Quantum and Classical Coin-Flipping Protocols based on Bit-Commitment and their Point Games

Transcription

1 Quantum and Classical Coin-Fliing Protocols based on Bit-Commitment and their Point Games Ashwin Nayak, Jamie Sikora, Levent Tunçel Follow-u work to a aer that will aear on the arxiv on Monday Berkeley 204

2 Fun with Cryto SDPs

3 (Weak) Coin-Fliing Cheating definitions PA,0 := max Pr[Alice can force outcome 0] PA, := max Pr[Alice can force outcome ] PB,0 := max Pr[Bob can force outcome 0] Weak P B, := max Pr[Bob can force outcome ] Coin-Fliing a a We have good weak coin-fliing rotocols (Mochon 2007, Iordanis talk)

4 (Strong) Coin-Fliing Cheating definitions Strong PA,0 := max Pr[Alice can force outcome 0] PA, := max Pr[Alice can force outcome ] PB,0 := max Pr[Bob can force outcome 0] PB, := max Pr[Bob can force outcome ] Coin-Fliing a a Classical: max{p A,0,P A,,P B,0,P B,} < is imossible Otimal strong Quantum: max{p A,0,P A,,P B,0,P B,} =/2 is imossible coin-fliing rotocols? [Lo, Chau 997] Quantum: max{pa,0,p A,,P B,0,P B,} < is ossible [Aharonov, Ta-Shma, Vazirani, Yao 2000]

5 (Strong) Coin-Fliing Otimal Bounds P A,0P B,0 /2 for every rotocol [Kitaev 2002] [Gutoski, Watrous 2007] Strong Coin-Fliing max{p A,0,P A,,P B,0,P B,} ale / 2+ is ossible for any > 0 [Chailloux and Kerenidis 2009] a a Based on weak coin-fliing! How can we find better coin-fliing rotocols? How do we rove coin-fliing rotocol security?

6 (Strong) Coin-Fliing Otimal Bounds P A,0P B,0 /2 for every rotocol [Kitaev 2002] [Gutoski, Watrous 2007] Strong Coin-Fliing max{p A,0,P A,,P B,0,P B,} ale / 2+ is ossible for any > 0 [Chailloux and Kerenidis 2009] a a Based on weak coin-fliing! How can we find better coin-fliing rotocols? How do we rove coin-fliing rotocol security?

7 (Strong) Coin-Fliing Otimal Bounds P A,0P B,0 /2 for every rotocol [Kitaev 2002] [Gutoski, Watrous 2007] Strong Coin-Fliing max{p A,0,P A,,P B,0,P B,} ale / 2+ is ossible for any > 0 [Chailloux and Kerenidis 2009] a a Based on weak coin-fliing! How can we find good and simle coin-fliing rotocols? How do we rove coin-fliing rotocol security?

8 Bad Coin-Fliing Protocol Alice chooses a uniformly at random Bob chooses b uniformly at random Alice sends a to Bob Bob sends b to Alice Alice oututs a b Bob oututs a b

9 Bad Coin-Fliing Protocol Alice chooses a uniformly at random Bob chooses b uniformly at random Alice oututs a b Alice sends a to Bob Bob sends b to Alice P B,0 = P B, = Before sending b, Bob can change it and Alice wouldn t know better Bob oututs a b

10 Bad Coin-Fliing Protocol Alice chooses a uniformly at random Alice cannot cheat at all Alice oututs a b Alice sends a to Bob Bob sends b to Alice PB,0 = PB, = PA,0 = PA, =/2 Bob chooses b uniformly at random Before sending b, Bob can change it and Alice wouldn t know better Bob oututs a b

11 Alice chooses a uniformly at random Alice cannot cheat at all Bad Coin-Fliing Protocol BAD Alice sends a to Bob Bob sends b to Alice Bob chooses b uniformly at random Before sending b, Bob can change it and Alice wouldn t know better Alice oututs a b P B,0 = P B, = P A,0 = P A, =/2 Bob oututs a b

12 Quantum Coin-Fliing Protocol Construction Alice creates a in suerosition Controlled on a, she creates a,x x, xi X a i := x for some robability vector a Thus, she creates the state below: i := X a X a, ai 2 x a,x x, xi For Alice For Bob Extra x for cheat detection

13 Quantum Coin-Fliing Protocol Construction Bob creates b in suerosition Controlled on b, he creates bi := X y b,y y, yi for some robability vector b Thus, he creates the state below: i := X b X b, bi 2 y b,y y, yi For Bob For Alice Extra y for cheat detection

