Quantum weak coin flipping with a single photon
Mathieu Bozzio, Ulysse Chabaud, Iordanis Kerenidis, Eleni Diamanti
QQuantum weak coin flipping with a single photon
Mathieu Bozzio,
1, 2
Ulysse Chabaud, Iordanis Kerenidis, and Eleni Diamanti Sorbonne Université, CNRS, LIP6, 4 Place Jussieu, F-75005 Paris, France Institut Polytechnique de Paris, Télécom Paris, LTCI,19 Place Marguerite Perey, 91129 Palaiseau, France Université de Paris, CNRS, IRIF, 8 Place Aurélie Nemours, 75013 Paris, FranceWeak coin flipping is among the fundamental cryptographic primitives which ensure the securityof modern communication networks. It allows two mistrustful parties to remotely agree on a randombit when they favor opposite outcomes. Unlike other two-party computations, one can achieveinformation-theoretic security using quantum mechanics only: both parties are prevented frombiasing the flip with probability higher than 1 / (cid:15) , where (cid:15) is arbitrarily low. Classically, thedishonest party can always cheat with probability 1 unless computational assumptions are used.Despite its importance, no physical implementation has been proposed for quantum weak coinflipping. Here, we present a practical protocol that requires a single photon and linear optics only.We show that it is fair and balanced even when threshold single-photon detectors are used, andreaches a bias as low as (cid:15) = 1 / √ − / ≈ . I. INTRODUCTION
Modern communication networks are continuously ex-panding, as the number of users and available online re-sources increases. On a daily basis, users must inevitablytrust local network nodes and transmission channels inorder to perform sensitive tasks such as private datatransmission, online banking, electronic voting, delegatedcomputing and many more. A complex network can be se-cured by relying on a collection of simpler cryptographic primitives , or building blocks, which are combined toguarantee overall security. Strong coin flipping (SCF)is one of such primitives, in which two parties remotelyagree on a random bit such that none of the parties canbias the outcome with probability higher than 1 / (cid:15) ,where (cid:15) is the protocol bias. SCF is fundamental in mul-tiparty computation [1], online gaming and more generalrandomized consensus protocols involving leader election[2].Weak coin flipping (WCF) is a version of coin flippingin which both parties have a preferred, opposite outcome:it effectively designates a winner and a loser. In the classi-cal world, information-theoretically secure SCF and WCFare impossible: they require computational assumptionsor trusting a third party [3–6]. Using quantum properties,on the other hand, enables information-theoretically se-cure SCF and WCF: the lowest possible bias for quantumSCF is (cid:15) = 1 / √ − / (cid:15) ≈ . (cid:15) = 1 / √ − / ≈ . (cid:15) = 1 / ≈ .
167 [14, 15].Very recently, a new explicit family of protocols achieved (cid:15) ≈ /
10 [16], followed by arbitrarily low biases [17].While quantum SCF protocols have been experimen-tally demonstrated [18–20], no implementation has beenproposed for quantum WCF. This may be explained bytwo reasons. First, it is difficult to find an encoding andimplementation which is robust to losses: a dishonestparty may always declare an abort when they are notsatisfied with the flip’s outcome. Second, none of thepreviously mentioned protocols translate trivially into asimple experiment: they involve performing single-shotgeneralized measurements [13] or generating beyond-qubitstates [12].In this work, we introduce a family of quantum WCFprotocols, inspired by [13], which achieve biases as lowas (cid:15) = 1 / √ − / ≈ . ≈ .
31. We further de-rive a practical security proof for both number-resolvingand threshold single-photon detectors, considering theextension to infinite Hilbert spaces. Since the presenceof losses may enable classical protocols to reach lowercheating probabilities than quantum protocols, we finallyshow that our fair and balanced quantum protocol bearsno classical equivalent over a few hundred meters of lossyoptical fiber and non-unit detection efficiency. a r X i v : . [ qu a n t - ph ] A ug II. PROTOCOL AND CORRECTNESS
In the honest protocol, Alice and Bob wish to toss afair coin, with a priori knowledge that they each favoropposite outcomes. Fig. 1 represents the implementationof the honest protocol, which follows five distinct steps.Defining x ∈ [0 , ] as a free protocol parameter, theseread: • Alice mixes a single photon with the vacuum on abeam splitter of reflectivity x . • Alice keeps the first spatial mode, and directs thesecond spatial mode to Bob. • Bob mixes the state he receives with the vacuumon a beam splitter of reflectivity y = 1 − − x ) . • Bob measures the second register of his state with asingle-photon detector, and broadcasts the outcome c ∈ { , } . • The last step is a verification step, which splits intotwo cases. If c = 0, Alice sends her state to Bob,who mixes it with his state on a beam splitter of re-flectivity z = 2 x . He then measures the two outputmodes with single-photon detectors. He declaresAlice the winner if the outcome ( b , b ) = (1 ,
0) isobtained. If c = 1: Bob discards his state, andAlice measures her state with a single-photon de-tector. She declares Bob the winner if the outcomeis a = 0.We show that the protocol is fair, i.e. that the probabilityof winning for each party is when they are both honest.Single photons are quantized excitations of the electro-magnetic field, which are described by the action of thecreation operator onto the vacuum. Beam splitters actlinearly on creation operators, and leave invariant thevacuum. Hence, the evolution of the quantum state overthe three modes up to Bob’s measurement reads: | i → ( x ) , √ x | i + √ − x | i→ ( y ) , √ x | i + p (1 − x ) y | i + p (1 − x )(1 − y ) | i , (1)where the notation ( t ) , kl indicates the reflectivity ofthe beam splitter and the corresponding spatial modes.Hence, the probability that Bob obtains outcome c =1 when measuring the third register is P (1) = (1 − x )(1 − y ), while the probability of outcome c = 0 is P (0) = 1 − P (1). Having set y = 1 − − x ) ensures P (0) = P (1) = . When c = 1, the state on modes 1and 2 is projected onto | i , while c = 0 projects thestate onto √ x | i + √ − x | i . In the first case,the measurement performed by Alice outputs a = 0 FIG. 1:
Representation of the honest protocol.
The dashed boxes indicate Alice and Bob’s laboratories,respectively. The beam splitter reflectivities are indicatedin red brackets. | i and | i are the vacuum and singlephoton Fock states, respectively. Curly lines representfiber used for quantum communication from Alice toBob, or delay lines within Alice’s or Bob’s laboratory,when waiting for the other party’s communication. Bobbroadcasts the classical outcome c , which controls anoptical switch on Alice’s side. The protocol when Bobdeclares c = 0 / a, b , b ) = (0 , ,
0) are the expected outcomeswhen both parties are honest.with probability 1. In the second case, the measurementperformed by Bob after the beam splitter with reflectivity z outputs ( b , b ) = (1 ,
0) with probability 1. Hence, theprobability that Alice (resp. Bob) wins is directly givenby P ( A ) h = P (0) (resp. P ( B ) h = P (1)). This shows thatthe protocol is fair, since P (0) = P (1) = . III. SECURITY
We now derive the security of the protocol. Namely, weobtain the probabilities of winning when Bob is dishonestand Alice is honest, and vice versa.
