In this letter we present the first implementation of a quantum coin tossing protocol. This protocol belongs to a class of ``two-party'' cryptographic problems, where the communication partners distrust each other. As with a number of such two-party protocols, the best implementation of the quantum coin tossing requires qutrits. In this way, we have also performed the first complete quantum communication protocol with qutrits. In our experiment the two partners succeeded to remotely toss a row of coins using photons entangled in the orbital angular momentum. We also show the experimental bounds of a possible cheater and the ways of detecting him.
We show that a secure quantum protocol for coin tossing exist. The existence of quantum coin tossing support the conjecture of D.Mayers [Phys.Rev.Lett. 78, 3414(1997)] that only asymmetrical tasks as quantum bit commitment are impossible.
We suggest an attack on a symmetric non-ideal quantum coin-tossing protocol suggested by Mayers Salvail and Chiba-Kohno. The analysis of the attack shows that the protocol is insecure.
A relativistic quantum information exchange protocol is proposed allowing two distant users to realize ``coin tossing'' procedure. The protocol is based on the point that in relativistic quantum theory reliable distinguishing between the two orthogonal states generally requires a finite time depending on the structure of these states.
We review the quantum version of a well known problem of cryptography called coin tossing (``flipping a coin via telephone''). It can be regarded as a game where two remote players (who distrust each other) tries to generate a uniformly distributed random bit which is common to both parties. The only resource they can use to perform this task is a classical or quantum communication channel. In this paper we provide a general overview over such coin tossing protocols, concerning in particular their security.
An unconditionally secure quantum cion tossing protocol for two remote participants via entangled swapping is presented. The security of this protocol is guaranteed by the nonlocal property of quantum entanglement and the classical complexity.
The cryptographic protocol of coin tossing consists of two parties, Alice and Bob, that do not trust each other, but want to generate a random bit. If the parties use a classical communication channel and have unlimited computational resources, one of them can always cheat perfectly. Here we analyze in detail how the performance of a quantum coin tossing experiment should be compared to classical protocols, taking into account the inevitable experimental imperfections. We then report an all-optical fiber experiment in which a single coin is tossed whose randomness is higher than achievable by …
There had been well known claims of ``provably unbreakable'' quantum protocols for bit commitment and coin tossing. However, we, and independently Mayers, showed that all proposed quantum bit commitment (and therefore coin tossing) schemes are, in principle, insecure because the sender, Alice, can always cheat successfully by using an EPR-type of attack and delaying her measurements. One might wonder if secure quantum bit commitment and coin tossing protocols exist at all. Here we prove that an EPR-type of attack by Alice will, in principle, break {\em any} realistic quantum bit commitment and…
In the literature, strong coin tossing protocols based on bit commitment have been proposed. Here we examine a protocol that instead tries to achieve the task by sharing entanglement securely. The protocol uses only qubits, and has bias 1/4. This is equal to the best known bias for bit commitment based schemes.
