PRL 94, 040501 (2005) P H Y S I C A L R E V I E W L E T T E R S week ending4 FEBRUARY 2005

Experimental Quantum Coin Tossing

G. Molina-Terriza,1,* A. Vaziri,1,† R. Ursin,1 and A. Zeilinger1,2

1Institut fur Experimentalphysik, Universitat Wien, Boltzmanngasse 5, A-1090, Vienna, Austria2Institute for Quantum Optics and Quantum Information, Austrian Academy of Sciences, Vienna, Austria

(Received 1 March 2004; published 31 January 2005)

0031-9007=

In this Letter we present the first implementation of a quantum coin-tossing protocol. This protocolbelongs to a class of ‘‘two-party’’ cryptographic problems, where the communication partners distrusteach other. As with a number of such two-party protocols, the best implementation of the quantum cointossing requires qutrits, resulting in a higher security than using qubits. In this way, we have alsoperformed the first complete quantum communication protocol with qutrits. In our experiment the twopartners succeeded to remotely toss a row of coins using photons entangled in the orbital angularmomentum. We also show the experimental bounds of a possible cheater and the ways of detecting him.

DOI: 10.1103/PhysRevLett.94.040501 PACS numbers: 03.67.Hk, 03.67.Dd, 42.65.Lm

Set Label Alice’s States Coin Bob’s Bases Label

1 A11 (|0 + |1 )/√2 Heads (1)(|0 + |1 )/√2 B11

(|0 1 )/√2 B12

1 A12 (|0 1 )/√2 Heads (1) |2 B13

2 A21 (|0 + |2 )/√2 Tails (0)(|0 + |2 )/√2 B21

(|0 2 )/√2 B22

2 A22 (|0 2 )/√2 Tails (0) |1 B23

FIG. 1. Here we show the four different states sent by Aliceand the bases used by Bob to properly characterize the incomingphoton. The Alice’s states are divided into two sets of two states.Each set represents a particular side of the coin. Bob uses twobases, corresponding to Alice’s states, each expanded by onefurther orthogonal state. The label of the states eases theirrecognition in Fig. 2.

In the original ‘‘coin-tossing’’ protocol, Alice and Bobhad just divorced and did not want to ever see each otheragain but they had to decide who kept the dog [1]. As theydid not trust any third party as a referee, they agreed to tossa coin. How could Bob be sure that Alice is honest whenshe said ‘‘It was tails. . .you lost’’ if he could not see theoutcome of the toss? This protocol belongs to a set of novelcryptographic problems like mail certification, remote con-tract signing, and mental poker, where, instead of rulingout an eavesdropper, the problem is that the communicat-ing partners do not trust each other. Other examples of thisso called ‘‘post cold war’’ protocols are ‘‘bit commitment’’or the computation of a function with distributed inputs [2].

This kind of protocol is receiving increased attentionfrom the cryptographic and quantum information com-munities. Although the perfect security of some ‘‘two-party’’ protocols seems impossible [3], it is unclear whichbounds can be imposed on the security. Also, it has beensuggested that quantum mechanics can be derived frompurely quantum information postulates, like the security ofquantum key distribution and the impossibility of perfectquantum bit commitment [4].

In a solution for coin tossing Alice throws the coin, locksit in a ‘‘box’’ and sends it to Bob, who has the proof that thecoin was thrown, but cannot see the actual result. Bobmakes his bet and, upon receiving it, Alice sends the keyto Bob, who unlocks the result [5]. In general, there is noclassical protocol which allows unrestricted securityagainst cheating for the coin-tossing protocols.

In quantum coin tossing [7,6,8–10], we replace the boxby a quantum state. Alice encodes the result of the throw ofthe coin by choosing one among a series of nonorthogonalstates and sends it to Bob. Without previous knowledge,Bob cannot know with certainty which of the states hepossesses. At this point, Bob makes his bet. To ‘‘unlock’’the state, Alice now tells Bob which state she sent and thenhe measures it to check Alice’s honesty.