A. Dishonest Bob, honest Alice
Dishonest Bob should always declare the outcome c = 1in order to maximize his winning probability. The out-come of the coin flip is then confirmed if Alice obtainsthe outcome a = 0 upon verification. Bob thus needsto maximize the probability of the outcome a = 0, ap-plying a general quantum operation to his half of thestate. However, the probability that the detector clicksis independent of Bob’s action. It is given by x , so thatBob’s winning probability is upper bounded by (1 − x ).This upper bound is reached if Bob discards his half ofthe state and broadcasts c = 1. Then, Bob’s optimalcheating probability is P ( B ) d = 1 − x . B. Dishonest Alice, honest Bob
Alice wins when Bob declares c = 0 and the outcome ofhis quantum measurement is ( b , b ) = (1 , σ , while Bob performs the rest of the protocolhonestly. We find that the security is derived easily ifBob is allowed photon number resolving detectors (seeAppendix B for details of all the proofs).Remarkably, the protocol is still secure even whenBob only uses threshold detectors, which is essentialto the practicality of the protocol. Moreover, Alice’soptimal cheating probability remains the same in bothcases: P ( A ) d = 1 − (1 − y )(1 − z ), which equals − x ) for y = 1 − − x ) and z = 2 x . In particular, for all valuesof x , we retrieve the property shared by the protocolsof [13]: P ( A ) d P ( B ) d = .The underlying idea in the security analysis for thresh-old and number resolving detectors is that Alice must gen-erate the state which maximizes the overlap with Bob’sprojectors | i h | and P ∞ n =1 | n i h n | , respectively.Setting x = 1 − / √
2, we obtain a version of the pro-tocol which is balanced, i.e. both players have the samecheating probability 1 / √
2. The protocol bias is then (cid:15) = 1 / √ − / ≈ . x , y , z yielding an unbalancedquantum WCF protocol allows to construct a quantumSCF protocol with bias ≈ . IV. FAULT TOLERANCEA. Noise
We now investigate how imperfect state generation,non-ideal beam splitters and single-photon detector darkcounts affect the correctness and security of the protocol.While we fixed the parameter values to y = 1 − − x ) and z = 2 x in the ideal setting, we now allow the threeparameters x , y , z to vary freely.The vacuum/single-photon encoding is very robust tonoise, in comparison to polarization or phase encodingfor instance: the only property that must be preservedthrough propagation is photon number. Alice may simplyproduce a heralded single photon via spontaneous para-metric down-conversion (SPDC) [22], which generatesa photon pair: one may be used for the flip, while theother may herald the presence of the first one. Given thephoton-pair emission probability p , accidentally emitting two pairs at the same time using SPDC occurs with prob-ability p . Since p may be arbitrarily tuned by changingthe pump power, p —and therefore the probability oftwo photons being accidentally generated by Alice atonce—may then be decreased to negligible values.Note that, in the case where Alice’s single photonsource is probabilistic but heralded (as in SPDC), shemay always inform Bob of a successful state generationprior to his announcement of c without compromisingsecurity. In what follows, we may therefore assume thatboth parties have agreed on the presence of an initialstate, and hence know when the protocol occurs.Noise will therefore stem from the non-ideal reflectivi-ties of the beam splitters, and the non-zero detector darkcount probability p dc . For each party, these may affectthe protocol correctness in two ways: an undesired biasof the flip, and an added abort probability during theverification process.Deviations on the beam splitter reflectivities x , y , and z will first change the honest winning probabilities: thesemay be re-calculated by replacing the ideal reflectivity r ∈ { x, y } with an imperfect r . As regards to honestaborts, a beam splitter with reflectivity z instead of z may be applied on the resulting state when c = 0. Noisydetectors may cause an unwanted abort corresponding toa click because of dark counts. However, with supercon-ducting nanowire single-photon detectors, this probabilityis typically very low, of the order of p dc < − [23].We can therefore conclude that any source of noisemay be incorporated in the security analysis by simplyreplacing parameters x , y , and z with x , y , and z .Furthermore, this source of error will most likely benegligible with current technology. We therefore solelyfocus on the more consequential effects of losses. B. Losses
Losses can be due to non-unit channel and delay linetransmissions, as well as non-unit detection efficiency.We label η t the transmission efficiency of the quantumchannel from Alice to Bob. We also define as η ( i ) f thetransmission of party i ’s fiber delay, while η ( i ) d denotes thedetection efficiency of party i ’s single-photon detectors.Here, we assume the efficiencies of Bob’s detectors tobe the same, and that each party introduces a fiberdelay whenever they are waiting for the other party’scommunication. The delay time therefore depends on thedistance between the two parties.In the presence of losses, the protocol may also abortwhen both parties are honest, when the photon is lost.We derive in Appendix D the expressions for the twohonest winning probabilities P ( A ) h and P ( B ) h , and hencethe probability P ab of abort, in the presence of losses: P ( A ) h = η t η ( B ) d (cid:18)q xzη ( A ) f + q (1 − x ) y (1 − z ) η ( B ) f (cid:19) P ( B ) h = η t η ( B ) d (1 − x )(1 − y ) P ab = 1 − P ( A ) h − P ( B ) h . (2)Note that the overall correctness does not depend onAlice’s detection efficiency η ( A ) d , since the declarationof outcome c depends solely on Bob’s detector, and theverification step on Alice’s side involves detecting vacuum. V. SECURITY IN THE PRESENCE OF LOSSES
Dishonest Bob’s best strategy is to perform the sameattack as in the lossless case, because he has no controlover Alice’s half of the subsystem. His winning probabilityis then P ( B ) d = 1 − xη ( A ) f η ( A ) d . However, in a more generalgame-theoretic scenario, Bob’s best strategy will in factdepend on the rewards and sanctions associated withhonest aborts and "getting caught cheating" aborts. Inother words, Bob has to minimize his risk-to-reward ratio.Maximizing his winning probability makes him run therisk of getting caught cheating with probability xη ( A ) f η ( A ) d .Dishonest Alice must still generate the state whichmaximizes the ( b , b , c ) = (1 , ,
0) outcome on Bob’s de-tectors after his honest transformations have been applied.However, the expression for Bob’s corresponding projec-tor now changes, as there is a finite probability (1 − η ( B ) d ) n that the n -photon component is projected onto the vac-uum. The 0 outcome on one spatial mode is thereforetriggered by the projection Π = P ∞ n =0 (1 − η ( B ) d ) n | n i h n | .The total projector responsible for the ( b , b , c ) = (1 , , = ( − Π ) ⊗ Π ⊗ Π . We showin Appendix E that dishonest Alice’s maximum winningprobability P ( A ) d satisfies:max l> (cid:20)(cid:16) − (1 − yη ( B ) f )(1 − z ) η ( B ) d (cid:17) l − (cid:16) − η ( B ) d (cid:17) l (cid:21) (cid:54) − (1 − y )(1 − z ) . (3)The value of the upper bound on the right hand sideis Alice’s cheating probability in the lossless case. Thisshows that Alice cannot take advantage of Bob’s imperfectdetectors or his lossy delay line in order to increase hercheating probability. We now provide a sketch of theproof: since passive linear optical elements act linearlyon creation operators, equal losses on different modes maybe commuted through the interferometer of the protocol.This allows to upper bound Alice’s maximum winningprobability by her winning probability in an equivalentpicture in which the losses happen just after her statepreparation, then followed by a lossless protocol. In that FIG. 2:
Practical quantum advantage for a fairand balanced protocol.
Numerical values for the low-est classical and quantum cheating probabilities, P Cd and P Qd , are plotted as a function of distance d in dashedblue and dotted red, respectively. Honest abort proba-bility P ab (responsible for P Qd being lower than our idealquantum cheating probability 1 / √
2) is plotted in solidmagenta. Our quantum protocol performs strictly bet-ter than any classical protocol when P Qd < P Cd . Weset η f = η s η t , where η s is the fiber delay transmissioncorresponding to 500ns of optical switching time, and η t = (cid:16) − . d (cid:17) is the fiber delay transmission associ-ated with travelling distance d twice (once for quantum,once for classical) in single-mode fibers with attenuation0 . η d = 0 .
95 and z = 0 .
57. Forperformance with lower η d = 0 .
90, please see AppendixG.case, it is as if dishonest Alice was trying to cheat inthe lossless protocol, while being restricted to lossy statepreparation instead of ideal state preparation.
