On the impossibility of coin-flipping in generalized probabilistic theories via discretizations of semi-infinite programs

TL;DR

This paper proves that ideal coin-flipping is impossible in generalized probabilistic theories under the Generalized No-Restriction Hypothesis, using a novel semi-infinite programming approach to model cheating strategies.

Contribution

It introduces a new formalism of semi-infinite programs for analyzing cheating strategies in cryptographic tasks within generalized probabilistic theories.

Findings

Coin-flipping impossible in classical, quantum, and generalized probabilistic theories.

Semi-infinite programs effectively model cheating strategies.

New formalism may benefit future cryptographic and quantum information research.

Abstract

Coin-flipping is a fundamental cryptographic task where a spatially separated Alice and Bob wish to generate a fair coin-flip over a communication channel. It is known that ideal coin-flipping is impossible in both classical and quantum theory. In this work, we give a short proof that it is also impossible in generalized probabilistic theories under the Generalized No-Restriction Hypothesis. Our proof relies crucially on a formulation of cheating strategies as semi-infinite programs, i.e., cone programs with infinitely many constraints. This introduces a new formalism which may be of independent interest to the quantum community.

Figures

Equations

$$\mathsf{Prob}(A_b,B_b)=1/2\text{ for }b\in \{0,1\}.$$

$$ϵ:=\max \{P_{\text{Alice},0}^{\ast },P_{\text{Alice},1}^{\ast },P_{\text{Bob},0}^{\ast },P_{\text{Bob},1}^{\ast }\}-1/2.$$

$$P_{\text{Bob},0}^{\ast }=\underset{B\in \mathcal{B}}{\sup }\left\{\mathsf{Prob}(A_0,B)\right\}.$$

$$p{A}_1+(1-p)A_2$$

$$\mathsf{Prob}\left(\sum _i{p}_i{A}_i,B\right)=\sum _i{p}_i\mathsf{Prob}(A_i,B)$$

$$\mathsf{Prob}(A_1,B)=\mathsf{Prob}(A_2,B),\forall B\in \mathcal{B}$$

$$\mathsf{Prob}(A,B)=⟨\tilde{A},\tilde{B}⟩.$$

$$P_{\text{Bob},0}^{\ast }=\underset{B\in \mathcal{B}}{\sup }\left\{⟨A_0,B⟩\right\}.$$

$$C^o:=\{W:⟨W,Z⟩\le 1,\forall Z\in C\}$$

$$C^{\ast }:=\{W:⟨W,Z⟩\ge 0,\forall Z\in C\}.$$

$$P_{\text{Bob},0}^{\ast }$$

$$=\underset{B\in {\mathcal{A}}^{\ast }}{\sup }\left\{⟨A_0,B⟩:⟨B,A⟩\le 1,\forall A\in \mathcal{A}\right\}.$$

$$P_{\text{Bob},0}^{\delta }=\underset{B\in {\mathcal{A}}^{\ast }}{\sup }\left\{⟨A_0,B⟩:⟨B,X⟩\le 1,\forall X\in {\mathcal{A}}_{\delta }\right\}.$$

$$f(Y)=\underset{X\in {\mathcal{A}}_{\delta }}{\max }\{|⟨X,Y⟩|\}$$

$$⟨B,A⟩$$

$$\le ⟨B,X⟩+\Vert B{\Vert }_2\Vert A-X{\Vert }_2$$

$$\le 1+\tau \delta .$$

$$P_{\text{Bob},0}^{\ast }\le P_{\text{Bob},0}^{\delta }\le (1+\tau \delta )P_{\text{Bob},0}^{\ast }.$$

$$\underset{y_X\ge 0}{\min }\left\{\sum _{X\in {\mathcal{A}}_{\delta }}{y}_X:\sum _{X\in {\mathcal{A}}_{\delta }}{y}_{X}X-A_0\in ({\mathcal{A}}^{\ast }{)}^{\ast }\right\}$$

$$A:=\frac{1}{P_{\text{Bob},0}^{\delta }}\sum _{X\in {\mathcal{A}}_{\delta }}{y}_X^{\prime }X=\sum _{X\in {\mathcal{A}}_{\delta }}\left(\frac{y_X^{\prime }}{{\sum }_{\tilde{X}\in {\mathcal{A}}_{\delta }}{y}_{\tilde{X}}^{\prime }}\right)X.$$

$$P_{\text{Alice},0}^{\ast }\ge ⟨A,B_0⟩\ge \frac{1}{P_{\text{Bob},0}^{\delta }}⟨A_0,B_0⟩=\frac{1}{2P_{\text{Bob},0}^{\delta }}$$