We discuss the security implications of noise for quantum coin tossing protocols. We find that if quantum error correction can be used, so that noise levels can be made arbitrarily small, then reasonable security conditions for coin tossing can be framed so that results from the noiseless case will continue to hold. If, however, error correction is not available (as is the case with present day technology), and significant noise is present, then tossing a single coin becomes problematic. In this case, we are led to consider random n-bit string generation in the presence of noise, rather than s…
In coin tossing two remote participants want to share a uniformly distributed random bit. At the least in the quantum version, each participant test whether or not the other has attempted to create a bias on this bit. It is requested that, for b = 0,1, the probability that Alice gets bit b and pass the test is smaller than 1/2 whatever she does, and similarly for Bob. If the bound 1/2 holds perfectly against any of the two participants, the task realised is called an exact coin tossing. If the bound is actually $1/2 + ξ$ where the bias $ξ$ vanishes when a security parameter m defined by the pr…
The relativistic quantum protocols realizing the bit commitment and distant coin tossing schemes are proposed. The protocols are based on the fact that the non-stationary orthogonal extended quantum states cannot be reliably distinguished if they are not fully accessible for the measurement. As the states propagate from the domain controlled by one of the user to the domain accessible for the measurements performed by the other user, they become reliably distinguishable for the second user. Important for the protocol are both the quantum nature of the states and the existence of a finite maxim…
We define cryptographic assumptions applicable to two mistrustful parties who each control two or more separate secure sites between which special relativity guarantees a time lapse in communication. We show that, under these assumptions, unconditionally secure coin tossing can be carried out by exchanges of classical information. We show also, following Mayers, Lo and Chau, that unconditionally secure bit commitment cannot be carried out by finitely many exchanges of classical or quantum information. Finally we show that, under standard cryptographic assumptions, coin tossing is strictly weak…
Quantum coin tossing (QCT) is an important primitive of quantum cryptography and has received continuous interest. However, in practical QCT, Bob's detectors can be subjected to detector-side channel attacks launched by dishonest Alice, which will possibly make the protocol completely insecure. Here, we report a simple strategy of a detector-blinding attack based on a recent experiment. To remove all the detector side channels, we present a solution of measurement-device-independent QCT (MDI-QCT). This method is similar to the idea of MDI quantum key distribution (QKD). MDI-QCT is loss toleran…
It is well-known that pure quantum states are typically almost maximally entangled, and thus have close to maximally mixed subsystems. We consider whether this is true for probabilistic theories more generally, and not just for quantum theory. We derive a formula for the expected purity of a subsystem in any probabilistic theory for which this quantity is well-defined. It applies to typical entanglement in pure quantum states, coin tossing in classical probability theory, and randomization in post-quantum theories; a simple generalization yields the typical entanglement in (anti)symmetric quan…
There had been well known claims of unconditionally secure quantum protocols for bit commitment. However, we, and independently Mayers, showed that all proposed quantum bit commitment schemes are, in principle, insecure because the sender, Alice, can almost always cheat successfully by using an Einstein-Podolsky-Rosen (EPR) type of attack and delaying her measurements. One might wonder if secure quantum bit commitment protocols exist at all. We answer this question by showing that the same type of attack by Alice will, in principle, break any bit commitment scheme. The cheating strategy genera…
When elementary quantum systems, such as polarized photons, are used to transmit digital information, the uncertainty principle gives rise to novel cryptographic phenomena unachievable with traditional transmission media, e.g. a communications channel on which it is impossible in principle to eavesdrop without a high probability of disturbing the transmission in such a way as to be detected. Such a quantum channel can be used in conjunction with ordinary insecure classical channels to distribute random key information between two users with the assurance that it remains unknown to anyone else,…
Joint Institute for Nuclear Research（联合核研究所）；Universidade de São Paulo（圣保罗大学）
The procedure of tossing quantum coins and dice is described. This case is an important example of a quantum procedure because it presents a typical framework employed in quantum information processing and quantum computing. The emphasis is on the clarification of the difference between quantum and classical conditional probabilities. These probabilities are designed for characterizing different systems, either quantum or classical, and they, generally, cannot be reduced to each other. Thus the Lüders probability cannot be treated as a generalization of the classical conditional probability. T…
