(t, n) Threshold d-Level Quantum Secret Sharing.

Most of Quantum Secret Sharing(QSS) are (n, n) threshold 2-level schemes, in which the 2-level secret cannot be reconstructed until all n shares are collected. In this paper, we propose a (t, n) threshold d-level QSS scheme, in which the d-level secret can be reconstructed only if at least t shares are collected. Compared with (n, n) threshold 2-level QSS, the proposed QSS provides better universality, flexibility, and practicability. Moreover, in this scheme, any one of the participants does not know the other participants' shares, even the trusted reconstructor Bob 1 is no exception. The transformation of the particles includes some simple operations such as d-level CNOT, Quantum Fourier Transform(QFT), Inverse Quantum Fourier Transform(IQFT), and generalized Pauli operator. The transformed particles need not to be transmitted from one participant to another in the quantum channel. Security analysis shows that the proposed scheme can resist intercept-resend attack, entangle-measure attack, collusion attack, and forgery attack. Performance comparison shows that it has lower computation and communication costs than other similar schemes when 2 < t < n - 1.

Introduction

A dealer who wants to share a secret among a group of participants, usually splits the secret into a few pieces. These pieces of the secret is called shares, which are distributed to different participants, and a share is only held by a participant. The secret can be reconstructed only when enough participants collaborate together. This is the basic idea of Secret Sharing (SS) in modern cryptography. A significant role of SS is that it protects secret information from being lost, destroyed, or altered. Therefore, SS is widely applied to threshold signature, threshold cryptography, secure multi-party computation, and group key management, etc.

Quantum Secret Sharing (QSS) is the expansion of SS in the quantum cryptography field, and the difference between the two is that QSS’ security is based on the fundamental principle of quantum physics. As a cryptographic scheme, QSS uses quantum information to deal with the problem of sharing classical or quantum secret. That is to say, the dealer distributes a secret that may be classical message or an unknown quantum state among a group of participants, and reconstructing the secret need a certain number of participants to collaborate together. The first QSS scheme was proposed by Hillery et al.[1] in 1999, based on Greenberger-Home-Zeilinger(GHZ) state. Since then, many design and analysis schemes on QSS have been proposed[2-20] such as circular QSSs[2-4], dynamic QSSs[5, 6], single particle QSSs[7-9], graph state QSSs[10-12], verifiable QSSs[13-15], and other QSSs that may be based on Calderbank–Shor–Steane codes[16], or based on phase shift operation[17-19], or based on quantum search algorithm[20].

According to different threshold, the existing QSS schemes can be classified into two categories: (n, n) QSS[2–12, 18–20] and (t, n) QSS[10, 11, 13–17]. For the former, the secret cannot be reconstructed until all n shares are collected. For the latter, the secret can be reconstructed only if at least t shares are collected. Furthermore, these QSS schemes can be fallen into two categories: 2-level QSS[2–6, 10, 12, 17–20] and d-level QSS[7–9, 11] depending on the dimension of Hilbert space. For the former, the quantum secret and its shares are all in 2 dimension Hilbert space. For the latter, the dimension of the quantum states is more than 2, that is d > 2. In general, QSS uses different levels of authority to control the participants’ access privileges. Though each participant holds a share, only the qualified subsets of the participants can reconstruct the secret. All the qualified subsets are decided according to different application requirements. Each qualified subset may have different number of participants, and a participant may belong to several qualified subsets. To the (t, n) threshold QSS scheme, the number of participants of each qualified subset is t.

Compared with (n, n) QSS, the design of (t, n) QSS is more complex, because it need employ the technologies such as graph state or error-correcting encoding. In term of practice, (t, n) QSS is more flexible, because the reconstruction of a secret for (t, n) QSS need at least t participants whereas for (n, n) QSS must be n participants. Compared to 2-level QSS, the design of d-level QSS is more difficult. The main reason is that the operations of the quantum computational cell need higher dimensional unitary operations, such as quantum Fourier transform (QFT), d-dimensional Pauli operations, etc. In addition, the universality and practicability of d-level QSS are better than that of 2-level QSS, because the dimension of Hilbert space may be d, which is higher than 2.