Full text

In this paper we consider the possibility of cryptography in theories more general than quantum or classical theory. One may ask why this is a worthwhile endeavour, and for this we give several reasons. The first reason is to future-proof current results which is important in the context of cryptography. While developing quantum cryptography and computation, the community quickly came to realize that classical cryptography results need to be reevaluated for the new quantum era. Since results in quantum cryptography typically rely on the validity of quantum mechanics being a faithful description of nature, these too all have to reevaluated if quantum theory is one day superseded by a new theory, regardless of how minor or radical the departure from quantum mechanics is. Another reason is to gain a better understanding of results in quantum theory. For instance, it is insightful to sit back and think about what parts of quantum theory were needed to prove a result. Did we require entanglement? Were we just assuming these states are in superposition? Can we reprove this only assuming the No-Signalling Principle? By answering such questions, we gain a better understanding of quantum mechanics itself as well as the resources necessary for performing particular tasks.

In this and many other works in cryptography, optimization theory is a key ingredient in the analysis. On a high level, we want to maximize how much someone can “cheat” a protocol, whereby it is understood that the inability to cheat translates into security, and vice versa. The goal is often to design protocols which minimize cheating. We, however, take the opposite approach in this work and prove a limitation on designing any protocol for a particular task, namely coin-flipping, discussed below.

Coin-flipping— Coin-flipping is the cryptographic task where Alice and Bob generate a random bit $b$ over a communication channel such that, when Alice and Bob are honest, both output the same bit $b$ and this bit is uniformly random Blu81 . Coin-flipping is a primitive that is used mainly for building larger, more sophisticated cryptographic protocols in the two-party setting, and hence an understanding of its properties, along with its security limitations, is important.

More formally the coin-flipping task is as follows. Suppose Alice has a set of strategies (basically, a description of how she interacts with Bob) given by the set $\mathcal{A}$ and Bob has a set of strategies given by the set $\mathcal{B}$. We do not just consider deterministic strategies but also those that occur as the result of some measurement procedure. We denote the probability of a pair of strategies occurring as $\mathsf{Prob}(A,B)$ which is between [math] and $1$ for all $A\in\mathcal{A}$ and $B\in\mathcal{B}$.

A coin-flipping protocol consists of the following:

• •

A triple of strategies for Alice $(A_{0},A_{1},A_{\mathrm{abort}})$ which correspond to the measurement outcomes of some deterministic strategy $A_{\text{det}}$,

• •

A triple of strategies for Bob $(B_{0},B_{1},B_{\mathrm{abort}})$ which correspond to the measurement outcomes of some deterministic strategy $B_{\text{det}}$,

satisfying

[TABLE]

The conditions above ensure that the protocol behaves as expected, that the bit $b$ is uniform and shared between Alice and Bob. Ideally, we wish that neither Alice nor Bob can cheat by digressing from protocol and disturbing the conditions given by (1). However, this may not be the case, and as such, we need to measure this disturbance. The security measure in coin-flipping is given by the amount a dishonest Alice or a dishonest Bob can bias the output distribution away from uniform. To make this formal, we define the symbols:

• •

$P_{\text{Alice},b}^{*}$ : The maximum probability that dishonest Alice can force honest Bob to accept the outcome $b$.

• •

$P_{\text{Bob},b}^{*}$ : The maximum probability that dishonest Bob can force honest Alice to accept the outcome $b$.

• •

$\epsilon$: The bias of the coin-flipping protocol defined as

[TABLE]

We wish to design protocols such as to minimize $\epsilon$, with a perfect protocol having $\epsilon=0$. In classical and quantum theory, this is known to be impossible LC97a ; Kit03 . In this work, we show that under some assumptions on $\mathcal{A}$ and $\mathcal{B}$, $\epsilon$ can be lower bounded by a positive constant, thus showing near-perfect coin-flipping is impossible in any theory satisfying those assumptions.

To study the range of possible $\epsilon$, we need to study the four quantities $P_{\text{Alice},0}^{*}$, $P_{\text{Alice},1}^{*}$, $P_{\text{Bob},0}^{*}$, and $P_{\text{Bob},1}^{*}$. Let us first consider $P_{\text{Bob},0}^{*}$. We can write this succinctly by the rudimentary optimization problem:

[TABLE]

This optimization problem exactly captures how much Bob can force Alice to output [math] maximized over all physical strategies he can perform. Before studying this problem using optimization theory, we require a mathematical structure on the quantities involved. We now discuss such a structure which is given by the study of Generalized Probabilistic Theories.

