Optimal quantum strong coin flipping
André Chailloux, Iordanis Kerenidis
LRI, Équipe ALGO, Université Paris Sud
Optimal quantum strong coin flipping A.Chailloux, I.Kerenidis
1/26
What is coin flipping ?
?
●
Alice and Bob divorce
➢
➢
➢
●
They want to decide fairly who gets the car
They are far from each other but can communicate
(e.g. by telephone)
They don't trust each other
How do they decide ?
➢
They flip a random coin
Optimal quantum strong coin flipping A.Chailloux, I.Kerenidis
2/26
●
●
It is not the QKD scenario
➢
Alice and Bob don't trust each other
➢
There is no eavesdropper
Other primitives that follow this scenario
➢
Bit Commitment
➢
Oblivious transfer
Optimal quantum strong coin flipping A.Chailloux, I.Kerenidis
3/26
Strong coin flipping
●
A strong coin flipping protocol consists of
➢
➢
●
Instructions given to Alice and Bob
An output value c 2 f0; 1; ?g
And has the following properties
➢
➢
➢
If Alice and Bob are honest then
Bias of the protocol
1
Pr[c = 0] = Pr[c = 1]) =
2
If Alice cheats and Bob is honest then
1
¤
PA = max (Pr[c = 0]; Pr[c = 1]) · + "
2
If Bob cheats and Alice is honest then
1
PB¤ = max (Pr[c = 0]; Pr[c = 1]) · + "
2
Optimal quantum strong coin flipping A.Chailloux, I.Kerenidis
4/26
Weak coin flipping
●
A weak coin flipping protocol consists of
➢
➢
➢
●
Instructions given to Alice and Bob
An output value c 2 f0; 1; ?g
c = 0 ↔ "Alice wins" ; c = 1 ↔ "Bob wins"
And has the following properties
➢
➢
➢
If Alice and Bob are honest then
1
Pr[Alice wins] = Pr[Bob wins] =
2
If Alice cheats and Bob is honest then
1
¤
PA = Pr[Alice wins] · + "
2
If Bob cheats and Alice is honest then
1
PB¤ = Pr[Bob wins] · + "
2
Optimal quantum strong coin flipping A.Chailloux, I.Kerenidis
5/26
Security conditions
●
The honest protocol must be efficient
●
Cheating players
➢
➢
Information theoretic security: any cheating player
has unlimited computational power and memory
Computational security: cheating players have limited
resources → (almost) all in-use protocols
Optimal quantum strong coin flipping A.Chailloux, I.Kerenidis
6/26
Classical coin flipping
●
Information theoretic security
1
Nothing is possible i.e. " = 2
➢
●
Computational security
We can achieve " ¼ 0 basing a coin flipping protocol on
➢
the hardness of factoring.
●
What about quantumly ?
Optimal quantum strong coin flipping A.Chailloux, I.Kerenidis
7/26
Known quantum results (IT security)
●
Strong coin flipping
➢
➢
➢
➢
●
" ' 0:41 [ATVY00]
" = 0:25 [Amb02,SR02]
1
1
1
¤
¤
PA £ PB ¸ i.e. " ¸ p ¡ ' 0:21 [Kit03]
2
2 2
1
1
p ¡ · " · 0:25
2 2
Weak coin flipping
➢
" ! 0 [Moc07]
Optimal quantum strong coin flipping A.Chailloux, I.Kerenidis
8/26
Best known strong coin flipping
a 2R f0; 1g
jÁa i =
p1 jaijai
2
+
p1 j2ij2i
2
½a
b 2R f0; 1g
●
A & B are honest
➢
●
➢
➢
a, pur jÁa i
c=a©b
●
CHECK
1
2
A is dishonest, optimal:
➢
b
Pr[c = 0] = Pr[c = 1] =
¾ = 16 j0ih0j + 16 j1ih1j + 23 j2ih2j
F 2 (½0 ; ¾) = F 2 (½1 ; ¾) =
PA¤ ·
3
4
3
4
B is dishonest, optimal
➢
➢
measure ½a
PB¤ · 12 + 14 = 34
½a = 12 jaihaj + 12 j2ih2j
Optimal quantum strong coin flipping A.Chailloux, I.Kerenidis
9/26
Our work
●
What is best bias for strong coin flipping ?
