We generalize the problem of coin flipping to more than two outcomes and parties. We term this problem dice rolling, and study both its weak and strong variants. We prove by construction that in quantum settings (i) weak N-sided dice rolling admits an arbitrarily small bias for any value of N, and (ii) two-party strong N-sided dice rolling saturates the corresponding generalization of Kitaev's bound for any value of N. In addition, we make use of this last result to introduce a family of optimal 2m-party strong n^m-sided dice rolling protocols for any value of m and n.
We introduce relativistic multi-party biased die rolling protocols, generalizing coin flipping to $M \geq 2$ parties and to $N \geq 2$ outcomes for any chosen outcome biases, and show them unconditionally secure. Our results prove that the most general random secure multi-party computation, where all parties receive the output and there is no secret input by any party, can be implemented with unconditional security. Our protocols extend Kent's [A. Kent, Phys. Rev. Lett. 83, 5382 (1999)] two-party unbiased coin flipping protocol, do not require any quantum communication, are practical to implem…
A coin is just a two sided dice. Recently, Mochon proved that quantum weak coin flipping with an arbitrarily small bias is possible. However, the use of quantum resources to allow N remote distrustful parties to roll an N-sided dice has yet to be addressed. In this paper we show that contrary to the classical case, N-sided dice rolling with arbitrarily small bias is possible for any N. In addition, we present a six-round three-sided dice rolling protocol, achieving a bias of 0.181, which incorporates weak imbalanced coin flipping.
In this paper, we present a semi-loss-tolerant strong quantum coin-flipping (QCF) protocol with the best bias of 0.3536. Our manuscript applies Quantum non-demolition (QND) measurement to quantum coin-flipping protocol. Furthermore, a single photon as a single qubit is used to avoid the difficult implementation of EPR resources. We also analyze the security of our protocol obtaining the best result among all coin-flipping protocols considering loss. A semi-loss-tolerant Quantum Dice Rolling (QDR) protocol is first proposed, and the security of corresponding three-party QDR is analyzed to bette…
How can two parties with competing interests carry out a fair coin flip, using only a noiseless quantum channel? This problem (quantum weak coin-flipping) was formalized more than 15 years ago, and, despite some phenomenal theoretical progress, practical quantum coin-flipping protocols with vanishing bias have proved hard to find. In the current work we show that there is a reason that practical weak quantum coin-flipping is difficult: any quantum weak coin-flipping protocol with bias $ε$ must use at least $\exp ( Ω(1/\sqrtε ))$ rounds of communication. This is a large improvement over the pre…
Coin-flipping is a fundamental cryptographic task where a spatially separated Alice and Bob wish to generate a fair coin-flip over a communication channel. It is known that ideal coin-flipping is impossible in both classical and quantum theory. In this work, we give a short proof that it is also impossible in generalized probabilistic theories under the Generalized No-Restriction Hypothesis. Our proof relies crucially on a formulation of cheating strategies as semi-infinite programs, i.e., cone programs with infinitely many constraints. This introduces a new formalism which may be of independe…
Coin flipping is a cryptographic primitive in which two distrustful parties wish to generate a random bit in order to choose between two alternatives. This task is impossible to realize when it relies solely on the asynchronous exchange of classical bits: one dishonest player has complete control over the final outcome. It is only when coin flipping is supplemented with quantum communication that this problem can be alleviated, although partial bias remains. Unfortunately, practical systems are subject to loss of quantum data, which restores complete or nearly complete bias in previous protoco…
In this paper, we present a loss-tolerant quantum strong coin flipping protocol with bias 0.359. This is an improvement over Berlin etal's protocol [BBBG08] which achieves a bias of 0.4. To achieve this, we extend Berlin et al.'s protocol by adding an encryption step that hides some information to Bob until he confirms that he successfully measured. We also show using numerical analysis that a we cannot improve this bias by considering a k-fold repetition of Berlin etal's protocol for k > 2.
We present a family of loss-tolerant quantum strong coin flipping protocols; each protocol differing in the number of qubits employed. For a single qubit we obtain a bias of 0.4, reproducing the result of Berlín et al. [Phys. Rev. A 80, 062321 (2009)], while for two qubits we obtain a bias of 0.3975. Numerical evidence based on semi-definite programming indicates that the bias continues to decrease as the number of qubits is increased but at a rapidly decreasing rate.
