PRL 94, 040501 (2005)
week ending
4 FEBRUARY 2005
PHYSICAL REVIEW LETTERS
Experimental Quantum Coin Tossing
G. Molina-Terriza,1,* A. Vaziri,1,† R. Ursin,1 and A. Zeilinger1,2
1
Institut für Experimentalphysik, Universität Wien, Boltzmanngasse 5, A-1090, Vienna, Austria
Institute for Quantum Optics and Quantum Information, Austrian Academy of Sciences, Vienna, Austria
(Received 1 March 2004; published 31 January 2005)
2
In this Letter we present the first implementation of a quantum coin-tossing protocol. This protocol
belongs to a class of ‘‘two-party’’ cryptographic problems, where the communication partners distrust
each other. As with a number of such two-party protocols, the best implementation of the quantum coin
tossing requires qutrits, resulting in a higher security than using qubits. In this way, we have also
performed the first complete quantum communication protocol with qutrits. In our experiment the two
partners succeeded to remotely toss a row of coins using photons entangled in the orbital angular
momentum. We also show the experimental bounds of a possible cheater and the ways of detecting him.
DOI: 10.1103/PhysRevLett.94.040501
PACS numbers: 03.67.Hk, 03.67.Dd, 42.65.Lm
In the original ‘‘coin-tossing’’ protocol, Alice and Bob
had just divorced and did not want to ever see each other
again but they had to decide who kept the dog [1]. As they
did not trust any third party as a referee, they agreed to toss
a coin. How could Bob be sure that Alice is honest when
she said ‘‘It was tails. . .you lost’’ if he could not see the
outcome of the toss? This protocol belongs to a set of novel
cryptographic problems like mail certification, remote contract signing, and mental poker, where, instead of ruling
out an eavesdropper, the problem is that the communicating partners do not trust each other. Other examples of this
so called ‘‘post cold war’’ protocols are ‘‘bit commitment’’
or the computation of a function with distributed inputs [2].
This kind of protocol is receiving increased attention
from the cryptographic and quantum information communities. Although the perfect security of some ‘‘twoparty’’ protocols seems impossible [3], it is unclear which
bounds can be imposed on the security. Also, it has been
suggested that quantum mechanics can be derived from
purely quantum information postulates, like the security of
quantum key distribution and the impossibility of perfect
quantum bit commitment [4].
In a solution for coin tossing Alice throws the coin, locks
it in a ‘‘box’’ and sends it to Bob, who has the proof that the
coin was thrown, but cannot see the actual result. Bob
makes his bet and, upon receiving it, Alice sends the key
to Bob, who unlocks the result [5]. In general, there is no
classical protocol which allows unrestricted security
against cheating for the coin-tossing protocols.
In quantum coin tossing [7,6,8–10], we replace the box
by a quantum state. Alice encodes the result of the throw of
the coin by choosing one among a series of nonorthogonal
states and sends it to Bob. Without previous knowledge,
Bob cannot know with certainty which of the states he
possesses. At this point, Bob makes his bet. To ‘‘unlock’’
the state, Alice now tells Bob which state she sent and then
he measures it to check Alice’s honesty.
If Bob’s measurement identifies Alice’s predicted state,
the protocol is a success. Otherwise, Alice and Bob con0031-9007=05=94(4)=040501(4)$23.00
sider the throw as a ‘‘failure’’. Contrary to the classical
case, this coin tossing scheme limits the chances of a
cheater to succeed. We will show that cheating can be
detected when the failures increase over the statistical
errors.
