Practical Quantum Bit Commitment Protocol Based on Quantum Oblivious Transfer

Abstract

Oblivious transfer (OT) and bit commitment (BC) are two-party cryptographic protocols which play crucial roles in the construction of various cryptographic protocols. We propose three practical quantum cryptographic protocols in this paper. We first construct a practical quantum random oblivious transfer (R-OT) protocol based on the fact that non-orthogonal states cannot be reliably distinguished. Then, we construct a fault-tolerant one-out-of-two oblivious transfer ($O{T}_1^2$) protocol based on the quantum R-OT protocol. Afterwards, we propose a quantum bit commitment (QBC) protocol which executes the fault-tolerant $O{T}_1^2$ several times. Mayers, Lo and Chau (MLC) no-go theorem proves that QBC protocol cannot be unconditionally secure. However, we find that computing the unitary transformation of no-go theorem attack needs so many resources that it is not realistically implementable. We give a definition of physical security for QBC protocols and prove that the practical QBC we proposed is physically secure and can be implemented in the real world.

1. Introduction

Quantum oblivious transfer (QOT) and quantum bit commitment (QBC) protocols are basic in quantum cryptography. They are important building blocks of multi-party secure computations. The study of QOT was started by Crépeau and Kilian [1]. In 1992, a practical QOT protocol was proposed [2]. However, in these two protocols, if Bob measures the pulses after Alice disclosing the basis, he will get both messages and Alice’s privacy will be destroyed. In the light of this drawback, Crépeau proposed a QOT protocol [3] based on a QBC scheme [4] to ensure that Bob cannot delay his measurement. Then, Yao proved that QOT constructed based on QBC [5] is secure. Shortly afterwards, Mayers, Lo and Chau separately presented no-go theorem and proved that there is no non-interactive QBC protocol with statistical security [6,7,8,9]. Subsequently, a great number of works that extend the framework of no-go theorem and further prove the impossibility of the standard QBC has been presented since Then, [10,11,12,13,14,15,16]. These results indicate that QOT protocols constructed based on QBC are not secure either. Then, quantum secure computations are also considered to be insecure [17,18,19,20].

Researchers Then, attempt to construct QBC protocols that can evade the no-go theorem. The most famous ones are relativistic QBC protocols, which were first proposed by Kent [21,22,23,24]. The protocol in Ref. [23] was implemented by different groups [25,26]. The time during commit phase and opening phase is limited by the distance between the trusted agents, which may be a restriction for building other multi-party cryptographic protocols. In addition, some QBC with computational security were proposed. Unconditionally binding and computationally concealing QBC schemes were presented by Tanaka [27] and Chailloux [28], respectively, and in 2016, another computationally binding commitment scheme was proposed and it can be realized from hash functions like SHA-3 [29]. The security of these QBC protocols depends on the limited computing power of the adversary. Once the computing power is improved in the future, the security of these protocols are threatened. Several QBC protocols were proposed based on physical hypothesis, such as bounded-quantum-storage model [30,31], noisy-storage model [32,33,34] and technological limitations on non-demolition measurements [35], the security of these protocols is threatened by the development of techniques. Some QBC schemes with security requirements relaxed were put forward, such as cheat-sensitive QBC [36,37,38,39] and game theoretic secure QBC [40]. There are also some non-relativistic QBC schemes which are claimed to be unconditionally secure [41,42,43,44,45,46]. However, most of them only exist theoretically. For example, in Ref. [43] Bob stores the quantum registers unmeasured until opening phase, which can be hardly implemented in practice.

In this paper, we do not devote to evading the no-go theorem. We give the definition of physical security. As long as the physical security is satisfied, even the attacker who ownes all the resources of the earth cannot break the protocol. The physical security was first proposed in Ref. [47]. The time complexity of no-go theorem attack algorithm is $O(2^{3n})$, where n is the security parameter of the QBC. In addition this algorithm needs at least $O(2^{2n})$ size of memory space to store the matrix of the unitary transformation. We define that if the entry number of the attack matrix is greater than the total number of protons on the earth (approximately ${10}^{50}$), QBC achieves physical-secure binding. It means when $n>83$, no-go theorem attack can hardly be realized in practice. Compared with those QBC schemes based on physical hypothesis, the definition of physical security limits the attacker with all the resources of the earth. QBC protocols that achieve physical security are more secure than other protocols based on physical hypothesis. In this paper, we focus on how to construct practical quantum protocols with physical security.

In [48], Yang constructed QBC based on QOT. We modify the protocols so that it can be applied in practice and achieve physical security. The imperfect sources, quantum channel and detectors are all allowed in the modified protocols. Considering error-correcting code and tolerable error rate, we describe the protocols in detail and analyze the security and problems we may face in practice.

The practical QBC protocol proposed in this paper has advantages over many existing protocols. Compared with the relativistic QBC protocols, the time between commit phase and opening phase is not limited in our scheme. Compared with the computationally secure protocols and QBC based on physical hypothesis, the physical security of our scheme will not be threatened by the growing computing power and techniques. Compared with those theoretical protocols, our schemes allow the imperfect equipment and can be implemented in the real world. The QBC protocols in Refs. [47,48] are also theoretical. The security analysis of these theoretical protocols is based on the ideal world rather than the real world. Therefore, these theoretical protocols which are not fault-tolerant cannot achieve the security they declared and cannot be realized in the real world. Our practical quantum cryptographic protocols, which are allowing the imperfection of current optoelectronic apparatus, provide appropriate security parameters and security analysis in the practical conditions. In sum, the practical QBC protocol achieves physical security and can be possible realized. Since the selection of security parameters and security analysis are based on available optoelectronic apparatus, the implement and security of the protocols are more practical and reliable.

2. The Efficiency and Errors of Practical Apparatuses

In practical protocols, all apparatuses should be realizable and convenient. All the apparatuses in the protocols are divided into three types: emission apparatuses, channel and detection apparatuses. In a practical protocol, the following situations should be considered.

• Emission apparatuses. The practical and efficient single-photon sources have not yet been realized, while some researchers have been studying the spectra [49] and efficiency [50] of the single-photon sources. In this paper, the single-photon sources are not adopted. Instead, we use weak coherent pulses with typical average photon number of ${\mu }_S$ in the following protocols, which can be easily prepared by standard semiconductor lasers and calibrated attenuators [51]. The error rate caused by the emission apparatuses is denoted as ${\epsilon }_S$. A pulse is requested to contain only one kind of polarization, but more than one photon in a pulse are allowed.
• Channel loss and error. The existence of the channel loss leads to an imperfect transfer efficiency, and the noise in the channel leads to some channel error. Suppose the transfer efficiency of the channel is ${\eta }_C$, the error rate caused by the channel is ${\epsilon }_C$. Refs. [52,53] provided the physical setups and detailed properties of some kinds of quantum channels.
• Detection apparatuses. In practice there is no detector with perfect detection efficiency. The quantum efficiency ${\eta }_D$ is the probability that the detector registers a count when one photon comes in, and the error rate caused by the detection apparatuses is ${\epsilon }_D$, where the main error source is the dark count d. The single-photon detectors with high efficiency, like 80–93% have been realized in the laboratory [54,55].

Assume all the parameters described above are all known by both parities of the protocol, and the typical average photon number of the whole system is $\mu \equiv {\mu }_S{\eta }_C{\eta }_D$. Then, the overall error rate is $\epsilon \equiv 1-(1-{\epsilon }_S)(1-{\epsilon }_C)(1-{\epsilon }_D)$.

3. Practical Weak QOT and QBC

Definition 1.

Random Oblivious Transfer (R-OT) Channel.

Alice sends a random bit r to Bob via a channel, if

1. 

Bob obtains the bit value r with a probability p satisfying $0<b<p<a$, $a<\frac{1}{2}$, where a and b are any two real numbers;

2. 

Alice does not know whether Bob has got the value of her bit.

Then, the channel is named as R-OT channel (an extended Rabin’s OT channel).

