Experimental quantum tossing of a single coin
Identifieur interne : 001372 ( Istex/Corpus ); précédent : 001371; suivant : 001373Experimental quantum tossing of a single coin
Auteurs : A T Nguyen ; J. Frison ; K. Phan Huy ; S. MassarSource :
- New Journal of Physics [ 1367-2630 ] ; 2008.
Abstract
The cryptographic protocol of coin tossing consists of two parties, Alice and Bob, who do not trust each other, but want to generate a random bit. If the parties use a classical communication channel and have unlimited computational resources, one of them can always cheat perfectly. If the parties use a quantum communication channel, there exist protocols such that neither party can cheat perfectly, although they may be able to significantly bias the coin. Here, we analyze in detail how the performance of a quantum coin tossing experiment should be compared to classical protocols, taking into account the inevitable experimental imperfections. We then report an all-optical fiber experiment in which a single coin is tossed whose randomness is higher than achievable by any classical protocol and present some easily realizable cheating strategies by Alice and Bob.
Url:
DOI: 10.1088/1367-2630/10/8/083037
Links to Exploration step
ISTEX:81DDD72A57BB19822DCAE26E04989E33052E2409Le document en format XML
<record><TEI wicri:istexFullTextTei="biblStruct"><teiHeader><fileDesc><titleStmt><title xml:lang="en">Experimental quantum tossing of a single coin</title><author><name sortKey="Nguyen, A T" sort="Nguyen, A T" uniqKey="Nguyen A" first="A T" last="Nguyen">A T Nguyen</name><affiliation><mods:affiliation>Service OPERA photonique, CP 194/5, Universit Libre de Bruxelles (ULB), Avenue F D Roosevelt 50, B-1050 Bruxelles, Belgium</mods:affiliation></affiliation><affiliation><mods:affiliation>Authors to whom any correspondence should be addressed.</mods:affiliation></affiliation><affiliation><mods:affiliation>E-mail: annguyen@ulb.ac.be</mods:affiliation></affiliation></author><author><name sortKey="Frison, J" sort="Frison, J" uniqKey="Frison J" first="J" last="Frison">J. Frison</name><affiliation><mods:affiliation>Laboratoire d'Information Quantique, CP 225, Universit Libre de Bruxelles (ULB), Boulevard du Triomphe, B-1050 Bruxelles, Belgium</mods:affiliation></affiliation></author><author><name sortKey="Phan Huy, K" sort="Phan Huy, K" uniqKey="Phan Huy K" first="K" last="Phan Huy">K. Phan Huy</name><affiliation><mods:affiliation>Dpartement d'Optique P M Duffieux, Institut FEMTO-ST, Centre National de la Recherche Scientifique UMR 6174, Universit de Franche-Comt, 25030 Besanon, France</mods:affiliation></affiliation></author><author><name sortKey="Massar, S" sort="Massar, S" uniqKey="Massar S" first="S" last="Massar">S. Massar</name><affiliation><mods:affiliation>Laboratoire d'Information Quantique, CP 225, Universit Libre de Bruxelles (ULB), Boulevard du Triomphe, B-1050 Bruxelles, Belgium</mods:affiliation></affiliation><affiliation><mods:affiliation>Authors to whom any correspondence should be addressed.</mods:affiliation></affiliation><affiliation><mods:affiliation>E-mail: smassar@ulb.ac.be</mods:affiliation></affiliation></author></titleStmt><publicationStmt><idno type="wicri:source">ISTEX</idno><idno type="RBID">ISTEX:81DDD72A57BB19822DCAE26E04989E33052E2409</idno><date when="2008" year="2008">2008</date><idno type="doi">10.1088/1367-2630/10/8/083037</idno><idno type="url">https://api.istex.fr/document/81DDD72A57BB19822DCAE26E04989E33052E2409/fulltext/pdf</idno><idno type="wicri:Area/Istex/Corpus">001372</idno></publicationStmt><sourceDesc><biblStruct><analytic><title level="a" type="main" xml:lang="en">Experimental quantum tossing of a single coin</title><author><name sortKey="Nguyen, A T" sort="Nguyen, A T" uniqKey="Nguyen A" first="A T" last="Nguyen">A T Nguyen</name><affiliation><mods:affiliation>Service OPERA photonique, CP 194/5, Universit Libre de Bruxelles (ULB), Avenue F D Roosevelt 50, B-1050 Bruxelles, Belgium</mods:affiliation></affiliation><affiliation><mods:affiliation>Authors to whom any correspondence should be addressed.</mods:affiliation></affiliation><affiliation><mods:affiliation>E-mail: annguyen@ulb.ac.be</mods:affiliation></affiliation></author><author><name sortKey="Frison, J" sort="Frison, J" uniqKey="Frison J" first="J" last="Frison">J. Frison</name><affiliation><mods:affiliation>Laboratoire d'Information Quantique, CP 225, Universit Libre de Bruxelles (ULB), Boulevard du Triomphe, B-1050 Bruxelles, Belgium</mods:affiliation></affiliation></author><author><name sortKey="Phan Huy, K" sort="Phan Huy, K" uniqKey="Phan Huy K" first="K" last="Phan Huy">K. Phan Huy</name><affiliation><mods:affiliation>Dpartement d'Optique P M Duffieux, Institut FEMTO-ST, Centre National de la Recherche Scientifique UMR 6174, Universit de Franche-Comt, 25030 Besanon, France</mods:affiliation></affiliation></author><author><name sortKey="Massar, S" sort="Massar, S" uniqKey="Massar S" first="S" last="Massar">S. Massar</name><affiliation><mods:affiliation>Laboratoire d'Information Quantique, CP 225, Universit Libre de Bruxelles (ULB), Boulevard du Triomphe, B-1050 Bruxelles, Belgium</mods:affiliation></affiliation><affiliation><mods:affiliation>Authors to whom any correspondence should be addressed.</mods:affiliation></affiliation><affiliation><mods:affiliation>E-mail: smassar@ulb.ac.be</mods:affiliation></affiliation></author></analytic><monogr></monogr><series><title level="j">New Journal of Physics</title><title level="j" type="abbrev">New J. Phys.</title><idno type="ISSN">1367-2630</idno><idno type="eISSN">1367-2630</idno><imprint><publisher>Institute of Physics Publishing</publisher><date type="published" when="2008">2008</date><biblScope unit="volume">10</biblScope><biblScope unit="issue">8</biblScope><biblScope unit="page" from="1">1</biblScope><biblScope unit="page" to="13">13</biblScope></imprint><idno type="ISSN">1367-2630</idno></series><idno type="istex">81DDD72A57BB19822DCAE26E04989E33052E2409</idno><idno type="DOI">10.1088/1367-2630/10/8/083037</idno><idno type="articleID">279271</idno><idno type="articleNumber">083037</idno></biblStruct></sourceDesc><seriesStmt><idno type="ISSN">1367-2630</idno></seriesStmt></fileDesc><profileDesc><textClass></textClass><langUsage><language ident="en">en</language></langUsage></profileDesc></teiHeader><front><div type="abstract">The cryptographic protocol of coin tossing consists of two parties, Alice and Bob, who do not trust each other, but want to generate a random bit. If the parties use a classical communication channel and have unlimited computational resources, one of them can always cheat perfectly. If the parties use a quantum communication channel, there exist protocols such that neither party can cheat perfectly, although they may be able to significantly bias the coin. Here, we analyze in detail how the performance of a quantum coin tossing experiment should be compared to classical protocols, taking into account the inevitable experimental imperfections. We then report an all-optical fiber experiment in which a single coin is tossed whose randomness is higher than achievable by any classical protocol and present some easily realizable cheating strategies by Alice and Bob.</div></front></TEI><istex><corpusName>iop</corpusName><author><json:item><name>A T Nguyen</name><affiliations><json:string>Service OPERA photonique, CP 194/5, Universit Libre de Bruxelles (ULB), Avenue F D Roosevelt 50, B-1050 Bruxelles, Belgium</json:string><json:string>Authors to whom any correspondence should be addressed.</json:string><json:string>E-mail: annguyen@ulb.ac.be</json:string></affiliations></json:item><json:item><name>J Frison</name><affiliations><json:string>Laboratoire d'Information Quantique, CP 225, Universit Libre de Bruxelles (ULB), Boulevard du Triomphe, B-1050 Bruxelles, Belgium</json:string></affiliations></json:item><json:item><name>K Phan Huy</name><affiliations><json:string>Dpartement d'Optique P M Duffieux, Institut FEMTO-ST, Centre National de la Recherche Scientifique UMR 6174, Universit de Franche-Comt, 25030 Besanon, France</json:string></affiliations></json:item><json:item><name>S Massar</name><affiliations><json:string>Laboratoire d'Information Quantique, CP 225, Universit Libre de Bruxelles (ULB), Boulevard du Triomphe, B-1050 Bruxelles, Belgium</json:string><json:string>Authors to whom any correspondence should be addressed.</json:string><json:string>E-mail: smassar@ulb.ac.be</json:string></affiliations></json:item></author><language><json:string>eng</json:string></language><originalGenre><json:string>paper</json:string></originalGenre><abstract>The cryptographic protocol of coin tossing consists of two parties, Alice and Bob, who do not trust each other, but want to generate a random bit. If the parties use a classical communication channel and have unlimited computational resources, one of them can always cheat perfectly. If the parties use a quantum communication channel, there exist protocols such that neither party can cheat perfectly, although they may be able to significantly bias the coin. Here, we analyze in detail how the performance of a quantum coin tossing experiment should be compared to classical protocols, taking into account the inevitable experimental imperfections. We then report an all-optical fiber experiment in which a single coin is tossed whose randomness is higher than achievable by any classical protocol and present some easily realizable cheating strategies by Alice and Bob.</abstract><qualityIndicators><score>8.132</score><pdfVersion>1.6</pdfVersion><pdfPageSize>595.276 x 841.89 pts (A4)</pdfPageSize><refBibsNative>true</refBibsNative><keywordCount>0</keywordCount><abstractCharCount>872</abstractCharCount><pdfWordCount>5718</pdfWordCount><pdfCharCount>28169</pdfCharCount><pdfPageCount>13</pdfPageCount><abstractWordCount>136</abstractWordCount></qualityIndicators><title>Experimental quantum tossing of a single coin</title><genre><json:string>research-article</json:string></genre><host><volume>10</volume><publisherId><json:string>nj</json:string></publisherId><pages><total>13</total><last>13</last><first>1</first></pages><issn><json:string>1367-2630</json:string></issn><issue>8</issue><genre><json:string>journal</json:string></genre><language><json:string>unknown</json:string></language><eissn><json:string>1367-2630</json:string></eissn><title>New Journal of Physics</title></host><publicationDate>2008</publicationDate><copyrightDate>2008</copyrightDate><doi><json:string>10.1088/1367-2630/10/8/083037</json:string></doi><id>81DDD72A57BB19822DCAE26E04989E33052E2409</id><score>0.23089968</score><fulltext><json:item><original>true</original><mimetype>application/pdf</mimetype><extension>pdf</extension><uri>https://api.istex.fr/document/81DDD72A57BB19822DCAE26E04989E33052E2409/fulltext/pdf</uri></json:item><json:item><original>false</original><mimetype>application/zip</mimetype><extension>zip</extension><uri>https://api.istex.fr/document/81DDD72A57BB19822DCAE26E04989E33052E2409/fulltext/zip</uri></json:item><istex:fulltextTEI uri="https://api.istex.fr/document/81DDD72A57BB19822DCAE26E04989E33052E2409/fulltext/tei"><teiHeader><fileDesc><titleStmt><title level="a" type="main" xml:lang="en">Experimental quantum tossing of a single coin</title></titleStmt><publicationStmt><authority>ISTEX</authority><publisher>Institute of Physics Publishing</publisher><availability><p>IOP Publishing and Deutsche Physikalische Gesellschaft</p></availability><date>2008</date></publicationStmt><sourceDesc><biblStruct type="inbook"><analytic><title level="a" type="main" xml:lang="en">Experimental quantum tossing of a single coin</title><author xml:id="author-1"><persName><forename type="first">A T</forename><surname>Nguyen</surname></persName><email>annguyen@ulb.ac.be</email><affiliation>Service OPERA photonique, CP 194/5, Universit Libre de Bruxelles (ULB), Avenue F D Roosevelt 50, B-1050 Bruxelles, Belgium</affiliation><affiliation>Authors to whom any correspondence should be addressed.