Protocol 2 Quantum Bit String Commitment with PUFs.

Message to be shared: $m=m_1\dots m_{2n}$.

Setup: Alice chooses a message size $2n$ and sends the value n to ${\mathcal{F}}_{EPR}$. The functionality prepares the state $|\psi \rangle ={⨂}_{i=1}^n|{\Psi }_{00}\rangle$ and sends the odd qubits to Alice and the even ones to Bob. Alice prepares the PUF ${\mathsf{H}}_1$.

Commitment phase: 1.To commit to a message m, Alice generates a uniformly random basis string $b\in {\{\{|0\rangle ,|1\rangle \},\{|+\rangle ,|-\rangle \}\}}^n$ such that b is a codeword of some pre-agreed code with minimum distance d and where $|+\rangle ={\displaystyle \frac{|0\rangle +|1\rangle }{\sqrt{2}}}$ and $|-\rangle ={\displaystyle \frac{|0\rangle -|1\rangle }{\sqrt{2}}}$. She measures each of her qubits i in the basis $b_i$, obtaining outcomes $O\in {\{0,1\}}^n$, and then sends Bob the PUF ${\mathsf{H}}_1$ and the string $c_1=m\oplus {\mathsf{H}}_1\left(b\right|O)$, where $b|O$ is the concatenation of b and O. Opening phase: 2.Alice sends the bases b and the outcomes O to Bob. 3.Bob measures each of his qubits i in the basis $b_i$, obtaining outcomes $O^{\prime }\in {\{0,1\}}^n$. If $O^{\prime }=O$, Bob accepts the opening. Otherwise, he rejects. He then calculates $m=c_1\oplus {\mathsf{H}}_1\left(b\right|O)$.