On bit-commitment based quantum coin flipping

In this paper, we focus on a special framework for quantum coin flipping protocols, bit-commitment based protocols, within which almost all known protocols fit. We show a lower bound of 1/16 for the bias in any such protocol. We also analyse a sequence of multi-round protocol that tries to overcome the drawbacks of the previously proposed protocols, in order to lower the bias. We show an intricate cheating strategy for this sequence, which leads to a bias of 1/4. This indicates that a bias of 1/4 might be optimal in such protocols, and also demonstrates that a cleverer proof technique may be required to show this optimality. 1 Quantum coin flipping Coin flipping is the communication problem in which two distrustful parties wish to agree on a common random bit, by “talking over the phone” [5]. When the two parties follow a protocol honestly, the bit they agree on is required to be 0 or 1 with equal probability. Ideally, they would also like that if any (dishonest) party deviates from the protocol, they do not agree on any particular outcome with probability more than 1/2. It is known that ideal coin flipping is impossible, in both, the classical and the quantum setting [10, 11]. In fact, in any classical protocol, one of the two parties can force the outcome of the protocol to a value of her choice with probability 1. In [1], Aharonov, Ta-Shma, Vazirani, and Yao showed that it is possible to design a quantum coin flipping protocol in which no player can force the outcome of the protocol with probability more than a constant 1/2 + ǫ, with bias a constant ǫ < 1/2. In other words, any cheating player in such protocols is detected with constant probability. Later, Ambainis [2] gave an improved protocol with bias at most 1/4. Formally, a quantum coin flipping protocol with bias ǫ is a two-party communication game in the style of [15], in which the players start with no inputs, and compute values cA, cB ∈ {0, 1} respectively (or declare that the other player is cheating). The protocol satisfies the following additional properties: 1. If both players are honest (i.e., follow the protocol), then they agree on the outcome of the protocol: cA = cB , and the outcome is 0 or 1 with equal probability: Pr(cA = cB = b) = 1/2, for b ∈ {0, 1}. Computer Science Department, and Institute for Quantum Information, California Institute of Technology, Mail Code 25680, Pasadena, CA 91125, USA. Email: [email protected]. Supported by Charles Lee Powell Foundation, and NSF grants CCR 0049092 and EIA 0086038. Part of this work was done while this author was at DIMACS Center, Rutgers University, and AT&T Labs, and was supported by NSF grants STC 91-19999, CCR 99-06105 and EIA 00-80234. AT&T Labs–Research, 180 Park Ave, Florham Park, NJ 07932, USA. Email: [email protected].