Generalized Probabilistic Theories (GPTs)— To study (3) more generally than quantum and classical theory we require a more general setting for physical theories. Here we work in the framework of generalized probabilistic theories which formalizes any physical theory with an operational description. There have been many approaches to GPTs, see, for example, hardy2001quantum ; barrett2007information ; Ludwig ; davies1970operational ; randall1970approach ; Piron64 ; Mackey ; chiribella2010probabilistic ; hardy2011reformulating for introductions to these frameworks. GPTs have been successfully used for studying cryptography sikora2018simple ; selby2018make ; lami2018ultimate ; barnum2011information ; barnum2008nonclassicality ; barrett2007information ; barrett2005no and computation krumm2018quantum ; barnum2018oracles ; garner2018interferometric ; barrett2017computational ; lee2016deriving ; lee2016bounds ; lee2016generalised ; lee2015computation ; lee2017higher in theories more general than quantum theory. We, however, do not actually need to introduce the full framework of GPTs for the purposes of this work. Instead, we just consider the structure that any such theory would impose on the sets of strategies for Alice and Bob.

As mentioned above, we do not just want to consider the strategies which occur deterministically, but those which may correspond to obtaining a particular outcome in some experiment. That is, given a strategy $A\in\mathcal{A}$ for Alice and a strategy $B\in\mathcal{B}$ for Bob we obtain a probability $\mathsf{Prob}(A,B)$ that these two strategies jointly occur. In particular there is always a ‘zero-strategy’ $0\in\mathcal{A}$ such that $\mathsf{Prob}(0,B)=0$ for all $B\in\mathcal{B}$. Conceptually, one can think of this as Alice aborting the protocol, or simply not taking part in the first place.

First, we assume that these spaces of strategies are convex where we interpret convex combinations as probabilistic mixtures. That is, we assume that

[TABLE]

is in the set $\mathcal{A}$ and represents the strategy where with probability $p$ Alice uses strategy $A_{1}$ and with probability $1-p$ Alice uses strategy $A_{2}$. Given this understanding of the convex structure, the calculated probabilities must satisfy

[TABLE]

and similarly for convex combinations of Bob’s strategies. This means that a strategy for Alice induces a linear functional on the space of strategies for Bob (and vice versa).

Rather than working directly with the spaces of strategies $\mathcal{A}$ and $\mathcal{B}$ we work with operational equivalence classes of strategies. We say that two strategies $A_{1}$ and $A_{2}$ are operationally equivalent if

[TABLE]

and similarly for Bob’s strategies. We denote these equivalence classes as $\tilde{\mathcal{A}}$ and $\tilde{\mathcal{B}}$.

Note that our earlier assumptions imply that $\tilde{\mathcal{A}}$ and $\tilde{\mathcal{B}}$ are both convex sets in some vector space $V$ which are bounded and have non-empty interior. Moreover, we assume that the vector space $V$ is finite-dimensional. This assumption is typically made in the study of GPTs for technical convenience. It can however be motivated by the idea that in a tomographic characterization of the strategies of Alice, one can only, in practice, perform a finite number of different experiments and therefore we must characterize the strategies by a finite number of probabilities.

Following a standard argument on the representations of linear functionals on finite-dimensional vector spaces, one can show that we can always write probabilities as

[TABLE]

From now on we take $\tilde{\mathcal{A}}$ as the set of Alice’s strategies (similarly $\tilde{\mathcal{B}}$ as the set of Bob’s strategies) and hence drop the tildes for convenience as the strategy representation should be clear from context.

We can now rewrite the optimization problem (3) in the form

[TABLE]

Due to the convex structure of the set $\mathcal{B}$, this is a convex optimization problem. However, since we want to prove general bounds on cheating, we require more structure on the sets $\mathcal{A}$ and $\mathcal{B}$ for our analysis.

A physical assumption— Clearly some assumption on the sets $\mathcal{A}$ and $\mathcal{B}$ is required to prove anything meaningful. For example, consider any physical theory and restrict both Alice and Bob to a set of strategies that are $\epsilon$-close to their honest strategies. This allows us to define a (rather boring) GPT in which ideal coin-flipping is possible up to some small error. To avoid GPTs with these unnecessary restrictions, we make the assumption that any mathematically feasible strategy for Bob can be physically realized.

To formally define this lack of restriction for Bob, we start with defining two important quantities studied in convex analysis. The polar set of the set $C$ is given as

[TABLE]

and its dual cone is given as

[TABLE]

Notice we have $\mathcal{B}\subseteq\mathcal{A}^{*}\cap\mathcal{A}^{o}$ and $\mathcal{A}\subseteq\mathcal{B}^{*}\cap\mathcal{B}^{o}$ because every choice of strategies for Alice and Bob yields a proper probability.

