Genuine Secret-Sharing States

Secret sharing Blakley (1979); Shamir (1979) is a way of allocating a secret among players, and a sufficient number of players must cooperate to restore the secret. To be more specific, in a $(k,n)$-threshold secret sharing scheme, a dealer distributes a secret to $n$ players, and $k$ or more players can reconstruct the secret if they collaborate, but fewer than $k$ players cannot do so, where $k\leq n$. Because of this feature, secret sharing can be used to deal with important and sensitive information.

We remark that quantum mechanics can provide us with unconditionally secure secret sharing. For example, there is a quantum protocol Hillery et al. (1999) based on the Greenberger-Horne-Zeilinger (GHZ) state Greenberger et al. (1989) in which each player can obtain a classical bit for $(n,n)$-threshold secret sharing. More precisely, if $N$ players including a dealer share an $N$-qubit GHZ state, then they can carry out an $(N-1,N-1)$-threshold secret sharing through the protocol. As a matter of fact, this secret-sharing protocol can be considered as an natural generalization of the Bell-state based quantum key distribution (QKD) protocol Ekert (1991).

Even though two players can securely share a secret key through the Bell state, there is a specific class of states on which perfectly secure QKD can be performed. The states in the class are called the private states Horodecki et al. (2005, 2009). In a similar way to the private states in QKD, we can naturally ask the following question, what kinds of quantum states are required to accomplish a secure $(n,n)$-threshold secret sharing? In Ref. Chi et al. (2008), this question has already been considered, and the quantum states, called the secret-sharing states, have been suggested as an answer to the question. It has been shown that if players share a secret-sharing state, then each player can have a classical bit for secret sharing, which is secure against any external eavesdropper. However, dishonest players, who have a fatal impact on the security of secret sharing, were not sufficiently considered in Ref. Chi et al. (2008). In particular, we can find secret-sharing states that provide each legitimate player with a secret bit, which is insecure against dishonest players, as we will see below. In other words, secret sharing is not in general guaranteed on the secret-sharing states.

To see this, we first look at the secret-sharing conditions presented in Ref. Chi et al. (2008): (i) The probability distributions of the players’ secret bits must be unbiased, and perfectly correlated, that is, if we let $p_{I}$ be the probability that the $N$ players get the random bit string $I\in\mathbb{Z}_{2}^{N}$, then $p_{I}=1/2^{N-1}$ for $I$ with even parity and $p_{I}=0$ for $I$ with odd parity. (ii) Any eavesdropper cannot obtain any information about the players’ secret bits. For $1\leq i\leq N$, let $A_{i}$ be the player $\mathcal{A}_{i}$’s qubit system, and $A^{\prime}_{i}$ be the $\mathcal{A}_{i}$’s another system with arbitrary dimension. Then it has been shown Chi et al. (2008) that $\rho_{\mathbb{A}\mathbb{A^{\prime}}}$ is a quantum state for secret sharing, that is, a secret-sharing state, where $\mathbb{A}=A_{1}\cdots A_{N}$ and $\mathbb{A^{\prime}}=A^{\prime}_{1}\cdots A^{\prime}_{N}$ if and only if it is of the form

where $\sigma_{\mathbb{A^{\prime}}}$ is an arbitrary state, and the $U_{I}$’s are unitary operators on the system $\mathbb{A^{\prime}}$. Here, $\mathbb{A}$ and $\mathbb{A^{\prime}}$ are called the secret part and the shield part of the state, respectively.

Suppose that three players share the following secret-sharing state,

Then we can readily see that if $\mathcal{A}_{3}$ is a dishonest player, then he/she can perfectly know the other players’ secret information by measuring his/her own secret part $A_{3}$ and shield part $A^{\prime}_{3}$ in the computational basis.

There also exists a secret-sharing state on which each legitimate player has an insecure secret bit against dishonest players, even when dishonest players do not handle their shield parts. It can be easily seen from the following secret-sharing state,

In this case, $\mathcal{A}_{3}$ and $\mathcal{A}_{4}$ can totally know the other players’ measurement outcomes by measuring their secret parts $A_{3}A_{4}$ in the Bell basis, and they can also deceive legitimate players as if they measure their secret parts in the computational basis.