Inspired by the flexibility of (t, n) threshold and the universality of d-level, in this paper, we propose a (t, n) threshold d-level QSS scheme. The scheme has generic properties of (t, n) threshold SS, e.g., the dealer Alice distributes n shares to n participants, and each participant only holds a share; any t out of the n participants can reconstruct the original secret. In addition, compared with the existing QSS schemes, the proposed QSS has better properties as follows. Owing to items 1 and 2, it provides lower computation cost; owing to item 3, it provides lower communication cost; owing to item 4, it is safer in resisting some common attacks.

There only exist simple operations such as quantum Fourier transform (QFT) and generalized Pauli operator. The complex operations, e.g., the graph state or error-correcting encoding, do not appear in our scheme;

Only the participant Bob 1 need apply quantum Fourier transform (QFT) to his own particle, other participants do not need;

It is unnecessary to transmit the quantum particles from one participant to the next in order;

Any one of the participants does not know the other participants’ shares, even the trusted reconstructor Bob 1 is no exception.

Preliminaries

In this section, the related preliminaries are introduced including quantum Fourier transform (QFT) and inverse quantum Fourier transform (IQFT), generalized Pauli operator, and Shamir’s (t, n) threshold SS. These preliminaries will be used in presenting (t, n) threshold QSS scheme.

Quantum Fourier Transform and Inverse Quantum Fourier Transform

Definition 1

. Quantum Fourier transform (QFT), a quantum version of the standard discrete Fourier transform, is a unitary transformation of d-level quantum system. For y, , the QFT is defined by refs 21 and 22 where is a primitive d-th root of unity.

Definition 2

. For x, , the inverse quantum Fourier transform (IQFT) is defined byBetween the QFT and the IQFT, there exists the relationship given by

Pauli Operator

Definition 3

. On Hilbert space of d-level quantum system, the generalized Pauli operator is defined by ref. 23 where α, .

In particular, on Hilbert space of d-level quantum system, the X gate and Z gate are represented by ref. 24

Shamir’s (t, n) threshold SS

Definition 4

. Suppose that there are a trusted dealer and n participants , Shamir’s (t, n) threshold SS[25] consists of the following two algorithm:

Share generation algorithm: The dealer randomly chooses a polynomial with degree t − 1: , where , and a 0 is a secret. The dealer computes n shares f(x ) for , then he/she sends n shares to n participants via a secure channel, and each participant P holds only a share f(x ).

Secret reconstruction algorithm: There are n distinct points on the polynomial f(x) in the 2-dimensional plane, so if and only if at least t points are given, the polynomial f(x) can be reconstructed by using the Lagrange interpolation formula as follows

If any t out of the n participants, denoted by , take out their shares . Then the t participants can reconstruct the original secret a 0 based on the above Equation (6)

Results

The Proposed QSS Scheme

Suppose that Alice is a dealer, and is a set of n participants. Alice chooses any one of the participants Bob 1 as a trusted reconstructor. The role of Bob 1 is to collect any t shares from n participants and reconstruct the final secret. The proposed QSS scheme consists of three phases: initialization phase, share distribution phase, and secret reconstruction phase.

Initialization Phase

Alice first finds a suitable prime d satisfying and sets a finite field Z . To divide a secret into n pieces, Alice randomly picks a polynomial with degree t − 1: , where the coefficients are randomly chosen, and the symbol + means addition modulo d.

Share Distribution Phase

Similar to Share generation algorithm of Shamir’s (t, n) threshold SS, Alice selects n distinct and nonzero values to compute n shares for , and then she publishes all x . Each classical share f(x ) can be encoded in a random qubit string according to the encoding method of BB84 protocol[26] or other secure quantum key distribution (QKD) protocols. After having finished the encoding procedure, Alice distributes sequentially the qubit string of f(x ) to the corresponding participant Bob for via a secure quantum channel. That is to say, each participant Bob holds a share f(x ). After having finished the distribution procedure of the qubit strings of all shares, the secret a 0 is shared among a group of participants. In addition, Alice selects a Hash function such as SHA1 to compute hash value H(a 0), and sends it to the participant Bob 1.

