{"id":"065d36a4-80c4-40df-b8a9-483cba7155e4","arxiv_id":"2608.11187","paper_version":1,"verdict":"REJECT","confidence":"MODERATE","novelty_score":6.0,"correctness_risk":"high","formal_verification":"none","parameter_count":1,"one_line_summary":"A statistical bit-commitment and coin-flipping scheme is claimed from hybrid locked PUFs, but the binding proof has a load-bearing gap.","lead":"This paper claims a bit-commitment protocol whose security rests on a hybrid quantum-classical hardware token called a locked PUF, plus a coin-flipping protocol built from it. The hiding argument is clean, but the binding proof relies on an assumption about the token's behavior that appears false, so the central security claim is not established as written.","discovery_kind":"new_application","skeptic_critique":{"model":"deepseek-v4-flash","headline":"Lemma 3's acceptance-relation assumption is false: Step 10's projective test accepts many z per verifier string a, so the |S| ≤ 2^s bound and Theorem 6's binding bound do not follow.","rationale":"The paper's intended contribution is a statistically hiding and binding commitment from HLPUFs, with coin flipping as a corollary. The hiding analysis (Lemma 2 and Theorem 5) is structurally plausible: if Algorithm 1 makes the selected payload uniform, the two honest commit ensembles are maximally mixed and hence identical, and unforgeability bounds the residual leakage. The binding proof, however, rests entirely on Lemma 3's operator-norm bound, and that lemma contains a false premise about the acceptance relation. Bob's Step 10 is a projective measurement on the state returned by the HLPUF; it does not define a deterministic relation between verifier string a and accepted output z. For the correct verifier string a=f1(x), every z whose basis pattern differs from f2(x) in w positions is accepted with probability 2^{-w}, so a single a already gives many accepted z. The proof's bound |S|≤2^s is therefore unjustified. If one restricts to probability-one acceptance, the relation has essentially one element, but then the reduction in Theorem 6 does not cover openings with partial acceptance probability. Either way, the exponential binding bound in Eq. (64) is not established. Because the reader's weakest assumption identified exactly this step and I find no independent evidence in the paper repairing it, I agree with the REJECT verdict. The concern is internal to the proof, not a disagreement with any external consensus, and the test above would settle it by exhibiting the counting failure at s=1, ℓ_min=4.","tokens_in":18029,"tokens_out":23417,"duration_ms":217915,"concrete_test":"Concrete check: instantiate s=1, ℓ_min=4, t=8, and choose J to be the four value-bit positions of f2(x) (so J has size 4). Fix x and v=f2(x)_J. For each y∈{0,1}^4, define z(y) by setting its J-substring to y and, for each qubit where y differs from v, flipping the corresponding basis bit of f2(x). Then z(y) has nonzero BB84 overlap with f2(x), and Bob's Step 10 accepts it with probability 2^{-wt(y⊕v)} > 0. Thus the acceptance relation R_x contains all 16 strings y, so |S|=16 while 2^s=2. This directly contradicts the |S|≤2^s assertion used in Eq. (58). Recomputing Lemma 3 with this S yields ||P+Q|| ≤ 1+2^{ℓ_min/2} (not the claimed 1+2^{(2s−ℓ_min)/2}); the paper's binding bound is not derived. If the authors object that large wt(y⊕v) gives negligible acceptance probability, the burden is on them to define a threshold and redo the proof with the resulting weights.","verdict_should_be":"UNCHANGED","load_bearing_attack":"The binding proof's load-bearing step is in Lemma 3 (Eqs. 54–58): R_x is treated as an acceptance relation with at most one accepted output string z for each verifier string a, giving |S| ≤ 2^s and hence ||P+Q|| ≤ 1 + 2^{(2s−ℓ_min)/2}. This treatment is inconsistent with the protocol's own Step 10. Bob's Step 10 is the two-outcome measurement {|ψ_z⟩⟨ψ_z|, I−|ψ_z⟩⟨ψ_z|} on the state returned by the locked HLPUF. For a fixed a=f1(x), the returned state is |ψ_{f2(x)}⟩, and any z whose BB84 encoding differs from f2(x) on a basis bit is accepted with probability 1/2; strings differing on w basis bits are accepted with probability 