VI. PRACTICAL PROTOCOL PERFORMANCE
We now analyze the performance of our protocol ina practical setting, by enforcing three conditions on thefree parameters: the protocol must be fair, balanced, andperform strictly better than any classical protocol. Thelatter condition is not required in an ideal implemen-tation, since quantum WCF always provides a securityadvantage over classical WCF. Allowing for abort cases,however, may enable some classical protocols to performbetter than quantum ones. This is because increasing theabort probability effectively decreases Alice and Bob’scheating probabilities. We say that the protocol allowsfor quantum advantage when it provides a strictly lowercheating probability than any classical protocol with thesame abort probability. This is obtained using the boundsfrom [24], which yield the best classical cheating probabil-ity P Cd = 1 −√ P ab for our protocol (see Appendix F). Thethree conditions may then be translated into the followingsystem of equations, where we define P Qd = P ( A ) d = P ( B ) d : ( i ) P ( A ) h = P ( B ) h fairness( ii ) P ( A ) d = P ( B ) d balance( iii ) P Qd < P Cd quantum advantage (4)Fig. 2 shows a choice of parameters for which system (4)is satisfied, up to a distance of d km. VII. DISCUSSION
By noticing a non-trivial connection between the earlyprotocol from [13] and linear optical transformations, weanswer the question of the implementability of quantumweak coin flipping, and show that it is achievable withcurrent technology over a few hundred meters. Bothparties require a set of beam splitters and single photonthreshold detectors. State generation on Alice’s sidecan be performed with any heralded probabilistic single-photon source. Only Alice requires an optical switch,which is commercially available. Although short-termquantum storage is needed, a spool of optical fiber withtwice the length of the quantum channel suffices, andprovides the required storage/retrieval efficiency. As the distance increases, the issue of interferometricstability should also be considered. Prior to the protocol,Alice and Bob may use similar techniques to twin-fieldquantum key distribution implementations to lock theinterference [28, 29], as it is in their interest to collaborateon this task to avoid the protocol from aborting.On the fundamental level, our results also raise thequestion of a potentially deeper connection between thelarge family of protocols from [10, 14, 15]—which achievesbiases as low as 1 / ACKNOWLEDGMENTS
We thank Atul Singh Arora and Simon Neves for use-ful discussions on quantum weak coin flipping and onexperimental requirements for heralded single-photonsources, respectively. We acknowledge support of theEuropean Union’s Horizon 2020 Research and InnovationProgramme under Grant Agreement No. 820445 (QIA)and the ANR through the ANR-17-CE39-0005 (quBIC)project. [1] O. Goldreich, S. Micali, and A. Wigderson, Proceedings ofthe Symposium on Theory of Computing , 218 (1987).[2] D. Alistarh, J. Aspnes, V. King, and J. Saia, Distrib.Comput. , 489 (2018).[3] M. Blum, SIGACT News , 23-27 (1983).[4] R. Cleve, Proceedings of the 18th annual ACM Sympo-sium on Theory of Computing (STOC 86) (1986).[5] A. Ambainis, Journal of Computer and System Sciences , 398 (2004).[6] G. Berlin, G. Brassard, F. Bussieres, and N. Godbout,Phys. Rev. A , 062321 (2009).[7] A. Chailloux and I. Kerenidis, 50th Annual IEEE Sym-posium on Foundations of Computer Science pp. 527–533(2009).[8] A. Chailloux and I. Kerenidis, 52nd Annual IEEE Sym-posium on Foundations of Computer Science p. 354–362(2011).[9] A. Kitaev, 6th Workshop on Quantum Information Pro-cessing (2003).[10] C. Mochon, arXiv (2007).[11] D. Aharonov, A. Chailloux, M. Ganz, I. Kerenidis, andL. Magnin, SIAM J. Comput. , 633–679 (2016).[12] I. Kerenidis and A. Nayak, Inf. Proc. Lett. , 131 (2004).[13] R. W. Spekkens and T. Rudolph, Phys. Rev. Lett. ,227901 (2002). [14] C. Mochon, 45th Symposium on Foundations of Com-puter Science pp. CALT–68–2486 (2004).[15] C. Mochon, Phys. Rev. A , 022341 (2005).[16] A. S. Arora, J. Roland, and S. Weis, Proceedings of the51st Annual ACM SIGACT Symposium on Theory ofComputing pp. 205–216 (2019).[17] A. S. Arora, J. Roland, and C. Vlachou, arXiv (2019).[18] G. Molina-Terriza, A. Vaziri, R. Ursin, and A. Zeilinger,Phys. Rev. Lett. , 040501 (2005).[19] G. Berlín, G. Brassard, F. Bussières, N. Godbout, J. A.Slater, and W. Tittel, Nat. Commun. , 561 (2011).[20] A. Pappa, P. Jouguet, T. Lawson, A. Chailloux, M. Legré,P. Trinkler, I. Kerenidis, and E. Diamanti, Nat. Commun. , 3717 (2014).[21] O. Morin, J.-D. Bancal, M. Ho, P. Sekatski, V. D’Auria,N. Gisin, J. Laurat, and N. Sangouard, Phys. Rev. Lett. , 130401 (2013).[22] C. Couteau, Contemporary Physics , 291 (2018).[23] R. H. Hadfield, Nat. Photonics , 696 (2009).[24] E. Hänggi and J. Wullschleger, Proceedings of TCC pp.468–485 (2011).[25] D. Berry and A. Lvovsky, Phys. Rev. Lett. , 203601(2010).[26] M. Reck, A. Zeilinger, H. J. Bernstein, and P. Bertani,Phys. Rev. Lett. , 58 (1994). [27] A. Ferraro, S. Olivares, and M. G. Paris, arXiv preprintquant-ph/0503237 (2005).[28] M. Minder, M. Pittaluga, G. L. Roberts, M. Lucamarini,J. F. Dynes, Z. L. Yuan, and A. J. Shields. Nat. Photonics , 334–338 (2019) [29] J-P. Chen, C. Zhang, Y. Liu, C. Jiang, W.Zhang, X-L.Hu, J-Y. Guan, Z-W. Yu, H. Xu, J. Lin, M-J. Li, H.Chen, H. Li, L. You, Z. Wang, X-B. Wang, Q. Zhang,and J-W. Pan. Phys. Rev. Lett. , 070501 (2020)[30] C. A. Miller. Proceedings of the 52nd Annual ACMSIGACT Symposium on Theory of Computing pp. 916–929 (2020). Appendix
In this appendix, we give detailed proofs of the results presented in the main text. Section A contains preliminarytechnical results. In Section B, we provide the security analysis for dishonest Alice. In Section C, we show howan unbalanced version of our WCF protocol may yield a SCF protocol. In Section D we derive the completenessof the protocol in the lossy case, and in Section E, we extend the security analysis to the case of a lossy protocol.In Section F we solve the system in Eq. (4) of the main text, and derive the constraints that the parameters ofthe protocol must satisfy in order to obtain a fair and balanced protocol which still outperforms all classical WCFprotocols in the lossy case. Finally, in Section G, we display the practical performance of our fair and balancedprotocol for various detection efficiencies.
Appendix A: Preliminary results
Single photons are obtained by the action of the creation operator onto the vacuum. Beam splitters act linearly oncreation operators, and leave invariant the vacuum. More precisely, a beam splitter of reflectivity t acting on modes k, l maps the creation operators ˆ a † k , ˆ a † l onto ˆ b † k , ˆ b † l , where ˆ b † k ˆ b † l = H ( t ) kl ˆ a † k ˆ a † l , (A1)where H ( r ) kl = √ r √ − r √ − r −√ r . (A2)In the following, we make use of a simple reduction which allows to simplify calculations in the proofs: Lemma 1.
