A quantum protocol for cheat-sensitive weak coin flipping
R. W. Spekkens, Terry Rudolph
备注：
4 pages RevTex. Differs from the journal version only in that the sentences: "The ordering of the authors on this paper was chosen by a coin flip implemented by a trusted third party. TR lost." have not been removed
We present a quantum protocol for the task of weak coin flipping. We find that, for one choice of parameters in the protocol, the maximum probability of a dishonest party winning the coin flip if the other party is honest is 1/sqrt(2). We also show that if parties restrict themselves to strategies wherein they cannot be caught cheating, their maximum probability of winning can be even smaller. As such, the protocol offers additional security in the form of cheat sensitivity.
Quantum protocols for coin-flipping can be composed in series in such a way that a cheating party gains no extra advantage from using entanglement between different rounds. This composition principle applies to coin-flipping protocols with cheat sensitivity as well, and is used to derive two results: There are no quantum strong coin-flipping protocols with cheat sensitivity that is linear in the bias (or bit-commitment protocols with linear cheat detection) because these can be composed to produce strong coin-flipping with arbitrarily small bias. On the other hand, it appears that quadratic ch…
Coin flipping is a fundamental cryptographic primitive that enables two distrustful and far apart parties to create a uniformly random bit [Blu81]. Quantum information allows for protocols in the information theoretic setting where no dishonest party can perfectly cheat. The previously best-known quantum protocol by Ambainis achieved a cheating probability of at most 3/4 [Amb01]. On the other hand, Kitaev showed that no quantum protocol can have cheating probability less than $1/\sqrt{2}$ [Kit03]. Closing this gap has been one of the important open questions in quantum cryptography. In this pa…
Bit commitment is a fundamental cryptographic primitive with numerous applications. Quantum information allows for bit commitment schemes in the information theoretic setting where no dishonest party can perfectly cheat. The previously best-known quantum protocol by Ambainis achieved a cheating probability of at most 3/4[Amb01]. On the other hand, Kitaev showed that no quantum protocol can have cheating probability less than 1/sqrt{2} [Kit03] (his lower bound on coin flipping can be easily extended to bit commitment). Closing this gap has since been an important and open question. In this pape…
We show that a biased quantum coin flip (QCF) cannot provide the performance of a black-boxed biased coin flip, if it satisfies some fidelity conditions. Although such a QCF satisfies the security conditions of a biased coin flip, it does not realize the ideal functionality, and therefore, does not fulfill the demands for universally composable security. Moreover, through a comparison within a small restricted bias range, we show that an arbitrary QCF is distinguishable from a black-boxed coin flip unless it is unbiased on both sides of parties against insensitive cheating. We also point out t…
Oblivious transfer is a fundamental primitive in cryptography. While perfect information theoretic security is impossible, quantum oblivious transfer protocols can limit the dishonest players' cheating. Finding the optimal security parameters in such protocols is an important open question. In this paper we show that every 1-out-of-2 oblivious transfer protocol allows a dishonest party to cheat with probability bounded below by a constant strictly larger than 1/2. Alice's cheating is defined as her probability of guessing Bob's index, and Bob's cheating is defined as his probability of guessin…
When submitting ``Coin-Flipping-based Quantum Oblivious Transfer'' (quant-ph/0605027v4) to Indocrypt-2006, I received valuable reviews. Due to the attacks in these reviews, my major protocols, for cheat-sensitive and coin-flipping-based 2-1 oblivious transfers, are insecure. I would have withdrawn the paper. But I think I'd rather post the attacks made by the reviewer. Besides, as ``coin-flipping-based 2-1 OT'' is an important case-study in ``Two-party Models and the No-go Theorems'' (quant-ph/0608165), the paper is also touched by the attack. It will be reconsidered, and the case-study will b…
Coin flipping is a cryptographic primitive in which two spatially separated players, who in principle do not trust each other, wish to establish a common random bit. If we limit ourselves to classical communication, this task requires either assumptions on the computational power of the players or it requires them to send messages to each other with sufficient simultaneity to force their complete independence. Without such assumptions, all classical protocols are so that one dishonest player has complete control over the outcome. If we use quantum communication, on the other hand, protocols ha…
So far, most of existed single-shot quantum coin flipping(QCF) protocols failed in a noisy quantum channel. Here, we present a nested-structured framework that makes it possible to achieve partially noise-tolerant QCF, due to that there is a trade-off between the security and the justice correctness. It is showed that noise-tolerant single-shot QCF protocols can be produced by filling the presented framework up with existed or even future protocols. We also proved a lower bound of 0.25, with which a cheating Alice or Bob could bias the outcome.