2^{-w}. Thus there are exponentially many z accepted with non-negligible probability for a single a, so the claimed 'at most one z per a' is false under any nonzero-probability reading. If R_x is instead read as 'accepts with probability 1,' then R_x contains essentially only (f1(x), f2(x)), but Theorem 6's reduction then omits legitimate partial-acceptance openings: a cheating Alice can send z that agrees with f2(x) on J and differs outside J, so Step 11 accepts with certainty while Step 10 accepts with probability 1/2; such contributions are not accounted for by S. In either reading the proof does not establish the operator-norm bound, and with s=ℓ_min/4 the failure is exponential. Since Theorem 6 is the basis for both the bit-commitment and coin-flipping claims, the central result is unsupported.","agreement_with_reader":"agree"},"referee_report":{"model":"deepseek-v4-flash","summary":"The paper proposes a statistically secure bit-commitment protocol (Protocol 1) built from an asymmetric Hybrid Locked PUF. Alice commits to a bit by BB84-encoding a substring f2(x0)_J of an HLPUF response, with the encoding basis chosen from one of two challenges produced by Algorithm 1. The hiding claim rests on an intrinsic ensemble-symmetry argument (Lemma 2, Theorem 5), and the binding claim rests on an operator-norm bound for the sum of acceptance projectors (Lemma 3, Theorem 6), giving eps_bind <= 2^{(2s-l_min)/2} = 2^{-l_min/4} with s = l_min/4. The paper also gives a black-box coin-flipping protocol (Protocol CF) with bias bounded by max{eps_forge, 2^{-l_min/4}}. The constructive Algorithm 1 and the explicit feasibility and query-complexity analysis are useful, but the central binding proof is not sound.","tokens_in":18468,"tokens_out":15129,"duration_ms":140964,"significance":"If the security proofs were correct, this would be a significant result: it would supply the first mistrustful two-party cryptographic primitive from hybrid hardware assumptions, avoiding bounded- or noisy-storage restrictions and offering a concrete implementation route. The paper's constructive challenge-generation subroutine, with its high-probability feasibility and query-complexity bounds, and the black-box coin-flipping reduction, are genuine contributions. However, the advertised statistical binding guarantee is unsupported because the main proof assumes a one-to-one acceptance relation that the protocol's own verification step does not satisfy. Since binding is the central technical claim, the significance of the paper as it stands is substantially reduced.","major_comments":[{"comment":"","section":"Section IV, Lemma 3 (Eqs. (54)-(63)); Protocol 1, Step 10"},{"comment":"","section":"Section IV, Lemma 2 and Proposition 1(iv)"},{"comment":"","section":"Section III A, Assumption 3"}],"minor_comments":[{"comment":"","section":"Section II B, Definitions 1-2"},{"comment":"","section":"Section II A, Eq. (3)"},{"comment":"","section":"Section III B"},{"comment":"","section":"Protocol 1"},{"comment":"","section":"Proposition 1 and Lemma 1"}],"recommendation":"reject","confidential_remarks":"The paper depends heavily on the authors' own prior HLPUF result [22] for the central unforgeability assumption, while introducing an asymmetric variant with a new interface. If the authors can replace Lemma 3's acceptance-relation assumption with a sound argument, the result could be worth reconsidering; as it stands, the binding claim is not established and the failure is in the core security parameter. The topic is within scope for a quantum-cryptography journal, but I do not see a local fix that preserves the claimed protocol and bound."},"author_rebuttal":null,"desk_editor":{"model":"deepseek-v4-flash","letter":"You should know this paper before the weekend: it has a genuinely new idea, and one load-bearing proof gap that kills the main claim as written. The construction—an asymmetric HLPUF split into a short verifier part and a longer payload part, with a balanced challenge-pair generation algorithm—is a real step beyond previous uses of HLPUFs for authentication and key generation. Applying it to mistrustful two-party tasks is novel, and the challenge-generation analysis (feasibility, query complexity) is careful. The hiding proof is also clean: given the uniform payload distribution from Algorithm 1, the two commit states are perfectly indistinguishable unless Bob can forge a verifier state, which is bounded by the HLPUF unforgeability assumption. That part holds up.