The cryptographic protocol of coin tossing consists of two parties, Alice and Bob, that do not trust each other, but want to generate a random bit. If the parties use a classical communication channel and have unlimited computational resources, one of them can always cheat perfectly. Here we analyze in detail how the performance of a quantum coin tossing experiment should be compared to classical protocols, taking into account the inevitable experimental imperfections. We then report an all-optical fiber experiment in which a single coin is tossed whose randomness is higher than achievable by any classical protocol and present some easily realisable cheating strategies by Alice and Bob.
We show that a secure quantum protocol for coin tossing exist. The existence of quantum coin tossing support the conjecture of D.Mayers [Phys.Rev.Lett. 78, 3414(1997)] that only asymmetrical tasks as quantum bit commitment are impossible.
We suggest an attack on a symmetric non-ideal quantum coin-tossing protocol suggested by Mayers Salvail and Chiba-Kohno. The analysis of the attack shows that the protocol is insecure.
A relativistic quantum information exchange protocol is proposed allowing two distant users to realize ``coin tossing'' procedure. The protocol is based on the point that in relativistic quantum theory reliable distinguishing between the two orthogonal states generally requires a finite time depending on the structure of these states.
We review the quantum version of a well known problem of cryptography called coin tossing (``flipping a coin via telephone''). It can be regarded as a game where two remote players (who distrust each other) tries to generate a uniformly distributed random bit which is common to both parties. The only resource they can use to perform this task is a classical or quantum communication channel. In this paper we provide a general overview over such coin tossing protocols, concerning in particular their security.
An unconditionally secure quantum cion tossing protocol for two remote participants via entangled swapping is presented. The security of this protocol is guaranteed by the nonlocal property of quantum entanglement and the classical complexity.
In this letter we present the first implementation of a quantum coin tossing protocol. This protocol belongs to a class of ``two-party'' cryptographic problems, where the communication partners distrust each other. As with a number of such two-party protocols, the best implementation of the quantum coin tossing requires qutrits. In this way, we have also performed the first complete quantum communication protocol with qutrits. In our experiment the two partners succeeded to remotely toss a row of coins using photons entangled in the orbital angular momentum. We also show the experimental bound…
There had been well known claims of ``provably unbreakable'' quantum protocols for bit commitment and coin tossing. However, we, and independently Mayers, showed that all proposed quantum bit commitment (and therefore coin tossing) schemes are, in principle, insecure because the sender, Alice, can always cheat successfully by using an EPR-type of attack and delaying her measurements. One might wonder if secure quantum bit commitment and coin tossing protocols exist at all. Here we prove that an EPR-type of attack by Alice will, in principle, break {\em any} realistic quantum bit commitment and…
In the literature, strong coin tossing protocols based on bit commitment have been proposed. Here we examine a protocol that instead tries to achieve the task by sharing entanglement securely. The protocol uses only qubits, and has bias 1/4. This is equal to the best known bias for bit commitment based schemes.
We discuss the security implications of noise for quantum coin tossing protocols. We find that if quantum error correction can be used, so that noise levels can be made arbitrarily small, then reasonable security conditions for coin tossing can be framed so that results from the noiseless case will continue to hold. If, however, error correction is not available (as is the case with present day technology), and significant noise is present, then tossing a single coin becomes problematic. In this case, we are led to consider random n-bit string generation in the presence of noise, rather than s…
In coin tossing two remote participants want to share a uniformly distributed random bit. At the least in the quantum version, each participant test whether or not the other has attempted to create a bias on this bit. It is requested that, for b = 0,1, the probability that Alice gets bit b and pass the test is smaller than 1/2 whatever she does, and similarly for Bob. If the bound 1/2 holds perfectly against any of the two participants, the task realised is called an exact coin tossing. If the bound is actually $1/2 + ξ$ where the bias $ξ$ vanishes when a security parameter m defined by the pr…
The relativistic quantum protocols realizing the bit commitment and distant coin tossing schemes are proposed. The protocols are based on the fact that the non-stationary orthogonal extended quantum states cannot be reliably distinguished if they are not fully accessible for the measurement. As the states propagate from the domain controlled by one of the user to the domain accessible for the measurements performed by the other user, they become reliably distinguishable for the second user. Important for the protocol are both the quantum nature of the states and the existence of a finite maxim…
We define cryptographic assumptions applicable to two mistrustful parties who each control two or more separate secure sites between which special relativity guarantees a time lapse in communication. We show that, under these assumptions, unconditionally secure coin tossing can be carried out by exchanges of classical information. We show also, following Mayers, Lo and Chau, that unconditionally secure bit commitment cannot be carried out by finitely many exchanges of classical or quantum information. Finally we show that, under standard cryptographic assumptions, coin tossing is strictly weak…