To construct a quantum string R-OT protocol, non-orthogonal states are used. There is no measuring apparatus that can distinguish non-orthogonal states with certainty. Only some probabilistic information can be obtained. Let Bob measure a sequence of photons in two quantum states $|{\mathsf{\Psi }}_0\rangle$, $|{\mathsf{\Psi }}_1\rangle$, where $\langle {\mathsf{\Psi }}_0|{\mathsf{\Psi }}_1\rangle =cos\phi$. Here we choose $\phi =\frac{\pi }{6}$. The quantity of the information Bob obtains depends on the measurement he performs. The optimal measurement can differentiate the two non-orthogonal states with a probability of $1-cos\phi$ [56,57,58], which is a kind of POVM measurement. Actually, the complicated measurement is not necessary. Even if we construct the protocol with the sub-optimal measurement, the security of the protocols can still be ensured, which will be analyzed in detail in Section 4. Through all of the measurements, we choose the most practical and easiest one. That is, Bob measures photons in two bases, $B_0=\{|{\mathsf{\Psi }}_0\rangle ,|{\mathsf{\Psi }}_0{\rangle }^{\perp }\}$ and $B_1=\{|{\mathsf{\Psi }}_1\rangle ,|{\mathsf{\Psi }}_1{\rangle }^{\perp }\}$ randomly. When the states is $|{\mathsf{\Psi }}_0\rangle$, the measurement results may be $|{\mathsf{\Psi }}_0\rangle$, $|{\mathsf{\Psi }}_1\rangle$ or $|{\mathsf{\Psi }}_1{\rangle }^{\perp }$. When the states is $|{\mathsf{\Psi }}_1\rangle$, the measurement results may be $|{\mathsf{\Psi }}_1\rangle$, $|{\mathsf{\Psi }}_0\rangle$ or $|{\mathsf{\Psi }}_0{\rangle }^{\perp }$. It can be seen that if Bob’s measurement results in $|{\mathsf{\Psi }}_x\rangle$, he cannot distinguish which state is sent by Alice. If his measurement results in $|{\mathsf{\Psi }}_x{\rangle }^{\perp }$, which is orthogonal to $|{\mathsf{\Psi }}_x\rangle$, the initial state cannot be $|{\mathsf{\Psi }}_x\rangle$ and therefore is $|{\mathsf{\Psi }}_{x\oplus 1}\rangle$. In this sub-optimal measurement, although Bob cannot distinguish the non-orthogonal states with 100%, he unambiguously knows that the receiving state must be $|{\mathsf{\Psi }}_{x\oplus 1}\rangle$ when his measurement results in $|{\mathsf{\Psi }}_x{\rangle }^{\perp }$. Ideally, the probability of getting a conclusive result is

$$\begin{array}{c}\hfill p_{ideal}=\frac{1}{2}\times \frac{1}{2}({\langle {\mathsf{\Psi }}_{x\oplus 1}|{\mathsf{\Psi }}_x\rangle }^{\perp }\langle {\mathsf{\Psi }}_x|{\mathsf{\Psi }}_{x\oplus 1}\rangle +{\langle {\mathsf{\Psi }}_x|{\mathsf{\Psi }}_{x\oplus 1}\rangle }^{\perp }\langle {\mathsf{\Psi }}_{x\oplus 1}|{\mathsf{\Psi }}_x\rangle )=\frac{1}{8}.\end{array}$$

(1)

Protocol 1.

Practical weak quantum R-OT protocol.

1. 

Alice and Bob agree on three security parameters, N, α, and ${\epsilon }_{set}$. The parameter N is the length of the qubit string sent by Alice. The parameter α is the expected fraction of Bob’s successful detection. The parameter ${\epsilon }_{set}$ is the expected error rate.

The number of photons in a weak coherent pulse with typical average photon number of ${\mu }_S$ follows Poisson distribution $p_n({\mu }_S)=\frac{e^{-{\mu }_S}{\mu }_S^n}{n!}$. It can be seen that the probability of no photon in a pulse is $p_0({\mu }_S)=e^{-{\mu }_S}$. Then, the probability of detecting at least one photons in a pulse with typical average photon number ${\mu }_S$ through a channel with transfer efficiency ${\eta }_C$ by a detector with quantum efficiency ${\eta }_D$ is $1-e^{-\mu }$.

They can set the fraction $\alpha \simeq 1-e^{-\mu }$ which is the probability that Alice expects Bob to detect successfully and set error rate ${\epsilon }_{set}\simeq \epsilon$ or a little bit higher to allow other noise. The parameters satisfy the equation $H(2{\epsilon }_{set})<\frac{1}{2}-(1-e^{-{\mu }_S}-{\mu }_S{e}^{-{\mu }_S})/2\alpha$ to resist photon number splitting attack [2].

2. 

Alice and Bob perform two tests.

Firstly, compare Alice’s sending time $t_i$ with Bob’s receiving time $t_i^{\prime }$ for each pulse. Since the distance between Alice and Bob is fixed, by the test they can easily get the traveling time θ, i.e., $\theta =t_i^{\prime }-t_i$. This test not only marks the address of each pulse, but also helps to distinguish the error caused by noises and dark counts.

Secondly, Alice sends a sequence of pulses through the quantum channel and tells Bob the bases of the pulses through a classical channel. Bob detects pulses in the other bases. If and only if Bob detects the pulses successfully with a probability greater than α and an error rate less than ${\epsilon }_{set}$, he agrees to continue the protocol. Otherwise, they take counsel together to adjust the parameter α or ${\epsilon }_{set}$.

3. 

Alice generates a random bit string $(r_1,\dots ,r_N)\in {\{0,1\}}^N$, and sends qubit string $|{\mathsf{\Psi }}_{r_1}\rangle ,\dots ,|{\mathsf{\Psi }}_{r_N}\rangle$ to Bob. She also tells Bob the sending time $t_i$ of each pulse through the classical channel.

4. 

Bob records the receiving time $t_i^{\prime }$ of each pulse and compares with the sending time. If and only if $t_i^{\prime }=t_i+\theta$, he admits $|{\mathsf{\Psi }}_{r_i}\rangle$ as a receiving pulse. He chooses $B_0$ or $B_1$ randomly to measure each receiving pulse. For these receiving pulses, when his measurement results in state $|{\mathsf{\Psi }}_x{\rangle }^{\perp }$, he accepts the pulse as a conclusive pulse and takes the bit value of this pulse as $x\oplus 1$.

5. 

The parameters are agreed by Alice and Bob. After Step 1–4, if the number of the effective pulses detected by Bob is not approximately equal to $\alpha N$, Bob has the right to abort the protocol. This step is a verification for the malicious Alice.

We regard Protocol 1 as a weak R-OT because it is similar to standard R-OT. But it is weaker in security when dishonest Alice sends different states, which will be explained in Section 4.2. Then, we construct a weak quantum $O{T}_1^2$ protocol based on R-OT protocol, the equivalence of R-OT and $O{T}_1^2$ has been proved in [59].

Protocol 2.

Practical weak quantum $O{T}_1^2$ protocol.

1. 

Alice and Bob execute Protocol 1 and an error correcting scheme. Denote Bob’s probability of getting a conclusive bit as $p_{con}(\mu )$. After Protocol 1, if the number of Bob’s conclusive bits is not approximately equal to $N{p}_{con}(\mu )$, he regards Alice as a malicious party and aborts the protocol. If Bob agrees to continue, they decide on a security parameter k according to an error correcting scheme and the probability $p_{con}(\mu )$. The values of k are analyzed in Section 4 and listed in

Table 1. When $p=20\%$, $N=800$, $p_2$ is controlled to be a magnitude of ${10}^{-6}$, the values of parameters with different $\mu$.

