How Spooky Actions at a Distance Deny Perfect Security

Albert Einstein was not a big fan of quantum mechanics. But there was one aspect of it that he could not get his head around, the entanglement. So much so that he called it "spooky action at a distance". We'll see exactly the role entanglement plays in making unconditionally secure quantum bit commitment impossible. Quantum bit commitment was initially believed to be a candidate for perfect security because of a feature of quantum mechanics that seems ideal for cryptography: measurement disturbs quantum states. Before we go there, let's talk about what Perfect Security really means. Perfect Security is a term first coined by Claude Shannon. He said a cryptosystem has perfect security if observing the ciphertext gives an attacker no info whatsoever about the plaintext. Formally:

P(M=m \mid C=c) = P(M=m)

Turns out that this is quite the challenge. Modern encryption systems that we rely on provide us computational security and not perfect security. Imperfect security is good enough, atleast for now. The intuition behind quantum bit commitment being perfectly secure was straightforward, let's summon Alice and Bob:

Alice could encode her commitment into quantum states.
Bob could not determine the committed bit without performing measurements.
Any attempt by Bob to learn the bit prematurely would disturb the states and could be detected later.
Therefore, the protocol appeared to be perfectly hiding.
At the same time, it was thought that quantum states could effectively "lock in" Alice's choice, making the protocol binding as well.

So what's this perfect hiding and binding? Before going into that let's looking into what a classical bit commintment looks like.

Classical Cryptography

Suppose Alice wants to commit to a bit (0 or 1) today, but reveal it to Bob tomorrow:

b \in \{0, 1\}

Alice wants to convince Bob that:

She has already decided on a value.
She won't change it later.
Bob can't learn it until she chooses to reveal it.

For the protocol to be secure, two properties must hold:

Hiding: Bob shouldn't be able to learn the committed bit before Alice reveals it. If Alice commits to 0, Bob must remain completely in the dark.
Binding: Alice shouldn't be able to change her commitment after the fact. Once she commits to 0, she shouldn't later decide she'd rather reveal 1.

Enter Quantum Mechanics

Quantum mechanics changes this because of a few key properties:

Quantum Uncertainty: Measurement changes quantum systems; observe a state the wrong way, and you may disturb it.
Superposition: A quantum bit (qubit) can exist in a state of both 0 and 1 simultaneously until measured.
Entanglement: When two particles become entangled, their states remain linked regardless of distance.
The No-Cloning Theorem: Quantum information cannot be copied perfectly.

Quantum Bit Commitment

A typical Quantum Bit Commitment (QBC) protocol consists of three phases:

Commitment Phase: Alice encodes her bit into quantum states and sends information to Bob. Bob cannot determine the bit, and Alice is supposedly locked into her choice.
Holding Phase: Bob stores the quantum information while Alice waits.
Reveal Phase: Alice announces her bit and verification information. Bob verifies that the reveal matches the original commitment.

The Fundamental Problem: Perfect Hiding Means Alice Can Cheat

The core issue is that in quantum mechanics, perfect secrecy comes at a cost. This is captured by the quantum bit commitment no-go theorem: No protocol can be both perfectly hiding and unconditionally secure at the same time. If the protocol hides the bit perfectly, then Bob’s view of the two possible commitments is identical. From his perspective, nothing distinguishes 0 from 1. But that indistinguishability has a deeper consequence. It means Alice is not truly bound to her choice at the time of commitment. Because the two cases look identical to Bob, quantum theory allows Alice to exploit that symmetry. In effect, she can perform a suitable quantum transformation later that converts one valid commitment into the other without being detected. The commitment was never fully fixed; it only appeared to be locked in. So the same feature that protects privacy also opens the door to cheating. Perfect hiding and perfect binding cannot coexist in the quantum world.

The Entanglement Attack

Instead of committing to a definite bit, Alice can prepare an entangled state

|\Psi\rangle_{AB} = \sum_i \sqrt{p_i}\,|i\rangle_A \otimes |\phi_i\rangle_B,

where she keeps subsystem $A$ and sends subsystem $B$ to Bob.

From Bob's perspective, the state he receives is described by the reduced density matrix

\rho_B = \operatorname{Tr}_A\!\left(|\Psi\rangle\langle\Psi|\right).

For a protocol to be perfectly hiding, Bob must see the same state regardless of whether Alice intends to reveal $0$ or $1$ :

\rho_B^{(0)} = \rho_B^{(1)}.

Let

|\Psi_0\rangle_{AB} \quad\text{and}\quad |\Psi_1\rangle_{AB}

be the corresponding joint states for commitments to $0$ and $1$ . Since they produce the same reduced state for Bob, there exists a unitary operation acting only on Alice's subsystem such that

|\Psi_1\rangle_{AB} = \left(U_A \otimes I_B\right) |\Psi_0\rangle_{AB}.

This means Alice can postpone her choice until the unveiling phase:

To reveal 0, she leaves her subsystem unchanged.
To reveal 1, she applies $U_A$ to her retained qubits.

Because the transformation acts only on Alice's private system,

\rho_B = \operatorname{Tr}_A\!\left(|\Psi_0\rangle\langle\Psi_0|\right) = \operatorname{Tr}_A\!\left(|\Psi_1\rangle\langle\Psi_1|\right),

Bob cannot detect the change before the reveal.