In this paper, we prove classical coin-flipping secure in the presence of quantum adversaries. The proof uses a recent result of Watrous [Wat09] that allows quantum rewinding for protocols of a certain form. We then discuss two applications. First, the combination of coin-flipping with any non-interactive zero-knowledge protocol leads to an easy transformation from non-interactive zero-knowledge to interactive quantum zero-knowledge. Second, we discuss how our protocol can be applied to a recently proposed method for improving the security of quantum protocols [DFL+09], resulting in an impleme…
So far, most of existed single-shot quantum coin flipping(QCF) protocols failed in a noisy quantum channel. Here, we present a nested-structured framework that makes it possible to achieve partially noise-tolerant QCF, due to that there is a trade-off between the security and the justice correctness. It is showed that noise-tolerant single-shot QCF protocols can be produced by filling the presented framework up with existed or even future protocols. We also proved a lower bound of 0.25, with which a cheating Alice or Bob could bias the outcome.
Performing complex cryptographic tasks will be an essential element in future quantum communication networks. These tasks are based on a handful of fundamental primitives, such as coin flipping, where two distrustful parties wish to agree on a randomly generated bit. Although it is known that quantum versions of these primitives can offer information-theoretic security advantages with respect to classical protocols, a demonstration of such an advantage in a practical communication scenario has remained elusive. Here, we experimentally implement a quantum coin flipping protocol that performs st…
In this article we show for the first time that quantum coin flipping with security guarantees that are strictly better than any classical protocol is possible to implement with current technology. Our protocol takes into account all aspects of an experimental implementation like losses, multi-photon pulses emitted by practical photon sources, channel noise, detector dark counts and finite quantum efficiency. We calculate the abort probability when both players are honest, as well as the probability of one player forcing his desired outcome. For channel length up to 21 km, we achieve a cheatin…
Weak coin flipping is among the fundamental cryptographic primitives which ensure the security of modern communication networks. It allows two mistrustful parties to remotely agree on a random bit when they favor opposite outcomes. Unlike other two-party computations, one can achieve information-theoretic security using quantum mechanics only: both parties are prevented from biasing the flip with probability higher than $1/2+ε$, where $ε$ is arbitrarily low. Classically, the dishonest party can always cheat with probability $1$ unless computational assumptions are used. Despite its importance,…
Die-rolling is the cryptographic task where two mistrustful, remote parties wish to generate a random $D$-sided die-roll over a communication channel. Optimal quantum protocols for this task have been given by Aharon and Silman (New Journal of Physics, 2010) but are based on optimal weak coin-flipping protocols which are currently very complicated and not very well understood. In this paper, we first present very simple classical protocols for die-rolling which have decent (and sometimes optimal) security which is in stark contrast to coin-flipping, bit-commitment, oblivious transfer, and many…
Coin flipping is a cryptographic primitive for which strictly better protocols exist if the players are not only allowed to exchange classical, but also quantum messages. During the past few years, several results have appeared which give a tight bound on the range of implementable unconditionally secure coin flips, both in the classical as well as in the quantum setting and for both weak as well as strong coin flipping. But the picture is still incomplete: in the quantum setting, all results consider only protocols with perfect correctness, and in the classical setting tight bounds for strong…
Coin flipping is a cryptographic primitive in which two spatially separated players, who in principle do not trust each other, wish to establish a common random bit. If we limit ourselves to classical communication, this task requires either assumptions on the computational power of the players or it requires them to send messages to each other with sufficient simultaneity to force their complete independence. Without such assumptions, all classical protocols are so that one dishonest player has complete control over the outcome. If we use quantum communication, on the other hand, protocols ha…
The problem of Hadamard quantum coin measurement in $n$ trials, with arbitrary number of repeated consecutive last states is formulated in terms of Fibonacci sequences for duplicated states, Tribonacci numbers for triplicated states and $N$-Bonacci numbers for arbitrary $N$-plicated states. The probability formulas for arbitrary position of repeated states are derived in terms of Lucas and Fibonacci numbers. For generic qubit coin, the formulas are expressed by Fibonacci and more general, $N$-Bonacci polynomials in qubit probabilities. The generating function for probabilities, the Golden Rati…