</affiliation></author><author xml:id="author-2"><persName><forename type="first">J</forename><surname>Frison</surname></persName><affiliation>Laboratoire d'Information Quantique, CP 225, Universit Libre de Bruxelles (ULB), Boulevard du Triomphe, B-1050 Bruxelles, Belgium</affiliation></author><author xml:id="author-3"><persName><forename type="first">K</forename><surname>Phan Huy</surname></persName><affiliation>Dpartement d'Optique P M Duffieux, Institut FEMTO-ST, Centre National de la Recherche Scientifique UMR 6174, Universit de Franche-Comt, 25030 Besanon, France</affiliation></author><author xml:id="author-4"><persName><forename type="first">S</forename><surname>Massar</surname></persName><email>smassar@ulb.ac.be</email><affiliation>Laboratoire d'Information Quantique, CP 225, Universit Libre de Bruxelles (ULB), Boulevard du Triomphe, B-1050 Bruxelles, Belgium</affiliation><affiliation>Authors to whom any correspondence should be addressed.</affiliation></author></analytic><monogr><title level="j">New Journal of Physics</title><title level="j" type="abbrev">New J. Phys.</title><idno type="pISSN">1367-2630</idno><idno type="eISSN">1367-2630</idno><imprint><publisher>Institute of Physics Publishing</publisher><date type="published" when="2008"></date><biblScope unit="volume">10</biblScope><biblScope unit="issue">8</biblScope><biblScope unit="page" from="1">1</biblScope><biblScope unit="page" to="13">13</biblScope></imprint></monogr><idno type="istex">81DDD72A57BB19822DCAE26E04989E33052E2409</idno><idno type="DOI">10.1088/1367-2630/10/8/083037</idno><idno type="articleID">279271</idno><idno type="articleNumber">083037</idno></biblStruct></sourceDesc></fileDesc><profileDesc><creation><date>2008</date></creation><langUsage><language ident="en">en</language></langUsage><abstract><p>The cryptographic protocol of coin tossing consists of two parties, Alice and Bob, who do not trust each other, but want to generate a random bit. If the parties use a classical communication channel and have unlimited computational resources, one of them can always cheat perfectly. If the parties use a quantum communication channel, there exist protocols such that neither party can cheat perfectly, although they may be able to significantly bias the coin. Here, we analyze in detail how the performance of a quantum coin tossing experiment should be compared to classical protocols, taking into account the inevitable experimental imperfections. We then report an all-optical fiber experiment in which a single coin is tossed whose randomness is higher than achievable by any classical protocol and present some easily realizable cheating strategies by Alice and Bob.</p></abstract></profileDesc><revisionDesc><change when="2008">Published</change></revisionDesc></teiHeader></istex:fulltextTEI><json:item><original>false</original><mimetype>text/plain</mimetype><extension>txt</extension><uri>https://api.istex.fr/document/81DDD72A57BB19822DCAE26E04989E33052E2409/fulltext/txt</uri></json:item></fulltext><metadata><istex:metadataXml wicri:clean="corpus iop not found" wicri:toSee="no header"><istex:xmlDeclaration>version="1.0" encoding="ISO-8859-1"</istex:xmlDeclaration><istex:docType SYSTEM="http://ej.iop.org/dtd/iopv1_5_2.dtd" name="istex:docType"></istex:docType><istex:document><article artid="nj279271"><article-metadata><jnl-data jnlid="nj"><jnl-fullname>New Journal of Physics</jnl-fullname><jnl-abbreviation>New J. Phys.</jnl-abbreviation><jnl-shortname>NJP</jnl-shortname><jnl-issn>1367-2630</jnl-issn><jnl-coden>NJOPFM</jnl-coden><jnl-imprint>Institute of Physics Publishing</jnl-imprint><jnl-web-address>stacks.iop.org/NJP</jnl-web-address></jnl-data><volume-data><year-publication>2008</year-publication><volume-number>10</volume-number></volume-data><issue-data><issue-number>8</issue-number><coverdate>August 2008</coverdate></issue-data><article-data><article-type type="paper" sort="regular"></article-type><type-number type="paper" numbering="article" artnum="083037">083037</type-number><article-number>279271</article-number><first-page>1</first-page><last-page>13</last-page><length>13</length><pii></pii><doi>10.1088/1367-2630/10/8/083037</doi><copyright>IOP Publishing and Deutsche Physikalische Gesellschaft</copyright><ccc>1367-2630/08/083037+13$30.00</ccc><printed></printed></article-data></article-metadata><header><title-group><title>Experimental quantum tossing of a single coin</title><short-title>Experimental quantum tossing of a single coin</short-title><ej-title>Experimental quantum tossing of a single coin</ej-title></title-group><author-group><author address="nj279271ad1" second-address="nj279271aad4" email="nj279271ea1"><first-names>A T</first-names><second-name>Nguyen</second-name></author><author address="nj279271ad2"><first-names>J</first-names><second-name>Frison</second-name></author><author address="nj279271ad3"><first-names>K</first-names><second-name>Phan Huy</second-name></author><author address="nj279271ad2" second-address="nj279271aad4" email="nj279271ea2"><first-names>S</first-names><second-name>Massar</second-name></author><short-author-list>A T Nguyen <italic>et al</italic></short-author-list></author-group><address-group><address id="nj279271ad1" showid="yes">Service OPERA photonique, CP 194/5, <orgname>Université Libre de Bruxelles</orgname> (ULB), Avenue F D Roosevelt 50, B-1050 Bruxelles, <country>Belgium</country></address><address id="nj279271ad2" showid="yes">Laboratoire d'Information Quantique, CP 225, <orgname>Université Libre de Bruxelles</orgname> (ULB), Boulevard du Triomphe, B-1050 Bruxelles, <country>Belgium</country></address><address id="nj279271ad3" showid="yes">Département d'Optique P M Duffieux, Institut FEMTO-ST, Centre National de la Recherche Scientifique UMR 6174, <orgname>Université de Franche-Comté</orgname>, 25030 Besançon, <country>France</country></address><address id="nj279271aad4" alt="yes" showid="yes">Authors to whom any correspondence should be addressed.</address><e-address id="nj279271ea1"><email mailto="annguyen@ulb.ac.be">annguyen@ulb.ac.be</email></e-address><e-address id="nj279271ea2"><email mailto="smassar@ulb.ac.be">smassar@ulb.ac.be</email></e-address></address-group><history received="28 April 2008" online="28 August 2008"></history><abstract-group><abstract><heading>Abstract</heading><p indent="no">The cryptographic protocol of coin tossing consists of two parties, Alice and Bob, who do not trust each other, but want to generate a random bit. If the parties use a classical communication channel and have unlimited computational resources, one of them can always cheat perfectly. If the parties use a quantum communication channel, there exist protocols such that neither party can cheat perfectly, although they may be able to significantly bias the coin. Here, we analyze in detail how the performance of a quantum coin tossing experiment should be compared to classical protocols, taking into account the inevitable experimental imperfections. We then report an all-optical fiber experiment in which a single coin is tossed whose randomness is higher than achievable by any classical protocol and present some easily realizable cheating strategies by Alice and Bob.</p></abstract></abstract-group></header><body refstyle="numeric"><sec-level1 id="nj279271s1" label="1"><heading>Introduction</heading><p indent="no">The cryptographic protocol of coin tossing introduced by Blum [<cite linkend="nj279271bib1">1</cite>] consists of two parties, Alice and Bob, who do not trust each other, but want to generate a random bit. If the parties use a classical communication channel and have unlimited computational resources, one of them can always cheat perfectly. But what if they use a quantum communication channel? Because of its conceptual importance and potential applications, quantum coin tossing was already envisaged by Bennett and Brassard in their seminal paper on quantum cryptography [<cite linkend="nj279271bib2">2</cite>]. Later works showed that perfect quantum coin tossing is impossible [<cite linkend="nj279271bib3">3</cite>]–[<cite linkend="nj279271bib5">5</cite>], but that imperfect protocols exist [<cite linkend="nj279271bib4">4</cite>], [<cite linkend="nj279271bib6">6</cite>]–[<cite linkend="nj279271bib10">10</cite>] that perform better than any classical protocol.</p><p>The motivation for studying quantum coin tossing is that it addresses a fundamental question, namely the power of quantum communication over classical communication. Indeed coin tossing is probably the simplest example of a cryptographic protocol that involves two parties who do not trust each other, but would like to achieve a common task. Perfect coin tossing would be a useful primitive that can be used in applications such as Mental Poker (see e.g. [<cite linkend="nj279271bib11">11</cite>]). The stronger protocol, bit commitment, enables more important tasks such as Zero-knowledge proofs (see e.g. [<cite linkend="nj279271bib12">12</cite>]). The no-go theorems mentioned above show that quantum communication does not allow these applications (except if one adds additional assumptions such as bounding the size of quantum memories [<cite linkend="nj279271bib13">13</cite>]). Quantum communication does however allow parties who do not trust each other to achieve some tasks that are impossible classically, such as imperfect forms of coin tossing, multiparty coin tossing [<cite linkend="nj279271bib14">14</cite>], or weak forms of string commitment [<cite linkend="nj279271bib15">15</cite>, <cite linkend="nj279271bib16">16</cite>].</p><p>Work on quantum coin tossing distinguishes between ‘weak coin tossing’ and ‘strong coin tossing’. In weak coin tossing, Alice and Bob have antagonistic goals: Alice wants the coin to be heads, say, whereas Bob wants the coin to come out tails. Good quantum protocols for weak coin tossing exist, although they seem very difficult to implement [<cite linkend="nj279271bib10">10</cite>]. In strong coin tossing, Alice and Bob both want the coin to be perfectly random. Quantum protocols that perform better at strong coin tossing than any classical protocol exist [<cite linkend="nj279271bib8">8</cite>, <cite linkend="nj279271bib9">9</cite>] and come close to the known upper bound (for the original unpublished proof of the upperbound, see [<cite linkend="nj279271bib5">5</cite>]; published proofs can be found in [<cite linkend="nj279271bib14">14</cite>, <cite linkend="nj279271bib17">17</cite>]).