A significant branch of classical cryptography deals with the problems which arise when mistrustful parties need to generate, process or exchange information. As Kilian showed a while ago, mistrustful classical cryptography can be founded on a single protocol, oblivious transfer, from which general secure multi-party computations can be built. The scope of mistrustful quantum cryptography is limited by no-go theorems, which rule out, inter alia, unconditionally secure quantum protocols for oblivious transfer or general secure two-party computations. These theorems apply even to protocols which…
Alice is a charismatic quantum cryptographer who believes her parties are unmissable; Bob is a (relatively) glamorous string theorist who believes he is an indispensable guest. To prevent possibly traumatic collisions of self-perception and reality, their social code requires that decisions about invitation or acceptance be made via a cryptographically secure variable bias coin toss (VBCT). This generates a shared random bit by the toss of a coin whose bias is secretly chosen, within a stipulated range, by one of the parties; the other party learns only the random bit. Thus one party can secre…
Coin tossing is a cryptographic task in which two parties who do not trust each other aim to generate a common random bit. Using classical communication this is impossible, but non trivial coin tossing is possible using quantum communication. Here we consider the case when the parties do not want to toss a single coin, but many. This is called bit string generation. We report the experimental generation of strings of coins which are provably more random than achievable using classical communication. The experiment is based on the ``plug and play'' scheme developed for quantum cryptography, and…
After a general introduction, the thesis is divided into four parts. In the first, we discuss the task of coin tossing, principally in order to highlight the effect different physical theories have on security in a straightforward manner, but, also, to introduce a new protocol for non-relativistic strong coin tossing. This protocol matches the security of the best protocol known to date while using a conceptually different approach to achieve the task. In the second part variable bias coin tossing is introduced. This is a variant of coin tossing in which one party secretly chooses one of two b…
The security of quantum communication using a weak coherent source requires an accurate knowledge of the source's mean photon number. Finite calibration precision or an active manipulation by an attacker may cause the actual emitted photon number to deviate from the known value. We model effects of this deviation on the security of three quantum communication protocols: the Bennett-Brassard 1984 (BB84) quantum key distribution (QKD) protocol without decoy states, Scarani-Acin-Ribordy-Gisin 2004 (SARG04) QKD protocol, and a coin-tossing protocol. For QKD, we model both a strong attack using tec…
We investigate sampling procedures that certify that an arbitrary quantum state on $n$ subsystems is close to an ideal mixed state $φ^{\otimes n}$ for a given reference state $φ$, up to errors on a few positions. This task makes no sense classically: it would correspond to certifying that a given bitstring was generated according to some desired probability distribution. However, in the quantum case, this is possible if one has access to a prover who can supply a purification of the mixed state. In this work, we introduce the concept of mixed-state certification, and we show that a natural sam…
A long sequence of tosses of a classical coin produces an apparently random bit string, but classical randomness is an illusion: the algorithmic information content of a classically-generated bit string lies almost entirely in the description of initial conditions. This letter presents a simple argument that, by contrast, a sequence of bits produced by tossing a quantum coin is, almost certainly, genuinely (algorithmically) random. This result can be interpreted as a strengthening of Bell's no-hidden-variables theorem, and relies on causality and quantum entanglement in a manner similar to Bel…
We present a two-party protocol for quantum gambling, a new task closely related to coin tossing. The protocol allows two remote parties to play a gambling game, such that in a certain limit it becomes a fair game. No unconditionally secure classical method is known to accomplish this task.
We have developed a scheme to generate, control, transmit and measure entangled photonic qutrits (two photons each of dimension d = 3). A Bell test of this source has previously been reported elsewhere [1], therefore, here we focus on how the control of the system is realized. Motivated by these results, we outline how the scheme can be used for two specific quantum protocols, namely key distribution and coin tossing and discuss some of their advantages and disadvantages.
We devise a protocol to build 1D time-dependent quantum walks in 1D maximizing the spatial spread throughout the procedure. We allow only one of the physical parameters of the coin-tossing operator to vary, i.e. the angle $θ$, such that for $θ=0$ we have the $\hatσ_z$, while for $θ=π/4$ we obtain the Hadamard gate. The optimal $θ$ sequences present non-trivial patterns, with mostly $θ\approx 0$ alternated with $θ\approx π/4$ values after increasingly long periods. We provide an analysis of the entanglement properties, quasi-energy spectrum and survival probability, providing a full physical pi…
We experimentally demonstrate a quantum walk on a line in phase space using one and two trapped ion. A walk with up to 23 steps is realized by subjecting an ion to state-dependent displacement operations interleaved with quantum coin tossing operations. To analyze the ion's motional state after each step we apply a technique that directly maps the probability density distribution onto the ion's internal state. The measured probability distributions and the position's second moment clearly show the non-classical character of the quantum walk. To further highlight the difference between the clas…
