Bit commitment

A bit commitment allows a sender to fix a bit while concealing it from the receiver until an opening phase. Binding prevents a sender from opening the same commitment as either bit; hiding prevents the receiver from learning the bit prematurely. With a one-way permutation $F$ and a hard-core predicate $h$, a commitment can consist of $F(x)$ and the masked bit $b\oplus h(x)$. Opening reveals $x$. Injectivity gives binding, while unpredictability of the hard-core predicate gives computational hiding. For an RSA cryptosystem, the receiver must not possess the inverse trapdoor.

If the two honest quantum state ensembles have the same density operator, their independently prepared blocks are perfectly hiding. A dishonest sender can instead send one half of a purification of a density operator and retain the other. The Hughston–Jozsa–Wootters theorem allows a measurement of the retained system to prepare either honest ensemble after commitment. If verification checks only the declared states, either opening is then accepted with the honest probabilities. This gives a concrete failure of binding while preserving perfect hiding.