Coin-flipping is a fundamental cryptographic task where a spatially separated Alice and Bob wish to generate a fair coin-flip over a communication channel. It is known that ideal coin-flipping is impossible in both classical and quantum theory. In this work, we give a short proof that it is also impossible in generalized probabilistic theories under the Generalized No-Restriction Hypothesis. Our proof relies crucially on a formulation of cheating strategies as semi-infinite programs, i.e., cone programs with infinitely many constraints. This introduces a new formalism which may be of independe…
Lo and Chau showed that an ideal quantum coin flipping protocol is impossible. The proof was simply derived from the impossibility proof of quantum bit commitment. However, the proof still leaves the possibility of a quantum coin flipping protocol with arbitrary small bias. In this paper, we show that a quantum coin flipping protocol with arbitrary small bias is impossible and show the lower bound of the bias of quantum coin flipping protocol.
Each classical public-coin protocol for coin flipping is naturally associated with a quantum protocol for weak coin flipping. The quantum protocol is obtained by replacing classical randomness with quantum entanglement and by adding a cheat detection test in the last round that verifies the integrity of this entanglement. The set of such protocols defines a family which contains the protocol with bias 0.192 previously found by the author, as well as protocols with bias as low as 1/6 described herein. The family is analyzed by identifying a set of optimal protocols for every number of messages.…
This note presents a quantum protocol that demonstrates that_weak_ coin flipping with bias approximately 0.239, less than 1/4, is possible. A bias of 1/4 was the smallest known, and followed from the strong coin flipping protocol of [Ambainis 2001]. Protocols with yet smaller bias, approximately 0.207, have independently been discovered [Ambainis 2001, Spekkens and Rudolph 2002]. We also present an alternative strong coin flipping protocol with bias 1/4 with analysis simpler than that of [Ambainis 2001].
"God does not play dice. He flips coins instead." And though for some reason He has denied us quantum bit commitment. And though for some reason he has even denied us strong coin flipping. He has, in His infinite mercy, granted us quantum weak coin flipping so that we too may flip coins. Instructions for the flipping of coins are contained herein. But be warned! Only those who have mastered Kitaev's formalism relating coin flipping and operator monotone functions may succeed. For those foolhardy enough to even try, a complete tutorial is included.
A family of protocols for quantum weak coin-flipping which asymptotically achieve a bias of 0.192 is described in this paper. The family contains protocols with n+2 messages for all n>1. The case n=2 is equivalent to the protocol of Spekkens and Rudolph with bias of 0.207. The case n=3 achieves a bias of 0.199, and n=8 achieves a bias of 0.193. The analysis of the protocols uses Kitaev's description of coin-flipping as a semidefinite program. The paper constructs an analytical solution to the dual problem which provides an upper bound on the amount that a party can cheat.