Secret Reconstruction Phase

we assume that all qualified subsets of the participants are decided according to the specific application scenario, and the number of participants of each qualified subset is t. On a certain day, the secret a 0 need to be reconstructed, any one of all qualified subsets is selected due to the absence of some participants. For simplicity of description, we assume that the selected qualified subset is denoted by . Figure 1 shows the reconstruction process of the original secret. In the process, each participant Bob performs the steps 5 and 6, and Bob 1 performs the steps 1–8. The details of the reconstruction process are described as follows.

Figure 1

Reconstruction process of the original secret.

Step 1. As a trusted participant, Bob 1 prepares t qudit particles , and each particle has m qubit, where .

Step 2. Let be a standard orthonormal basis of a d-level quantum system and set a QFT based on this orthonormal basis. When Bob 1 applies the QFT to the first particle |0〉1, the composite state of t particles is denoted bywhere is a primitive d-th root of unity.

Step 3. Bob 1 performs respectively d-level CNOT operation on the particle |0〉 for . Where (QFT |0〉1) is the control qudit and |0〉 is the target qudit. After performed (t − 1) CNOT operations by Bob 1, the state evolves as an entangled state

Step 4. Bob 1 sends respectively the particle |k〉 to the corresponding participant Bob through the authenticated quantum channel.

Step 5. After all participants have received their particles, each participant Bob takes out his share f(x ) and calculates respectively the following valueFor convenience, the s is named shadow of the share f(x ).

Step 6. Each participant Bob performs a generalized Pauli operator on his particle |k〉, where is defined byAfter the Pauli operator is performed on each particle, the state evolves as

Step 7. Bob 1 applies QFT −1 to his own particle |k〉1 and further measures it in the computational basis to obtain the secret .

Step 8. Bob 1 first computes the hash value H(f(0)′) using a hash function , and then verifies . If the equation holds, he shares the secret with other participants; otherwise he thinks that there is at least one dishonest participant and ends the reconstruction phase.

Correctness Proof

The proposed (t, n) threshold QSS is proven in this section. The proof of correctness will focus primarily on Equation (12) of Step 6 and the secret recovery of Step 7.

Lemma 1

. If the Pauli operator is performed on the particle |k〉 of the orthogonal entangled state of Equation (9) by the participant Bob , the state evolves as of Equation (12).

Proof

. When the Pauli operator is performed on the particle |k〉 of the state of Equation (9) for , the state evolves as

Lemma 2

. If QFT −1 is applied to the particle |k〉1 of the state of Equation (12), the measurement output of the transformed particle is the original secret .

. Based on Equation (10) and Lagrange interpolation formula of Equation (7), f(0) can be calculated byAccording to the Equation (3), Bob 1 applies QFT −1 to the first particle of the state of Equation (12) and obtainsWhen Bob 1 further measures the first particle in his hand, the measurement output is original secret f(0).

Security Analysis

In this section, the security of the proposed (t, n) threshold QSS scheme is analyzed. The security analysis focuses primarily on intercept-resend attack, entangle-measure attack, collusion attack, and forgery attack.

Intercept-Resend Attack

Without loss of generality, Eve is assumed as an eavesdropper, who has unlimited computing power whose technology is only limited by the laws of quantum mechanics. Suppose Eve controls the quantum channel and intercepts any one quantum particle on the way from Bob 1 to Bob in Step 4, then she measures the intercepted particle by using the computational basis . With the probability of 1/d she can succeed with the attack and get . Further she prepares a new particle that is the same as the intercepted one, and then resends the new particle to Bob . Unfortunately, the measurement outcome k does not contain any information about private share f(x ) or its shadow s . Therefore, Eve cannot get any valuable information in the intercept-resend attack.

Entangle-Measure Attack

In entangle-measure attack, the eavesdropper Eve may use a unitary operation to entangle an ancillary particle on the intercepted one, and then measures the ancillary particle to obtain valuable information. Suppose Eve intercepts all t − 1 particles transmitted from Bob 1 to Bob , and then prepares an ancillary particle |e〉 . Further, she entangles the ancillary particle |e〉 on any one of the intercepted particles such as |k〉 by using d-level CNOT operation, where |k〉 is the control qudit and |e〉 is the target qudit. The state of Equation (9) evolves as ′Next step, Eve chooses another particle |k〉 as control particle to perform d-level CNOT operation on the target particle |e〉. Now the state evolves as It can be seen that the ancillary particle |e〉 is disentangled out from the entangled state , and the original state is not changed. If Eve measures the ancillary particle |e〉, she obtains e, which is the same as prepared at the beginning. From this, Eve can come to the conclusion that the particles |k〉 and |k〉 are the same.

