Experimental quantum tossing of a single coin
aa r X i v : . [ qu a n t - ph ] A p r Experimental quantum tossing of a single coin
A. T. Nguyen , J. Frison , K. Phan Huy and S. Massar Service OPERA photonique, CP 194/5, Universit´e Libre de Bruxelles (U.L.B.),Avenue F. D. Roosevelt 50, B-1050 Bruxelles, Belgium Laboratoire d’Information Quantique, CP 225, Universit´e Libre de Bruxelles(U.L.B.), Boulevard du Triomphe, B-1050 Bruxelles, Belgium D´epartement d’Optique P.M. Duffieux, Institut FEMTO-ST, Centre National de laRecherche Scientifique UMR 6174, Universit´e de Franche-Comt´e, 25030 Besan¸con,FranceE-mail: [email protected] , [email protected] Abstract.
The cryptographic protocol of coin tossing consists of two parties, Aliceand Bob, that do not trust each other, but want to generate a random bit. If the partiesuse a classical communication channel and have unlimited computational resources, oneof them can always cheat perfectly. Here we analyze in detail how the performance of aquantum coin tossing experiment should be compared to classical protocols, taking intoaccount the inevitable experimental imperfections. We then report an all-optical fiberexperiment in which a single coin is tossed whose randomness is higher than achievableby any classical protocol and present some easily realisable cheating strategies by Aliceand Bob.PACS numbers: 42.50.-p,42.50.Ex xperimental quantum tossing of a single coin
1. Introduction
The cryptographic protocol of coin tossing introduced by Blum [1] consists of twoparties, Alice and Bob, that do not trust each other, but want to generate arandom bit. If the parties use a classical communication channel and have unlimitedcomputational resources, one of them can always cheat perfectly. But what if theyuse a quantum communication channel? Because of its conceptual importance andpotential applications, quantum coin tossing was already envisaged by Bennett andBrassard in their seminal paper on quantum cryptography [2]. Later works showed thatperfect quantum coin tossing is impossible [4, 5, 6], but that imperfect protocols exist[7, 5, 8, 9, 10, 11] that perform better than any classical protocol.Work on quantum coin tossing distinguishes between “weak coin tossing” and“strong coin tossing”. In weak coin tossing Alice and Bob have antagonistic goals:Alice wants the coin to be heads, say, whereas Bob wants the coin to come out tails.Good quantum protocols for weak coin tossing exist, although they seem very difficultto implement[11]. In strong coin tossing Alice and Bob both want the coin to beperfectly random. Quantum protocols that perform better at strong coin tossing thanany classical protocol exist[9, 10] and come close to the known upper bound (for theoriginal unpublished proof of the upperbound, see[6]; published proofs can be found in[12, 13]).Quantum coin tossing itself is just one example of several interesting tasks thattwo parties which do not trust each other can achieve if they share a quantumcommunication channel, but cannot achieve if they use a classical communicationchannel. Other examples include multiparty coin tossing[12] and weak forms of stringcommittment[14, 15]. The no go theorems mentioned above [4, 5, 6] rule out most otherapplications, except if one adds additional assumptions such as bounding the size ofquantum memories[16].Recently two works [17, 18] have experimentally studied optical implementationsof quantum coin tossing. However the experiment of ref. [17] suffered from importantphoton loss which made it difficult to assess how the experiment worked when tossinga single coin. This was circumvented, as in [18], by addressing string flipping, i.e. theproblem where the parties try to toss a string of coins rather than a single one. Theseworks were however carried out without realizing that good classical protocols exist forstring flipping, see e.g. [19] for a presentation of such protocols.In the present work we go back to the conceptually simpler problem of