Physical Limitations of Quantum Cryptographic Primitives or Optimal Bounds for Quantum Coin Flipping and Bit Commitment

International audienceCoin flipping and bit commitment are two fundamental cryptographic primitiveswith numerous applications. Quantum information allows for such protocols in the information theoreticsetting where no dishonest party can perfectly cheat. The previously best-known quantumcoin flipping and bit commitment protocol by Ambainis achieved a cheating probability of at most3/4 [A. Ambainis, Proceedings of the 30th Annual ACM Symposium on Theory of Computing, Washington,DC, IEEE Computer Society, 2001]. On the other hand, Kitaev showed that no quantumcoin flipping or bit commitment protocol can have cheating probability less than 1/√2 [A. Kitaev,Presentation at the 6th Workshop on Quantum Information Processing (QIP), 2003]. Closing thesegaps has been one of the important open questions in quantum cryptography. In this paper, weresolve both questions. First, we present a quantum strong coin flipping protocol with cheatingprobability arbitrarily close to 1/√2. More precisely, we show how to use any weak coin flippingprotocol with cheating probability 1/2 + ε in order to achieve a strong coin flipping protocol withcheating probability 1/√2 + O(ε). The optimal quantum strong coin flipping protocol follows fromour construction and the optimal quantum weak coin flipping protocol described by [C. Mochon,arXiv:0711.4114, 2007]. Second, we provide the optimal bound for quantum bit commitment. Onthe one hand, we show a lower bound of approximately γ ≈ 0.739, improving Kitaev’s lower bound.On the other hand, we present an optimal quantum bit commitment protocol which has cheatingprobability arbitrarily close to γ. More precisely, we show how to use any weak coin flipping protocolwith cheating probability 1/2 + ε in order to achieve a quantum bit commitment protocol withcheating probability γ + O(ε). To obtain the final protocol, we then use the optimal quantum weakcoin flipping protocol described by [C. Mochon, arXiv:0711.4114, 2007]. Unlike the previous protocolfor coin flipping, our protocol uses quantum effects beyond the weak coin flip. To stress this fact, weadditionally show that any classical bit commitment protocol with access to perfect weak (or strong)coin flipping has cheating probability at least 3/4