Hybrid Quantum Protocols for Secure Multiparty Summation and Multiplication.

The summation and multiplication are two basic operations for secure multiparty quantum computation. The existing secure multiparty quantum summation and multiplication protocols have (n, n) threshold approach and their computation type is bit-by-bit, where n is total number of players. In this paper, we propose two hybrid (t, n) threshold quantum protocols for secure multiparty summation and multiplication based on the Shamir's secret sharing, SUM gate, quantum fourier transform, and generalized Pauli operator, where t is a threshold number of players that can perform the summation and multiplication. Their computation type is secret-by-secret with modulo d, where d, n ≤ d ≤ 2n, is a prime. The proposed protocols can resist the intercept-resend, entangle-measure, collusion, collective, and coherent quantum attacks. They have better computation as well as communication costs and no player can get other player's private input.

Introduction

The secure multiparty quantum computation is an essential component in quantum cryptography. The summation and multiplication are two basic operations for secure multiparty quantum computation. The secure multiparty quantum summation and multiplication include a list of secrets, which is shared among a set of players and the players jointly perform summation or multiplication without revealing their secrets. The classical summation and multiplication protocols cannot provide the unconditional secure communications. However, the quantum summation and multiplication protocols can provide the unconditional security as they are based on the principles of quantum mechanics like quantum correlation[1], entanglement for bipartite system[2], Heisenberg XYZ model[3]. In 2007, Du et al.[4] discussed a secure multiparty quantum addition modulo n + 1 protocol based on the non-orthogonal states, where n is total number of players. In 2010, Chen et al.[5] introduced a secure multiparty quantum addition modulo 2 protocol based on multi-particle entangle. In 2014, Zhang et al.[6] presented a protocol with addition modulo 2 based on both polarization of a single photon. In 2010, a three-party quantum addition modulo 2 protocol was discussed by Zhang et al.[7]. These protocols have some limitations, for example, they cannot perform addition correctly if one player is dishonest as these protocols have (n, n) threshold approach, and the modulo of these protocols is very small. They have high communication and computation costs due to the bit-by-bit computation. In 2015, Shi et al.[8] discussed a secure multiparty quantum summation and multiplication protocol. This protocol is efficient, but it has (n, n) threshold approach. In 2017, Shi and Zhang[9] introduced a two-party quantum protocol for summation. This protocol cannot perform summation correctly if one party is dishonest. In the same year, a multiparty quantum summation modulo 2 protocol was discussed by Zhang et al.[10]. This protocol is efficient but its modulo is too small. Then, Liu et al.[11] discussed a secure multiparty quantum summation protocol based on two particle Bell States. This protocol is efficient but its modulo is 2 and it has (n, n) threshold approach. In 2018, Yang and Ye[12] introduced a secure multiparty quantum protocol for summation based on the quantum Fourier transform. The computation type of this protocol is secret-by-secret, but it has (n, n) threshold approach. Recently, Jiao et al.[13] have discussed a secure multiparty quantum summation and multiplication protocol with mutually unbiased bases. This protocol is efficient, but the computation type of this protocol is secret-by-secret and it has (n, n) threshold approach. Most of the existing secure multiparty summation and multiplication protocols have (n, n) threshold approach and bit-by-bit computation type. Further, they are not practically feasible as they require high communication as well as computation costs.

In this paper, we propose two hybrid (t, n) threshold quantum protocols for secure multiparty summation and multiplication. In order to incorporate the advantages of both quantum and classical multiparty summation and multiplication, we apply the quantum methods in a secure multiparty computation. The novelty of the proposed work can be summarized as follows. Our protocols have (t, n) threshold approach, where t players can perform the quantum summation and multiplication systematically and efficiently without revealing their privacy. They require less communication and computation costs as their computation type is secret-by-secret. Further, our proposed protocols possess all the benefits(i.e., they use qudit instead of qubit, do not require the secret information to be passed through the transmitted particles, do not require to perform entanglement measurement, and the quantum attacks cannot be performed) of the existing secure multiparty quantum summation and multiplication.

Preliminaries

Here, we introduce the Shamir’s secret sharing, quantum state, SUM gate, quantum Fourier transform (QFT), and generalized Pauli operator, which will be used in our work.