tossing asingle coin, and report an experiment in which a single coin is tossed whose randomnessis higher than achievable by any classical protocol. We begin by discussing in detailhow the results of such a coin tossing experiment should be compared with classicalprotocols in view of the inevitable imperfections that will occur in any experimentalrealisation. Coin tossing in the presence of noise was already studied in [20], but withthe emphasiz on applications to string flipping, whereas here we are concerned withtossing a single coin. We then present the experimental implementation, which follows xperimental quantum tossing of a single coin
2. Formulation of the problem
A protocol for coin tossing consists in a series of rounds of (classical or quantum)communication at the end of which the parties decide on an outcome. The outcomecan be either a decision that the coin has the value c = 0 or c = 1, or it can be thatthe protocol aborts, in which case we say that c = ⊥ . Note that because the rounds of(quantum or classical) communication are sequential, it is logically possible for Alice tochoose one output x , and for Bob to chose another output y . For the sake of generalityit is convenient to take this into account and to denote by p xy = Probability that in an honest execution of theprotocol Alice outputs x and Bob outputs y ,where x, y ∈ { , , ⊥} .We will say that a protocol is correct , if, when both parties are honest, at the endof the protocol they agree on the outcome, and that the results c = 0 and c = 1 occurwith equal probability: p = p = (1 − p ⊥⊥ ) /
2. This formulation takes into accountthat because of experimental imperfections, the outcome c = ⊥ may occur even whenboth parties are honest.The aim of a cheater is to force the outcome of the coin tossing protocol. We denoteby p ∗ y = Probability that a dishonest Alice can force anhonest Bob to output y p x ∗ = Probability that a dishonest Bob can force anhonest Alice to output xAn alternative notation often used in the litterature is the bias ǫ which is related to ournotation by ǫ A = max y ( p ∗ y −
12 ) ǫ B = max x ( p x ∗ −
12 ) (1)The bound due to Kitaev [6, 12, 13] states that either ǫ A or ǫ B is greater or equal to 1 / √ ǫ A = ǫ B = 1 / ρ and ρ both pure”. For such protocolsit is proven in [10] that ǫ A + ǫ B ≥ / p ⊥⊥ = 0): xperimental quantum tossing of a single coin Lemma 1: For any correct classical coin tossing protocol with three outcomes , , ⊥ wehave: (1 − p ∗ )(1 − p ∗ ) ≤ p ⊥⊥ , (2)(1 − p ∗ )(1 − p ∗ ) ≤ p ⊥⊥ . (3)Note that if p ⊥⊥ = 0 these inequalities imply that either p ∗ = 1 or p ∗ = 1, andthat either p ∗ = 1 or p ∗ = 1, thereby showing that classical coin tossing is impossible.When p ⊥⊥ = 0 a cheater can no longer necessarily force the outcome he wants. In thesupplementary material we show that there exist classical protocols that saturate eitherone of equations (2) or (3), and that there exist classical protocols that come close tosaturating both equations (2) and (3).In view of Lemma 1, it is natural to quantify the quality of quantum coin tossingexperiments by the following merit function: M = (1 − p ∗ )(1 − p ∗ )2 + (1 − p ∗ )(1 − p ∗ )2 − p ⊥⊥ (4)which has the following properties:(i) Positivity of probabilities implies − ≤ M ≤ +1(ii) For any classical protocol we have M ≤ M = 1.The interpretation of the merit function is most obvious in the weak coin tossing schemewherein Alice wins if Bob outputs 1 while Bob wins if Alice outputs 0 because then theterm (1 − p ∗ )(1 − p ∗ ) is the product of how often a dishonest Alice cannot force awin times how often a dishonest Bob cannot force a win (and similarly for the term(1 − p ∗ )(1 − p ∗ )). The better the protocol, the larger these terms.As illustration let us compute the value of M for different protocols. The bound dueto Kitaev states with precision, see [12], that p ∗ p ∗ ≥ / p ∗ p ∗ ≥ /
2. Insertingthis into eq . (4) shows that for all quantum protocols,
M ≤ (1 − / √ ≃ . M = 1 /
16 = 0 .
