Graph States for Quantum Secret Sharing

0.57 MB·

by  Damian Markham

Graph States forQuantum Secret Sharing
Damian Markham1,2,∗ and Barry C. Sanders3
1Universite´ Denis Diderot, 175 Rue du Chevaleret, 75013 Paris, France
2Department ofPhysics, GraduateSchool ofScience, UniversityofTokyo, Tokyo 113-0033, Japan
3InstituteforQuantum InformationScience, Universityof Calgary, AlbertaT2N 1N4, Canada
Weconsider threebroadclassesofquantum secretsharingwithandwithouteavesdropping andshow how
agraphstateformalismunifiesotherwisedisparatequantumsecretsharingmodels. Inadditiontotheelegant
unificationprovidedbygraphstates,ourapproachprovidesageneralizationofthresholdclassicalsecretsharing
viainsecurequantumchannelsbeyondthecurrentrequirementof100%collaborationbyplayerstojustasimple
majorityinthecaseoffiveplayers.Anotherinnovationhereistheintroductionofembeddedprotocolswithina
largergraphstatethatservesasaone-wayquantuminformationprocessingsystem.
8
0
0
I. INTRODUCTION (ii) tointroducethreesubproblemsthatshowhowtheorig-
2
inal classical secret sharing and the two versions of

ct Secret sharing is one of the most important information- quantumsecretsharingfitintothegeneralproblemand
O theoretically secure cryptographic protocols and is germane highlightthedifferencesbetweenthesesubproblems,
to onlineauctions, electronicvoting, sharedelectronicbank-
1 (iii) develop a graph state formalism [6] that unites these
ing, andcooperativeactivationofbombs. Althoughfirstfor-
1 subproblemsintooneelegantframework,
mulatedandsolvedinclassicalinformationterms[1],twodi-

] rectionshavebeenfollowedinthequantumcase:classicalse-
h cretsharingwithquantumenhancementofchannelstoprotect (iv) extend one class of subproblems concerning classical
p secret sharing in insecure public channels beyond the
against eavesdropping [2] (and experimentally realized [3])
- existingsecurityproofsthatrequire100%collaboration
t andprotectingquantuminformationasanapplicationofquan-
n bytheplayers,and
tum error correction [4] (and experimentally realized in the
a
u ‘continuousvariable’Gaussianstatecase[5]).
(v) introduceembeddedsecretsharingprotocolsforgraph
q Insecretsharing,adealerwishestotransmitasecret,which
stateswithinone-wayquantumcomputing,whichcould
[ canbeabitstringoraqubitstringanddealsanencodedver-
serveasafirststeptowardsimplementingintegratedse-
sionofthissecrettonplayerssuchthatsomesubsetsofplay-
2 cret sharing protocolswithin quantumcomputing,e.g.
erscancollaboratetoreconstructthesecretandallothersub-
v distributed measurement-based quantum computation
2 sets are denied any informationwhatsoeveraboutthe secret.
(MBQC)[7].
3 Theaccessstructureisthesetofallsubsetsofplayersthatcan
5 obtainthe secret, andthe adversarystructureis the set of all
1 subsetsofplayersthatarecompletelydeniedthesecret.
8. In threshold secret sharing, each player receives precisely II. SECRETSHARINGPROBLEMANDSUBPROBLEMS
0 one equalshare of the encodedsecret, and a thresholdnum-
8 berofanyplayersk cancollaboratetoreconstructthe secret Tobeginweformulatethegeneralproblem. Thebasicunit
0
whereas every subset of fewer than k players is denied any ofclassicalinformationisthebit,correspondingto 0,1 ,and
: { }
v informationatall: thisschemeisreferredtoas(k,n)thresh- thebasicunitofquantuminformationisthequbit,correspond-
i old secret sharing and is a primitive protocol by which any ingto = span 0 , 1 . Anymessagecanbeencodedin
X H2 {| i | i}
information-theoreticsecretsharingprotocolcanbeachieved. a finite string of bitsif the informationis classicalor in a fi-
r
In each case the channel can be classical or quantum de- nitestringofqubits(perhapsentangledandcouldbe pureor
a
pending on context. A private channel is an authenticated mixed)ifthe‘information’isquantum.
channelthatis imperviousto eavesdropping. A publicchan-
nelisanauthenticatedchannelthatisopentoeavesdropping. Secret Sharing Problem: A dealer holds a se-
Mathematicallychannelsaredescribedbycompletelypositive cretS, whichiseithera bitora qubit,andmust
trace-preservingmappings,evenforclassicalchannelsasclas- send thissecretto n playerssuchanyk ormore
sicalinformationprocessingcanbeembeddedintoaquantum playerscanreconstructthesecret,andallsetsof
framework. fewerthankplayersaswellaseavesdroppersare
Ourgoalshereare deniedanyaccesswhatsoevertothesecret.
(i) to formulatea secret sharingproblemthat allows both Remark. Asecretthatislongerthanonebitoronequbitcan
classicalandquantumchannels,whichcanbeprivateor besharedbyadistributedprotocolthatsharesthestringone
public, bitorqubitatatime.
Our new andgeneralformulationof the secretsharingprob-
lemismeanttobehelpfulinthatitincorporatesvarioussce-
∗Electronicaddress:[email protected] narios of secret sharing with quantum or classical channels
2
thatcanbepublicorprivate,andthethreemajorsecretshar- arethemainstateresourceinalmostallmultipartitequantum
ingareasofstudy[1,2,4]aresubproblemsofthisoverarching information processing tasks, including measurement based
problem. quantumcomputationanderrorcorrection(hencethelargeef-
forttomakethem).Third,theyallowforanelegantgraphical
CC Classical secret sharingwith privatechannelsbetween
representationwhichoffersanintuitivepictureofinformation
the dealer and each player and private Classical chan-
flow,andalsoallowthepossibleuseofgraphtheoreticresults
nelssharedbetweeneachpairofplayers;
toaidproofsandunderstanding.
CQ Classical secret sharing with public channels between Inthisworkweemploygraphstatesinthestandardform[6]
thedealerandeachplayerandeitherQuantumorclas- plustwoextensions. Theseextensionsareactuallyquitesim-
sicalchannelssharedbetweeneachpairofplayers ple (modification via local unitaries) and are intended to al-
low intuitive graphical understanding of how information is
QQ Quantumsecretsharingwhereinthedealersharesquan- encodedandspreadoverthe graphs. The ideais thatthe se-
tum channels with each player, and these channels cretwillbeencodedontoclassicallabelsplacedonverticesof
can be private or public, and the players share either the graph representinglocal operations. The inherententan-
Quantum or classical private channels between each glement of the graph states allows these labels to be shifted
other. around, allowing us to see graphically which sets of players
canaccessthesecretsandwhichcannot(explicitlywrittenas
As secret sharing is information-theoretically secure, the
propertiesP1-P4,seee.g. Fig.2). Wewillgiveseveralexam-
distribution of a classical secret message is completely se-
plesalongthewaytomakeitclear.
cure without the need for quantum information, in contrast
We will begin by defining these extended ‘labeled’ graph
to quantum key distribution [8], which catapults key distri-
states in Subsec. IIIA, followed by describing the graphical
butionoverpublicchannelsto information-theoreticsecurity
rules of how they are used to spread information and how
from the classical limited computational-security guarantee.
it can be accessed in Subsec. IIIB, finishing with how they
Thus case CC [1] is resolved fully by classical information
changeundermeasurementsinSubsec.IIIC.
processing,butweembedCCintoagraphstatedescription.