</p><p>Recently, two works [<cite linkend="nj279271bib18">18</cite>, <cite linkend="nj279271bib19">19</cite>] have experimentally studied optical implementations of quantum coin tossing. However, the experiment [<cite linkend="nj279271bib18">18</cite>] suffered from important photon loss, which made it difficult to assess how the experiment worked when tossing a single coin. This was circumvented, as in [<cite linkend="nj279271bib19">19</cite>], by addressing string flipping, i.e. the problem where the parties try to toss a string of coins rather than a single one. These works were, however, carried out without realizing that good classical protocols exist for string flipping, see e.g. [<cite linkend="nj279271bib20">20</cite>] for a presentation of such protocols.</p><p>In the present work, we go back to the conceptually simpler problem of tossing a single coin, and report an experiment in which a single coin is tossed whose randomness is higher than achievable by any classical protocol. We begin by discussing in detail how the results of such a coin tossing experiment should be compared with classical protocols in view of the inevitable imperfections that will occur in any experimental realization. Coin tossing in the presence of noise was already studied in [<cite linkend="nj279271bib21">21</cite>], but with the emphasis on applications to string flipping, whereas here we are concerned with tossing a single coin. We then present the experimental implementation, which follows closely the earlier work of [<cite linkend="nj279271bib19">19</cite>], and present some easily realizable cheating strategies by Alice and Bob.</p></sec-level1><sec-level1 id="nj279271s2" label="2"><heading>Formulation of the problem</heading><p indent="no">A protocol for coin tossing consists in a series of rounds of (classical or quantum) communication at the end of which the parties decide on an outcome. The outcome can be either a decision that the coin has the value <inline-eqn><math-text><italic>c</italic>=0</math-text></inline-eqn> or 1, or it can be that the protocol aborts, in which case we say that <inline-eqn><math-text><italic>c</italic>=⊥</math-text></inline-eqn>. Note that because the rounds of (quantum or classical) communication are sequential, it is logically possible for Alice to choose one output <inline-eqn><math-text><italic>x</italic></math-text></inline-eqn>, and for Bob to choose another output <inline-eqn><math-text><italic>y</italic></math-text></inline-eqn>. For the sake of generality, it is convenient to take this into account and to denote by
<display-eqn textype="equation" notation="LaTeX" number="no"></display-eqn></p><p>We will say that a protocol is <italic>correct</italic>, if, when both parties are honest, at the end of the protocol they agree on the outcome, and that the results <inline-eqn><math-text><italic>c</italic>=0</math-text></inline-eqn> and 1 occur with equal probability: <inline-eqn><math-text><italic>p</italic><sub>00</sub>=<italic>p</italic><sub>11</sub>=(1−<italic>p</italic><sub>⊥⊥</sub>)/2</math-text></inline-eqn>. This formulation takes into account that because of experimental imperfections, the outcome <inline-eqn><math-text><italic>c</italic>=⊥</math-text></inline-eqn> may occur even when both parties are honest.</p><p>The aim of a cheater is to force the outcome of the coin tossing protocol. We denote by
<display-eqn textype="equation" notation="LaTeX" number="no"></display-eqn>where the maximum is taken over all cheating strategies of Alice (Bob). An alternative notation often used in the literature is the bias <inline-eqn><math-text>ε</math-text></inline-eqn>, which is related to our notation by
<display-eqn id="nj279271eqn1" textype="equation" notation="LaTeX" eqnnum="1" lines="multiline"></display-eqn>The bound due to Kitaev [<cite linkend="nj279271bib5">5</cite>, <cite linkend="nj279271bib14">14</cite>, <cite linkend="nj279271bib17">17</cite>] states that for <italic>quantum</italic> coin tossing, either <inline-eqn><math-text>ε<sub><upright>A</upright></sub></math-text></inline-eqn> or <inline-eqn><math-text>ε<sub><upright>B</upright></sub></math-text></inline-eqn> is greater than or equal to <inline-eqn></inline-eqn>. The best known <italic>quantum</italic> protocol for strong coin tossing due to Ambainis has <inline-eqn><math-text>ε<sub><upright>A</upright></sub>=ε<sub><upright>B</upright></sub>=1/4</math-text></inline-eqn>.</p><p>In the appendix, we prove the following (which generalizes a result of [<cite linkend="nj279271bib5">5</cite>] when <inline-eqn><math-text><italic>p</italic><sub>⊥⊥</sub>=0</math-text></inline-eqn>):</p><proclaim id="nj279271pro1" type="lemma" format="num" style="italic"><heading>Lemma 1</heading><p indent="no">For any correct <italic>classical</italic> coin tossing protocol with three outcomes <inline-eqn><math-text>0, 1, ⊥</math-text></inline-eqn> we have:
<display-eqn id="nj279271eqn2" textype="equation" notation="LaTeX" eqnnum="2"></display-eqn><display-eqn id="nj279271eqn3" textype="equation" notation="LaTeX" eqnnum="3"></display-eqn></p></proclaim><p>Note that if <inline-eqn><math-text><italic>p</italic><sub>⊥⊥</sub>=0</math-text></inline-eqn>, these inequalities imply that either <inline-eqn><math-text><italic>p</italic><sub>0*</sub>=1</math-text></inline-eqn> or <inline-eqn><math-text><italic>p</italic><sub>*1</sub>=1</math-text></inline-eqn>, and that either <inline-eqn><math-text><italic>p</italic><sub>1*</sub>=1</math-text></inline-eqn> or <inline-eqn><math-text><italic>p</italic><sub>*0</sub>=1</math-text></inline-eqn>, thereby showing that classical coin tossing is impossible as either Alice or Bob can perfectly force the outcome of the protocol.</p><p>When <inline-eqn><math-text><italic>p</italic><sub>⊥⊥</sub>≠0</math-text></inline-eqn> a cheater can no longer necessarily force the outcome he wants. In the appendix we show that there exist classical protocols that saturate either one of equations (<eqnref linkend="nj279271eqn2">2</eqnref>) or (<eqnref linkend="nj279271eqn3">3</eqnref>), and that there exist classical protocols that come closer to saturating both equations (<eqnref linkend="nj279271eqn2">2</eqnref>) and (<eqnref linkend="nj279271eqn3">3</eqnref>).</p><p>In view of lemma <textref linkend="nj279271pro1">1</textref>, it is natural to quantify the quality of quantum coin tossing experiments by the following merit function:
<display-eqn id="nj279271eqn4" textype="equation" notation="LaTeX" eqnnum="4"></display-eqn>which has the following properties: <ordered-list id="list1" type="arabic" pattern="5"><list-item id="list1-i1" marker="1."><p>Positivity of probabilities implies <inline-eqn></inline-eqn>.</p></list-item><list-item id="list1-i2" marker="2."><p>For any classical protocol we have <inline-eqn></inline-eqn>. Classical protocols achieve <inline-eqn></inline-eqn> if they saturate both inequalities (<eqnref linkend="nj279271eqn2">2</eqnref>) and (<eqnref linkend="nj279271eqn3">3</eqnref>).</p></list-item><list-item id="list1-i3" marker="3."><p>An ideal protocol would have <inline-eqn></inline-eqn>, in which case neither Alice nor Bob can cheat, i.e. <inline-eqn><math-text><italic>p</italic><sub><italic>c</italic>*</sub>=<italic>p</italic><sub>*<italic>c</italic></sub>=0</math-text></inline-eqn>, and the protocol never aborts, i.e. <inline-eqn><math-text><italic>p</italic><sub>⊥⊥</sub>=0</math-text></inline-eqn>.</p></list-item><list-item id="list1-i4" marker="4."><p>The worst protocol would have <inline-eqn></inline-eqn>. This occurs when either Alice or Bob can cheat perfectly, i.e. <inline-eqn><math-text><italic>p</italic><sub><italic>c</italic>*</sub>=1</math-text></inline-eqn> or <inline-eqn><math-text><italic>p</italic><sub>*<italic>c</italic></sub>=1</math-text></inline-eqn> for both <inline-eqn><math-text><italic>c</italic>=0, 1</math-text></inline-eqn>, and when the protocol aborts whenever Alice and Bob are both honest, i.e. <inline-eqn><math-text><italic>p</italic><sub>⊥⊥</sub>=1</math-text></inline-eqn>.</p></list-item></ordered-list></p><p>The interpretation of the merit function is most obvious in the weak coin tossing scheme wherein Alice wins if Bob outputs <inline-eqn><math-text>1</math-text></inline-eqn>, while Bob wins if Alice outputs <inline-eqn><math-text>0</math-text></inline-eqn> because then the term <inline-eqn><math-text>(1−<italic>p</italic><sub>*1</sub>)(1−<italic>p</italic><sub>0*</sub>)</math-text></inline-eqn> is the product of how often a dishonest Alice cannot force a win times how often a dishonest Bob cannot force a win (and similarly for the term <inline-eqn><math-text>(1−<italic>p</italic><sub>*0</sub>)(1−<italic>p</italic><sub>1*</sub>)</math-text></inline-eqn>). The better the protocol, the larger these terms.</p><p>As an illustration let us compute the value of <inline-eqn></inline-eqn> for different protocols. The bound due to Kitaev states with precision, see [<cite linkend="nj279271bib14">14</cite>], that <inline-eqn><math-text><italic>p</italic><sub>*1</sub><italic>p</italic><sub>1*</sub>⩾1/2</math-text></inline-eqn> and <inline-eqn><math-text><italic>p</italic><sub>*0</sub><italic>p</italic><sub>0*</sub>⩾1/2</math-text></inline-eqn>. Inserting this into equation (<eqnref linkend="nj279271eqn4">4</eqnref>) shows that for all quantum protocols, <inline-eqn></inline-eqn>. For Ambainis's protocol [<cite linkend="nj279271bib8">8</cite>] for instance we have <inline-eqn></inline-eqn>.</p></sec-level1><sec-level1 id="nj279271s3" label="3"><heading>Experimental implementation</heading><sec-level2 id="nj279271s3.1" label="3.1"><heading>The protocol</heading><p indent="no">Our implementation of quantum coin tossing uses the following protocol: <ordered-list id="list2" type="arabic" pattern="5"><list-item id="list2-i5" marker="1."><p>Alice chooses <inline-eqn><math-text><italic>a</italic>∈{0, 1}</math-text></inline-eqn> at random. She prepares state <inline-eqn><math-text>ψ<sub><italic>a</italic></sub></math-text></inline-eqn>, where the two possible states are non orthogonal: <inline-eqn><math-text>|⟨ψ<sub>1</sub>|ψ<sub>0</sub>⟩|=<upright>cos</upright> &thetas;>0</math-text></inline-eqn>. She sends <inline-eqn><math-text>ψ<sub><italic>a</italic></sub></math-text></inline-eqn> to Bob.</p><p>The states <inline-eqn><math-text>ψ<sub>0, 1</sub></math-text></inline-eqn> will be taken to be coherent states of light of amplitude <inline-eqn><math-text>α</math-text></inline-eqn> and opposite phase:
<display-eqn id="nj279271eqn5" textype="equation" notation="LaTeX" eqnnum="5"></display-eqn>which implies that
