New Protocols and Lower Bound for Quantum Secret Sharing with Graph States
We introduce a new family of quantum secret sharing protocols with limited quantum resources which extends the protocols proposed by Markham and Sanders  and Broadbent, Chouha, and Tapp . Parametrized by a graph and a subset of its vertices , the protocol consists in: () encoding the quantum secret into the corresponding graph state by acting on the qubits in ; () use a classical encoding to ensure the existence of a threshold. These new protocols realize quantum secret sharing i.e., any set of at least players among can reconstruct the quantum secret, whereas any set of less than players has no information about the secret. In the particular case where the secret is encoded on all the qubits, we explore the values of for which there exists a graph such that the corresponding protocol realizes a secret sharing. We show that for any threshold there exists a graph allowing a protocol. On the other hand, we prove that for any there is no graph allowing a protocol. As a consequence there exists such that the protocols introduced by Markham and Sanders in  admit no threshold when the secret is encoded on all the qubits and .
uantum Cryptography, Secret Sharing, Graphs, Graph States.
A quantum secret sharing [9, 3, 6] is a protocol by which a dealer distributes shares of a quantum secret to players such that any subset of at least players can reconstruct the secret by combining their shares, while any set of less than players cannot have any information about the secret. It is assumed that the secret is an arbitrary one-qubit state, that the dealer has only one copy of the secret he wants to share and that the players can communicate together using classical and quantum channels.
A direct consequence of the no-cloning theorem  is that no quantum secret sharing protocol can exists when – otherwise two distinct sets of players can reconstruct the secret implying a cloning of quantum secret. On the other hand, for any a protocol has been introduced in  in such a way that the dimension of each share is proportional to the number of players.
The unbounded size of the share is a strong limitation of the protocol, as a consequence several schemes of quantum secret sharing using a bounded amount of resources for each player have been introduced [13, 17, 12]. In particular, in  a quantum secret sharing scheme using graph states is presented where each player receives a single qubit. At the forefront in terms of implementation, the graph states has emerged as a powerful and elegant family of entangled state [8, 18].
Only few threshold quantum secret sharing schemes have been proved in the literature to be achievable using graph states: can be done using a graph (cycle with 5 vertices), and for any , an protocol using the complete graph can be done, up to some constraints on the quantum secret . Independently  introduced an protocol for any . This protocol is based on the GHZ state  which is locally equivalent to a complete graph state . The technique which consists in mixing the quantum secret before to encode it into a larger state is also used in  in such a way that some players have a classical share but no quantum share.
We introduce a new family of secret sharing protocols using graph states. Like in  the quantum secret is encoded into a graph state shared between the players, but in order to obtain threshold protocols, an additional round is added to the protocol. This round consists in mixing the quantum secret using a one-time pad scheme which classical key is then shared between the players using a classical secret sharing protocol. This technique extends the one presented in  in which the secret is partially mixed and then shared using a fixed quantum state, namely the GHZ state which is equivalent to the complete graph state. Independently, a hybrid classical-quantum construction of QSS has been rencently proposed in  where they optimize the quantum communication complexity when the size of the secret is greater than the number of players.
The family of protocols we introduce in the present paper is parametrised by a pair where is a graph and is a non empty set of vertices of the graph. We explore the possible values of for which there exists a pair leading to a protocol. Our main results are: first, we introduce a family of graphs which can realise any protocol when . This result proves that graph states secret sharing can be used not only for protocols, but also for any threshold larger than . The second main result of the paper is the proof that there is no graph such that realizes a protocols when . Notice that this lower bound also applies in the protocol introduced by Markham and Sanders. Moreover, it suggests that secret sharing protocols with a threshold closed to half of the players cannot be achieve with shares of bounded size.
Section 2 is dedicated to the description of the various secret sharing protocols based on graph states: section 2.1 describes the protocol cQSS introduced in  for sharing a classical secret, while section 2.2 describes its extension to a quantum secret qQSS. We prove that the sufficient combinatorial conditions for accessibility and privacy introduced in  for these protocols are actually necessary. These graphical characterisation are key ingredients for proving the main results of this paper. In section 2.3 the new family of protocols qQSS* is introduced. In section 3 we prove that for any there exists a qQSS* protocol which realises a secret sharing. Finally, in section 4, we prove the following lower bound: for any there is no graph such that realises a qQSS* scheme. A preliminary version of this work has been presented at .
2 Graph state secret sharing
2.1 Sharing a classical secret using a graph state
For a given graph on vertices , the corresponding graph state is a -qubit quantum state defined as
where is the number of edges in the induced subgraph .