Case CQ considers quantum-enhanced protection from
eavesdroppingoverpublicchannelsand was firststudied for
A. Labeledgraphstates
(2,2)thresholdsecretsharing[2,9,10]andextendedto(n,n)
threshold secret sharing [11]. The quantum enhancement is
ApuregraphstateisastateintheHilbertspace ⊗n,i.e.a
achievedbyrandomkeydistributionenabledviaquantumpu- H2
rification. stringofnqubits.For =(0 1 )/√2andanundirected
ThethirdcaseQQdealswiththesharingofquantuminfor- graphG=(V,E)com|p±riisingn| iv±er|ticies,with
mation[4],asopposedtoclassicalinformationinthefirsttwo
V= v , E= e =(v ,v ) (3.1)
subproblemsidentified above. To distinguish this case from { i} { ij i j }
thefirsttwocases, theterm‘quantumstatesharing’issome-
thesetofnverticesandthesetofedges,respectively.
times used [5]. In contrast to CQ, which is only solved for
the (n,n) threshold secret sharing case, this quantum infor- Definition 1. Two players i and j are ‘neighbours’iff there
mationversioninprivatechannelsisfullygeneralinthesense exists an edge e that connects their respective vertices v
ij i
thatthegeneral(k,n)casehasbeensolvedasanapplication andv .
j
ofquantumerrorcorrection.
In summary our graph state formalism unifies known re- Thesetofi’sneighboursisdenotedNi.
sults concerning(n,n) CQ plus QQ for higher-dimensional Agraphstateiscreatedfromaninitialstate
stabilizer states, and adds new results, including (3,5) CQ.
Weexpectthatournewapproachtoallformsofquantumse- + ⊗n =H⊗n 0 ⊗n, H = + 0 + 1 , (3.2)
| i | i | ih | |−ih |
cretsharingin the literaturewill enablefurtheradvancesbe-
with H the Hadamard transformation, by applying the two-
cause ofthe eleganceandunifyingpropertiesofthisformal-
qubitcontrolled-phasegate
ism.
CZǫǫ′ =( 1)ǫǫ′ ǫǫ′ , ǫ,ǫ′ 0,1 , ǫǫ′ ⊗2 (3.3)
| i − | i ∈{ } | i∈H2
III. GRAPHSTATES
to all pairs of qubits whose corresponding vertices on the
grapharejoinedbyanedgeandnottoanypairnotconnected
Graph states provide a superb resource for secret sharing,
byan edge. The commutativityofall CZ operationsimplies
asweshow.Theadvantagesofusinggraphstatesinthiswork
thattheorderofapplyingCZgatesisunimportant:
arethreefold. First,theyarethemostreadilyavailablemulti-
partiteresourcestatesinthelaboratoryatpresent,withgraph G = CZe + ⊗n. (3.4)
states of up to 6 qubits already built and used for informa- | i | i
eY∈E
tionprocessingexperimentally[12, 13], andmanyproposals
fortheirimplementationinvarioussystems. Second,theyare We now modifythe graphlabeling. Theusualgraphstate
naturalcandidatesforintegrationofdifferenttasks,sincethey haseachnodelabeledbyitsvertexindex;inotherwordsthe
3
labelofvertexv istheindexi,whichhasabitstringlength
i
of O(logn). We append to this label three more bits so the
labelofvertexv is(i,ℓ ,ℓ ,ℓ )foreachℓ 0,1 .
i i1 i2 i3 ij
∈{ }
Thefirsttwolabelsareusedtodescribeclassicalinforma-
tionspreadoverthestate. Overallvertices,wedefinethevec-
tors~ℓ =(ℓ ,ℓ )fortheithvertex,~ℓ =(ℓ ,ℓ ,...,ℓ )
i⋆ i1 i2 ⋆j 1j 2j nj
forthejthbitoverallnvertices,and
~ℓ=(~ℓ ,~ℓ ,...,~ℓ ). (3.5)
1⋆ 2⋆ n⋆
Graphicallytheselabelswillbeattachedtotheirverticesand
usedto representthe spreadingofclassical information. Ifa
vertexv hasnolabel,thisisequivalenttosetting~ℓ =(0,0).
i i⋆
Thethirdadditionalbitℓ occursinthesecurityofproto-
cols,andisnotrelevanttotih3eclassicalinformationtransmit- FIG. 1: (Color online) Labeled graph with vertex v1, depicted
as 1 inside a (cid:3), which indicates that S has been applied to this
ted. For the ease of graphical manipulation of the encoded
vertex, and vertices v2 and v3, depicted as the numerals 2 and 3
information,we absorbthisbitinto thegraphitself. Graphi-
callythethirdbitℓi3 isdepictedasthevertexvi beingeither iXnsℓiid1eZℓ#i2. haTvheebleaebnelsap~ℓpil⋆ied=to(eℓaic1h,ℓiq2u)biitndji,carteesptehcattiveolpye.ratFioonr
a#(thesetofwhichisdenotedV#),forℓ =0,ora(cid:3)(the
tsheutsoaf wunhiiocnhoifstdweonotytepdesVo(cid:3)f)v,efrotirceℓis3, = 1.i3The vertex set is ~sℓtia⋆te≡|G(0~ℓ⋆,2ℓii2)=∀i,Zth1ℓi1s2la⊗belZed2ℓ2g2ra⊗phZst3ℓa3t2e(c|o0rr+es+poin+dsit|o1t−he−eni)co/d√ed2
(Eqn.(3.13)).
V=V# V(cid:3). (3.6)
∪
Wethushavetheextendedgraphs =(V#,V(cid:3),E). Encodedgraph states can be elegantlyexpressed in
G |G~ℓ⋆2i
Theseextralabelsimplythe actionoflocalunitaryopera- thestabilizerformalism. ForY = iXZ andstabilizeropera-
tions(hencemaintainingentanglementproperties)viathefol- torsforanyithvertexdenotedby
lowingdefinition.