\n\nThe problem is Lemma 3, which is the entire basis for binding. The proof defines R_x as an acceptance relation with at most one accepted output string z per verifier string a, giving |S| ≤ 2^s. But Step 10 of the protocol is a projective measurement, not a deterministic filter. For a returned state |ψ_{f2(x)}⟩, any z whose encoding differs from f2(x) on w basis-value bits is accepted with probability 2^{-w}. So for a single verifier string a, there are exponentially many z accepted with non-negligible probability, and |S| ≤ 2^s is simply false. If you instead read R_x as “accepts with probability 1,” then only the exact (f1(x), f2(x)) pair is included, but then the proof systematically ignores the legitimate openings where Alice sends a z that passes Step 11 but only passes Step 10 with probability 1/2. Either reading breaks the operator-norm bound, and Theorem 6 collapses. Since binding is the whole point of a commitment scheme, the coin-flipping protocol built on top inherits the same gap.\n\nThis is not a minor fix-up. The bound 2^{(2s−ℓ_min)/2} is the only thing connecting the hardware parameters to the cheating probability, and with s = ℓ_min/4 it is exponentially small but no longer derived from the protocol. The reliance on [22] for unforgeability is fine as an external assumption; that is not the issue.\n\nFor a reader: this is a good case study in how a plausible-looking operator-norm argument can break on a subtle mischaracterization of a quantum measurement. The hiding side and the algorithm analysis are worth reading. But the central result should not be trusted.\n\nMy recommendation: do not accept as is, but do send it to a serious referee. The idea is novel enough and the flaw specific enough that expert eyes might see whether a corrected acceptance-relation argument can rescue the bound. This deserves a real review, not a desk reject.","headline":"A genuinely new hardware-token commitment protocol whose hiding proof is clean, but the binding proof rests on a false acceptance-relation assumption and the central result does not hold as written.","tokens_in":18895,"tokens_out":2580,"would_cite":false,"duration_ms":25576,"reading_group":"maybe","serious_thinker":"yes","would_accept_peer_review":true},"rs_alignment":null,"lean_confirmation":null,"pith_extraction":{"msc":["81P94","94A60"],"pacs":["03.67.Dd","03.67.Hk"],"model":"deepseek-v4-flash","headline":"The paper claims to construct statistically secure bit commitment and coin flipping from hybrid locked physical unclonable functions, a hardware primitive that evades the quantum no-go theorem under hardware assumptions.","keywords":["bit commitment","coin flipping","hybrid locked PUF","physical unclonable function","quantum cryptography","statistical security","BB84 encoding","hardware security"],"falsifier":"Fix a public challenge pair and a verifier string $a$, then enumerate the payload strings $z$ that pass the Step-10 projective test with non-negligible probability; if more than one such $z$ exists for a single $a$, the $|S|\\le 2^s$ count used in the binding proof does not follow and the claimed $\\epsilon_{\\rm bind}$ would need a different argument.","tokens_in":17881,"feed_emoji":"🔐","tokens_out":11973,"duration_ms":91013,"temperature":0.7,"pith_summary":"The paper claims to construct the first statistically secure bit-commitment scheme that does not restrict the adversary's quantum memory or computing power, by relying instead on a hardware assumption: a classically unclonable device locked behind a quantum verification interface. The protocol makes Alice's commitment state depend on a challenge–response pair of an asymmetric hybrid locked PUF, with the bit concealed in the choice of BB84 basis pattern generated by a careful alternative-challenge algorithm. The authors prove statistical hiding by bounding the trace distance between the two commit ensembles