These problems are caused by the lack of sufficient consideration on dishonest players in the secret-sharing conditions. Hence, in this work, we modify the secret-sharing conditions to fully cover $(n,n)$-threshold secret sharing scenarios, and introduce a class of quantum states on which each player can obtain a classical information for secret sharing secure against not only eavesdropper but also dishonest players. We call them the genuine secret-sharing (GSS) states. In addition, we show that if $N$ players share an $N$-party GSS state, local operations and classical communication (LOCC) enables any $M$ players out of the $N$ players to share an $M$-party GSS state. It can be an important property in a quantum network connected by repeaters, since if the network consists of a GSS state then players can share their own GSS state with properly smaller size without providing any information to the repeaters.

Furthermore, we define the distillable rate with respect to the GSS state, and also show that the distillable rate is upper bounded by the relative entropy of entanglement Vedral et al. (1997); Vedral and Plenio (1998) between any bipartition of the total players. By using this property, we discuss the irreducible GSS state, which players cannot have additional information for secret sharing from the shield part of the state via LOCC.

Our paper is organized as follows. We introduce the GSS state, and investigate its properties in Sec. II. We define the GSS distillable rate in Sec. III, and give examples of the GSS states in Sec. IV. Finally, we conclude our work with some discussion in Sec. V.

To perfectly deal with $(n,n)$-threshold secret sharing scenarios, we should also regard dishonest players as internal eavesdroppers who may conspire with an external one. Thus we modify the secret-sharing conditions in Ref. Chi et al. (2008) as follows.

• (i)

  The probability distributions of all players’ secret information must be unbiased and perfectly correlated.

• (ii^′)

  Any eavesdropper and dishonest players cannot get any information about the legitimate players’ secret information.

Since the modified conditions include the previous ones, the quantum states on which players can have secret information that satisfies the modified conditions also have the form of the secret-sharing states, but they must be different from the states. The difference can be seen in the following theorem. From now on, we let $A_{i}$ be the qudit system for all $i$ to handle more general situations.

As seen in Eq. (6), unitary operators on the shield part of the GSS state can be expressed as the product of unitary operators acting on two players’ shield parts.

Let us now investigate the properties of the GSS state. We remark that if $N$ players share the $N$-party GHZ state, then any $M$ players among the total players can share the $M$-party GHZ state by all players’ LOCC. We can see from the following theorem that the GSS state has the similar property.

Since quantum networks in general require repeaters connecting players because of the distance limitation of quantum communication, and players want to get a secure information without providing their information to repeaters, this property can play an important role in quantum networks. Hence, in quantum networks, sharing a GSS state can be a goal for secure multipartite quantum communication.

The next property is about a relation between the GSS state and the Holevo information Holevo (1973), which is one of the important quantities in security analysis. Suppose that Alice and Bob share a state $\rho_{AB}$, and Alice measures her system. For each Alice’s measurement outcome $x$, let $p_{x}$ and $\rho_{B}^{x}$ be its probability and Bob’s resulting state after her measurement, respectively. The Holevo information between Alice’s measurement outcomes and Bob’s state is given by

where $S$ is the von Neumann entropy and $\bar{\rho}=\sum_{x}p_{x}\rho_{B}^{x}$. Zero Holevo information between Alice’s measurement outcomes and Bob’s state, that is, $\chi_{\rho}(x:B)=0$ means that Bob cannot have any information about Alice’s measurement outcomes. Thus, the modified condition (ii^′) can be replaced as follows: For a given quantum state $\Upsilon$, $\chi_{\Upsilon}(k_{l}:\mathcal{D}E)=0$ for any party $\mathcal{D}E$ of dishonest players and eavesdropper, where $k_{l}$ is the the legitimate player $\mathcal{A}_{l}$’s secret information. In other words, the Holevo information is zero if and only if the state satisfying the condition (i) for secret sharing is a GSS state. For example, since $\chi(i_{1}:\mathcal{A}_{3})=1$ in Eq. (I), where $i_{1}$ is the $\mathcal{A}_{1}$’s measurement outcome when he/she measures his/her secret part in the computational basis, the secret-sharing state in Eq. (I) is not a GSS state.