$\mathbf{\mu }$	${\mathit{p}}_{\mathit{con}}(\mathbf{\mu })$	${\mathit{p}}_{\mathit{con}}^{\prime }(\mathbf{\mu })$	${\mathit{l}}_{\mathit{obt}}$	k	${\mathbf{\epsilon }}_2$	${\mathit{p}}_{1\mathit{t}}$	${\mathit{p}}_1$	${\mathit{p}}_2$
2	$0.197$	$0.285$	143	131	$0.0944$	$0.117$	$0.107$	$3.25\times {10}^{-6}$
3	$0.264$	$0.395$	190	172	$0.122$	$0.0887$	$0.0484$	$1.85\times {10}^{-6}$
4	$0.316$	$0.488$	228	210	$0.147$	$0.0621$	$0.0312$	$1.53\times {10}^{-6}$
5	$0.357$	$0.567$	260	236	$0.164$	$0.0435$	$0.0324$	$7.45\times {10}^{-7}$
6	$0.388$	$0.634$	283	259	$0.178$	$0.0267$	$0.0236$	$4.73\times {10}^{-6}$

.

2. 

The error correcting scheme is applied to $\alpha N$ bits words with expected error rate ${\epsilon }_{set}$, which is non-uniqueness. The following is only an example of this kind of scheme, which is based on $(63,57,3)$ Hamming code.

There are k bits in sets I and J after the process of error correction, respectively. Let $l_{obt}$ denotes the number of the bits in I or J before error correction. Alice divides two sequences of $l_{obt}$ bits into 63-bit blocks and performs the wire link permutation W on it. When $l_{obt}=63⌈\frac{l_{obt}}{63}⌉-\Delta ,\Delta$ bits of the block in front should be added to the last block. Then, calculate the syndromes $s_{A_i}$ and discard the check bits of each block. Repeat above operations four times and send these syndromes to Bob. Bob divides his $l_{obt}$ bits into 63-bit blocks and performs the wire link permutation W on it. When $l_{obt}=63⌈\frac{l_{obt}}{63}⌉-\Delta ,\Delta$ bits of the block in front should be added to the last block. For each round, he calculates the syndromes $s_{B_i}$ and $s_i=s_{A_i}\oplus s_{B_i}$. Correct the error in each block and discard all check bits. After error correction, assume the error rate reduces to ${\epsilon }_1^{\prime }$.

3. 

Bob discards all check bits and selects from the remaining bits to obtain two sets I and J, where $I=\{i_1,\dots ,i_k\}$ and $J=\{j_1,\dots ,j_k\}$ with $I\cap J=\varnothing$. The k bits $r_{i_1},\dots ,r_{i_k}$ are chosen from the conclusive bits. In case the conclusive bits in Bob’s hand are a little less than k, he adds some random bits.

4. 

Bob chooses a random bit m. If $m=0$, he sends $\{X,Y\}=\{I,J\}$ to Alice. Otherwise, he sends $\{X,Y\}=\{J,I\}$.

5. 

After receiving $(X,Y)$, Alice encrypts her messages $b_0$ and $b_1$ with $r_i$,

$$\left\{\begin{array}{c}\hfill c_0=b_0{\oplus }_{i\in X}{r}_i,\\ \hfill c_1=b_1{\oplus }_{i\in Y}{r}_i.\end{array}\right.$$

Then, Alice sends $c_0$, $c_1$ to Bob.

6. 

Bob calculates ${\oplus }_{i\in I}{r}_i$ and decrypts $c_m$ to obtain $b_m$.

According to the error correcting scheme, the relation between the parameters k and $l_{obt}$ is

$$k=57⌈\frac{l_{obt}}{63}⌉-\Delta =l_{obt}-6⌈\frac{l_{obt}}{63}⌉.$$

(2)

Suppose the error rate of each bit in Protocol 1 is ${\epsilon }_1=0.3\%$, which is a general value in practice. After error correction, the error rate can be reduced to ${\epsilon }_1^{\prime }=0.0757\%$ [60]. As long as there is one bit error in key used in the decryption algorithm, Bob cannot obtain $b_m$ in Protocol 2. The error rate of Protocol 2 is ${\epsilon }_2$. The relation of ${\epsilon }_2$ and ${\epsilon }_1^{\prime }$ is

$${\epsilon }_2=1-{(1-{\epsilon }_1^{\prime })}^k.$$

(3)

When ${\epsilon }_1^{\prime }=0.0757\%$, the values of ${\epsilon }_2$ changing with the parameter k are shown in Figure 1.

Protocol 2 is different from standard QOT since Alice may not transfer a correct message to Bob. If we set the upper bound of the error rate as $20\%$, the parameter k should be less than 295 according to Equation (3).

Then, we can construct a quantum bit commitment protocol by executing the quantum $O{T}_1^2$ protocol l times as follows.

Protocol 3.

Practical quantum bit commitment protocol.

Commit phase:

1. 

Alice randomly divides her commit value as $b=b_0^{(i)}\oplus b_1^{(i)}$, $i=1,\dots ,l$.

2. 

Bob generates local random numbers $\{m_i=0,1|i=1,\dots ,l\}$.

3. 

Alice executes Protocol 2 with Bob l times, and Bob can obtain the values $\{b_{m_i}^{(i)}|i=1,\dots ,l\}$.

Opening phase:

1. 

Alice opens $\{b_0^{(i)},b_1^{(i)};r_{i_1}^{(i)},\dots ,r_{i_k}^{(i)};r_{j_1}^{(i)},\dots ,r_{j_k}^{(i)}|i=1,\dots l\}$.

2. 

Bob verifies whether $\{b_0^{(i)},b_1^{(i)};r_{i_1}^{(i)},\dots ,r_{i_k}^{(i)};r_{j_1}^{(i)},\dots ,r_{j_k}^{(i)}|i=1,\dots l\}$ are consistent with his $\{b_{m_i}^{(i)};r_{i_1}^{(i)},\dots ,r_{i_k}^{(i)}|i=1,\dots l\}$ and those conclusive bits in J. If the consistency holds more than 80% of l rounds, he admits Alice’s commitment value as b. Otherwise, he regards Alice as a malicious party and aborts the protocol.

In practice, the physical system and the coded bit string in $OT$ protocols unavoidably have some errors. In Section 3, assume ${\epsilon }_1=0.3\%$, $k\le 295$, the error rate of $O{T}_1^2$ can be less than $20\%$. But it does not impact the construction of a BC protocol.

4. The Security of QOT

A standard $O{T}_1^2$ scheme satisfies the following requirements.

• Correctness If both parities are honest and follow the protocols, Bob obtains one of the message $b_m$ sent by Alice correctly.
• Privacy for Alice If Alice is honest, Bob cannot obtain both of the messages sent by Alice.
• Privacy for Bob If Bob is honest, Alice cannot distinguish which message Bob obtains.

The aim of our QOT is to construct a practical QBC. Therefore, the correctness of the QOT protocols is not necessary. To detect a cheating Alice, suppose the probability that an honest Bob cannot get a correct message is less than $20\%$. Execute Protocol 2 l times to construct QBC scheme. If and only if there are less than $0.2l$ rounds where Alice does not disclose the consistent results, Bob admits Alice’s commitment.

For the security of $O{T}_1^2$ protocol, He [61] has proved that the $O{T}_1^2$ protocol implemented upon all-or-nothing OT is not covered by the cheating strategy in Ref. [17]. Therefore, the following security analysis of $O{T}_1^2$ does not contain the attack of entangled states.

4.1. Privacy for Alice

The operations executed by Bob in Protocol 2 include measuring the states sent by Alice, selecting the elements in Set I and J. Then, sending $X,Y$ to Alice, decrypting the ciphertext $c_0$ or $c_1$. It can be seen that only in the measurement, he can cheat and take a more superior measurement to obtain more conclusive results, which may lead him to get both $b_0$ and $b_1$. We analyze the probabilities of getting a conclusive bit for the honest Bob and the malicious Bob in order to determine the security parameters in the practical protocols.