Shamir’s secret sharing

In the Shamir’s secret sharing, there is a set of players and a dealer[14]. This secret sharing scheme consists of two phases: secret sharing and secret reconstruction. In secret sharing phase, the dealer shares a secret among n players using a (t − 1) degree polynomial f(y); each player knows only his share. In secret reconstruction phase, the t players reconstruct the secret using the Lagrange interpolation. The Lagrange Interpolation is defined as follows.

For y = 0, Eq.(1) can be written as follows.

Quantum State

In quantum computing, the d-level quantum state is defined as follows[15].

It must satisfy , where C represents complex number.

SUM gate

In quantum computing, the SUM gate is defined as follows[16].where |u〉 and |v〉 denote control and target particles, respectively, and .

Quantum Fourier Transform (QFT)

The discrete Fourier transform is the foundation of QFT. The d-level QFT is defined as follows[8].where, ω represents e2.

Generalized Pauli operator

In quantum computing, the d-level generalized Pauli operator is defined as follows[17].where, .

Proposed Protocols

In this section, we propose two hybrid (t, n) threshold secure multiparty quantum summation and multiplication protocols. Let X and Y have two secrets a and b, respectively, and want to perform (a + b) or (a × b) without revealing their secrets. In these proposed protocols, we assume that the set of players , a qualified subset , each qualified subset containing t players and player P1 is an initiator.

Hybrid secure multiparty quantum summation protocol

Here, we discuss our proposed hybrid (t, n) threshold secure multiparty quantum summation, whose procedure is given as follows.

Step 1: The X and Y choose two different polynomials and , where and are coefficients and a and b are the secrets of X and Y, respectively. Then, they compute the classical shares f(y) and g(y), respectively, using the Shamir’s Secret Sharing[14] and distribute these shares among the set of players . Player P, , possesses only his shares f(y) and g(y).

Step 2: Player P, computes and keeps h(y) secret.

Step 3: Player P, , computes the shadow of his shares, denoting as A, as follows.

Step 4: Initiator P1 prepares t single qudit particles |0〉1, |0〉2, …, |0〉 and applies QFT on the first particle |0〉1. The resultant state |ϕ1〉 is given as follows.

Here, |ϕ1〉 and |0〉’s, , are control and target qudits, respectively.

Step 5: Player P1 performs (t − 1) SUM operations to produce the entangled state |ϕ2〉 as follows.

Initiator P1 sends the particle |l〉 to each player P, .

Step 6: Each player P, , applies the QFT operation on his particle |l〉 and then executes the generalized Pauli operator , . The quantum state |ϕ2〉 is evolved as the quantum state |ϕ3〉, which is obtained as follows:

Step 7: In computational basis, each player P, , measures his particle and broadcasts his measurement result m + A, .

Step 8: Finally, they jointly compute the summation by adding their measurement results. The summation of the secrets is computed as: .

Hybrid secure multiparty quantum multiplication protocol

Here, we discuss our proposed quantum protocol for secure multiparty multiplication, whose procedure is given as follows.

Step 1: Initially, X and Y select two different polynomials and , where a and b are the secrets of X and Y, and are coefficients of polynomials f(y) and g(y), respectively. Then, they compute the classical shares f(y) and g(y), respectively, and distribute them among n players. Player P, , knows his shares f(y) and g(y) only.

Step 2: Player P, , computes and shares among n players using new random polynomial . The total polynomial, denoted as T, is computed by each player P, , using the Vandermonde matrix[18]. Player P, , knows T only.

Step 3: Each player P, , computes the shadow B of his share as follows.

Step 4: Initiator P1 prepares t single qudit particles and applies QFT on the first particle 01. The resultant state |Φ1〉 is given as follows.

Here, |Φ1〉 denotes control qudit and |0〉’s, , denote target qudits.

Step 5: Initiator executes (t − 1) SUM operations to get the entangled state |Φ2〉, as follows.

Initiator P1 sends the particle |r〉 to each player P, .

Step 6: Each player P, , applies QFT on his particle |r〉, followed by the generalized Pauli operator . The quantum state |Φ2〉 is evolved as the resultant state |Φ3〉,which is given below:

Step 7: Each player P, , measures his particle in computational basis and broadcasts his measurement result w + B.