Suppose Eve takes each intercepted particle |k〉 as control particle respectively, and |e〉 as target particle to perform d-level CNOT operation. As a result, she finds all particles are the same. Similar to the entangle-measure attack, the measurement outcome of the particle |k〉 does not contain any information about private share f(x ) or its shadow s . Therefore, Eve cannot also get any valuable information in the entangle-measure attack, only knowing that all transmitted particles are the same.

Collusion Attack

As is known to all, QSS scheme uses the qualified subsets to prevent collusion attack of the participants. After analyzing the existing QSS schemes, we find some schemes cannot resist collusion attack, in which some participants can collude to get the private information of other participants. That is to say, in these QSS schemes, by getting rid of several qualified participants, the unqualified subsets of participants can reconstruct the original secret. Classifying collusion attacks of the existing QSS schemes, the study focuses on the following cases.

Case 1: Collusion attack of Bob and Bob

In refs 17, 22 and 27, if Bob and Bob are dishonest, they can collude to get the private information of Bob . The reason is that the refs 17, 22 and 27 have the same security loopholes: the private information of the previous participant is transformed by using the unitary operation, and then it is transmitted to the next participant. If Bob and Bob collaborate, Bob may send the particle transformed by himself such as to Bob . As a result, Bob not only holds the particle transmitted by Bob , but also holds the particle transmitted by Bob . Given this, Bob can calculate out U operation of Bob , and further he can deduce the private information of Bob .

Case 2: Collusion attack of the first participant Bob 1 and the last participant Bob

As ref. 6 pointed out there exists a security loophole in the dynamic QSS of ref. 5, i.e., the first participant and the last one can collude to obtain the master key of the dealer without the other participants’ cooperation. Ref. 4 also found that the circular QSS of ref. 3 is not secure as the first participant and the last one can illegally obtain the secret messages without introducing any error. The refs 3 and 5 also have the same security loopholes: the dealer and n participants transmit the transformed private information one by one. The transmission route forms a circle, in which the first participant is at the left of the dealer, and the last one is at the right of the dealer. If the first participant colludes with the last one, they can obtain the dealer’s private information.

Case 1 never happens in the proposed (t, n) threshold QSS scheme, because each participant performs unitary operation with private information in his own lab, and the transformed private information is not transmitted via the quantum channel. Case 2 never also happens in the proposed (t, n) threshold QSS scheme, because the dealer (Alice) and reconstructor (Bob 1) do not take part in the circular transmission route, and their private information are not passed from one participant to the next but saved in their own hands. Therefore, as long as the dealer (Alice) and the reconstructor (Bob 1) are both trusted entities, the proposed QSS scheme can resist collusion attack.

Forgery Attack

For secret sharing scheme, as always, it is an issue of public concern to prevent the participants from providing fake shares or shadows. In SS, Feldman[28] first studied this problem and proposed a verifiable secret sharing, in which each participant’s share can be verified publicly. In QSS, Yang et al.[13, 14] proposed two verifiable schemes to check whether some dishonest participants provide fake shares. Song et al.[15] pointed out the forged quantum particles can pass the verification of other participants in ref. 13 and further proposed an new verifiable QSS scheme to improve the original one. From here we can see that verifiable QSS must provide validation function to resist forgery attack of the participants.

In the proposed QSS scheme, in order to resist forgery attack, the reconstructor Bob 1 uses hash function to certify the authenticity of the secret. During the secret reconstruction phase, if a dishonest participant Bob performs Pauli operator with a fake shadow s instead of his true s , though other participants provide the correct information, the original secret a 0 cannot be recovered correctly. In Step 8 of the secret reconstruction phase, when Bob 1 calculates out the secret f(0)′ and verifies it by checking the equation , he finds that the equation does not hold. He thinks that at least one dishonest participant has provided a fake shadow, and he terminates the reconstruction process and does not share the wrong secret f(0)′ with other participants. Therefore, the forgery attack of the participant Bob is infeasible.

