## 5 The Security of QBC
### Binding of QBC
#### 5.2.1 Attacks without Entangle States  
When [PERSON] attacks QBC protocol without entangle states, she has two different strategy. One is to attack QBC protocol directly. The other is to attack privacy for [PERSON] of \(OT_{1}^{2}\) first and knows [PERSON]'s choice \(m\). Then, she changes the message \(b_{m\in 1}^{(i)}\) in the opening phase.  
The former attack for [PERSON] is to change the values of \(b_{0}^{(i)}\) or \(b_{1}^{(i)}\) just in the opening phase of QBC protocol. But some of these values are known by [PERSON]. [PERSON] has no idea about which bits [PERSON] obtains. Because our \(OT_{1}^{2}\) is a fault-tolerant scheme, the probability that [PERSON] can obtain a correct \(b_{0}\) or \(b_{1}\) successfully is \(1-p=0.8\), which is the probability that there is no error for the key used in the decryption algorithm of \(OT_{1}^{2}\) protocol and the conclusive results are enough to construct Set \(l\). [PERSON] has a probability of \(p=20\%\) of getting neither of the messages, a probability of \(40\%\) of getting the message \(b_{0}\), and a probability of \(40\%\) of getting the message \(b_{1}\). Therefore, if [PERSON] randomly changes the message \(b_{0}^{(i)}\) or \(b_{1}^{(i)}\), her probability of being detected is \(40\%\). [PERSON]'s commitment in Protocol 3 contains \(l\) same value of \(b\). A strategy for the cheating [PERSON] is to commit \"\(0\)\" with the number of \(\frac{l}{2}\) and commit \"\(1\)\" with the number of \(\frac{l}{2}\) in _commit phase_, and change half of them in _opening phase_. Therefore, for \(l=40\), [PERSON]'s success probability of attacking is  
\[p_{br}^{\prime}=(1-0.4)^{20}\approx 3.6\times 10^{-5}. \tag{32}\]  
In practical protocol, the probability of breaking the binding of the bit commitment is allowed to be around \(3.6\times 10^{-5}\).  
The QBC protocol is a compositional protocol, which calls the \(OT_{1}^{2}\) protocol several times. In Section 4.2, we analyze the privacy for [PERSON] of \(OT_{1}^{2}\) protocol. [PERSON] could attack by replacing one of the states with \(|\Psi_{0}\rangle^{\perp}\). Suppose the cheating [PERSON] commits \"\(0\)\" with the number of \(\frac{l}{2}\) and commit \"\(1\)\" with the number of \(\frac{l}{2}\) in _commit phase_. When [PERSON] attacks \(l/2\) rounds without detection,she can break the binding of QBC. [PERSON] has a probability of \(p=20\%\) getting neither of the messages. When [PERSON] gets none of the correct messages, [PERSON] can change one of the messages without being detected. When [PERSON] gets one of the messages, the probability that [PERSON] attacks without detection is not greater than \(p(OT)=p(3 con)+\frac{1}{2}p_{0}(\mu)+\frac{1}{2}p_{1}\left[c\
otin I\wedge c\
otin J\right]\). The reason is that when the index \(c\) is neither in Set \(I\) nor \(J\), it is possible that the fake state \(|\Psi_{0}\rangle^{\perp}\) is accepted as a conclusive bit and [PERSON] discloses an inconsistent result in _opening phase_ of QBC. The probability that [PERSON] attacks one round without being detected is  
\[p(1 round) \tag{33}\] \[\leq p+(1-p)p(OT)\] \[= \frac{1}{2}+\frac{e^{-\mu}-e^{-\frac{5\mu}{4}}-e^{-\frac{7\mu}{4} }+e^{-2\mu}}{(1-e^{-\frac{1}{4}})(1-2e^{-\mu}+e^{-\frac{7\mu}{4}})}\frac{k}{N} -\frac{(1-e^{-\mu})(1+e^{-\frac{8}{4}}-e^{-\frac{3\mu}{4}}-e^{-\mu})}{(1-e^{- \frac{\mu}{4}})(1-2e^{-\mu}+e^{-\frac{8}{4}})}\frac{x}{N}.\]  
When [PERSON] attacks \(OT_{1}^{2}\) protocol and changes \(b_{0}\) or \(b_{1}\) in _opening phase_ of QBC, the probability that the attack is not detected by [PERSON] is  
\[p(BC)=[p(1 round)]^{l/2}. \tag{34}\]  
When [PERSON] selects none of conclusive results into Set \(J\), the maximum probability of attacking is  
\[p(BC)_{max}=[p(1 round)_{max}]^{l/2}=[p+(1-p)p(OT)_{max}]^{l/2}, \tag{35}\]  
which are listed in Table 3. [PERSON] has the maximum probability of attacking the binding of QBC protocol with magnitudes of \(10^{-5}\), which is allowed in practice.