## 2 Results  
### The Theoretical Description of the Protocol  
Let us begin with a brief review on the definition of BC and the theoretical scheme in ref. [56]. BC is a two-party cryptography between [PERSON] and [PERSON], which includes the following phases. In the commit phase, [PERSON] decides the value of the bit \(b\) that she wants to commit and sends [PERSON] a piece of evidence, e.g., some quantum states. Later, in the unveil phase, [PERSON] announces the value of \(b\), and [PERSON] checks it with the evidence. The interval between the commit and unveil phases can be called the holding phase. An unconditionally secure BC protocol needs to be both binding (i.e., [PERSON] cannot change the value of \(b\) after the commit phase) and concealing ([PERSON] cannot know \(b\) before the unveil phase). Since whether QBC can be unconditionally secure in principle is a very important theoretical problem, here, we only consider the ideal case without transmission errors, detection loss, dark counts, or other practical imperfections. In ref. [56], the following protocol was proposed:  
_Our theoretical QBC protocol:_  
_The commit phase:_  
(i) _[PERSON] decides on the value of_ \(b\) _(_\(b=0\) _or_ \(1\)_) that she wants to commit. Then, for_ \(j=1\) _to s:_  
_She randomly picks an integer_ \(i_{j}\in\{1,2,\ldots,\infty\}\)_and sends [PERSON] a quantum register_ \(\Psi_{j}\)_, which is an infinite-dimensional system prepared in the state_ \(\Psi_{ij}^{b}=(|0\rangle+(-1)^{b}|i_{j}\rangle)/\sqrt{2}\)_._  
_That is, if_ \(b=0\) _she randomly picks a state from the set:_  
\[\bigg{\{}\psi_{i}^{0}\equiv|\phi_{i+}\rangle=\frac{1}{\sqrt{2}}(|0\rangle+|i \rangle),i=1,\ldots,n-1\bigg{\}}, \tag{1}\]  
_or, if_ \(b=1\)_, she randomly picks a state from the set:_  
\[\bigg{\{}\psi_{i}^{1}\equiv|\phi_{i-}\rangle=\frac{1}{\sqrt{2}}(|0\rangle-|i \rangle),i=1,\ldots,n-1\bigg{\}}, \tag{2}\]  
_where_ \(|0\rangle\)_,_ \(|1\rangle\)_,_ \(|2\rangle\)_,_ \(\ldots\)_,_ \(|i\rangle\)_,_ \(\ldots\) _are orthogonal to each other and_ \(n\to\infty\)_._  
_Note that, in each round,_ \(i_{j}\) _is independently chosen, while_ \(b\) _remains the same for all_ \(j\)_;_  
_The holding phase:_  
(ii) _[PERSON] stores these s quantum registers unmeasuredly;_  
_The unveil phase:_  
(iii) _[PERSON] announces the values of_ \(b\) _and all_ \(i_{j}\) _(_\(j=1,\ldots,s\)_);_  
(iv) _[PERSON] tries to project each_ \(\Psi_{j}\) _into the state_ \(\psi_{ij}^{b}=(|0\rangle+(-1)^{b}|i_{j}\rangle)/\sqrt{2}\)_. If the projections are successful for all registers, [PERSON] accepts [PERSON]'s commitment. Else, if any of the projections fails, [PERSON] concludes that [PERSON] cheated._The key reason that this protocol can be unconditionally secure is the specific forms of the states in Equations (1) and (2). In general, the cheating strategy in the no-go proofs [6; 7; 8; 9; 10; 11; 12; 13; 14; 15; 16; 17; 18; 19; 20; 21; 22; 23; 24; 25; 26; 27; 28; 29; 30; 31; 32; 33; 34; 35; 36; 37; 38; 39; 40; 41; 42; 43; 44] can be successful in most QBC protocols using other forms of quantum states for the following reason. Suppose that honest [PERSON] is supposed to send [PERSON] the state \(\psi^{00}\) (\(\psi^{11}\)) if she wants to commit \(b=0\) (\(b=1\)), where \(\psi^{00}\) (\(\psi^{11}\)) is picked from a set of states described by the density matrix \(\rho_{0}^{\delta}\) (\(\rho_{1}^{\delta}\)). Since an unconditionally secure QBC protocol needs to be concealing against dishonest [PERSON], there should be the following:  
\[\rho_{0}^{\delta}\simeq\rho_{1}^{\delta} \tag{3}\]  
so that [PERSON] cannot discriminate the state himself. Then, the HJW theorem applies. That is, dishonest [PERSON] can begin the QBC protocol by preparing the system \(\alpha\otimes\beta\) in such a state that \(\beta\) alone has density matrix \(\rho_{0}^{\delta}\). Then, she skips the measurement in the commit phase so that \(\alpha\) and \(\beta\) remain entangled.