3. Experimental Implementation
Our implementation of quantum coin tossing uses the following protocol:(i) Alice chooses a ∈ { , } at random. She prepares state ψ a , where the two possiblestates are non orthogonal: |h ψ | ψ i| = cos θ >
0. She sends ψ a to Bob.The states ψ , will be taken to be coherent states of light of amplitude α andopposite phase: | ψ i = | + α i , | ψ i = | − α i (5) xperimental quantum tossing of a single coin θ = |h ψ | ψ i| = |h− α | + α i| = e − α . (6)In the notation of [10] we thus have ρ = | ψ ih ψ | and ρ = | ψ ih ψ | both pure.Also note that ρ = ρ prevents from cheating strategies based on entanglement[3, 4].(ii) Bob chooses b ∈ { , } at random. He tells the value of b to Alice.(iii) Alice tells Bob the value of a .(iv) Bob carries out a measurement which projects onto ψ a or onto the orthogonalspace. If he finds that the state is not equal to ψ a he aborts, and the outcome ofthe protocol is ⊥ . If he finds that the state is equal to ψ a then the outcome of theprotocol is c = a ⊕ b .Bob’s measurement is carried out as follows: using a local oscillator (LO), hedisplaces the quantum state by + α if a = 1 or by − α if a = 0. If Alice is honestthis results in the state becoming the vacuum state. To check this Bob then sendsthe resulting state onto a single photon detector. If the detector clicks then Bobassumes that Alice was cheating and he aborts: the outcome of the protocol is ⊥ .If the detector does not click, then Bob assumes that Alice is honest. (Note thatBob’s measurement is similar in spirit to the method proposed in [21] for quantumstate tomography, but Bob’s task is simpler since he only needs to detect if Aliceis cheating, and not carry out the full state tomography). We now study how the merit function M depends on the details of the experiment. Forthe sake of comparison we first look at the situation in the absence of imperfections.First of all, in this case p ⊥⊥ = 0.Second, if Alice is dishonest she will send a fixed state | φ i at step 1 and at step3 she will choose the value of a which will make her win the protocol, and then shewill hope that Bob will not abort. The probability that Bob will abort is given by theoverlap of | φ i with | ψ i and | ψ i . One easily finds (see [20]) that Alice’s optimal choiceis | φ i = N ( | ψ i + | ψ i ) where N a normalization constant, yielding the optimal values: p ∗ = p ∗ = 12 + |h ψ | ψ i| θ . (7)Third, if Bob is dishonest, he will measure the state sent by Alice at step 2 so as totry to find out whether it is ψ or ψ , and he will then choose the value of b according tothe result of his measurement. For the optimal measurement the probability that Bobwins is p ∗ = p ∗ = 12 + q − |h ψ | ψ i| θ . (8)The maximal value of the merit function M max = (1 − / √ ≃ .
021 occurs whencos( θ ) = sin( θ ) = 1 / √
2, corresponding to α = 0 .
17. Note that this is the maximum xperimental quantum tossing of a single coin ρ and ρ both pure”. To obtain estimates on p ∗ c , p c ∗ and p ⊥⊥ , and hence to estimate M , in the presence ofimperfections requires that we make assumptions on how the experiment is carried out.The parameter, p ⊥⊥ , which we also call the Quantum Bit Error Rate (QBER), caneasily be measured experimentally by tossing a large number of coins with Alice andBob both following their honest strategy. When Bob is dishonest his cheating strategy is, as before, toestimate before step 2 the state | ψ a i prepared by Alice so as to correctly guess thevalue of a . How do experimental imperfections, and in particular the limited visibility V of interferences affect Bob’s success probability p c ∗ ? To analyse this note that thestate Alice sends to Bob is a short laser pulse of known intensity which is then stronglyattenuated. Under strong attenuation all quantum states tend towards mixtures ofcoherent states (see e.g. [18]). Thus we can assume that the states prepared by Aliceare coherent states of known intensity α . These coherent states are not precisely knownto Alice. However it is not difficult to show that if two coherent states have intensity α ,their scalar product is lower bounded by |h ψ | ψ i| ≥ e − α . Bob’s cheating probabilitycan then be bounded, as in equation (8), by the scalar product of the two states preparedby Alice: p c ∗ = 12 + q − |h ψ | ψ i| ≤
12 + √ − e − α . (9) When Alice is dishonest we suppose that she can prepare anarbitrary state just in front of Bob’s laboratory, and then send it to Bob. How do theimperfections in Bob’s laboratory affect p ∗ c ? To quantify this Bob could carry out acomplete tomography of his measurement apparatus, and based on the results computewhat is Alice’s best cheating strategy. Here we will make a simple estimate based oneasily accessible parameters.First of all let us consider the effects of the attenuation A T during transmissionbetween Alice and Bob’s laboratories, of the attenuation A B in Bob’s apparatus, and ofthe efficiency η of his detector. We take these parameters into account by analysing afictitious system in which Bob’s apparatus is replaced by a lossless apparatus, and all theattenuation is under Alice’s control, i.e. η fict = 100%, A fictB = 1, and A fictT = A T A B η .This replacement can only help a cheating Alice. In the fictitious system the state sentby an honest Alice is | ± α fictB i = | ± α √ A T A B η i .Second we analyse the effect of finite visibility on the performance of the fictitioussystem just described. Because of the finite visibility, Bob will not be making aprojection onto the state | ± α fictB i , but onto slightly different states. We make the xperimental quantum tossing of a single coin CD1 D2 A
PBS D FMC1L PCM PCM PBS C2
Bob’s laboratory Alice’s laboratory Φ B Φ Α Figure 1.