Definition2. The‘labeledgraphstate’,isobtainedfromthe Ki# =Xi⊗ei,j∈EZj, Ki(cid:3) =Yi⊗ei,j∈EZj, (3.11)
graphstate G by
| i (for circular and square vertices respectively) the encoded
state iscompletelyspecifiedbyeigenequations
(cid:12)(cid:12)G~ℓ(cid:11)=Oi (cid:16)Xiℓi1Ziℓi2(cid:17)|Gi |G~ℓ⋆2i K#,(cid:3) =( 1)ℓi2 i V. (3.12)
= Sj G (3.7) i |G~ℓ⋆2i − |G~ℓ⋆2i∀ ∈
|Gi | i
j|vOj∈V(cid:3) Thefollowingtwoexamples,forthreeandforfourqubits,
respectively, explain how the stabilizers define the encoded
for
graphstates.
X =0 1 + 1 0,
| ih | | ih | Example1. Thethree-qubitlabeledgraphstatepresentedin
Z =0 0 1 1, (3.8)
| ih |−| ih | Fig.1istheencodedgraphstate
S =0 0 i1 1.
| ih |− | ih |
0++ +i1
Remark. The partial phase shift gate S is used to perform G =Zℓ12 Zℓ22 Zℓ32 | i | −−i ,
anX Y basistransformationforprotectionagainsteaves- | ~ℓ⋆2i 1 ⊗ 2 ⊗ 3 (cid:18) √2 (cid:19)
droppi↔ng,analogoustotheBB84strategy[8]. (3.13)
andistheuniquecommoneigenstateof
Forencodingpurposes,onlylocalZ gatesarerequired,so
weintroduceanotherkindofgraphstate. (cid:3)
K =Y Z Z
1 1⊗ 2⊗ 3
Definition3. The‘encodedgraphstate’is K# =Z X 11
2 1⊗ 2⊗ 3
|G~ℓ⋆2i= Ziℓi2|Gi. (3.9) K3# =Z1⊗112⊗X3, (3.14)
Oi
witheigenvalues~ℓ =(l ,l ,l ).
Thus the encodedgraph state is also a labeled graph state ⋆2 12 22 32
with ℓ = 0 for all i, = .
1i |G~ℓ⋆2i |G~ℓ=(0,ℓ12,0,ℓ22,...,0,ℓn2)i A four-qubit encoded graph state is given in the fol-
Encodedgraphstatesexhibittheorthonormalityproperty lowing example. First we define the n-qubit Greenberger-
Horne-Zeilinger-Mermin(nGHZM)graphandcorresponding
DG~ℓ⋆2(cid:12)G~ℓ′⋆2E=δ~ℓ⋆2~ℓ′⋆2. (3.10) nGHZMgraphstate.
(cid:12)
4
Definition4. ThenGHZMgraphforvertexv isthedegreen
i
graph
=(V= v ,E= (v ,v ) ), (3.15)
nGHZM j 1 j6=i
G { } { }
and the nGHZM graph state is the state corresponding to
.
nGHZM
|G i
Example2. The4GHZMgraphisdepictedinFig.2(a),and
thecorrespondingencoded4GHZMgraphstateis
=Zℓ12 Zℓ22 Zℓ32 Zℓ42 , (3.16)
|G~ℓ⋆2i ⊗ ⊗ ⊗ |Gi
1
= (0+++ + 1 ),
|Gi √2 | i | −−−i
andisfullydefinedbythefourstabilizers
FIG. 2: (Color online) Equivalence of labeled graph states depict-
K# =X Z Z Z, K# =Z X 11 11, ing bit dependence for four players. (a) The initial four party en-
K1# =Z ⊗11 ⊗X ⊗11, K#2 =Z ⊗11 ⊗11 ⊗X, (3.17) coded graph state corresponds to ~ℓi⋆ = (0,li2). (b) Equivalent
3 ⊗ ⊗ ⊗ 4 ⊗ ⊗ ⊗ statewith~ℓ1⋆ = (0,0), ~ℓ2⋆ = (0,l22),~ℓ3⋆ = (0,l32), and~ℓ4⋆ =
witheigenvalues~ℓ =(l ,l ,l ,l ). (l12,l42)(seeEqn.(3.19)): bitℓ12 hasbeenshuffledfromvertex1
⋆2 12 22 32 42 tovertex4,whichisindicatedbythearrowinthefigure. (c)Equiv-
alentstatewithbitℓ22shuffledtotheotherparties:~ℓ1⋆ =(ℓ22,l12),
~ℓ2⋆ = (0,0), ~ℓ3⋆ = (0,ℓ22 l32), and ~ℓ4⋆ = (0,l22 l42) as
B. DependenceandAccess indicatedby arrowsand labels⊕(seeEqn.(3.20)). NOTE:⊕vertexvi
withoutlabelisequivalenttosetting~ℓi⋆ =(0,0).
We first consider sharing a classical secret; sharing quan-
tumsecretsfollowsfromthisaswewillseelater. Eachqubit
representedbyavertexinthegraphisheldbyoneplayer,and labeled graph states where labels can be shuffled outside V′
theclassicalsecretisencodedintothelabel~ℓ⋆2. Asubsetof as much as possible. Of course different ~ℓ⋆2-labeled graph
playersisrepresentedbyavertexsubsetV′ V. states,equivalentlyencodedgraphstates,mustbeinequivalent
Forgenerallabeledgraphstates,allacces⊂sibleinformation because of the orthonormality relation (3.10); indeed this is
for V′ resides in the reducedstate obtained from the labeled whyweneedthe~ℓ labels.
⋆1
graphstate(3.7): Then the next step is to ascertain if the desired informa-
tion can be accessed by V′, which is effected by a measure-
ρV′~ℓ =TrV/V′|G~ℓihG~ℓ|. (3.18) ment protocol correspondingto appropriate combinationsof
K (3.11),thenexploitingtheeigenequationrelations(3.12).
i
Inthecontextofsecretsharing,itisimportanttoknowwhat
Fortunately the graph readily reveals the appropriate way
information about ~ℓ is contained in ρV′~ℓ. The information to do this. Before giving the general rules, we begin with a
sharedbetweenρ and~ℓexhibitstwoimportantproperties: four-qubitexample.