<display-eqn id="nj279271eqn6" textype="equation" notation="LaTeX" eqnnum="6"></display-eqn>(In the notation of [<cite linkend="nj279271bib9">9</cite>], we thus have <inline-eqn><math-text>ρ<sub>0</sub>=|ψ<sub>0</sub>⟩⟨ψ<sub>0</sub>|</math-text></inline-eqn> and <inline-eqn><math-text>ρ<sub>1</sub>=|ψ<sub>1</sub>⟩⟨ψ<sub>1</sub>|</math-text></inline-eqn> both pure, where <inline-eqn><math-text>ρ<sub><italic>a</italic></sub></math-text></inline-eqn> is the reduced density matrix of Bob's state after Alice has finished the ‘commitment phase’. For such protocols where <inline-eqn><math-text>ρ<sub>0</sub></math-text></inline-eqn> and <inline-eqn><math-text>ρ<sub>1</sub></math-text></inline-eqn> are both pure, it is proven, still in [<cite linkend="nj279271bib9">9</cite>], that <inline-eqn><math-text>ε<sub><upright>A</upright></sub><sup>2</sup>+ε<sub><upright>B</upright></sub><sup>2</sup>⩾1/4</math-text></inline-eqn>. Also note that <inline-eqn><math-text>ρ<sub>0</sub>≠ρ<sub>1</sub></math-text></inline-eqn> prevents cheating strategies based on entanglement [<cite linkend="nj279271bib3">3</cite>, <cite linkend="nj279271bib22">22</cite>].</p></list-item><list-item id="list2-i8" marker="2."><p>Bob chooses <inline-eqn><math-text><italic>b</italic>∈{0, 1}</math-text></inline-eqn> at random. He tells the value of <inline-eqn><math-text><italic>b</italic></math-text></inline-eqn> to Alice.</p></list-item><list-item id="list2-i9" marker="3."><p>Alice tells Bob the value of <inline-eqn><math-text><italic>a</italic></math-text></inline-eqn>.</p></list-item><list-item id="list2-i10" marker="4."><p>Bob carries out a measurement which projects onto <inline-eqn><math-text>ψ<sub><italic>a</italic></sub></math-text></inline-eqn> or onto the orthogonal space. If he finds that the state is not equal to <inline-eqn><math-text>ψ<sub><italic>a</italic></sub></math-text></inline-eqn> he aborts, and the outcome of the protocol is <inline-eqn><math-text>⊥</math-text></inline-eqn>. If he finds that the state is equal to <inline-eqn><math-text>ψ<sub><italic>a</italic></sub></math-text></inline-eqn> then the outcome of the protocol is <inline-eqn><math-text><italic>c</italic>=<italic>a</italic>⊕<italic>b</italic></math-text></inline-eqn>.</p><p>Bob's measurement is carried out as follows: using a local oscillator (LO), he displaces the quantum state by <inline-eqn><math-text>+α</math-text></inline-eqn> if <inline-eqn><math-text><italic>a</italic>=1</math-text></inline-eqn> or by <inline-eqn><math-text>−α</math-text></inline-eqn> if <inline-eqn><math-text><italic>a</italic>=0</math-text></inline-eqn>. If Alice is honest this results in the state becoming the vacuum state. To check this Bob then sends the resulting state onto a single photon detector. If the detector clicks then Bob assumes that Alice was cheating and he aborts: the outcome of the protocol is <inline-eqn><math-text>⊥</math-text></inline-eqn>. If the detector does not click, then Bob assumes that Alice is honest. (Note that Bob's measurement is similar in spirit to the method proposed in [<cite linkend="nj279271bib23">23</cite>] for quantum state tomography, but Bob's task is simpler since he only needs to detect if Alice is cheating, and not carry out the full state tomography).</p></list-item></ordered-list></p></sec-level2><sec-level2 id="nj279271s3.2" label="3.2"><heading>Analysis in the absence of imperfections</heading><p indent="no">We now study how the merit function <inline-eqn></inline-eqn> depends on the details of the experiment. For the sake of comparison, we first look at the situation in the absence of imperfections.</p><p>First of all, in this case <inline-eqn><math-text><italic>p</italic><sub>⊥⊥</sub>=0</math-text></inline-eqn>.</p><p>Secondly, if Alice is dishonest she will send a fixed state <inline-eqn><math-text>|&phis;⟩</math-text></inline-eqn> at step 1 and at step 3, she will choose the value of <inline-eqn><math-text><italic>a</italic></math-text></inline-eqn> which will make her win the protocol, and then she will hope that Bob will not abort. The probability that Bob will abort is given by the overlap of <inline-eqn><math-text>|&phis;⟩</math-text></inline-eqn> with <inline-eqn><math-text>|ψ<sub>0</sub>⟩</math-text></inline-eqn> and <inline-eqn><math-text>|ψ<sub>1</sub>⟩</math-text></inline-eqn>. One easily finds (see [<cite linkend="nj279271bib21">21</cite>]) that Alice's optimal choice is <inline-eqn><math-text>|&phis;⟩=<italic>N</italic>(|ψ<sub>0</sub>⟩+|ψ<sub>1</sub>⟩)</math-text></inline-eqn>, where <inline-eqn><math-text><italic>N</italic></math-text></inline-eqn> a normalization constant, yielding the optimal values:
<display-eqn id="nj279271eqn7" textype="equation" notation="LaTeX" eqnnum="7"></display-eqn></p><p>Thirdly, if Bob is dishonest, he will measure the state sent by Alice at step 2 so as to try to find out whether it is <inline-eqn><math-text>ψ<sub>0</sub></math-text></inline-eqn> or <inline-eqn><math-text>ψ<sub>1</sub></math-text></inline-eqn>, and he will then choose the value of <inline-eqn><math-text><italic>b</italic></math-text></inline-eqn> according to the result of his measurement. For the optimal measurement the probability that Bob wins is
<display-eqn id="nj279271eqn8" textype="equation" notation="LaTeX" eqnnum="8"></display-eqn></p><p>The maximal value of the merit function <inline-eqn></inline-eqn> occurs when <inline-eqn></inline-eqn>, corresponding to <inline-eqn><math-text>α<sup>2</sup>=0.17</math-text></inline-eqn>. Note that this is the maximum value for protocols which in the terminology of Spekkens and Rudolph [<cite linkend="nj279271bib9">9</cite>] fall in the category ‘<inline-eqn><math-text>ρ<sub>0</sub></math-text></inline-eqn> and <inline-eqn><math-text>ρ<sub>1</sub></math-text></inline-eqn> both pure’.</p></sec-level2><sec-level2 id="nj279271s3.3" label="3.3"><heading>Analysis in the presence of imperfections</heading><p indent="no">To obtain estimates on <inline-eqn><math-text><italic>p</italic><sub>*<italic>c</italic></sub></math-text></inline-eqn>, <inline-eqn><math-text><italic>p</italic><sub><italic>c</italic>*</sub></math-text></inline-eqn> and <inline-eqn><math-text><italic>p</italic><sub>⊥⊥</sub></math-text></inline-eqn>, and hence to estimate <inline-eqn></inline-eqn>, in the presence of imperfections requires that we make assumptions on how the experiment is carried out.</p><p>The parameter, <inline-eqn><math-text><italic>p</italic><sub>⊥⊥</sub></math-text></inline-eqn>, which we also call the quantum bit error rate (QBER), can easily be measured experimentally by tossing a large number of coins with Alice and Bob both following their honest strategy. Note that there are two contributions to the QBER, the optical contribution <inline-eqn><math-text><upright>QBER</upright><sub><upright>opt</upright></sub></math-text></inline-eqn> due to finite visibility of interferences, and the contribution <inline-eqn><math-text><upright>QBER</upright><sub><upright>dk</upright></sub></math-text></inline-eqn> due to dark counts of the detectors. The total QBER is thus the sum <inline-eqn><math-text><upright>QBER</upright>=<upright>QBER</upright><sub><upright>opt</upright></sub>+<upright>QBER</upright><sub><upright>dk</upright></sub></math-text></inline-eqn>.</p><sec-level3 id="nj279271s3.3.1" label="3.3.1"><heading>Bob is dishonest</heading><p indent="no">When Bob is dishonest his cheating strategy is, as before, to estimate before step 2 the state <inline-eqn><math-text>|ψ<sub><italic>a</italic></sub>⟩</math-text></inline-eqn> prepared by Alice so as to correctly guess the value of <inline-eqn><math-text><italic>a</italic></math-text></inline-eqn>. How do experimental imperfections affect Bob's success probability <inline-eqn><math-text><italic>p</italic><sub><italic>c</italic>*</sub></math-text></inline-eqn>? To analyze this note that the state Alice sends to Bob is a short laser pulse of known intensity which is then strongly attenuated. Under strong attenuation all quantum states tend towards mixtures of coherent states (see e.g. [<cite linkend="nj279271bib19">19</cite>]). Thus we can assume that the states prepared by Alice are coherent states of known intensity <inline-eqn><math-text>α<sup>2</sup></math-text></inline-eqn>. These coherent states are not precisely known to Alice. However, it is not difficult to show that if two coherent states have intensity <inline-eqn><math-text>α<sup>2</sup></math-text></inline-eqn>, their scalar product is lower bounded by <inline-eqn><math-text>|⟨ψ<sub>1</sub>|ψ<sub>0</sub>⟩|⩾<upright>e</upright><sup>−2α<sup>2</sup></sup></math-text></inline-eqn>. Bob's cheating probability can then be bounded, as in equation (<eqnref linkend="nj279271eqn8">8</eqnref>), by the scalar product of the two states prepared by Alice:
<display-eqn id="nj279271eqn9" textype="equation" notation="LaTeX" eqnnum="9"></display-eqn>Note that the visibility <inline-eqn><math-text><italic>V</italic></math-text></inline-eqn> of the interferences does not enter into equation (<eqnref linkend="nj279271eqn9">9</eqnref>).</p></sec-level3><sec-level3 id="nj279271s3.3.2" label="3.3.2"><heading>Alice is dishonest</heading><p indent="no">When Alice is dishonest we suppose that she can prepare an arbitrary state just in front of Bob's laboratory, and then send it to Bob. How do the imperfections in Bob's laboratory affect <inline-eqn><math-text><italic>p</italic><sub>*<italic>c</italic></sub></math-text></inline-eqn>? To quantify this Bob could carry out a complete tomography of his measurement apparatus, and based on the results compute what is Alice's best cheating strategy. Here, we will make a simple estimate based on easily accessible parameters.</p><p>First of all, let us consider the effects of the attenuation <inline-eqn><math-text><italic>A</italic><sub><upright>T</upright></sub></math-text></inline-eqn> during transmission between Alice and Bob's laboratories, of the attenuation <inline-eqn><math-text><italic>A</italic><sub><upright>B</upright></sub></math-text></inline-eqn> in Bob's apparatus, and of the efficiency <inline-eqn><math-text>η</math-text></inline-eqn> of his detector. We take these parameters into account by analyzing a fictitious system in which Bob's apparatus is replaced by a lossless apparatus, and all the attenuation is under Alice's control, i.e. <inline-eqn><math-text>η<sup><upright>fict</upright></sup>=100%</math-text></inline-eqn>, <inline-eqn><math-text><italic>A</italic><sub><upright>B</upright></sub><sup><upright>fict</upright></sup>=1</math-text></inline-eqn>, and <inline-eqn><math-text><italic>A</italic><sub><upright>T</upright></sub><sup><upright>fict</upright></sup>=<italic>A</italic><sub><upright>T</upright></sub><italic>A</italic><sub><upright>B</upright></sub>η</math-text></inline-eqn>. This replacement can only help a cheating Alice. In the fictitious system the state sent by an honest Alice is <inline-eqn></inline-eqn>.</p><p>Second, we analyze the effect of finite visibility on the performance of the fictitious system just described. Because of the finite visibility, Bob will not be making a projection onto the state <inline-eqn><math-text>|±α<sub><upright>B</upright></sub><sup><upright>fict</upright></sup>⟩</math-text></inline-eqn>, but onto slightly different states. We make the assumption that Bob's apparatus acts as a passive linear optical system. This implies that the true states onto which Bob projects are slightly modified coherent states <inline-eqn><math-text>|±α<sub><upright>B</upright></sub><sup><upright>fict</upright></sup>+δ<sub>±</sub>⟩</math-text></inline-eqn>. The deviations due to <inline-eqn><math-text>δ<sub>±</sub></math-text></inline-eqn> give rise to the optical contribution to the QBER:
<display-eqn id="nj279271eqn10" textype="equation" notation="LaTeX" eqnnum="10"></display-eqn>where <inline-eqn><math-text><italic>q</italic></math-text></inline-eqn>, the QBER per photon, can be related to the visibility V of interferences by <inline-eqn><math-text><italic>q</italic>≃(1−<italic>V</italic>)/2</math-text></inline-eqn>.</p><p>The distance between the two states onto which Bob projects is given by