We can now define our physical assumption.  

 

Definition 1. The Generalized No-Restriction Hypothesis for Bob states that $\mathcal{B}=\mathcal{A}^{*}\cap\mathcal{A}^{o}$.

To support this assumption, one can argue that if Alice knows that her set of strategies is given as $\mathcal{A}$ then to be able to guarantee security against Bob she should not make any assumptions about what Bob can do. In other words, we also maximize over all physical theories, which in this case translates to allowing Bob to have the largest set of strategies as possible.

This is closely related to the (standard) No-Restriction Hypothesis chiribella2010probabilistic which is a commonly used assumption in the study of GPTs that can be expressed as the idea that all mathematically possible measurements are physically allowed. Here we generalize this idea to the level of arbitrary strategies.

One could equally well consider Bob’s perspective and assume the Generalized No-Restriction Hypothesis for Alice, i.e. $\mathcal{A}=\mathcal{B}^{*}\cap\mathcal{B}^{o}$. Surprisingly these two assumptions are not equivalent, see Fig. 1 for an example of this fact. However, for the purposes of this work we need to only assume it for one party. We henceforth assume it for Bob, but by symmetry the following arguments can be adapted to the case where it is assumed instead for Alice.

Optimization analysis— Under this assumption we can now clean up the optimization problem for Bob (8) as:

[TABLE]

This type of optimization problem is called a semi-infinite program since the variable $B$ is finite-dimensional but there are infinitely many constraints. (Note that this class is not the same as the more popular class of optimization problems called semidefinite programs.) Semi-infinite programming has a rich theory, see for example Shapiro2009 , although it has yet to be used to study quantum theory or its generalizations, as far as we are aware.

For our needs, it suffices to look at relaxations of $P_{\text{Bob},0}^{*}$ where we optimize instead using a discretization of the infinite set $\mathcal{A}$. To this end, we define a mesh, denoted here as $\mathcal{A}_{\delta}$, parameterized by a fineness measure $\delta>0$, such that it has the following properties:

• •

$\mathcal{A}_{\delta}$ is finite, contains a basis for $V$, and is contained in $\mathcal{A}$;

• •

$\forall A\in\mathcal{A},\,\exists X\in\mathcal{A}_{\delta}\,\text{ such that }\,\|X-A\|_{2}\leq\delta$.

Note that such a discretization always exists since $\mathcal{A}$ is bounded.

We now consider the discretized version of this optimization problem defined to optimize using $\mathcal{A}_{\delta}$ instead, as shown below

[TABLE]

First note that we have $P_{\text{Bob},0}^{*}\leq P_{\text{Bob},0}^{\delta}$ since it relaxes (12) as $\mathcal{A}_{\delta}\subseteq\mathcal{A}$. Furthermore, since there are finitely many constraints, this is a (traditional) cone program making it easier to analyze. Recently there have been several applications of cone programming to the study of GPTs selby2018make ; sikora2018simple ; fiorini2014generalized ; JP17 ; bae2016structure ; lami2018ultimate and to quantum theory GSU13 ; BCJRWY14 ; LP15 ; NST16 ; SW17 .

As expected, as one decreases $\delta$ (the fineness measure of the mesh), we have that $\mathcal{A}_{\delta}$ becomes a better approximation of the set $\mathcal{A}$. In particular, we have the lemma below.

Lemma 2. $\lim_{\delta\to 0^{+}}P_{\text{Bob},0}^{\delta}=P_{\text{Bob},0}^{*}$.

[TABLE]

which is finite since $\mathcal{A}_{\delta}$ is finite. It can be easily checked that this is a norm (since $\mathcal{A}_{\delta}$ contains a basis) and is bounded for all $B$ satisfying the constraints of (13). Since all norms are equivalent in finite-dimensional vector spaces, we know there exists a $\tau>0$ such that $\|B\|_{2}\leq\tau$ for all $B$ feasible in $\eqref{pertbob}$.

Fix $B$ feasible in $\eqref{pertbob}$ and $A\in\mathcal{A}$. We now wish to scale $B$ by some constant $c>0$ to ensure $\langle A,cB\rangle\leq 1$ (and thus $cB$ is feasible in $\eqref{nicebob}$). Then for $X\in\mathcal{A}_{\delta}$ $\delta$-close to $A$, we have

[TABLE]

Thus, $\dfrac{1}{1+\tau\delta}B$ is feasible in (12). This implies that

[TABLE]

Taking limits finishes the proof. ∎

We now prove a lower bound on the product of Alice’s cheating probability and the relaxation of Bob’s cheating probability. This is the key step in proving our main result which takes advantage of the simplified structure of the relaxed problem.