4.1.1. Analysis on the Probability of Getting a Conclusive Bit for Honest Bob

Let $|n_0\rangle$ and $|n_{\frac{\pi }{6}}\rangle$ denote n-photon states of polarization 0 and $\frac{\pi }{6}$, respectively. For an honest Bob, if he chooses the measurement basis $B_1$ to detect $|1_0\rangle$, the probability of the state collapsing to $|1_{\frac{2\pi }{3}}\rangle$ is $\frac{1}{4}$. For $|n_0\rangle$, the probability of at least one of the photons collapse to the state with polarization of $\frac{2\pi }{3}$ is $1-{\left(\frac{3}{4}\right)}^n$. Therefore, the probability of getting a conclusive resulting in a pulse which contains n photons is

$$p(n)=\frac{1}{2}\times \left[1-{\left(\frac{3}{4}\right)}^n\right].$$

(4)

The probability of getting a conclusive bit in a pulse with the typical average photon number $\mu$ is

$$\begin{array}{cc}\hfill p_{con}(\mu )& =\sum _{n=1}[p_n(\mu )\times p(n)]\hfill \\ & =\sum _{n=1}\left\{\frac{1}{2}\left[1-{\left(\frac{3}{4}\right)}^n\right]\frac{e^{-\mu }{\mu }^n}{n!}\right\}\hfill \\ & =\frac{1}{2}\left[\sum _{n=1}\frac{e^{-\mu }{\mu }^n}{n!}-e^{-\frac{\mu }{4}}\sum _{n=1}\frac{e^{-\frac{3\mu }{4}}{\left(\frac{3\mu }{4}\right)}^n}{n!}\right]\hfill \\ & =\frac{1}{2}\left(1-e^{-\frac{\mu }{4}}\right).\hfill \end{array}$$

(5)

It can be seen that an honest Bob is supposed to obtain $N{p}_{con}(\mu )$ conclusive bits. The probability of getting a conclusive bit in one pulse with different $\mu$ can be seen in Figure 2. The larger ${\mu }_S$ of emission apparatus and more efficient detector they use, the higher efficiency the protocol has.

4.1.2. Analysis on the Probability of Getting a Conclusive Bit for Malicious Bob

Assume that the malicious Bob has the ability of separating n photons by photon number splitting attack. For a single photon, the successful probability of optimal measurement to distinguish the two non-orthogonal states is $1-cos\phi$, which has been proved in Refs. [56,57,58]. For n photons, a malicious Bob’s probability of distinguishing the non-orthogonal sates is

$$p^{\prime }(n)=1-co{s}^n\phi .$$

(6)

Then, a malicious Bob using photon number splitting attack and optimal measurement for single-photon can get a conclusive bit with the probability of

$$p_{con}^{\prime }(\mu )=\sum _{n=1}{p}_n(\mu )\times p^{\prime }(n)=1-e^{-\mu (1-\frac{\sqrt{3}}{2})}.$$

(7)

Here we consider that the malicious Bob has an ideal detector, the quantum efficient ${\eta }_D^{\prime }$ of which is $100\%$. Thus, ${\mu }^{\prime }={\mu }_S{\eta }_C=\frac{\mu }{{\eta }_D}$. Assume that the protocols are executed over atmospheric channel, the quantum efficiency ${\eta }_D$ of an honest Bob’s detector is $80\%$ and this kind of detector has already been realized in the laboratory [54,55]. The cheating Bob’s probability of getting a conclusive bit is

$$p_{con}^{″}(\mu )=1-e^{-\frac{5\mu }{4}(1-\frac{\sqrt{3}}{2})},$$

(8)

which can be seen in Figure 3. A malicious Bob can get about $[1-e^{-\frac{5\mu }{4}(1-\frac{\sqrt{3}}{2})}]N$ conclusive bits.

4.1.3. Contrastive Analysis and Determination of the Parameters in Practical Protocols

If a malicious Bob wants to obtain both $b_0$ and $b_1$ in Protocol 2, he must get at least $2k$ conclusive bits in Protocol 1. The difference between an honest Bob’s probability of obtaining a conclusive bit and half of a malicious Bob’s probability of obtaining a conclusive bit is $p_{diff}(\mu )=p_{con}(\mu )-\frac{1}{2}{p}_{con}^{″}(\mu )$, which can be seen in Figure 4.

When $\mu =4.85$, the difference $p_{diff}(\mu )$ takes a maximum value $0.0732$. The probability of obtaining i conclusive bits is $p_{obt}$, which is referred to the binomial distribution and shown in Figure 5.

Suppose the probability of the case where the number of conclusive bits obtained by an honest Bob is no more than $l_{obt}$ is $p_1$, and the probability of the case where the number of conclusive bits obtained by a malicious Bob is no less than $2l_{obt}$ is $p_2$. Then,

$$\begin{array}{c}\hfill p_1=\sum _{i=0}^{l_{obt}}{C}_N^i{[p_{con}(\mu )]}^i{[1-p_{con}(\mu )]}^{N-i}\end{array}$$

(9)

$$\begin{array}{c}\hfill p_2=\sum _{i=2l_{obt}}^N{C}_N^i{[p_{con}^{\prime }(\mu )]}^i{[1-p_{con}^{\prime }(\mu )]}^{N-i}\end{array}$$

(10)

To ensure that the honest Bob obtains one correct message in Protocol 2 and the malicious Bob cannot obtain both $b_0$ and $b_1$, $p_1$ and $p_2$ should be small enough.

The probability that an honest Bob cannot execute Protocol 2 successfully is p,

$$p=1-(1-{\epsilon }_2)(1-p_1).$$

(11)

To detect a cheating Alice, p should be less than $20\%$. Given an error rate ${\epsilon }_2$, $p_1$ has an upper bound $p_{1t}$ to ensure $p\le 20\%$. To ensure the concealing of the BC protocol, $p_2$ is set up with a magnitude of ${10}^{-6}$.

When $\mu$ is too low, the difference between the probability of obtaining a conclusive bit by an honest and a malicious Bob is not large enough to select the proper parameters. When $\mu$ is too large, the proper k is large, which will lead to a large ${\epsilon }_2$. Then, there is no proper parameters either. It can be seen from Table 1 that when $2\le \mu \le 6$, we can always find the proper parameters to execute the protocols successfully.

4.2. Privacy for Bob

The attack for Alice is to send different states which can bias the measurements that will be conclusive for Bob. Then, she may have a larger probability to guess Bob’s choice m. In our protocol, if and only if Bob’s measurement results in state $|{\mathsf{\Psi }}_0{\rangle }^{\perp }$ and $|{\mathsf{\Psi }}_1{\rangle }^{\perp }$, he admits it a conclusive bit. We analyze the case where Alice sends all the states dishonestly and the case where Alice sends only one state dishonestly in R-OT protocol.

4.2.1. The Attack that Alice Sends Only One State Dishonestly in R-OT Protocol

In Step (3) of Protocol 1, an honest Alice is supposed to send the state $|{\mathsf{\Psi }}_0\rangle$ or $|{\mathsf{\Psi }}_1\rangle$ only. However, a malicious Alice may replace one of the pulse ($|{\mathsf{\Psi }}_{r_c}\rangle$) with $|{\mathsf{\Psi }}_0{\rangle }^{\perp }$ instead. This attack makes Bob more likely to accept this pulse as a conclusive results and Alice has a higher probability to distinguish which set is Set I. Then, we analyze whether this attack is effective both in R-OT and $O{T}_1^2$ protocols.