V′~ℓ
Example 3. A dealer distributes the encoded graph
A1 Bit dependence:–ρ is dependent on bit k if ρ is
V′~ℓ V′~ℓ state (3.16) to all four players V = v ,v ,v ,v depicted
notinvariantunderaflipofthekthbit. { 1 2 3 4}
inFig.2(a).Inthisexampleweshowthat,ifthethreeplayers
A2 Bit access:– Bit k is accessible if there exists a mea- inV′ = v1,v2,v3 collaborate,theylearntwobits(ℓ22,ℓ32)
{ }
surement protocol such that one copy of ρ reveals of the four-bit encoding and are entirely denied knowledge
V′~ℓ
thevalueofbitkwithcertainty. of two other bits (ℓ12,ℓ42), whether they use shared quan-
tumchannelsoronlyLOCC.Wealsoseethatjusttwoplayers
A2 A1,butA1;A2. Givendependencyonabit,itisespe- V′′ = v ,v can(andcanonly)acquireℓ ℓ viaLOCC,
cial⇒lyusefultoknowwhatinformationcanbeobtainedbyV′ where{ 2iss3u}mmation mod 2. 22⊕ 32
vialocaloperationsandclassicalcommunication(LOCC)or ⊕
Acting upon the encoded graph state (3.16) by the fourth
viaquantumchannels.
stabilizerofEq.(3.17)yields
Graphicallyweascertainthedependancyofasetofplayers
V′ on the information by shuffling bits between neighbours: K#ℓ12 =11 Zℓ22 Zℓ32 Xℓ12Zℓ42
that is, exploitingequivalencesbetween labeled graph states 4 |Gℓ~⋆2i 1⊗ 2 ⊗ 3 ⊗ 4 4 |Gi
withdifferentlabels~ℓ. Ifalabeldoesnotoccurononeofthe =(cid:12)G~ℓ=(0,0,0,ℓ22,0,ℓ32,ℓ12,ℓ42)E
ovebrvtiioceussibnecthaeusseetthVe′,lathbaetlsweotuhladstnhoendreeppernedseennctyaolonciatl.uTnhiitsariys =((cid:12)(cid:12)−1)ℓ12ℓ42|Gℓ~⋆2i. (3.19)
operationoutsidethesetV′, whichcannotaffectthereduced TheplayersubsetV′ = v ,v ,v isthusindependentofℓ
1 2 3 12
{ }
density matrix ρ . We thus look for equivalencesbetween becauselocalunitarydependenceonℓ hasbeenshuffledto
V′~ℓ 12
5
player v ’s two-bit label ~ℓ . In Fig. 2(b), this ℓ bit shuf- Example4. ForExamples2and3letthe#representationof
4 4⋆ 12
fle is depicted as a green arrow from vertex v to vertex v . vertexv bechangedtoa(cid:3)inFig.2(a).Thus,inFig.2(c),the
1 4 1
Vertexv1 is unlabeledbecause its bit valueis now zero, and resultantbitpaironvertexv1is~ℓ1⋆ =(ℓ22,ℓ12 ℓ22)instead
vertexv4 nowhasatwo-bitlabel~ℓ4⋆ = (ℓ12,ℓ42). Thegraph of ~ℓ = (ℓ ,ℓ ) because modifying X ⊕Y = iXZ in
1⋆ 22 12
statesinFigs.2(a)and2(b)arethusequivalentupto(anirrel- therevisedstabilizerK# K(cid:3) yieldsane7→xtraZ operation
evant)globalphase. 1 7→ 1
leadingto 1 on the second bit(via the appropriatechange
Players in V′ share a reduced state that is dependent on toEq,(3.20⊕)).Theothersremainthesame~ℓ =(0,ℓ ℓ ),
bits ℓ ,ℓ . In fact they can perform measurements corre- 3⋆ 2⊕ 3
spond2i2ng3to2 K# and K# to learn these two bits according ~ℓ4⋆ =(0,ℓ2⊕ℓ4).
2 3
to (3.12). With shared quantum channels, there is no prob-
Theseexamplesforfourqubitsaregeneralizabletonqubits
leminperformingsuchajointmeasurementasK2# andK3# with # or (cid:3) vertices. Here are the general principles for
commute and have supportonly on operationsby players in
accessibility and dependence of information in an encoded
V′. Howeverquantumchannelsarenotrequired: theplayers
graphstate.
canlearn(ℓ ,ℓ )byLOCCbecausethestabilizerscommute
22 32
locally. In contradistinction a failure of local commutation Proposition 1. The following principles hold for encoded
wouldimplythatthesebitscouldnotbelearnedbyLOCC. graphsstates .
Infactasmallersetofplayerscanaccessinformation.Con- |G~ℓ⋆2i
tsoidreKrt#hℓe22seytieolfdpslayersV′′ = {v2,v3}. Applyingeigenopera- P1 oTnheveenrtceoxdvedigsraepqhuivstaalteent|Gto~ℓ⋆2tihewliathbeolnede-bgirtalpahbesltalit2e
1 i
where vertex v is relabeled 0 and a neighbour-
K1#ℓ22(cid:12)(cid:12)(cid:12)G~ℓ⋆2E=X⊗ℓZ22ℓZ22ℓ+12ℓ3⊗2 ⊗11Zℓ22+ℓ42|Gi |o~ℓinGjfg⋆~ℓtih=veet(ryℓtepi2xe,#vℓjj2oi⊕rs(cid:3)ℓrie2,l)ari,ebdsepelpeecedtniedvieitnlhyge.roTn~ℓhjwe⋆hree=tmhae(rinℓviie2nr,gtℓenjx2e)vigiohisr-
= boursofv ,v N arerelabeled(0,ℓ ℓ ). Inthis
(cid:12)G~ℓ=(ℓ22,ℓ12,0,0,0,ℓ22⊕ℓ32,0,ℓ22⊕ℓ42)E wayanynjeigkhb∈ouriofv canshufflethek2d⊕epein2dencyof
(cid:12) i
=((cid:12)−1)ℓ12ℓ22(cid:12)G~ℓ⋆2E (3.20) ℓflii2ngtoisitdseeplficatneddatosgitrseerenmaarrinoiwnsgannedigshhboowusrhs.owBidtespheunf--
(cid:12)
Thisimpliesthatthereducedde(cid:12)nsitymatrixonlydependson dence of the reduced state on bit labels can be trans-
ℓ ℓ . Thisinformationcanbeaccessedbymeasuring ferredfromoneplayertoanother.
22 32
⊕
K#K# =11 X X 11. (3.21) P2 Thebitvalueℓ isaccessiblebyplayersinsetV′ifand
2 3 ⊗ ⊗ ⊗ onlyifv andail2litsneighboursN areinthesetV′.
i i
This can be done by LOCC. This shuffling is illustrated in
Fig.2(c);henceallgraphstatesinFigs.2(a)to2(c)areequiv- P3 IfthesetV′ comprisesanevennumberofplayers,and
alent. all their external neighbours (outside the set V′) are
neighboursofeachandeveryplayerinV′,thenthesum
Remark. StabilizeroperatorsK#(andproductsthereof)are
i (mod 2) of all their one-bit labels ℓ is accessible,
not directly measured by the players under LOCC; rather { i2}
i.e.theycancollaboratetofind
playerslocallymeasureintheX ,Y =iX Z ,orZ basesto
i i i i i
obtainone-bitoutcomessXi ,sYi ,andsZi ,respectively, where ℓ ℓ ... ℓ , v ,v ,...,v V′.
sα is assigned the value 0 if the measurement outcome is 1, i2⊕ j2 ⊕ m2 i j m ∈
i
and1ifthemeasurementoutcomeis 1.
