Lower bound for a class of weak quantum coin flipping protocols

Andris Ambainis

DOI: https://doi.org/10.48550/arXiv.quant-ph/0204063

2002-04-11

Quantum Physics

Abstract:We study the class of protocols for weak quantum coin flipping introduced by Spekkens and Rudolph (quant-ph/0202118). We show that, for any protocol in this class, one party can win the coin flip with probability at least $1/\sqrt{2}$.

What problem does this paper attempt to address?

Tight bounds for classical and quantum coin flipping

Esther Hänggi,Jürg Wullschleger

DOI: https://doi.org/10.1007/978-3-642-19571-6_28

2011-04-26

Abstract:Coin flipping is a cryptographic primitive for which strictly better protocols exist if the players are not only allowed to exchange classical, but also quantum messages. During the past few years, several results have appeared which give a tight bound on the range of implementable unconditionally secure coin flips, both in the classical as well as in the quantum setting and for both weak as well as strong coin flipping. But the picture is still incomplete: in the quantum setting, all results consider only protocols with perfect correctness, and in the classical setting tight bounds for strong coin flipping are still missing. We give a general definition of coin flipping which unifies the notion of strong and weak coin flipping (it contains both of them as special cases) and allows the honest players to abort with a certain probability. We give tight bounds on the achievable range of parameters both in the classical and in the quantum setting.

Quantum Physics,Cryptography and Security
Protocols for Quantum Weak Coin Flipping

Atul Singh Arora,Jérémie Roland,Chrysoula Vlachou,Stephan Weis

2024-02-25

Abstract:Weak coin flipping is an important cryptographic primitive -- it is the strongest known secure two-party computation primitive that classically becomes secure only under certain assumptions (e.g. computational hardness), while quantumly there exist protocols that achieve arbitrarily close to perfect security. This breakthrough result was established by Mochon in 2007 [

Quantum Physics,Cryptography and Security
Improving device-independent weak coin flipping protocols

Atul Singh Arora,Jamie Sikora,Thomas Van Himbeeck

2024-04-26

Abstract:Weak coin flipping is the cryptographic task where Alice and Bob remotely flip a coin but want opposite outcomes. This work studies this task in the device-independent regime where Alice and Bob neither trust each other, nor their quantum devices. The best protocol was devised over a decade ago by Silman, Chailloux, Aharon, Kerenidis, Pironio, and Massar with bias $\varepsilon \approx 0.33664$, where the bias is a commonly adopted security measure for coin flipping protocols. This work presents two techniques to lower the bias of such protocols, namely self-testing and abort-phobic compositions. We apply these techniques to the SCAKPM '11 protocol above and, assuming a continuity conjecture, lower the bias to $\varepsilon \approx 0.29104$. We believe that these techniques could be useful in the design of device-independent protocols for a variety of other tasks.

Quantum Physics,Cryptography and Security
Optimal bounds for quantum bit commitment

André Chailloux,Iordanis Kerenidis

DOI: https://doi.org/10.48550/arXiv.1102.1678

2011-02-09

Abstract:Bit commitment is a fundamental cryptographic primitive with numerous applications. Quantum information allows for bit commitment schemes in the information theoretic setting where no dishonest party can perfectly cheat. The previously best-known quantum protocol by Ambainis achieved a cheating probability of at most 3/4[Amb01]. On the other hand, Kitaev showed that no quantum protocol can have cheating probability less than 1/sqrt{2} [Kit03] (his lower bound on coin flipping can be easily extended to bit commitment). Closing this gap has since been an important and open question. In this paper, we provide the optimal bound for quantum bit commitment. We first show a lower bound of approximately 0.739, improving Kitaev's lower bound. We then present an optimal quantum bit commitment protocol which has cheating probability arbitrarily close to 0.739. More precisely, we show how to use any weak coin flipping protocol with cheating probability 1/2 + eps in order to achieve a quantum bit commitment protocol with cheating probability 0.739 + O(eps). We then use the optimal quantum weak coin flipping protocol described by Mochon[Moc07]. To stress the fact that our protocol uses quantum effects beyond the weak coin flip, we show that any classical bit commitment protocol with access to perfect weak (or strong) coin flipping has cheating probability at least 3/4.