In Protocol 1, when Alice replaces one of the pulses ($|{\mathsf{\Psi }}_{r_c}\rangle$) with $|{\mathsf{\Psi }}_0{\rangle }^{\perp }$, the number of the photons in the pulse follows Poisson distribution. Let $|n_{\frac{\pi }{2}}\rangle$ denotes an n-photon state with the polarization $\frac{\pi }{2}$. For an honest Bob, he chooses the measurement basis $B_1$ with the probability of $1/2$. When he measures $|1_{\frac{\pi }{2}}\rangle$ with $B_1$, the probability that the state collapse to $|1_{\frac{2\pi }{3}}\rangle$ is $\langle \frac{\pi }{2}|\frac{2\pi }{3}\rangle \langle \frac{2\pi }{3}|\frac{\pi }{2}\rangle =3/4$. When he measures $|n_{\frac{\pi }{2}}\rangle$ with $B_1$, the probability that at least one of the photons of $|n_{\frac{\pi }{2}}\rangle$ collapse to the state with polarization of $\frac{2\pi }{3}$ is $1-{(\frac{1}{4})}^n$. According to Equation (5), the probability of choosing the basis $B_1$ and getting a conclusive bit in a pulse is

$$p_{B_{1}con}(\mu )=\sum _{n=1}\left\{\frac{1}{2}\left[1-{\left(\frac{1}{4}\right)}^n\right]\frac{e^{-\mu }{\mu }^n}{n!}\right\}=\frac{1}{2}\left(1-e^{-\frac{3\mu }{4}}\right).$$

(12)

When Bob chooses the measurement basis $B_0$ to detect the fake pulse, if there is only one photon in the pulse, the probability that he accepts it as conclusive pulse is $100\%$. The probability of choosing the basis $B_0$ and getting a conclusive bit in a pulse is

$$p_{B_{0}con}(\mu )=\frac{1}{2}(1-e^{-\mu }).$$

(13)

Therefore, when Alice replaces one of the pulses with $|{\mathsf{\Psi }}_0{\rangle }^{\perp }$, the average probability of Bob getting a conclusive result is

$$p_{(i)}=p_{B_{0}con}(\mu )+p_{B_{1}con}(\mu )=1-\frac{1}{2}{e}^{-\mu }-\frac{1}{2}{e}^{-\frac{3\mu }{4}}.$$

(14)

Consequently, Bob accepts the fake pulse as a conclusive result with a larger probability of $p_{(i)}$ than the situation where Alice is honest. In the following, we will analyze that although the cheating Alice has a larger probability to know Bob’s choice m, she still has no idea what is got by Bob. In standard $O{T}_1^2$, if Alice has a probability larger than the legal threshold of knowing Bob’s choice, she breaks Bob’s privacy. In this paper, Protocol 2 is the block of constructing QBC. The security that requests Alice cannot know what is obtained by Bob is enough. It can be seen that the security is weaker than the standard $O{T}_1^2$. Therefore, we call it weak quantum $O{T}_1^2$, and Alice attacking the weak $O{T}_1^2$ successfully means that she knows the content of the message obtained by Bob.

Protocol 2 is a fault-tolerant quantum $O{T}_1^2$ scheme with $p\le 20\%$. When Bob does not get the correct message with a probability of p, whether Alice attacks successfully cannot be defined. Then, consider Alice’s attack in the condition that Bob gets the correct message. When Alice replaces one of the pulses ($|{\mathsf{\Psi }}_{r_c}\rangle$) with $|{\mathsf{\Psi }}_0{\rangle }^{\perp }$ instead, the index of the fake pulse may be in Set I, J, or neither in I nor J. If Alice does not see the index c in Set X or Y, she randomly guesses which message Bob obtains. Suppose the probability that she guesses the correct m is $\frac{1}{2}p[c\notin I\wedge c\notin J]$. If Alice finds the index c in Set X or Y, she believes the set which contains c is Set I. In other words, when the index of the fake pulse in Set I, Alice knows Bob’s choice with a large probability; when the index of the fake pulse in Set J, she has no choice to break the protocol. Then, Alice needs the following conditions to know the content of the message obtained by Bob.

(i)

Bob accepts the fake pulse as a conclusive result.

(ii)

Bob picks the index of the fake pulse into Set I.

(iii)

Bob’s measuring result of $|{\mathsf{\Psi }}_0{\rangle }^{\perp }$ is consistent with Alice’s conjecture of $r_c$.

Item (iii) ensures that Bob can obtain a correct message. Suppose the probability of the above three conditions being satisfied is $p(3con)$. The probability that Alice knows the content of the message obtained by Bob is

$$\begin{array}{c}\hfill p(OT)=p(3con)+\frac{1}{2}p(c\notin I\wedge c\notin J).\end{array}$$

(15)

The probability of Item (i) being satisfied is $p_{(i)}$. In the practical protocol, an honest Bob is supposed to obtain $N{p}_{con}(\mu )$ conclusive bits, where $p_{con}(\mu )=(1-e^{-\frac{\mu }{4}})/2$ according to Equation (5). He picks k bits from the conclusive results to form Set I. Assume the number of conclusive result is still $N{p}_{con}(\mu )$. The probability that Bob accepts the fake pulse as the conclusive pulse and picks it in Set I is

$$p(c\in I)=p_{(i)}·\frac{C_{N{p}_{con}(\mu )-1}^{k-1}}{C_{N{p}_{con}(\mu )}^k}=\frac{k(2-e^{-\mu }-e^{-\frac{3\mu }{4}})}{N(1-e^{-\frac{\mu }{4}})}.$$

(16)

Suppose the probability that Bob measures in basis $B_0$ and gets a conclusive bit $r_c=1$ is $p_{B_{0}con}(\mu )$, the probability that Bob measures in basis $B_1$ and gets a conclusive bit $r_c=0$ is $p_{B_{1}con}(\mu )$. It can be seen that $p_{B_{0}con}(\mu )>p_{B_{1}con}(\mu )$. Alice knows that Bob is more likely to obtain $r_c=1$. In the case that $c\in I$, the conditional probability that Bob accepts $r_c=1$ is

$$\begin{array}{cc}\hfill p\left(r_c=1|c\in I\right)& =\frac{p\left(r_c=1|c\in I\right)}{p\left(r_c=1|c\in I\right)+p\left(r_c=0|c\in I\right)}\hfill \\ & =\frac{p_{B_{0}con}(\mu )}{p_{B_{0}con}(\mu )+p_{B_{1}con}(\mu )}\hfill \\ & =\frac{1-e^{-\mu }}{2-e^{-\mu }-e^{-\frac{3\mu }{4}}}.\hfill \end{array}$$

(17)

The second “=” holds because Bob randomly picks the elements of Set I from his conclusive results in well-distributed. Therefore, the probability of the above three conditions being satisfied is

$$p(3con)=p(r_c=1\wedge c\in I)=p\left(r_c=1|c\in I\right)p(c\in I)=\frac{k}{N}·\frac{1-e^{-\mu }}{1-e^{-\frac{\mu }{4}}}.$$

(18)

Then, we analyze the condition that the index c is neither in Set I nor J. When Bob does not receive the fake pulse, the index c is certainly not in the sets, the probability of which is $p_0(\mu )=e^{-\mu }$. When Bob receives the fake pulse, the probability that the index c is not in the two sets depends on his choice of the elements in the sets. Suppose the probability that the index c is not in the two sets when Bob receives the fake pulse is

$$\begin{array}{c}\hfill p_1[c\notin I\wedge c\notin J]=p_{(i)}p[c\notin I\wedge c\notin J|Con]+(1-p_0(\mu )-p_{(i)})p[c\notin I\wedge c\notin J|Inc],\end{array}$$

(19)

where $p[c\notin I\wedge c\notin J|Con]$ denotes the probability of the condition where Bob accepts the fake pulse as a conclusive result but does not choose it in Set I nor J; $p[c\notin I\wedge c\notin J|Inc]$ denotes the probability of the condition where Bob accepts the fake pulse as an inconclusive result but does not choose it in Set J. Assume that Bob chooses x bits of the conclusive results into Set J while $k-x$ bits of the inconclusive results into Set J, where $0\le x\le p_{con}(\mu )N-k$. Then, the number of conclusive results neither in Set I nor J is $p_{con}(\mu )N-k-x$, the number of inconclusive results not in Set J is $[1-p_0(\mu )-p_{con}(\mu )]N-(k-x)$. Therefore, the probability $p_1[c\notin I\wedge c\notin J]$ is

$$\begin{array}{cc}& p_1[c\notin I\wedge c\notin J]\hfill \\ \hfill =& p_{(i)}\frac{p_{con}(\mu )N-k-x}{p_{con}(\mu )N}+[1-p_0(\mu )-p_{(i)}]\frac{[1-p_0(\mu )-p_{con}(\mu )]N-(k-x)}{[1-p_0(\mu )-p_{con}(\mu )]N}\hfill \\ \hfill =& 1-e^{-\mu }-\frac{2+2e^{-\frac{\mu }{4}}-8e^{-\mu }+2e^{-\frac{7\mu }{4}}+2e^{-2\mu }}{(1-e^{-\frac{\mu }{4}})(1-2e^{-\mu }+e^{-\frac{\mu }{4}})}\frac{k}{N}-\frac{2(1-e^{-\mu })(1+e^{-\frac{\mu }{4}}-e^{-\frac{3\mu }{4}}-e^{-\mu })}{(1-e^{-\frac{\mu }{4}})(1-2e^{-\mu }+e^{-\frac{\mu }{4}})}\frac{x}{N}.\hfill \end{array}$$