➢
➢
➢
We construct a protocol with " =
p1
2
¡
1
2
We use Mochon's weak coin flipping as a subroutine
The construction is classical and easy to describe
(unlike Mochon's protocol).
Optimal quantum strong coin flipping A.Chailloux, I.Kerenidis
10/26
A first attempt
●
●
●
●
Perform (almost) perfect WCF
The winner chooses c 2R f0; 1g
If A & B are honest: c is random
A cheating player can choose the value of c only
if he wins the WCF otherwise c is random
➢
➢
●
PA¤
1
1 1
3
1
1 1
3
¤
· ¢1+ ¢ =
; PB · ¢ 1 + ¢ =
2
2 2
4
2
2 2
4
Problem: a cheating player succeeds with
probability 1/2 even if he loses the WCF
Optimal quantum strong coin flipping A.Chailloux, I.Kerenidis
11/26
Old protocol
New protocol
a 2R f0; 1g
a
Perform WCF
Perform WCF(z)
●
The winner outputs
a random value c
●
If A wins
➢
●
Output c = a
If B wins
➢
Outputs c = a wp. p
➢
Outputs c = 1-a wp. 1-p
Optimal quantum strong coin flipping A.Chailloux, I.Kerenidis
12/26
Unbalanced weak coin flipping
●
An unbalanced weak coin flipping W CF (z; ")
has the following properties:
➢
If Alice and Bob are honest then
Pr[Alice wins] = z and Pr[Bob wins] = 1 ¡ z
➢
➢
If Alice cheats and Bob is honest then
PA¤ = Pr[Alice wins] · z + "
If Bob cheats and Alice is honest then
PB¤ = Pr[Bob wins] · (1 ¡ z) + "
Optimal quantum strong coin flipping A.Chailloux, I.Kerenidis
13/26
Our protocol
●
a 2R f0; 1g
a
➢
●
Perform WCF(z,0)
●
If A & B are honest
If Bob cheats (suppose he
wants 0)
➢
➢
●
Output c = a
If B wins
➢
➢
Outputs c = a wp. p
Outputs c = 1-a wp. 1-p
If a = 0, Bob lets Alice win
the WCF
Pr[c = 0] · 1
If A wins
➢
c is random
If a = 1, Bob wants to win
the WCF
Pr[c = 0] · 1 ¡ z
➢
PB¤
Since a is random
2¡z
= Pr[c = 0] ·
2
Optimal quantum strong coin flipping A.Chailloux, I.Kerenidis
14/26
Our protocol
●
a 2R f0; 1g
a
If Alice cheats (suppose she
wants 0)
➢
Perform WCF(z,0)
●
Pr[c = 0] · z + (1 ¡ z)p
➢
If a = 1, Alice lets Bob win
the WCF
Pr[c = 0] · (1 ¡ p)
If A wins
➢
●
If a = 0, Alice wants to win
Output
c=a
➢
If B wins
➢
➢
= a wp. p
Outputs c = a wp. 1 ¡ p
We choose p so that these
values are equal
p=
Outputs c
➢
PA¤
1¡z
2¡z
1
·1¡p ·
2¡z
Optimal quantum strong coin flipping A.Chailloux, I.Kerenidis
15/26
Recap
●
We construct a protocol with
1
¤
¤
PA¤ · 2¡z
; PB¤ · 2¡z
)
P
¢
P
A
B ·
2
➢
➢
●
●
1
2
We achieve Kitaev's lower bound.
¤
¤
P
=
P
In order to have A
B we need
p to
construct WCF(z) with z = 2 ¡ 2
What about errors ?
