Short answer: Bit commitment is a cryptographic primitive in which one party commits to a bit and later reveals it, without being able to change it, while the other party cannot learn it early. In 1997 Dominic Mayers showed in Physical Review Letters that unconditionally secure quantum bit commitment is impossible, which he described as a severe setback for quantum cryptography. This is a theoretical result about protocols, and it limits what quantum methods can offer without extra assumptions.
What unconditional security means
Mayers' abstract says the claim of quantum cryptography has always been that it can provide protocols that are unconditionally secure, meaning the security does not depend on any restriction on the time, space or technology available to the cheaters. He shows this claim does not hold for any quantum bit commitment protocol. Because many cryptographic tasks use bit commitment as a basic primitive, he says the result implies a severe setback for quantum cryptography. His model encompasses all reasonable implementations of quantum bit commitment in which the participants have not met before, including those that use special relativity.
Earlier protocols that failed
An arXiv paper titled "The Trouble with Quantum Bit Commitment" discusses a 1993 protocol by Brassard, Crepeau, Jozsa and Langlois, called the BCJL protocol. It says Lo and Chau had explained how to break a family of quantum bit commitment schemes and claimed their attack applied to BCJL. The paper says the intuition behind that attack is correct and exposes a weakness common to all proposals of a certain kind, but BCJL does not fall in that category. Nevertheless BCJL is insecure, and the paper says the required attack and proof are more subtle. It claims to provide the first complete proof that BCJL is insecure.
The paper also quotes a concern from Lo and Chau that the security of other quantum protocols, for example oblivious transfer, remains to be examined, and calls this a serious concern because quantum oblivious transfer and many other quantum protocols depend on the security of bit commitment.
The impossibility result
The arXiv version of Mayers' paper adds the key condition. It shows that unconditionally secure bit commitment is impossible unless a computing device, such as a beam splitter or a quantum gate, can be simultaneously trusted by both participants. It says this encompasses any protocol based on the theory of special relativity. It notes that the BCJL protocol had been realized to be insecure in the fall of 1995, after which researchers tried to find a secure replacement. The proof assumes an initial state with registers set to a fixed state and no entanglement with the environment, and shows that no protocol starting this way is unconditionally secure unless the trusted-device condition holds. The author remarks that it is easy to build a secure protocol if the initial state is already the outcome of a bit commitment encoding, which is why the proof needs the assumption.
What this does not tell you
The result is about unconditional security of bit commitment. It does not say quantum key distribution is insecure, and it does not say commitments are impossible when security rests on computational assumptions or trusted devices. The sources here are from 1996 and 1997 and describe the state of the field then, and later work may refine the picture.
FAQ
What is bit commitment?
A protocol where one party commits to a bit and later reveals it, binding them to it while hiding it from the other party until then.
What did Mayers show?
That no quantum bit commitment protocol is unconditionally secure for parties who have not met before.
Does it break quantum key distribution?
No. It concerns bit commitment, which other protocols may depend on.
Why does it matter for other protocols?
Quantum oblivious transfer and many other protocols depend on bit commitment, per the BCJL paper.
Is there any way around it?
The arXiv version says it holds unless a device can be simultaneously trusted by both participants.
All field notes