Quantum Physics
A Tight Lower Bound on Adaptively Secure Full-Information Coin Flip

Iftach Haitner,Yonatan Karidi-Heller

2024-10-27

Abstract:In a distributed coin-flipping protocol, Blum [ACM Transactions on Computer Systems '83], the parties try to output a common (close to) uniform bit, even when some adversarially chosen parties try to bias the common output. In an adaptively secure full-information coin flip, Ben-Or and Linial [FOCS '85], the parties communicate over a broadcast channel, and a computationally unbounded adversary can choose which parties to corrupt along the protocol execution. Ben-Or and Linial proved that the $n$-party majority protocol is resilient to $O(\sqrt{n})$ corruptions (ignoring poly-logarithmic factors), and conjectured this is a tight upper bound for any $n$-party protocol (of any round complexity). Their conjecture was proved to be correct for single-turn (each party sends a single message) single-bit (a message is one bit) protocols Lichtenstein, Linial and Saks [Combinatorica '89], symmetric protocols Goldwasser, Tauman Kalai and Park [ICALP '15], and recently for (arbitrary message length) single-turn protocols Tauman Kalai, Komargodski and Raz [DISC '18]. Yet, the question of many-turn protocols was left entirely open. In this work, we close the above gap, proving that no $n$-party protocol (of any round complexity) is resilient to $\omega(\sqrt{n})$ (adaptive) corruptions.

Cryptography and Security
Lower Bounds for Quantum Oblivious Transfer

André Chailloux,Iordanis Kerenidis,Jamie Sikora

DOI: https://doi.org/10.48550/arXiv.1007.1875

2013-03-23

Abstract:Oblivious transfer is a fundamental primitive in cryptography. While perfect information theoretic security is impossible, quantum oblivious transfer protocols can limit the dishonest players' cheating. Finding the optimal security parameters in such protocols is an important open question. In this paper we show that every 1-out-of-2 oblivious transfer protocol allows a dishonest party to cheat with probability bounded below by a constant strictly larger than 1/2. Alice's cheating is defined as her probability of guessing Bob's index, and Bob's cheating is defined as his probability of guessing both input bits of Alice. In our proof, we relate these cheating probabilities to the cheating probabilities of a coin flipping protocol and conclude by using Kitaev's coin flipping lower bound. Then, we present an oblivious transfer protocol with two messages and cheating probabilities at most 3/4. Last, we extend Kitaev's semidefinite programming formulation to more general primitives, where the security is against a dishonest player trying to force the outcome of the other player, and prove optimal lower and upper bounds for them.

Quantum Physics
Simple, near-optimal quantum protocols for die-rolling

Jamie Sikora

DOI: https://doi.org/10.48550/arXiv.1605.08156

2018-08-28

Abstract:Die-rolling is the cryptographic task where two mistrustful, remote parties wish to generate a random $D$-sided die-roll over a communication channel. Optimal quantum protocols for this task have been given by Aharon and Silman (New Journal of Physics, 2010) but are based on optimal weak coin-flipping protocols which are currently very complicated and not very well understood. In this paper, we first present very simple classical protocols for die-rolling which have decent (and sometimes optimal) security which is in stark contrast to coin-flipping, bit-commitment, oblivious transfer, and many other two-party cryptographic primitives. We also present quantum protocols based on integer-commitment, a generalization of bit-commitment, where one wishes to commit to an integer. We analyze these protocols using semidefinite programming and finally give protocols which are very close to Kitaev's lower bound for any $D \geq 3$. Lastly, we briefly discuss an application of this work to the quantum state discrimination problem.

Quantum Physics,Optimization and Control
Experimental cheat-sensitive quantum weak coin flipping

Simon Neves,Verena Yacoub,Ulysse Chabaud,Mathieu Bozzio,Iordanis Kerenidis,Eleni Diamanti

DOI: https://doi.org/10.1038/s41467-023-37566-x

2022-11-07

Abstract:As in modern communication networks, the security of quantum networks will rely on complex cryptographic tasks that are based on a handful of fundamental primitives. Weak coin flipping (WCF) is a significant such primitive which allows two mistrustful parties to agree on a random bit while they favor opposite outcomes. Remarkably, perfect information-theoretic security can be achieved in principle for quantum WCF. Here, we overcome conceptual and practical issues that have prevented the experimental demonstration of this primitive to date, and demonstrate how quantum resources can provide cheat sensitivity, whereby each party can detect a cheating opponent, and an honest party is never sanctioned. Such a property is not known to be classically achievable with information-theoretic security. Our experiment implements a refined, loss-tolerant version of a recently proposed theoretical protocol and exploits heralded single photons generated by spontaneous parametric down conversion, a carefully optimized linear optical interferometer including beam splitters with variable reflectivities and a fast optical switch for the verification step. High values of our protocol benchmarks are maintained for attenuation corresponding to several kilometers of telecom optical fiber.