Optimal quantum strong coin flipping A.Chailloux, I.Kerenidis
16/26
Creating unbalanced protocol
●
We start from
➢
●
●
P1 = W CF (z1 ; ") ; P2 = W CF (z2 ; ") ; Q = W CF ( 12 ; "0 ) ; z2 ¸ z1
We consider the following protocol P
➢
Perform Q
➢
If Alice wins, run P2 ; If Bob wins, run P1
z1 + z 2
; " + (z2 ¡ z1 )"0 )
We have P = W CF (
2
Optimal quantum strong coin flipping A.Chailloux, I.Kerenidis
17/26
Sketch of proof
●
If A & B are honest then
Pr[Alice wins] = z22 + z21
➢
●
If Alice cheats
➢
➢
●
Her optimal strategy is to try and win Q
Pr[Alice wins] · ( 12 + "0 ) ¢ (z2 + ") + ( 12 ¡ "0 ) ¢ (z1 + ")
Pr[Alice wins] ·
z1 +z2
2
+ " + "0 (z2 ¡ z1 )
The error increases slowly
➢
"0 +
"0
2
+
"0
4
¢¢¢
z1
z1 +z2
2
Optimal quantum strong coin flipping A.Chailloux, I.Kerenidis
z2
18/26
Unbalanced weak coin flipping
Proposition
●
●
Let P = W CF ( 12 ; "0 ) with N rounds of communication
8x 2 f0; 1g; we can create Q = W CF (z; "0 ) with:
➢
Q uses tN rounds of communication
➢
jz ¡ xj · 2¡t
➢
"0 · 2"0
Optimal quantum strong coin flipping A.Chailloux, I.Kerenidis
19/26
Final Theorem
Theorem
●
Let P = W CF ( 12 ; "0 ) with N rounds of communication
●
We can create a strong coin °ipping protocol S such that
p1
2
¡
1
2
➢
The bias of S is smaller than
+ 4"0
➢
S uses O(log( "10 )N ) rounds of communication
Optimal quantum strong coin flipping A.Chailloux, I.Kerenidis
20/26
Loss Tolerant quantum coin flipping
(Brassard et al.)
jÁ0;0 i = j0i ; jÁ0;1 i = j+i
jÁ1;0 i = j1i ; jÁ1;1 i = j¡i
B0 = fj0i; j1ig
B1 = fj+i; j¡ig
●
●
No conclusive M for a
(optimized) bias ' 0:4
a 2R f0; 1g
x 2R f0; 1g
jÁa;x i
b 2R f0; 1g
y 2R f0; 1g
M in By
b
a; x
c=a©b
Optimal quantum strong coin flipping A.Chailloux, I.Kerenidis
CHECK
when x = y
21/26
Problem with noise
●
Quantum noise
➢
➢
●
Quantum losses
Errors in the measurement: In this case, honest
players also abort with some probability
If we can deal with noise, these protocols
can be practical.
Optimal quantum strong coin flipping A.Chailloux, I.Kerenidis
22/26
A first attempt
●
Error rate e (e = 2%)
●
Repeat Brassard's protocol twice
➢
If QCF1 doesn't abort, output it's outcome o1
➢
If QCF1 aborts and QCF2 doesn't aborts, output o2
➢
If both abort then abort
●
Abort probability = (e/2)2 = 10-4
●
Bias = 49%
Optimal quantum strong coin flipping A.Chailloux, I.Kerenidis
23/26
A second attempt
●
Run the protocol k times (k < 10)
●
Honest case
➢
Output majority of the outcomes
➢
Accept if #Aborts ≤ 2
➢
●
●
With correct parameters
➢
Abort probability = 6*10-6
➢
Bias = 49%
What next ?
Optimal quantum strong coin flipping A.Chailloux, I.Kerenidis
24/26
Conclusion
●
By using Mochon's weak coin flipping, we
construct an optimal quantum SCF
➢
●
Because of Kitaev's bound, not practical
➢
●
We need a better understanding of Mochon's protocol
Possible if we restrict Alice or Bob's memory
What happens if we add noise ?
➢
Attempt by Brassard et al. with losses
➢
Can we make it really noise tolerant ?
Optimal quantum strong coin flipping A.Chailloux, I.Kerenidis
25/26
Thank you
Optimal quantum strong coin flipping A.Chailloux, I.Kerenidis
26/26