Single-photon advantage in quantum cryptography beyond QKD

Domain: chemistry
Published: 2026-02-26
Editorial outcome: minor_revision

Abstract
Quantum key distribution (QKD) can be used to establish a secret key between trusted parties. Many practical use-cases in communication networks, however, involve parties who do not trust each other. A fundamental cryptographic building block for such distrustful scenarios is quantum coin flipping, which has been investigated only in few experimental studies to date, all of which used probabilistic quantum light sources imposing fundamental limitations. Here, we experimentally implement a quantum strong coin flipping protocol using single-photon states and demonstrate a quantum advantage compared to both classical realizations and implementations using faint laser pulses. We achieve this by employing a state-of-the-art deterministic quantum dot light source in combination with fast, random polarization-state encoding enabling sufficiently low quantum bit error ratio. By demonstrating a single-photon quantum advantage in a cryptographic primitive beyond QKD, our work represents a major advance towards the implementation of complex cryptographic tasks in a future quantum internet.

Introduction
The functionality of today’s communication networks relies on diverse, sensitive and complex tasks which, nevertheless, can be built from a set of basic cryptographic building blocks, or primitives. While the security of classical cryptographic implementations relies on assumptions regarding e.g., the computational complexity, it is known that laws of quantum physics can be exploited to enhance the security in communication 1–3. To date, quantum key distribution (QKD) is by far the most studied quantum cryptographic primitive, enabling unconditional security in the communication between authenticated, trusted parties. Despite its importance and success, QKD is fundamentally limited in its usefulness, as it cannot be used for more complex cryptographic tasks. Many practical use-cases, including randomized leader election, commitment schemes, multi-party computation, or online casinos, involve two or more parties who do not know or trust each other 4–6.

An important example of a cryptographic primitive between two distrustful parties is coin flipping (CF), where two parties toss a coin to choose between two alternatives in the least biased way. Due to the importance of this primitive, M. Blum introduced the idea of ’coin flipping by telephone’ already in 1983, in which two spatially separated parties do not necessarily trust each other but still wish to ensure that the outcome of the coin flip is secure 7. As classical coin-flipping protocols rely on the computational complexity of one-way functions, they can always be broken with sufficient computational power under standard non-relativistic assumptions 8.

This is not the case in the quantum version of coin flipping protocols 9, although a finite bias remains 10,11. Interestingly, the first quantum coin flipping protocol has been proposed in the very same seminal work by C. H. Bennett and G. Brassard in 1984 2. While this and many other protocols seemed impractical, more recent proposals accounted for device imperfections and channel loss, unavoidable in practical scenarios 12,13. Experimental implementations of quantum coin flipping reported to date used attenuated lasers, i.e., weak coherent pulses (WCPs) 14,15, sources based on spontaneous parametric down conversion (SPDC) exploiting entanglement 16,17, or heralded single photon states 18. However, as demonstrated in our work, deterministic quantum light sources providing single photons on-demand, can provide an advantage for implementations of cryptographic primitives beyond QKD.

In this work, we experimentally implement a quantum strong coin flipping protocol using an on-demand sub-Poissonian light source and demonstrate its advantage over both classical and WCP-based implementations. To this end, we employ a state-of-the-art single-photon source based on a semiconductor quantum dot deterministically integrated into a high-Purcell micro-cavity in combination with fast dynamic polarization-state encoding with a sufficiently low quantum bit error ratio (QBER), required for the successful execution of this type of protocol. Based on a thorough theoretical analysis, we optimize the protocol parameters and experimentally achieve quantum coin flipping rates on the order of ≈ 1 kbit/s in a back-to-back configuration. We observe cheating probabilities lower than what is possible in the equivalent classical coin flipping protocol, both in simulations and in the experiment. Moreover, we conducted QSCF experiments under variable attenuation inside the quantum channel and studied its impact on the quantum advantage. Our work represents an important step forward in exploiting quantum advantages in realistic settings for applications in the future quantum internet.

Results
The quantum coin flipping protocol
In the context of quantum coin flipping, similar to classical coin flipping, two protocol families, known as quantum strong coin flipping (QSCF) and quantum weak coin flipping (QWCF), are distinguished according to the goals of the two parties. While in QWCF both parties favor a certain outcome (e.g., Alice wants 0 and Bob wants 1, and they are aware of the other party’s preference), both parties want a random, unbiased result in QSCF. Hence, cheating in QWCF must be considered in one direction only, while both directions are important in QSCF, resulting in more protocol constraints for the latter type.

The important figures of merit for a coin flipping protocol are the honest winning probabilities PA and PB of Alice and Bob, their dishonest cheating probabilities PA and PB, as well as the honest abort probability P AB, which describes protocol aborts due to photon loss or errors without cheating. In this context, a protocol is called balanced if Alice and Bob have the same honest winning probabilities (PA = PB), and fair when they have equal dishonest cheating probabilities (PA = PB). Note, that the terms fair and balanced are also used reversely in some work 6. Here, however, we follow the terminology used in ref. 13. The degree of security of a fair and balanced coin flipping protocol is then measured by the bias ϵ = max[PA, PB] − 1/2, that quantifies how much the dishonest cheating probability differs from the case of random guessing with probability 1/2. The minimum theoretically achievable bias for a QSCF protocol was shown by Kitaev to be ϵ ≤ 1/2(√2 − 1) ≈ 0.2119, which corresponds to a minimum cheating probability of 71%. On the other hand, QWCF protocols with arbitrarily small bias exist 20, which are, however, often based on assumptions difficult to achieve experimentally. More recently, a newly proposed QWCF protocol 21 reaching Kitaev’s bias limit was also successfully implemented experimentally 18. Note that a successful implementation of QSCF always trivially implies a QWCF version of the same bias, as the two parties can simply place bets on the outcome of the random bit.