Quantum coin tossing (QCT) is an important primitive of quantum cryptography and has received continuous interest. However, in practical QCT, Bob's detectors can be subjected to detector-side channel attacks launched by dishonest Alice, which will possibly make the protocol completely insecure. Here, we report a simple strategy of a detector-blinding attack based on a recent experiment. To remove all the detector side channels, we present a solution of measurement-device-independent QCT (MDI-QCT). This method is similar to the idea of MDI quantum key distribution (QKD). MDI-QCT is loss toleran…
It is well-known that pure quantum states are typically almost maximally entangled, and thus have close to maximally mixed subsystems. We consider whether this is true for probabilistic theories more generally, and not just for quantum theory. We derive a formula for the expected purity of a subsystem in any probabilistic theory for which this quantity is well-defined. It applies to typical entanglement in pure quantum states, coin tossing in classical probability theory, and randomization in post-quantum theories; a simple generalization yields the typical entanglement in (anti)symmetric quan…
There had been well known claims of unconditionally secure quantum protocols for bit commitment. However, we, and independently Mayers, showed that all proposed quantum bit commitment schemes are, in principle, insecure because the sender, Alice, can almost always cheat successfully by using an Einstein-Podolsky-Rosen (EPR) type of attack and delaying her measurements. One might wonder if secure quantum bit commitment protocols exist at all. We answer this question by showing that the same type of attack by Alice will, in principle, break any bit commitment scheme. The cheating strategy genera…
When elementary quantum systems, such as polarized photons, are used to transmit digital information, the uncertainty principle gives rise to novel cryptographic phenomena unachievable with traditional transmission media, e.g. a communications channel on which it is impossible in principle to eavesdrop without a high probability of disturbing the transmission in such a way as to be detected. Such a quantum channel can be used in conjunction with ordinary insecure classical channels to distribute random key information between two users with the assurance that it remains unknown to anyone else,…
Joint Institute for Nuclear Research（联合核研究所）；Universidade de São Paulo（圣保罗大学）
The procedure of tossing quantum coins and dice is described. This case is an important example of a quantum procedure because it presents a typical framework employed in quantum information processing and quantum computing. The emphasis is on the clarification of the difference between quantum and classical conditional probabilities. These probabilities are designed for characterizing different systems, either quantum or classical, and they, generally, cannot be reduced to each other. Thus the Lüders probability cannot be treated as a generalization of the classical conditional probability. T…
A significant branch of classical cryptography deals with the problems which arise when mistrustful parties need to generate, process or exchange information. As Kilian showed a while ago, mistrustful classical cryptography can be founded on a single protocol, oblivious transfer, from which general secure multi-party computations can be built. The scope of mistrustful quantum cryptography is limited by no-go theorems, which rule out, inter alia, unconditionally secure quantum protocols for oblivious transfer or general secure two-party computations. These theorems apply even to protocols which…
Alice is a charismatic quantum cryptographer who believes her parties are unmissable; Bob is a (relatively) glamorous string theorist who believes he is an indispensable guest. To prevent possibly traumatic collisions of self-perception and reality, their social code requires that decisions about invitation or acceptance be made via a cryptographically secure variable bias coin toss (VBCT). This generates a shared random bit by the toss of a coin whose bias is secretly chosen, within a stipulated range, by one of the parties; the other party learns only the random bit. Thus one party can secre…
Coin tossing is a cryptographic task in which two parties who do not trust each other aim to generate a common random bit. Using classical communication this is impossible, but non trivial coin tossing is possible using quantum communication. Here we consider the case when the parties do not want to toss a single coin, but many. This is called bit string generation. We report the experimental generation of strings of coins which are provably more random than achievable using classical communication. The experiment is based on the ``plug and play'' scheme developed for quantum cryptography, and…
After a general introduction, the thesis is divided into four parts. In the first, we discuss the task of coin tossing, principally in order to highlight the effect different physical theories have on security in a straightforward manner, but, also, to introduce a new protocol for non-relativistic strong coin tossing. This protocol matches the security of the best protocol known to date while using a conceptually different approach to achieve the task. In the second part variable bias coin tossing is introduced. This is a variant of coin tossing in which one party secretly chooses one of two b…
The security of quantum communication using a weak coherent source requires an accurate knowledge of the source's mean photon number. Finite calibration precision or an active manipulation by an attacker may cause the actual emitted photon number to deviate from the known value. We model effects of this deviation on the security of three quantum communication protocols: the Bennett-Brassard 1984 (BB84) quantum key distribution (QKD) protocol without decoy states, Scarani-Acin-Ribordy-Gisin 2004 (SARG04) QKD protocol, and a coin-tossing protocol. For QKD, we model both a strong attack using tec…