In other words, the commitment was never truly fixed. Alice's choice remains hidden within the entangled state until she decides which bit to unveil:

|\Psi_1\rangle = \left(U_A \otimes I_B\right) |\Psi_0\rangle.

Here's a picture to explain the above equation. Entanglement Attack

Imagine Alice and Bob are playing a game with a "magic lockbox.". Bob wants Alice to lock either a 0 card or a 1 card inside the box today, and reveal it tomorrow. A normal lockbox works because once the card is inside, it's stuck there. The entanglement attack is like Alice using a special trick box that doesn't actually contain a definite card yet. When Bob looks at the box, everything appears normal. He can't tell whether it contains a 0 or a 1. But secretly, Alice kept a magic remote control connected to the box. The remote doesn't let her send messages to Bob or change what he sees immediately. Instead, it lets her decide later how the box should be interpreted. The next day: If she wants to reveal 0, she presses nothing and opens the box. If she wants to reveal 1, she presses a button on the remote first, then opens the box. The spooky action at distance is the fact that Alice is able to delay her choice until the reveal without Bob finding out.

The Unavoidable Trade-Off

You can have perfect hiding or perfect binding, but not both. The two security goals pull against each other like opposite ends of a quantum tug-of-war. It's almost as if nature itself forbids this perfect balance to exist.

Workarounds

While perfect, unconditional security is impossible, practical alternatives exist by relaxing assumptions:

Cheat-Sensitive Protocols:
Cheat-sensitive protocols rely on the idea that cheating is not always fully preventable, but it becomes detectable with non-negligible probability. A standard example is cheat-sensitive quantum coin flipping, where two parties use quantum states (often variants of BB84 states, a protocol class within the broader BB84 family BB84 quantum key distribution protocol) so that any attempt to bias the outcome disturbs the states and can be detected when measurements are later compared. Another example is interactive proof systems with “verification sampling,” where a prover can deviate, but random spot checks make successful undetected cheating unlikely.

Relativistic Protocols:
Relativistic protocols exploit constraints from special relativity, in particular the finite speed of light. In relativistic bit commitment schemes, a party splits into two spatially separated agents who must respond simultaneously. Because signals cannot travel faster than light, the two agents cannot coordinate in time to adjust responses based on the verifier’s challenge. This idea appears in relativistic bit commitment constructions by Adrian Kent and related relativistic cryptography frameworks. A simple example is a commitment protocol where Alice commits using two distant sites; unveiling requires consistent, simultaneous responses that cannot be adaptively coordinated if she tries to cheat.

Partial Commitment:
Partial commitment protocols accept some controlled leakage or flexibility to achieve practicality. In weak bit commitment, the receiver may learn a small amount of information about the committed bit before opening, but not enough to determine it reliably. Another example is noisy or bounded-leakage commitments where perfect hiding is relaxed to statistical or computational hiding with a small bias. These are often used as building blocks for more efficient oblivious transfer or secure multiparty computation when perfect security is too expensive.

Bounded Quantum Storage Model:
The bounded quantum storage model assumes adversaries cannot store arbitrary quantum states for long periods without significant decoherence or capacity limits Bounded quantum storage model. Protocols in this model include BB84-style key exchange variants where an adversary is forced to measure quantum states immediately due to storage limits, preventing later coordinated attacks once classical information is revealed. Another example is secure bit commitment schemes that remain binding because a cheating party cannot retain enough quantum information to reconstruct alternative openings later.

References

Bennett, C. H., & Brassard, G. (1984). Quantum cryptography: Public key distribution and coin tossing. Proceedings of the IEEE International Conference on Computers, Systems & Signal Processing.
Brassard, G., Crépeau, C., Jozsa, R., & Langlois, D. (1993). A quantum bit commitment scheme provably unbreakable by both parties. Proceedings of the 34th IEEE Symposium on Foundations of Computer Science (FOCS).
Mayers, D. (1997). Unconditionally secure quantum bit commitment is impossible. Physical Review Letters, 78(17), 3414–3417. https://doi.org/10.1103/PhysRevLett.78.3414
Lo, H.-K., & Chau, H. F. (1997). Is quantum bit commitment really possible? Physical Review Letters, 78(17), 3410–3413. https://doi.org/10.1103/PhysRevLett.78.3410
Kent, A. (2012). Unconditionally secure bit commitment by transmitting measurement outcomes. Physical Review Letters, 109(13), 130501. https://doi.org/10.1103/PhysRevLett.109.130501
Chandran, N., Goyal, V., Moriarty, R., & Ostrovsky, R. (2014). Position-based quantum cryptography. SIAM Journal on Computing, 43(1), 150–178. https://doi.org/10.1137/130922712
Damgård, I., Fehr, S., Salvail, L., & Schaffner, C. (2005). Cryptography in the bounded quantum-storage model. Proceedings of the 46th IEEE Symposium on Foundations of Computer Science, 449–458. https://doi.org/10.1109/FOCS.2005.54
König, R., Wehner, S., & Wullschleger, J. (2012). The bounded quantum storage model. IEEE Transactions on Information Theory, 58(9), 6332–6345. https://doi.org/10.1109/TIT.2012.2207815
Tomamichel, M., Schaffner, C., Smith, A., & Renner, R. (2011). Leftover hashing against quantum side information. IEEE Transactions on Information Theory, 57(8), 5524–5535. https://doi.org/10.1109/TIT.2011.2158031