In this article we show for the first time that quantum coin flipping with security guarantees that are strictly better than any classical protocol is possible to implement with current technology. Our protocol takes into account all aspects of an experimental implementation like losses, multi-photon pulses emitted by practical photon sources, channel noise, detector dark counts and finite quantum efficiency. We calculate the abort probability when both players are honest, as well as the probability of one player forcing his desired outcome. For channel length up to 21 km, we achieve a cheatin…
In this paper, we present a semi-loss-tolerant strong quantum coin-flipping (QCF) protocol with the best bias of 0.3536. Our manuscript applies Quantum non-demolition (QND) measurement to quantum coin-flipping protocol. Furthermore, a single photon as a single qubit is used to avoid the difficult implementation of EPR resources. We also analyze the security of our protocol obtaining the best result among all coin-flipping protocols considering loss. A semi-loss-tolerant Quantum Dice Rolling (QDR) protocol is first proposed, and the security of corresponding three-party QDR is analyzed to bette…
How can two parties with competing interests carry out a fair coin flip, using only a noiseless quantum channel? This problem (quantum weak coin-flipping) was formalized more than 15 years ago, and, despite some phenomenal theoretical progress, practical quantum coin-flipping protocols with vanishing bias have proved hard to find. In the current work we show that there is a reason that practical weak quantum coin-flipping is difficult: any quantum weak coin-flipping protocol with bias $ε$ must use at least $\exp ( Ω(1/\sqrtε ))$ rounds of communication. This is a large improvement over the pre…
Unconditionally secure bit commitment and coin flipping are known to be impossible in the classical world. Bit commitment is known to be impossible also in the quantum world. We introduce a related new primitive - {\em quantum bit escrow}. In this primitive Alice commits to a bit $b$ to Bob. The commitment is {\em binding} in the sense that if Alice is asked to reveal the bit, Alice can not bias her commitment without having a good probability of being detected cheating. The commitment is {\em sealing} in the sense that if Bob learns information about the encoded bit, then if later on he is as…
We focus on a family of quantum coin-flipping protocols based on bit-commitment. We discuss how the semidefinite programming formulations of cheating strategies can be reduced to optimizing a linear combination of fidelity functions over a polytope. These turn out to be much simpler semidefinite programs which can be modelled using second-order cone programming problems. We then use these simplifications to construct their point games as developed by Kitaev. We also study the classical version of these protocols and use linear optimization to formulate optimal cheating strategies. We then cons…
Coin flipping is a cryptographic primitive in which two distrustful parties wish to generate a random bit in order to choose between two alternatives. This task is impossible to realize when it relies solely on the asynchronous exchange of classical bits: one dishonest player has complete control over the final outcome. It is only when coin flipping is supplemented with quantum communication that this problem can be alleviated, although partial bias remains. Unfortunately, practical systems are subject to loss of quantum data, which restores complete or nearly complete bias in previous protoco…
In this paper, we present a loss-tolerant quantum strong coin flipping protocol with bias 0.359. This is an improvement over Berlin etal's protocol [BBBG08] which achieves a bias of 0.4. To achieve this, we extend Berlin et al.'s protocol by adding an encryption step that hides some information to Bob until he confirms that he successfully measured. We also show using numerical analysis that a we cannot improve this bias by considering a k-fold repetition of Berlin etal's protocol for k > 2.
We present a family of loss-tolerant quantum strong coin flipping protocols; each protocol differing in the number of qubits employed. For a single qubit we obtain a bias of 0.4, reproducing the result of Berlín et al. [Phys. Rev. A 80, 062321 (2009)], while for two qubits we obtain a bias of 0.3975. Numerical evidence based on semi-definite programming indicates that the bias continues to decrease as the number of qubits is increased but at a rapidly decreasing rate.
We introduce relativistic multi-party biased die rolling protocols, generalizing coin flipping to $M \geq 2$ parties and to $N \geq 2$ outcomes for any chosen outcome biases, and show them unconditionally secure. Our results prove that the most general random secure multi-party computation, where all parties receive the output and there is no secret input by any party, can be implemented with unconditional security. Our protocols extend Kent's [A. Kent, Phys. Rev. Lett. 83, 5382 (1999)] two-party unbiased coin flipping protocol, do not require any quantum communication, are practical to implem…
In this paper, we prove classical coin-flipping secure in the presence of quantum adversaries. The proof uses a recent result of Watrous [Wat09] that allows quantum rewinding for protocols of a certain form. We then discuss two applications. First, the combination of coin-flipping with any non-interactive zero-knowledge protocol leads to an easy transformation from non-interactive zero-knowledge to interactive quantum zero-knowledge. Second, we discuss how our protocol can be applied to a recently proposed method for improving the security of quantum protocols [DFL+09], resulting in an impleme…