Step 8: Finally, they compute the multiplication by adding their measurement results. The multiplication of the secrets is computed as: .

Correctness

In this section, we prove the correctness of our proposed protocols. We discuss the correctness proof of the secure multiparty quantum summation protocol only. The correctness proof of the secure multiparty quantum multiplication protocol is very much similar to that of the secure multiparty quantum summation protocol.

Correctness Proof

lemma 1

If all players in a qualified subset act honestly, then they can perform summation .

proof 1

On Applying QFT and Pauli operators by each player P, , on his particle gives the quantum state as follows.

Each player P, , measures his particle in computational basis. The compute the sum after receiving others players’ measurement results.

From Eq. (15), we get sum of the secrets .

Example

Here, we illustrate our proposed secure multiparty quantum summation and multiplication protocols using an example. Suppose X and Y have two secrets 4 and 2, respectively, and want to compute their sum and multiplication without revealing their secrets. The X and Y share these secrets among 7 players and the qualified subset computes the summation and multiplication. The X and Y select prime as 11. Thus, prime d = 11, threshold t = 3, and total number of players n = 7.

Summation example

Example.

Consider that X and Y choose their respective polynomials and . They compute their classical shares f(y) and g(y) and distribute these shares among 7 players . Each player P, , computes . The computation of share and h(y) are shown in Table 1. Each player P, k = 1, 2, 3, (of qualified subset ) computes the shadow of his share A as follows:

Table 1

Share Computation for Summation and Multiplication.

Players		P1	P2	P3	P4	P5	P6	P7
Shares	f(yi)	9	9	4	5	1	3	0
	g(yi)	6	1	9	8	9	1	6
	h(yi) = f(yi) + g(yi)	4	10	2	2	10	4	6
	h′(yi) = f(yi) × g(yi)	10	9	3	7	9	3	0
Polynomials: zi(x)		10 + x + 2x2	9 + 3x + x2	3 + 2x + 2x2	7 + 2x + 3x2	9 + 5x + x2	3 + 2x + x2	0 + x + 5x2
Shares	z1(xi)	2	9	9	2	10	0	5
	z2(xi)	2	8	5	4	5	8	2
	z3(xi)	7	4	5	10	8	10	5
	z4(xi)	1	1	7	8	4	6	3
	z5(xi)	4	1	0	1	4	9	5
	z6(xi)	8	8	3	4	0	2	10
	z7(xi)	6	0	4	7	9	10	10
	Ti	7	9	3	0	0	3	9

Initiator P1 computes and sends the particle |l〉 to each player P, k = 2, 3. Each player P (of qualified subset ) applies QFT and generalized Pauli operators U1,0, U3,0, U2,0 on his particle. Hence,

Finally, the players measure (computational basis) their particles and broadcast their respective measurement results m1 + 1, m2 + 3, m3 + 2. They get the sum by adding their measurement results as follows:

Example of multiplication

Similar to summation, X and Y select their respective polynomials and and compute their respective classical shares f(y) and g(y). They distribute these shares among 7 players . Each player P, , computes and these shares are shared among n players using new random polynomial . The shares of total polynomial, denoted as T, are computed by each player P, , using the Vandermonde matrix[18]. The computation of T is shown in Table 1. Each player P, k = 1, 2, 3, (of qualified subset ) computes the shadow of his shares B as follows.

Initiator P1 computes , sends the particle |r〉 to player P, k = 2, 3. Each player P (of qualified subset ) applies QFT operation and generalized Pauli operators U10,0, U6,0, U3,0 on his particles as follows.

Finally, players measure (computational basis) their particle and broadcasts their measurement results w1 + 10, w2 + 6, w3 + 3. They get the multiplication by adding measurement results as follows:

Security Analysis

In this section, we analyze the security of our proposed secure multiparty quantum summation and multiplication protocols. We mainly focus on the security analysis of summation protocol because the security analysis of multiplication protocol is very much similar to that of summation protocol.

Intercept-resend attack

Suppose an eavesdropper E intercepts the particle |l〉 and measures it in the computational basis to extract the information about the shadow of the share. The eavesdropper E prepares a fake particle and resends it to player P, . If E performs this attack, then he can compute l correctly with probability . But E cannot get any valuable information about the share of the shadow from l, because |l〉 does not contain any valuable information about the shadow of the share.