The protocol chosen for the implementation in this work is one of the most established ones in the family of QSCF protocols and has been proposed in ref. 12 and extended in ref. 13. Previously, this protocol was used to show an experimental quantum advantage using attenuated laser pulses 15. In the following, we first introduce the QSCF protocol and discuss on the basis of simulations how single photons can be exploited to enhance its quantum advantage, before we turn to the experimental implementation.

The main steps of the QSCF protocol from ref. 13 implemented in this work are the following 15 (cf. Fig. 1):
1. In each step i of a K-step long protocol round, Alice prepares and sends pulse i ∈ (1, K) to Bob, in a randomly chosen preparation basis α i ∈ {0, 1} and encoding bit value c i ∈ {0, 1}. The four possible states |ϕ α i,ci are read: |ϕ α i,0 = 1/√2(|0i + (−1)α i |1i) and |ϕ α i,1 = 1/√2(|0i − (−1)α i |1i), with the real number a ∈ (0.5, 1), used to fine-tune the initial states to optimize the protocol and ensure equal cheating probabilities of Alice and Bob.
2. Bob picks a random measurement basis β i for each pulse. If Bob has not detected any of the K pulses, the protocol aborts, otherwise, the first detection event is j.
3. Bob picks a random number b j and sends it to Alice via a classical channel together with the index j.
4. Alice reveals her corresponding basis and bit value (α j, c j) to Bob.
5. Whenever the same basis was used (α j = β j), Bob confirms whether he measured the same state |ϕ α j,cj or aborts if the states disagree.
6. If Bob has not aborted, the outcome of the coin flip is c j ⊕ b j.

The probability of aborting when both parties do not attempt to cheat P AB depends on different protocol parameters such as the number K of pulses sent per coin flip, the transmission η Bob inside Bob’s receiver setup, the photon detection efficiency η Det of Bob’s detector, the detection error e, the mean number of photons per pulse μ and the photon statistics of the employed light source.

It is important to note that the photon statistics of the employed light source crucially affect the protocol performance, as discussed in the following. Phase-randomized weak coherent pulses follow a Poisson distribution, i.e., the probability p n that a pulse contains n photons depends on the mean photon number μ according to p n = e−μ μn/n!. In contrast, the photon statistics of a deterministic single-photon source, as used in our implementation, is limited by experimental imperfections only. In this case, the amount of multi-photon contribution can be upper-bounded via the anti-bunching value g(2)(0) as ref. 22

p 0 ≈ μ, p 2 ≤ 1/2 μ2g(2)(0), p 1 ≈ 1 − p 0 − p 2. (2)

Protocol performance simulation
Next, we simulate the performance of the QSCF protocol to evaluate the optimal parameters for our implementation. Accounting for the experimental conditions in our protocol implementation, the cheating probabilities can be calculated as a function of the protocol parameter a defining the tilt-angle in the four coin flipping states (cf., Eq. (1)). Optimizing the parameter a one can minimize the cheating probabilities, while maintaining PA = PB, for each parameter from the set {μ, K, g(2)(0)} (see “Methods” and Supplementary Note 3). This optimization is performed for the parameters summarized in Table 1 corresponding to the experimental conditions realized in our implementation further below. Figure 2a shows the obtained optimized cheating probabilities as a function of the number of rounds K for a QSCF protocol implemented with weak coherent pulses (WCP, cf. blue line), a single photon source (SPS, cf. green line) and the equivalent classical protocol (black line). A quantum advantage is achieved when the QSCF cheating probability is smaller than in the classical protocol (blue shaded region). We find that the SPS implementation outperforms the WCP version in the full parameter range, while at high K values only the SPS can achieve a quantum advantage (green shaded region). The dashed green line indicates an ideal SPS without any multi-photon pulses (g(2)(0) = 0). In this case, no 2-photon events can be used to cheat, thus preserving the quantum advantage for large K. However, for K ≪ 1/μ, the probability of multi-photon events becomes negligible even for a non-ideal single-photon source, which is why the maximum quantum advantage is the same, and even an ideal single-photon source would not further reduce the cheating probability for this protocol and experimental parameters.

An extended comparison between SPS and WCP implementation confirms that both provide a quantum advantage for realistic parameters, while the advantage is higher for the SPS. Figure 2b, c illustrates the difference between classical cheating probability and QSCF cheating probability. Here, regions of positive values identify a quantum advantage. The simulations reveal that in implementations using realistic single-photon sources, the reduced multi-photon contributions enable a quantum advantage in a larger parameter range compared to WCPs. Note, that the advantage of our SPS compared to WCPs can exceed 8% for larger K (see Supplementary Note 4). This, however, occurs in a regime with a reduced advantage compared to the classical case. In our work, we therefore chose parameters that clearly yield a quantum advantage while simultaneously enabling a single-photon advantage.

In this context, two aspects of QSCF are noteworthy compared to QKD: Firstly, the concept of decoy-states for mitigating multi-photon effects, as known from laser-based QKD 23, cannot be employed in the distrustful setting of coin flipping. Hence, all multi-photon events increase the cheating possibilities for Bob. Secondly, achieving a quantum advantage in the QSCF protocol is more sensitive to bit errors. For the chosen protocol, QBERs below ≈ 4% are required to achieve a quantum advantage (see Methods), while BB84-QKD can tolerate up to 11% QBER and still asymptotically generate a secure key 24. The reason is that in QKD, errors can be mitigated during post-processing, while they reduce the equivalent classical cheating probability in QSCF due to an increased number of protocol aborts. Note also that the employed cheating probability bound for Bob in the QSCF protocol is not tight, and lower bounds might be found in the future, which would increase the effective quantum advantage.