If Bob’s measurement identifies Alice’s predicted state,the protocol is a success. Otherwise, Alice and Bob con-

05=94(4)=040501(4)$23.00 04050

sider the throw as a ‘‘failure’’. Contrary to the classicalcase, this coin tossing scheme limits the chances of acheater to succeed. We will show that cheating can bedetected when the failures increase over the statisticalerrors.

Our implemented protocol is based on a proposal byAmbainis [6] using three-dimensional quantum states(‘‘qutrits’’). The series of states that Alice can send andthe correspondent throw of the coin are presented in thetable shown in Fig. 1. Alice’s states are divided into twosets, each of them containing two orthogonal states. Statesof one set have a nonvanishing projection onto states of theother set. Bob needs two different measuring bases in orderto determine the state of each possible photon sent byAlice. Each of Bob’s bases (Fig. 1) contains, besides

1-1 2005 The American Physical Society

PRL 94, 040501 (2005) P H Y S I C A L R E V I E W L E T T E R S week ending4 FEBRUARY 2005

Alice’s states of the corresponding set, a third orthogonalstate. These additional states are crucial for increasing thechances to detect cheating, as we will show below.

The maximum probability that one of the partners biasesthe result without being noticed is 25% [6]. This limits thetheoretical probability of a cheater to win to 75% since inany coin tossing the probability to win is 50% anyway.Spekkens and Rudolph [7] proofed that no similar proto-col, i.e., strong coin-tossing protocols based on bit commit-ment where Alice supplies the state, can improve thesecurity and, in particular, using qubits instead of qutritswill always make the protocol more insecure. On the otherhand the effect of noise in any protocol reduces the security[11]. For example a noisy qutrit protocol can be less securethan a perfect qubit protocol. We will show below that ourexperiment was robust enough to noise and was moresecure than any similar qubit protocol. It is yet unclear ifnew protocols based on completely different schemescould perform better, either with qunits or with qubits.This raises the interesting question of which problemscan be more efficiently solved with higher dimensionalstates [12].

In our proof of principle experiment (Fig. 2), Alicepossesses a source of orbital angular momentum entangledphotons [13,14]. She keeps one photon of each pair andsends the other one to Bob. By projecting her photon onto acertain state, she nonlocally projects Bob’s photon ontoany state of the states shown in Fig. 1. The detection of thephoton by Alice is the signal which confirms that a suitablephoton carrying an orbital angular momentum qutrit hasbeen sent to Bob [15]. Alice sends the electronic triggeringsignal to Bob. Once Bob receives the signal, he sends hisbet to Alice. Now she tells Bob which was the state. Then

Bob

Pump beam

Alice

BBO

Set 1 Set 2

B11

B12

B13

B23

B21

B22

A11

A12

A21

A22

FIG. 2 (color online). Diagram of the setup. Alice possesses asource of entangled photons. Using beam splitters, she projectsprobabilistically one of the photons onto one of the four possiblestates shown in the table in Fig. 1. This state is transferrednonlocally to the other photon, which is on its way to Bob. Bob’sphoton is projected randomly onto one of the six possibleelements of the two bases. Photons going to a wrong basis arenot considered.

04050

Bob measures the state of the photon and verifies thehonesty of Alice. A final coincidence measurement be-tween the electronic signals from Alice and Bob is neededto check if all the steps were performed correctly.

An argon-ion laser pumps a 1.5-mm-thick �-barium-borate crystal cut for Type I phase matching. The crystalemits down-converted pairs of identically polarized pho-tons (� � 702 nm) at an angle of 4� off the pump direc-tion. These photons are entangled in the orbital angularmomentum. We use the substate ’ 0:7j0A0Bi �0:5j1A1Bi � 0:5j2A2Bi, where j0Ai and j0Bi correspond toGaussian beams and j1Ai and j2Bi (j2Ai and j1Bi) areLaguerre Gaussian beams with azimuthal index m � 1(m � �1) [16]. With a series of beam splitters, whosereflectances were chosen so that the photons were equallydistributed among the final paths, both parties direct theirphotons probabilistically to holograms and single modefibers, each projecting the photon onto a certain state [17].