Our implemented protocol is based on a proposal by
Ambainis [6] using three-dimensional quantum states
(‘‘qutrits’’). The series of states that Alice can send and
the correspondent throw of the coin are presented in the
table shown in Fig. 1. Alice’s states are divided into two
sets, each of them containing two orthogonal states. States
of one set have a nonvanishing projection onto states of the
other set. Bob needs two different measuring bases in order
to determine the state of each possible photon sent by
Alice. Each of Bob’s bases (Fig. 1) contains, besides
Set Label Alice’s States
1
Coin
√
A11 (|0 + |1 )/ 2 Heads (1)
Bob’s Bases Label
√
(|0 + |1 )/ 2 B11
(|0
1
2
2
A12 (|0
√
1 )/ 2 Heads (1)
√
1 )/ 2 B12
|2
B13
√
(|0 + |2 )/ 2 B21
√
A21 (|0 + |2 )/ 2 Tails (0)
√
(|0
2 )/ 2 B22
√
A22 (|0
2 )/ 2 Tails (0)
|1
B23
FIG. 1. Here we show the four different states sent by Alice
and the bases used by Bob to properly characterize the incoming
photon. The Alice’s states are divided into two sets of two states.
Each set represents a particular side of the coin. Bob uses two
bases, corresponding to Alice’s states, each expanded by one
further orthogonal state. The label of the states eases their
recognition in Fig. 2.
040501-1
 2005 The American Physical Society
PHYSICAL REVIEW LETTERS
PRL 94, 040501 (2005)
Alice’s states of the corresponding set, a third orthogonal
state. These additional states are crucial for increasing the
chances to detect cheating, as we will show below.
The maximum probability that one of the partners biases
the result without being noticed is 25% [6]. This limits the
theoretical probability of a cheater to win to 75% since in
any coin tossing the probability to win is 50% anyway.
Spekkens and Rudolph [7] proofed that no similar protocol, i.e., strong coin-tossing protocols based on bit commitment where Alice supplies the state, can improve the
security and, in particular, using qubits instead of qutrits
will always make the protocol more insecure. On the other
hand the effect of noise in any protocol reduces the security
[11]. For example a noisy qutrit protocol can be less secure
than a perfect qubit protocol. We will show below that our
experiment was robust enough to noise and was more
secure than any similar qubit protocol. It is yet unclear if
new protocols based on completely different schemes
could perform better, either with qunits or with qubits.
This raises the interesting question of which problems
can be more efficiently solved with higher dimensional
states [12].
In our proof of principle experiment (Fig. 2), Alice
possesses a source of orbital angular momentum entangled
photons [13,14]. She keeps one photon of each pair and
sends the other one to Bob. By projecting her photon onto a
certain state, she nonlocally projects Bob’s photon onto
any state of the states shown in Fig. 1. The detection of the
photon by Alice is the signal which confirms that a suitable
photon carrying an orbital angular momentum qutrit has
been sent to Bob [15]. Alice sends the electronic triggering
signal to Bob. Once Bob receives the signal, he sends his
bet to Alice. Now she tells Bob which was the state. Then
B11
Bob
B23 B22
Bob measures the state of the photon and verifies the
honesty of Alice. A final coincidence measurement between the electronic signals from Alice and Bob is needed
to check if all the steps were performed correctly.
An argon-ion laser pumps a 1.5-mm-thick -bariumborate crystal cut for Type I phase matching. The crystal
emits down-converted pairs of identically polarized photons ( 702 nm) at an angle of 4 off the pump direction. These photons are entangled in the orbital angular
momentum. We use the substate ’ 0:7j0A 0B i 0:5j1A 1B i 0:5j2A 2B i, where j0A i and j0B i correspond to
Gaussian beams and j1A i and j2B i (j2A i and j1B i) are
Laguerre Gaussian beams with azimuthal index m 1
(m 1) [16]. With a series of beam splitters, whose
reflectances were chosen so that the photons were equally
distributed among the final paths, both parties direct their
photons probabilistically to holograms and single mode
fibers, each projecting the photon onto a certain state [17].
Bob’s photons were directed randomly to a projection
onto one of his six possible states. The detections were
electronically discriminated with the information provided
by Alice by a coincidence measurement. We programmed
the logic to only consider those photons detected by Bob
which are exactly timed with Alice’s electronic signal and
to disregard the photons on Bob’s side going to the wrong
basis.