We investigate sampling procedures that certify that an arbitrary quantum state on $n$ subsystems is close to an ideal mixed state $φ^{\otimes n}$ for a given reference state $φ$, up to errors on a few positions. This task makes no sense classically: it would correspond to certifying that a given bitstring was generated according to some desired probability distribution. However, in the quantum case, this is possible if one has access to a prover who can supply a purification of the mixed state. In this work, we introduce the concept of mixed-state certification, and we show that a natural sam…
A long sequence of tosses of a classical coin produces an apparently random bit string, but classical randomness is an illusion: the algorithmic information content of a classically-generated bit string lies almost entirely in the description of initial conditions. This letter presents a simple argument that, by contrast, a sequence of bits produced by tossing a quantum coin is, almost certainly, genuinely (algorithmically) random. This result can be interpreted as a strengthening of Bell's no-hidden-variables theorem, and relies on causality and quantum entanglement in a manner similar to Bel…
We present a two-party protocol for quantum gambling, a new task closely related to coin tossing. The protocol allows two remote parties to play a gambling game, such that in a certain limit it becomes a fair game. No unconditionally secure classical method is known to accomplish this task.
We devise a protocol to build 1D time-dependent quantum walks in 1D maximizing the spatial spread throughout the procedure. We allow only one of the physical parameters of the coin-tossing operator to vary, i.e. the angle $θ$, such that for $θ=0$ we have the $\hatσ_z$, while for $θ=π/4$ we obtain the Hadamard gate. The optimal $θ$ sequences present non-trivial patterns, with mostly $θ\approx 0$ alternated with $θ\approx π/4$ values after increasingly long periods. We provide an analysis of the entanglement properties, quasi-energy spectrum and survival probability, providing a full physical pi…
Methods of quantum mechanics promise information-theoretic security for various protocols in cryptography. However, impossibility of some cryptographic applications such as standard bit commitment, oblivious transfer, multiparty secure computations and ideal coin tossing in quantum regime leaves an obvious question on the completeness of quantum cryptography. Instead of using wide range of rules and techniques for a variety of cryptographic applications, we demonstrate here a unified structure for quantum cryptography based on quantum non-local correlations. The unified framework achieves same…
For more than a decade, it was believed that unconditionally secure quantum bit commitment (QBC) is impossible. But basing on a previously proposed quantum key distribution scheme using orthogonal states, here we build a QBC protocol in which the density matrices of the quantum states encoding the commitment do not satisfy a crucial condition on which the no-go proofs of QBC are based. Thus the no-go proofs could be evaded. Our protocol is fault-tolerant and very feasible with currently available technology. It reopens the venue for other "post-cold-war" multi-party cryptographic protocols, e.…
The security of source has become an increasingly important issue in quantum cryptography. Based on the framework of measurement-device-independent quantum-key-distribution (MDI-QKD), the source becomes the only region exploitable by a potential eavesdropper (Eve). Phase randomization is a cornerstone assumption in most discrete-variable (DV-) quantum communication protocols (e.g., QKD, quantum coin tossing, weak coherent state blind quantum computing, and so on), and the violation of such an assumption is thus fatal to the security of those protocols. In this paper, we show a simple quantum h…
Bit commitment is a fundamental cryptographic task that guarantees a secure commitment between two mutually mistrustful parties and is a building block for many cryptographic primitives, including coin tossing, zero-knowledge proofs, oblivious transfer and secure two-party computation. Unconditionally secure bit commitment was thought to be impossible until recent theoretical protocols that combine quantum mechanics and relativity were shown to elude previous impossibility proofs. Here we implement such a bit commitment protocol. In the experiment, the committer performs quantum measurements u…
We introduce a new kind of expectation transformer for a mixed classical-quantum programming language. Our semantic approach relies on a new notion of a cost structure, which we introduce and which can be seen as a specialisation of the Kegelspitzen of Keimel and Plotkin. We show that our weakest precondition analysis is both sound and adequate with respect to the operational semantics of the language. Using the induced expectation transformer, we provide formal analysis methods for the expected cost analysis and expected value analysis of classical-quantum programs. We illustrate the usefulne…
Non-equilibrium photon correlations of coherently excited single quantum systems can reveal their internal quantum dynamics and provide spectroscopic access. Here we propose and discuss the fundamentals of a coherent photon coincidence spectroscopy based on the application of laser pulses with variable delay and the detection of an time-averaged two-photon coincidence rate. For demonstration, two simple but important cases, i.e., an exciton - biexciton in a quantum dot and two coupled quantum emitters, are investigated based on quantum dynamics simulations demonstrating that this nonlinear spe…
In [1] the authors claim that "weak values are not inherently quantum but rather a purely statistical feature". I argue that their model reproduces only few elements of weak measurements but fails to reproduce all the other intrinsically quantum features.