(20)

Then, the probability that Alice attacks Protocol 2 successfully is

$$\begin{array}{cc}\hfill p(OT)& =p(3con)+\frac{1}{2}{p}_0(\mu )+\frac{1}{2}{p}_1[c\notin I\wedge c\notin J]\hfill \\ & =\frac{1}{2}+\frac{e^{-\mu }-e^{-\frac{5\mu }{4}}-e^{-\frac{7\mu }{4}}+e^{-2\mu }}{(1-e^{-\frac{\mu }{4}})(1-2e^{-\mu }+e^{-\frac{\mu }{4}})}\frac{k}{N}-\frac{(1-e^{-\mu })(1+e^{-\frac{\mu }{4}}-e^{-\frac{3\mu }{4}}-e^{-\mu })}{(1-e^{-\frac{\mu }{4}})(1-2e^{-\mu }+e^{-\frac{\mu }{4}})}\frac{x}{N}.\hfill \end{array}$$

(21)

When $x=⌊p_{con}(\mu )N-k⌋$, the minimum of $p(OT)$ is

$$\begin{array}{cc}\hfill p{(OT)}_{min}=& \frac{1}{2}-\frac{⌊\frac{1}{2}(1-e^{-\frac{u}{4}})N⌋(1-e^{-\mu })(1+e^{-\frac{\mu }{4}}-e^{-\frac{3\mu }{4}}-e^{-\mu })}{(1-e^{-\frac{\mu }{4}})(1-2e^{-\mu }+e^{-\frac{\mu }{4}})N}\hfill \\ & +\frac{(1-e^{-\frac{3\mu }{4}})(1+e^{-\frac{\mu }{4}}-2e^{-\frac{5\mu }{4}})}{(1-e^{-\frac{\mu }{4}})(1-2e^{-\mu }+e^{-\frac{\mu }{4}})}\frac{k}{N}.\hfill \end{array}$$

(22)

When $x=0$, the maximum of $p(OT)$ is

$$\begin{array}{c}\hfill p{(OT)}_{max}=\frac{1}{2}+\frac{(e^{-\mu }-e^{-\frac{5\mu }{4}}-e^{-\frac{7\mu }{4}}+e^{-2\mu })}{(1-e^{-\frac{\mu }{4}})(1-2e^{-\mu }+e^{-\frac{\mu }{4}})}\frac{k}{N}.\end{array}$$

(23)

The minimum and the maximum probabilities that Alice attacks Protocol 2 successfully with different $\mu$ are listed in

Table 2. The probabilities of Alice breaking Bob’s privacy in our $O{T}_1^2$ protocol. $p{(OT)}_{min}$ and $p{(OT)}_{max}$ denote the maximum probabilities that Alice breaks Protocol 2 with different $\mu$ when $N=800$.

$\mathbf{\mu }$	k	$\mathit{p}{(\mathit{OT})}_{\mathit{min}}$	$\mathit{p}{(\mathit{OT})}_{\mathit{max}}$
2	131	$0.4462$	$0.5129$
3	172	$0.4227$	$0.5070$
4	210	$0.4238$	$0.5034$
5	236	$0.4174$	$0.5015$
6	259	$0.4194$	$0.5007$

. Actually, Bob putting more index of conclusive results in Set I and J is beneficial for him to get more information about $b_0$ and $b_1$. Bob should prefer to select $x=\lfloor p_{con}(\mu )N-k\rfloor$. Even if Alice guesses which message Bob obtains without any trick, she has a probability of $1/2$ to get the right answer. It can be seen from Table 2 that when Bob chooses $x=\lfloor p_{con}(\mu )N-k\rfloor$, the probability that Alice breaks the $O{T}_1^2$ protocol is $p{(OT)}_{min}<1/2$, which causes that Alice replaces one of the states with $|{\mathsf{\Psi }}_0{\rangle }^{\perp }$ is not an effective attack. In addition, we will show in Section 5.2 that even Bob chooses $x=0$, Alice cannot break the binding of our QBC protocol.

4.2.2. The Attack that Alice Sends All States Dishonestly in R-OT Protocol

The attack that Alice sends all states dishonestly may be detected by Bob through the different ratio of conclusive results. She should generate different proportions of different states. For example, Alice sends states in Breidbart basis to increase the proportion of Bob’s conclusive (inconclusive) bits. Consider the ideal case, for $|{\mathsf{\Psi }}_0\rangle =|0\rangle$ and $|{\mathsf{\Psi }}_1\rangle =|\pi /6\rangle$, the states in Breidbart basis are $|\frac{\pi }{12}\rangle$ and $|\frac{7\pi }{12}\rangle$. If Alice sends the state $|\frac{\pi }{12}\rangle$ and Bob randomly chooses the measurement basis $B_0$ or $B_1$, the probability that Bob obtains a conclusive bit is

$$\begin{array}{c}\hfill \begin{array}{c}\hfill p_c=\frac{1}{2}〈\frac{\pi }{12}\left|\frac{\pi }{2}\right.〉\left.〈\frac{\pi }{2}\right|\frac{\pi }{12}〉+\frac{1}{2}〈\frac{7}{12}\left|\frac{2\pi }{3}\right.〉\left.〈\frac{2\pi }{3}\right|\frac{\pi }{12}〉=\frac{1}{2}-\frac{\sqrt{3}}{4}.\end{array}\end{array}$$

(24)

If Alice sends the state $|\frac{7\pi }{12}\rangle$ and Bob randomly chooses the measurement basis $B_0$ or $B_1$, the probability that Bob obtains a conclusive bit is

$$\begin{array}{c}\hfill \begin{array}{c}\hfill p_c^{\prime }=\frac{1}{2}〈\frac{7\pi }{12}\left|\frac{\pi }{2}\right.〉\left.〈\frac{\pi }{2}\right|\frac{7\pi }{12}〉+\frac{1}{2}〈\frac{7\pi }{12}\left|\frac{2\pi }{3}\right.〉\left.〈\frac{2\pi }{3}\right|\frac{7\pi }{12}〉=\frac{1}{2}+\frac{\sqrt{3}}{4}.\end{array}\end{array}$$

(25)

It is clear that when Alice sends $|\frac{\pi }{12}\rangle$, she knows that Bob is likely to get an inconclusive bit. When Alice sends $|\frac{7\pi }{12}\rangle$, she knows that Bob is likely to get a conclusive bit. In order to ensure the ratio of the conclusive result is $1/8$ according to Equation (1), Alice should set the proportion of $|\frac{\pi }{12}\rangle$ as $\frac{1}{2}+\frac{\sqrt{3}}{4}$ and the proportion of $|\frac{7\pi }{12}\rangle$ as $\frac{1}{2}-\frac{\sqrt{3}}{4}$. According to Equation (25), the ratio of state $|\frac{7\pi }{12}\rangle$ accepted as conclusive results and inconclusive results is $\frac{\frac{1}{2}+\frac{\sqrt{3}}{4}}{\frac{1}{2}-\frac{\sqrt{3}}{4}}$ in $O{T}_1^2$ protocol, which is around $13.9$. When Alice receives the index set X and Y, she regards the set contains more index of $|\frac{7\pi }{12}\rangle$ as the set I. By this attack, she can know the value of m chosen by Bob with a large probability.