For more than a decade, it was believed that unconditionally secure quantum bit commitment (QBC) is impossible. But basing on a previously proposed quantum key distribution scheme using orthogonal states, here we build a QBC protocol in which the density matrices of the quantum states encoding the commitment do not satisfy a crucial condition on which the no-go proofs of QBC are based. Thus the no-go proofs could be evaded. Our protocol is fault-tolerant and very feasible with currently available technology. It reopens the venue for other "post-cold-war" multi-party cryptographic protocols, e.…
The security of source has become an increasingly important issue in quantum cryptography. Based on the framework of measurement-device-independent quantum-key-distribution (MDI-QKD), the source becomes the only region exploitable by a potential eavesdropper (Eve). Phase randomization is a cornerstone assumption in most discrete-variable (DV-) quantum communication protocols (e.g., QKD, quantum coin tossing, weak coherent state blind quantum computing, and so on), and the violation of such an assumption is thus fatal to the security of those protocols. In this paper, we show a simple quantum h…
Bit commitment is a fundamental cryptographic task that guarantees a secure commitment between two mutually mistrustful parties and is a building block for many cryptographic primitives, including coin tossing, zero-knowledge proofs, oblivious transfer and secure two-party computation. Unconditionally secure bit commitment was thought to be impossible until recent theoretical protocols that combine quantum mechanics and relativity were shown to elude previous impossibility proofs. Here we implement such a bit commitment protocol. In the experiment, the committer performs quantum measurements u…
Here we propose a general relativistic quantum framework for cryptography that exploits the fascinating connection of quantum non-locality and special theory of relativity with cryptography. The underlying principle of unconditional security is causality and two-fold quantum non-local correlations: first entanglement swapping and then teleportation over causally independent entangled systems. We show that the proposed framework has following remarkable and novel features in mistrustful cryptography: (i) It helps in defining a new notion of oblivious transfer where both the data transferred and…
We introduce some new perfect state transfer and teleportation schemes by quantum walks with two coins. Encoding the transferred information in coin 1 state and alternatively using two coin operators, we can perfectly recover the information on coin 1 state at target position only by at most two times of flipping operation. Based on quantum walks with two coins either on the line or on the $N$-circle, we can perfectly transfer any qubit state. In addition, using quantum walks with two coins either on complete graphs or regular graphs, we can first implement perfect qudit state transfer by quan…
Lo and Chau showed that an ideal quantum coin flipping protocol is impossible. The proof was simply derived from the impossibility proof of quantum bit commitment. However, the proof still leaves the possibility of a quantum coin flipping protocol with arbitrary small bias. In this paper, we show that a quantum coin flipping protocol with arbitrary small bias is impossible and show the lower bound of the bias of quantum coin flipping protocol.
One of the earliest cryptographic applications of quantum information was to create quantum digital cash that could not be counterfeited. In this paper, we describe a new type of quantum money: quantum coins, where all coins of the same denomination are represented by identical quantum states. We state desirable security properties such as anonymity and unforgeability and propose two candidate quantum coin schemes: one using black box operations, and another using blind quantum computation.
We present a mathematical formalism for the description of unrestricted quantum walks with entangled coins and one walker. The numerical behaviour of such walks is examined when using a Bell state as the initial coin state, two different coin operators, two different shift operators, and one walker. We compare and contrast the performance of these quantum walks with that of a classical random walk consisting of one walker and two maximally correlated coins as well as quantum walks with coins sharing different degrees of entanglement. We illustrate that the behaviour of our walk with entangled …
We consider two independent quantum walks on separate lines augmented by partial or full swapping of coins after each step. For classical random walks, swapping or not swapping coins makes little difference to the random walk characteristics, but we show that quantum walks with partial swapping of coins have complicated yet elegant inter-walker correlations. Specifically we study the joint position distribution of the reduced two-walker state after tracing out the coins and analyze total, classical and quantum correlations in terms of the mutual information, the quantum mutual information, and…
We generalize the discrete quantum walk on the line using a time dependent unitary coin operator. We find an analytical relation between the long-time behaviors of the standard deviation and the coin operator. Selecting the coin time sequence allows to obtain a variety of predetermined asymptotic wave-function spreadings: ballistic, sub-ballistic, diffusive, sub-diffusive and localized.