Weak coin flipping is among the fundamental cryptographic primitives which ensure the security of modern communication networks. It allows two mistrustful parties to remotely agree on a random bit when they favor opposite outcomes. Unlike other two-party computations, one can achieve information-theoretic security using quantum mechanics only: both parties are prevented from biasing the flip with probability higher than $1/2+ε$, where $ε$ is arbitrarily low. Classically, the dishonest party can always cheat with probability $1$ unless computational assumptions are used. Despite its importance,…
Performing complex cryptographic tasks will be an essential element in future quantum communication networks. These tasks are based on a handful of fundamental primitives, such as coin flipping, where two distrustful parties wish to agree on a randomly generated bit. Although it is known that quantum versions of these primitives can offer information-theoretic security advantages with respect to classical protocols, a demonstration of such an advantage in a practical communication scenario has remained elusive. Here, we experimentally implement a quantum coin flipping protocol that performs st…
In this paper, we present a quantum strong coin flipping protocol. In this protocol, an EPR pair and a quantum memory storage are made use of, and losses in the quantum communication channel and quantum memory storage are all analyzed. We obtain the bias in the fair scenario as a function of $p$, where $p$ is the probability that the particle in Bob's quantum memory storage is lost, which means our bias varies as the degree of losses in the quantum memory storage changes. Therefore we call our protocol semi-loss-tolerant. We also show that the bias decreases with decreasing $p$. When $p$ appro…
We generalize the problem of coin flipping to more than two outcomes and parties. We term this problem dice rolling, and study both its weak and strong variants. We prove by construction that in quantum settings (i) weak N-sided dice rolling admits an arbitrarily small bias for any value of N, and (ii) two-party strong N-sided dice rolling saturates the corresponding generalization of Kitaev's bound for any value of N. In addition, we make use of this last result to introduce a family of optimal 2m-party strong n^m-sided dice rolling protocols for any value of m and n.
The cryptographic protocol of coin tossing consists of two parties, Alice and Bob, that do not trust each other, but want to generate a random bit. If the parties use a classical communication channel and have unlimited computational resources, one of them can always cheat perfectly. Here we analyze in detail how the performance of a quantum coin tossing experiment should be compared to classical protocols, taking into account the inevitable experimental imperfections. We then report an all-optical fiber experiment in which a single coin is tossed whose randomness is higher than achievable by …
We study the class of protocols for weak quantum coin flipping introduced by Spekkens and Rudolph (quant-ph/0202118). We show that, for any protocol in this class, one party can win the coin flip with probability at least $1/\sqrt{2}$.
In this paper, we focus on a special framework for quantum coin flipping protocols,_bit-commitment based protocols_, within which almost all known protocols fit. We show a lower bound of 1/16 for the bias in any such protocol. We also analyse a sequence of multi-round protocol that tries to overcome the drawbacks of the previously proposed protocols, in order to lower the bias. We show an intricate cheating strategy for this sequence, which leads to a bias of 1/4. This indicates that a bias of 1/4 might be optimal in such protocols, and also demonstrates that a cleverer proof technique may be …
Coin flipping is a cryptographic primitive for which strictly better protocols exist if the players are not only allowed to exchange classical, but also quantum messages. During the past few years, several results have appeared which give a tight bound on the range of implementable unconditionally secure coin flips, both in the classical as well as in the quantum setting and for both weak as well as strong coin flipping. But the picture is still incomplete: in the quantum setting, all results consider only protocols with perfect correctness, and in the classical setting tight bounds for strong…
The problem of Hadamard quantum coin measurement in $n$ trials, with arbitrary number of repeated consecutive last states is formulated in terms of Fibonacci sequences for duplicated states, Tribonacci numbers for triplicated states and $N$-Bonacci numbers for arbitrary $N$-plicated states. The probability formulas for arbitrary position of repeated states are derived in terms of Lucas and Fibonacci numbers. For generic qubit coin, the formulas are expressed by Fibonacci and more general, $N$-Bonacci polynomials in qubit probabilities. The generating function for probabilities, the Golden Rati…
We investigate the global chirality distribution of the quantum walk on the line when decoherence is introduced either through simultaneous measurements of the chirality and particle position, or as a result of broken links. The first mechanism drives the system towards a classical diffusive behavior. This is used to build new quantum games, similar to the spin-flip game. The second mechanism involves two different possibilities: (a) All the quantum walk links have the same probability of being broken. (b) Only the quantum walk links on a half-line are affected by random breakage. In case (a) …
We present a new protocol and two lower bounds for quantum coin flipping. In our protocol, no dishonest party can achieve one outcome with probability more than 0.75. Then, we show that our protocol is optimal for a certain type of quantum protocols. For arbitrary quantum protocols, we show that if a protocol achieves a bias of at most $ε$, it must use at least $Ω(\log \log \frac{1}ε)$ rounds of communication. This implies that the parallel repetition fails for quantum coin flipping. (The bias of a protocol cannot be arbitrarily decreased by running several copies of it in parallel.)