Experimental setup: L, picosecond laser; D1, main photon counter;D2, auxiliary photon counter; C1, 50/50 coupler; A, attenuator; Φ B Bob’s phasemodulator; PCM, polarization controller; PBS, polarizing beam splitter; C2, 80/20coupler; PD, photodiode; Φ A , Alice’s phase modulator; FM, Faraday mirror. assumption that Bob’s apparatus acts as a passive linear optical system. This impliesthat the true states onto which Bob projects are slightly modified coherent states | ± α fictB + δ ± i . The deviations due to δ ± give rise to the optical contribution to theQBER: QBER opt = (cid:16) | δ + | + | δ − | (cid:17) / q | α fictB | , (10)where q , the QBER per photon, can be related to the visibility V of interferences by q ≃ (1 − V ) /
2. (Note that in addition to
QBER opt , there is another contribution to theQBER due to the dark counts of the detectors. The total QBER is the sum of thesetwo contributions:
QBER = QBER opt + QBER dk .)The distance between the two states onto which Bob projects is given by | (+ α fictB + δ + ) − ( − α fictB + δ − ) | ≥ | α fictB | − | α fictB || δ + − δ − | = 4 | α fictB | (1 − √ q ) . (11)Inserting this into equation (7) gives p ∗ c ≤
12 + 12 exp h − A B A T η (1 − √ q ) α i . (12)Thus the effect of the imperfections is to replace α by and effective attenuated intensity A B A T η (cid:16) − √ q (cid:17) α . Our experimental setup, depicted in Fig. 1, based on the plug and play system developedfor long distance quantum key distribution [22], is very similar to the one described in[18]. It consists of an all-fiber (standard SMF-28) passively balanced interferometer,and is therefore well suited to long distance quantum communication. The protocolbegins with Bob producing a short (300 ps) intense laser pulse at λ = 1 . µm (id300 xperimental quantum tossing of a single coin A = 0 , π to put on the signal pulse using her phase modulator. The signalAlice sends back to Bob is thus the coherent state | ± α i with average photon number | α | = 0 . b and then receive from her thevalue of a . In our experiment the fiber pigtails of the PBS are sufficient to realize thedelay. Upon receiving the value of a , Bob puts the corresponding phase Φ B = aπ on theLO. This ensures that there should be destructive interference at the output port thatgoes to the circulator and then to detector D1 (id200 from idQuantique). If detectorD1 registers a click, Bob aborts. If it does not click, the outcome of the coin toss is c = a ⊕ b . The other output of coupler C1 is monitored by detector D2, although thisis not directly used in the experiment.There are in fact two security loopholes in this experiment. The first arises becauseAlice does not know the intensity of the signal pulse she attenuates before sending itback to Bob. Thus in principle Bob could send her a more intense state than expected,which would mean that the scalar product of the states prepared by Alice would besmaller than expected. The second security loophole arises because Bob does not knowthe intensity of the pulse he uses as LO. Thus in principle Alice could send Bob thevacuum state, both in the signal and LO, and cheat perfectly. Both loopholes could beclosed by having Alice (Bob) monitor the intensity of the signal (LO) before she (he)attenuates it. This was not realised in the present setup because the laser pulses usedwere not intense enough, but would be possible using more intense or longer laser pulsesas in [18], or by using an isolator combined with an amplitude modulator as in [24]. As mentioned above, we performed the experimentwith | α | = 0 .