Then the bit value outcome for th−e measurement of K# P4 IfP2holds,andplayersinthesetsharequantumchan-
2
andK# inExample3is nels,allinformationencodedinone-bitlabelsisacces-
3
sible. Ifthesetsharesonlyclassicalchannels,andP2
ℓ =sZ sX, ℓ =sZ sX, (3.22) holds,theninformationaccessibilityislimitedbecause
22 1 ⊕ 2 32 1 ⊕ 3 neighboursv andv inthesetcanonlylearneitherℓ
i j i2
respectively. Henceforth when we say players can locally or ℓ but not both, but v and v in the set can learn
j2 i j
measureanoperator,wemeanmeasurementinthesensethat bothℓ andℓ iftheyarenotimmediateneighbours.
i2 j2
localPaulimeasurementscanbeperformedandresultantbit
outcomescombinedtolearnthesameasifnonlocalstabilizer NOTE: The bit shuffling in P1 is not active; rather it recog-
measurementswereperformed. nizesequivalencebetweenlabeledgraphstates.
For Example 3, each player’s qubit corresponded to a # Proof. All proofs are simply derived from eigenequa-
vertex. Extending to (cid:3) vertices is straightforward by using tions (3.11) and (3.12), which shuffles bits between play-
theK(cid:3) stabilizers(3.11). Specificallyifavertexismodified ers,therebyrevealingactualdependenceofreducedstateson
i
bychangingits graphrepresentationfroma #to a (cid:3), in the givenbitlabels ℓ .
i2
stabilizersanX ischangedtoaY andwehaveacorrespond- For P1, supp{ose}vertex v has a neighbouring vertex v
i j
ingchangetothebittransfer. whichiseithera#ora(cid:3). Then
6
|G~ℓ⋆2i=(−1)ℓi2ℓj2Kj#ℓi2|G~ℓ⋆2i=(−1)ℓi2ℓj211i⊗Zjℓj2Xjℓi2 ⊗(vk,vj)∈EZk(ℓk2+ℓj2)⊗m6=i,j;(vm,vj)∈/EZmlm2|Gi,
|G~ℓ⋆2i=(−1)ℓi2ℓj2Kj(cid:3)ℓi2|G~ℓ⋆2i=(−1)ℓi2ℓj2i11i⊗Zjli2⊕ℓj2Xjℓi2 ⊗(vk,vj)∈EZk(ℓk2+ℓj2)⊗m6=i,j;(vm,vj)∈/EZmℓm2|Gi, (3.23)
respectively. Evidently dependency on ℓ is shuffled from
i2
neighbourv tov ,andv ’sotherneighboursareasdescribed
i j j
inP1.
For P2, players obtain ℓ by measuring K#,(cid:3) of (3.11)
i2 i
and(3.12). BecauseK#,(cid:3) isnontrivialoniandalsoonN ,
i i
by (3.11), player i and all of N must collaborate to mea-
i
sureℓ ,andthiscollaborationissufficient.
i2
ForP3westartbylookingatthecaseV′ containsonlytwo
players. By (3.11) if all neighbours of pair v ,v V′ are
i j
either in the set, or shared outside the set, K#,(cid:3) ∈K#,(cid:3) is
i · j
nontrivialonlyinsidetheset,andthuscanbemeasuredbythe
membersoftheset. ThisistruesincealltheZfromtheK#,(cid:3)
i
cancel with the Z from K#,(cid:3) on their commonneighbours.
j
ApplyingK#,(cid:3) K#,(cid:3)to(3.12),weseethatthisyieldsℓ
i · j i2⊕
ℓ . Similarlythisholdsforanyevennumberofplayers.
j2
For the comparison of LOCC to the fully quantum case
ofP4,bytheabovelogicifpropertiesP2andP3hold,thenthe FIG.3:(Coloronline)WhenPauliZandY measurementsaremade
dependencyontheassociatedobservablesarenontrivialonly on vertex v1, graphs (a) and (b) metamorphose into (a′) and (b′),
within the set. As all operators K#,(cid:3) commute, all observ- respectively. Outcomes Siα = 0,1 correspond to measurement
i eigenvalues 1,+1respectively,andareincorporatedintothelabels
ables commute in the nontrivial set, and hence can be mea- in(a′)and(b−′).
suredbyglobaloperations.
ForLOCC,itisclearfrom(3.11)that,ifverticesv andv
i j
Paraeulnieoigphebraotuorrss,othneinaKndi#,j(cid:3)haenndceKcj#an,(cid:3)nosthbareesdimiffuelrtaennetoloucslayl vertexvi anditsedgesdeleted. ForoutcomesZi ,thelabelsof
allverticesinN changeto~ℓ ⋆ (0,ℓ sZ). Wedenote
measuredlocally;therefore,evenifP2holds,onemustchoose i j 7→ j2⊕ i
theresultantgraphbyg.
one measurement or the other. If vertices v and v are not
i j If a Y measurement is made on vertex v of an encoded
neighbours, they are indeed amenable to simultaneous local i
graph state with circular vertices, the resultant state is a la-
measurements. Similar statements can be made when P3
beled graph state obtained by applying the following four
holds,butaremorecomplicatedgraphicallyandmustbetaken
stepstotheoriginalgraph;thenewgraphisdenotedg′.
casebycase.
S1 Performlocalcomplementationonv :allexistingedges
i
between elements in N are removed, and where they
C. LocalZandY measurementsonencodedgraphstates i
didnotexist,theyareadded.
In our protocols encoded graph states with both (cid:3) and #
vertices arise as a result of performing either Y or Z mea- S2 Each#vertexinNi ischangedto(cid:3).
surementsonqubitsidentifiedbyverticesofthelabeledgraph
with only circular vertices. Local Pauli measurements on S3 For outcome sY, the labels on the neighbours of i
i
graphstatesaredescribedbyasimplesetofrules,whichread- changetoℓ =(0,ℓ ) (0,ℓ ℓ sY)
ily yield the resultantstates [6]. These rules were originally j⋆ j2 → j2⊕ i2⊕ i
statedintermsofgraphstatesuptolocalunitaryoperations.
S4 Removevertexiandallitsedges.
For ourpurposeswe wouldlike to incorporatealso these lo-
cal unitaryoperationsinto the labeled graphstates. We now
representtheserulesexactlygraphicallyfortheZandY mea- Example 5. A Z and a Y measurement on vertex v1 of a
surements,usingthelabeledgraphsabove,withnolocaluni- squaregraphstatewith circularvertices changesthe graphs
taryambiguity. asdepictedinFig.3.