Let U = ( H ( z ) ⊗ )( ⊗ H ( y ) ) , with z > . For all density matrices τ , Tr[( τ ⊗ | i h | ) U † ( ⊗ | i h | ) U ] = Tr[( τ ⊗ | i h | ) V † ( | i h | ⊗ ⊗ | i h | ) V ] , (A3) where V = ( ⊗ H ( b ) )( H ( a ) ⊗ )( ⊗ R ( π ) ⊗ ) , with a = y (1 − z )1 − (1 − y )(1 − z ) and b = 1 − (1 − y )(1 − z ) , and R ( π ) a phaseshift of π acting on mode .Proof. The action of U on the creation operators is given by U = √ z √ − z √ − z −√ z
00 0 1 √ y √ − y √ − y −√ y = √ z p y (1 − z ) p (1 − y )(1 − z ) √ − z −√ yz − p (1 − y ) z √ − y −√ y . (A4)Linear interferometers map product coherent states onto product coherent states, and, for all α ∈ C , we have that U † | α i = | β β β i , where β β β = α √ zα p y (1 − z ) α p (1 − y )(1 − z ) . (A5)We have V = ( ⊗ H ( b ) )( H ( a ) ⊗ )( ⊗ R ( π ) ⊗ ), with a, b ∈ [0 , R ( π ) a phase shift of π acting on mode 2.The action of V on the creation operators is given by V = √ b √ − b √ − b −√ b √ a √ − a √ − a −√ a
00 0 1 − = √ a −√ − a p b (1 − a ) √ ab √ − b p (1 − a )(1 − b ) p a (1 − b ) −√ b . (A6)For all α ∈ C , V † | α i = | γ γ γ i , where γ γ γ = α p b (1 − a ) α √ abα √ − b . (A7)Since a = y (1 − z )1 − (1 − y )(1 − z ) and b = 1 − (1 − y )(1 − z ), we have b (1 − a ) = z , ab = y (1 − z ), and 1 − b = (1 − y )(1 − z ), so( β , β , β ) = ( γ , γ , γ ). Then,Tr[( τ ⊗ | i h | ) U † ( ⊗ | i h | ) U ] = 1 π Z C d α Tr[( τ ⊗ | i h | ) U † | α i h α | U ]= 1 π Z C d α Tr[( τ ⊗ | i h | ) V † | α i h α | V ]= Tr[( τ ⊗ | i h | ) V † ( | i h | ⊗ ⊗ | i h | ) V ] , (A8)where we used the completeness relation of coherent states = π R C | α i h α | d α .We also recall a useful simple property, which we will use extensively in the following: Lemma 2.
Equal losses on various modes can be commuted through passive linear optical elements acting on thesemodes.
This result was proven, e.g., in [25], and we give hereafter a quick proof for completeness.
Proof.
One way to prove this statement is to use the fact that any interferometer may be decomposed as beamsplitters and phase shifters [26]. Then, losses trivially commute with phase shifters, and are easily shown to commutewith beam splitters. Indeed, consider a beam splitter of reflectivity t acting on modes 1 and 2. Its action on thecreation operators of the modes is given byˆ a † , ˆ a † → √ t ˆ a † + √ − t ˆ a † , √ − t ˆ a † − √ t ˆ a † , (A9)while equal losses η on both modes act as ˆ a † , ˆ a † → √ η ˆ a † , √ η ˆ a † . (A10)Hence, the action of the beam splitter followed by losses is given byˆ a † , ˆ a † → √ η ( √ t ˆ a † + √ − t ˆ a † ) , √ η ( √ − t ˆ a † − √ t ˆ a † ) , (A11)while losses followed by the beam splitter act asˆ a † , ˆ a † → √ t ( √ η ˆ a † ) + √ − t ( √ η ˆ a † ) , √ − t ( √ η ˆ a † ) − √ t ( √ η ˆ a † ) , (A12)which is equal to the previous evolution.In what follows, we let the parameters x, y, z vary freely, and derive the relation these parameters need to satisfy toenforce a honest protocol without abort cases. As presented in the main text, when both parties are honest (Fig. 1),the evolution of the quantum state over the three modes up to Bob’s first measurement reads: | i → ( x ) , √ x | i + √ − x | i→ ( y ) , √ x | i + p (1 − x ) y | i + p (1 − x )(1 − y ) | i , (A13)where the notation ( t ) , kl indicates the reflectivity of the beam splitter and the corresponding spatial modes. Hence,the probability that Bob obtains outcome c = 1 when measuring the third register is P (1) = (1 − x )(1 − y ), while theprobability of outcome c = 0 is P (0) = 1 − P (1).If Bob registers the outcome c = 1, then the post-measurement state on Alice’s side is | i , which will always passthe verification step.If Bob registers the outcome c = 0, then the post-measurement state reads: r x − (1 − x )(1 − y ) | i + s (1 − x ) y − (1 − x )(1 − y ) | i . (A14)The value of the parameter z should be fixed to z = x − (1 − x )(1 − y ) , (A15)so that this state passes the verification step, and that the protocol doesn’t abort in the honest case. We assume thisrelation holds in the following. In that case, the winning probabilities of Alice and Bob in the honest case are given by P ( A ) h = 1 − (1 − x )(1 − y ) P ( B ) h = (1 − x )(1 − y ) . (A16)The protocol is fair when (1 − x )(1 − y ) = . In that case, y = 1 − − x ) and z = 2 x .Let us also recall from the main text that in the general case, the winning probability of dishonest Bob is given by P ( B ) d = 1 − x. (A17) Appendix B: Security analysis for Dishonest Alice without losses1. Bob has number-resolving detectors
When using number-resolving single-photon detectors, any projection onto the n > | i h | FIG. 3:
Dishonest Alice.
Alice aims to maximize the outcome (1 , , ,
0) for modes 1 and 2 means that Alice passed Bob’sverification. The reflectivities of the beamsplitter are given by y = 1 − − x ) and z = 2 x .only (Fig. 3). Let σ be the state sent by Alice. Let U = ( H ( z ) ⊗ )( ⊗ H ( y ) ), with z = x − (1 − x )(1 − y ) . Alice needs tomaximize the probability of the overall outcome (1 , , P ( A ) d = Tr[ U ( σ ⊗ | i h | ) U † | i h | ] , (B1)since Bob uses number-resolving detectors. By convexity of the probabilities, we may assume without loss of generalitythat Alice sends a pure state σ = | ψ i h ψ | , which allows us to write: P ( A ) d = Tr[ U ( | ψ i h ψ | ⊗ | i h | ) U † | i h | ]= Tr[( | ψ i h ψ | ⊗ | i h | ) U † | i h | U ]= Tr[ h ψ | ⊗ h | U † | i h | U | ψ i ⊗ | i ] . (B2)We have: U † | i = ( ⊗ H ( y ) )( H ( z ) ⊗ ) | i = ( ⊗ H ( y ) )( √ z | i + √ − z | i )= √ z | i + p y (1 − z ) | i + p (1 − y )(1 − z ) | i , (B3)and therefore: U † | i h | U = z | i h | + y (1 − z ) | i h | + (1 − y )(1 − z ) | i h | + p yz (1 − z ) ( | i h | + | i h | )+ p z (1 − y )(1 − z ) ( | i h | + | i h | )+ (1 − z ) p y (1 − y ) ( | i h | + | i h | ) . (B4)Substituting back into Eq. (B2) then reduces to: P ( A ) d = h ψ | (cid:16) z | i h | + y (1 − z ) | i h | + p yz (1 − z )( | i h | + | i h | ) (cid:17) | ψ i = h ψ | (cid:16) √ z | i + p y (1 − z ) | i (cid:17) (cid:16) √ z h | + p y (1 − z ) h | (cid:17) | ψ i = (cid:12)(cid:12)(cid:12) h ψ | (cid:16) √ z | i + p y (1 − z ) | i (cid:17)(cid:12)(cid:12)(cid:12) . (B5)Using Cauchy-Schwarz inequality then allows to upper bound P ( A ) d as: P ( A ) d (cid:54) k ψ k (cid:13)(cid:13)(cid:13)(cid:16) √ z | i + p y (1 − z ) | i (cid:17)(cid:13)(cid:13)(cid:13) (cid:54) (1 − (1 − y )(1 − z )) k ψ k , (B6)0which is maximized for k ψ k = 1. Hence we finally get: P ( A ) d (cid:54) − (1 − y )(1 − z ) . (B7)In order to find Alice’s optimal cheating strategy (i.e.the optimal pure state | φ i that she must send to achievethis bound), we remark that the unnormalized state √ z | i + p y (1 − z ) | i maximizes the expression in Eq. (B6).Normalizing this state then provides Alice’s optimal strategy, which is to prepare the state | φ i := r z − (1 − y )(1 − z ) | i + s y (1 − z )1 − (1 − y )(1 − z ) | i . (B8)Hence, P ( A ) d = 1 − (1 − y )(1 − z ) . (B9)In the case of a fair protocol, y = 1 − − x ) and z = 2 x , so P ( A ) d = 12(1 − x ) , (B10)and Alice’s optimal strategy is to prepare the state | φ x i := 2 p x (1 − x ) | i + (1 − x ) | i . (B11)
