Multiparty quantum coin flipping

1
Multiparty quantum coin flipping

• Andris Ambainis
• University of Waterloo

2
Quantum cryptography

• Unconditional secure key distribution.
• Unconditional security for other tasks?

3
Setting

• QKD two honest parties, connected by insecure
  channel. Protection from eavesdropping.
• Two (or more) parties, some of them might be
  dishonest. Honest parties need to be protected
  from dishonest ones.

4
Bit commitment

• Alice has a bit a. She wants to commit it to Bob
  so that
• Bob does not learn a,
• Alice cannot change it.

5
Coin flipping

• Alice and Bob want to flip a coin so that neither
  of them controls the outcome.
• If both honest, 0 (1) with probability 1/2.
• If one honest, 0 (1) with probability at most
  1/2?.

6
Classical cryptography

• Bit commitment, coin flipping, oblivious transfer
  are possible with one-way functions.
• Impossible against cheating parties with
  unlimited computing power.

7
Classical coin flipping

• k messsages
• If Alice, Bob honest, they agree on result after
  k rounds.

8
Classical coin flipping

• Vertices on level i transcripts of first i
  messages.
• Edges from level i-1 to level i messages in the
  ith round.

9
Classical coin flipping

• A Alice wins, B- Bob wins.

A

• Color levels k, k-1, , 1, 0.
• At each position, one party can win with
  probability 1.

A
B
A
10
Classical coin flipping

• Theorem In any information-theoretic classical
  protocol, one of the parties can force one
  outcome with probability 1.
• With computational assumptions, good protocols
  possible.

11
Classical coin flipping
a?0, 1
b?0, 1
Commit (a)
b
Reveal (a)
Result (ab) mod 2.
12
Quantum coin flipping

• Theorem There is a quantum protocol in which a
  dishonest party cannot force the outcome to 0 (1)
  with probability gt¾.

13
Classical coin flipping
a?0, 1
b?0, 1
Commit (a)
b
Reveal (a)
Result (ab) mod 2.
14
Impossibility theorem

• Theorem Mayers, 1996. Perfect quantum bit
  commitment is impossible.
• If Bobs state contains no information about
  Alices bit, Alice can change commitment
  perfectly.

15
Imperfect commitment

• Alice commits b by sending quantum state ?b.
• Given ?b, Bob can guess b with probability at
  most ¾.
• Alice can change the commitment with probability
  at most ¾.

16
Quantum coin flipping

• Theorem There is a quantum protocol in which a
  dishonest party cannot force the outcome to 0 (1)
  with probability gt¾.
• Theorem Kitaev, 2002 In any protocol, one party
  can force outcome 0 (1) with probability at least
  1/?2.

17
Weak coin flipping

• Outcome 0 Alice wins
• Outcome 1 Bob wins
• No cheating party can win with probability more
  than p.
• No restrictions on cheating parties trying to
  lose.

18
Weak coin flipping

• A, Rudolph, Spekkens, 2002 Protocol in which
  cheater can win with probability ? 1/?2.
• Mochon, 2004 Probability ? 0.692.
• Mochon, 2005 Probability ? 2/3.
• Perfect protocols impossible, ½1/2n may be
  possible.

19
Multiparty coin flipping

• k parties, k-1 of them dishonest.
• Theorem A, Buhrman, Dodis, Rohrig
• There is a protocol in which k-1 cheating parties
  cannot bias the coin with probability ?1-c/k
• In any protocol, k-1 cheating parties can bias
  the coin with probability ?1-c/k

20
K-party protocol

• Divide k parties into pairs.

1
2
3
4
21
K-party protocol

• ?log k? rounds
• Probability that the honest party reaches final
  round

4
1
1
2
3
4
22
K-party protocol

• Probability that k-1 cheaters fail

4
1
1
2
3
4
23
Cheat-sensitivity

• Three outcomes
• Alice wins
• Alice loses
• Alice catches Bob cheating
• Being caught cheating is more costly than losing
  coin flip

24
Coin flipping with penalties

• Winning 1.
• Losing -1.
• Being caught cheating -L.
• If both parties honest, each wins/loses with
  probability ½.
• Lemma If one party honest, the expected win by
  other party is O(1/?L).

25
K-party protocol

• Player 1 honest, all others dishonest.
• Round 1
• Player 1 loses ? cheaters win
• Player 1 wins ? cheaters can win in next rounds
  (prob. p)
• Player 2 caught ? cheaters lose

1
1
2
26
K-party protocol

• Winning probability for cheaters
• Player 1 loses 1
• Player 1 wins p
• Player 2 caught 0
• Coin flipping with penalty

1
1
2
27
K-party protocol

• Quantum protocol for k/2 parties, cheaters win
  with probability at most p.

1
1
2
28
Result

• Theorem A, Buhrman, Dodis, Rohrig k-1 cheating
  parties cannot bias the coin with probability
  ?1-c/k.

29
Lower bound

• In any quantum protocol, k-1 cheaters can always
  achieve outcome 0 with probability
• Kitaev, 2002 In a 2-party CF protocol, one
  party can achieve outcome 0 with probability 1/?2.

30
Proof

• Describe the optimal strategies for Alice, Bob by
  semidefinite programs
• Combine the dual programs of Alice and Bob

31
Proof

• The optimal strategy for Bob
• maximize Tr((?A,1?1M)?A,N) subject to
• trM(?A, 0)0??0A
• trM(?A, j)trM(UA,j ?A, j-1 UA,j)

32
Proof

• (Probability of dishonest Alice forcing 1)
  (Probability of dishonest Bob forcing 1) ?
  (Probability of honest Alice, Bob agreeing on
  outcome 1)1/2.
• Either Alice or Bob can achieve 1 with
  probability 1/?2.
• k parties there are k-1 parties which can
  convince kth party with probability

33
Weak coin flipping

• Alice needs outcome 0, Bob needs outcome 1.
• (Probability of dishonest Alice forcing 0)
  (Probability of dishonest Bob forcing 1) ?
  (Probability of honest Alice getting 0 and honest
  Bob getting 1)

34
Coin flipping summary

• 2-party 1/?2 ? p ? 3/4.
• k-party 1-c/k ? p ? 1-c/k.
• Weak 2-party ½ lt p ? 2/3.

35
Oblivious transfer

• Alice has two bits x0, x1. Bob wants to learn xb
  so that
• Alice does not learn b.
• Alice is guaranteed that Bob gets only one bit.
• Theorem Lo, 1996 Perfect quantum OT is
  impossible.

36
Imperfect quantum OT

• Probability of receiver guessing both x0 and x1
  (ideal ½).
• Probability of sender guessing i (ideal ½).

• Probability of receiver getting correct xi (ideal
  1).

37
Imperfect quantum OT
?
?
38
Open problems

• Weak coin flipping, imperfect OT.
• Robustness against dishonest party claiming that
  someone else is cheating.
• Other tasks?
• Composability?