14 Quantum Coin-Fliing Protocol Alice creates the quantum state i := X a 2 a, ai X x a,x x, xi Bob creates the quantum state i := X b 2 b, bi X y b,y y, yi For i = to n Alice sends xi (from second x register) to Bob Bob sends yi (from second y register) to Alice Alice sends a,x to Bob Bob sends b,y to Alice Alice measures to determine: () The value of a b (2) If Bob cheated Bob measures to determine: () The value of a b (2) If Alice cheated

15 Quantum Coin-Fliing Protocol Alice creates the quantum state i := X a 2 a, ai X x a,x x, xi Bob creates the quantum state i := X b 2 b, bi X y b,y y, yi a a x xx2x3 bby yy2 y3

16 Quantum Coin-Fliing Protocol Alice creates the quantum state i := X a 2 a, ai X x a,x x, xi Bob creates the quantum state i := X b 2 b, bi X y b,y y, yi a a x x2x3 bby xyy2 y3

17 Quantum Coin-Fliing Protocol Alice creates the quantum state i := X a 2 a, ai X x a,x x, xi Bob creates the quantum state i := X b 2 b, bi X y b,y y, yi a a x yx2x3 bby x y2 y3

18 Quantum Coin-Fliing Protocol Alice creates the quantum state i := X a 2 a, ai X x a,x x, xi Bob creates the quantum state i := X b 2 b, bi X y b,y y, yi a a x y x3 bby xx2 y2 y3

19 Quantum Coin-Fliing Protocol Alice creates the quantum state i := X a 2 a, ai X x a,x x, xi Bob creates the quantum state i := X b 2 b, bi X y b,y y, yi a a x y2 y x3 bby xx2 y3

20 Quantum Coin-Fliing Protocol Alice creates the quantum state i := X a 2 a, ai X x a,x x, xi Bob creates the quantum state i := X b 2 b, bi X y b,y y, yi a a x yy2 bby xx2x3 y3

21 Quantum Coin-Fliing Protocol Alice creates the quantum state i := X a 2 a, ai X x a,x x, xi Bob creates the quantum state i := X b 2 b, bi X y b,y y, yi a a x yy2 y3 bby xx2x3

22 Quantum Coin-Fliing Protocol Alice creates the quantum state i := X a 2 a, ai X x a,x x, xi Bob creates the quantum state i := X b 2 b, bi X y b,y y, yi a y bby a x y2y3 xx2x3

23 Quantum Coin-Fliing Protocol Alice creates the quantum state i := X a 2 a, ai X x a,x x, xi Bob creates the quantum state i := X b 2 b, bi X y b,y y, yi a b y yy2 y3 b a x xx2x3

24 Quantum Coin-Fliing Protocol Alice creates the quantum state i := X a 2 a, ai X x a,x x, xi Bob creates the quantum state i := X b 2 b, bi X y b,y y, yi Outcome? a b y yy2 y3 b a x xx2 x3 Alice measures to learn a and b. Deending on b, she measures y, y, y2, y3 to see if it s in the state bi := X y b,y y, yi

25 Quantum Coin-Fliing Protocol Alice creates the quantum state i := X a 2 a, ai X x a,x x, xi Bob creates the quantum state i := X b 2 b, bi X y b,y y, yi Bob cheated? a b y yy2 y3 b a x xx2 x3 Alice measures to learn a and b. Deending on b, she measures y, y, y2, y3 to see if it s in the state bi := X y b,y y, yi

26 Quantum Coin-Fliing Protocol Alice creates the quantum state i := X a 2 a, ai X x a,x x, xi Bob creates the quantum state i := X b 2 b, bi X y b,y y, yi Outcome? a b y yy2 y3 b a x xx2 x3 Bob measures to learn a and b. Deending on a, he measures x, x, x2, x3 to see if it s in the state a i := X x a,x x, xi

27 Quantum Coin-Fliing Protocol Alice creates the quantum state i := X a 2 a, ai X x a,x x, xi Bob creates the quantum state i := X b 2 b, bi X y b,y y, yi Alice cheated? a b y yy2 y3 b a x xx2 x3 Bob measures to learn a and b. Deending on a, he measures x, x, x2, x3 to see if it s in the state a i := X x a,x x, xi

28 Calculating the cheating robabilities as SDPs Probability Bob PA,0 = su h F, B,0 i s.t. Tr X ( ) = ih Tr X2 ( 2 ) = Tr Y ( ) oututs 0. Tr Xn ( n ) = Tr Yn ( n ) Tr X,A ( F ) = Tr Yn ( n ) i 0 Variables are Bob s quantum states throughout the rotocol Alice cannot alter all of Bob s state

