[Paper Review] Attacks on Symmetric Quantum Coin-Tossing Protocols

Boaz Leslau|ArXiv.org|Apr 15, 2001

Quantum Information and Cryptography2 references3 citations

TL;DR

This paper demonstrates a novel attack on the symmetric non-ideal quantum coin-tossing protocol MSC(99), showing that a cheater can bias the outcome toward 0 with a non-negligible bias of up to approximately 0.092, independent of protocol parameters. The attack exploits the trade-off between information gain and fidelity in quantum state distinguishability, revealing that MSC(99) is insecure despite its symmetric, slow information-flow design intended to prevent cheating.

ABSTRACT

We suggest an attack on a symmetric non-ideal quantum coin-tossing protocol suggested by Mayers Salvail and Chiba-Kohno. The analysis of the attack shows that the protocol is insecure.

Motivation & Objective

• To investigate the security of the symmetric, non-ideal quantum coin-tossing protocol MSC(99), which was claimed to achieve unconditionally secure coin tossing via slow, symmetric information accumulation.
• To analyze whether the protocol's symmetric information flow can truly prevent cheating, especially in the presence of a quantum adversary who can delay measurement.
• To demonstrate that even a protocol designed to limit cheating through gradual information disclosure remains vulnerable to a strategic measurement attack.
• To quantify the intrinsic bias a cheater can induce by exploiting the relationship between fidelity and distinguishability in quantum states.

Proposed method

• The attack models a cheater (Bob*) who remains unitary and coherent until he has gained moderate but sufficient information about the protocol outcome, then measures to collapse the state toward his desired result.
• The attack uses the fidelity between density matrices representing the two possible outcomes (0 and 1) as a measure of distinguishability, derived from the transition probability and quantum state overlap.
• Key equations include the error probability in state discrimination (PE) and the fidelity (F) between density matrices, with F(ρ₀,ρ₁) = √P(ρ₀,ρ₁) and F(ρ₀,ρ₁) = tr√(√ρ₀ρ₁√ρ₀).
• The analysis uses the statistical overlap of binomial distributions to approximate the fidelity F^l(ρ₀,ρ₁) ≈ Erf(α/√2), where α depends on the deviation from equal probability.
• The attack's success is quantified by computing the probability P(X=0) using the fidelity and error probability, leading to a lower bound on the bias independent of protocol parameters.
• The optimal attack time is derived by maximizing the bias, showing it peaks when the participant's knowledge K ≈ 0.511, corresponding to a maximum bias of ~0.09195.

Experimental results

Research questions

• RQ1 Can a symmetric quantum coin-tossing protocol like MSC(99) remain secure against a cheater who delays measurement until gaining partial information?
• RQ2 What is the maximum bias a cheater can induce in a non-ideal quantum coin-tossing protocol through strategic measurement timing?
• RQ3 How does the trade-off between information gain and state distinguishability (fidelity) affect the security of symmetric quantum protocols?
• RQ4 Does the slow, symmetric information accumulation in MSC(99) truly prevent cheating, or can it be exploited by a coherent attacker?

Key findings

• The attack achieves a non-negligible bias of up to approximately 0.09195 toward the desired outcome, which is independent of the protocol's parameters (c, s, n, m), as long as m is large enough.
• The maximum bias occurs when the cheater's knowledge K ≈ 0.510964, indicating that even slight information advantage leads to significant bias.
• The bias is intrinsic to the quantum information trade-off in the parity bit problem and arises from the fidelity between density matrices representing the two outcomes.
• The attack is effective regardless of the protocol's design details, as it relies only on the general structure of state distinguishability and fidelity, making it broadly applicable to similar protocols.
• The attack does not require any deviation from the protocol's quantum rules; the cheater remains coherent until measurement, making detection impossible.
• The results show that MSC(99) is insecure, despite its symmetric and gradual information disclosure, because the fidelity-based distinguishability allows a strategic measurement to bias the outcome.