We discuss the security implications of noise for quantum coin tossing protocols. We find that if quantum error correction can be used, so that noise levels can be made arbitrarily small, then reasonable security conditions for coin tossing can be framed so that results from the noiseless case will continue to hold. If, however, error correction is not available (as is the case with present day technology), and significant noise is present, then tossing a single coin becomes problematic. In this case, we are led to consider random n-bit string generation in the presence of noise, rather than s…
We propose a coin-flip protocol which yields a string of strong, random coins and is fully simulatable against poly-sized quantum adversaries on both sides. It can be implemented with quantum-computational security without any set-up assumptions, since our construction only assumes mixed commitment schemes which we show how to construct in the given setting. We then show that the interactive generation of random coins at the beginning or during outer protocols allows for quantum-secure realizations of classical schemes, again without any set-up assumptions. As example applications we discuss q…
Leader election between n parties is known to be impossible classically. This work gives a simple algorithm that does it, based on the weak coin flipping protocol with arbitrarily small bias derived by Mochon in 2007, and recently published and simplified in Aharonov et al in 2016. A protocol with linear number of coin flipping rounds is quite simple to achieve; We further provide an improvement to logarithmic number of coin flipping rounds. This is a much improved journal version of a preprint posted in 2009: many typos are corrected, proofs are more rigorous and accurate, and the analysis of…
We investigate weak coin flipping, a fundamental cryptographic primitive where two distrustful parties need to remotely establish a shared random bit. A cheating player can try to bias the output bit towards a preferred value. For weak coin flipping the players have known opposite preferred values. A weak coin-flipping protocol has a bias $ε$ if neither player can force the outcome towards their preferred value with probability more than $\frac{1}{2}+ε$. While it is known that all classical protocols have $ε=\frac{1}{2}$, Mochon showed in 2007 [arXiv:0711.4114] that quantumly weak coin flippin…
Mochon's proof [Moc07] of existence of quantum weak coin flipping with arbitrarily small bias is a fundamental result in quantum cryptography, but at the same time one of the least understood. Though used several times as a black box in important follow-up results [Gan09, CK09, AS10, CK11, KZ13] the result has not been peer-reviewed, its novel techniques (and in particular Kitaev's point game formalism) have not been applied anywhere else, and an explicit protocol is missing. We believe that truly understanding the existence proof and the novel techniques it relies on would constitute a major …
A coin is just a two sided dice. Recently, Mochon proved that quantum weak coin flipping with an arbitrarily small bias is possible. However, the use of quantum resources to allow N remote distrustful parties to roll an N-sided dice has yet to be addressed. In this paper we show that contrary to the classical case, N-sided dice rolling with arbitrarily small bias is possible for any N. In addition, we present a six-round three-sided dice rolling protocol, achieving a bias of 0.181, which incorporates weak imbalanced coin flipping.