2. Bob has threshold detectors
Unlike the previous case, incorrect outcomes with higher photon number could still pass the test: for n ≥
1, thethreshold detectors cannot discriminate between a | i and | n i projection. We show in the following that thisdoesn’t help a dishonest Alice, and that the strategy described previously for the case of number resolving detectorsis still optimal in the case of threshold detectors.With the same notations as in the previous proof, Alice needs to maximize the probability of the overall outcome(1 , , P ∞ n =1 | n i h n | = ( − | i h | ) ⊗ | i h | . This allows us to write: P ( A ) d = Tr[ U ( | ψ i h ψ | ⊗ | i h | ) U † (( − | i h | ) ⊗ | i h | )] , (B12)since Bob uses threshold detectors, where U = ( H ( z ) ⊗ )( ⊗ H ( y ) ), with z = x − (1 − x )(1 − y ) .Linear optical evolution conserves photon number. Hence if Alice sends the vacuum state, the detectors will neverclick. Removing the two-mode vacuum component of the state prepared by Alice and renormalizing therefore alwaysincreases her winning probability. Since we are looking for the maximum winning probability, we can assume withoutloss of generality that h ψ | i = 0, i.e.Tr[ U ( | ψ i h ψ | ⊗ | i h | ) U † | i h | ] = | h ψ | i | , (B13)So maximizing the winning probability in Eq. (B12) is equivalent to maximizing˜ P ( A ) d = Tr[ U ( | ψ i h ψ | ⊗ | i h | ) U † ( ⊗ | i h | )] , (B14)given the constraint h ψ | i = 0. We have˜ P ( A ) d = Tr[ U ( | ψ i h ψ | ⊗ | i h | ) U † ( ⊗ | i h | )]= Tr[( | ψ i h ψ | ⊗ | i h | ) U † ( ⊗ | i h | ) U ] . (B15)With Lemma 1 and Eq. (B15), we may thus write:˜ P ( A ) d = Tr[( | ψ i h ψ | ⊗ | i h | ) V † ( | i h | ⊗ ⊗ | i h | ) V ] , (B16)1 FIG. 4:
Equivalent picture for dishonest Alice.
In the original dishonest setup of Fig. 3, Alice aims to maximizethe outcome (1 , , b = 1 − (1 − y )(1 − z ).where V = ( ⊗ H ( b ) )( H ( a ) ⊗ )( ⊗ R ( π ) ⊗ ), with a = y (1 − z )1 − (1 − y )(1 − z ) and b = 1 − (1 − y )(1 − z ). Let us now define: | ψ a i := H ( a ) ( ⊗ R ( π )) | ψ i . (B17)The constraints h ψ | i = 0 and h ψ a | i = 0 are equivalent, because the above transformation leaves the total numberof photons invariant. With Eq. (B16) we obtain˜ P ( A ) d = Tr[( | ψ a i h ψ a | ⊗ | i h | )( ⊗ H ( b ) )( | i h | ⊗ ⊗ | i h | )( ⊗ H ( b ) )] , (B18)with the constraint h ψ a | i = 0. Maximizing this expression thus corresponds to maximizing the probability of theoutcome (0 ,
0) when measuring modes 1 and 3 of the state obtain by mixing the second half of | ψ a i with the vacuumon a beam splitter of reflectivity b = 1 − (1 − y )(1 − z ) (Fig. 4).We now show that an optimal strategy for Alice is to ensure that | ψ a i = | i . Let us write | ψ a i = X p + q> ψ pq | pq i , (B19)where we take into account the constraint h ψ x | i = 0. Then, with Eq. (B18) we obtain˜ P ( A ) d = X p + q> ,p + q > ψ pq ψ ∗ p q Tr[ | pq i h p q | ( | i h | ⊗ H ( b ) ( ⊗ | i h | ) H ( b ) )]= X q> ,q > ψ q ψ ∗ q Tr[ | q i h q | H ( b ) ( ⊗ | i h | ) H ( b ) ]= X n ≥ ,q> ,q > ψ q ψ ∗ q Tr[ | q i h q | H ( b ) | n i h n | H ( b ) ]= X n> | ψ n | | h n | H ( b ) | n i | = X n> | ψ n | b n , (B20)where we used in the fourth line the fact that H ( b ) doesn’t change the number of photons. Since b ∈ [0 , P ( A ) d (cid:54) b X n> | ψ n | = b, (B21)2since | ψ a i is normalized, and this bound is reached for | ψ | = 1, i.e. | ψ a i = | i . With Eq. (B17), this implies thatan optimal strategy for Alice is to prepare the state | ψ i = ( ⊗ R ( π )) H ( a ) | i = √ − a | i + √ a | i = r z − (1 − y )(1 − z ) | i + s y (1 − z )1 − (1 − y )(1 − z ) | i = | φ i , (B22)where | φ i is the state that dishonest Alice needs to send to maximize her winning probability when Bob usesnumber-resolving detectors (Eq. (B8)). Her winning probability is then P ( A ) d = 1 − (1 − y )(1 − z ) . (B23)We therefore recover the same result as for number-resolving detectors. Once again, if the protocol is fair then y = 1 − − x ) and z = 2 x , so P ( A ) d = 12(1 − x ) , (B24)and an optimal strategy for Alice is to prepare the state | φ x i := 2 p x (1 − x ) | i + (1 − x ) | i . (B25) Appendix C: Quantum SCF protocol
An unbalanced quantum WCF protocol can be turned into a quantum SCF protocol using an additional classicalprotocol, as described in [7]. In particular, let us consider a WCF protocol such that: P ( A ) h = pP ( B ) h = 1 − pP ( A ) d = p + (cid:15)P ( B ) d = 1 − p + (cid:15), (C1)for p ∈ [0 ,
1] and (cid:15) >
0. Then, the corresponding SCF protocol has bias [7]max (cid:18) −
12 ( p − (cid:15) ) , − ( p + (cid:15) ) − (cid:19) . (C2)For our WCF protocol, we have Eqs. (A16),(A17) and (B23): P ( A ) h = 1 − (1 − x )(1 − y ) P ( B ) h = (1 − x )(1 − y ) P ( A ) d = 1 − (1 − y )(1 − z ) P ( B ) d = 1 − x, (C3)with the constraint z = x − (1 − x )(1 − y ) (so that the protocol does not abort in the honest case, Eq. (A15)). Enforcingthe conditions in Eq. (C1), and optimizing over the corresponding SCF bias implies x = y (1 − y )(1 − y ) z = y (1 − y ) − x − y − z + yz , (C4)3which in turn give the values x ≈ . y ≈ . z ≈ . , (C5)by enforcing x, y, z ∈ [0 , ≈ .
31, which is a lower bias than the best implemented SCF protocol so far[20].
Appendix D: Correctness, with losses
We give a representation of the honest protocol with losses, in Fig. 5. The efficiency of Alice’s and Bob’s detectorsare denoted η ( A ) d and η ( B ) d , respectively. The efficiency of the quantum channel from Alice to Bob is denoted η t , and η ( A ) f and η ( B ) f are the efficiencies of Alice’s and Bob’s fiber delay lines, respectively.The honest winning probability for Bob is directly given by his chance of detecting the photon (the photon gets tohis detector and doesn’t get lost): P ( B ) h = η t η ( B ) d (1 − x )(1 − y ) . (D1)On the other hand, Alice wins if the photon, starting from her first input mode, is detected by Bob in the last step. FIG. 5:
Representation of the honest protocol with losses.