Bob’s photons were directed randomly to a projectiononto one of his six possible states. The detections wereelectronically discriminated with the information providedby Alice by a coincidence measurement. We programmedthe logic to only consider those photons detected by Bobwhich are exactly timed with Alice’s electronic signal andto disregard the photons on Bob’s side going to the wrongbasis.

Alice and Bob decided to try their coin-tossing protocolwith a row of throws. In this experiment they obtained 50%heads (1) and 44% tails (0). As Bob’s guesses were ran-dom, he won in half of the throws. The overall failures inthe protocol around 6% of the throws are mainly due toslight misalignments. In Fig. 3(a) we present the typicalexperimental probabilities. In Fig. 4(a), we show a set of

0

1

(a)

|0⟩+|1⟩ |2⟩ |0⟩−|1⟩

(b)

|0⟩+|2⟩ |1⟩ |0⟩−|2⟩

FIG. 3 (color online). Statistics of Bob’s measurements. Red(gray) bars correspond to failures of the protocol. Black (heads)and white (tails) bars correspond to proper throws and indicatethe result of the tossing. In (a) Alice is honest. She sends the state�j0i � j1i=

���

2p

(Heads). The errors in this case are due tomisalignments of the setup and are intrinsic to it. In (b) Aliceis cheating. She always sends a mixture of two states. After Bobmakes his bet, she decides which state she must tell him. In thiscase she claims to have sent state �j0i � j2i=

���

2p

.

1-2

FIG. 4 (color online). Two different ordered rows of throws.Upper left corner: first throw, lower right corner: last throw. Thecolor of a square represents the result of the throw, as Alicecommunicates it to Bob, black: head, white: tail and red (gray):Failure. Left image, Bob and Alice are honest: Heads 50%, tails44%, failures 6%. The difference between heads and tails is dueto different efficiencies of the detectors and the failures are dueto imperfections of the setup. Right image, Bob honest and Alicecheats: Heads 26%, tails 28%, failures 46%. One can clearly seehow the failures increase due to the fact that Alice is cheating.

PRL 94, 040501 (2005) P H Y S I C A L R E V I E W L E T T E R S week ending4 FEBRUARY 2005

the actual throws. Every square of the image represents athrow of the coin.

The level of security of the protocol is given by the noiseof our experiment [7,11]. The security against Alice cheat-ing depends on the trace distance (D) and the securityagainst Bob cheating depends on the fidelity (F) betweenthe density matrices sending a ‘‘1’’ and sending a ‘‘0’’. Inour kind of protocols, using qubits limits the possible statesto D� F2 > 1 [12]. Values of D and F, violating thisinequality mean that we are accessing a security not al-lowed by qubits. If our experiment were noiseless wewould obtain D � 0:5 and F � 0:5 which is the bestsecurity achievable up to now. By modeling the 6% noisefound in our experiment as completely incoherent weobtain D� F2 � 0:91 which is still better than the securitythat could be achieved with any similar protocol usingqubits, even a noiseless one. One fact which helped tobound the security was the use of a fair protocol, whereAlice and Bob have the same chances of cheating.

We further experimentally explored the security of ourimplementation. For us it was a harder problem to devise acheating procedure than to prepare the honest protocol.The best way we could find for Alice to cheat was thefollowing one. Alice always sends a random symmetricmixture of the state �j0i � j1i=

���

2p

and the state �j0i �j2i=

���

2p

, which is a random mixture of heads or tails [18].When Bob makes his bet, Alice always tells him that helost, and then, Bob has to measure in the correspondingbasis. For example, if Bob says that it was tails, Alice’sanswer is that the state was heads (�j0i � j1i=

���

2p

), andBob measures in this basis. It is an easy task to check thatAlice will win in 62.5% of the throws only, which is belowthe theoretical maximum of 75% [7,6]. This strategy re-sembles a biased coin which can be flipped even after Bobmade his choice.