Quantum Physics
Unconditionally secure quantum coin flipping

Guang Ping He

DOI: https://doi.org/10.1016/j.rinp.2023.106398

2023-07-23

Abstract:Quantum coin flipping (QCF) is an essential primitive for quantum cryptography. Unconditionally secure strong QCF with an arbitrarily small bias was widely believed to be impossible. But basing on a problem which cannot be solved without quantum algorithm, here we propose such a QCF protocol, and show how it manages to evade all existing no-go proofs on QCF.

Quantum Physics
A proposal for founding mistrustful quantum cryptography on coin tossing

Adrian Kent

DOI: https://doi.org/10.1103/PhysRevA.68.012312

2003-06-12

Abstract:A significant branch of classical cryptography deals with the problems which arise when mistrustful parties need to generate, process or exchange information. As Kilian showed a while ago, mistrustful classical cryptography can be founded on a single protocol, oblivious transfer, from which general secure multi-party computations can be built. The scope of mistrustful quantum cryptography is limited by no-go theorems, which rule out, inter alia, unconditionally secure quantum protocols for oblivious transfer or general secure two-party computations. These theorems apply even to protocols which take relativistic signalling constraints into account. The best that can be hoped for, in general, are quantum protocols computationally secure against quantum attack. I describe here a method for building a classically certified bit commitment, and hence every other mistrustful cryptographic task, from a secure coin tossing protocol. No security proof is attempted, but I sketch reasons why these protocols might resist quantum computational attack.

Quantum Physics,Cryptography and Security
Semi-Loss-Tolerant Strong Coin Flipping Protocol Using EPR Pairs

Jia-Jun Ma,Fen-Zhuo Guo,Qian Yang,Yan-Bing Li,Qiao-Yan Wen

DOI: https://doi.org/10.48550/arXiv.1107.1455

2012-03-19

Abstract:In this paper, we present a quantum strong coin flipping protocol. In this protocol, an EPR pair and a quantum memory storage are made use of, and losses in the quantum communication channel and quantum memory storage are all analyzed. We obtain the bias in the fair scenario as a function of $p$, where $p$ is the probability that the particle in Bob's quantum memory storage is lost, which means our bias varies as the degree of losses in the quantum memory storage changes. Therefore we call our protocol semi-loss-tolerant. We also show that the bias decreases with decreasing $p$. When $p$ approaches 0, the bias approaches 0.3536, which is less than that of all the previous loss-tolerant protocols. Details of both parties' optimal cheating strategies are also given and analyzed. What's more, experimental feasibility is discussed and demonstrated. Compared with previous qubit-based loss-tolerant SCF protocols, we introduce the EPR pair to keep our protocol loss-tolerant while trying to push down the bias. In addition, a quantum memory storage is used and the losses in it has been taken into account. We obtain the bias in the fair scenario as a function of $p$, where $p$ is the probability that the particle in Bob's quantum memory storage is lost, which means our bias varies as the degree of losses in the quantum memory storage changes. We also show that the bias decreases with decreasing $p$. When $p$ approaches 0, the bias approaches 0.3536, which is less than that of all the previous loss-tolerant protocols. Details of both parties' optimal cheating strategies are also given and analyzed. Besides, experimental feasibility is discussed and demonstrated.