We investigate coin-flipping protocols for multiple parties in a quantum broadcast setting: (1) We propose and motivate a definition for quantum broadcast. Our model of quantum broadcast channel is new. (2) We discovered that quantum broadcast is essentially a combination of pairwise quantum channels and a classical broadcast channel. This is a somewhat surprising conclusion, but helps us in both our lower and upper bounds. (3) We provide tight upper and lower bounds on the optimal bias epsilon of a coin which can be flipped by k parties of which exactly g parties are honest: for any 1 <= g <=…
Weak coin flipping (WCF) is a fundamental cryptographic primitive for two-party secure computation, where two distrustful parties need to remotely establish a shared random bit whilst having opposite preferred outcomes. It is the strongest known primitive with arbitrarily close to perfect security quantumly while classically, its security is completely compromised (unless one makes further assumptions, such as computational hardness). A WCF protocol is said to have bias $ε$ if neither party can force their preferred outcome with probability greater than $1/2+ε$. Classical WCF protocols are sho…
In quantum zero knowledge, the assumption was made that the verifier is only using unitary operations. Under this assumption, many nice properties have been shown about quantum zero knowledge, including the fact that Honest-Verifier Quantum Statistical Zero Knowledge (HVQSZK) is equal to Cheating-Verifier Quantum Statistical Zero Knowledge (QSZK) (see [Wat02,Wat06]). In this paper, we study what happens when we allow an honest verifier to flip some coins in addition to using unitary operations. Flipping a coin is a non-unitary operation but doesn't seem at first to enhance the cheating possibi…
In this letter we present the first implementation of a quantum coin tossing protocol. This protocol belongs to a class of ``two-party'' cryptographic problems, where the communication partners distrust each other. As with a number of such two-party protocols, the best implementation of the quantum coin tossing requires qutrits. In this way, we have also performed the first complete quantum communication protocol with qutrits. In our experiment the two partners succeeded to remotely toss a row of coins using photons entangled in the orbital angular momentum. We also show the experimental bound…
We implement a quantum walk in phase space with a new mechanism based on the superconducting resonator-assisted double quantum dots. By analyzing the hybrid system, we obtain the necessary factors of realization of a quantum walk in phase space: the walker, coin, coin flipping and conditional phase shift. In order to implement the coin flipping operator, we add a driving field to the resonator. The interaction between the quantum dots and resonator field is used to implement conditional phase shift. Furthermore, we show with different driving fields the quantum walk in phase space exhibits a b…
We review the quantum version of a well known problem of cryptography called coin tossing (``flipping a coin via telephone''). It can be regarded as a game where two remote players (who distrust each other) tries to generate a uniformly distributed random bit which is common to both parties. The only resource they can use to perform this task is a classical or quantum communication channel. In this paper we provide a general overview over such coin tossing protocols, concerning in particular their security.
There had been well known claims of unconditionally secure quantum protocols for bit commitment. However, we, and independently Mayers, showed that all proposed quantum bit commitment schemes are, in principle, insecure because the sender, Alice, can almost always cheat successfully by using an Einstein-Podolsky-Rosen (EPR) type of attack and delaying her measurements. One might wonder if secure quantum bit commitment protocols exist at all. We answer this question by showing that the same type of attack by Alice will, in principle, break any bit commitment scheme. The cheating strategy genera…
Coin-flipping is a cryptographic task in which two physically separated, mistrustful parties wish to generate a fair coin-flip by communicating with each other. Chailloux and Kerenidis (2009) designed quantum protocols that guarantee coin-flips with near optimal bias. The probability of any outcome in these protocols is provably at most $1/\sqrt{2} + δ$ for any given $δ> 0$. However, no explicit description of these protocols is known, and the number of rounds in the protocols tends to infinity as $δ$ goes to 0. In fact, the smallest bias achieved by known explicit protocols is $1/4$ (Ambainis…
Parrondo games are coin flipping games with the surprising property that alternating plays of two losing games can produce a winning game. We show that this phenomenon can be modelled by probabilistic lattice gas automata. Furthermore, motivated by the recent introduction of quantum coin flipping games, we show that quantum lattice gas automata provide an interesting definition for quantum Parrondo games.
After a general introduction, the thesis is divided into four parts. In the first, we discuss the task of coin tossing, principally in order to highlight the effect different physical theories have on security in a straightforward manner, but, also, to introduce a new protocol for non-relativistic strong coin tossing. This protocol matches the security of the best protocol known to date while using a conceptually different approach to achieve the task. In the second part variable bias coin tossing is introduced. This is a variant of coin tossing in which one party secretly chooses one of two b…
There had been well known claims of ``provably unbreakable'' quantum protocols for bit commitment and coin tossing. However, we, and independently Mayers, showed that all proposed quantum bit commitment (and therefore coin tossing) schemes are, in principle, insecure because the sender, Alice, can always cheat successfully by using an EPR-type of attack and delaying her measurements. One might wonder if secure quantum bit commitment and coin tossing protocols exist at all. Here we prove that an EPR-type of attack by Alice will, in principle, break {\em any} realistic quantum bit commitment and…