<display-eqn id="nj279271eqn11" textype="equation" notation="LaTeX" eqnnum="11"></display-eqn>Inserting this into equation (<eqnref linkend="nj279271eqn7">7</eqnref>) gives
<display-eqn id="nj279271eqn12" textype="equation" notation="LaTeX" eqnnum="12"></display-eqn>Thus the effect of the imperfections is to replace <inline-eqn><math-text>α<sup>2</sup></math-text></inline-eqn> by an effective attenuated intensity <inline-eqn></inline-eqn>. Note that the visibility of interferences <inline-eqn><math-text><italic>V</italic></math-text></inline-eqn>, or equivalently <inline-eqn><math-text><upright>QBER</upright><sub><upright>opt</upright></sub></math-text></inline-eqn>, enters into equation (<eqnref linkend="nj279271eqn12">12</eqnref>) through the parameter <inline-eqn><math-text><italic>q</italic></math-text></inline-eqn>. Indeed if Bob does not control his measuring apparatus perfectly, then it may be easier for Alice to cheat.</p></sec-level3></sec-level2><sec-level2 id="nj279271s3.4" label="3.4"><heading>Experimental results</heading><p indent="no">Our experimental setup, depicted in figure <figref linkend="nj279271fig1">1</figref>, based on the plug and play system developed for long distance quantum key distribution [<cite linkend="nj279271bib24">24</cite>], is very similar to the one described in [<cite linkend="nj279271bib19">19</cite>]. It consists of an all-fiber (standard SMF-28) passively balanced interferometer, and is therefore well suited to long distance quantum communication. The protocol begins with Bob producing a short (300 ps) intense laser pulse at <inline-eqn><math-text>λ=1.55 μ<upright>m</upright></math-text></inline-eqn> (laser id300 from idQuantique). The pulse is split into two by the coupler C1 with equal reflection and transmission coefficients <inline-eqn><math-text>50%</math-text></inline-eqn>. One of the pulses is delayed with respect to the other by 134 ns. The pulses are then recombined on a polarizing beam splitter (PBS) and sent to Alice. The pulse that propagated along the long arm of the interferometer is strongly attenuated and will play the role of signal. The pulse that propagated along the short arm will play the role of LO. Upon receiving the pulses, Alice splits off part of them using the coupler C2 and sends it to a photodiode that triggers her electronics. At Alice's site the pulses are further attenuated by the different optical elements. They are reflected by the Faraday mirror. And Alice randomly chooses the phase <inline-eqn><math-text>Φ<sub><upright>A</upright></sub>=0, π</math-text></inline-eqn> to put on the signal pulse using her phase modulator. The signal Alice sends back to Bob is thus the coherent state <inline-eqn><math-text>|±α⟩</math-text></inline-eqn> with average photon number <inline-eqn><math-text>|α|<sup>2</sup>=0.27</math-text></inline-eqn>. The 134 ns delay between the signal and the LO ensures the phase <inline-eqn><math-text>Φ<sub><upright>A</upright></sub></math-text></inline-eqn> is only applied to the signal.</p><figure id="nj279271fig1" parts="single" width="column" position="float" pageposition="top" printstyle="normal" orientation="port"><graphic position="indented"><graphic-file version="print" format="EPS" width="20pc" printcolour="no" filename="images/nj279271fig1.eps"></graphic-file><graphic-file version="ej" format="JPEG" printcolour="yes" filename="images/nj279271fig1.jpg"></graphic-file></graphic><caption type="figure" id="nj279271fc1" label="Figure 1"><p indent="no">Experimental setup: L, picosecond laser; D1, main photon counter; D2, auxiliary photon counter; C1, 50/50 coupler; A, attenuator; <inline-eqn><math-text>Φ<sub><upright>B</upright></sub></math-text></inline-eqn>, Bob's phase modulator; PCM, polarization controller; PBS, polarizing beam splitter; C2, 80/20 coupler; PD, photodiode; <inline-eqn><math-text>Φ<sub><upright>A</upright></sub></math-text></inline-eqn>, Alice's phase modulator; FM, Faraday mirror.</p></caption></figure><p>When the pulses come back to Bob's site, they are sent along the short and long arm of the interferometer by the PBS and interfere at coupler C1. In front of the PBS is a delay line belonging to Bob, which ensures that after the pulses enter Bob's laboratory he has the time to send to Alice the value of the bit <inline-eqn><math-text><italic>b</italic></math-text></inline-eqn> and then receive from her the value of <inline-eqn><math-text><italic>a</italic></math-text></inline-eqn>. In our experiment, the fiber pigtails of the PBS are sufficient to realize the delay. Upon receiving the value of <inline-eqn><math-text><italic>a</italic></math-text></inline-eqn>, Bob puts the corresponding phase <inline-eqn><math-text>Φ<sub><upright>B</upright></sub>=<italic>a</italic>π</math-text></inline-eqn> on the LO. This ensures that there should be destructive interference at the output port that goes to the circulator and then to detector D1 (id200 from idQuantique). If detector D1 registers a click, Bob aborts. If it does not click, the outcome of the coin toss is <inline-eqn><math-text><italic>c</italic>=<italic>a</italic>⊕<italic>b</italic></math-text></inline-eqn>. The other output of coupler C1 is monitored by detector D2, although this is not directly used in the experiment.</p><p>There are two security loopholes in this experiment which have not yet been discussed. The first arises because Alice does not know the intensity of the signal pulse she attenuates before sending it back to Bob. Thus, in principle, Bob could send her a more intense state than expected, which would mean that the scalar product of the states prepared by Alice would be smaller than expected. The second security loophole arises because Bob does not know the intensity of the pulse he uses as LO. Thus, in principle, Alice could send Bob the vacuum state, both in the signal and LO, and cheat perfectly. Both loopholes could be closed by having Alice (Bob) monitor the intensity of the signal (LO) before she (he) attenuates it. This was not realized in the present setup because the laser pulses used were not intense enough, but it would be possible using more intense or longer laser pulses as in [<cite linkend="nj279271bib19">19</cite>], or by using an isolator combined with an amplitude modulator as in [<cite linkend="nj279271bib25">25</cite>].</p><sec-level3 id="nj279271s3.4.1" label="3.4.1"><heading>Both parties are honest</heading><p indent="no">As mentioned above, we performed the experiment with <inline-eqn><math-text>|α|<sup>2</sup>=0.27</math-text></inline-eqn>. In a typical series 10 000 coins were tossed, and we obtained 5066 occurrences of <inline-eqn><math-text><italic>c</italic>=1</math-text></inline-eqn>, 2 occurrences of <inline-eqn><math-text><italic>c</italic>= ⊥</math-text></inline-eqn>, the other outcomes being <inline-eqn><math-text><italic>c</italic>=0</math-text></inline-eqn> (which is consistent with the statistical uncertainty which should be of the order of <inline-eqn></inline-eqn>). However, we insist that the protocol can be used to toss a single coin.</p><p>We estimate the merit function as follows. The abort probability is estimated by tossing a large number (<inline-eqn><math-text>1.5×10<sup>5</sup></math-text></inline-eqn>) of coins with Alice and Bob both honest
<display-eqn id="nj279271eqn13" textype="equation" notation="LaTeX" eqnnum="13"></display-eqn>where the error comes from statistical uncertainty.</p><p>The transmission losses are assumed to be negligible, <inline-eqn><math-text><italic>A</italic><sub><upright>T</upright></sub>=1</math-text></inline-eqn>, as the two parties are separated by a few metres of optical fiber. Bob's detector D1 has a <inline-eqn><math-text>η=10%</math-text></inline-eqn> quantum efficiency. It is gated using a <inline-eqn><math-text>2.5 <upright>ns</upright></math-text></inline-eqn> gate leading to a dark count probability of <inline-eqn><math-text>4.7×10<sup>−5</sup></math-text></inline-eqn>. The attenuation of the signal in the optical elements of Bob's laboratory has been measured to be <inline-eqn><math-text><italic>A</italic><sub><upright>B</upright></sub>≃−6</math-text></inline-eqn> dB (which includes the 3 dB losses at coupler C1 where the signal and the LO interfere). Visibilities, as measured using an intense signal, were at least 99.0% (corresponding to <inline-eqn><math-text><italic>q</italic>=5×10<sup>−3</sup></math-text></inline-eqn>). By inserting these parameters in equations (<eqnref linkend="nj279271eqn9">9</eqnref>) and (<eqnref linkend="nj279271eqn12">12</eqnref>), we obtain upper bounds for <inline-eqn><math-text><italic>p</italic><sub>*<italic>c</italic></sub></math-text></inline-eqn> and <inline-eqn><math-text><italic>p</italic><sub><italic>c</italic>*</sub></math-text></inline-eqn>:
<display-eqn id="nj279271eqn14" textype="equation" notation="LaTeX" eqnnum="14"></display-eqn>leading to the lower bound for the merit function:
<display-eqn id="nj279271eqn15" textype="equation" notation="LaTeX" eqnnum="15"></display-eqn></p><p>This bound may seem very small. Its value is roughly explained by noting that the maximal value in the absence of imperfections is <inline-eqn></inline-eqn>. The main source of imperfections is the efficiency of the detectors (10 dB) and the losses in Bob's apparatus (6 dB) which yield a very high bound for <inline-eqn><math-text><italic>p</italic><sub>*<italic>c</italic></sub></math-text></inline-eqn>, see equation (<eqnref linkend="nj279271eqn12">12</eqnref>). Thus we should reduce the attainable value of <inline-eqn></inline-eqn> by a factor 40, yielding approximately equation (<eqnref linkend="nj279271eqn15">15</eqnref>). This argument shows that the simplest way to improve the experiment would be to use a more efficient detector. It also shows that the value of <inline-eqn></inline-eqn> is rather robust against small variations of the experimental parameters. We have computed that we could keep <inline-eqn></inline-eqn> positive, while increasing losses between Alice and Bob to <inline-eqn><math-text><italic>A</italic><sub><upright>T</upright></sub>≃4.4 <upright>dB</upright></math-text></inline-eqn> (more than 20 km of SMF-28 fiber), all other parameters being kept constant.</p></sec-level3><sec-level3 id="nj279271s3.4.2" label="3.4.2"><heading>Bob is dishonest</heading><p indent="no">In order to cheat Bob must estimate the state <inline-eqn><math-text>|ψ<sub><italic>a</italic></sub>⟩</math-text></inline-eqn> prepared by Alice so as to correctly guess the value of <inline-eqn><math-text><italic>a</italic></math-text></inline-eqn> before sending the value of <inline-eqn><math-text><italic>b</italic></math-text></inline-eqn>. We implemented a simple cheating strategy in which Bob always applies <inline-eqn><math-text>Φ<sub><upright>B</upright></sub>=0</math-text></inline-eqn> on the LO. If detector D1 clicks Bob assumes that Alice chose <inline-eqn><math-text><italic>a</italic>=1</math-text></inline-eqn>, whereas if D1 does not click he assumes <inline-eqn><math-text><italic>a</italic>=0</math-text></inline-eqn>. Implementing this strategy yielded the value <inline-eqn><math-text><italic>p</italic><sub>1*</sub>=0.505</math-text></inline-eqn>. This very low value (compared to the bound of equation (<eqnref linkend="nj279271eqn14">14</eqnref>)) is due to the small values of <inline-eqn><math-text>η</math-text></inline-eqn> and <inline-eqn><math-text><italic>A</italic><sub><upright>B</upright></sub></math-text></inline-eqn>. Note that a much better cheating strategy, but which was impossible to implement in our laboratory, would be for Bob to carry out a homodyne measurement and measure the quadrature that gives him the best estimate of <inline-eqn><math-text><italic>a</italic></math-text></inline-eqn>.