Performance Analysis and Comparison

In this section, the performance of the proposed QSS scheme is analyzed and compared with five other similar schemes: Yang et al.’s QSS of ref. 7, Qin et al.’s QSS of ref. 17, Shi et al.’s protocol I and protocol III of ref. 22, and Li et al.’s QSS of ref. 27. The performance analysis and comparison of the six similar schemes can be viewed from the following three aspects: universality and practicability, computation cost, and communication cost.

Universality and Practicability

In ref. 7, Yang et al. prepares an n-particle entangled state to design their protocol, and each participant holds a d-level particle. In ref. 17, the dealer prepares a multi-particle sequence, in which each particle is 2-level. In the protocol I and III of ref. 22, the initiator who is taken as one of the participants prepares a d-level 2-particle entangled state, and each of other n − 1 participants prepares respectively a d-level single particle. In ref. 27, the dealer prepares an ordered sequence of multiple EPR pairs. In the proposed QSS, the participant Bob 1 prepares a t-particle entangled state by using d-level CNOT operation, and each participant holds a d-level particle.

We assume that the number of the prepared single particles or EPR pairs is the same as that of the participants who reconstruct the secret in the six similar schemes. In ref. 7 and the proposed scheme, each participant holds a particle, and each particle has m qubits, where . As Table 1 shows, ref. 7 need prepare mn qubits, and the proposed QSS need prepare mt qubits. In the protocol I of ref. 22, the total number of the prepared particles is n + 1, so that is m(n + 1) qubits. In the protocol III of ref. 22, the number of the prepared qubits is mn(n + 1). In ref. 17, Alice need prepare t particles, so that is mt qubits. In ref. 27, Alice need prepare t EPR pairs, so that is 2mt qubits.

Table 1

Comparison of universality and practicability.

Property	Ref. 7	Ref. 17	I of Ref. 22	III of Ref. 22	Ref. 27	The proposed QSS
(t, n) or (n, n)	(n, n)	(t, n)	(n, n)	(n, n)	(t, n)	(t, n)
Level	d	2	d	d	2	d
Qubits	mn	mt	m(n + 1)	mn(n + 1)	2mt	mt

From the Table 1 we can see that refs 17 and 27 and the proposed QSS are (t, n) schemes, and the three other QSSs are (n, n) schemes. Ref. 7, the protocol I and III of ref. 22, and the proposed QSS are d-level schemes, and the two other QSSs are 2-level schemes. The proposed QSS scheme has not only the merits of (t, n) scheme but also the merits of d-level scheme. It should has better flexibility, universality and practicability than the five other QSS schemes. Moreover, the proposed QSS prepares the same number of the particles as ref. 17, and both schemes can save more resources on the prepared particles than the four other similar schemes.

Computation Cost

Ref. 7 does not show how to prepare an n-particle entangled state, and ref. 27 also does not describe how to prepare an ordered sequence of t EPR pairs. Therefore, in order to make a simplified comparison, we do not consider computation cost of preparing the particles in the protocol I and III of ref. 22 and the proposed QSS scheme. Refs 17 and 27 and the proposed QSS describe the generation process of the shares, however, refs 7 and 22 make no reference to it. Also we do not consider computation cost of the generation process of the shares. In refs 17 and 27, each particle is 2-level. Differently, in refs 7 and 22 and the proposed QSS, each particle is d-level. To be convenient for comparison, the particle dimension d is to be set to 2, thus .

The computation costs of the six similar schemes are shown in Table 2. In ref. 7, each participant first performs QFT on his particle |k〉 , and then applies to the particle QFT|k〉, further measures the transformed particle in his lab. The total computation cost is .

Table 2

Comparison of computation costs.

Operations of the entities	Ref. 7	Ref. 17	I of Ref. 22	III of Ref. 22	Ref. 27	The proposed QSS
QFT	n		1	n + 1		1
U operation	nU_s_r,0	t(t + 1) U(θ)	(n − 1) U j	(n 2 − 1) U j	t(2t − 1) U i,j	tU_0,s_r
QFT −1			1	n + 1		1
Measure operation (M)	n		2	2(n + 1)	t	1
Hash operation (H)						2H

In ref. 17, the dealer Alice performs U(θ ) on every particle of the sequence , and then sends the transformed sequence to the participant Bob . For , the participant Bob applies U(θ ) to the particle sequence received from , and then sends the transformed sequence to subsequent participant . The total computation cost is .