Quantum Physics
One Weird Trick Tightens the Quantum Adversary Bound, Especially for Success Probability Close to $1/2$

Duyal Yolcu

2023-03-18

Abstract:The textbook adversary bound for function evaluation states that to evaluate a function $f\colon D\to C$ with success probability $\frac{1}{2}+\delta$ in the quantum query model, one needs at least $\left( 2\delta -\sqrt{1-4\delta^2} \right) Adv(f)$ queries, where $Adv(f)$ is the optimal value of a certain optimization problem. For $\delta \ll 1$, this only allows for a bound of $\Theta\left(\delta^2 Adv(f)\right)$ even after a repetition-and-majority-voting argument. In contrast, the polynomial method can sometimes prove a bound that doesn't converge to $0$ as $\delta \to 0$. We improve the $\delta$-dependent prefactor and achieve a bound of $2\delta Adv(f)$. The proof idea is to "turn the output condition into an input condition": From an algorithm that transforms perfectly input-independent initial to imperfectly distinguishable final states, we construct one that transforms imperfectly input-independent initial to perfectly distinguishable final states in the same number of queries by projecting onto the "correct" final subspaces and uncomputing. The resulting $\delta$-dependent condition on initial Gram matrices, compared to the original algorithm's condition on final Gram matrices, allows deriving the tightened prefactor.

Quantum Physics,Computational Complexity
A constant lower bound for any quantum protocol for secure function evaluation

Sarah Osborn,Jamie Sikora

DOI: https://doi.org/10.48550/arXiv.2203.08268

2022-03-16

Abstract:Secure function evaluation is a two-party cryptographic primitive where Bob computes a function of Alice's and his respective inputs, and both hope to keep their inputs private from the other party. It has been proven that perfect (or near perfect) security is impossible, even for quantum protocols. We generalize this no-go result by exhibiting a constant lower bound on the cheating probabilities for any quantum protocol for secure function evaluation, and present many applications from oblivious transfer to the millionaire's problem. Constant lower bounds are of practical interest since they imply the impossibility to arbitrarily amplify the security of quantum protocols by any means.

Quantum Physics
Classical and quantum fingerprinting with shared randomness and one-sided error

R.T. Horn,A.J. Scott,J. Walgate,R. Cleve,A.I. Lvovsky,B.C. Sanders

DOI: https://doi.org/10.26421/qic5.3-6

2005-05-01

Quantum Information and Computation

Abstract:Within the simultaneous message passing model of communication complexity, under a public-coin assumption, we derive the minimum achievable worst-case error probability of a classical fingerprinting protocol with one-sided error. We then present entanglement-assisted quantum fingerprinting protocols attaining worst-case error probabilities that breach this bound.

physics, particles & fields,quantum science & technology, mathematical,computer science, theory & methods
On the composable security of weak coin flipping

Jiawei Wu,Yanglin Hu,Akshay Bansal,Marco Tomamichel

2024-06-21

Abstract:Weak coin flipping is a cryptographic primitive in which two mutually distrustful parties generate a shared random bit to agree on a winner via remote communication. While a stand-alone secure weak coin flipping protocol can be constructed from noiseless communication channels, its composability has not been explored. In this work, we demonstrate that no weak coin flipping protocol can be abstracted into a black box resource with composable security. Despite this, we also establish the overall stand-alone security of weak coin flipping protocols under sequential composition.

Quantum Physics,Cryptography and Security
The Chernoff lower bound for symmetric quantum hypothesis testing

Michael Nussbaum,Arleta Szkoła

DOI: https://doi.org/10.1214/08-AOS593

2009-04-27

Abstract:We consider symmetric hypothesis testing in quantum statistics, where the hypotheses are density operators on a finite-dimensional complex Hilbert space, representing states of a finite quantum system. We prove a lower bound on the asymptotic rate exponents of Bayesian error probabilities. The bound represents a quantum extension of the Chernoff bound, which gives the best asymptotically achievable error exponent in classical discrimination between two probability measures on a finite set. In our framework, the classical result is reproduced if the two hypothetic density operators commute. Recently, it has been shown elsewhere [Phys. Rev. Lett. 98 (2007) 160504] that the lower bound is achievable also in the generic quantum (noncommutative) case. This implies that our result is one part of the definitive quantum Chernoff bound.