The dashed boxes indicate Alice and Bob’slaboratories, respectively. The reflectivity of the beamsplitters is indicated in red. The efficiencies of the detectors,are indicated in white. Curly lines represent fiber used for quantum communication from Alice to Bob, or delaylines within Alice’s or Bob’s laboratory. | i and | i are the vacuum and single photon Fock states, respectively. Bobbroadcasts the classical outcome c , which controls an optical switch on Alice’s side. The protocol when Bob declares c = 0 / a † → √ x ˆ a † + √ − x ˆ a † → q xη ( A ) f ˆ a † + p (1 − x ) η t ˆ a † → q xη ( A ) f ˆ a † + p (1 − x ) η t y ˆ a † + p (1 − x )(1 − y ) η t ˆ a † → q xη ( A ) f ˆ a † + p (1 − x ) η t y ˆ a † + q (1 − x )(1 − y ) η t η ( B ) d ˆ a † → q xη ( A ) f η t ˆ a † + q (1 − x ) η t yη ( B ) f ˆ a † + q (1 − x )(1 − y ) η t η ( B ) d ˆ a † → (cid:18)q xη ( A ) f η t z + q (1 − x ) η t yη ( B ) f (1 − z ) (cid:19) ˆ a † + (cid:18)q xη ( A ) f η t (1 − z ) − q (1 − x ) η t yη ( B ) f z (cid:19) ˆ a † + q (1 − x )(1 − y ) η t η ( B ) d ˆ a † → (cid:18)q xη ( A ) f η t zη ( B ) d + q (1 − x ) η t yη ( B ) f (1 − z ) η ( B ) d (cid:19) ˆ a † + (cid:18)q xη ( A ) f η t (1 − z ) η ( B ) d − q (1 − x ) η t yη ( B ) f zη ( B ) d (cid:19) ˆ a † + q (1 − x )(1 − y ) η t η ( B ) d ˆ a † . (D2)In particular, the photon reaches Bob’s uppermost detector with probability P ( A ) h = (cid:18)q xη ( A ) f η t zη ( B ) d + q (1 − x ) η t yη ( B ) f (1 − z ) η ( B ) d (cid:19) = η t η ( B ) d (cid:18)q xzη ( A ) f + q (1 − x ) y (1 − z ) η ( B ) f (cid:19) . (D3)Finally, the protocol aborts for all other detection events: P ab = 1 − P ( A ) h − P ( B ) h . (D4) Appendix E: Security analysis for Dishonest Alice, with losses
The losses η correspond to a probability 1 − η of losing a photon. These can be modelled as a mixing with thevacuum on a beam splitter of reflectivity η . Dishonest Bob wins with probability P ( B ) d = 1 − xη ( A ) f η ( A ) d , (E1)by performing the same attack as in the lossless case, since he has no control over Alice’s laboratory. In what follows,we provide the security analysis for Dishonest Alice.
1. Lossy delay line
We show in this section that Alice’s maximum winning probability when Bob is using a delay line of efficiency η f isalways lower than when Bob’s delay line is perfect, i.e. η f = 1, independently of the efficiency η d of his detectors. Thelossy delay line of efficiency η f may be modelled as a mixing with the vacuum on a beam splitter of transmission η f .Alice prepares a state σ , which goes through the interferometer depicted in Fig. 6, and wins if the measurementoutcome obtained by Bob is (1 , , η f just before the detection (Fig. 7), since this increases the probability of theoutcome 0 for this mode. Let us assume that this is the case. Then, by Lemma 2, the losses η f on output modes 2and 3 may be commuted back through the beam splitter of reflectivity y , acting on modes 2 and 3.Since the input state on mode 3 is the vacuum, the losses on this mode may then be removed (Fig. 8). In that case,the probability of winning is clearly lower than when the delay line is perfect (Fig. 9), because Alice is now restrictedto lossy state preparation instead of ideal state preparation.5 FIG. 6:
Alice aims to maximize the outcome (1 , ,
0) by sending the state σ . The lossy delay line is represented by amixing with the vacuum on a beam splitter of transmission amplitude η f . The quantum efficiency of the detectors isindicated in white. FIG. 7:
Adding losses on the third mode increases Alice’s winning probability.
FIG. 8:
The losses η f are commuted back to Alice’s state preparation. The losses on input mode 3 can be omittedsince the input state is the vacuum.This reduction shows that Alice’s maximum winning probability when Bob is using a lossy delay line is alwayslower than when Bob’s delay line is perfect, independently of the efficiency η d of his detectors.Moreover, Alice’s maximum cheating probability and optimal cheating strategy may be inferred from the casewhere Bob has a perfect delay line, as we show in what follows. By convexity of the probabilities, Alice’s best strategyis to send a pure state | ψ i = P k,l (cid:62) ψ kl | kl i . Let us denote by W the interferometer depicted in Fig. 6, including thedetection losses. Let us consider the evolution of Alice’s state and the vacuum on the third input mode through the6 FIG. 9:
Alice aims to maximize the outcome (1 , ,
0) by sending the state σ . The delay line efficiency η f is equal to1.interferometer W . The creation operator for the first mode evolves asˆ a † → √ z ˆ a † + √ − z ˆ a † → √ zη d ˆ a † + p (1 − z ) η d ˆ a † = W ˆ a † W † , (E2)while the creation operator for the second mode evolves asˆ a † → √ y ˆ a † + p − y ˆ a † → √ yη f ˆ a † + p − y ˆ a † → q y (1 − z ) η f ˆ a † − √ yzη f ˆ a † + p − y ˆ a † → q y (1 − z ) η f η d ˆ a † − √ yzη f η d ˆ a † + p (1 − y ) η d ˆ a † = W ˆ a † W † . (E3)Hence, the output state (before the ideal threshold detection) is given by W | ψ i = W X k,l (cid:62) ψ kl | kl i = W X k,l (cid:62) ψ kl √ k ! l ! (ˆ a † ) k (ˆ a † ) l | i = X k,l (cid:62) ψ kl √ k ! l ! ( W ˆ a † W † ) k ( W ˆ a † W † ) l | i = X k,l (cid:62) ψ kl √ k ! l ! ( √ zη d ˆ a † + p (1 − z ) η d ˆ a † ) k ( q y (1 − z ) η f η d ˆ a † − √ yzη f η d ˆ a † + p (1 − y ) η d ˆ a † ) l | i . (E4)Now Alice’s maximum cheating probability is given by P ( A ) d = Tr[ W | ψ i h ψ | W † ( − | i h | ) | i h | ] . (E5)Hence, the state after a successful projection ( − | i h | ) | i h | , which has norm P ( A ) d , reads " X k + l> ψ kl √ k ! l ! ( zη d ) k/ [ y (1 − z ) η f η d ] l/ (ˆ a † ) k + l | i . (E6)7When Bob has a perfect delay line ( η f = 1) this state reads " X k + l> ψ kl √ k ! l ! ( zη d ) k/ [ y (1 − z ) η d ] l/ (ˆ a † ) k + l | i , (E7)and its norm is the winning probability of Alice in that case. Hence, P ( A ) d [ η f , η d , y, z ] = P ( A ) d [1 , η d , yη f , z ] , (E8)i.e.we can obtain Alice’s cheating probability by solving the case with perfect delay line, and replacing the parameter y by yη f . In the following, we thus derive Alice’s optimal strategy in that case.