One could argue that the same cheating probabilities and almost the same quantum advantage of the single-photon source could, in principle, be reproduced using a laser with a smaller mean photon number μ, as the likelihood of multi-photon events is proportional to μ2. However, a smaller μ would require higher K values, leading to a lower rate of successful coin flips, as the maximum rate of secure coin flips is R CF = R 0 / K ≈ R 0 · μ, where R 0 is the system clock rate. Therefore, employing sub-Poissonian light sources in QSCF provides not only a reduced bias but also a better performance for the same bias.

Experimental setup overview
To implement the QSCF protocol simulated above, we realized the experimental setup shown in Fig. 3a. Alice uses a deterministic single-photon source to generate flying qubits at a clock rate of R 0 = 80 MHz using a 4-state polarization analyzer with passive basis choice in combination with superconducting nanowire detectors and time-tagging electronics (see “Methods”). Classical post-processing is performed via a classical data link. The execution of the QSCF protocol relies on two building blocks, namely the single-photon generation and the dynamic qubit encoding on Alice’s side, as discussed in the following.

Flying qubit generation
The single-photon source comprises a single pre-selected semiconductor quantum dot emitting at a wavelength of 921 nm, deterministically integrated into a micro-cavity based on a hybrid circular Bragg grating (cf. inset in Fig. 3a) to enhance the photon extraction efficiency and reduce the radiative lifetime to 50 ps via high Purcell enhancement. For details on the design, deterministic fabrication and in-depth quantum-optical characterization of this type of single-photon source, we refer to ref. 25 and ref. 26, respectively. Choosing quasi-resonant (p-shell at 896 nm) optical excitation of the quantum emitter operated in a cryogenic environment (4 K) results in the emission spectrum in Fig. 3b. Here, the predominant emission of a charged state used for our experiments in the following is identified. Performing a Hanbury-Brown and Twiss measurement after spectral filtering via a monochromator and coupling to a single-mode fiber confirms the single-photon nature of the emission with an uncorrected and integrated anti-bunching value of g(2)(0) = 0.03(1) (cf. Fig. 3c). Furthermore, it is essential for the protocol implementation that the emitted photon states possess no coherence in the photon number basis, a necessary assumption in the treated cheating strategies, as recently discussed by Bozzio et al. 27. This was confirmed for the excitation conditions used in the coin flipping implementation, by interfering sequentially emitted single photons in a Mach-Zehnder-interferometer and varying their relative phase while monitoring the count rate after the interference. The absence of oscillations observed in this experiment, as seen in Fig. 3d confirm that the photon number coherence in the used light state is negligible, thus, the analytical formalism based on ref. 15 can be applied without the need for active phase-randomization. As a cross-check, we repeated the experiment with the same quantum emitter under strict resonant excitation (≈ 0.2π pulse area), revealing oscillations due to a finite photon number coherence, as expected for this excitation scheme.

Dynamic polarization state encoding
Dynamic state preparation on Alice’s side is performed using a fiber-coupled EOM controlled by a self-built arbitrary waveform generator (AWG) based on field-programmable gate-array (FPGA) electronics, digital-to-analog converters (DAC) and an amplifier (Amp). The polarization encoded qubit states leaving the EOM are then rotated into the final protocol states via fiber polarization paddles just before entering the quantum channel. Figure 4a illustrates the desired qubit states and the corresponding polarization Stokes vector ~s on the Poincaré sphere. Note that the voltage levels corresponding to the desired polarization states need to be carefully adjusted, due to the relatively small difference to the standard BB84 states. To achieve the lowest QBER in our protocol implementation, we employed an advanced coding scheme, which required a doubling of the effective clock rate inside the AWG to 160 MHz. While this made the precise timing control more demanding, it effectively suppressed voltage level drifts in random state sequences, enabling low QBER levels with improved temporal stability (see “Methods”). Figure 4b shows an exemplary random voltage level sequence used as input for the EOM in our protocol implementation, where alternating voltage modulation was applied. This measurement confirms the correct adjustment of the voltage levels to the four target states for our implementation (full lines). Please note the small but crucial difference between the QSCF states used in this work, corresponding to a = 0.9, and the BB84 states typically used in QKD (dashed gray lines). Using the encoding system presented above, we experimentally achieve an overall QBER for dynamic random state switching of single-photon pulses of 2.8%. In order to achieve a quantum advantage, a QBER below ≈ 4% is required for the protocol chosen here (see Methods), as a higher QBER would lead to a reduced classical cheating probability due to many honest aborts.

Experimental quantum strong coin flipping
To implement the QSCF protocol, Alice randomly encodes the four protocol states for the fixed optimized value of a = 0.9 and a fixed number of pulses K = 50,000. After the K voltage values, the sequence is repeated to evaluate the protocol performance with sufficient statistics. To implement the random bit sequence, we used a pre-stored set of quantum random numbers generated by measuring vacuum fluctuations 28,29, which were provided by the Australian National University 30. After propagation through the quantum channel, first in the back-to-back case without additional loss, Bob projects the arriving photons into the four protocol states by detecting them in his four detection channels, yielding the arrival statistics shown for a short time period in Fig. 5a. Synchronizing the qubit-state preparation and detection using a trigger signal at the start of each protocol run, we are able to average over many realizations of the K-long random sequence.