Collusion attack

In our proposed protocols, each player P measures his particle and broadcasts his measurement result , . Thus, other players cannot obtain the shadow of the share (A). Suppose the dishonest players P and P collude together to obtain other players’ shadow of the share A. They cannot get any information about the shadow of the share because player P1 only sends the particles |l〉 to other players; nothing else, and the particles |l〉 don’t carry any valuable information about the shadow of the share. So, this attack is not possible in our proposed protocols.

Entangle-measure attack

In this attack, the eavesdropper E intercepts all the particles |l〉, when the initiator P1 sends the particles |l〉 to player P, . Further, E selects a intercepted particle |l〉 and prepares an ancillary particle |c〉. The d-level SUM operation is performed by E on |l〉 to entangle the ancillary particle |c〉. The quantum state |ϕ2〉 is evolved as |ϕ2〉′, which is given below.

E prepares another secret particle |l〉 and performs d-level SUM operation on |c〉. The quantum state |ϕ2〉′ is evolved as |ϕ2〉″, which is given below.

The ancillary particle |c〉 is measured by E and gets the initial value |c〉. So, E concludes that the particles |l〉 and |r〉 are the same. Based on this conclusion, E assumes that all the particles |l〉’s are same. Thus, E cannot get any information about the shadow of the share from this attack.

Collective attack

In this attack, E interacts with each qudit by preparing an independent ancillary particle and jointly performs the measurement operation on all the ancillary qudit to get the shadow of the share. E prepares an independent ancillary particle |c〉 to interact with each qudit of player . After interacting, E gets the particle |l〉 and jointly performs the measurement operation in the computational basis to learn the shadow of the share. From this joint measurement, E cannot get any information about the shadow of the share because |l〉 does not contain any information of the shadow of the share.

Coherent attack

In coherent attack, E jointly interacts with all qudit of player , by preparing an independent ancillary particle |c〉 and he gets each player’s particle |l〉. E jointly performs the measurement operation in computational basis on each player’s particle |l〉. From this measurement of particle |l〉, E only gets l with probability . But, l does not contain any valuable information about the shadow of the share. Here, E only knows the interacting particle |l〉, nothing else. So, from this attack, E cannot learn the shadow of the share.

Performance Analysis

Here, we analyze the performance of our proposed secure multiparty quantum summation and multiplication protocols and compare it with that of ten existing secure multiparty quantum summation and multiplication protocols: Du et al.’s protocol[4], Chen et al.’s protocol[5], Zhang et al.’s protocol[6], Zhang et al.’s protocol[7], Shi et al.’s protocol[8], Shi’s protocol[9], Zhang et al.’s protocol[10], Liu et al.’s protocol[11], Yang’s protocol[12] and Jiao et al.’s protocol[13] based on three parameters: cost, universality, and attack. The Du et al.’s protocol[4] is based on multiparty computation but it has (n, n) threshold approach and its modulo is n + 1 and computation type is bit-by-bit. The Chen et al.’s[5], Zhang et al.s[6], Zhang et al.’s[7] protocols are based on multiparty computation but they have (n, n) threshold approach; their modulo are 2 and computation type is bit-by-bit. The protocols of Chen et al.[5] and Zhang et al.[6] perform 1 Unitary operation. Both the protocols of Shi et al.[8] are based on multiparty computation and computation type is secret-by-secret, but they have (n, n) threshold approach. In the Shi et al.’s protocols[8], the QFT is applied on the first particle by initiator Bob1,who sends second particle to next player. Then, the unitary operation is performed by each player Bob, i = 2, 3, …, n. Initiator Bob1 applies QFT−1 on his particle. So, the total computation and communication costs of these protocols are 1QFT + 1QFT−1 + (n − 1) unitary operations + 2 measure operation and n, respectively. The Shi’s protocol[9] is based on multiparty computation but it has (n, n) threshold approach and its computation type is bit-by-bit. The Zhang et al.’s protocol[10] is based on multiparty computation but it has (n, n) threshold approach with bit-by-bit computation type and modulo of 2. The total computation cost of this protocol is n measure operations. The Liu et al.’s protocol[11] is based on multiparty computation but it has (n, n) threshold approach with bit-by-bit computation type and modulo of 2. The total computation and computation costs of this protocol is n and n, respectively. The Yang’s protocol[12] is based on multiparty computation but it has (n, n) threshold approach. The total computation and communication costs of this protocol are nQFT + n measure operation and (n − 1), respectively. The Jiao et al.’s protocol[13] is based on multiparty computation but it has (n, n) threshold approach with bit-by-bit computation type. The total computation and communication costs of this protocol is n unitary operation + n measure operations and n, respectively. However, our proposed summation and multiplication protocols are based on multiparty computation with modulo d, have (n, n) threshold approach, and their computation type is secret-by-secret. The total computation and communication costs of these protocols are 1QFT + (t − 1) unitary operation + t measure operation and (t − 1), respectively. So, our protocols are more secure, flexible, and practical as compared to the existing summation and multiplication protocols. The comparison of cost, universality, and attack are shown in Table 2. In this table, IR, EM, Comt, Com, s-by-s, b-by-b, Summ. and Multi. denote intercept-resend attack, entangle-measure attack, computation cost, communication cost, secret-by-secret, bit-by-bit, summation and multiplication, respectively.