27. In a typical series 10000 coins were tossed, and we obtained 5066occurrences of c = 1, 2 occurrences of c = ⊥ , the other outcomes being c = 0 (whichis consistent with the statistical uncertainty which should be of order √ xperimental quantum tossing of a single coin . ) of coins with Alice and Bob both honest: p ⊥⊥ ≃ . ± .
37 10 − . (13)where the error comes from statistical uncertainty.The transmission losses are assumed to be negligible, A T = 1, as both parties areseparated by a few meters of optical fiber. Bob’s detector D1 has a η = 10% quantumefficiency. It is gated using a 2 . ns gate leading to a dark count probability of 4 . − .The attenuation of the signal in the optical elements of Bob’s laboratory has beenmeasured to be A B ≃ − q = 5 10 − ). By inserting these parameters in equations(9) and (12) we obtain upper bounds for p ∗ c and p c ∗ : p ∗ c ≤ . p c ∗ ≤ .
906 (14)leading to the lower bound for the merit function:
M ≥ .
33 10 − . (15)This bound may seem very small. Its value is roughly explained by noting thatthe maximal value in the absence of imperfections is M max = 0 . M by a factor 40,yielding approximately equation (15). This argument shows that the simplest way toimprove the experiment would be to use a more efficient detector. It also shows thatthe value of M is rather robust against small variations of the experimental parameters.We have computed that we could keep M positive while increasing losses between Aliceand Bob to A T ≃ . In order to cheat Bob must estimate the state | ψ a i preparedby Alice so as to correctly guess the value of a before sending the value of b . Weimplemented a simple cheating strategy in which Bob always applies Φ B = 0 on the LO.If detector D1 clicks Bob assumes that Alice chose a = 1, whereas if D1 does not clickhe assumes a = 0. Implementing this strategy yielded the value p ∗ = 0 . η and A B . Note that a much better cheatingstrategy, but which was impossible to implement in our laboratory, would be for Bobto carry out a homodyne measurement and measure the quadrature that gives him thebest estimate of a . As discussed above, when Alice is dishonest her best strategyis to send a fixed state | φ i = N ( | + α i + | − α i ) to Bob. After receiving b she then sendsthe value of a that makes her win the coin toss and hopes that Bob will not abort. Inpractice we implemented a strategy where Alice always sends | + α i . Even though thisstrategy is very basic, it leads to p ∗ c = 0 . xperimental quantum tossing of a single coin
4. Conclusion
In conclusion we have studied in detail how the performance of quantum coin tossingprotocols in the presence of imperfections should be compared to classical protocols.We then reported on a fiber optics experimental realisation of a quantum coin tossingprotocol. Our analysis shows that in this realisation the maximum success cheatingprobabilities for Alice and Bob are respectively 0.9971 and 0.906 when experimentalimperfections are taken into account, which is still better than achievable by any classicalprotocol. We implemented this protocol using an all-optical fiber scheme and tossed acoin whose randomness is higher than achievable by any classical protocol. Finally weimplemented simple realisable cheating strategies for both Alice and Bob.After the present work was completed, we learned of a recent proposal speciallydesigned for carrying out quantum coin tossing in the presence of losses[23]. Obviouslytaking into account losses, in particular those that occur in Bob’s apparatus, was animportant consideration when choosing and analysing the protocol reported here. Theprotocol reported in [23] seems more tolerant to loss then ours. Once the effect of otherimperfections (such as finite visibility of interference fringes) are taken into account, itcould be compared to ours using the merit function M introduced above. Acknowledgments
We acknowledge the support of the Fonds pour la formation `a la Recherche dansl’Industrie et dans l’Agriculture (FRIA, Belgium); of the Interuniversity AttractionPoles Programme - Belgian State - Belgian Science Policy under grant IAP6-10; and ofthe EU project QAP contract 015848.
Appendix
Here we provide bounds on the performance of classical coin tossing protocols whenthere is some probability that the protocol aborts when both parties are honest. Wealso show that there exist classical protocols that attain these bounds. We use thenotation and terminology introduced in the main text. The idea of the following resultis to analyse the performance of a classical protocol with 3 outcomes ( i.e. a classicalprotocol in which the parties try to toss a trit.).
