Weak Coin Flipping Research Articles

Experimental cheat-sensitive quantum weak coin flipping

As in modern communication networks, the security of quantum networks will rely on complex cryptographic tasks that are based on a handful of fundamental primitives. Weak coin flipping (WCF) is a significant such primitive which allows two mistrustful parties to agree on a random bit while they favor opposite outcomes. Remarkably, perfect information-theoretic security can be achieved in principle for quantum WCF. Here, we overcome conceptual and practical issues that have prevented the experimental demonstration of this primitive to date, and demonstrate how quantum resources can provide cheat sensitivity, whereby each party can detect a cheating opponent, and an honest party is never sanctioned. Such a property is not known to be classically achievable with information-theoretic security. Our experiment implements a refined, loss-tolerant version of a recently proposed theoretical protocol and exploits heralded single photons generated by spontaneous parametric down conversion, a carefully optimized linear optical interferometer including beam splitters with variable reflectivities and a fast optical switch for the verification step. High values of our protocol benchmarks are maintained for attenuation corresponding to several kilometers of telecom optical fiber.

Quantum weak coin flipping with a single photon

Weak coin flipping is among the fundamental cryptographic primitives which ensure the security of modern communication networks. It allows two mistrustful parties to remotely agree on a random bit when they favor opposite outcomes. Unlike other two-party computations, one can achieve information-theoretic security using quantum mechanics only: both parties are prevented from biasing the flip with probability higher than $1/2+\epsilon$, where $\epsilon$ is arbitrarily low. Classically, the dishonest party can always cheat with probability $1$ unless computational assumptions are used. Despite its importance, no physical implementation has been proposed for quantum weak coin flipping. Here, we present a practical protocol that requires a single photon and linear optics only. We show that it is fair and balanced even when threshold single-photon detectors are used, and reaches a bias as low as $\epsilon=1/\sqrt{2}-1/2\approx 0.207$. We further show that the protocol may display quantum advantage over a few hundred meters with state-of-the-art technology.

Large family of quantum weak coin-flipping protocols

Each classical public-coin protocol for coin flipping is naturally associated with a quantum protocol for weak coin flipping. The quantum protocol is obtained by replacing classical randomness with quantum entanglement and by adding a cheat detection test in the last round that verifies the integrity of this entanglement. The set of such protocols defines a family which contains the protocol with bias 0.192 previously found by the author, as well as protocols with bias as low as 1/6 described herein. The family is analyzed by identifying a set of optimal protocols for every number of messages. In the end, tight lower bounds for the bias are obtained which prove that 1/6 is optimal for all protocols within the family.

Quantum state targeting

We introduce a primitive for quantum cryptography that we term ``state targeting.'' We show that increasing one's probability of success in this task above a minimum amount implies an unavoidable increase in the probability of a particular kind of failure. This is analogous to the unavoidable disturbance to a quantum state that results from gaining information about its identity, and can be shown to be a purely quantum effect. We solve various optimization problems for state targeting that are useful for the security analysis of two-party cryptographic tasks implemented between remote antagonistic parties. Although we focus on weak coin flipping, the results are significant for other two-party protocols, such as strong coin flipping, partially binding and concealing bit commitment, and bit escrow. Furthermore, the results have significance not only for the traditional notion of security in cryptography, that of restricting a cheater's ability to bias the outcome of the protocol, but also for a different notion of security that arises only in the quantum context, that of cheat sensitivity. Finally, our analysis leads to some interesting secondary results, namely, a generalization of Uhlmann's theorem and an operational interpretation of the fidelity between two mixed states.

Quantum protocol for cheat-sensitive weak coin flipping.

We present a quantum protocol for the task of weak coin flipping. We find that, for one choice of parameters in the protocol, the maximum probability of a dishonest party winning the coin flip if the other party is honest is 1/sqrt[2]. We also show that if parties restrict themselves to strategies wherein they cannot be caught cheating, their maximum probability of winning can be even smaller. As such, the protocol offers additional security in the form of cheat sensitivity.