Table 2

Comparison in terms of Cost, Universality, and Attack.

Protocols				Du[4]	Chen[5]	Zhang[6]	Zhang[7]	Shi[8]		Shi[9]	Zhang[10]	Liu[11]	Yang[12]	Jiao[13]		Proposed
Operation				Summ.	Summ.	Summ.	Summ.	Summ.	Multi.	Summ.	Summ.	Summ.	Summ.	Summ.	Multi.	Summ.	Multi.
Performance Parameters	Costs	Comt.	QFT	—	—	—	—	1	1	—	—	—	n	—	—	1	1
			QFT−1	—	—	—	—	1	1	—	—	—	—	—	—	—	—
			Unitary Operation	—	1	1	—	n − 1	n − 1	—	—	—	—	n	n	t − 1	n − 1
			Measure Operation	—	—	—	—	2	2	—	n	n	n	n	n	t	t
		Com.	Message Particle	—	—	—	—	—	—	—	—	—	—	—	—	t − 1	t − 1
			Decoy Particle	—	—	—	—	n	n	—	—	n	n − 1	n	n	—	—
	Univ.	Model		(n, n)	(n, n)	(n, n)	(n, n)	(n, n)	(n, n)	(n, n)	(n, n)	(n, n)	(n, n)	(n, n)	(n, n)	(t, n)	(t, n)
		Modulo		n + 1	2	2	2	N	N	—	2	2	d	N	N	d	d
		Qubits		—	—	—	—	⌈log2d⌉n	⌈log2d⌉n	2⌈log2d⌉n	—	2	—	—	—	—	—
		Type of Computation		b-by-b	b-by-b	b-by-b	b-by-b	s-by-s	s-by-s	b-by-b	b-by-b	b-by-b	s-by-s	b-by-b	b-by-b	s-by-s	s-by-s
	Attacks	IR		—	Yes	Yes	Yes	Yes	Yes	—	Yes	Yes	Yes	Yes	Yes	Yes	Yes
		Collusion		—	Yes	No	No	—	—	—	Yes	—	Yes	—	—	Yes	Yes
		EM		—	—	Yes	—	Yes	Yes	—	—	Yes	Yes	Yes	Yes	Yes	Yes
		Collective		—	—	—	—	—	—	—	—	—	—	—	—	Yes	Yes
		Coherent		—	—	—	—	—	—	—	—	—	—	—	—	Yes	Yes

Conclusion

In this paper, we have presented the hybrid (t, n) threshold quantum protocols for multiparty summation and multiplication. They have better communication and computation costs as the type of computation is secret-by-secret. They can resist the quantum attacks, i.e., intercept-resend, entangle-measure, collusion, collective, and coherent. No player cannot get other players’ private information. Our protocols are more secure, flexible, and practical as compared to the existing summation and multiplication protocols. Further, they possess all the benefits (i.e., use qudit instead of qubit, do not pass any secret information through the transmitted particles, do not perform entanglement measurement, and quantum attacks are not possible) of the existing secure multiparty quantum summation and multiplication.