2. Perfect delay line
Let σ be the state sent by Alice, and η d the detector efficiency. She needs to maximize the probability of the overalloutcome (1 , ,
0) at the output of the interferometer depicted in Fig. 10, hence the overlap with the projector:Π η d (1 , , = " − X m (1 − η d ) m | m i h m | ⊗ "X n,p (1 − η d ) n + p | n i h n | ⊗ | p i h p | . (E9)By convexity of the probabilities, we may assume without loss of generality that Alice sends a pure state σ = | ψ i h ψ | .Moreover, the imperfect threshold detectors of quantum efficiency η d can be modelled by mixing the state to bemeasured with the vacuum on a beam splitter of transmission amplitude η d followed by an ideal threshold detection [27].In that case, this corresponds to losses η d on modes 1, 2, and 3, followed by ideal threshold detections. By Lemma 2,commuting the losses back through the interferometer leads to the equivalent picture depicted in Fig. 11, where thelosses on input mode 3 have been omitted, since the input state is the vacuum.In that case, Alice’s probability of winning is clearly lower than when the threshold detectors are perfect (Fig. 3),because she is restricted to lossy state preparation instead of ideal state preparation. Let | ˜ ψ i be the lossy stateobtained by applying losses η d on both modes of Alice’s prepared state | ψ i . Alice’s winning probability may then bewritten: P ( A ) d = Tr[ U ( | ˜ ψ i h ˜ ψ | ⊗ | i h | ) U † ( − | i h | ) ⊗ | i h | ]= Tr[ U ( | ˜ ψ i h ˜ ψ | ⊗ | i h | ) U † ( ⊗ | i h | )] − Tr[ U ( | ˜ ψ i h ˜ ψ | ⊗ | i h | ) U † | i h | ] , (E10)where U = ( H ( z ) ⊗ )( ⊗ H ( y ) ) is the unitary corresponding to the general interferometer of the lossless protocol.By Lemma 1, we haveTr[( τ ⊗ | i h | ) U † ( ⊗ | i h | ) U ] = Tr[( τ ⊗ | i h | ) V † ( | i h | ⊗ ⊗ | i h | ) V ] , (E11)for any density matrix τ , where V = ( ⊗ H ( b ) )( H ( a ) ⊗ )( ⊗ R ( π ) ⊗ ), with a = y (1 − z ) y + z − yz and b = y + z − yz , and R ( π ) a phase shift of π acting on mode 2. Hence, P ( A ) d = Tr[ V ( | ˜ ψ i h ˜ ψ | ⊗ | i h | ) V † ( | i h | ⊗ ⊗ | i h | )] − Tr[ | ˜ ψ i h ˜ ψ | | i h | ] , (E12)where we used U † | i = | i for the second term. Setting | ˜ ψ x i = ( H ( a ) ⊗ )( ⊗ R ( π )) | ˜ ψ i yields P ( A ) d = Tr[( | ˜ ψ x i h ˜ ψ x | ⊗ | i h | )( ⊗ H ( b ) )( | i h | ⊗ ⊗ | i h | )( ⊗ H ( b ) )] | {z } ≡ P − Tr[ | ˜ ψ x i h ˜ ψ x | | i h | ] | {z } ≡ P , (E13)where we used | i = ( ⊗ R ( π )) H ( a ) | i for the second term P .Let us consider the first term P . Since | ˜ ψ i is the state obtained by applying losses η d on both modes of the state | ψ i , we obtain the equivalent picture in Fig. 12, where we have added losses η d also on mode 3, since the input stateis the vacuum.8Let | ψ x i = H ( a ) ( ⊗ R ( π )) | ψ i . With Lemma 2, commuting the losses η d to the output of the interferometer inFig. 12, and combining the losses on mode 2 and 3 yields P = Tr[ | ψ x i h ψ x | Π η d (0) ⊗ Π η d (1 − b )(0) ] , (E14)where Π η (0) is the POVM element corresponding to no click for a threshold detector of quantum efficiency η (recallthat this is the same as an ideal detector preceded by a mixing with the vacuum on a beam splitter of transmissionamplitude η ). The same reasoning for the second term P gives P = Tr[ | ψ x i h ψ x | Π η d (0) ⊗ Π η d (0) ] , (E15)and we finally obtain with Eq. (E13), P ( A ) d = Tr[ | ψ x i h ψ x | Π η d (0) ⊗ (Π η d (1 − b )(0) − Π η d (0) )] . (E16) FIG. 10:
Alice aims to maximize the outcome (1 , ,
0) by sending the state σ . The quantum efficiency of thedetectors is indicated in white. FIG. 11:
The quantum efficiency are modelled as losses η d on modes 1, 2, and 3, which are then commuted throughthe interferometer, back to Alice’s state preparation. The losses on input mode 3 can be omitted since the input stateis the vacuum.Let us write | ψ x i = P + ∞ k,l ≥ ψ kl | kl i . With the expression of the POVM in Eq. (E9) the last equation reads P ( A ) d = X k,l ≥ | ψ kl | (1 − η d ) k [(1 − η d (1 − b )) l − (1 − η d ) l ] (cid:54) max k,l (cid:62) (1 − η d ) k [(1 − η d (1 − b )) l − (1 − η d ) l ] X k,l (cid:62) | ψ kl | = max k,l (cid:62) (1 − η d ) k [(1 − η d (1 − b )) l − (1 − η d ) l ]= max l (cid:62) [(1 − η d (1 − b )) l − (1 − η d ) l ]= max l (cid:62) [(1 − η d (1 − y )(1 − z )) l − (1 − η d ) l ] , (E17)9 FIG. 12:
An equivalent picture for the first term P of Eq. (E13). The term P is the probability of the simultaneousoutcomes 0 for modes 1 and 3.where we used b = y + z − yz . Let l ∈ N ∗ such that max l (cid:62) [(1 − η d (1 − b )) l − (1 − η d ) l ] = (1 − η d (1 − b )) l − (1 − η d ) l .This last expression is an upperbound for P ( A ) d , which is attained for ψ kl = δ k, δ l,l , i.e. | ψ x i = | l i . Thus, the beststrategy for Alice is to send the state | ψ i = ( ⊗ R ( π )) H ( a ) | ψ x i = ( ⊗ R ( π )) H ( a ) | l i , (E18)where a = y (1 − z ) y + z − yz , and her winning probability is then P ( A ) d = (1 − η d (1 − y )(1 − z )) l − (1 − η d ) l , (E19)when Bob has a perfect delay line. Recalling Eq. (E8), the best strategy for Alice when Bob has a lossy delay line ofefficiency η f is to send the state | ψ i = ( ⊗ R ( π )) H ( a ) | ψ x i = ( ⊗ R ( π )) H ( a ) | l i , (E20)where a = y (1 − z ) η f yη f + z − yzη f , and l ∈ N ∗ maximizes (1 − η d (1 − yη f )(1 − z )) l − (1 − η d ) l . Her winning probability is then P ( A ) d = max l> h (1 − (1 − yη f )(1 − z ) η d ) l − (1 − η d ) l i = (1 − η d (1 − yη f )(1 − z )) l − (1 − η d ) l = η d [1 − (1 − yη f )(1 − z )] l − X j =0 (1 − η d ) j (1 − η d (1 − yη f )(1 − z )) l − j − (cid:54) η d [1 − (1 − yη f )(1 − z )] l − X j =0 (1 − η d ) j = η d [1 − (1 − yη f )(1 − z )] 1 − (1 − η d ) l − (1 − η d )= [1 − (1 − yη f )(1 − z )][1 − (1 − η d ) l ] (cid:54) − (1 − yη f )(1 − z ) (cid:54) − (1 − y )(1 − z ) , (E21)and this last expression is the winning probability when there are no losses.Let us derive the value of l . For this, we define: r = 1 − η d (1 − yη f )(1 − z ) s = 1 − η d . (E22)0We then consider a λ ∈ R ∗ + which maximizes ( r λ − s λ ) for λ ∈ R ∗ + . We have that: ddλ ( r λ − s λ ) = 0 ⇔ λ = ln ln s − ln ln r ln r − ln s , (E23)for strictly non-zero r and s and where ln denotes the complex logarithm function. This allows to deduce: l = floor( λ ) if r floor( λ ) − s floor( λ ) (cid:62) r ceil( λ ) − s ceil( λ ) ceil( λ ) if r ceil( λ ) − s ceil( λ ) (cid:62) r floor( λ ) − s floor( λ ) . (E24) Appendix F: Solving the system from Eq. (4)1. Condition (i)
The first condition enforces a fair protocol, i.e. P ( A ) h = P ( B ) h . With Eqs. (D1) and (D3), we aim to solve for y as afunction of x and z :( i ) ⇔ η t η ( B ) d (cid:18)q xzη ( A ) f + q (1 − x ) y (1 − z ) η ( B ) f (cid:19) = η t η ( B ) d (1 − x )(1 − y )( i ) ⇔ (1 − x ) h (1 − z ) η ( B ) f + 1 i y + 2 q x (1 − x ) z (1 − z ) η ( A ) f η ( B ) f √ y + xzη ( A ) f − (1 − x ) = 0 . (F1)We make the substitution Y = √ y in order to transform Eq. (F1) into a second-order polynomial equation. We thentake only the positive solution (since y must be positive) which reads: Y = r xz (1 − z ) η ( A ) f η ( B ) f − h (1 − z ) η ( B ) f + 1 i h xzη ( A ) f − (1 − x ) i − q xz (1 − z ) η ( A ) f η ( B ) f √ − x h (1 − z ) η ( B ) f + 1 i . (F2)We may finally write: ( i ) ⇔ y = f (cid:16) x, z, η ( i ) f , η d , η t (cid:17) , (F3)where f (cid:16) x, z, η ( i ) f , η d , η t (cid:17) = (cid:16)q (1 − x ) (cid:2) (1 − z ) η ( B ) f +1 (cid:3) − xzη ( A ) f − p xz (1 − z ) η ( A ) f η ( B ) f (cid:17) (1 − x ) (cid:2) (1 − z ) η ( B ) f +1 (cid:3) .Note that y should be a real number, and hence we require that the expression under the first square root of f (cid:16) x, z, η ( i ) f , η d , η t (cid:17) is positive, i.e.: z (cid:54) (1 − x )(1 + η ( B ) f ) xη ( A ) f + (1 − x ) η ( B ) f . (F4)Furthermore, note that, for η ( A ) f = η ( B ) f = η f , y should be an increasing function of η f , and therefore a decreasingfunction of d when η f = 10 − . d . Mathematically speaking, this is to prevent y ( d ) → ∞ and y ( d ) >
1. Physicallyspeaking, this condition ensures that, as the probability of transmitting the photon (and of preserving it for verification)gets smaller, Bob should encourage a detection on the third mode, which evens out the honest probabilities of winning.