Graph states have the following fundamental fixpoint property: given a graph , for any vertex ,
where is the neighborhood of in , , are one-qubit Pauli operators and is a Pauli operator acting on the qubits in . As a consequence, for any subset of vertices, . Since and anti-commutes and ,
where is the odd neighborhood of .
We present a family of quantum protocols for sharing a classical secret () parametrized by a graph and a non empty subset of the vertices of the graph. This family of protocols has been introduced in . Obviously, sharing a classical bit can be done using a classical scheme, like , instead of using a quantum state. However, the study of the cQSS protocols, and in particular the characterisation of accessibility and privacy (see corollary 1) are essential for the next sections where the sharing of a quantum secret is considered.
Suppose a dealer wants to share a classical secret between players. The dealer prepares the state where is the identity and consists in applying the Pauli operator on each qubit of . The dealer sends each player the qubit of . Regarding the reconstruction of the secret, a set of players can recover the secret if and only if , i.e. if the set of players can distinguish perfectly between the two states and , where is the state of the subsystem of the players in . On the other hand, a set of players has no information about the secret if and only if and are indistinguishable, i.e. .
Sufficient graphical conditions for accessibility and privacy have been proved in :
Lemma 1 ()
Given a cQSS protocol , for any ,
– If s.t. and then can access the secret.
– If s.t. then has no information about the secret.
According to the previous lemma, for a given set of players , if s.t. and then can access the secret. More precisely, the players in perform a measurement of their qubits according to the observable . This measurement produces a classical outcomes which is the reconstructed secret .
We prove that the sufficient graphical conditions are actually necessary conditions, and that any set of players is either able to access the secret or has no information about the secret.
Given a graph and , for any , satisfies exactly one of the two properties:
For a given , let be the cut matrix induced by , i.e. the sub-matrix of the adjacency matrix of such that the columns of correspond to the vertices in and its rows to the vertices in . is the matrix representation of the linear function which maps every to , where the set is identified with its characteristic column vector. Similarly, , where since is symmetric. Moreover, notice that for any set , is given by the matrix product where again sets are identified with their column vector representation. Equation is satisfied iff s.t. which is equivalent to . Thus is true iff where . Similarly equation is satisfied iff s.t. iff . Thus is true iff . Since for any , it comes that either is true or is true.
Given a cQSS protocol , for any ,
can access the secret.
has no information about the secret.
2.2 Sharing a quantum secret
Following , the cQSS protocols are extended to qQSS schemes for sharing a quantum secret . Given a graph and a non empty subset of vertices, the dealer prepares the quantum state . Notice that the transformation is a valid quantum evolution – i.e. an isometry – whenever is orthogonal to which is guaranteed by . Then, the dealer sends each player the qubit of . Regarding the reconstruction of the secret, it has been proved in , that a set of players can recover the quantum state if and only if can reconstruct a classical secret in the two protocols and , where and is the symmetric difference. In other words is obtained by complementing the egdes of incident to two vertices in . We introduce an alternative characterisation of q-accessibility (ability to reconstruct a quantum secret) which does not involved the complemented graph :
Given a qQSS protocol , a set of players can reconstruct the quantum secret if and only if, in the protocol cQSS , can reconstruct the classical secret and cannot.
First notice that for any , if then . Thus for any , if , .
Assume that can reconstruct the quantum secret, so can reconstruct the classical secret in . Thus s.t. . According to the previous remark, it implies that , so cannot reconstruct the secret.
Assume cannot recover the classical secret and can. So s.t. . If is even, let where is odd and . Such a set exists since can reconstruct the classical secret in . If is odd, then let . In both cases, and , so according to the previous remark, , as a consequence can access the classical secret in .
In any pure quantum secret sharing protocol a set of players can reconstruct a quantum secret if and only if its complement set of players has no information about the secret (see ). As a consequence:
Given a qQSS protocol , a set of players has no information about the quantum secret if and only if, in the protocol cQSS , can reconstruct the classical secret and cannot.
Sets of players that can reconstruct the secret and those who have no information about the secret admit simple graphical characterisation thanks to the simple reduction to the classical case. However, contrary to the cQSS case, there is a third kind of set players, those who can have some information about the secret but not enough to reconstruct the secret perfectly. For instance for any consider the qQSS protocol where is the complete graph on the vertices . For any set of vertices s.t. and , both and cannot reconstruct a classical secret in the corresponding protocol, so cannot reconstruct the quantum secret perfectly but has some information about the secret.
The qQSS protocols and have the same accessing structures – i.e. a set of players can access the secret in iff it can access the secret in . In particular, the protocols and have the same accessing sets.