In the protocol I of ref. 22, the initiator performs QFT on the first particle, and sends the second particle (ancillary particle) to next participant. For , each participant Bob performs unitary operation U on his particle. Finally, Bob 1 performs QFT −1 on his particle, and then measures it to obtain the secret. The total computation cost of the protocol I is . To resist collusion attack, the protocol I is upgraded to the protocol III. For , each participant splits his share into n pieces, and then calls the protocol I to compute each y . Finally, one of the participants calls protocol I to compute the summation of all y . The total computation cost of the protocol III is .

In ref. 27, the dealer first sends the Y′ sequence to Bob 1. For , Bob performs on each particle of the Y′ sequence received from . performs final operation on each particle of the transformed Y′ sequence received from . The total computation cost is .

In the proposed QSS, after performs QFT on the first particle |k〉1, each participant Bob applies to his particle |k〉. Finally, Bob 1 performs QFT −1 on his own particle, and then measures it to obtain the secret. The total computation cost is .

The computation cost of Hash operations 2H has slight impact on the total cost of the proposed QSS. For a single qubit, QFT is a Hadamard gate operation, which is taken as a unitary operation. We assume that the computation costs for each unitary operation in Table 2 are roughly the same. If 2 ≤ t = n, the computation cost of the proposed QSS and that of the protocol I of ref. 22 are roughly the same, and both are lower than that of the four other schemes. If 2 < t < n − 1, the computation cost of the proposed QSS is lowest in the six similar schemes.

Communication Cost

For the six similar schemes, we assume that the number of the decoy particles is l, and the number of the message particles is the same as that of the prepared single-particles or EPR pairs. In ref. 17, the transmission route of the quantum sequence is determined as: Alice → Bob  → Bob 1 →  → Bob . The total number of the transmitted particles is the sum of the message particles and the decoy particles, as shown in Table 3, which is . In ref. 27, the transmission route of the Y′ sequence is determined as: Alice → Bob 1 →  → Bob , and that of the X′ sequence is determined as: Alice → Bob . The total number of the transmitted particles is also .

Table 3

Comparison of communication costs.

Transmitted particles	Ref. 7	Ref. 17	I of Ref. 22	III of Ref. 22	Ref. 27	The proposed QSS
message particles(or initial particles)	n − 1	t(t + 1)			t(t + 1)	t − 1
decoy particles (or ancillary particles)		l(t + 1)	n	nn	l(t + 1)

In the protocol I of ref. 22, the ancillary particle is transmitted from one participant to another, and its transmission route is determined as: Initiator → Bob 2 →  → Bob  → Initiator. The total number of the transmitted particles is n. In the protocol III of ref. 22, for , each participant splits his share into n pieces, and every n pieces need one ancillary particle to compute y . The total number of the transmitted particles is nn.

In the proposed QSS and ref. 7, the decoy particles are not inserted into the message particles, and the transformed message particles are not transmitted in the quantum channel from one participant to another. The communication cost only is dominated by the distribution of the initial particles from the dealer (or the reconstructor) to every participant. The number of the transmitted particles of the proposed QSS is t − 1, and that of ref. 7 is n − 1. If t = n, the communication cost of the proposed QSS, that of ref. 7 and that of the protocol I of ref. 22 are roughly the same. If t < n, the communication cost of the proposed QSS is the lowest in the six similar schemes.

Discussion

Some existing QSS schemes cannot resist collusion attack of the participants, and the unqualified subsets set of participants can obtain some information about the secret. To resist collusion attack, ref. 22 upgraded the protocol I to the protocol III. With the enhancement of the security, the computation cost of the protocol III flies to (n + 1) times. In this paper, we present a (t, n) threshold d-level QSS scheme. Security analysis shows that our scheme can also resist collusion attack. Furthermore, if 2 < t < n − 1, our scheme has lower computation and communication cost than other similar schemes including the protocol I of ref. 22. Our scheme is feasible and practical with the present technologies, because it employs quantum CNOT, QFT, and Pauli operator as main transformation operations, which have been used widely in quantum field.