</p></sec-level3><sec-level3 id="nj279271s3.4.3" label="3.4.3"><heading>Alice is dishonest</heading><p indent="no">As discussed above, when Alice is dishonest her best strategy is to send a fixed state <inline-eqn><math-text>|&phis;⟩=<italic>N</italic>(|+α⟩+|−α⟩)</math-text></inline-eqn> to Bob. After receiving <inline-eqn><math-text><italic>b</italic></math-text></inline-eqn> she then sends the value of <inline-eqn><math-text><italic>a</italic></math-text></inline-eqn> that makes her win the coin toss and hopes that Bob will not abort. In practice we implemented a strategy where Alice always sends <inline-eqn><math-text>|+α⟩</math-text></inline-eqn>. Even though this strategy is very basic, it leads to <inline-eqn><math-text><italic>p</italic><sub>*<italic>c</italic></sub>=0.9956</math-text></inline-eqn>, which is close to the theoretical maximum, equation (<eqnref linkend="nj279271eqn14">14</eqnref>).</p></sec-level3></sec-level2></sec-level1><sec-level1 id="nj279271s4" label="4"><heading>Conclusion</heading><p indent="no">In conclusion, we have studied in detail how the performance of quantum coin tossing protocols in the presence of imperfections should be compared to classical protocols. We then reported on a fiber optics experimental realization of a quantum coin tossing protocol. Our analysis shows that in this realization the maximum success cheating probabilities for Alice and Bob are, respectively, 0.9971 and 0.906 when experimental imperfections are taken into account, which is still better than achievable by any classical protocol. We implemented this protocol using an all-optical fiber scheme and tossed a coin whose randomness is higher than achievable by any classical protocol. Finally, we implemented simple realizable cheating strategies for both Alice and Bob.</p><p>After the present work was completed, we learned of a recent proposal specially designed for carrying out quantum coin tossing in the presence of losses [<cite linkend="nj279271bib26">26</cite>]. Obviously taking into account losses, in particular those that occur in Bob's apparatus, was an important consideration when choosing and analyzing the protocol reported here. The protocol reported in [<cite linkend="nj279271bib26">26</cite>] seems more tolerant to loss than ours.</p></sec-level1><acknowledgment><heading>Acknowledgments</heading><p indent="no">We acknowledge the support of the Fonds pour la formation à la Recherche dans l'Industrie et dans l'Agriculture (FRIA, Belgium) of the Interuniversity Attraction Poles Programme—Belgian State—Belgian Science Policy under grant IAP6-10, and of the EU project QAP contract 015848. K Phan Huy also acknowledges support from the Programme International de Coopération Scientifique PICS-3742 and from the Groupement de Recherche Photonique Nonlinéaire et Milieu Microstructurés GDR-3073 of the Centre National de Recherche Scientifique (CNRS).</p></acknowledgment><appendix id="nj279271a1"><sec-level1 id="nj279271s5" type="unnum" appendix="yes" style="ALPHA"><heading>Appendix</heading><p indent="no">Here, we provide bounds on the performance of classical coin tossing protocols when there is non zero probability that the protocol aborts when both parties are honest. We also show that there exist classical protocols that attain these bounds. We use the notation and terminology introduced in the main text. The idea of the following result is to analyze the performance of a classical protocol with 3 outcomes (i.e. a classical protocol in which the parties try to toss a trit).</p><proclaim id="nj279271pro2" type="lemma" format="num" style="italic"><heading>Lemma 1</heading><p indent="no">For any correct <italic>classical</italic> coin tossing protocol with three outcomes <inline-eqn><math-text>0, 1, ⊥</math-text></inline-eqn> we have:
<display-eqn id="nj279271eqnA.1" textype="equation" notation="LaTeX" eqnnum="A.1"></display-eqn></p><p><display-eqn id="nj279271eqnA.2" textype="equation" notation="LaTeX" eqnnum="A.2"></display-eqn></p></proclaim><proclaim id="nj279271pro3" type="proof" format="unnum" style="upright"><heading>Proof</heading><p indent="no">We need to introduce some notation.</p><p>The protocol consists of <inline-eqn><math-text><italic>K</italic></math-text></inline-eqn> rounds of communication, labeled <inline-eqn><math-text><italic>j</italic>=1, …, <italic>K</italic></math-text></inline-eqn>.</p><p>Denote by <inline-eqn><math-text><italic>u</italic><sub><italic>j</italic></sub></math-text></inline-eqn> the possible states of the protocol at round <inline-eqn><math-text><italic>j</italic></math-text></inline-eqn>.</p><p>Denote by <inline-eqn><math-text><italic>w</italic>(<italic>u</italic><sub><italic>j</italic></sub>)</math-text></inline-eqn> the probability of reaching state <inline-eqn><math-text><italic>u</italic><sub><italic>j</italic></sub></math-text></inline-eqn> at round <inline-eqn><math-text><italic>j</italic></math-text></inline-eqn> in an honest execution of the protocol.</p><p>Denote by <inline-eqn><math-text><italic>w</italic>(<italic>u</italic><sub><italic>j</italic>+1</sub>|<italic>u</italic><sub><italic>j</italic></sub>)</math-text></inline-eqn> the probability that in an honest execution, the protocol will be in state <inline-eqn><math-text><italic>u</italic><sub><italic>j</italic>+1</sub></math-text></inline-eqn> at round <inline-eqn><math-text><italic>j</italic>+1</math-text></inline-eqn> if it is in state <inline-eqn><math-text><italic>u</italic><sub><italic>j</italic></sub></math-text></inline-eqn> at round <inline-eqn><math-text><italic>j</italic></math-text></inline-eqn>.</p><p>Denote by <inline-eqn><math-text><italic>p</italic><sub>*<italic>y</italic></sub>(<italic>u</italic><sub><italic>j</italic></sub>)</math-text></inline-eqn> the maximum probability that, when Alice is dishonest and Bob is honest, Alice can force Bob to output <inline-eqn><math-text><italic>y</italic></math-text></inline-eqn> at the end of the protocol if the state at round <inline-eqn><math-text><italic>j</italic></math-text></inline-eqn> is <inline-eqn><math-text><italic>u</italic><sub><italic>j</italic></sub></math-text></inline-eqn>.</p><p>Denote by <inline-eqn><math-text><italic>p</italic><sub><italic>x</italic>*</sub>(<italic>u</italic><sub><italic>j</italic></sub>)</math-text></inline-eqn> the maximum probability that, when Bob is dishonest and Alice is honest, Bob can force Alice to output <inline-eqn><math-text><italic>x</italic></math-text></inline-eqn> at the end of the protocol if the state at round <inline-eqn><math-text><italic>j</italic></math-text></inline-eqn> is <inline-eqn><math-text><italic>u</italic><sub><italic>j</italic></sub></math-text></inline-eqn>.</p><p>Introduce the quantity <inline-eqn><math-text><italic>T</italic><sub><italic>j</italic></sub></math-text></inline-eqn> defined by
<display-eqn textype="equation" notation="LaTeX" number="no"></display-eqn></p><p>Note that if we take <inline-eqn><math-text><italic>x</italic>=0</math-text></inline-eqn> and <inline-eqn><math-text><italic>y</italic>=1</math-text></inline-eqn> the initial value (<inline-eqn><math-text><italic>j</italic>=1</math-text></inline-eqn>) of <inline-eqn><math-text><italic>T</italic></math-text></inline-eqn> is <inline-eqn><math-text><italic>T</italic><sub>1</sub>(0, 1)= (1−<italic>p</italic><sub>0*</sub>)(1−<italic>p</italic><sub>*1</sub>)</math-text></inline-eqn>, i.e. the left-hand side of equation (<eqnref linkend="nj279271eqnA.1">A.1</eqnref>).</p><p>Note also that at round <inline-eqn><math-text><italic>K</italic></math-text></inline-eqn>, when the protocol has ended, <inline-eqn><math-text><italic>T</italic><sub><italic>K</italic></sub></math-text></inline-eqn> is equal to the sum over the final states of the protocol in an honest execution of the product of the probabilities that the output of Alice is not <inline-eqn><math-text><italic>x</italic></math-text></inline-eqn> and that the output of Bob is not <inline-eqn><math-text><italic>y</italic></math-text></inline-eqn>. Thus if we take <inline-eqn><math-text><italic>x</italic>=0</math-text></inline-eqn> and <inline-eqn><math-text><italic>y</italic>=1</math-text></inline-eqn>, then <inline-eqn><math-text><italic>T</italic><sub><italic>K</italic></sub>(0, 1)=<italic>p</italic><sub>⊥⊥</sub></math-text></inline-eqn>, i.e. the right-hand side of equation (<eqnref linkend="nj279271eqnA.1">A.1</eqnref>).</p><p>To complete the proof we show that <inline-eqn><math-text><italic>T</italic></math-text></inline-eqn> is an increasing function of <inline-eqn><math-text><italic>j</italic></math-text></inline-eqn>, i.e. <inline-eqn><math-text><italic>T</italic><sub><italic>j</italic>+1</sub>⩾<italic>T</italic><sub><italic>j</italic></sub></math-text></inline-eqn>. To this end suppose that at round <inline-eqn><math-text><italic>j</italic></math-text></inline-eqn> Bob will send some communication to Alice.</p><p>Then Alice cannot influence what will happen at round <inline-eqn><math-text><italic>j</italic></math-text></inline-eqn>, hence we have: <inline-eqn></inline-eqn>.</p><p>Furthermore, we have the trivial identity <inline-eqn></inline-eqn>.</p><p>Finally, we note that since it is Bob's turn to talk at round <inline-eqn><math-text><italic>j</italic></math-text></inline-eqn>, we have <inline-eqn><math-text>1−<italic>p</italic><sub><italic>x</italic>*</sub>(<italic>u</italic><sub><italic>j</italic></sub>)⩽1−<italic>p</italic><sub><italic>x</italic>*</sub>(<italic>u</italic><sub><italic>j</italic>+1</sub>)</math-text></inline-eqn>, where <inline-eqn><math-text><italic>u</italic><sub><italic>j</italic>+1</sub></math-text></inline-eqn> is any state at round <inline-eqn><math-text><italic>j</italic>+1</math-text></inline-eqn> that can be obtained from state <inline-eqn><math-text><italic>u</italic><sub><italic>j</italic></sub></math-text></inline-eqn> at round <inline-eqn><math-text><italic>j</italic></math-text></inline-eqn> in an honest execution.</p><p>Inserting these identities into the definition of <inline-eqn><math-text><italic>T</italic><sub><italic>j</italic></sub></math-text></inline-eqn>, we obtained the desired inequality <inline-eqn><math-text><italic>T</italic><sub><italic>j</italic>+1</sub>⩾<italic>T</italic><sub><italic>j</italic></sub></math-text></inline-eqn>.</p><p>The proof of equation (<eqnref linkend="nj279271eqnA.2">A.2</eqnref>) is similar. □</p></proclaim><p>We have also obtained a partial converse of lemma <textref linkend="nj279271pro1">1</textref>:</p><proclaim id="nj279271pro4" type="lemma" format="num" num="4" style="italic"><heading>Lemma 2</heading><p indent="no">There exists a correct classical protocol such that inequality (<eqnref linkend="nj279271eqnA.1">A.1</eqnref>) is saturated, and there exists a correct classical protocol such that inequality (<eqnref linkend="nj279271eqnA.2">A.2</eqnref>) is saturated. There also exists a correct classical protocol for which