Alice and Bob decided to try their coin-tossing protocol
with a row of throws. In this experiment they obtained 50%
heads (1) and 44% tails (0). As Bob’s guesses were random, he won in half of the throws. The overall failures in
the protocol around 6% of the throws are mainly due to
slight misalignments. In Fig. 3(a) we present the typical
experimental probabilities. In Fig. 4(a), we show a set of
1
B21
B12
B13
Pump beam
Set 1
BBO
(a)
(b)
|0〉+|1〉 |2〉 |0〉−|1〉
|0〉+|2〉 |1〉 |0〉−|2〉
Set 2
A21
A11
Alice
week ending
4 FEBRUARY 2005
0
A22
A12
FIG. 2 (color online). Diagram of the setup. Alice possesses a
source of entangled photons. Using beam splitters, she projects
probabilistically one of the photons onto one of the four possible
states shown in the table in Fig. 1. This state is transferred
nonlocally to the other photon, which is on its way to Bob. Bob’s
photon is projected randomly onto one of the six possible
elements of the two bases. Photons going to a wrong basis are
not considered.
FIG. 3 (color online). Statistics of Bob’s measurements. Red
(gray) bars correspond to failures of the protocol. Black (heads)
and white (tails) bars correspond to proper throws and indicate
the result ofpthe
tossing. In (a) Alice is honest. She sends the state
j0i j1i= 2 (Heads). The errors in this case are due to
misalignments of the setup and are intrinsic to it. In (b) Alice
is cheating. She always sends a mixture of two states. After Bob
makes his bet, she decides which state she must
ptell
him. In this
case she claims to have sent state j0i j2i= 2.
040501-2
PRL 94, 040501 (2005)
PHYSICAL REVIEW LETTERS
FIG. 4 (color online). Two different ordered rows of throws.
Upper left corner: first throw, lower right corner: last throw. The
color of a square represents the result of the throw, as Alice
communicates it to Bob, black: head, white: tail and red (gray):
Failure. Left image, Bob and Alice are honest: Heads 50%, tails
44%, failures 6%. The difference between heads and tails is due
to different efficiencies of the detectors and the failures are due
to imperfections of the setup. Right image, Bob honest and Alice
cheats: Heads 26%, tails 28%, failures 46%. One can clearly see
how the failures increase due to the fact that Alice is cheating.
the actual throws. Every square of the image represents a
throw of the coin.
The level of security of the protocol is given by the noise
of our experiment [7,11]. The security against Alice cheating depends on the trace distance (D) and the security
against Bob cheating depends on the fidelity (F) between
the density matrices sending a ‘‘1’’ and sending a ‘‘0’’. In
our kind of protocols, using qubits limits the possible states
to D F2 > 1 [12]. Values of D and F, violating this
inequality mean that we are accessing a security not allowed by qubits. If our experiment were noiseless we
would obtain D 0:5 and F 0:5 which is the best
security achievable up to now. By modeling the 6% noise
found in our experiment as completely incoherent we
obtain D F2 0:91 which is still better than the security
that could be achieved with any similar protocol using
qubits, even a noiseless one. One fact which helped to
bound the security was the use of a fair protocol, where
Alice and Bob have the same chances of cheating.
We further experimentally explored the security of our
implementation. For us it was a harder problem to devise a
cheating procedure than to prepare the honest protocol.
The best way we could find for Alice to cheat was the
following one. Alice always sends
p a random symmetric
mixture
of
the
state
j0i
j1i=
2 and the state j0i p
j2i= 2, which is a random mixture of heads or tails [18].