Quantum Physics
Tight Bounds for the Randomized and Quantum Communication Complexities of Equality with Small Error

Olivier Lalonde,Nikhil S. Mande,Ronald de Wolf

2023-10-18

Abstract:We investigate the randomized and quantum communication complexities of the well-studied Equality function with small error probability $\epsilon$, getting optimal constant factors in the leading terms in a number of different models. In the randomized model, 1) we give a general technique to convert public-coin protocols to private-coin protocols by incurring a small multiplicative error, at a small additive cost. This is an improvement over Newman's theorem [Inf. Proc. Let.'91] in the dependence on the error parameter. 2) Using this we obtain a $(\log(n/\epsilon^2)+4)$-cost private-coin communication protocol that computes the $n$-bit Equality function, to error $\epsilon$. This improves upon the $\log(n/\epsilon^3)+O(1)$ upper bound implied by Newman's theorem, and matches the best known lower bound, which follows from Alon [Comb. Prob. Comput.'09], up to an additive $\log\log(1/\epsilon)+O(1)$. In the quantum model, 1) we exhibit a one-way protocol of cost $\log(n/\epsilon)+4$, that uses only pure states and computes the $n$-bit Equality function to error $\epsilon$. This bound was implicitly already shown by Nayak [PhD thesis'99]. 2) We show that any $\epsilon$-error one-way protocol for $n$-bit Equality that uses only pure states communicates at least $\log(n/\epsilon)-\log\log(1/\epsilon)-O(1)$ qubits. 3) We exhibit a one-way protocol of cost $\log(\sqrt{n}/\epsilon)+3$, that uses mixed states and computes the $n$-bit Equality function to error $\epsilon$. This is also tight up to an additive $\log\log(1/\epsilon)+O(1)$, which follows from Alon's result. 4) We study the number of EPR pairs required to be shared in an entanglement-assisted one-way protocol. Our upper bounds also yield upper bounds on the approximate rank and related measures of the Identity matrix.

Quantum Physics,Computational Complexity
Reexamination of Quantum Bit Commitment: the Possible and the Impossible

Giacomo Mauro D'Ariano,Dennis Kretschmann,Dirk Schlingemann,Reinhard F. Werner

DOI: https://doi.org/10.1103/PhysRevA.76.032328

2007-10-15

Abstract:Bit commitment protocols whose security is based on the laws of quantum mechanics alone are generally held to be impossible. In this paper we give a strengthened and explicit proof of this result. We extend its scope to a much larger variety of protocols, which may have an arbitrary number of rounds, in which both classical and quantum information is exchanged, and which may include aborts and resets. Moreover, we do not consider the receiver to be bound to a fixed "honest" strategy, so that "anonymous state protocols", which were recently suggested as a possible way to beat the known no-go results are also covered. We show that any concealing protocol allows the sender to find a cheating strategy, which is universal in the sense that it works against any strategy of the receiver. Moreover, if the concealing property holds only approximately, the cheat goes undetected with a high probability, which we explicitly estimate. The proof uses an explicit formalization of general two party protocols, which is applicable to more general situations, and a new estimate about the continuity of the Stinespring dilation of a general quantum channel. The result also provides a natural characterization of protocols that fall outside the standard setting of unlimited available technology, and thus may allow secure bit commitment. We present a new such protocol whose security, perhaps surprisingly, relies on decoherence in the receiver's lab.

Quantum Physics
Estimating Gaps in Martingales and Applications to Coin-Tossing: Constructions and Hardness