However, $〈\frac{7\pi }{12}\left|\frac{\pi }{2}\right.〉\left.〈\frac{\pi }{2}\right|\frac{7\pi }{12}〉=〈\frac{7\pi }{12}\left|\frac{2\pi }{3}\right.〉\left.〈\frac{2\pi }{3}\right|\frac{7\pi }{12}〉$ means that Alice has no idea about Bob’s the measurement results by this attack. Bob cannot obtain the correct bit in $O{T}_1^2$ protocol, while Alice cannot disclose the correct $r_i$ in the opening phase of QBC protocol.

5. The Security of QBC

BC protocol is binding if Alice cannot change the value of b after she commits and it is concealing if Bob cannot obtain b before the opening phase. Protocol 3 is both physically binding and concealing in practice. We first show the concealing property.

5.1. Concealing of QBC

We first analyze the ideal protocol without error and loss to prove that QBC in ideal conditions is information-theoretically concealing. Then, further consider the practical conditions.

Theorem 1.

Protocol 3 in ideal conditions without imperfect facilities and errors is information-theoretically concealing.

Proof. 

According to the description of Protocol 3, it is easy to see that the relation of $r_i$, ciphertext $c_0$, $c_1$ and the commit value b is

$$\underset{i=1}{\overset{2k}{⨁}}{r}_i=c_0\oplus c_1\oplus b.$$

(26)

Suppose ${\rho }_{b^{\prime }}^{(2k)}$ is the density operator of the whole state received by Bob when Alice commits b, where $b^{\prime }=c_0\oplus c_1\oplus b$. Then

$${\rho }_{b^{\prime }}^{(2k)}=\frac{1}{2^{2k-1}}\sum _{{⨁}_{i=1}^{2k}{r}_i=b^{\prime }}|{\mathsf{\Psi }}_{r_i}\rangle \langle {\mathsf{\Psi }}_{r_i}|.$$

(27)

As $\langle {\mathsf{\Psi }}_0|{\mathsf{\Psi }}_1\rangle =cos\phi$, define

$$\begin{array}{c}\hfill |{\mathsf{\Psi }}_0\rangle =\left[\begin{array}{c}cos\frac{\phi }{2}\\ sin\frac{\phi }{2}\end{array}\right],|{\mathsf{\Psi }}_1\rangle =\left[\begin{array}{c}cos\frac{\phi }{2}\\ -sin\frac{\phi }{2}\end{array}\right]\end{array}$$

According to the process of analysis in [62], the density operators ${\rho }_0^{(2k)}$ and ${\rho }_1^{(2k)}$ satisfy

$${\rho }_0^{(2k)}-{\rho }_1^{(2k)}=2\times {\left[\begin{array}{cc}0& sin\frac{\phi }{2}cos\frac{\phi }{2}\\ sin\frac{\phi }{2}cos\frac{\phi }{2}& 0\end{array}\right]}^{\otimes 2k}.$$

(28)

Then, trace distance is

$$D({\rho }_0^{(2k)},{\rho }_1^{(2k)})=\frac{1}{2}Tr\left|{\rho }_0^{(2k)}-{\rho }_1^{(2k)}\right|={(sin\phi )}^{2k}.$$

(29)

For any positive polynomial $p(·)$ and every sufficiently large n,

$$D({\rho }_0^{(2k)},{\rho }_1^{(2k)})<\frac{1}{p(n)}$$

(30)

holds. The theorem is proved. □

In practical QBC protocol, the commit value is $b=b_0^{(i)}\oplus b_1^{(i)}$, where $i=1,2,\dots ,l$. The $O{T}_1^2$ protocol is executed l times. When Bob breaks Alice’s privacy just once in $O{T}_1^2$ protocol, he knows the commit value. Some security parameters of $O{T}_1^2$ protocol are given is Table 1 and the probability that Bob breaks Alice’s privacy $p_2$ is controlled to be a magnitude of ${10}^{-6}$. Suppose the times of executing $O{T}_1^2$ protocol in bit commitment protocol is $l=40$, a malicious Bob can obtain what Alice has committed before opening phase with a probability of

$$\begin{array}{c}\hfill p_{br}=1-{(1-{10}^{-6})}^{40}\approx 4.0\times {10}^{-5}.\end{array}$$

(31)

In practical protocol, the probability of breaking the concealing of bit commitment around $4.0\times {10}^{-5}$ is allowed.

5.2. Binding of QBC

All of Alice’s attacks can be divided into two categories, i.e., without entangled states, and with entangled states.

5.2.1. Attacks without Entangle States

When Alice attacks QBC protocol without entangle states, she has two different strategy. One is to attack QBC protocol directly. The other is to attack privacy for Bob of $O{T}_1^2$ first and knows Bob’s choice m. Then, she changes the message $b_{m\oplus 1}^{(i)}$ in the opening phase.

The former attack for Alice is to change the values of $b_0^{(i)}$ or $b_1^{(i)}$ just in the opening phase of QBC protocol. But some of these values are known by Bob. Alice has no idea about which bits Bob obtains. Because our $O{T}_1^2$ is a fault-tolerant scheme, the probability that Bob can obtain a correct $b_0$ or $b_1$ successfully is $1-p=0.8$, which is the probability that there is no error for the key used in the decryption algorithm of $O{T}_1^2$ protocol and the conclusive results are enough to construct Set I. Bob has a probability of $p=20\%$ of getting neither of the messages, a probability of $40\%$ of getting the message $b_0$, and a probability of $40\%$ of getting the message $b_1$. Therefore, if Alice randomly changes the message $b_0^{(i)}$ or $b_1^{(i)}$, her probability of being detected is $40\%$. Alice’s commitment in Protocol 3 contains l same value of b. A strategy for the cheating Alice is to commit “0” with the number of $\frac{l}{2}$ and commit “1” with the number of $\frac{l}{2}$ in commit phase, and change half of them in opening phase. Therefore, for $l=40$, Alice’s success probability of attacking is

$$\begin{array}{c}\hfill p_{br}^{\prime }={(1-0.4)}^{20}\approx 3.6\times {10}^{-5}.\end{array}$$

(32)

In practical protocol, the probability of breaking the binding of the bit commitment is allowed to be around $3.6\times {10}^{-5}$.

The QBC protocol is a compositional protocol, which calls the $O{T}_1^2$ protocol several times. In Section 4.2, we analyze the privacy for Bob of $O{T}_1^2$ protocol. Alice could attack by replacing one of the states with $|{\mathsf{\Psi }}_0{\rangle }^{\perp }$. Suppose the cheating Alice commits “0” with the number of $\frac{l}{2}$ and commit “1” with the number of $\frac{l}{2}$ in commit phase. When Alice attacks $l/2$ rounds without detection, she can break the binding of QBC. Bob has a probability of $p=20\%$ getting neither of the messages. When Bob gets none of the correct messages, Alice can change one of the messages without being detected. When Bob gets one of the messages, the probability that Alice attacks without detection is not greater than $p(OT)=p(3con)+\frac{1}{2}{p}_0(\mu )+\frac{1}{2}{p}_1\left[c\notin I\wedge c\notin J\right]$. The reason is that when the index c is neither in Set I nor J, it is possible that the fake state $|{\mathsf{\Psi }}_0{\rangle }^{\perp }$ is accepted as a conclusive bit and Alice discloses an inconsistent result in opening phase of QBC. The probability that Alice attacks one round without being detected is

$$\begin{array}{cc}& p(1round)\hfill \\ \hfill \le & p+(1-p)p(OT)\hfill \\ \hfill =& \frac{1}{2}+\frac{e^{-\mu }-e^{-\frac{5\mu }{4}}-e^{-\frac{7\mu }{4}}+e^{-2\mu }}{(1-e^{-\frac{\mu }{4}})(1-2e^{-\mu }+e^{-\frac{\mu }{4}})}\frac{k}{N}-\frac{(1-e^{-\mu })(1+e^{-\frac{\mu }{4}}-e^{-\frac{3\mu }{4}}-e^{-\mu })}{(1-e^{-\frac{\mu }{4}})(1-2e^{-\mu }+e^{-\frac{\mu }{4}})}\frac{x}{N}.\hfill \end{array}$$

(33)

When Alice attacks $O{T}_1^2$ protocol and changes $b_0$ or $b_1$ in opening phase of QBC, the probability that the attack is not detected by Bob is

$$p(BC)={[p(1round)]}^{l/2}.$$

(34)

When Bob selects none of conclusive results into Set J, the maximum probability of attacking is

$$p{(BC)}_{max}={[p{(1round)}_{max}]}^{l/2}={[p+(1-p)p{(OT)}_{max}]}^{l/2},$$

(35)

which are listed in

Table 3. The maximum probabilities of Alice breaking the binding of QBC protocol by replacing one state of $|{\mathsf{\Psi }}_0{\rangle }^{\perp }$ with different $\mu$ when $N=800$.