The relative temporal offset between Alice’ and Bob’s time-bins is determined by correlating a set of the sequence for different relative shifts and channel permutations. This enables us to compare the detected state to the actually sent state for each time bin (see Fig. 5b), which yields a high extinction in the preparation basis and the expected projections in the other bases. Figure 5c presents the resulting input-output matrices, as theoretically expected from the parameter a (left panel) and for the experimental realizations with losses in the quantum channel of 0 dB (back-to-back), 3 dB, and 6 dB, resulting in a QBER of 2.8%, 3.1%, and 6.4% (right panels). The QBER obtained under dynamic random state preparation was calculated from the ratio of wrong projections divided by all projections for a given state and averaged over all four QSCF states. We observe a good agreement between the experimental performance and the theoretical expectations.

Performing the protocol steps outlined above, coin flips are performed for each realization of the K-step long random sequence for the back-to-back case, yielding the performance summarized in Table 2. We perform 52,978 successful coin flips within 34 s, yielding a rate of about 1500 secure single-photon coin flips per second. Honest aborts due to sequences in which no photon is detected are almost negligible for the chosen length of K. Honest aborts due to deviations between Alice and Bob’s outcomes, however, appear in P AB = 1.4% of the cases, in good agreement with the theoretical prediction that the honest abort probability converges to e/2, as such an error is detected in 1/2 of the cases in the protocol. Using the a parameter and the photon statistics, we can calculate the maximum cheating probabilities of Alice and Bob to be PA = PB = 90.0%, confirming that the protocol is fair, while the coin flip outcome probabilities of P 0 = 49.9% and P 1 = 50.1% confirm the assumption of a random basis choice and the correct generation of a random bit. From the measured honest abort probability P AB we can calculate the equivalent cheating probability for a classical coin flipping protocol, resulting in 91.6%. The smaller cheating probabilities observed for the quantum version of the coin flipping protocol demonstrate that we indeed experimentally achieved a quantum advantage. Moreover, the same protocol carried out with a phase-randomized WCP source of the same μ using the same experimental setup would yield calculated cheating probabilities of 90.3%, higher than in the single-photon case. Hence, we demonstrate not only a quantum advantage, but also a single-photon advantage compared to WCP-based implementations, as predicted in the protocol simulations.

Next, we investigate the performance of our QSCF implementation as a function of additional transmission losses of 3 dB and 6 dB in the free-space quantum channel, corresponding to several km of fiber transmission representative for realistic urban quantum networks. To compensate for the decreasing number of photons detected in each K-long sequence with increasing transmission loss, we gradually increased K from now K = 25,000 in the lossless case up to K = 100,000 for 6 dB attenuation. Figure 6a depicts the resulting honest abort probability P AB as a function of the channel loss. We find that despite the increase in K, the honest abort probability still increases due to the reduced signal-to-noise ratio, causing an increased detection error. The increase in P AB quantitatively matches the theoretical expectation (solid lines), as calculated from the experimentally measured QBER e and the selected length of the random sequence K.

The experimental quantum advantage achieved in our protocol implementation for different channel attenuations is presented in Fig. 6b, as calculated from the protocol parameters and the measured honest abort probabilities (points), as well as from the theoretically predicted honest abort probabilities (solid lines). We observe that a quantum advantage is maintained for 3 dB additional loss in the quantum channel, while no quantum advantage is present at 6 dB loss due to the increased detection errors, as well as a non-optimal choice of K (cf. discussion further below). The experimental results are again in good agreement with the theoretical predictions for the same parameters. The decreasing quantum advantage with increasing loss directly results from the increase in honest abort probability, causing the equivalent classical cheating probability to decrease. In addition, the single-photon advantage is illustrated by plotting the equivalent WCP quantum advantage (dashed lines), indicating that the advantage is more relevant for higher loss, where the need for a higher K increases the influence of multi-photon pulses.

To further explore the effect of loss, Fig. 7 shows the maximum possible rate of secure coin flips R, which is calculated from the system clock rate (80 MHz) divided by the smallest possible value of K still yielding a positive quantum advantage. Here, we assumed that the error at zero attenuation is e 0 = 2.8% and modeled the increase in error with loss (see Methods). By comparing our single-photon source (green line) to the equivalent attenuated laser source (blue line), we confirm that the sub-Poissonian photon statistics lead to performance improvements. Assuming an improved implementation (red line), using a single-photon source that combines the best values for μ = 0.29 after dynamic state preparation 31 and g(2)(0) = 0.0001 32 achieved with quantum dots to date, would lead to substantial performance improvements in single-photon QSCF. Here, the higher source efficiency μ allows shorter protocol sequences K, which in turn enable higher coin flipping rates, while a larger K can be tolerated at higher loss when g(2)(0) is smaller.

Methods
Analytical expression for honest abort probability
The honest abort probability P AB can be calculated from the probability Z that a pulse of Alice does not cause a detection event at Bob, the probability P dc that Bob’s detector clicks, even though no pulse arrived, and the probability e that a state is detected incorrectly (referred to as QBER above). According to ref. 13 the honest abort probability P AB can thus be expressed as follows:

P AB = ZK (1 − P dc)K + PK dc (1 − P dc)i−1 Z i−1 + (1 − ZK (1 − P dc)K) i P = K 1 (1 − P dc)i−1 P dc Z i = 2 e (3)

with Z = p 0 + (1 − p 0)(1 − η). Here, η = η Bob · η Det is the product of the transmission of Bob’s receiver module and the detection efficiency and p n the probability that a pulse contains n photons. In the case of phase-randomized attenuated laser pulses with a mean photon number μ, p n follows a Poisson distribution p n = e−μ μn/n!, while for deterministic single-photon source p n is only limited by experimental imperfections and can be approximated by Eq. 2 22.