29 PA,0 = su h F, B,0 i s.t. Tr X ( ) = ih Tr X2 ( 2 ) = Tr Y ( ). Tr Xn ( n ) = Tr Yn ( n ) Tr X,A ( F ) = Tr Yn ( n ) i 0

30 PA,0 = su h F, B,0 i s.t. Tr X ( ) = ih Tr X2 ( 2 ) = Tr Y ( ). Tr Xn ( n ) = Tr Yn ( n ) Tr X,A ( F ) = Tr Yn ( n ) i 0 = su 2 P a P y a,yf (s (a,y), a ) s.t. Tr X (s ) = Tr X2 (s 2 ) = s e Y. Tr Xn (s n ) = s n e Yn Tr A (s) = s n e Yn s, s i 0

31 PA,0 = su h F, B,0 i s.t. Tr X ( ) = ih Tr X2 ( 2 ) = Tr Y ( ). Tr Xn ( n ) = Tr Yn ( n ) Tr X,A ( F ) = Tr Yn ( n ) i 0 = su 2 P a P y a,yf (s (a,y), a ) s.t. Tr X (s ) = Tr X2 (s 2 ) = s e Y. Tr Xn (s n ) = s n e Yn Tr A (s) = s n e Yn s, s i 0 Polytoe!

32 PA,0 = su h F, B,0 i s.t. Tr X ( ) = ih Tr X2 ( 2 ) = Tr Y ( ). Tr Xn ( n ) = Tr Yn ( n ) Tr X,A ( F ) = Tr Yn ( n ) i 0 Not a olytoe! = su 2 P a P y a,yf (s (a,y), a ) s.t. Tr X (s ) = Tr X2 (s 2 ) = s e Y. Tr Xn (s n ) = s n e Yn Tr A (s) = s n e Yn s, s i 0 Polytoe!

33 PA,0 = su h F, B,0 i s.t. Tr X ( ) = ih Tr X2 ( 2 ) = Tr Y ( ). Tr Xn ( n ) = Tr Yn ( n ) Tr X,A ( F ) = Tr Yn ( n ) i 0 Not a olytoe! = su 2 P a P y a,yf (s (a,y), a ) s.t. Tr X (s ) = Tr X2 (s 2 ) = s e Y. Tr Xn (s n ) = s n e Yn Tr A (s) = s n e Yn s, s i 0 Polytoe!

34 PA,0 = su h F, B,0 i s.t. Tr X ( ) = ih Tr X2 ( 2 ) = Tr Y ( ). Tr Xn ( n ) = Tr Yn ( n ) Tr X,A ( F ) = Tr Yn ( n ) i 0 Not a olytoe! = su 2 P a P y a,yf (s (a,y), a ) s.t. Tr X (s ) = Tr X2 (s 2 ) = s e Y. Tr Xn (s n ) = s n e Yn Tr A (s) = s n e Yn s, s i 0 Polytoe! Similar SDPs and reductions for the other cheating robabilities

35 We have SDP formulations (and their simlifications)

36 Point Games!

37 Point Game Idea Start with two oints [,0] and [0,], each with robability /2. The idea is to merge the oints/robabilities into a single oint Points are eigenvalues of dual variables. The idea is to stri away the messy basis information Notation: q [x,y] is oint [x,y] with robability q

38 Basic Point Game Moves Point Raising: q[x, y]! q[x 0,y] (x 0 x) Point Merging: nx q i [x i,y]! nx q i! alepn i= q ix i P n i= q i,y i= i=

39 Easy Point Game /2

40 Easy Point Game Raised oint /2

41 Easy Point Game Merged two oints /2

42 Easy Point Game Final oint /2

43 Another Easy Point Game /2

44 Another Easy Point Game Raised this oint /2

45 Another Easy Point Game Merged two oints /2 Final oint

46 Another Easy Point Game /2 Final oint

47 Basic Point Game Moves Point Raising: q[x, y]! q[x 0,y] (x 0 x) Point Merging: nx q i [x i,y]! nx q i! alepn i= q ix i P n i= q i,y i= i= Point Slitting: nx i= q i! 2 4 P n i= q i,y5! q i i= x i Pn 3 nx i= q i [x i,y]

48 Bob s Dual P B, := min Px (w ) x s.t. (w ) x Px 2 (w 2 ) x,y,x 2 (w 2 ) x,y,x 2 Px 3 (w 3 ) x,y,x 2,y 2,x 3 (w n ) x,y,...,x n Pa 2 a,xv a,y Diag(v a ) T ā ā.