04050

In order to force Alice to cheat, we changed states A11and A22 to be identical to states A21 and A12, respec-tively. Alice does not need to keep a record of which stateis being sent. In this way she sends a probabilistic mixtureof the two states. Her strategy is to tell Bob that the statesent was exactly the opposite of Bob’s bet.

In practice it is even harder for Alice to win, because shecannot turn off the statistical errors which also happen inthe honest protocol. In our case the number of failures,when Alice cheats in this way, was 46% of the throws. Thedifference with the expected failures is mainly due to thefact that Alice is not sending a perfect mixture of the twostates. Figure 3(b) shows Bob’s results for one of the twostates Alice claimed she was sending. Also, we present theactual row of throws in Fig. 4(b). By comparing the resultspresented in images (a) and (b) it was very easy for Bob todiscover that in (b) the protocol was not followed honestly.Also, it was a little bit suspicious to him that in all theproper throws of Fig. 4(b), Alice won.

At this point, let us turn back to Fig. 3(b). We note thatthe state in which most of the failures go is precisely theone outside the plane defined by the elements of Alice’sset. Evidently in this case, the use of a three-dimensionalspace is necessary in order that Bob can detect Alicecheating.

We now discuss a few details of our implementation. In aproper protocol, the detection of the photon by Bob shouldbe delayed until after he sent his bet to Alice. In our setup,it was difficult to prepare such a delay and so we simulatedit by software. Future implementations should include anoptical delay.

Another difference with respect to an ideal implementa-tion is that both Alice and Bob could not deterministicallyproject their photon onto a given state. Although this is nota problem for an honest Alice, who chooses at randomwhich state to send among the possible four, it mightpresent a security hazard when one of the parties cannotbe trusted. A closer look shows that this is not the case.Photons going to the wrong basis or photons simply notdetected are considered as failures in our scheme thus theycannot increase the odds of winning by a dishonest player.

A possible problem of this implementation would be iftoo many photons are lost in a game were only one coin isplayed. Then the players cannot reach any conclusion evenif they both play fairly because the likelihood that a failurecomes from cheating would be low. This problem can besolved using better detectors, fast optical switches andmode sorters [19] to avoid the loss of photons. This willalso increase the signal to noise ratio, improving the se-curity. A better method would be a protocol where the twoparties throw a large row of coins [20]. As in our case, Bobwill project randomly the incoming photon onto differentbases and store the result, even if the photon went to awrong bases. Then Bob can use a tomographic estimationto check the states Alice announced. Both Bob and Alice

1-3

PRL 94, 040501 (2005) P H Y S I C A L R E V I E W L E T T E R S week ending4 FEBRUARY 2005

can also count the photons lost during the communicationand check if their number corresponds to the known ex-perimental loses.

In conclusion, we have experimentally demonstrated a‘‘quantum coin-tossing’’ protocol. To our knowledge, thisis the first two-party communication protocol which issolved using the laws of quantum physics to encode thecommunication. Contrary to the usual ‘‘key distribution’’protocols, here the information shared by Alice and Bob isdirectly exchanged through the quantum states. Also, thisprotocol is the first one implemented where the use of morethan two dimensions presents a clear advantage. Using oursetup we were able to share a few tens of thousands of cointhrows in a few seconds between two parties. We alsoallowed one party to try to cheat, which was easily detectedthrough a significant increase of failures. We hope that thiswork triggers systematic investigations of the possibilitiesopen to dishonest parties. We showed that, although theapplication of such a protocol in a single coin throwexperiment to settle the ‘‘who keeps the dog problem’’ isof a confined interest, in a more elaborated applicationwhere many random bits are needed it would be easy todetect a cheater. This kind of system could include the casewere Alice is the dealer of coins to many different Bob’s.All the players should be able to see what the previousresults were. Our test experiment was confined to thedimensions of an optical table. In order to send the infor-mation over long distances one should use more elaboratedsystems using, e.g., adaptative optics or specially designedfibers.