If a Z measurement is made on vertex v of an encoded
i
graph state with circular vertices, the resultant state corre- These rules can easily be understood by the fact that any
spondstoalabeledgraphstateoftheoriginalgraphbutwith encodedgraphstate with labelsℓ = 0 i can bewritten in
i2
∀
7
theform IV. SECRETSHARINGPROTOCOLS
1
|G(~0)i=√2(cid:18)|0i1|g(0···0)i2,...,n+|1i1|g(1···10···0)i2,...,n(cid:19) Inthissectionweintroduceourthreesecretsharingproto-
cols beginningwith CC for sharing classical secrets in Sub-
∈N1
eiπ/4 | {z } sec.IVA. Usingourgraphstateapproach,weconstructsolu-
= 0′ g′ ) tionsforeachof(n,n),(3,4)and(3,5)thresholdsecretshar-
√2 (cid:18)| i1| (0···0 i2,...,n
ing. These results provide a foundation for our subsequent
protocols:CQinSubsec.IVBandQQinSubsec.IVC.
i1′ g′ , (3.24)
− | i1| (1 10···0)i2,...,n(cid:19)
···
∈N1
| {z } A. CC
with 0 , 1 and
{| i | i}
0′ =1/√2(0 i1 ), 1′ =1/√2(0 +i1 ) In the CC protocol, classical information is directly en-
{| i | i− | i | i | i | i } coded into the bit string ~ℓ , i.e. onto the encoded graph
⋆2
theeigenstatesoftheZ andY Paulioperators,andthecorre-
state inamannerthatenablescertainsetsofcollab-
spondingeigenvaluesare+1and 1,respectively.Addingla- {|G~ℓ⋆2i}
oratingplayerstoaccessconcealedinformationaccordingto
−
bels~ℓ⋆2 indicatestheapplicationoflocalZs. Thiscommutes theprinciplesofthesecretsharingprotocol.
withmeasuringPauliZ,sothelabelscarryforwardonlywith MathematicallyourprotocolissimilartoGottesman’s[14]
theadditionofthecorrectionfromthemeasurementitself,e.g. whereinstabilizersareusedtoshareclassicalsecretsinquan-
Fig. 3(a),(a’). However, local Z does not commute with a tumstates.AdifferencebetweenourschemeandGottesman’s
Y measurement,hencethebitℓ12 carriesontothemeasured is that he uses mixed high-dimensional states whereas our
graph(S3),e.g. Fig.3(b),(b’). graphstateapproachenablesuseofpurestatesonqubits.An-
Thefollowingdefinitionfollowsnaturally. otherdifferencewithGottesman’sapproachisthatourmethod
is notas general: ourscheme worksfor a limited numberof
Definition5. Givenagraph withonlycircularvertices,and
G (k,n) scenarioswhereasGottesman’smethodworks forany
associatedencodedgraphstate , thegraphofthestate
|G~ℓ⋆2i (k,n). Although our scheme is more restrictive, it is appli-
givenbymeasuringPauliY onvertexi 1,...,n iscalled
theconjugategraphdenotedg′,withcon∈ju{gategrap}hstatede- cable to a restricted set of cases and importantly provides a
foundationforthe protocolsdiscussedinsubsequentsubsec-
noted g′ andcanbefoundexplicitlybyfollowingthe
| i1,...,n/i tions.
rules
TheCCprotocolstepsareasfollows:
R1 Performlocalcomplementationonv .
i CC1 ThedealerencodesthesecretbitstringS intotheclas-
R2 Replaceallneighboursofiwith(cid:3)vertices. sicalinformation~ℓ andencodesthisontothen-qubit
⋆2
state .
R3 Removev andallitsedges. {|G~ℓ⋆2i}
i
CC2 Thedealersendseachplayeronequbit.
Itcaneasilybeshownthatencodedconjugategraphstates
canbewrittenas CC3 An authorizedset of playersaccesses the secretbit by
measuring appropriate stabilizer operators (prescribed
e−iπ/4
(cid:12)g(′0···0)E= √2 (cid:18)|g(0···0)i+|g(1···10···0)i(cid:19) explicitlyineachcase).
(cid:12)(cid:12) ∈N1 Hereweanalyzetheabilityofsetsofplayerstoaccessthisin-
e−iπ/4 | {z } formationfortwocases: usingLOCCandusingfullquantum
(cid:12)(cid:12)g(′1···10···0)(cid:29)= √2 (cid:18)|g(0···0)i−i|g(1···10···0)i(cid:19) caodmifmfeurennictasthioanri(nFgQsCtr)u.cWtuerew,iallnsdeethtahtattheeacrhulgersaopfharecpceressseanrtes
(cid:12)(cid:12) |∈{Nz1} |∈{Nz1} (3.25) simpleingraphterms,andshowthatsomegraphscanbeused
as secret sharing schemes as set out in the introduction. In
soareeffectivelyconjugatetotheencodedgraphstates particularwepresentschemesfor(n,n),(3,4)and(3,5).
We now proceed to give explicitexamplesof how the de-
{(cid:12)g(0···0)(cid:11),|g(1···10···0)i}. pendence and access properties in Sec. IIIB can be applied
(cid:12) ∈N1 to give secret sharing via the above protocol. We begin by
| {z } looking at the case of nGHZM states. Using Property P1,
ThefollowingdefinitionsareusefulforSec. V. i
we can see in Fig. 4(a) that the player set v ,...,v de-
1 m
{ }
Definition6. ThenGHZMgraphGnGHZMi isembeddedinG pendsonly on bits ℓ22,...,ℓm2; i.e., the dependencyon ℓ12
if andN = . hasbeenremoved. FromP2itispossibleforthesameplayer
GnGHZMi ⊂G i∩G\GnGHZMi ∅
settorecoverallℓ ...,ℓ ,and,byP4,thiscanbedoneby
Definition7. ThenGHZMgraphstateisembeddedintostate 22 m2
LOCC.
if isembeddedin .
|Gi GnGHZMi G Explicitlythiswouldbedonebyplayer1measuringZ1and
Wenowhavethenecessaryformalismtodevelopthevari- the remainingplayers v ,...,v measuring X and com-
2 m i
oussecretsharingprotocols. paringresultstomeasu{reK#,...,K} #,yieldingℓ ,...,ℓ
2 m 22 m2
8
obtain,andonlyobtain,ℓ ℓ . Fig.5(c)revealsthatplay-
22 42
ers v ,v ,v obtain,and o⊕nlyobtain,ℓ and/or(byusing
1 2 3 22
{ }
FQC/LOCC)ℓ ℓ .
12 32
Similarly, play⊕ers v ,v ,v obtain, and onlyobtain, ℓ
2 3 4 32
{ }
and/or (via FQC/LOCC) ℓ ℓ . The remaining triplets
22 42
⊕
obtain, and only obtain, ℓ and/or (via FQC/LOCC) ℓ
12 22
ℓ in the case of v ,v ,v , and ℓ and/or (FQC/LOCC⊕)
42 1 2 4 42
ℓ ℓ inthecas{eof v ,v},v .