49 Bob s Dual P B, := min Px (w ) x s.t. (w ) x Px 2 (w 2 ) x,y,x 2 (w 2 ) x,y,x 2 Px 3 (w 3 ) x,y,x 2,y 2,x 3. (w n ) x,y,...,x n Pa 2 a,xv a,y Diag(v a ) T X ā ā () y ā,y v a,y ale

50 Uer bound on Bob s Dual cheating Point Merges P B, := min Px (w ) x s.t. (w ) x Px 2 (w 2 ) x,y,x 2 (w 2 ) x,y,x 2 Px 3 (w 3 ) x,y,x 2,y 2,x 3 Point Raises. (w n ) x,y,...,x n Pa 2 a,xv a,y Diag(v a ) T ā ā () X y ā,y v a,y ale Point Slits

51 Alice s Dual P A,0 := min z s.t. z Py (z 2 ) x,y (z 2 ) x,y Py 2 (z 3 ) x,y,x 2,y 2 (z n ) x,y,...,x n,y n (z n+ ) x,y Diag(z (y) n+ ) 2 a,y a a T.

52 Uer bounds Alice s Dual Alice cheating Point Merges P A,0 := min z s.t. z Py (z 2 ) x,y (z 2 ) x,y Py 2 (z 3 ) x,y,x 2,y 2 Point Raises Point Slits (z n ) x,y,...,x n,y n (z n+ ) x,y Diag(z (y) n+ ) 2 a,y a a T. () X y a,y a,x 2(z n+ ) x,y ale

53 Duals P B, := min Px (w ) x s.t. (w ) x Px 2 (w 2 ) x,y,x 2 (w 2 ) x,y,x 2 Px 3 (w 3 ) x,y,x 2,y 2,x 3 (w n ) x,y,...,x n Pa 2 a,xv a,y Diag(v a ) T ā ā. P A,0 := min z s.t. z Py (z 2 ) x,y (z 2 ) x,y Py 2 (z 3 ) x,y,x 2,y 2 (z n ) x,y,...,x n,y n (z n+ ) x,y Diag(z (y) n+ ) 2 a,y a a T.

54 Quantum Point Game ( of 3)

55 Quantum Point Game (2 of 3)

56 Quantum Point Game (3 of 3)

57 Quantum Point Game (3 of 3) Final oint [ B,, A,0 ] (w ) x so P B, ale B, A,0 = z so P A,0 ale A,0

58 Point Game Usefulness Final oint [ B,, A,0 ] (w ) x so P B, ale B, A,0 = z so P A,0 ale A,0

59 Point Game Usefulness Weak Duality: PB, ale B, PA,0 ale A,0 Final oint [ B,, A,0 ] Strong Duality: P B, = B, P A,0 = A,0 is ossible

60 Point Game Usefulness Weak Duality: PB, ale B, PA,0 ale A,0 Strong Duality: P B, = B, P A,0 = A,0 Bounds weak Final oint [ B,, A,0 ] coin-fliing only! is ossible

61 Point Game Usefulness Weak Duality: PB, ale B, PA,0 ale A,0 Final oint [ B,, A,0 ] Strong Duality: P B, = B, P A,0 = A,0 is ossible Can be aired to bound the other two cheating robabilities as well

62 Point Game Usefulness Weak Duality: PB, ale B, PA,0 ale A,0 Strong Duality: P B, = B, P A,0 = A,0 Bounds strong Final oint [ B,, A,0 ] coin-fliing now! is ossible Can be aired to bound the other two cheating robabilities as well

63 Classical Point Games!

64 Classical Point Game (Favouring Cheating Alice) Final oint [ (Tr A 2 A n (α 0 ), Tr A2 A n (α )), ]

65 Classical Point Game (Favouring Cheating Bob) Final oint [, (β 0, β ) ]

66 Quantum security from studying classical rotocols... We have a classical equivalence as well Classical oint games have large final oints Classical coin-fliing rotocols are insecure At most one arty can cheat erfectly (holds in the classical and quantum case) Quantum rotocols (of this form) cannot saturate Kitaev s lower bound

67 Oen questions Can we find otimal rotocols within this family? (We conjecture 3/4 is otimal from numerical tests) Can time-indeendent oint games (TIPGs) be used to simlify things? Can we find oint games for strong coin-fliing? What are the otimal solutions to the SDPs?

68 Oen questions Can we find otimal rotocols within this family? (We conjecture 3/4 is otimal from numerical tests) Can time-indeendent oint games (TIPGs) be used to simlify things? Can we find oint games for strong coin-fliing? What are the otimal solutions to the SDPs? Thank you!