We investigate the global chirality distribution of the quantum walk on the line when decoherence is introduced either through simultaneous measurements of the chirality and particle position, or as a result of broken links. The first mechanism drives the system towards a classical diffusive behavior. This is used to build new quantum games, similar to the spin-flip game. The second mechanism involves two different possibilities: (a) All the quantum walk links have the same probability of being broken. (b) Only the quantum walk links on a half-line are affected by random breakage. In case (a) …
We propose a coin-flip protocol which yields a string of strong, random coins and is fully simulatable against poly-sized quantum adversaries on both sides. It can be implemented with quantum-computational security without any set-up assumptions, since our construction only assumes mixed commitment schemes which we show how to construct in the given setting. We then show that the interactive generation of random coins at the beginning or during outer protocols allows for quantum-secure realizations of classical schemes, again without any set-up assumptions. As example applications we discuss q…
We investigate weak coin flipping, a fundamental cryptographic primitive where two distrustful parties need to remotely establish a shared random bit. A cheating player can try to bias the output bit towards a preferred value. For weak coin flipping the players have known opposite preferred values. A weak coin-flipping protocol has a bias $ε$ if neither player can force the outcome towards their preferred value with probability more than $\frac{1}{2}+ε$. While it is known that all classical protocols have $ε=\frac{1}{2}$, Mochon showed in 2007 [arXiv:0711.4114] that quantumly weak coin flippin…
Leader election between n parties is known to be impossible classically. This work gives a simple algorithm that does it, based on the weak coin flipping protocol with arbitrarily small bias derived by Mochon in 2007, and recently published and simplified in Aharonov et al in 2016. A protocol with linear number of coin flipping rounds is quite simple to achieve; We further provide an improvement to logarithmic number of coin flipping rounds. This is a much improved journal version of a preprint posted in 2009: many typos are corrected, proofs are more rigorous and accurate, and the analysis of…
Bit commitment is a fundamental cryptographic primitive with numerous applications. Quantum information allows for bit commitment schemes in the information theoretic setting where no dishonest party can perfectly cheat. The previously best-known quantum protocol by Ambainis achieved a cheating probability of at most 3/4[Amb01]. On the other hand, Kitaev showed that no quantum protocol can have cheating probability less than 1/sqrt{2} [Kit03] (his lower bound on coin flipping can be easily extended to bit commitment). Closing this gap has since been an important and open question. In this pape…
Mochon's proof [Moc07] of existence of quantum weak coin flipping with arbitrarily small bias is a fundamental result in quantum cryptography, but at the same time one of the least understood. Though used several times as a black box in important follow-up results [Gan09, CK09, AS10, CK11, KZ13] the result has not been peer-reviewed, its novel techniques (and in particular Kitaev's point game formalism) have not been applied anywhere else, and an explicit protocol is missing. We believe that truly understanding the existence proof and the novel techniques it relies on would constitute a major …
In this paper, we present a quantum strong coin flipping protocol. In this protocol, an EPR pair and a quantum memory storage are made use of, and losses in the quantum communication channel and quantum memory storage are all analyzed. We obtain the bias in the fair scenario as a function of $p$, where $p$ is the probability that the particle in Bob's quantum memory storage is lost, which means our bias varies as the degree of losses in the quantum memory storage changes. Therefore we call our protocol semi-loss-tolerant. We also show that the bias decreases with decreasing $p$. When $p$ appro…
Weak coin flipping (WCF) is a fundamental cryptographic primitive for two-party secure computation, where two distrustful parties need to remotely establish a shared random bit whilst having opposite preferred outcomes. It is the strongest known primitive with arbitrarily close to perfect security quantumly while classically, its security is completely compromised (unless one makes further assumptions, such as computational hardness). A WCF protocol is said to have bias $ε$ if neither party can force their preferred outcome with probability greater than $1/2+ε$. Classical WCF protocols are sho…
We implement a quantum walk in phase space with a new mechanism based on the superconducting resonator-assisted double quantum dots. By analyzing the hybrid system, we obtain the necessary factors of realization of a quantum walk in phase space: the walker, coin, coin flipping and conditional phase shift. In order to implement the coin flipping operator, we add a driving field to the resonator. The interaction between the quantum dots and resonator field is used to implement conditional phase shift. Furthermore, we show with different driving fields the quantum walk in phase space exhibits a b…
