Weak coin flipping is the cryptographic task where Alice and Bob remotely flip a coin but want opposite outcomes. This work studies this task in the device-independent regime where Alice and Bob neither trust each other, nor their quantum devices. The best protocol was devised over a decade ago by Silman, Chailloux, Aharon, Kerenidis, Pironio, and Massar with bias
ε≈0.33664, where the bias is a commonly adopted security measure for coin flipping protocols. This work presents two techniques to lower the bias of such protocols, namely self-testing and abort-phobic compositions. We apply these techniques to the SCAKPM '11 protocol above and, assuming a continuity conjecture, lower the bias to
ε≈0.29104. We believe that these techniques could be useful in the design of device-independent protocols for a variety of other tasks. Independently of weak coin flipping, en route to our results, we show how one can test
n−1 out of
n devices, and estimate the performance of the remaining device, for later use in the protocol. The proof uses linear programming and, due to its generality, may find applications elsewhere.
This note presents a quantum protocol that demonstrates that weak coin flipping with bias ≈ 0.239, less than 1/4, is possible. A bias of 1/4 was the smallest known, and followed from the strong coin flipping protocol of Ambainis [2]. Protocols with yet smaller bias ≈ 0.207 have independently been discovered [4, 10]. We also present an alternative strong coin flipping protocol with bias 1/4 with analysis simpler than that of [2]. 1 Quantum weak coin flipping Often in applications based on this primitive, coin-flipping is used to choose one of two competing parties as the “winner”. In the classic example from [5], Alice and Bob are getting a divorce, and would like to decide who gets the car. They decide to toss a coin for that purpose, but don’t trust each other. In such a scenario, they could instead play any fair game to decide the issue. Motivated by this, we consider the following weaker version of coin-flipping. A weak coin flipping protocol with bias ǫ, is a two-party communication game in the style of [11], in which the players start with no inputs, and compute a value cA,cB ∈ {0,1} respectively or declare that the other player is cheating. The protocol is deemed successful if Alice and Bob agree on the outcome, i.e. cA = cB.
In the distrustful quantum cryptography model the parties have conflicting interests and do not trust one another. Nevertheless, they trust the quantum devices in their labs. The aim of the device-independent approach to cryptography is to do away with the latter assumption, and, consequently, significantly increase security. It is an open question whether the scope of this approach also extends to protocols in the distrustful cryptography model, thereby rendering them "fully" distrustful. In this Letter, we show that for bit commitment-one of the most basic primitives within the model-the answer is positive. We present a device-independent (imperfect) bit-commitment protocol, where Alice's and Bob's cheating probabilities are ≃0.854 and 3/4, which we then use to construct a device-independent coin flipping protocol with bias ≲0.336.