Impossibility of quantum bit commitment

Bit commitment is a protocol between two parties who don't trust each other. Alice wants to commit to a secret bit 0 or 1 without revealing it yet. Bob wants to be sure she can't change it later.

Any bit commitment scheme has to satisfy two properties:

Mechanically it's easy to imagine. Alice writes her bit on a piece of paper, locks it in a box, hands the box to Bob. Bob holds the box but has no key, so he can't open it (concealing). Alice doesn't have the box anymore, so she can't swap the contents (binding). When the time comes, she sends the key and Bob opens it.

But this version of the protocol relies on physical assumptions: a perfect lock, a perfect box, no way to tamper. The goal is to build the same thing out of information, with no physical lockbox required.

Here's a natural-looking quantum protocol. Alice wants to commit to a bit b. She picks a random element from one of two sets:

• To commit to 0, she picks randomly from S₀ = {|0⟩, |1⟩}.
• To commit to 1, she picks randomly from S₁ = {|+⟩, |−⟩}.

She prepares the corresponding qubit and sends it to Bob. Bob stores it and does nothing yet.

At reveal time, Alice tells Bob exactly which state she sent. Bob measures in the corresponding basis and checks the result. If it doesn't match, Alice gets caught.

If Alice committed to 0, she sent either |0⟩ or |1⟩ with equal probability. Bob doesn't know which. From his perspective the qubit is a completely random mix.

If Alice committed to 1, she sent either |+⟩ or |−⟩ with equal probability. Same story: from Bob's perspective, completely random.

And here's the kicker: those two random mixes are identical. Bob's view is literally the same density matrix whether Alice committed to 0 or 1. The concealing property holds perfectly.

Alice already sent the qubit to Bob. She can't touch it anymore. So she can't change what she committed to, right?

It looks like the binding property holds. But one of the two properties is wrong.

Alice doesn't have to prepare an honest single qubit at all. Instead, she prepares two qubits, W and X, in an entangled state. She sends X to Bob and keeps W herself.

From Bob's perspective, X looks exactly the same as before. He can't tell the difference between Alice being honest and Alice using entanglement. The concealing property still holds.

But Alice hasn't actually committed to anything yet. She's kept a quantum handle on Bob's qubit through her half of the entangled pair.

The binding property has completely failed. Alice was never locked in to either bit. The protocol looked secure because Bob couldn't see what state was sent. The cheat is that the state was never decided.

This isn't a flaw in one clever protocol. It's a consequence of how quantum mechanics works, proven independently by Dominic Mayers and by Hoi-Kwong Lo & Hoi-Fung Chau in 1996/1997. The argument is short.

For a quantum protocol to be perfectly concealing, Bob's view must be identical whether Alice committed 0 or 1. In the language of density matrices: ρ_B(0) = ρ_B(1) on Bob's side.

There's a theorem in quantum information (Hughston-Jozsa- Wootters) that says: if two purifications of the same density matrix exist, there is always a transformation Alice can do on her own qubits alone that swaps one for the other.

That transformation is Alice's cheat. She can always switch her commitment from 0 to 1 (or vice versa) without Bob knowing. The condition that makes the protocol concealing is the same condition that guarantees Alice can cheat.

BB84 worked because quantum mechanics makes eavesdropping detectable. That's a real quantum advantage.

Bit commitment fails because quantum mechanics makes commitment unenforceable. That's a real quantum limitation.

The interesting thing: both sides come from the same physics. Entanglement is what lets BB84 and E91 detect eavesdroppers. It's also what lets Alice cheat in bit commitment. Quantum mechanics isn't magic. It has specific things it can do and specific things it provably cannot.