Classical randomized algorithms use a coin toss instruction to explore different evolutionary branches of a problem. Quantum algorithms, on the other hand, can explore multiple evolutionary branches by mere superposition of states. Discrete quantum random walks, studied in the literature, have nonetheless used both superposition and a quantum coin toss instruction. This is not necessary, and a discrete quantum random walk without a quantum coin toss instruction is defined and analyzed here. Our construction eliminates quantum entanglement from the algorithm, and the results match those obtaine…
In this paper, we present a semi-loss-tolerant strong quantum coin-flipping (QCF) protocol with the best bias of 0.3536. Our manuscript applies Quantum non-demolition (QND) measurement to quantum coin-flipping protocol. Furthermore, a single photon as a single qubit is used to avoid the difficult implementation of EPR resources. We also analyze the security of our protocol obtaining the best result among all coin-flipping protocols considering loss. A semi-loss-tolerant Quantum Dice Rolling (QDR) protocol is first proposed, and the security of corresponding three-party QDR is analyzed to bette…
We investigated discrete-time quantum walks with an arbitary unitary coin. Here we discover that the average position $<x> =\max(<x> \sin(α+γ)$, while the initial state is $1/\sqrt{2}(\mid0L>+i\mid0R>)$. We prove the result and get some symmetry properties of quantum walks with a U(2) coin with $\mid0L>$ and $\mid0R>$ as the initial state.
Coin flipping is a fundamental cryptographic primitive that enables two distrustful and far apart parties to create a uniformly random bit [Blu81]. Quantum information allows for protocols in the information theoretic setting where no dishonest party can perfectly cheat. The previously best-known quantum protocol by Ambainis achieved a cheating probability of at most 3/4 [Amb01]. On the other hand, Kitaev showed that no quantum protocol can have cheating probability less than $1/\sqrt{2}$ [Kit03]. Closing this gap has been one of the important open questions in quantum cryptography. In this pa…
We report on the possibility of controlling quantum random walks with a step-dependent coin. The coin is characterized by a (single) rotation angle. Considering different rotation angles, one can find diverse probability distributions for this walk including: complete localization, Gaussian and asymmetric likes. In addition, we explore the entropy of walk in two contexts; for probability density distributions over position space and walker's internal degrees of freedom space (coin space). We show that entropy of position space can decrease for a step-dependent coin with the step-number, quite …
We introduce and analyze a one-dimensional quantum walk with two time-independent rotations on the coin. We study the influence on the property of quantum walk due to the second rotation on the coin. Based on the asymptotic solution in the long time limit, a ballistic behaviour of this walk is observed. This quantum walk retains the quadratic growth of the variance if the combined operator of the coin rotations is unitary. That confirms no localization exhibits in this walk. This result can be extended to the walk with multiple time-independent rotations on the coin.
We demonstrate a quantum walk with time-dependent coin bias. With this technique we realize an experimental single-photon one-dimensional quantum walk with a linearly-ramped time-dependent coin flip operation and thereby demonstrate two periodic revivals of the walker distribution. In our beam-displacer interferometer, the walk corresponds to movement between discretely separated transverse modes of the field serving as lattice sites, and the time-dependent coin flip is effected by implementing a different angle between the optical axis of half-wave plate and the light propagation at each step…
Quantum state transfer between different sites is a significant problem for quantum networks and quantum computers. By selecting quantum walks with two coins as the basic model and two coin spaces as the communication carriers, we successfully implement quantum state transfer on various graphs (EPL, \textbf{124} (2018) 60009) \cite{Shang_2019}. Here, we demonstrate the experimental implementation of this scheme using IBM quantum experience platform. In particular, we show the transfer of Bell state, GHZ state and W state on complete graph on the quantum device. Also, we observe that our protoc…
We present a generalized version of the discrete time quantum walk, using the SU(2) operation as the quantum coin. By varying the coin parameters, the quantum walk can be optimized for maximum variance subject to the functional form $σ^2 \approx N^2$ and the probability distribution in the position space can be biased. We also discuss the variation in measurement entropy with the variation of the parameters in the SU(2) coin. Exploiting this we show how quantum walk can be optimized for improving mixing time in an $n$-cycle and for quantum walk search.
In this paper we point out that the genuine quantum and classical correlations defined by Giorgi et al in two different ways [Phys. Rev. Lett. 107, 190501 (2011), arXiv:1108.0434] do not coincide in general.