From the honest abort probability, the classical cheating probability can be calculated as P C ≤ 1 − P AB/2 42, which is inversely proportional to P AB. While the honest abort probability is not sensitive to the photon statistics, the main difference between WCPs and single-photon sources lies in the cheating probabilities. Cheating is possible when an error occurred without an honest abort. This case becomes more likely at higher μ, since there are more multi-photon pulses and an abort is less likely. Consistently, sending more photons makes an abort less likely and hence classical cheating possible. See Supplementary Note 1 for a comparative graphical discussion of the honest abort probability P AB and the classical cheating probability P C as a function of μ and K (complementing main Fig. 2a).

Analytical expressions for cheating probabilities
The security analysis follows refs. 13,15, based on ref. 43 for the original protocol 9. Alice’s optimal cheating strategy consists of sending entangled states, waiting for Bob’s announcement, and then performing a measurement on her part of the state, which in the worst case results in a cheating probability of ref. 13

PA ≤ 3 + 2√a(1 − a) / 4. (4)

This leads to a maximum cheating probability of 100% for a = 0.5 (cf. Supplementary Fig. S3). For Bob, the optimum cheating strategy depends on whether he has detected 0, 1, or 2 photons, assuming that he can differentiate the photon number. The these cases are (cf. ref. 13):
(A 1) Bob does not detect a single photon
(A 2) Bob detects at least one 1-photon pulse
(A 3) Bob detects exactly one 2-photon pulse
(A 4) Bob detects exactly one 2-photon and at least one 1-photon pulse

Summing the contributions leads to an upper bound for Bob’s total cheating probability of ref. 13

PB ≤ ∑4 i=1 P A i × P b0|A i + (1 − ∑4 i=1 P A i) 1, (5)

according to ref. 15 (see Supplementary Table 1). For simplicity, Bob is assumed to be able to cheat with unity probability in all other cases A i>4. Note that the cheating probability bound defined for Bob is not tight, and lower bounds are possible in principle. However, while more explicit events could be considered to further tighten Bob’s bound, the probability for higher-order multi-photon events is not only very low, but also their cheating probability is very close to the conservatively assumed 100%. In the reasonable parameter regime of K ≈ 1/μ used in our work, which allows for practical coin flipping rates, the probability of all additional cases A i>4 can be estimated to be < 10−8 for attenuated laser pulses and < 10−12 for our QD light source. Hence, we consider the impact of terms A i>4 negligible for our study. Note also that if Alice were to send laser pulses without phase-randomization, Bob could cheat better due to the remaining photon number coherence, which would require a refined analysis 27. See Supplementary Note 2 for a comparative discussion of the cheating probability for WCPs and real single-photon sources as a function of μ and K, as well as the classical cheating probability bound.

Estimation of lower error limit
A quantum advantage is achieved when the dishonest cheating probability of the fair and balanced protocol is smaller than the classical cheating probability, which is determined by the honest abort probability. The smallest honest abort probability is achieved in the regime of large K, where no aborts are due to non-detections, and aborts take place only due to errors which are detected in half of the cases, thus P AB ≥ e/2. This translates into a classical cheating probability of P C ≤ 1 − e/4. On the other hand, the smallest possible cheating probability in the regime in which photons are detected is a. Hence, a quantum advantage requires approximately

e ≤ 4(1 − a)2 ≈ 4%. (6)

Simulations for parameter optimization
To maximize the quantum advantage while ensuring a fair protocol in our implementation, we performed simulations to optimize the parameters used in the experiments. To this end, we minimized the cheating probabilities under the constraints of achieving a quantum advantage (P quantum < P classical) and PA = PB. The optimal parameter a is determined by calculating the point of equal cheating probabilities for Alice and Bob PA = PB using Eqs. (4) and (5) (see Supplementary Note 3). For the experimental parameters from Table 1, PA = PB is achieved for a = 0.9, which is also used in the experiment. The a-optimization was performed for each {μ, K} combination, which yielded main Fig. 2.

Theoretical expectations for projections of prepared states
To calculate the theoretically expected input-output matrix in the main text Fig. 2, we consider the four input states prepared by Alice in the language of the honest protocol in explicit form as a function of a (cf. Eq. (1)):

|ϕ 0,0 = √a|0i + √1 − a|1i
|ϕ 0,1 = √a|0i − √1 − a|1i
|ϕ 1,0 = √1 − a|0i + √a|1i
|ϕ 1,1 = √1 − a|0i − √a|1i (7)

Here, the first index denotes the basis and the second the selected state. These states are orthogonal within one basis, normalized, and the bases do not commute. Next, the projections onto the four QCF states, i.e., the overlap of each prepared state with all the other basis states, can be calculated as a function of a (cf. Supplementary Table 2). This was finally used to calculate the matrix illustrating the theoretical expectations in main Fig. 5c for a = 0.9 and dividing the projection probabilities by 2 to account for the fact that each basis is chosen in the Bob module with a probability of 50%.

Estimation of maximum coin flip rate
The maximum possible rate of secure coin flips is calculated as r = 1 / (T · K min), with T = 12.5 ns the temporal separation between single-photon pulses and K min the smallest possible value still yielding a quantum advantage for a specific loss. The detection error is modeled as e = e 0 + η Bob · η Det · P dc, with e 0 = 0.028, the dark count rate P dc = 4 · 10−7, η Bob = 0.5, and the detection efficiency η det = 0.425.