We consider the cryptographic task of bit-string generation. This is a generalisation of coin tossing in which two mistrustful parties wish to generate a string of random bits such that an honest party can be sure that the other cannot have biased the string too much. We consider a quantum protocol for this task, originally introduced in Phys. Rev. A {\bf 69}, 022322 (2004), that is feasible with present day technology. We introduce security conditions based on the average bias of the bits and the Shannon entropy of the string. For each, we prove rigorous security bounds for this protocol in b…
We show that the phenomenon of anomalous weak values is not limited to quantum theory. In particular, we show that the same features occur in a simple model of a coin subject to a form of classical backaction with pre- and post-selection. This provides evidence that weak values are not inherently quantum, but rather a purely statistical feature of pre- and post-selection with disturbance.
Multi-dimensional quantum walks usually require large coin spaces. Here we show that the non-localized case of the spatial density probability of the two-dimensional Grover walk can be obtained using only a two-dimensional coin space and a quantum walk in alternate directions. We present a formal proof of this correspondence and analyze the behavior of the coin-position entanglement as well as the x-y spatial entanglement in our scheme with respect to the Grover one. We show that our experimentally simpler scheme allows to entangle the two orthogonal directions of the walk more efficiently.
Ferrie and Combes [PRL 113 120404 (2014)] produce a classical measurement scheme that supposedly exhibits `anomalous' weak values. I show that their model is flawed due to an incorrect definition of the weak value. As a consequence their claims are invalid.
In a recent Letter [PRL 113, 120404 (2014)] Ferrie and Combes claimed to show "that weak values are not inherently quantum, but rather a purely statistical feature of pre- and post-selection with disturbance." In this Comment I will show that this claim is not valid. It follows from Ferrie and Combes misunderstanding of the concept of weak value.
The "anomalous" values of C. Ferrie and J. Combes in Phys. Rev. Lett. 113, 120404 (2014) say nothing about quantum - or even classical - physics. They are not analogues of the weak values that emerge when we describe the quantum world via an initial state evolving forwards in time and a final state evolving backwards in time, and couple this world weakly to realistic measuring devices.
The authors of a recent paper [Phys. Rev. Lett. 113, 120404 (2014)] suggest that "weak values are not inherently quantum but rather a purely statistical feature of pre- and postselection with disturbance". We argue that this claim is erroneous, since such values require averaging with distributions which change sign. This type of averaging arises naturally in quantum mechanics, but may not occur in classical statistics.