<display-eqn id="nj279271eqnA.3" textype="equation" notation="LaTeX" eqnnum="A.3" lines="multiline"></display-eqn></p></proclaim><proclaim id="nj279271pro5" type="proof" format="unnum" style="upright"><heading>Proof</heading><p indent="no">Let us consider the following protocol:</p><p>Round 1: Alice excludes one of the outcomes. That is she chooses that the outcome of the protocol will be either in <inline-eqn><math-text>{0, 1}</math-text></inline-eqn> (she has excluded <inline-eqn><math-text>⊥</math-text></inline-eqn>), <inline-eqn><math-text>{0, ⊥}</math-text></inline-eqn> (she has excluded <inline-eqn><math-text>1</math-text></inline-eqn>) or <inline-eqn><math-text>{1, ⊥}</math-text></inline-eqn> (she has excluded <inline-eqn><math-text>0</math-text></inline-eqn>). She tells her choice to Bob. If she is honest she chooses randomly among these three possibilities with <italic>a priori</italic> probabilities <inline-eqn><math-text><italic>q</italic><sub>01</sub></math-text></inline-eqn>, <inline-eqn><math-text><italic>q</italic><sub>0⊥</sub></math-text></inline-eqn>, <inline-eqn><math-text><italic>q</italic><sub>1⊥</sub></math-text></inline-eqn>.</p><p>Round 2: Bob chooses between the remaining two outcomes thereby determining the result of the protocol. He tells Alice what his choice is. Thus for instance if Alice told him that the outcome was <inline-eqn><math-text>{0, 1}</math-text></inline-eqn>, Bob can choose that the outcome is either <inline-eqn><math-text>0</math-text></inline-eqn> or <inline-eqn><math-text>1</math-text></inline-eqn>, but not <inline-eqn><math-text>⊥</math-text></inline-eqn>. If he is honest he chooses randomly among the two remaining possibilities with probabilities <inline-eqn><math-text><italic>q</italic><sub>0|01</sub></math-text></inline-eqn>, <inline-eqn><math-text><italic>q</italic><sub>1|01</sub></math-text></inline-eqn>; <inline-eqn><math-text><italic>q</italic><sub>0|0⊥</sub></math-text></inline-eqn>, <inline-eqn><math-text><italic>q</italic><sub>⊥|0⊥</sub></math-text></inline-eqn>; <inline-eqn><math-text><italic>q</italic><sub>1|1⊥</sub></math-text></inline-eqn>, <inline-eqn><math-text><italic>q</italic><sub>⊥|1⊥</sub></math-text></inline-eqn>.</p><p>It is easy to check that, if the parties are honest, the probabilities are:
<display-eqn id="nj279271eqnA.4" textype="equation" notation="LaTeX" eqnnum="A.4" lines="multiline"></display-eqn>and that, if they are dishonest, the probabilities are:
<display-eqn id="nj279271eqnA.5" textype="equation" notation="LaTeX" eqnnum="A.5" lines="multiline"></display-eqn></p><p>If we choose the parameters such that <inline-eqn><math-text><italic>q</italic><sub>0⊥</sub>=<italic>q</italic><sub>1⊥</sub></math-text></inline-eqn>, <inline-eqn><math-text><italic>q</italic><sub>0|01</sub>=<italic>q</italic><sub>1|01</sub>=1/2</math-text></inline-eqn>, <inline-eqn><math-text><italic>q</italic><sub>0|0⊥</sub>=<italic>q</italic><sub>1|1⊥</sub>⩾1/2</math-text></inline-eqn>, then the protocol is correct and equation (<eqnref linkend="nj279271eqnA.3">A.3</eqnref>) is verified.</p><p>And if we choose <inline-eqn><math-text><italic>q</italic><sub>0⊥</sub>=0</math-text></inline-eqn> and <inline-eqn><math-text><italic>q</italic><sub>1|1⊥</sub>><italic>q</italic><sub>1|01</sub></math-text></inline-eqn> then we have <inline-eqn><math-text><italic>p</italic><sub>⊥⊥</sub>=<italic>q</italic><sub>⊥|1⊥</sub><italic>q</italic><sub>1⊥</sub>=(1−<italic>q</italic><sub>1|1⊥</sub>)(1−<italic>q</italic><sub>01</sub>)</math-text></inline-eqn> and <inline-eqn><math-text><italic>p</italic><sub>0*</sub>=<italic>q</italic><sub>01</sub></math-text></inline-eqn>, <inline-eqn><math-text><italic>p</italic><sub>*1</sub>=<italic>q</italic><sub>1|1⊥</sub></math-text></inline-eqn> thus saturating equation (<eqnref linkend="nj279271eqnA.1">A.1</eqnref>). Note that by adjusting the remaining free parameter <inline-eqn><math-text><italic>q</italic><sub>0|01</sub></math-text></inline-eqn> one can make the protocol correct.</p><p>Similarly one can saturate inequality (<eqnref linkend="nj279271eqnA.2">A.2</eqnref>). </p></proclaim></sec-level1></appendix></body><back><references><heading>References</heading><reference-list type="numeric"><journal-ref id="nj279271bib1" num="1"><authors><au><second-name>Blum</second-name><first-names>M</first-names></au></authors><year>1983</year><jnl-title>ACM SIGACT News</jnl-title><volume>15</volume><pages>23</pages><crossref><cr_doi>http://dx.doi.org/10.1145/1008908.1008911</cr_doi><cr_issn type="print">01635700</cr_issn></crossref></journal-ref><book-ref id="nj279271bib2" num="2"><authors><au><second-name>Bennett</second-name><first-names>C H</first-names></au><au><second-name>Brassard</second-name><first-names>G</first-names></au></authors><year>1984</year><book-title>Proc. IEEE Int. Conf. on Computers, Systems and Signal Processing <upright>(</upright>Bangalore, India<upright>)</upright></book-title><publication><place>New York</place><publisher>IEEE</publisher></publication><pages>p 175</pages></book-ref><journal-ref id="nj279271bib3" num="3"><authors><au><second-name>Lo</second-name><first-names>H-K</first-names></au><au><second-name>Chau</second-name><first-names>H F</first-names></au></authors><year>1998</year><jnl-title>Physica</jnl-title><part>D</part><volume>120</volume><pages>177</pages><crossref><cr_doi>http://dx.doi.org/10.1016/S0167-2789(98)00053-0</cr_doi><cr_issn type="print">01672789</cr_issn></crossref></journal-ref><misc-ref id="nj279271bib4" num="4"><authors><au><second-name>Mayers</second-name><first-names>D</first-names></au><au><second-name>Salvail</second-name><first-names>L</first-names></au><au><second-name>Chiba-Kohno</second-name><first-names>Y</first-names></au></authors><year>1999</year><preprint-info><preprint>Preprint</preprint><art-number type="arxiv">quant-ph/9904078</art-number></preprint-info></misc-ref><misc-ref id="nj279271bib5" num="5"><authors><au><second-name>Kitaev</second-name><first-names>A Y</first-names></au></authors><year>2002</year><misc-text>Lecture delivered at QIP 2003, MSRI, Berkeley, CA (unpublished). Online at <webref url="http://www.msri.org/publications/video/index05.html">http://www.msri.org/publications/video/index05.html</webref></misc-text></misc-ref><journal-ref id="nj279271bib6" num="6"><authors><au><second-name>Goldenberg</second-name><first-names>L</first-names></au><au><second-name>Vaidman</second-name><first-names>L</first-names></au><au><second-name>Wiesner</second-name><first-names>S</first-names></au></authors><year>1999</year><jnl-title>Phys. Rev. Lett.</jnl-title><volume>82</volume><pages>3356</pages><crossref><cr_doi>http://dx.doi.org/10.1103/PhysRevLett.82.3356</cr_doi><cr_issn type="print">00319007</cr_issn><cr_issn type="electronic">10797114</cr_issn></crossref></journal-ref><book-ref id="nj279271bib7" num="7"><authors><au><second-name>Aharonov</second-name><first-names>D</first-names></au><au><second-name>Ta-Shma</second-name><first-names>A</first-names></au><au><second-name>Vazirani</second-name><first-names>U V</first-names></au><au><second-name>Yao</second-name><first-names>A C</first-names></au></authors><year>2000</year><book-title>Proc. 32nd Annu. ACM Symp. on Theory of Computing <upright>(</upright>STOC 00<upright>)</upright> <upright>(</upright>Portland, USA<upright>)</upright></book-title><publication><place>New York</place><publisher>ACM</publisher></publication><pages>p 705</pages></book-ref><book-ref id="nj279271bib8" num="8"><authors><au><second-name>Ambainis</second-name><first-names>A</first-names></au></authors><year>2001</year><book-title>Proc. 33rd Annu. ACM Symp. on Theory of Computing <upright>(</upright>Hersonissos, Greece<upright>)</upright></book-title><publication><place>New York</place><publisher>ACM</publisher></publication><pages>p 134</pages></book-ref><journal-ref id="nj279271bib9" num="9"><authors><au><second-name>Spekkens</second-name><first-names>R W</first-names></au><au><second-name>Rudolph</second-name><first-names>T</first-names></au></authors><year>2002</year><jnl-title>Phys. Rev.</jnl-title><part>A</part><volume>65</volume><pages>012310</pages><crossref><cr_doi>http://dx.doi.org/10.1103/PhysRevA.65.012310</cr_doi><cr_issn type="print">10502947</cr_issn><cr_issn type="electronic">10941622</cr_issn></crossref></journal-ref><misc-ref id="nj279271bib10" num="10"><authors><au><second-name>Mochon</second-name><first-names>C</first-names></au></authors><year>2007</year><preprint-info><preprint>Preprint</preprint><art-number type="arxiv">0711.4114</art-number></preprint-info></misc-ref><book-ref id="nj279271bib11" num="11"><authors><au><second-name>Goldwasser</second-name><first-names>S</first-names></au><au><second-name>Micali</second-name><first-names>S</first-names></au></authors><year>1982</year><book-title>Proc. 14th Annu. ACM Symp. on Theory of Computing <upright>(</upright>San Francisco, USA<upright>)</upright></book-title><publication><place>New York</place><publisher>ACM</publisher></publication><pages>p 365</pages></book-ref><journal-ref id="nj279271bib12" num="12"><authors><au><second-name>Goldreich</second-name><first-names>O</first-names></au><au><second-name>Micali</second-name><first-names>S</first-names></au><au><second-name>Wigderson</second-name><first-names>A</first-names></au></authors><year>1991</year><jnl-title>J. ACM</jnl-title><volume>38</volume><pages>690</pages><crossref><cr_doi>http://dx.doi.org/10.1145/116825.116852</cr_doi><cr_issn type="print">00045411</cr_issn></crossref></journal-ref><journal-ref id="nj279271bib13" num="13"><authors><au><second-name>Damgard</second-name><first-names>I B</first-names></au><au><second-name>Fehr</second-name><first-names>S</first-names></au><au><second-name>Salvail</second-name><first-names>L</first-names></au><au><second-name>Schaffner</second-name><first-names>C</first-names></au></authors><year>2008</year><jnl-title>SIAM J. Comput.</jnl-title><volume>37</volume><pages>1865</pages><crossref><cr_doi>http://dx.doi.org/10.1137/060651343</cr_doi><cr_issn type="print">00975397</cr_issn></crossref></journal-ref><book-ref id="nj279271bib14" num="14"><authors><au><second-name>Amabainis</second-name><first-names>A</first-names></au><au><second-name>Buhrman</second-name><first-names>H</first-names></au><au><second-name>Dodis</second-name><first-names>Y</first-names></au><au><second-name>Rörig</second-name><first-names>H</first-names></au></authors><year>2004</year><book-title>Proc. 19th Annu. IEEE Conf. on Computational Complexity <upright>(</upright>Amherst, USA<upright>)</upright></book-title><publication><place>New York</place><publisher>IEEE</publisher></publication><pages>p 250</pages></book-ref><journal-ref id="nj279271bib15" num="15"><authors><au><second-name>Buhrman</second-name><first-names>H</first-names></au><au><second-name>Christandl</second-name><first-names>M</first-names></au><au><second-name>Hayden</second-name><first-names>P</first-names></au><au><second-name>Lo</second-name><first-names>H-K</first-names></au><au><second-name>Wehner</second-name><first-names>S</first-names></au></authors><year>2006</year><jnl-title>Phys. Rev. Lett.