Dynamic polarization-state encoding
The dynamic polarization-state switching is implemented using a self-built arbitrary waveform generator (AWG) in combination with a fiber-based electro-optic modulator (EOM) in a single-pass configuration. The EOM used in this work is a customized phase-modulator (by EOSPACE Inc.). The AWG driving the EOM is based on a 16-bit digital-to-analog converter (DAC) (by Analog Electronics) driven by an FPGA development board (by AMD). Using the FPGA, a K × 2 ROM structure is designed to store a 2-bit random number sequence of length K using the excitation laser trigger output (Sync) as the main clock signal. For each rising edge of the Sync signal, the FPGA reads the 2-bit value in the ROM structure and correspondingly updates the 16-bit digital input value for the DAC board, using a low-voltage differential signaling (LVDS) protocol via an FPGA Mezzanine Card connector on the FPGA board. A copy of the Sync signal is generated by the FPGA and provided to the DAC board for reading the digital input pattern and updating the output voltage level. For reading the next entry, the FPGA increases the address input for the ROM by plus one. Once the address value reaches K, its value is reset to zero for repeating the pre-stored random modulation pattern. In addition, the FPGA generates a trigger pulse at the beginning of each coin flipping sequence, i.e., once the address value is reset to zero, which is sent to the time tagger input for keeping track of the starting time of each coin flipping attempt. To vary the applied voltage levels while performing calibration routines in real-time, a universal asynchronous receiver-transmitter (UART) module is implemented in the FPGA for sending commands and digital values for each voltage level from our PC to the FPGA using the UART protocol.

Optimizing modulation voltage levels
To determine the exact voltage levels to be applied to the EOM for preparing the four QSCF states, we follow the calibration routine described below. For this purpose, we use Bob’s calibrated polarization-state analyzer described further below. Initially, a direct analytical mapping is performed from the desired qubit states on the Bloch sphere (determined by a) to the corresponding Stokes vector ~s on the Poincaré sphere coupled to the quantum channel by Alice (see Supplementary Note 5). Next, we prepare laser pulses tuned to the same wavelength as our single-photon source in the respective polarization states using a polarimeter and optimize the voltage levels step-wise.

In the first step, a periodic sequence of two different voltage levels is generated with the AWG and applied to the EOM for determining the voltage levels necessary to rotate the polarization between two orthogonal states, i.e., π-rotation on the Poincaré sphere. Using a fiber-based polarization controller, the two prepared polarization states are rotated to match the detection basis. The achievable extinction ratio is monitored by comparing the detected counts projected into two orthogonal basis states. Applying an adjustable electronic temporal delay to the AWG output, we ensure that the single photons arrive while the voltage supplied to the EOM is settled at its target value. This procedure is repeated iteratively for different voltage differences between the two states in the sequence to minimize the QBER. For our experimental setup, the FPGA output voltage yielding the lowest QBER amounts to 330 mV, which, after amplification, corresponds to Vπ ≈ 3 V at the EOM.

In a second step, the periodic two-level sequence used above is extended to a four-level switching sequence. While the four BB84-states typically used in QKD are eigenstates of the two non-orthogonal bases, rectilinear and diagonal, the QSCF states are slightly tilted according to the parameter a, resulting in a larger overlap between the two states. Instead, the correct voltage levels are found by applying a variable shift between the two pairs of voltage levels to minimize the QBER while maintaining the Vπ difference between orthogonal levels. In each iteration, the four generated states are rotated into the detection reference frame of Bob using the fiber-based polarization controller.

After calibration with the laser, we use linearly polarized single photon pulses to optimize the voltage levels for maximal discrimination between the four known protocol states in the corresponding detection channels. Following the procedure described above, the QBER, defined as the ratio of false detection events in one basis divided by all detection events within this basis, reaches values below 2.0% for a periodic 4-state sequence.

Four-state Manchester coding
When directly encoding a random polarization state sequence using the voltage levels determined above with our AWG, small time-dependent deviations between the measured and the targeted voltage levels are observed, which are caused by drifts in the DAC stage whenever repeated voltage levels are prepared (which always happens with finite probability in random sequences). This drift results in increased quantum bit errors during the transmission of random polarization-state switching sequences, while it is absent when applying periodic switching sequences as used during the calibration procedure described above. To mitigate this voltage level drift, an advanced coding scheme was employed, which builds on the idea of binary phase-keying, also known as Manchester coding. Here, the electronic clock-rate inside the AWG is doubled from 80 MHz to 160 MHz, and for each sent state, the voltage level corresponding to the orthogonal state is applied. As the optical clock of the excitation laser remains at 80 MHz the polarization-state preparation of the photons can be timed such that polarization switching occurs during the first 6.25 ns of each 12.5 ns laser repetition period (cf. gray shaded window in main Fig. 4b), followed by the orthogonal state’s voltage level. This results in an average voltage level inside the control electronics of zero, which effectively suppresses voltage level drifts (see Supplementary Note 6, including Supplementary Fig. S5). While this requires more precise delay control, the previous drift is avoided, allowing for random polarization switching.