2. Condition (ii)
The second condition enforces a balanced protocol, i.e. P ( A ) d = P ( B ) d . With Eqs. (E1) and (E21), this translates intothe following expression for x : ( ii ) ⇔ x = g (cid:16) y, z, η ( i ) f , η ( i ) d (cid:17) , (F5)1where g (cid:16) y, z, η ( i ) f , η ( i ) d (cid:17) = 1 η ( A ) f η ( A ) d (cid:20) − max l (cid:62) [(1 − η ( B ) d (1 − yη ( B ) f )(1 − z )) l − (1 − η ( B ) d ) l ] (cid:21) . (F6)
3. Condition (iii)
We recall the general coin flipping formalism from [24], in which any classical or quantum coin flipping protocolmay be expressed as: CF ( p , p , p ∗ , p ∗ , p ∗ , p ∗ ) , (F7)where p ii is the probability that two honest players output value i ∈ { , } , p ∗ i is the probability that DishonestAlice forces Honest Bob to declare outcome i , and p i ∗ is the probability that Dishonest Bob forces Honest Alice todeclare outcome i . In this formalism, a perfect SCF protocol can then be expressed as CF (cid:0) , , , , , (cid:1) , whilea perfect WCF may be expressed as CF (cid:0) , , , , , (cid:1) . We may now express our quantum WCF protocol in thelossless setting as: CF (cid:18) , , (cid:20) − x ) (cid:21) , , , [1 − x ] (cid:19) . (F8)In the lossy setting, note that the probabilities that Alice and Bob each choose to lose (i.e. p ∗ and p ∗ , respectively),both remain 1. When Dishonest Bob chooses to lose, he may always declare outcome 0 regardless of what he detects,which yields p ∗ = 1. When Dishonest Alice chooses to lose, she may send a state | n i to Bob, and so: p ∗ = Tr h H ( y ) | n i h n | H ( y ) I ⊗ ( I − Π ) i = 1 − Tr h H ( y ) | n i h n | H ( y ) ( I ⊗ Π ) i , (F9)where Π = P l ≥ (1 − η ) l | l i h l | and H ( y ) = √ y √ − y √ − y −√ y .Now, H ( y ) | n i = H ( y ) (ˆ a † ) n √ n ! | i = 1 √ n ! ( √ y ˆ a † + p − y ˆ a † ) n | i = 1 √ n ! n X k =0 (cid:18) nk (cid:19) y k (1 − y ) n − k ˆ a † k ˆ a † ( n − k )2 | i = n X k =0 s(cid:18) nk (cid:19) y k (1 − y ) n − k | k ( n − k ) i . (F10)We thus obtain, by linearity of the trace: p ∗ = 1 − X l,l ≥ (1 − η ) l n X k,k =0 s(cid:18) nk (cid:19) y k (1 − y ) n − k s(cid:18) nk (cid:19) y k (1 − y ) n − k Tr [ | k ( n − k ) i h k ( n − k ) | | l l i h l l | ]= 1 − n X k =0 (1 − η ) n − k (cid:18) nk (cid:19) y k (1 − y ) n − k = 1 − [ y + (1 − η )(1 − y )] n , (F11)2which goes to 1 when n goes to infinity, for y <
1. Hence, in the lossy setting, the protocol becomes a: CF (cid:16) P ( A ) h , P ( B ) h , P ( A ) d , , , P ( B ) d (cid:17) , (F12)where P ( A ) d = max l> (cid:16) − (1 − yη ( A ) f )(1 − z ) η ( B ) d (cid:17) l − (cid:16) − η ( B ) d (cid:17) l and P ( B ) d = 1 − xη ( A ) f η ( A ) d .Using Theorem 1 from [24], there exists a classical protocol that implements an information-theoretically securecoin flip with our parameters if and only if the following conditions hold: P ( A ) h ≤ P ( A ) d P ( B ) h ≤ P ( B ) d P ab = 1 − P ( A ) h − P ( B ) h ≥ (1 − P ( A ) d )(1 − P ( B ) d ) . (F13)Our quantum protocol therefore presents an advantage over classical protocols if at least one of these conditions cannot be satisfied. Since we are interested in fair and balanced protocols, setting P h = P ( A ) h = P ( B ) h and P d = P ( A ) d = P ( B ) d allows to rewrite (F13) as: ( P h ≤ P d P ab = 1 − P h ≥ (1 − P d ) ⇔ P h ≤ [1 − (1 − P d ) ] . (F14)Let us finally remark that for all x we have [1 − (1 − x ) ] = x − x ≤ x , so the first inequality above is implied bythe second. The system is thus equivalent to the second inequality: P ab = 1 − P h ≥ (1 − P d ) , (F15)provided that P ( A ) h = P ( B ) h = P h and P ( A ) d = P ( B ) d = P d .In order to get a clearer insight into the meaning of quantum advantage, we express this condition in terms ofcheating probability: our protocol displays quantum advantage if and only if the lowest classical cheating probability P Cd = 1 − p − P h = 1 − p P ab (F16)exceeds our quantum cheating probability P Qd . Appendix G: Practical quantum advantage for various detection efficiencies
In this section, we plot the numerical solutions to the system from Eq. (4) in order to display quantum advantageas a function of distance for various detection efficiencies. Numerical values for the lowest classical and quantumcheating probabilities, P Cd and P Qd , are plotted as a function of distance d in blue and red, respectively. Our quantumprotocol performs strictly better than any classical protocol when P Qd < P Cd . We set η f = η s η t , where η s is thefiber delay transmission corresponding to 500ns of optical switching time, and η t = (cid:16) − . d (cid:17) is the fiber delaytransmission associated with travelling distance d twice (once for quantum, once for classical) in single-mode fiberswith attenuation 0 . FIG. 13:
Parameters η d = 0 .
95 and z = 0 .
57. Note that honest abort probability P ab is plotted in magenta. FIG. 14:
Parameters η d = 0 .
90 and z = 0 .
63. Note that honest abort probability has been omitted in order to zoomin, but it lies around 0 ..