When Bob makes his bet, Alice always tells him that he
lost, and then, Bob has to measure in the corresponding
basis. For example, if Bob says that it was tails,pAlice’s
answer is that the state was heads (j0i j1i= 2), and
Bob measures in this basis. It is an easy task to check that
Alice will win in 62.5% of the throws only, which is below
the theoretical maximum of 75% [7,6]. This strategy resembles a biased coin which can be flipped even after Bob
made his choice.
week ending
4 FEBRUARY 2005
In order to force Alice to cheat, we changed states A11
and A22 to be identical to states A21 and A12, respectively. Alice does not need to keep a record of which state
is being sent. In this way she sends a probabilistic mixture
of the two states. Her strategy is to tell Bob that the state
sent was exactly the opposite of Bob’s bet.
In practice it is even harder for Alice to win, because she
cannot turn off the statistical errors which also happen in
the honest protocol. In our case the number of failures,
when Alice cheats in this way, was 46% of the throws. The
difference with the expected failures is mainly due to the
fact that Alice is not sending a perfect mixture of the two
states. Figure 3(b) shows Bob’s results for one of the two
states Alice claimed she was sending. Also, we present the
actual row of throws in Fig. 4(b). By comparing the results
presented in images (a) and (b) it was very easy for Bob to
discover that in (b) the protocol was not followed honestly.
Also, it was a little bit suspicious to him that in all the
proper throws of Fig. 4(b), Alice won.
At this point, let us turn back to Fig. 3(b). We note that
the state in which most of the failures go is precisely the
one outside the plane defined by the elements of Alice’s
set. Evidently in this case, the use of a three-dimensional
space is necessary in order that Bob can detect Alice
cheating.
We now discuss a few details of our implementation. In a
proper protocol, the detection of the photon by Bob should
be delayed until after he sent his bet to Alice. In our setup,
it was difficult to prepare such a delay and so we simulated
it by software. Future implementations should include an
optical delay.
Another difference with respect to an ideal implementation is that both Alice and Bob could not deterministically
project their photon onto a given state. Although this is not
a problem for an honest Alice, who chooses at random
which state to send among the possible four, it might
present a security hazard when one of the parties cannot
be trusted. A closer look shows that this is not the case.
Photons going to the wrong basis or photons simply not
detected are considered as failures in our scheme thus they
cannot increase the odds of winning by a dishonest player.
A possible problem of this implementation would be if
too many photons are lost in a game were only one coin is
played. Then the players cannot reach any conclusion even
if they both play fairly because the likelihood that a failure
comes from cheating would be low. This problem can be
solved using better detectors, fast optical switches and
mode sorters [19] to avoid the loss of photons. This will
also increase the signal to noise ratio, improving the security. A better method would be a protocol where the two
parties throw a large row of coins [20]. As in our case, Bob
will project randomly the incoming photon onto different
bases and store the result, even if the photon went to a
wrong bases. Then Bob can use a tomographic estimation
to check the states Alice announced. Both Bob and Alice
040501-3
PRL 94, 040501 (2005)
PHYSICAL REVIEW LETTERS
can also count the photons lost during the communication
and check if their number corresponds to the known experimental loses.
In conclusion, we have experimentally demonstrated a
‘‘quantum coin-tossing’’ protocol. To our knowledge, this
is the first two-party communication protocol which is
solved using the laws of quantum physics to encode the
communication. Contrary to the usual ‘‘key distribution’’
protocols, here the information shared by Alice and Bob is
directly exchanged through the quantum states. Also, this
protocol is the first one implemented where the use of more
than two dimensions presents a clear advantage. Using our
setup we were able to share a few tens of thousands of coin
throws in a few seconds between two parties. We also
allowed one party to try to cheat, which was easily detected
through a significant increase of failures. We hope that this
work triggers systematic investigations of the possibilities
open to dishonest parties. We showed that, although the
application of such a protocol in a single coin throw
experiment to settle the ‘‘who keeps the dog problem’’ is
of a confined interest, in a more elaborated application
where many random bits are needed it would be easy to
detect a cheater. This kind of system could include the case
were Alice is the dealer of coins to many different Bob’s.
