Weak Coin Flipping

quantum-computing
cryptography
Alice wants 1, Bob wants 0
they both know which outcome the other wants
first protocol
- Alice generates a Bell-ish state `\sqrt{\alpha}\ket{00} + \sqrt{1-\alpha}\ket{11}`
- Alice sends one of these qubits to Bob
- Bob attaches a qubit by mapping `\ket{0} \mapsto \sqrt{a}\ket{0}\ket{b=0} + \sqrt{1-\alpha}\ket{0}\ket{b=1}` and `\ket{1}\mapsto\ket{1}\ket{b=1}`
- a whole view of our state is `\sqrt{\alpha}\sqrt{\alpha} \ket{00,b=0} + \sqrt{1-a}\sqrt{a}\ket{00,b=1} + \sqrt{1-a}\ket{11,b=1}`
  - if we measure `b=0` we result in the state `\ket{00}`, but if we measure `b=1` we result in the state `\sqrt{\alpha}\ket{00} + \ket{11}`
- if Bob measures `b=0`, Bob sends back his qubit, so Alice should be able to verify that she has `\ket{00}`
- if Bob measures `b=1`, Bob asks Alice to send her qubit, and Bob verifies that he has `\sqrt{\alpha}\ket{00} + \ket{11}`
- tldr the person who is about to lose verifies that they weren't tricked
- if we choose `\alpha = \frac{1}{\sqrt{2}}`, they can cheat with only `71\%` probability: this differs from strong-coin-flipping because we already know the output both parties desire
a better protocol requires higher dimensions
- the idea is that we do weak measurements and pass information back and forth
- we can change the "skew" of a superposition this way
we can get arbitrarily close to `\frac{1}{2}` probability of cheating: gain over classical where weak coin flipping is completely impossible