## 2 Results
### Practical Difficulties  
The security of the practical implementation of the protocol, however, is limited by two difficulties. (1) The length of the classical communications between [PERSON] and [PERSON] has to remain finite, so that [PERSON] cannot announce the delay times \(\tau_{j}\) (\(j=1,\ldots,s\)) with an unlimited number of digits. (2) The delay time of the storage rings \(SR_{A}\) and \(SR_{B}\) cannot be adjusted to an unlimited precision either, so that [PERSON] and [PERSON] cannot set \(\tau_{j}\) precisely to any desired value. Consequently, the number of choices for the time slots \(T_{i}\) in Equation (23) (from which \(\tau_{j}\) can be picked) cannot really go to infinite. Instead, when the above two difficulties limit the precision of time control to \(\Delta\tau\), the number of time slots within the range \([0,\tau_{\max}]\) is as below:  
\[n=\tau_{\max}/\Delta\tau+1. \tag{25}\]  
Therefore, the quantum optical method in Section 2.2 actually implements finite \(n\)-dimensional systems, instead of infinite-dimensional ones. That is, though the two protocols are equivalent in principle, in practice, the experimental scheme is not a faithful implementation of our theoretical protocol in Section 2.1. Thus, it cannot be as secure as the latter.  
Nevertheless, making use of this limitation for cheating is technically challenging too. Suppose that [PERSON] and [PERSON] know the value of \(\Delta\tau\) and therefore know the actual finite \(n\). According to Section 5 of ref. [56], if [PERSON] wants to cheat, she needs to have the technology to prepare entangled states in the form of Equation (4) in the commit phase, which is the quantum superposition of \(n\) different states. Moreover, later in the unveil phase, when she measures system \(\alpha\) to complete her cheating, she needs to discriminate her measurement result between \(\ket{\alpha_{i+}}\) and \(\ket{\bar{\alpha}_{i-}}\), where the latter is defined by Equation (9). Multiplying \(\bra{\alpha_{i+}}\) by it and we yield the following:  
\[|\bra{\alpha_{i+}}\ket{\bar{\alpha}_{i-}}|^{2}=1-\frac{4}{n+2} \tag{26}\]  
(i.e., Equation (3.10) of ref. [56]). In our experimental protocol, suppose that the storage rings can achieve a precision of \(\Delta\tau=300\) ps; then, for \(\tau_{\max}=500\) us, there is \(n\simeq 1.67\times 10^{6}\). We can see that \(|\bra{\alpha_{i+}}\ket{\bar{\alpha}_{i-}}|^{2}\) is so close to 1 that even a tiny amount of noise and error in [PERSON]'s experimental devices (which is inevitable in practice) could make the discrimination between \(|\alpha_{i+}\rangle\) and \(|\bar{\alpha}_{i-}\rangle\) impossible. On the other hand, if [PERSON] is dishonest and wants to learn the committed bit \(b\) before the unveil phase, according to Section 7 of ref. [56], he needs to be capable of discriminating the two density matrices \(\rho_{0}^{\beta}=\rho_{+}^{\otimes s}\) and \(\rho_{1}^{\beta}=\rho_{-}^{\otimes s}\) where the trace distance between \(\rho_{+}\) and \(\rho_{-}\) is below:  
\[D\big{(}\rho_{+},\rho_{-}\big{)}=\frac{1}{\sqrt{n-1}} \tag{27}\]  
(i.e., Equation (3.1) of ref. [56]). Again, in the practical setting, such a tiny difference between the states could be completely drowned by the noise and error in the experimental devices. Therefore, even with the limited \(n\) value achievable today, the experimental protocol in Section 2.2 can at least be used as a practically secure (instead of unconditionally secure) QBC scheme, or serve as a proof-of-principle implementation of the theoretical protocol in Section 2.1.