Weak coin flipping is among the fundamental cryptographic primitives which ensure the security of modern communication networks. It allows two mistrustful parties to remotely agree on a random bit when they favor opposite outcomes. Unlike other two-party computations, one can achieve information-theoretic security using quantum mechanics only: both parties are prevented from biasing the flip with probability higher than $1/2+ε$, where $ε$ is arbitrarily low. Classically, the dishonest party can always cheat with probability $1$ unless computational assumptions are used. Despite its importance,…
In most widely discussed discrete time quantum walk model, after every unitary shift operator, the particle evolves into the superposition of position space and settles down in one of its basis states, loosing entanglement in the coin space in the new position. The Hadamard operation is applied to let the particle to evolve into the superposition in the coin space and the walk is iterated. We present a model with a additional degree of freedom for the unitary shift operator $U^{\prime}$. The unitary operator with additional degree of freedom will evolve the quantum particle into superposition …
One of the proposals for the exploitation of two-dimensional quantum walks has been the efficient generation of entanglement. Unfortunately, the technological effort required for the experimental realization of standard two-dimensional quantum walks is significantly demanding. In this respect, an alternative scheme with less challenging conditions has been recently studied, particularly in terms of spatial-entanglement generation [C. Di Franco, M. Mc Gettrick, and Th. Busch, Phys. Rev. Lett. 106, 080502 (2011)]. Here, we extend the investigation to a scenario where a measurement is performed o…
A fundamental task in modern cryptography is the joint computation of a function which has two inputs, one from Alice and one from Bob, such that neither of the two can learn more about the other's input than what is implied by the value of the function. In this Letter, we show that any quantum protocol for the computation of a classical deterministic function that outputs the result to both parties (two-sided computation) and that is secure against a cheating Bob can be completely broken by a cheating Alice. Whereas it is known that quantum protocols for this task cannot be completely secure,…
In this paper, we present a semi-loss-tolerant strong quantum coin-flipping (QCF) protocol with the best bias of 0.3536. Our manuscript applies Quantum non-demolition (QND) measurement to quantum coin-flipping protocol. Furthermore, a single photon as a single qubit is used to avoid the difficult implementation of EPR resources. We also analyze the security of our protocol obtaining the best result among all coin-flipping protocols considering loss. A semi-loss-tolerant Quantum Dice Rolling (QDR) protocol is first proposed, and the security of corresponding three-party QDR is analyzed to bette…
We have recently proposed a two-dimensional quantum walk where the requirement of a higher dimensionality of the coin space is substituted with the alternance of the directions in which the walker can move [C. Di Franco, M. Mc Gettrick, and Th. Busch, Phys. Rev. Lett. {\bf 106}, 080502 (2011)]. For a particular initial state of the coin, this walk is able to perfectly reproduce the spatial probability distribution of the non-localized case of the Grover walk. Here, we present a more detailed proof of this equivalence. We also extend the analysis to other initial states, in order to provide a m…
So far, most of existed single-shot quantum coin flipping(QCF) protocols failed in a noisy quantum channel. Here, we present a nested-structured framework that makes it possible to achieve partially noise-tolerant QCF, due to that there is a trade-off between the security and the justice correctness. It is showed that noise-tolerant single-shot QCF protocols can be produced by filling the presented framework up with existed or even future protocols. We also proved a lower bound of 0.25, with which a cheating Alice or Bob could bias the outcome.
We employ the broken-link model to create a barrier with slits in a two-dimensional lattice. The diffraction and interference patterns of the probability distribution of quantum walkers passing through the slits are analyzed. Simulations were performed using the main types of coins, and display diffraction and interference patterns that depend on the choice of coins.
Quantum walk research has mainly focused on evolutions due to repeated applications of time-independent unitary coin operators. However, the idea of controlling the single particle evolution using time-dependent unitary coins has still been a subject of multiple studies as it not only hosts interesting possibilities for quantum information processing but also opens a much richer array of phenomena including static and dynamic localizations. So far, such studies have been performed only for single quantum walkers. In case of multi-walker systems, time-dependent coins may generate measurable phe…
Robust and leakage-resilient device-independent oblivious transfer in MiniQCrypt
Centre for Quantum Technologies, Singapore（新加坡量子技术中心）；Department of Computer Science, National University of Singapore（新加坡国立大学计算机系）；MajuLab, UMI 3654, Singapore（新加坡UMI 3654 MajuLab）
A quantum board game is a multi-round protocol between a single quantum player against the quantum board. Molina and Watrous discovered quantum hedging. They gave an example for perfect quantum hedging: a board game with winning probability < 1, such that the player can win with certainty at least 1-out-of-2 quantum board games played in parallel. Here we show that perfect quantum hedging occurs in a cryptographic protocol - quantum coin flipping. For this reason, when cryptographic protocols are composed, hedging may introduce serious challenges into their analysis. We also show that hedging …
We develop a framework for solving the action of a three-channel passive optical interferometer on single-photon pulse inputs to each channel using SU(3) group-theoretic methods, which can be readily generalized to higher-order photon-coincidence experiments. We show that features of the coincidence plots vs relative time delays of photons yield information about permanents, immanants, and determinants of the interferometer SU(3) matrix.