We focus on a family of quantum coin-flipping protocols based on bit-commitment. We discuss how the semidefinite programming formulations of cheating strategies can be reduced to optimizing a linear combination of fidelity functions over a polytope. These turn out to be much simpler semidefinite programs which can be modelled using second-order cone programming problems. We then use these simplifications to construct their point games as developed by Kitaev. We also study the classical version of these protocols and use linear optimization to formulate optimal cheating strategies. We then cons…
Coin-flipping is a cryptographic task in which two physically separated, mistrustful parties wish to generate a fair coin-flip by communicating with each other. Chailloux and Kerenidis (2009) designed quantum protocols that guarantee coin-flips with near optimal bias. The probability of any outcome in these protocols is provably at most $1/\sqrt{2} + δ$ for any given $δ> 0$. However, no explicit description of these protocols is known, and the number of rounds in the protocols tends to infinity as $δ$ goes to 0. In fact, the smallest bias achieved by known explicit protocols is $1/4$ (Ambainis…
We introduce some new perfect state transfer and teleportation schemes by quantum walks with two coins. Encoding the transferred information in coin 1 state and alternatively using two coin operators, we can perfectly recover the information on coin 1 state at target position only by at most two times of flipping operation. Based on quantum walks with two coins either on the line or on the $N$-circle, we can perfectly transfer any qubit state. In addition, using quantum walks with two coins either on complete graphs or regular graphs, we can first implement perfect qudit state transfer by quan…
Relativistic protocols have been proposed to overcome some impossibility results in classical and quantum cryptography. In such a setting, one takes the location of honest players into account, and uses the fact that information cannot travel faster than the speed of light to limit the abilities of dishonest agents. For example, various relativistic bit commitment protocols have been proposed. Although it has been shown that bit commitment is sufficient to construct oblivious transfer and thus multiparty computation, composing specific relativistic protocols in this way is known to be insecure…
We show a perfect state transfer of an arbitrary unknown two-qubit state can be achieved via a discrete-time quantum walk with various settings of coin flippings, and extend this method to distribution of an arbitrary unknown multi-qubit entangled state between every pair of sites in the multi-dimensional network. Furthermore, we study the routing of quantum information on this network in a quantum walk architecture, which can be used as quantum information processors to communicate between separated qubits.
A quantum board game is a multi-round protocol between a single quantum player against the quantum board. Molina and Watrous discovered quantum hedging. They gave an example for perfect quantum hedging: a board game with winning probability < 1, such that the player can win with certainty at least 1-out-of-2 quantum board games played in parallel. Here we show that perfect quantum hedging occurs in a cryptographic protocol - quantum coin flipping. For this reason, when cryptographic protocols are composed, hedging may introduce serious challenges into their analysis. We also show that hedging …
The quantum walk (QW) is the term given to a family of algorithms governing the evolution of a discrete quantum system and as such has a founding role in the study of quantum computation. We contribute to the investigation of QW phenomena by performing a detailed numerical study of discrete-time quantum walks. In one dimension (1D), we compute the structure of the probability distribution, which is not a smooth curve but shows oscillatory features on all length scales. By analyzing walks up to $N$ = 1000000 steps, we discuss the scaling characteristics and limiting forms of the QW in both real…
Single-Photon Advantage in Quantum Cryptography Beyond QKD
Institute of Solid State Physics, Technical University of Berlin（柏林工业大学固体物理研究所）；Electrical Engineering and Computer Science Department, Technical University of Berlin（柏林工业大学电气与计算机工程系）；Key Laboratory of Optoelectronic Materials and Devices, Institute of Semiconductors, Chinese Academy of Sciences（中国科学院半导体研究所光电材料与器件重点实验室）；Center of Materials Science and Optoelectronics Engineering, University of Chinese Academy of Sciences（中国科学院大学材料科学与工程光电子学中心）
The problems of Hadamard quantum coin flipping in n-trials and related generalized Fibonacci sequences of numbers were introduced in [1]. It was shown that for an arbitrary number of repeated consecutive states, probabilities are determined by Fibonacci numbers for duplicated states, Tribonacci numbers for triplicated states and N-Bonacci numbers for arbitrary N-plicated states. In the present paper we generalize these results for direct product of multiple qubit states and arbitrary position of repeated states. The calculations are based on structure of Fibonacci trees in space of qubit state…