"God does not play dice. He flips coins instead." And though for some reason He has denied us quantum bit commitment. And though for some reason he has even denied us strong coin flipping. He has, in His infinite mercy, granted us quantum weak coin flipping so that we too may flip coins. Instructions for the flipping of coins are contained herein. But be warned! Only those who have mastered Kitaev's formalism relating coin flipping and operator monotone functions may succeed. For those foolhardy enough to even try, a complete tutorial is included.
The dimensionality of the internal coin space of discrete-time quantum walks has a strong impact on the complexity and richness of the dynamics of quantum walkers. While two-dimensional coin operators are sufficient to define a certain range of dynamics on complex graphs, higher dimensional coins are necessary to unleash the full potential of discrete-time quantum walks. In this work we present an experimental realization of a discrete-time quantum walk on a line graph that, instead of two-dimensional, exhibits a four-dimensional coin space. Making use of the extra degree of freedom we observe…
Within a special multi-coin quantum walk scheme we analyze the effect of the entanglement of the initial coin state. For states with a special entanglement structure it is shown that this entanglement can be meausured with the mean value of the walk, which depends on the i-concurrence of the initial coin state. Further on the entanglement evolution is investigated and it is shown that the symmetry of the probability distribution is reflected by the symmetry of the entanglement distribution.
Quantum walks, both discrete (coined) and continuous time, form the basis of several recent quantum algorithms. Here we use numerical simulations to study the properties of discrete, coined quantum walks. We investigate the variation in the entanglement between the coin and the position of the particle by calculating the entropy of the reduced density matrix of the coin. We consider both dynamical evolution and asymptotic limits for coins of dimensions from two to eight on regular graphs. For low coin dimensions, quantum walks which spread faster (as measured by the mean square deviation of th…
We study maximal coin-position entanglement generation via a discrete-time quantum walk, in which the coin operation is randomly selected from one of two coin operators set at each step. We solve maximal entanglement generation as an optimization problem with quantum process fidelity as the cost function. Then we determine the maximal entanglement that can be rigorously generated for any step beyond the second regardless of initial condition with appropriate coin sequences. The simplest coin sequence comprising Hadamard and identity operations is equivalent to the generalized elephant quantum …
Non-equilibrium photon correlations of coherently excited single quantum systems can reveal their internal quantum dynamics and provide spectroscopic access. Here we propose and discuss the fundamentals of a coherent photon coincidence spectroscopy based on the application of laser pulses with variable delay and the detection of an time-averaged two-photon coincidence rate. For demonstration, two simple but important cases, i.e., an exciton - biexciton in a quantum dot and two coupled quantum emitters, are investigated based on quantum dynamics simulations demonstrating that this nonlinear spe…
Quantum protocols for coin-flipping can be composed in series in such a way that a cheating party gains no extra advantage from using entanglement between different rounds. This composition principle applies to coin-flipping protocols with cheat sensitivity as well, and is used to derive two results: There are no quantum strong coin-flipping protocols with cheat sensitivity that is linear in the bias (or bit-commitment protocols with linear cheat detection) because these can be composed to produce strong coin-flipping with arbitrarily small bias. On the other hand, it appears that quadratic ch…
How can two parties with competing interests carry out a fair coin flip, using only a noiseless quantum channel? This problem (quantum weak coin-flipping) was formalized more than 15 years ago, and, despite some phenomenal theoretical progress, practical quantum coin-flipping protocols with vanishing bias have proved hard to find. In the current work we show that there is a reason that practical weak quantum coin-flipping is difficult: any quantum weak coin-flipping protocol with bias $ε$ must use at least $\exp ( Ω(1/\sqrtε ))$ rounds of communication. This is a large improvement over the pre…
The control of quantum walk is made particularly transparent when the initial state is expressed in terms of the eigenstates of the coin operator. We show that the group-velocity density acquires a much simpler form when expressed in this basis. This allows us to obtain a much deeper understanding of the role of the initial coin state on the dynamics of quantum walks and control it. We find that the eigenvectors of the coin result in an extremal regime of a quantum walk. The approach is illustrated on two examples of quantum walks on a line.