Hamidreza Amini Khorasgani,Hemanta K. Maji,Tamalika Mukherjee

DOI: https://doi.org/10.48550/arXiv.1907.01694

2019-11-27

Abstract:Consider designing a distributed coin-tossing protocol for n processors such that the probability of heads is X0 in [0,1], and an adversary can reset one processor to change the distribution of the final outcome. For X0=1/2, in the non-cryptographic setting, Blum's majority protocol is $\frac1{\sqrt{2\pi n}}$ insecure. For computationally bounded adversaries and any X0 in [0,1], the protocol of Moran,Naor,Segev (2009) is only O(1/n) insecure. In this paper, we study discrete-time martingales (X0,X1,..,Xn) such that Xi in [0,1], for all i in {0,..,n}, and Xn in {0,1}. In particular, for any X0 in [0,1], we construct martingales that yield $\frac12\sqrt{\frac{X_0(1-X_0)}{n}}$ insecure coin-tossing protocols with n-bit communication; irrespective of the number of bits required to represent the output distribution. Note that for sufficiently small X0, we achieve higher security than Moran et al's protocol even against computationally unbounded adversaries. For X0=1/2, our protocol requires only 40% of the processors to obtain the same security as the majority protocol. We introduce a new inductive technique that uses geometric transformations to estimate the large gaps in these martingales. For any X0 in [0,1], we show that there exists a stopping time $T$ such that $\mathbb{E}[|{X_T-X_{T-1}}|]\geq\frac2{\sqrt{2n-1}}\cdot X_0(1-X_0)$. The inductive technique also constructs martingales that demonstrate the optimality of our bound - we construct optimal martingales such that any $T$ has$\mathbb{E}[|{X_T-X_{T-1}}|]\leq\frac1{\sqrt{n}}\cdot\sqrt{X_0(1-X_0)}$. Our lower-bound holds for all X0 in [0,1]; while the previous bound of Cleve,Impagliazzo (1993) exists only for positive constant X0. Our approach only employs elementary techniques and avoids the complex probabilistic tools inherent to the approaches of Cleve,Impagliazzo (1993) and Beimel,Haitner,Makriyannis,Omri (2018).

Discrete Mathematics
An Almost-Optimally Fair Three-Party Coin-Flipping Protocol

Iftach Haitner,Eliad Tsfadia

DOI: https://doi.org/10.48550/arXiv.2105.00850

2021-05-04

Abstract:In a multiparty fair coin-flipping protocol, the parties output a common (close to) unbiased bit, even when some corrupted parties try to bias the output. Cleve [STOC 1986] has shown that in the case of dishonest majority (i.e., at least half of the parties can be corrupted), in any $m$-round coin-flipping protocol the corrupted parties can bias the honest parties' common output bit by $\Omega(\frac1{m})$. For more than two decades the best known coin-flipping protocols against dishonest majority had bias $\Theta(\frac{\ell}{\sqrt{m}})$, where $\ell$ is the number of corrupted parties. This was changed by a recent breakthrough result of Moran et al. [TCC 2009], who constructed an $m$-round, two-party coin-flipping protocol with optimal bias $\Theta(\frac1{m})$. In a subsequent work, Beimel et al. [Crypto 2010] extended this result to the multiparty case in which less than $\frac23$ of the parties can be corrupted. Still for the case of $\frac23$ (or more) corrupted parties, the best known protocol had bias $\Theta(\frac{\ell}{\sqrt{m}})$. In particular, this was the state of affairs for the natural three-party case. We make a step towards eliminating the above gap, presenting an $m$-round, three-party coin-flipping protocol, with bias $\frac{O(\log^3 m)}m$. Our approach (which we also apply for the two-party case) does not follow the "threshold round" paradigm used in the work of Moran et al. and Beimel et al., but rather is a variation of the majority protocol of Cleve, used to obtain the aforementioned $\Theta(\frac{\ell}{\sqrt{m}})$-bias protocol.

Cryptography and Security

Lower bound for a class of weak quantum coin flipping protocols

Tight bounds for classical and quantum coin flipping

Protocols for Quantum Weak Coin Flipping

Improving device-independent weak coin flipping protocols

Optimal bounds for quantum bit commitment

A Tight Lower Bound on Adaptively Secure Full-Information Coin Flip

Lower Bounds for Quantum Oblivious Transfer

Simple, near-optimal quantum protocols for die-rolling

Experimental cheat-sensitive quantum weak coin flipping

Unconditionally secure quantum coin flipping

A proposal for founding mistrustful quantum cryptography on coin tossing

Semi-Loss-Tolerant Strong Coin Flipping Protocol Using EPR Pairs

One Weird Trick Tightens the Quantum Adversary Bound, Especially for Success Probability Close to $1/2$

A constant lower bound for any quantum protocol for secure function evaluation

Classical and quantum fingerprinting with shared randomness and one-sided error

On the composable security of weak coin flipping

The Chernoff lower bound for symmetric quantum hypothesis testing

Tight Bounds for the Randomized and Quantum Communication Complexities of Equality with Small Error

Reexamination of Quantum Bit Commitment: the Possible and the Impossible

Estimating Gaps in Martingales and Applications to Coin-Tossing: Constructions and Hardness

An Almost-Optimally Fair Three-Party Coin-Flipping Protocol