$\mathbf{\mu }$	k	$\mathit{p}{(1\mathit{round})}_{\mathit{max}}$	$\mathit{p}{(\mathit{BC})}_{\mathit{max}}$
2	131	$0.6103$	$5.1\times {10}^{-5}$
3	172	$0.6056$	$4.4\times {10}^{-5}$
4	210	$0.6027$	$4.0\times {10}^{-5}$
5	236	$0.6012$	$3.8\times {10}^{-5}$
6	259	$0.6005$	$3.7\times {10}^{-5}$

. Alice has the maximum probability of attacking the binding of QBC protocol with magnitudes of ${10}^{-5}$, which is allowed in practice.

5.2.2. Attack with Entangle States

The entanglement generation and control [63,64,65,66] are the preconditions of the attack with entangle states. Then, we analyze this kind of attacks. In Protocol 1, the states are generated by Alice and sent to Bob. After sending the states, if Alice does not perform the EPR type attack, she can do nothing with the outgoing states. If she prepares entangled states and sends a part of them to Bob, she tries to find the local unitary transformation to change the value of commitment, which is actually the no-go theorem attack.

When Alice commits “0” or “1”, she prepares

$$\begin{array}{c}\hfill \begin{array}{c}\hfill |0\rangle =\sum _{i=1}^{2k}{\alpha }_i|e_i{\rangle }_A\otimes |{\mathsf{\Psi }}_{r_i}{\rangle }_B,|1\rangle =\sum _{j=1}^{2k}{\beta }_i|e_j^{\prime }{\rangle }_A\otimes {|{\mathsf{\Psi }}_{r_j}\rangle }_B,\end{array}\end{array}$$

(36)

respectively, where

$$\begin{array}{c}\hfill \begin{array}{c}\hfill \underset{i=1}{\overset{2k}{⨁}}{r}_i=c_0\oplus c_1,\underset{j=1}{\overset{2k}{⨁}}{r}_j=c_0\oplus c_1\oplus 1,\end{array}\end{array}$$

(37)

If Alice wants to change the value of commitment from “0” to “1”, she needs to get state $|\nu \rangle$ with the same reduced density operator as $|0\rangle$, which satisfies $|\langle 1|\nu \rangle |=F({\rho }_0^{2k},{\rho }_1^{2k})=1-\delta$. Then, she must find out the unitary transformation acting on A alone to transform $|0\rangle$ into $|\nu \rangle$. The calculation of unitary transformation is presented in Appendix A. As $|\nu \rangle$ and $|1\rangle$ are so similar, Bob can hardly detect the cheating Alice.

However, according to Appendix A, the no-go theorem attack algorithm’s time complexity is $O(2^{3n})$, besides, this algorithm needs at least $O(2^{2n})$ size of memory space to store the matrix. The entry number of matrix $U_A$ is $2^{2k}\times 2^{2k}$, according to Table 1 this number is greater than the number of protons on the earth. It means that Alice is unable to get the matrix in practice, and the storage time of quantum states is limited. The bit commitment could be executed over a period of time to prevent Alice from applying transformation with the other part of entanglement states. Therefore, in practice Alice can hardly attack the binding of the bit commitment protocol with this method. Therefore, our protocol achieves the physical security defined in Section 1.

6. Discussions

In this paper, we analyze the situation where the protocols are executed on an atmospheric window with a high efficiency detector of $80\%$. If a malicious Bob has a greater ability to obtain information near Alice’s site and has a super channel, the transfer efficiency could be $100\%$. To defend the attack, the product of the efficiency of transfer and an honest Bob’s detector ${\eta }_C{\eta }_D$ should be increased to $80\%$.

If we execute the protocols in optical fiber, the bit commitment protocol can be realized between two parties with a long distance. For a malicious Bob who uses photon number splitting attack and has a detector with an efficiency less than ${\eta }_D/80\%$, the analysis and security of the protocol also hold. It means that our protocols can probably be applied over a long distance in the future.

We considered another construction of quantum bit commitment protocol. In quantum R-OT protocol, Bob prepares a random qubit string $|{\mathsf{\Phi }}_1\rangle ,\dots ,|{\mathsf{\Phi }}_n\rangle$ and sends it to Alice, where $|{\mathsf{\Phi }}_i\rangle \in \{|0\rangle ,|1\rangle ,|+\rangle ,|-\rangle \}$. Alice generates random bit string $(r_1,\dots ,r_N)\in {\{0,1\}}^N$. When $r_i=0$, she keeps the ith qubit unchanged and sends it back to Bob; when $r_i=1$, she rotates the state along y axis with $\frac{\pi }{6}$, and sends the qubit back to Bob, that is

$$\left\{\begin{array}{c}{r}_i=0,|{\mathsf{\Phi }}_i\rangle ⟶|{\mathsf{\Phi }}_i\rangle ,\hfill \\ r_i=1,|{\mathsf{\Phi }}_i\rangle ⟶|{\mathsf{\Phi }}_i+\frac{\pi }{6}\rangle .\hfill \end{array}\right.$$

Bob chooses $B_0$ or $B_1$ randomly to measure the pulses coming from Alice, where $|{\mathsf{\Psi }}_0\rangle =|{\mathsf{\Phi }}_i\rangle$ and $|{\mathsf{\Psi }}_1\rangle =|{\mathsf{\Phi }}_i+\frac{\pi }{6}\rangle$. From these receiving pulses, if and only if his measurement results in state $|{\mathsf{\Psi }}_x{\rangle }^{\perp }$, he accepts a pulse as a conclusive pulse and takes the bit value of this pulse as $x\oplus 1$.

When attacking the quantum bit commitment protocols by no-go theorem, Alice usually prepares states as $|0\rangle ={\Sigma }_i{\alpha }_i|e_i{\rangle }_A\otimes {|{\varphi }_i\rangle }_B$ and $|1\rangle ={\Sigma }_j{\beta }_j|e_j^{\prime }{\rangle }_A\otimes {|{\varphi }_j^{\prime }\rangle }_B$. Then, she keeps the first register herself and sends the second register to Bob. Only by Alice’s local unitary transformation, she can cheat by changing the value of the commit bit b in opening phase. In the protocol above, the quantum states are prepared by Bob and Alice has no original states. However, when she rotates the coming states, she can make the operation as a controlled unitary transformation. The control bit in the transformation is entangled with the other register. Similarly, Alice can cheat by local unitary transformation on the other register. The construction above actually is not beyond the no-go theorem and increase the complexity of the practical system. Therefore, we construct a more practical and easier protocol in Section 3.

7. Conclusions

Based on two non-orthogonal states, we construct a practical quantum R-OT protocol. Afterwards we construct a one-out-of-two oblivious transfer protocol based on the quantum R-OT protocol. Finally, we present a bit commitment protocol based on the one-out-of-two protocol. The security of concealing is kept by the measurement hypothesis and superposition principle of state in quantum mechanics. The binding of the bit commitment protocol is physically secure. By using weak coherent pulses and allowing some errors, our protocols can be applied in practice. With the advent of the higher efficiency detectors in optical fiber, our protocol can be realized with a long distance.