</jnl-title><volume>97</volume><pages>250501</pages><crossref><cr_doi>http://dx.doi.org/10.1103/PhysRevLett.97.250501</cr_doi><cr_issn type="print">00319007</cr_issn><cr_issn type="electronic">10797114</cr_issn></crossref></journal-ref><journal-ref id="nj279271bib16" num="16"><authors><au><second-name>Jain</second-name><first-names>R</first-names></au></authors><year>2008</year><jnl-title>J. Cryptol.</jnl-title><misc-text>to appear</misc-text><preprint-info><preprint>Preprint</preprint><art-number type="arxiv">quant-ph/0506001</art-number></preprint-info></journal-ref><book-ref id="nj279271bib17" num="17"><authors><au><second-name>Gutoski</second-name><first-names>G</first-names></au><au><second-name>Watrous</second-name><first-names>J</first-names></au></authors><year>2007</year><book-title>Proc. 39th ACM Symp. on Theory of Computing <upright>(</upright>San Diego, USA<upright>)</upright></book-title><publication><place>New York</place><publisher>ACM</publisher></publication><pages>p 565 </pages><preprint-info><preprint>Preprint</preprint><art-number type="arxiv">quant-ph/0611234v2</art-number></preprint-info></book-ref><journal-ref id="nj279271bib18" num="18"><authors><au><second-name>Molina-Terriza</second-name><first-names>G</first-names></au><au><second-name>Vaziri</second-name><first-names>A</first-names></au><au><second-name>Ursin</second-name><first-names>R</first-names></au><au><second-name>Zeilinger</second-name><first-names>A</first-names></au></authors><year>2005</year><jnl-title>Phys. Rev. Lett.</jnl-title><volume>94</volume><pages>040501</pages><crossref><cr_doi>http://dx.doi.org/10.1103/PhysRevLett.94.040501</cr_doi><cr_issn type="print">00319007</cr_issn><cr_issn type="electronic">10797114</cr_issn></crossref></journal-ref><journal-ref id="nj279271bib19" num="19"><authors><au><second-name>Lamoureux</second-name><first-names>L-Ph</first-names></au><au><second-name>Amans</second-name><first-names>D</first-names></au><au><second-name>Brainis</second-name><first-names>E</first-names></au><au><second-name>Barrett</second-name><first-names>J</first-names></au><au><second-name>Massar</second-name><first-names>S</first-names></au></authors><year>2005</year><jnl-title>Phys. Rev. Lett.</jnl-title><volume>94</volume><pages>050503</pages><crossref><cr_doi>http://dx.doi.org/10.1103/PhysRevLett.94.050503</cr_doi><cr_issn type="print">00319007</cr_issn><cr_issn type="electronic">10797114</cr_issn></crossref></journal-ref><book-ref id="nj279271bib20" num="20"><authors><au><second-name>Buhrman</second-name><first-names>H</first-names></au><others><italic>et al</italic></others></authors><year>2007</year><art-title>High entropy random selection protocols</art-title><book-title>Proc. 11th Int. Workshop on Randomization and Computation <upright>(</upright>RANDOM07<upright>)</upright> <upright>(</upright>Boston, USA<upright>)</upright> Approximation, Randomization and Combinatorial Optimization Algorithms and Techniques <upright>(</upright>Lecture Notes in Computer Science <upright>vol 4627)</upright></book-title><publication><place>Berlin</place><publisher>Springer</publisher></publication></book-ref><journal-ref id="nj279271bib21" num="21"><authors><au><second-name>Barrett</second-name><first-names>J</first-names></au><au><second-name>Massar</second-name><first-names>S</first-names></au></authors><year>2004</year><jnl-title>Phys. Rev.</jnl-title><part>A</part><volume>69</volume><pages>022322</pages><crossref><cr_doi>http://dx.doi.org/10.1103/PhysRevA.69.022322</cr_doi><cr_issn type="print">10502947</cr_issn><cr_issn type="electronic">10941622</cr_issn></crossref></journal-ref><misc-ref id="nj279271bib22" num="22"><authors><au><second-name>Mayers</second-name><first-names>D</first-names></au></authors><year>1996</year><preprint-info><preprint>Preprint</preprint><art-number type="arxiv">quant-ph/9605044</art-number></preprint-info></misc-ref><journal-ref id="nj279271bib23" num="23"><authors><au><second-name>Wallentowitz</second-name><first-names>S</first-names></au><au><second-name>Vogel</second-name><first-names>W</first-names></au></authors><year>1996</year><jnl-title>Phys. Rev.</jnl-title><part>A</part><volume>53</volume><pages>4528</pages><crossref><cr_doi>http://dx.doi.org/10.1103/PhysRevA.53.4528</cr_doi><cr_issn type="print">10502947</cr_issn><cr_issn type="electronic">10941622</cr_issn></crossref></journal-ref><journal-ref id="nj279271bib24" num="24"><authors><au><second-name>Ribordy</second-name><first-names>G</first-names></au><au><second-name>Gautier</second-name><first-names>J D</first-names></au><au><second-name>Gisin</second-name><first-names>N</first-names></au><au><second-name>Guinnard</second-name><first-names>O</first-names></au><au><second-name>Zbinden</second-name><first-names>H</first-names></au></authors><year>1998</year><jnl-title>Electron. Lett.</jnl-title><volume>34</volume><pages>2116</pages><crossref><cr_doi>http://dx.doi.org/10.1049/el:19981473</cr_doi><cr_issn type="print">00135194</cr_issn></crossref></journal-ref><journal-ref id="nj279271bib25" num="25"><authors><au><second-name>Legre</second-name><first-names>M</first-names></au><au><second-name>Zbinden</second-name><first-names>H</first-names></au><au><second-name>Gisin</second-name><first-names>N</first-names></au></authors><year>2006</year><jnl-title>Quantum Inf. Comput.</jnl-title><volume>6</volume><pages>326</pages></journal-ref><book-ref id="nj279271bib26" num="26"><authors><au><second-name>Berlin</second-name><first-names>G</first-names></au><au><second-name>Brassard</second-name><first-names>G</first-names></au><au><second-name>Bussières</second-name><first-names>F</first-names></au><au><second-name>Godbout</second-name><first-names>N</first-names></au></authors><year>2008</year><book-title>2nd Int. Conf. on Quantum, Nano, and Micro Technologies <upright>(</upright>ICQNM08<upright>)</upright> <upright>(</upright>Sainte Luce, Martinique<upright>)</upright></book-title><publication><place>New York</place><publisher>IEEE</publisher></publication><pages>p 1</pages></book-ref></reference-list></references></back></article></istex:document></istex:metadataXml><mods version="3.6"><titleInfo lang="eng"><title>Experimental quantum tossing of a single coin</title></titleInfo><titleInfo type="abbreviated"><title>Experimental quantum tossing of a single coin</title></titleInfo><titleInfo type="alternative" lang="eng"><title>Experimental quantum tossing of a single coin</title></titleInfo><name type="personal"><namePart type="given">A T</namePart><namePart type="family">Nguyen</namePart><affiliation>Service OPERA photonique, CP 194/5, Universit Libre de Bruxelles (ULB), Avenue F D Roosevelt 50, B-1050 Bruxelles, Belgium</affiliation><affiliation>Authors to whom any correspondence should be addressed.</affiliation><affiliation>E-mail: annguyen@ulb.ac.be</affiliation><role><roleTerm type="text">author</roleTerm></role></name><name type="personal"><namePart type="given">J</namePart><namePart type="family">Frison</namePart><affiliation>Laboratoire d'Information Quantique, CP 225, Universit Libre de Bruxelles (ULB), Boulevard du Triomphe, B-1050 Bruxelles, Belgium</affiliation><role><roleTerm type="text">author</roleTerm></role></name><name type="personal"><namePart type="given">K</namePart><namePart type="family">Phan Huy</namePart><affiliation>Dpartement d'Optique P M Duffieux, Institut FEMTO-ST, Centre National de la Recherche Scientifique UMR 6174, Universit de Franche-Comt, 25030 Besanon, France</affiliation><role><roleTerm type="text">author</roleTerm></role></name><name type="personal"><namePart type="given">S</namePart><namePart type="family">Massar</namePart><affiliation>Laboratoire d'Information Quantique, CP 225, Universit Libre de Bruxelles (ULB), Boulevard du Triomphe, B-1050 Bruxelles, Belgium</affiliation><affiliation>Authors to whom any correspondence should be addressed.</affiliation><affiliation>E-mail: smassar@ulb.ac.be</affiliation><role><roleTerm type="text">author</roleTerm></role></name><typeOfResource>text</typeOfResource><genre type="research-article" displayLabel="paper">paper</genre><originInfo><publisher>Institute of Physics Publishing</publisher><dateIssued encoding="w3cdtf">2008</dateIssued><copyrightDate encoding="w3cdtf">2008</copyrightDate></originInfo><language><languageTerm type="code" authority="iso639-2b">eng</languageTerm><languageTerm type="code" authority="rfc3066">en</languageTerm></language><physicalDescription><internetMediaType>text/html</internetMediaType></physicalDescription><abstract>The cryptographic protocol of coin tossing consists of two parties, Alice and Bob, who do not trust each other, but want to generate a random bit. If the parties use a classical communication channel and have unlimited computational resources, one of them can always cheat perfectly. If the parties use a quantum communication channel, there exist protocols such that neither party can cheat perfectly, although they may be able to significantly bias the coin. Here, we analyze in detail how the performance of a quantum coin tossing experiment should be compared to classical protocols, taking into account the inevitable experimental imperfections. We then report an all-optical fiber experiment in which a single coin is tossed whose randomness is higher than achievable by any classical protocol and present some easily realizable cheating strategies by Alice and Bob.</abstract><relatedItem type="host"><titleInfo><title>New Journal of Physics</title></titleInfo><titleInfo type="abbreviated"><title>New J. Phys.</title></titleInfo><genre type="journal">journal</genre><identifier type="ISSN">1367-2630</identifier><identifier type="eISSN">1367-2630</identifier><identifier type="PublisherID">nj</identifier><identifier type="CODEN">NJOPFM</identifier><identifier type="URL">stacks.iop.org/NJP</identifier><part><date>2008</date><detail type="volume"><caption>vol.</caption><number>10</number></detail><detail type="issue"><caption>no.</caption><number>8</number></detail><extent unit="pages"><start>1</start><end>13</end><total>13</total></extent></part></relatedItem><identifier type="istex">81DDD72A57BB19822DCAE26E04989E33052E2409</identifier><identifier type="DOI">10.1088/1367-2630/10/8/083037</identifier><identifier type="articleID">279271</identifier><identifier type="articleNumber">083037</identifier><accessCondition type="use and reproduction" contentType="copyright">IOP Publishing and Deutsche Physikalische Gesellschaft</accessCondition><recordInfo><recordContentSource>IOP</recordContentSource><recordOrigin>IOP Publishing and Deutsche Physikalische Gesellschaft</recordOrigin></recordInfo></mods></metadata><enrichments><json:item><type>multicat</type><uri>https://api.istex.fr/document/81DDD72A57BB19822DCAE26E04989E33052E2409/enrichments/multicat</uri></json:item></enrichments><serie></serie></istex></record>Pour manipuler ce document sous Unix (Dilib)
EXPLOR_STEP=$WICRI_ROOT/Wicri/Belgique/explor/OpenAccessBelV2/Data/Istex/Corpus
HfdSelect -h $EXPLOR_STEP/biblio.hfd -nk 001372 | SxmlIndent | more
Ou
HfdSelect -h $EXPLOR_AREA/Data/Istex/Corpus/biblio.hfd -nk 001372 | SxmlIndent | more
Pour mettre un lien sur cette page dans le réseau Wicri
{{Explor lien
|wiki= Wicri/Belgique
|area= OpenAccessBelV2
|flux= Istex
|étape= Corpus
|type= RBID
|clé= ISTEX:81DDD72A57BB19822DCAE26E04989E33052E2409
|texte= Experimental quantum tossing of a single coin
}}
| This area was generated with Dilib version V0.6.25. |  |