2.3 Threshold schemes
For any qQSS protocol , the accessing structures can be characterized. For secret sharing protocols, this is often interesting to focus on threshold protocols, i.e. protocols such that there exists an integer such that any set of least players can reconstruct the secret, whereas any set of at most players have no information about the secret. Such threshold protocols are denoted . In , it has been proved that if the dealer is sending a pure quantum state to the players, like in the qQSS protocols, then the threshold, if it exists, should be equal to where is the number of players. This property which is derived from the no-cloning theorem, is very restrictive. It turns out that there is a unique threshold for which a qQSS protocol is known. This protocol is where is the cycle graph on vertices. The threshold for this protocol is . In section 4, we prove that under the constraint that , there is no threshold qQSS protocol for .
However, in general a qQSS protocol corresponds to a ramp secret sharing scheme  where any set of players smaller than cannot access the information and any set greater than can. In this section we show how these ramp schemes can be turned into threshold schemes by adding a classical secret sharing round.
Given a graph over vertices, a non empty subset of vertices , and an integer , such that with , satisfying , , and , it exists an quantum secret sharing protocol for any in which the dealer sends one qubit to players and uses a -threshold classical secret sharing scheme on the players.
The rest of the section is dedicated to define a family of protocols called satisfying the theorem.
Inspired by the work of Broadbent, Chouha and Tapp , we extend the qQSS scheme adding a classical reconstruction part. In , a family of unanimity – i.e. the threshold is the number of players – quantum secret sharing protocols have been introduced. They use a state which equivalent to the graph state where is the complete graph on vertices. We extend this construction to any graph, using also a more general initial encryption corresponding to a quantum one-time pad of the quantum secret.
Quantum secret sharing with graph states and classical reconstruction ().
Given a graph , a non empty subset of players , and an integer , such that if then
satisfying , , and .
Suppose the dealer wishes to share the quantum secret .
Encryption. The dealer chooses uniformly at random . and apply on .The resulting state is .
Graph state embedding. The dealer embeds to the -qubit state .
Distribution. The dealer sends each player the qubit . Moreover using a classical secret sharing scheme with a threshold , the dealer shares the bits .
Reconstruction. The reconstruction of the secret for a set of players s.t. is in steps: first the set is used to add an ancillary qubit and put the overall system in an appropriate state; then is used to disentangled the ancillary qubit form the rest of the system; finally the classical bits and are used to recover the secret:
(a) The players in applies on their qubits the isometry where are the projectors associated with observable , i.e. . The resulting state is .
(b) The players in apply the controlled unitary map , where . The resulting state is .
(c) Thanks to the classical secret sharing scheme, the players in recover the bits and . They apply and then for reconstructing the quantum secret on the ancillary qubit.
Note that this reconstruction method can be used for the qQSS protocols defined in  and for which the reconstruction part was not explicitly defined.
A protocol is a secret sharing protocol if for any s.t. , can reconstruct the secret in .
The classical encoding ensures that any set of size smaller then cannot access to the secret. is acting on the qubits . Moreover if and otherwise, so the application of the isometry produce the state . Regarding step of the reconstruction, since , is acting on the qubits in . Moreover produces the states . Finally the classical secret scheme guarantees that the players in have access to and so that they reconstruct the secret.
Proof of Theorem 2.1. The correctness of the qQSS* protocol implies that given a graph over vertices, a non empty subset of vertices , and an integer , such that with , satisfying , , and , it exists a protocol. In order to finish the proof of Theorem 2.1 this protocol is turned into a protocol for any the qQSS* protocol is modified as follows, following the technique used in . During the distribution stage, the dealer shares and with all the players with a threshold , but sends a qubit of the graph state to only players chosen at random among the players. During the reconstruction, a set of players must contain at least players having a qubit. This set use the reconstruction steps and and then the last step is done by all the players.
In the following we focus on the particular case where .
3 Building - Protocols
We give a construction of an infinite family of quantum secret sharing schemes where . This construction can be defined recursively from cycle over 5 vertices () which has been used in Markham and Sanders  to build a ((3,5)) quantum secret sharing protocol.
We define a composition law between two graphs and as follows:
Let and be two graphs. The lexicographic product of two graphs and is defined as follows: and .
In other terms, the graph is a graph which vertices are replaced by copies of the graph , and which edges are replaced by complete bipartitions between two copies of the graph (Figure 1).
For any graphs and ,
It is easy to see that . We want to show that .
Consider an edge . If then . Otherwise . Thus or which means, by definition, that . Therefore, .
Furthemore where and . Thus