by the PUF's unforgeability parameter, and statistical binding by an operator-norm bound on the sum of the acceptance projectors. They then build a strong coin-flipping protocol on top of the commitment in a black-box way. If correct, the result opens a new route to mistrustful two-party cryptography in quantum networks using off-the-shelf hardware.","feed_headline":"Hybrid hardware tokens yield statistically secure bit commitment","feed_subtitle":"First mistrustful two-party protocol from locked PUFs; also gives a coin-flipping protocol.","key_machinery":"The load-bearing object is the asymmetric hybrid locked PUF: a classical PUF whose output is split into a verifier part $f_1(x)$ of length $s$ and a payload part $f_2(x)$ of length $t$, with only the payload encoded into BB84 states and released through a locked interface only after the verifier state $|\\psi^{f_1(x)}\\rangle$ is supplied. The commitment state is $\\rho_b = |f_2(x_0)_J\\rangle\\langle f_2(x_0)_J|_{\\beta(x_b)}$, where $J$ is an ordered set of $\\ell_{\\min}$ indices chosen by Algorithm 1, which flips bits of the base challenge $x_0$ to produce an alternative challenge $x_1$ with balanced values and bases and verifier states of small overlap. The security proofs use two mechanisms: the intrinsic ensemble symmetry of the generated challenges to prove perfect hiding of the honest ensembles, and an operator-norm bound $\\|P+Q\\|_\\infty \\le 1+2^{(2s-\\ell_{\\min})/2}$ on the sum of acceptance projectors to prove binding against arbitrary coherent cheating strategies.","core_discovery":"The central claim is that Protocol 1 is an $\\epsilon_{\\rm hide}$-hiding and $\\epsilon_{\\rm bind}$-binding bit-commitment protocol, with $\\epsilon_{\\rm hide}\\le \\epsilon_{\\rm forge}$ (Theorem 5) and $\\epsilon_{\\rm bind}\\le 2^{(2s-\\ell_{\\min})/2}$ (Theorem 6), where $s$ is the length of the verifier part of the hardware response, $\\ell_{\\min}$ is the length of the committed payload substring, and $\\epsilon_{\\rm forge}$ is the unforgeability of the asymmetric hybrid locked PUF. Under Assumptions 1–3, this gives statistical security with no bound on the adversary's storage. The paper further derives a coin-flipping protocol with bias at most $\\frac{1}{2}\\max\\{\\epsilon_{\\rm forge}, 2^{-\\ell_{\\min}/4}\\}$. This is, to the authors' knowledge, the first mistrustful two-party protocol built from hybrid hardware modules.","pith_inferences":["A natural next step is to formalise and prove the early-measurement variant; if it retains statistical security, the protocol becomes implementable with only classical storage at the receiver.","The modular operator-norm proof technique could be adapted to other hardware assumptions, such as quantum-secure classical PUFs or trusted platform modules, as long as the acceptance relation keeps the same counting structure.","The binding bound improves as the verifier length $s$ grows relative to the committed payload length $\\ell_{\\min}$; a concrete parameter optimisation would trade this against the expected query complexity of the challenge-generation algorithm.","If the HLPUF unforgeability parameter is negligible in practice, the coin-flip bias is dominated by $2^{-\\ell_{\\min}/4}$, so choosing $\\ell_{\\min}$ large enough yields near-ideal coin flipping under the same hardware assumptions."],"forward_implications":["If the construction is sound, statistically secure bit commitment becomes achievable in a non-relativistic, non-storage-restricted setting, provided a tamper-proof locked PUF can be manufactured and the stated assumptions hold.","The coin-flipping protocol inherits the hiding and binding parameters, giving a bias bound $\\delta_{\\rm CF} \\le \\frac{1}{2}\\max\\{\\epsilon_{\\rm forge}, 2^{-\\ell_{\\min}/4}\\}$.","The challenge-generation algorithm runs in expected $2+e^{-\\Omega(s)}$ queries, so the scheme has a concrete and efficient implementation route rather than being merely existential.","A variant with early measurement by Bob removes the need for quantum memory during the protocol, at the cost of a weaker security parameter, as the authors note for future work.","The asymmetric split between verifier and payload