12 32 1 3 4
⊕ { }
We see that this graph gives a (3,4) threshold scheme by
setting
FIG. 4: (Color online) Distribution and access of information
l12,...,ln2 for the n-GHZM state. The green arrows represent ℓ12 =ℓ22 =ℓ32 =ℓ42 =S. (4.2)
{ }
uses of dependency Property P1. In (a) the dependency on l12 is
takenoutoftheset,andin(b)thedependencyonl22issharedacross
thewholeset.Thisencodedgraphstategivesan(n,n)secretsharing
Ourfinalresultinthissubsectionconcernsthe(3,5)thresh-
schemebysettingl12 =Sandtheotherbitscanbesetarbitrarily.
oldscheme,givenbya5-qubitringdepictedinFig.6.
Proposition4. Thefive-qubitencodedRINGgraphstateen-
viaeigenequations(3.12). Hence,inthiscase,LOCCissuffi- ables(3,5)thresholdsecretsharingfortheCCprotocolpro-
cientforallpossibleinformationaccess. vided that ℓ = ℓ = ℓ = ℓ = ℓ = S, with LOCC
12 22 32 42 52
Similarly Fig. 4(b) shows how P1 implies that the player betweenplayersbeingsufficientfordecoding.
subset v ,...,v dependsonbits
2 m
{ } Proof. Fig. 6(a) shows how P1 implies that players 1 and 2
l ℓ ,ℓ ℓ ,...,ℓ ℓ cannotaccessanyinformationbecausethedependencycanbe
22 32 22 42 22 m2
⊕ ⊕ ⊕ takenawayfromthem. Similarlyitiseasytoseethatnopair
onlyand,byP3andP4,theycanbeaccessedsimultaneously of players can access any information by application of P1.
byLOCCalone. Explicitlythiswouldbedonebyallplayers Ontheotherhandifthreecyclicneighbours vi,vj,vk form
{ }
measuringXi. Theplayersinthissetthencompareresultsto a set, P1 implies the set only depends on ℓj2; this is clear
measure from the case for the player set v1,v2,v3 in Fig. 6(b). P2
{ }
implies the bit can be accessed, and P4 says this access can
K# K#,K# K#,...K# K#. (4.1) beachievedviaLOCC.Accessingwouldbeaccomplishedby
2 · 3 2 · 4 2 · m measuringK#, which is done by locally measuringZ , X ,
j i j
Only in the case that all players collaborate would there be Z .
k
a difference between the LOCC and FQ cases; in this case Theremainingpossiblesetsofthreeplayersareallsimilar
P4 implies that, by LOCC, the players can either access to the T shape in Fig. 6(c); in this case the set v ,v ,v
i j k
{ }
ℓ ,...,ℓ or ℓ . Obviously, for FQC, all information is dependsonlyonℓ ℓ ℓ bypropertyP1.Thisisseenfor
22 n2 12 i2 j2 k2
simultaneouslyaccessible. theexample v ,v ,⊕v ⊕inFig.6(c).BypropertiesP2andP4
1 2 4
{ }
Weseeabovethatbitℓ isonlyaccessiblewhenallplay- theplayerscanaccessthesecretbyLOCC.Theirprocedureis
12
ersacttogether. BychoosingthesecretbitS asS = ℓ and effectedbymeasuringK# K# K#,whichisaccomplished
12 i · j · k
fixingallotherℓ arbitrarily,weobtainthefollowingpropo- locallybymeasuringY ,Y ,X .
i2 i j k
sition. Anysetofmorethanthreeplayerscontainsatleastoneof
these possibilities, and the players can therefore access the
Proposition2. AnencodednGHZMstatewithℓ12 = S and sameinformation.BychoosingtoencodethebitsecretS as
allotherℓ settozeroenablesa(n,n)directsecretsharing
i2
schemethatcanbeaccessedviaLOCC. ℓ12 =ℓ22 =ℓ32 =ℓ24 =ℓ52 =S, (4.3)
ThiscaseisdepictedinFig.4. thepropositionisproved.
Nowweseethat(3,4)thresholdsecretsharingisattainable
Here we established three examples that use graph states
withencodedgraphstates.
forsecretsharing.Thesethreeexamplesdemonstratethesim-
ple propertiesof our approach, and more examplesof graph
Proposition 3. The 4-qubit ring encoded graph state with
statesforsecretsharingcouldbefound. Inthenexttwosub-
ℓ = ℓ = ℓ = ℓ = S enables a (3,4) direct secret
12 22 32 42
sections,weextendtheseresultsandtechniquestosecretkey
sharing scheme, and LOCC between players suffices for de-
distillationandtosharingaquantumsecret.
coding.
Proof. The4-qubitringstateisdepictedinFig.5. We seein
Fig.5(a)thatP1showsthatpairs v ,v , v ,v , v ,v B. CQ
1 2 2 3 3 4
and v ,v aredeniedanyinform{ationw}ha{tsoeve}r. { }
1 4
Fi{gure5(}b)showsthattheplayerpair v ,v canobtain, InthissubsectionweaddresscaseCQ,whichcorresponds
1 3
and moreovercan onlyobtain, ℓ ℓ .{Simil}arly v ,v totheprotocolexpoundedbyHillery,Buzˇek,andBerthiaume
12 32 2 4
⊕ { }
9
FIG. 5: (Color online) Application of P1 to the square encoded graph state. This graph gives a (3,4) secret sharing scheme setting
ℓ1 = ℓ2 = ℓ3= ℓ4 = S(seeproposition3).
FIG.6: (Coloronline) Application of P1tothe5-qubit ring encoded graph statetoobtain a(3,5) direct secret sharingscheme by setting
ℓ12 = ℓ22 = ℓ32 = ℓ42 = ℓ52 = S.
(HBB) for sending a classical secret with insecure quantum and(3,3)cases,andthishasbeenextendedtothe(n,n)case
channels between the dealer and players [2]. Actually this in[11].
problemcaninsteadbesolvedbycombiningtheclassicalse- We notethat,asanextensionofHBB, ourprotocolshares
cretsharingprotocolofShamir[1]viastandardquantumkey thesamedrawbacks. TheHBBprotocol,henceours,protects
distribution(QKD)[8]toassuresecureclassicalchannelsbe- againstintercept-resendattacksbutisnotguaranteedtobese-
tween the dealer and each of the players. In the QKD ap- cure against other attacks [9]. Second, it only works for a
proach, the dealer would first establish a random key with noiseless channel: In the case of a noisy channel, the HBB
each of the players individually by using QKD. This would protocol can not establish a key (as the noise will be mis-
enableperfectlysecureclassicalcommunicationbetweenthe takenforaneavesdropper).Thisproblemislikelynotfatal,as
dealerandeachplayer(asaonetimepad),whichcanthenbe approachesinvolvingentanglementdistillationoralternatives
used to performthe Shamir protocolsafely. However, QKD couldhelptoovercometheeffectsofnoiseinthechannel[10].