Lemma 1: For any correct classical coin tossing protocol with three outcomes , , ⊥ we have: (1 − p ∗ )(1 − p ∗ ) ≤ p ⊥⊥ , (A.1)(1 − p ∗ )(1 − p ∗ ) ≤ p ⊥⊥ . (A.2) Proof of Lemma 1 . We need to introduce some notation.The protocol consists of K rounds of communication, labeled j = 1 , . . . , K .Denote by u j the possible states of the protocol at round j . xperimental quantum tossing of a single coin w ( u j ) the probability of reaching state u j at round j in an honestexecution of the protocol.Denote by w ( u j +1 | u j ) the probability that in an honest execution, the protocol willbe in state u j +1 at round j + 1 if it is in state u j at round j .Denote by p ∗ y ( u j ) the maximum probability that if Alice is dishonest and Bob ishonest, then Alice can force Bob to output y at the end of the protocol if the state atround j is u j .Denote by p x ∗ ( u j ) the maximum probability that if Bob is dishonest and Alice ishonest, then Bob can force Alice to output x at the end of the protocol if the state atround j is u j .Introduce the quantity T j defined by T j ( x, y ) = X u j w ( u j )(1 − p x ∗ ( u j ))(1 − p ∗ y ( u j ))Note that if we take x = 0 and y = 1 the initial value ( j = 1) of T is T (0 ,
1) = (1 − p ∗ )(1 − p ∗ ), ie. the left hand side of eq. (A.1).Note also that at round K , when the protocol has ended, T K is equal to the sum overthe final states of the protocol in an honest execution of the product of the probabilitiesthat the output of Alice is not x and that the output of Bob is not y . Thus if we take x = 0 and y = 1, then T K (0 ,
1) = p ⊥⊥ , ie. the right hand side of eq. (A.1).To complete the proof we show that T is an increasing function of j , ie. T j +1 ≥ T j .To this end suppose that at round j Bob will send some communication to Alice.Then Alice cannot influence what will happen at round j , hence we have: p ∗ y ( u j ) = P u j +1 w ( u j +1 | u j ) p ∗ y ( u j +1 ).Furthermore we have the trivial identity w ( u j +1 ) = P u j w ( u j +1 | u j ) w ( u j ).Finally we note that since it is Bob’s turn to talk at round j , we have 1 − p x ∗ ( u j ) ≤ − p x ∗ ( u j +1 ) where u j +1 is any state at round j + 1 that can be obtained from state u j at round j in an honest execution.Inserting these identities into the definition of T j , we obtained the desired inequality T j +1 ≥ T j .The proof of eq. (A.2) is similar. End of proof of Lemma 1.
We have also obtained a partial converse of Lemma 1:
Lemma 2: There exists a correct classical protocol such that inequality (A.1) is saturated,and there exists a correct classical protocol such that inequality (A.2) is saturated. Therealso exists a correct classical protocol for which (1 − p ∗ )(1 − p ∗ ) = (1 − p ∗ )(1 − p ∗ ) = p ⊥⊥ . (A.3) Proof of Lemma 2.
Let us consider the following protocol:Round 1: Alice excludes one of the outcomes. That is she chooses that the outcomeof the protocol will be either in { , } (she has excluded ⊥ ), { , ⊥} (she has excluded 1) xperimental quantum tossing of a single coin { , ⊥} (she has excluded 0). She tells her choice to Bob. If she is honest she choosesrandomly among these three possibilities with a priori probabilities q , q ⊥ , q ⊥ .Round 2: Bob chooses which of the remaining two outcomes is the result of theprotocol. He tells Alice what is his choice. Thus for instance if Alice told him that theoutcome was in { , } , Bob can choose that the outcome is either 0 or 1, but not ⊥ . If heis honest he chooses randomly among the two remaining possibilities with probabilities q | , q | ; q | ⊥ , q ⊥| ⊥ ; q | ⊥ , q ⊥| ⊥ .It is easy to check that, if the parties are honest, the probabilities are: p = q | q + q | ⊥ q ⊥ p = q | q + q | ⊥ q ⊥ p ⊥⊥ = q ⊥| ⊥ q ⊥ + q ⊥| ⊥ q ⊥ ; (A.4)and that, if they are dishonest, the probabilities are: p ∗ = max { q | , q | ⊥ } p ∗ = max { q | , q | ⊥ } p ∗ = q + q ⊥ p ∗ = q + q ⊥ . (A.5)If we choose the parameters such that q ⊥ = q ⊥ , q | = q | = 1 / q | ⊥ = q | ⊥ ≥ /
2, then the protocol is correct and eq. (A.3) is verified.And if we choose q ⊥ = 0 then we have p ⊥⊥ = q ⊥| ⊥ q ⊥ = (1 − q | ⊥ )(1 − q ) and p ∗ = q , p ∗ = q | ⊥ thus saturating eq. (A.1). Note that by adjusting the remainingfree parameter q | one can make the protocol correct.Similarly one can saturate inequality (A.2). End of proof of Lemma 2.
