Why is unconditional classical bit commitment impossible?

Question

It is well-known that unconditional quantum bit commitment is impossible [1, 2, 3]. So I wonder if there is a direct proof for the classical case.

Note that any classical protocol can be treated as a quantum protocol, where all states are diagonal. However, the proofs for the quantum case always require the adversary to input a state like $(|0 \rangle + | 1 \rangle)/\sqrt{2}$, and every operation is done in a purified way.

Can we prove the impossibility of classical bit commitment for an unbounded classical adversary?

Answer 1

Can we prove the impossibility of classical bit commitment for an unbounded classical adversary?

Yes, the proof is quite simple (even if it is completely different from proofs about bit commitments in the Quantum Realm), assuming that both the committer and the verifier as computationally unbounded.

One way to approach it would be to look at the commitment opening procedure (and ignore the commitment generation procedure). I'll limit this proof to noninteractive opening procedures - handling the interactive case is more work, but essentially follows this logic.

This procedure is a function that takes two inputs, the commitment and some revelation data, and generates an element from the set $\{ 0, 1, \perp \}$, that is $\mathbb{O}( C, R ) \to \{ 0, 1, \bot \}$.

To open the commitment $C$, the committer would publish the revelation data $R$, and the verifier could then compute the function $\mathbb{O}( C, R )$ - if it evaluates to a $0$, then the commitment opens to a $0$; if it is a $1$, then the commitment opens to a $1$.

Now, to be perfecting hiding, then for any valid commitment $C$, there has to be two distinct revelation datas $R_0, R_1$ that open the commitment to both 0 and 1 - that is, $\mathbb{O}(C, R_0) = 0$ and $\mathbb{O}(C, R_1) = 1$. If that were not the case, then a computationally unbounded verifier could compute $\mathbb{O}(C, R)$ on all possible $R$ values and see what the commitment cannot open to (and thus see what must be the committed value).

To be perfectly binding, then there cannot be a commitment that can be opened both ways - there cannot be a commitment $C$ and two revelation datas $R_0, R_1$ with $\mathbb{O}(C, R_0) = 0$ and $\mathbb{O}(C, R_1) = 1$; otherwise, a computationally unbounded committer could find such a triplet $C, R_0, R_1$ (by checking all possibilities), issue $C$ as his commitment, and then later open it as either $0$ or $1$ at his discretion.

Hence, we have two incompatible requirements; that $\mathbb{O}(C, R_0) = 0$ and $\mathbb{O}(C, R_1) = 1$ must hold simultaneously and that the two also must not hold simultaneously.

Hence, we must assume that at least one of the two sides is computationally bounded.