Alice is a charismatic quantum cryptographer who believes her parties are unmissable; Bob is a (relatively) glamorous string theorist who believes he is an indispensable guest. To prevent possibly traumatic collisions of self-perception and reality, their social code requires that decisions about invitation or acceptance be made via a cryptographically secure variable bias coin toss (VBCT). This generates a shared random bit by the toss of a coin whose bias is secretly chosen, within a stipulated range, by one of the parties; the other party learns only the random bit. Thus one party can secretly influence the outcome, while both can save face by blaming any negative decisions on bad luck.
We describe here some cryptographic VBCT protocols whose security is guaranteed by quantum theory and the impossibility of superluminal signalling, setting our results in the context of a general discussion of secure two-party computation. We also briefly discuss other cryptographic applications of VBCT.
In coin tossing two remote participants want to share a uniformly distributed random bit. At the least in the quantum version, each participant test whether or not the other has attempted to create a bias on this bit. It is requested that, for b = 0,1, the probability that Alice gets bit b and pass the test is smaller than 1/2 whatever she does, and similarly for Bob. If the bound 1/2 holds perfectly against any of the two participants, the task realised is called an exact coin tossing. If the bound is actually $1/2 + ξ$ where the bias $ξ$ vanishes when a security parameter m defined by the pr…
Joint Institute for Nuclear Research（联合核研究所）；Universidade de São Paulo（圣保罗大学）
The procedure of tossing quantum coins and dice is described. This case is an important example of a quantum procedure because it presents a typical framework employed in quantum information processing and quantum computing. The emphasis is on the clarification of the difference between quantum and classical conditional probabilities. These probabilities are designed for characterizing different systems, either quantum or classical, and they, generally, cannot be reduced to each other. Thus the Lüders probability cannot be treated as a generalization of the classical conditional probability. T…
Quantum coin tossing (QCT) is an important primitive of quantum cryptography and has received continuous interest. However, in practical QCT, Bob's detectors can be subjected to detector-side channel attacks launched by dishonest Alice, which will possibly make the protocol completely insecure. Here, we report a simple strategy of a detector-blinding attack based on a recent experiment. To remove all the detector side channels, we present a solution of measurement-device-independent QCT (MDI-QCT). This method is similar to the idea of MDI quantum key distribution (QKD). MDI-QCT is loss toleran…
When elementary quantum systems, such as polarized photons, are used to transmit digital information, the uncertainty principle gives rise to novel cryptographic phenomena unachievable with traditional transmission media, e.g. a communications channel on which it is impossible in principle to eavesdrop without a high probability of disturbing the transmission in such a way as to be detected. Such a quantum channel can be used in conjunction with ordinary insecure classical channels to distribute random key information between two users with the assurance that it remains unknown to anyone else,…
We investigate sampling procedures that certify that an arbitrary quantum state on $n$ subsystems is close to an ideal mixed state $φ^{\otimes n}$ for a given reference state $φ$, up to errors on a few positions. This task makes no sense classically: it would correspond to certifying that a given bitstring was generated according to some desired probability distribution. However, in the quantum case, this is possible if one has access to a prover who can supply a purification of the mixed state. In this work, we introduce the concept of mixed-state certification, and we show that a natural sam…
We investigate weak coin flipping, a fundamental cryptographic primitive where two distrustful parties need to remotely establish a shared random bit. A cheating player can try to bias the output bit towards a preferred value. For weak coin flipping the players have known opposite preferred values. A weak coin-flipping protocol has a bias $ε$ if neither player can force the outcome towards their preferred value with probability more than $\frac{1}{2}+ε$. While it is known that all classical protocols have $ε=\frac{1}{2}$, Mochon showed in 2007 [arXiv:0711.4114] that quantumly weak coin flippin…
We introduce relativistic multi-party biased die rolling protocols, generalizing coin flipping to $M \geq 2$ parties and to $N \geq 2$ outcomes for any chosen outcome biases, and show them unconditionally secure. Our results prove that the most general random secure multi-party computation, where all parties receive the output and there is no secret input by any party, can be implemented with unconditional security. Our protocols extend Kent's [A. Kent, Phys. Rev. Lett. 83, 5382 (1999)] two-party unbiased coin flipping protocol, do not require any quantum communication, are practical to implem…
We address the performance of a coin-biased quantum walk as a generator for non-classical position states of the walker. We exploit a phenomenon of coherent localisation in the position space --- resulting from the choice of small values of the coin parameter and assisted by post-selection --- to engineer large-size coherent superpositions of distinguishable position states of the walker. The protocol that we design appears to be remarkably robust against both the actual value taken by the coin parameter and strong dephasing-like noise acting on the spatial degree of freedom. We finally illust…
Aaronson and Drucker (2011) asked whether there exists a quantum finite automaton that can distinguish fair coin tosses from biased ones by spending significantly more time in accepting states, on average, given an infinite sequence of tosses. We answer this question negatively.
A family of loss-tolerant quantum coin flipping protocols
我们提出了一个家庭的损失容忍量子强抛硬币协议，每个协议不同的量子位数。对于单个量子比特，我们得到的偏差为0.4，再现了Berlin等人的结果[Phys. Rev. A 80，062321（2009）]，而对于两个量子比特，我们得到的偏差为0.3975。基于半定规划的数值证据表明，随着量子位数的增加，偏置继续减小，但速度很快。
Weak coin flipping (WCF) is a fundamental cryptographic primitive for two-party secure computation, where two distrustful parties need to remotely establish a shared random bit whilst having opposite preferred outcomes. It is the strongest known primitive with arbitrarily close to perfect security quantumly while classically, its security is completely compromised (unless one makes further assumptions, such as computational hardness). A WCF protocol is said to have bias $ε$ if neither party can force their preferred outcome with probability greater than $1/2+ε$. Classical WCF protocols are sho…
How can two parties with competing interests carry out a fair coin flip, using only a noiseless quantum channel? This problem (quantum weak coin-flipping) was formalized more than 15 years ago, and, despite some phenomenal theoretical progress, practical quantum coin-flipping protocols with vanishing bias have proved hard to find. In the current work we show that there is a reason that practical weak quantum coin-flipping is difficult: any quantum weak coin-flipping protocol with bias $ε$ must use at least $\exp ( Ω(1/\sqrtε ))$ rounds of communication. This is a large improvement over the pre…
Given a coin with unknown bias $p\in [0,1]$, can we exactly simulate another coin with bias $f(p)$? The exact set of simulable functions has been well characterized 20 years ago. In this paper, we ask the quantum counterpart of this question: Given the quantum coin $|p\rangle=\sqrt{p}|0\rangle+\sqrt{1-p}|1\rangle$, can we exactly simulate another quantum coin $|f(p)\rangle=\sqrt{f(p)}|0\rangle+\sqrt{1-f(p)}|1\rangle$? We give the full characterization of simulable quantum state $k_0(p)|0\rangle+k_1(p)|1\rangle$ from quantum coin $|p\rangle=\sqrt{p}|0\rangle+\sqrt{1-p}|1\rangle$, and present an…
Weak coin flipping is among the fundamental cryptographic primitives which ensure the security of modern communication networks. It allows two mistrustful parties to remotely agree on a random bit when they favor opposite outcomes. Unlike other two-party computations, one can achieve information-theoretic security using quantum mechanics only: both parties are prevented from biasing the flip with probability higher than $1/2+ε$, where $ε$ is arbitrarily low. Classically, the dishonest party can always cheat with probability $1$ unless computational assumptions are used. Despite its importance,…