References [1] Blum M 1981 Coin flipping by telephone: A protocol for solving impossible problems
Advancesin Cryptology: A Report on CRYPTO 81 ed A Gersho (Santa Barbara, ECE Report No 82-04)pp. 11-15[2] Bennett C H and Brassard G 1984 Quantum cryptography: Public key distribution and cointossing
Proc. of IEEE Int. Conf. on Computers, Systems and Signal Processing (Bangalore) ,pp. 175 - 179[3] Mayers D 1996 Unconditionally secure quantum bit commitment is impossible
Preprint arXiv:quant-ph/9605044 (1996)[4] Lo H-K and Chau H F 1998 Why quantum bit commitment and ideal quantum coin tossing areimpossible
Physica D , 177[5] Mayers D, Salvail L and Chiba-Kohno Y 1999 Unconditionally secure quantum coin tossing Preprint
Phys. Rev. Lett. , 3356[8] Aharonov D, Ta-Shma A, Vazirani U V and Yao A C 2000 Quantum bit escrow (ACM Press) pp. 705 - 724 xperimental quantum tossing of a single coin [9] Ambainis A 2001 A new protocol and lower bounds for quantum coin flipping Proc. on 33rd AnnualACM Symp. on Theory of Computing (New York) (ACM Press) pp. 134142[10] Spekkens R W and Rudolph T 2002 Degrees of concealment and bindingness in quantum bitcommitment protocols
Phys. Rev. A , 012310[11] Mochon C 2007 Quantum weak coin flipping with arbitrarily small bias Preprint http://lanl.arxiv.org/abs/0711.4114[12] Amabainis A, Buhrman H, Dodis Y and R¨orig H 2004 Multiparty quantum coin flipping
Proc. ofthe 19th Annual IEEE Conference on Computational Complexity pp. 250259[13] Gutoski G and Watrous J 2007 Toward a general theory of quantum games
Proc. of the 39th ACMSymp. on Theory of Computing , pp. 565574
Preprint arXiv:quant-ph/0611234v2[14] Buhrman H, Christandl M, Hayden P, Lo H-K and Wehner S 2006 Security of quantum bit stringcommitment depends on the information measure
Phys. Rev. Lett. Journal of Cryptology(JoC) to appear
Preprint arXiv:quant-ph/0506001[16] Damgard I B, Fehr S, Salvail L and Schaffner C 2008 Cryptography in the Bounded-Quantum-Storage Model
SIAM Journal on Computing Phys. Rev. Lett. Phys. Rev. Lett. et al. Proc. of the 11th Int.Workshop on Randomization and Computation (RANDOM07) ; Approximation, Randomization,and Combinatorial Optimization
Algorithms and Techniques, Lecture Notes in Computer Science
Volume 4627/2007, (Berlin: Springer)[20] Barrett J and Massar S 2004 Quantum Coin Tossin Phys. Rev. A , 022322 (2004).[21] Wallentowitz S and Vogel W 1996 Unbalanced homodyning for quantum state measurements Phys.Rev. A Electron. Lett. , pp. 1 9[24] Legre M, Zbinden H and Gisin N 2006 Implementation of continuous variable quantumcryptography in optical fibres using a go&return configuration Quantum Info. Comp.6