Lemma 3. ${P_{\text{Alice},0}^{*}\cdot P_{\text{Bob},0}^{\delta}\geq 1/2}$, for all $\delta>0$.

[TABLE]

and this problem attains an optimal solution $\{y^{\prime}_{X}\}$. Thus, we have ${P_{\text{Bob},0}^{\delta}=\sum_{X\in\mathcal{A}_{\delta}}y^{\prime}_{X}}$. Define

[TABLE]

Notice that $A\in\mathcal{A}$ by convexity and $A-\frac{1}{P_{\text{Bob},0}^{\delta}}A_{0}\in(\mathcal{A}^{*})^{*}$ by the constraints in (19). Suppose Alice uses $A$ as her strategy to force Bob to accept outcome [math]. Then we have

[TABLE]

since $B_{0}\in\mathcal{B}\subseteq\mathcal{A}^{*}$ and $\langle A_{0},B_{0}\rangle=1/2$ from Eq. (1). ∎

By combining the two lemmas, we have that ${P_{\text{Alice},0}^{*}\cdot P_{\text{Bob},0}^{*}\geq 1/2}$, and therefore the maximum of the two probabilities is at least $1/\sqrt{2}$. This gives the same lower bound on the bias Kitaev gave for the case of quantum theory Kit03 which was later reproved by Gutoski and Watrous using a representation of quantum strategies GW07 .

Theorem 4. Any coin-flipping protocol in a GPT satisfying the Generalized No-Restriction Hypothesis for Bob (and/or Alice) satisfies $\epsilon\geq 1/\sqrt{2}-1/2\approx 0.207$. In particular, either Alice or Bob can force an outcome with probability at least $1/\sqrt{2}$.

Since quantum theory satisfies the Generalized No-Restriction Hypothesis for both Alice and Bob GW07 , we have another proof that coin-flipping is impossible in quantum theory.

Discussion— What is perhaps unusual about our main result is that we have found a numerical lower bound that holds for any GPT satisfying the Generalized No-Restriction Hypothesis for Alice and/or Bob. Typically results in the study of GPTs either show something is possible or impossible, or consider a specific GPT (whose structure can be exploited). This is relevant for cryptographic purposes as well. If our result was simply saying that perfect coin-flipping is impossible, then this does not rule out the existence of protocols with small bias, which would be enough for all intents and purposes. Theorem 4 says that near perfect protocols cannot exist either. Moreover, the constant lower bound shows that the security of coin-flipping protocols cannot be boosted in the sense that a protocol with bias $\epsilon<1/2$ cannot be used in a composition to reduce the bias arbitrarily close to [math].

The main technique in this work is our treatment of semi-infinite programs, in particular, how we discretized them into cone programs. We hope that our use of semi-infinite programs will raise awareness of this formalism for future uses in quantum theory and physics by breaking roadblocks when formulating difficult problems as optimization problems.

Future work— This bound on coin-flipping is (asymptotically) achievable in quantum theory using a protocol which is classical apart from quantum subroutines CK09 . This quantum subroutine is a black-box implementation of quantum weak coin-flipping–a similarly defined task but with less stringent security requirements. The history of finding the best quantum weak coin-flipping protocol culminated in the work of Mochon Moc07 . This unpublished paper is $80$ pages long and, even though it has been simplified ACGKM15 (see also NST15 ), is still not well understood. (Recent progress has been made however in the work ARW18 .) Mochon’s work relies on point games (developed by Kitaev), a notion which is dual, in a sense, to protocols (specified in this work as the pair of triples $((A_{0},A_{1},A_{\mathrm{abort}}),(B_{0},B_{1},B_{\mathrm{abort}}))$. Even though point games are mysterious in the context of quantum theory, perhaps our generalization to the framework of GPTs will shed light. In fact, there is one immediate similarity to this work. A major step in Mochon’s proof is the reduction from time-dependent point games to time-independent point games. This, in a nutshell, strips away all the ‘time-dependent’ information of the protocol. Our framework and proof, on the other hand, completely strips away all notion of time as it does not explicitly rely on the round-to-round strategy descriptions, and thus might make this point game reduction simpler, or even trivial.

In short, if one were to develop GPT weak coin-flipping protocols with small bias, then the lower bound presented in this work might be achievable by imitating the quantum protocol. It would be interesting to see which GPTs allow for secure weak coin-flipping, whether it is proved using point games, semi-infinite programming, or another yet-to-be-discovered method.