suggests a generic template for converting device-based authentication primitives into mistrustful two-party primitives, potentially extending to string commitment and oblivious transfer."],"supporting_citations":[{"why":"It supplies the HLPUF construction, the locking mechanism, and the unforgeability assumption that Protocol 1 relies on.","marker":"[22]"},{"why":"It establishes the impossibility of unconditionally secure quantum bit commitment, motivating the hardware-assumption route.","marker":"[3]"},{"why":"It provides the companion impossibility result that rules out unconditional commitments in the plain model.","marker":"[4]"},{"why":"It introduces quantum PUFs, the precursor of the hybrid hardware primitive used here.","marker":"[21]"},{"why":"It shows how storage restrictions enable information-theoretic two-party cryptography, the conceptual template the paper extends to hardware assumptions.","marker":"[12]"},{"why":"It provides the weak-binding security definition adopted for quantum commitments.","marker":"[27]"}],"fun_headline_variants":["Hybrid PUFs secure bit commitment","Statistical bit commitment from locked hardware","Hardware tokens enable secure coin flipping","First hardware-based two-party protocol from PUFs","Quantum hardware gives statistically secure bit commitment"],"cache_read_input_tokens":3200,"weakest_assumption_plain":"The proof assumes that for every verifier string supplied to the locked device, the acceptance test in effect permits only one output string to open successfully, which is what keeps the set of accepted openings small enough for the operator-norm bound.","fun_headline_variants_meta":{"raw":{"variants":["Hybrid PUFs secure bit commitment","Statistical bit commitment from locked hardware","Hardware tokens enable secure coin flipping","First hardware-based two-party protocol from PUFs","Quantum hardware gives statistically secure bit commitment"]},"model":"deepseek-v4-flash","effort":"low","cost_usd":0.000236,"raw_usage":{"total_tokens":1478,"prompt_tokens":892,"completion_tokens":586,"prompt_tokens_details":{"cached_tokens":384},"prompt_cache_hit_tokens":384,"prompt_cache_miss_tokens":508,"completion_tokens_details":{"reasoning_tokens":524}},"tokens_in":508,"tokens_out":586,"duration_ms":6228,"temperature":1.0,"reasoning_tokens":524,"cache_read_input_tokens":384,"cache_creation_input_tokens":0},"cache_creation_input_tokens":0},"created_at":"2026-08-12T04:26:35.982342+00:00","model_set":{"reader":"deepseek-v4-flash"},"falsifier":"Fix a public challenge pair and a verifier string $a$, then enumerate the payload strings $z$ that pass the Step-10 projective test with non-negligible probability; if more than one such $z$ exists for a single $a$, the $|S|\\le 2^s$ count used in the binding proof does not follow and the claimed $\\epsilon_{\\rm bind}$ would need a different argument.","supporting_citations":[{"cited_title":"Vidick and S","cited_arxiv_id":null,"evidence_quote":"It supplies the HLPUF construction, the locking mechanism, and the unforgeability assumption that Protocol 1 relies on."},{"cited_title":"Commit phase:The commitment is a bitb∈ {0,1}","cited_arxiv_id":null,"evidence_quote":"It establishes the impossibility of unconditionally secure quantum bit commitment, motivating the hardware-assumption route."},{"cited_title":null,"cited_arxiv_id":null,"evidence_quote":"It provides the companion impossibility result that rules out unconditional commitments in the plain model."},{"cited_title":"Lo and H","cited_arxiv_id":null,"evidence_quote":"It introduces quantum PUFs, the precursor of the hybrid hardware primitive used here."},{"cited_title":"If this test rejects, he rejects the opening","cited_arxiv_id":null,"evidence_quote":"It shows how storage restrictions enable information-theoretic two-party cryptography, the conceptual template the paper extends to hardware assumptions."},{"cited_title":"Unruh, Computationally binding quantum commitments, inAdvances in Cryptology — EUROCRYPT 2016, Part II, Lecture Notes in Computer Science, Vol","cited_arxiv_id":null,"evidence_quote":"It provides the weak-binding security definition adopted for quantum commitments."}],"review_version":1}