All the players should be able to see what the previous
results were. Our test experiment was confined to the
dimensions of an optical table. In order to send the information over long distances one should use more elaborated
systems using, e.g., adaptative optics or specially designed
fibers.
This work was supported by the Austrian Sciences
Foundation (F.W.F) and the European Commission
through the Marie-Curie program and the RAMBO-Q
project of the IST program. Discussions with M.
Aspelmeyer and K. Resch are gratefully appreciated. We
are also indebted to Terry Rudolph for commenting on
earlier versions of the manuscript.
*Present address: ICFO, Barcelona, Spain
†
Present address: Atomic Physics Division, NIST, USA
[1] M. Blum, in Coin Flipping by Phone (CRYPTO Report
No. 1981, p. 11, 1981).
week ending
4 FEBRUARY 2005
[2] For a review on cryptographic protocols and their relation
to quantum mechanics, see D. Gottesman and J.-K. Lo,
Phys. Today 53, 22 (2000).
[3] H.-K. Lo, and H. F. Chau, Phys. Rev. Lett. 78, 3410
(1997); D. Mayers, ibid. 78, 3414 (1997).
[4] R. Clifton, J. Bub, and H. Halvorson, Found. Phys. 33,
1561 (2001).
[5] For the sake of simplicity we explain a weak coin tossing
(WCT), but we actually implemented strong coin tossing
(SCT). In SCT, Alice locks in the box a bit b. After
receiving the box, Bob sends to Alice a bit b0 . The toss
of the coin results from the operation b b0 . A WCT can
be produced trivially from a SCT and as shown, a SCT can
be implemented from bit commitment. For definitions and
properties of WCT and SCT, see Ref. [7]. For a review on
quantum bit commitment see J. Bub, Found. Phys. 31, 735
(2001).
[6] A. Ambainis, in Proceedings of 33rd Annual Symposium
on Theory of Computing, 2001 (ACM, New York, 2001),
p. 134.
[7] R. W. Spekkens and T. Rudolph, Phys. Rev. A 65, 012310
(2001); Phys. Rev. Lett. 89, 227901 ( 2002).
[8] C. H. Bennett and G. Brassard, Proceedings of IEEE
International Conference on Computers, Systems, and
Signal Processing (IEEE, Bangalore, India, 1984), p. 175.
[9] H.-K. Lo and H. F. Chau, Physica D (Amsterdam) 120,
177 (1998).
[10] D. Aharonov, A. Ta-Shma, U. Vazirani, and A. Yao, in
Proceedings of the 32nd Annual Symposium on Theory of
Computing 2000 (Association for Computing Machinery,
New York, 2000), p. 705.
[11] N. K. Langford et al., Phys. Rev. Lett. 93, 053601 (2004).
[12] A. D. Greentree et al., Phys. Rev. Lett. 92, 097901 (2004).
[13] A. Mair et al., Nature (London) 412, 313 (2001).
[14] G. Molina-Terriza, J. P. Torres, and L. Torner, Phys. Rev.
Lett. 88, 013601 (2002).
[15] G. Molina-Terriza et al., Phys. Rev. Lett. 92, 167903
(2004).
[16] A. E. Siegman, Lasers, (University Science, Sausalito,
1986).
[17] A. Vaziri, G. Weihs, and A. Zeilinger, J. Opt. B 4, S47
(2002).
[18] A better cheating strategy for Alice was sent to us by T.
Rudolph, after the submission of theppaper.
Alice should
prepare the state 2j0i j1ip j2i= 6 and tell
that
pBob
she sends either j0i j1i= 2 or j0i j2i= 2.
[19] J. Leach, et al., Phys. Rev. Lett. 88, 257901 (2002).
[20] J. Barrett et al., Phys. Rev. A 69, 022322 (2004).
040501-4