As onecanseefromthe theoryoferror-correctingcodes, Pr[A ρ] rǫ + 1 c21+c3c22+c1 =1+ε . (34) for sufficiently large N, there exists a code E with the Xi i| ≤ 2 2p c3 informationraten′/N thatis virtually equalto 1. Thus, in this case, a secure protocol can be constructed with Here,asc ,c 1andc canbechosenarbitrarilysmall, m/n 1/2,where m is the bit number accessible by the ε on the R1HS3 ≃can be ar2bitrarily small. 2 receiv≃er before unveiling. For example, take r = 210 and ǫ = 2 10, which cor- − respond to α 26. Then, it is guaranteed from the ≥ 6. Choice of Parameters Gilbert-Vershamovbound(seeRef.[12])thatthereexists a linear code with q = 4, N = 105, d/N = 10 2, and − Next, we show that ε given in (34) can actually be n′/N 0.95, for which Inequality (37) holds. In this ≥ arbitrarily small by choosing sufficiently large N. Here, case, m/n<0.53 is satisfied. we doa veryroughestimate withoutworryingaboutthe It should be noted, however, that in real life there tightness of the bound. First assume rǫ 1/2 for ǫ are problems with information losses in optical channels 1 1 defined in (33), then ≤ and with the detection rate of photon detectors. Conse- quently,Bobmightenduprejecting Alice’s commitment c2+c c2+c even when an honest Alice has sent the correct commit- p 1 c33 2 1 ≤(1+2rǫ1)(2c1+c2) . ment |ΨAi. Still, we can overcome these problems by modifying and immediately we have steps 3 and 4 of the open phase (Sec.IIIB) as follows. First take an integer parameter t > 0, the exact value Pr[A ρ] 1+4rǫ +4r2ǫ . (35) of which is determined by the noise level of the channel i 2 1 | ≤ Xi andthe detectionrate. Thenchangesteps3and4ofthe open phase as follows: We will prove below that the second and the third term on the RHS of Inequality (35) can be ε/2 respec- 3. Bobverifiesthefollowingconditionforeachparticle tively. As to the second term, it suffic≤es to let α = 1 i N : ≤ ≤ log 2 6ε/r . As to the third term, first note 1 1/l − - If the basis he chooses is correct, i.e., e − (cid:0) (cid:1) | ii ∈ M(s ), he obtains e as a result of his mea- Fα(N)<(D−1)αexp[N ·H2(α/N)] (36) suremi ent. | ii for N α+1 > N/D (see e.g., Ref.[12], Appendix A). Then, he records as y the number of particles that − Using Inequality(36), we see that the third term on the do not satisfy the above condition. RHS of (35) can be bounded from above if 4. If the above condition does not hold for more than α εβα t particles, i.e., if y >t, then Bob rejects the com- N H +dlogβ log . (37) · 2(cid:16)N(cid:17) ≤ (cid:18)8r2(D 1)α(cid:19) mitment. Otherwise he accepts it. − 9 In other words, Bob accepts Alice’s commitment even classicalerror-correctingcode E needs to be ofthe order when up to a certain number of particles does not meet of N 105 in length. Although possible in principle, it ≃ the condition of step 3. In this case too, the security of is not very practical to calculate a generator matrix of the protocol can be shown in almost the same way as in this size using currently available computers. Instead, it the previous section[13]. is much moreworthwhile to optimize the protocolor the security proof so that we can ensure the same level of security for smaller N. VI. CONCLUSION For example, the estimate given in Section IVB6 is not yet tight, since there we were interested mainly in Inthis paper,we haveproposedanew QBSC protocol proving that the protocol is in fact possible. Thus, by and shown that it is secure in terms of the same secu- using a better strategy,we might be able to obtain more rity requirements as discussed in Ref.[3]. Our protocol securityforshorterbitlengthn. Note,inparticular,that hasthemeritthatitcanbeimplementedusingcurrently evenwiththeratiom/noftheaccessiblebitsbeingfixed, available technology such as single-photon sources and there is a variety of choices of parameters, such as q, D, detectors. and l. It will be interesting to see how we can better An example of future work is the optimization of the optimize the protocol,whether by making better choices protocol presented here. As discussed in Section V, if for quantum states 0 ,..., q 1 or by optimizing the | i | − i the protocol is implemented using BB84-like states, the classical error-correctingcode E. [1] C.H. Bennett and G. Brassard, “Quantum Cryptogra- Tools, (Cambridge Univ.Press, Cambridge, 2001). phy: PublicKeyDistributionandCoinTossing,”inPro- [10] C.H. Bennett, G. Brassard, S. Breidbart and S. Wies- ceedings of the IEEE International Conference on Com- ner, “Quantum Cryptography, or Unforgeable Subway puters, SystemsandSignalProcessing(IEEE,NewYork, Tokens,” in Proceedings of CRYPTO ’82, p.267 (1982). 1984) p.175. [11] H. Buhrman, R. Cleve, J. Watrous and R. de Wolf, [2] C.W. Helstrom, Quantum Detection and Estimation “QuantumFingerprinting,”Phys. Rev. Lett.,87,167902 Theory (AcademicPress, New York,1976). (2001). [3] A.Kent,“QuantumBitStringCommitment,”Phys.Rev. [12] W.W. Peterson and E.J. Weldon, Jr., Error Correcting Lett., 90, 237901 (2003). Codes (MIT Press, 1972). [4] A. Kent, “Unconditionally Secure Bit Commitment,” [13] T. Tsurumaru, work in progress. Phys.Rev.Lett., 83, 1447-1450 (1999). [14] A.C. Yao, “Security of Quantum Protocols against Co- [5] H.-K.Loand H.F. Chau “Is QuantumBit Commitment herent Measurements,” in Proceedings of 1995 ACM ReallyPossible?,”Phys.Rev.Lett.,78,3410-3413(1997). Symposium on Theory of Computing 67–75 (1995). [6] D.Mayers, “Unconditionally Secure QuantumBit Com- [15] H.-K. Lo and H.F. Chau, “Why Quantum Bit Commit- mitment is Impossible,” Phys. Rev. Lett., 78, 3414 ment and Ideal Quantum Coin Tossing are Impossible,” (1997). Phisica, D120, pp.177–187 (1998). [7] M.A. Nielsen and I.L. Chuang, Quantum Computa- [16] H.F. Chau and H.-K. Lo, “Making an Empty Promise tion and Quantum Information(CambridgeUniv.Press, withaQuantumComputer,”Fortsch.Phys., 46,pp.507– Cambridge, 2000). 520, (1998). [8] H. Delfs and H. Knebl, Introduction to Cryptography, [17] Onthecontrary,abitcommitment schemethat exploits Principles and Applications (Springer Verlag, Berlin, special relativity has been proposed and the security 2002). proof has been given. See Ref.[4]. [9] O.Goldreich,FoundationsofCryptography, Vol.I,Basic

Implementable Quantum Bit-String Commitment Protocol

Similar Implementable Quantum Bit-String Commitment Protocol