Quantum cheating.

Taking advantage of quantum effects once seemed to offer a remarkably secure way of processing information. Cryptographers developed and tested schemes that appeared highly resistant to tampering and eavesdropping (SN: 2/10/96, p. 90). Now, researchers have uncovered a weakness that makes unconditional security impossible to achieve using any method that requires a specific type of quantum bit manipulation.

"This result implies a severe setback for quantum cryptography," says Dominic Mayers of Princeton University. He describes his findings in the April 28 Physical Review Letters. Another paper on the subject, by Hoi-Kwong Lo of Hewlett-Packard Laboratories in Bristol, England, and H.F. Chau of the University of Hong Kong, also appears in that issue.

The problem involves a procedure called quantum bit commitment, which allows people to compare or combine information while keeping each individual's contribution secret. It works like this: A person writes a bit--either 0 or 1--on a piece of paper, places the slip inside a box, and locks the box. She then gives the locked box to someone else but keeps the key. She can no longer change her mind about the value of the bit. At the same time, no one else can determine her choice until she supplies the key.

The quantum version of bit commitment involves photons of polarized light. The direction of oscillation of a photon's electric field is generally given by an angle or orientation. Suppose the sender can transmit photons in four polarizations: 0 [degrees] (horizontal), 45 [degrees] (diagonal), 90 [degrees] (vertical), and 135 [degrees] (diagonal). The recipient has a choice of two measurements. One measurement distinguishes between the horizontal and vertical polarizations, and the other distinguishes between the two diagonal states.

If the recipient's detector is set up to observe only vertically polarized photons, it counts each vertically polarized photon that it sees as I and each horizontally polarized photon as 0. The detector's response to diagonally polarized photons is random, meaning that it is equally likely to register 1 or 0.

To make a bit commitment, the sender transmits a locked box in the form of a string of photons all polarized either vertically or diagonally. The recipient has no way of determining whether they are vertical or diagonal, so he randomly sets his detector so that it sometimes responds to vertically polarized photons and sometimes to diagonally polarized photons. Essentially, the detector records a string of 1s and 0s, which represent the correct value only when the detector happens to match the orientation of the sender's polarized photons. However, the sender can prove that she transmitted a particular orientation by obtaining the detector's setting at each point and telling him what he saw in the instances where the detector had the correct setting.

The trouble is that the sender can cheat by producing pairs of photons with the same polarization. She can then send one from each pair to the recipient and store the other for later observation. The matched photons have the curious quantum property that the observation of one affects how the other appears in a detector, an effect known as the Einstein-Podolsky-Rosen correlation. In effect, there are two linked boxes, and the sender can peek inside hers to see what the recipient has recorded at the other. Knowing all the recipient's observations, she is free to lie about whether she sent vertically or diagonally polarized photons.

"There is no way for [the recipient] to detect this attack," Lo and Chau say. Indeed, such cheating defeats all proposed schemes for quantum bit commitment, they conclude.

"Because we have shown that bit commitment is impossible", Mayers says, "we cannot hope to realize cryptographic ... applications which are known to be powerful enough to [include] bit commitment."