This work was supported by the Austrian SciencesFoundation (F.W.F) and the European Commissionthrough the Marie-Curie program and the RAMBO-Qproject of the IST program. Discussions with M.Aspelmeyer and K. Resch are gratefully appreciated. Weare also indebted to Terry Rudolph for commenting onearlier versions of the manuscript.

*Present address: ICFO, Barcelona, Spain†Present address: Atomic Physics Division, NIST, USA

[1] M. Blum, in Coin Flipping by Phone (CRYPTO ReportNo. 1981, p. 11, 1981).

04050

[2] For a review on cryptographic protocols and their relationto quantum mechanics, see D. Gottesman and J.-K. Lo,Phys. Today 53, 22 (2000).

[3] H.-K. Lo, and H. F. Chau, Phys. Rev. Lett. 78, 3410(1997); D. Mayers, ibid. 78, 3414 (1997).

[4] R. Clifton, J. Bub, and H. Halvorson, Found. Phys. 33,1561 (2001).

[5] For the sake of simplicity we explain a weak coin tossing(WCT), but we actually implemented strong coin tossing(SCT). In SCT, Alice locks in the box a bit b. Afterreceiving the box, Bob sends to Alice a bit b0. The tossof the coin results from the operation b � b0. A WCT canbe produced trivially from a SCT and as shown, a SCT canbe implemented from bit commitment. For definitions andproperties of WCT and SCT, see Ref. [7]. For a review onquantum bit commitment see J. Bub, Found. Phys. 31, 735(2001).

[6] A. Ambainis, in Proceedings of 33rd Annual Symposiumon Theory of Computing, 2001 (ACM, New York, 2001),p. 134.

[7] R. W. Spekkens and T. Rudolph, Phys. Rev. A 65, 012310(2001); Phys. Rev. Lett. 89, 227901 ( 2002).

[8] C. H. Bennett and G. Brassard, Proceedings of IEEEInternational Conference on Computers, Systems, andSignal Processing (IEEE, Bangalore, India, 1984), p. 175.

[9] H.-K. Lo and H. F. Chau, Physica D (Amsterdam) 120,177 (1998).

[10] D. Aharonov, A. Ta-Shma, U. Vazirani, and A. Yao, inProceedings of the 32nd Annual Symposium on Theory ofComputing 2000 (Association for Computing Machinery,New York, 2000), p. 705.

[11] N. K. Langford et al., Phys. Rev. Lett. 93, 053601 (2004).[12] A. D. Greentree et al., Phys. Rev. Lett. 92, 097901 (2004).[13] A. Mair et al., Nature (London) 412, 313 (2001).[14] G. Molina-Terriza, J. P. Torres, and L. Torner, Phys. Rev.

Lett. 88, 013601 (2002).[15] G. Molina-Terriza et al., Phys. Rev. Lett. 92, 167903

(2004).[16] A. E. Siegman, Lasers, (University Science, Sausalito,

1986).[17] A. Vaziri, G. Weihs, and A. Zeilinger, J. Opt. B 4, S47

(2002).[18] A better cheating strategy for Alice was sent to us by T.

Rudolph, after the submission of the paper. Alice shouldprepare the state �2j0i � j1i � j2i=

���

6p

and tell Bob thatshe sends either �j0i � j1i=

���

2p

or �j0i � j2i=���

2p

.[19] J. Leach, et al., Phys. Rev. Lett. 88, 257901 (2002).[20] J. Barrett et al., Phys. Rev. A 69, 022322 (2004).

1-4