Quantum weak coin flipping with a single photon

Abstract

Weak coin flipping is among the fundamental cryptographic primitives which ensure the security of modern communication networks. It allows two mistrustful parties to remotely agree on a random bit when they favor opposite outcomes. Unlike other two-party computations, one can achieve information-theoretic security using quantum mechanics only: both parties are prevented from biasing the flip with probability higher than $1/2+\ensuremath{\epsilon}$, where $\ensuremath{\epsilon}$ is arbitrarily low. Classically, the dishonest party can always cheat with probability 1 unless computational assumptions are used. Despite its importance, no physical implementation has been proposed for quantum weak coin flipping. Here, we present a practical protocol that requires a single photon and linear optics only. We show that it is fair and balanced even when threshold single-photon detectors are used, and reaches a bias as low as $\ensuremath{\epsilon}=1/\sqrt{2}\ensuremath{-}1/2\ensuremath{\approx}0.207$. We further show that the protocol may display a quantum advantage over a few-hundred meters with state-of-the-art technology.