Calibration of qubit state detection
Qubit-state detection is performed on Bob’s side using a polarization-state analyzer consisting of a 50:50 beamsplitter (BS) passively realizing the random basis choice, followed by two polarizing beam splitters (PBS) onto which the photon’ polarization state is rotated using two sets of a half- and a quarter-wave plate, enabling projections into the four protocol states. A high extinction-ratio linear polarizer in each reflected beam path enables a high overall qubit-state discrimination (see further below). The polarization-state analyzer has an overall transmission of η Bob = 50% (excluding the detectors). To optimize the discrimination of the four QSCF states in the Bob module, a polarimeter in combination with a linear polarizer is used in the four output ports, while carefully adjusting the wave-plates. Applying this calibration procedure, we achieve a contribution of the Bob module to the overall QBER below 0.1%. Photons from the four outputs are finally detected via a superconducting nanowire single photon detector (Single Quantum) with η Det = 85% detection efficiency. Not least, residual temporal delays between the four detection channels are carefully compensated by matching the arrival times of laser pulses tuned to the emission wavelength of our single-photon source.

Data analysis
The first step to implement the full coin flipping protocol and for generating secure random bits is to synchronize the prepared states of Alice with the detected states at Bob. Alice has a list of the K states she prepared during the sequence, while Bob only detects a single photon per sequence on average. Summing over many realizations of the K-long pulse sequence allows Bob to guess the state he most likely received in each time bin of the sequence (cf. Supplementary Fig. S5a). The resulting list (or a set) of detected states [1, 2, 3, 4] can be correlated with Alice’ list to find the relative temporal offset between the two lists. This is done by iteratively computing the average of the element-wise difference while rolling the index of one list. See Supplementary Note 7, including extended data illustrated in Supplementary Fig. S6. Using the correct temporal offset, as determined above, each coin flip can be evaluated on a single coin flip level following the strong coin flipping protocol introduced in the main text by exchanging random bits, comparing the basis and state and, if the protocol did not abort, generating a secure random bit.

