Pooling quantum states obtained by indirect measurements

We consider the pooling of quantum states when Alice and Bob both have one part of a tripartite system and, on the basis of measurements on their respective parts, each infers a quantum state for the third part S. We denote the conditioned states which Alice and Bob assign to S by alpha and beta respectively, while the unconditioned state of S is rho. The state assigned by an overseer, who has all the data available to Alice and Bob, is omega. The pooler is told only alpha, beta, and rho. We show that for certain classes of tripartite states, this information is enough for her to reconstruct omega by the formula omega \propto alpha rho^{-1} beta. Specifically, we identify two classes of states for which this pooling formula works: (i) all pure states for which the rank of rho is equal to the product of the ranks of the states of Alice's and Bob's subsystems; (ii) all mixtures of tripartite product states that are mutually orthogonal on S.Comment: Corrected a mistake regarding the scope of our original result. This version to be published in Phys. Rev. A. 6 pages, 1 figur

A large family of quantum weak coin-flipping protocols

Each classical public-coin protocol for coin flipping is naturally associated with a quantum protocol for weak coin flipping. The quantum protocol is obtained by replacing classical randomness with quantum entanglement and by adding a cheat detection test in the last round that verifies the integrity of this entanglement. The set of such protocols defines a family which contains the protocol with bias 0.192 previously found by the author, as well as protocols with bias as low as 1/6 described herein. The family is analyzed by identifying a set of optimal protocols for every number of messages. In the end, tight lower bounds for the bias are obtained which prove that 1/6 is optimal for all protocols within the family.Comment: 17 pages, REVTeX 4 (minor corrections in v2

A quantum protocol for cheat-sensitive weak coin flipping

We present a quantum protocol for the task of weak coin flipping. We find that, for one choice of parameters in the protocol, the maximum probability of a dishonest party winning the coin flip if the other party is honest is 1/sqrt(2). We also show that if parties restrict themselves to strategies wherein they cannot be caught cheating, their maximum probability of winning can be even smaller. As such, the protocol offers additional security in the form of cheat sensitivity.Comment: 4 pages RevTex. Differs from the journal version only in that the sentences: "The ordering of the authors on this paper was chosen by a coin flip implemented by a trusted third party. TR lost." have not been remove

On bit-commitment based quantum coin flipping

In this paper, we focus on a special framework for quantum coin flipping protocols,_bit-commitment based protocols_, within which almost all known protocols fit. We show a lower bound of 1/16 for the bias in any such protocol. We also analyse a sequence of multi-round protocol that tries to overcome the drawbacks of the previously proposed protocols, in order to lower the bias. We show an intricate cheating strategy for this sequence, which leads to a bias of 1/4. This indicates that a bias of 1/4 might be optimal in such protocols, and also demonstrates that a cleverer proof technique may be required to show this optimality.Comment: The lower bound shown in this paper is superceded by a result of Kitaev (personal communication, 2001

Serial composition of quantum coin-flipping, and bounds on cheat detection for bit-commitment

Quantum protocols for coin-flipping can be composed in series in such a way that a cheating party gains no extra advantage from using entanglement between different rounds. This composition principle applies to coin-flipping protocols with cheat sensitivity as well, and is used to derive two results: There are no quantum strong coin-flipping protocols with cheat sensitivity that is linear in the bias (or bit-commitment protocols with linear cheat detection) because these can be composed to produce strong coin-flipping with arbitrarily small bias. On the other hand, it appears that quadratic cheat detection cannot be composed in series to obtain even weak coin-flipping with arbitrarily small bias.Comment: 7 pages, REVTeX 4 (minor corrections in v2

Tight bounds for classical and quantum coin flipping

Coin flipping is a cryptographic primitive for which strictly better protocols exist if the players are not only allowed to exchange classical, but also quantum messages. During the past few years, several results have appeared which give a tight bound on the range of implementable unconditionally secure coin flips, both in the classical as well as in the quantum setting and for both weak as well as strong coin flipping. But the picture is still incomplete: in the quantum setting, all results consider only protocols with perfect correctness, and in the classical setting tight bounds for strong coin flipping are still missing. We give a general definition of coin flipping which unifies the notion of strong and weak coin flipping (it contains both of them as special cases) and allows the honest players to abort with a certain probability. We give tight bounds on the achievable range of parameters both in the classical and in the quantum setting.Comment: 18 pages, 2 figures; v2: published versio