maynotaffordthemostefficientapproachhencetheinterest Our protocolemploys graph states to generalize the HBB
inalternativeschemes. scheme[2]. Byusinggraphstatesourschemecouldbuildon
HBB [2] combinesecret sharingprotocolswith QKD: the currentexperimentalresearchfor generatinggraphstates for
dealer distributes multipartite states to share a secret key, measurement-basedquantumcomputing[12].Further,encod-
whichcanonlybedistilledbyorsharedwithauthorizedsets ingontographstatesallowsustousethepropertiesdeveloped
of players. This key can then be used to send any classical Sec.IIItogeneralizetootheraccessstructures.
messagethedealerwouldwishtosendtotheauthorizedplay- As an example we show how this approach generalizes
ers,withoutanyunauthorizedpartieshavingaccesstoit. The HBB’s protocol to the (3,5) case, together with the (n,n)
HBBapproachcanbemoreefficientinthenumberofusesof case. Although other examples are not provided here, the
quantumchannelsbetweendealerandplayers,whichiscom- propertiesgiveninSec.IIIBallowfurtherexploration.Inad-
parabletothegreaterefficiencyachievedbydirectdistillation dition, our graph state shows how the HBB protocol can be
of multipartite entanglement rather than distillation of pairs thoughtofasanextensiontoGottesman’sresults[14],inthe
of maximallyentangledstates and complicatedsequencesof sensethatHBB’sprotocolcanberegardedasapurificationof
teleportations[15]). Gottesman’s.
AnotherbenefitisthattheHBBapproachcanbeextended
tosharingquantumsecrets(QQ)asweseeinthenextsubsec- Theunderlyingconceptfortheprotocolissimple. Weuse
tion. HBB[2]createdaclassicalthresholdschemefor(2,2) anentangledstateasthechannelbetweenthedealerDandn
10
players.Thiswillbeagraphstate;hencewecanalwayswrite
inthefollowingway(c.f.Sec.IIIC)
1 {|g(0···0)i1,...,n,|g(1···10···0)i1,...,n},
|G(~0)i=√2(cid:16)|0iD|g(0···0)i1,...,n |∈{NzD}
ortheconjugatestates
+|1iD|g(1···10···0)i1,...,n(cid:17) g′ , g′ .
∈ND {| (0···0)i1,...,n | (1···10···0)i1,...,n}
=eiπ/4 0′| {gz′} ∈ND
√2 (cid:16)| iD| (0···0)i1,...,n As seen in Sec. IIIC these sta|te{sza}re conjugate in the sense
i1′ g′ . (4.4) thatdiscriminatingthestates
− | iD| (1···10...0)i1,...,n(cid:17)
|∈{NzD} {|g(0···0)i1,...,n,|g(1···10···0)i1,...,n}
The dealer measures randomly in either the 0 , 1 or ∈ND
D D
the 0′ D, 1′ D basis. Thedealer’smeasure{m| einto|utico}mes providesnoinformationabout|w{hzeth}erwehave
{| i | i }
providetherandomkey.
Throughthe entanglement, the playerscan access the key |g(′0···0)i1,...,n
bymakingthecorrectmeasurement.Ifthedealermeasuresin
or
0 , 1 ,theresultsarethencorrelatedtothestates
D D
{| i | i }
g′ .
{|g(0···0)i1,...,n,|g(1···10···0)i1,...,n} | (1···10···0)i1,...,n
∈ND ∈ND
| {z }
| {z } Thus, the players cannot discriminate both bases simultane-
held by the players. If any set of players can discriminate
ously,soevenifasetofplayersisauthorizedandcandiscrim-
thesestatesperfectly,theycanfindoutwhatthemeasurement
inate perfectly,50%of the time they will measurein a basis
resultofthedealerwas,andtherebyobtaintherandomkey.
inwhichtheygainnoinformationaboutthedealer’smeasure-
The dealer may instead choose to measure in
mentresult, hencewill notaccess the key. To accommodate
the 0′ , 1′ basis, and then the player’s qubits
{| iD | iD} thisatsome pointin the protocol,thedealeror playersmust
willendupineitheroftheassociatedconjugatestates
announcewhichbasistheymeasure. Resultswherethebases
matcharekept,andthosethatdonotmatcharediscarded.The
g′ , g′
{| (0···0)i1,...,n | (1 10···0)i1,...,n} remainingresultsshouldbeperfectlycorrelatedandprovidea
···
∈ND randomkey,oftenreferredtoasthe‘siftedkey’. Bystandard
| {z } classicalsecurityprotocols[3],thiscanbedistilledtoasecret
correlatedto themeasurementresult. Theabilityto discrim-
keybythedealerandauthorisedplayerssacrificingpartofthe
inate (or in other words, to access the information ~ℓ⋆2 and siftedkey.
hencegetthekey)isthendeterminedbytheconjugategraph
Inthiswayourprotocolsareprotectedagainstalargeclass
g′, which must be checked to have the correct access struc- ofattacks,namelytheso-calledintercept-resendattacks. For
ture also (if we want to do secret sharing). We see that this
suchattacksweimagineaneavesdropper(traditionallycalled
worksfortheGHZandthe5-qubitringencodedgraphstates,
Eve)whotriestogaininformationaboutthesecretkeybyin-
butitdoesnotworkforthe4-qubitringencodedgraphstate.
terceptingthequbitsbeforetheyreachtheplayers,andeither
This is why we cannotextend the (3,4) CC protocolto key measuring them directly or entangling them to some ancilla
distributioninthisway.
‘spy’-qubitsofherownandthensendingthemontotheplay-
In the case of only one player, this corresponds to Ek- ers.(Infact,thiseavesdroppercouldinsteadbesomeunautho-
ert’s protocol [16]. In our case there is the added struc- rizedplayers.) AtanypointintheprotocolEvemaymeasure
ture given by the graph g. Discriminating these states is herentangledancillaspy-qubitstoattemptaccesstothekey.
the same as accessing either the information ~ℓ⋆2 = ~0 or She will try to do this in a way that is not detectable by the
~ℓ = (1,...,1,0,...,0). Bychoosingtherightgraph,only dealerandauthorizedplayers.
⋆2
theauthorizedplayerscanaccesstheinformation,ordiscrimi- Measuringintwoconjugatebasesservestwocomplemen-
natethestatesandaccessthiskey.Inthisfirstinstanceweuse tarypurposestocounterthisparticularclassofattacks. First
exactlythegraphsofthelastprotocolstodothis. Inthisway the measurements in conjugate bases is decided randomly,
theseentangledstates(4.4)areapurificationoftheprotocols which protects against any intercept-resend eavesdropping
ofthelastsection-takinga randomchoiceofthetwograph strategy: if Eve knows which measurement the players will
states(whichcanbeviewedasamixedstate)toanentangled make, she can make the same measurementherself and thus
purestate byaddinganauxiliarysystem, whichisthedealer beundetected,but,ifshedoesnotknowthemeasurementba-
inthiscase. sis, thenanyintrusionbyherwillaffectthestatisticsofsub-
The players also measure randomly to either discriminate sequentmeasurementsandthusbe detectable. Second,mea-
states surement in conjugate bases allows checking of correlations