Peer review rounds
[{"round": 1, "reviewer_comments": {"reviewer_1": "In this work, the Authors identify a security advantage in terms of cheating probability for a well-studied quantum-cryptographic task known as quantum strong coin flipping (QSCF), enabled by the use of single-photon sources (SPS) instead of weak coherent pulses (WCP). Using a quasi-resonantly pumped semiconductor quantum dot emitting at 921 nm with a second-order correlation function at zero time delay of around 3%, the Authors demonstrate this advantage experimentally for several values of channel loss, also maintaining quantum advantage over classical implementations of SCF with a similar abort probability.\n\nThe manuscript reads in a clear and structured way. Detailed theoretical and experimental methodologies, along with the experimental results, are presented in the Main, Methods and Supplementary. In principle, I believe that experimentally demonstrating the first advantage of single-photon sources (SPS) over Poissonian alternatives in a beyond-QKD protocol is worth pursuing: it provides a new benchmark and elegant milestone that should be of interest to both single-photon and quantum cryptography communities. I also appreciate the effort taken in actively generating polarization states that lie much closer to each other on the Bloch sphere than standard BB84 states, along with measures taken to limit voltage drifts.\n\nHowever, the demonstrated advantage of SPS over WCS is very small in my opinion (~0.3% absolute difference at 0 dB loss), and the actual cheating probabilities of ~90% are unfortunately too high to provide any valuable secure application. In essence, I feel like the theoretical aspects do not provide any novelty, since the chosen QSCF protocol, its practical security analysis and its associated parameter space optimization (applicable to both SPS and WCS) were extensively studied in Refs. [10,11,13,15]. This would not necessarily be a problem in itself, but the main claim of the manuscript, i.e. that SPS outperform WCS for this protocol, might be overestimated due to the bounds on the cheating probabilities not being tight (as mentioned by the Authors and shown in the security analysis adapted from previous works).\n\nIn order to provide a fair or more significant comparison, I would at least suggest some effort on the theory side to make the security bounds tighter, which would in turn make the source comparison more fair, and/or formulate altogether a different figure of merit where the source advantage might be more substantial. For these reasons, I do not recommend publication in Nature Communications at this stage, unless these concerns are addressed. In the points below, I give suggestions that can help the Authors, along with some more minor clarity/definition comments.\n\nPossibilities/limits of SPS advantage:\n1) Protocol/quantum advantage: to increase the fairness of the source comparison and novelty of the overall results, I would suggest improving the security analysis (with numerical methods to estimate some additional A_i>4 in Eq.(4) if this is too cumbersome analytically) to improve the (quantum) advantage over classical methods for a fixed, experimental abort probability. This would additionally make the source comparison between SPS and WCS more fair, as the cheating due to multiphoton noise would be less overestimated. If the difference turns out not to be significant, I am happy with the current analysis.\n2) Source advantage: The advantage of SPS over WCS is small (~0.3% at 0 dB loss), and likely a little smaller if the security bounds for the QSCF protocol are tightened (since you would get less penalized by multiphoton emission, which is the main difference between WCS and SPS at a fixed mean photon number). Overall, I am wondering whether, for this very reason, there could not be a more impressive source advantage to demonstrate as a function of losses: for example, over what distance/loss are SPS able to maintain a quantum advantage compared to WCP? I have the feeling that this would be a more impressive figure of merit, since the multiphoton advantage of SPS would get significant with higher loss. Furthermore, although the employed QD source has some limitations, I would at least suggest plotting an additional curve in Fig.2a that shows how much better an ideal (or the best currently published) QD could perform in principle.\n3) Frequency conversion: The employed QD emits at 921nm, but QSCF is a communication protocol and will most likely be implemented at telecom wavelengths when deployed over standard SMF fibers. How do the Authors expect frequency conversion to affect their demonstrated advantage? More precisely, incorporating typical numbers for the losses and multiphoton noise introduced by frequency conversion, would SPS still gain an advantage over WCP for associated values of average photon number “mu” and rounds K?\n\nDefinitions and clarity:\n- Line 21, \"The most fundamental quantum cryptographic building block [...] is quantum coin flipping\": this is not correct per se, as, both in the classical and quantum world, coin flipping may be constructed from much more fundamental primitives like bit commitment and oblivious transfer. Please attenuate this claim by changing it (for example) to \"one of the fundamental building blocks...\".\n- Line 43, \"eg: for doing business\": this does not provide the Reader with any information regarding the applications of coin flipping. Could the Authors cite one or two relevant use-cases?\n- Line 120, “under the fairness constraint”: this quantity/constraint has not been defined before. To make things clear for the uninformed Reader, I would strongly recommend that the Authors introduce all the relevant properties of quantum coin flipping earlier in the draft, for example before or after the protocol description. These should at least include fairness (probability of winning the coin flip should be equal for honest parties), balance (upper-bounds on the cheating probabilities should be equal for both parties), and abort probability.\n- Line 170, “results in the emission spectrum in Figure 2b”: this should read “Figure 3b”.", "reviewer_2": "In this article, the authors implemented a quantum strong coin flipping protocol, which is an interesting cryptographic primitive useful for sharing randomness without trust, as well as serving as a subroutine for more complex cryptographic protocols like commitment schemes. The main difference and novel analysis compared to the previously proposed protocol “Experimental Plug and Play Quantum Coin Flipping” is that they replaced the coherent light source with a high-fidelity deterministic single photon source. They analyzed the new advantages offered by using a single photon source in this protocol and observed a decrease in the cheating probability compared to the weak coherent pulse model previously proposed. Additionally, they explored the effects of losses on the quantum advantage observed, providing a more comprehensive analysis.\n\nThe authors presented both simulated and implemented data that are consistent and easy to understand. For the experimental setup, they employed a cutting-edge photon source recently developed by some of the authors, along with dynamic state encoding controlled by FPGAs, which has been refined to reduce error levels.\n\nOverall, the article offers new insights and analysis, as well as a well-developed experimental setup. However, I have one suggestion for improvement: In the abstract, the authors mention that probabilistic photon sources, which I assumed to be SPDC sources, suffer from “fundamental limitations,” but this point is not discussed further or referenced afterward. Properly referencing and detailing these limitations would strengthen the argument more.", "reviewer_3": "In the work “Single-photon advantage in quantum cryptography beyond QKD,” the authors present the implementation of a quantum strong coin-flipping protocol using a deterministic single-photon source based on a semiconductor quantum dot. They demonstrate, first through simulations and subsequently in experiments, not only the advantage of the quantum protocol over its classical counterpart, but also the benefit of implementing single-photon states compared to coherent states.\n\nI find the paper both interesting and technically sound. However, before making a final decision, I would like the authors to address the following comments and questions:\n- I believe the title does not accurately reflect the content of the work. The phrase “in quantum cryptography beyond QKD” suggests a broad survey of all quantum cryptographic applications (excluding QKD) where single photons offer an advantage. Since this work focuses on a specific protocol, it might be clearer and more appropriate to reference that directly in the title.\n- In the first section, while describing the protocol, some points could be clarified. For example, in point 2, Bob chooses a basis beta_i, but it is unclear what basis this corresponds to without referring to the figure. In point 3, it is stated that Bob picks a random number b_j, but it is not specified that this should be a binary value.\n- The protocol appears to describe only a single round of the experiment. How is parameter estimation performed in practice? Is there an abort condition depending on the quantum bit error rate (QBER)?\n- In the experimental section, the authors test the setup in a free-space quantum channel with varying levels of loss and compare it to the expected performance in fiber. However, why was the experiment not performed directly using optical fiber? Are there challenges related to coupling into the fiber?\n- The authors highlight the advantage of single-photon sources in terms of a reduced cheating probability. However, the reported difference is around 0.3%, which seems quite small. Considering the significantly easier implementation using coherent states, does this marginal advantage still justify switching to a single-photon source?"}, "author_response": "We thank the Reviewers for their assessment of our work and the, in principle, very positive feedback. The constructive criticism helped us to further improve our manuscript. We carefully read all remarks and addressed the points raised as detailed in the following. Here, we mark reviewer comments in blue, our responses in black, and revised/new text in red. The detailed point-by-point response to the Reviewers below is complemented by a marked-up version of the Revised Manuscript and the Supplementary Information file, highlighting the changes made.\n\n[... Author response continues with detailed point-by-point replies to Reviewer 1, 2, and 3 as provided in the source text ...]"}, {"round": 2, "reviewer_comments": {"reviewer_1": "I would like to thank the Authors for addressing my comments in a very detailed and convincing manner (especially the study of the impact of terms A_i>4 and the addition of ideal SPS curves to show the full expected potential of SPS), and for implementing the changes that make the article more informative.\n\nI believe that the manuscript is now suitable for publication, provided that the following minor comment is implemented:\n- I really appreciate the addition of Figure 7, which displays an advantage of SPS over WCP for achievable distance that is in my opinion more impressive than the pure (small) gain in terms of bias at zero distance. In the figure title however, could you please change \"unbiased\" coin flips to \"secure\" coin flips? A Reader might get confused otherwise, since the coin flips DO have a finite bias.", "reviewer_3": "I thank the authors for addressing my comments in a precise and thorough manner. I acknowledge and accept the authors’ decision to retain their original choice of title, which is well within their rights. I particularly appreciate the honest and thoughtful response to my final comment concerning the academic relevance of the reported results.\n\nFor these reasons, I consider the manuscript worthy of publication in Nature Communications."}, "author_response": ""}]

Decision letter