Theorem 4 shows that players’ secret information must be unbiased in order to be secure against dishonest players and eavesdropper. Therefore, the condition (ii^′) of the modified secret-sharing conditions includes unbiasedness of the players’ secret information, and so the unbiasedness can be omitted in the condition (i) of the modified conditions.

In this section, we discuss the distillable rate with respect to the GSS state. Before defining the distillable rate, we need to consider one issue arising from the presence of dishonest players. For instance, let us look at the secret-sharing state in Eq. (I) once more. For $\alpha,\beta\in\mathbb{C}$ with $|\alpha|^{2}+|\beta|^{2}=1$, if we let $\ket{\mu_{0}}=\alpha\ket{0}+\beta\ket{1}$ and $\ket{\mu_{1}}=\beta^{*}\ket{0}-\alpha^{*}\ket{1}$, the state can be written as

Hence, for any $\mathcal{A}_{1}$’s measurement basis $\left\{\ket{\mu_{0}},\ket{\mu_{1}}\right\}$, player $\mathcal{A}_{3}$ can get the other players’ secret information by properly measuring his/her system. However, since this is a secret-sharing state, it is GHZ distillable Chi et al. (2008), that is, the GHZ state can be asymptotically distilled from the state by LOCC. Thus, if we define the distillable rate as how many copies of the given state are required to asymptotically distill a GSS state through LOCC, the completely insecure quantum state may have a strictly positive rate.

In order to avoid such an issue, we employ the Devetak-Winter rate Devetak and Winter (2005); Kogias et al. (2017). Let $\rho_{\mathcal{A}_{1}\cdots\mathcal{A}_{N}}$ be a given state. We say that $\rho_{\mathcal{A}_{1}\cdots\mathcal{A}_{N}}$ has positive Devetak-Winter rate if there is a set of measurement operations $\{\mathcal{M}_{k}\}_{1\leq k\leq N}$ such that for any $\mathcal{D}\subset\{\mathcal{A}_{1},\cdots,\mathcal{A}_{N}\}$ with $|\mathcal{D}|\leq N-2$, $I\left(m_{i}:\bar{m}_{i}\right)-\chi_{\rho}\left(m_{i}:\mathcal{D}E\right)>0$, where $I\left(X:Y\right)$ is the mutual information between $X$ and $Y$, $\mathcal{A}_{i}\notin\mathcal{D}$, $m_{i}$ is the $\mathcal{A}_{i}$’s measurement outcome, and $\bar{m}_{i}$ is the sum of the measurement outcomes of players except $\mathcal{A}_{i}$. If we define the distillable rate only for quantum states with positive Devetak-Winter rate, then we can rule out quantum states that are completely insecure.

We note that when players are divided into two parties, $\mathcal{P}_{1}$ and $\mathcal{P}_{2}$, they can have a private state between two parties if they share a GSS state. Thus, we have

where $K_{D}^{\mathcal{P}_{1}:\mathcal{P}_{2}}$ is the distillable key rate between $\mathcal{P}_{1}$ and $\mathcal{P}_{2}$, which is defined by protocols to distill private states Horodecki et al. (2009). In addition, since the relative entropy of entanglement (REE) is an upper bound of the distillable key rate Horodecki et al. (2009), we obtain

where $E_{r}^{\mathcal{P}_{1}:\mathcal{P}_{2}}$ is REE between $\mathcal{P}_{1}$ and $\mathcal{P}_{2}$, that is,

Here, $S(\rho\|\sigma)=-S(\rho)-\textrm{Tr}\rho\log\sigma$ is the relative entropy, and $\mathrm{SEP}_{\mathcal{P}_{1}:\mathcal{P}_{2}}$ is the set of bipartite separable states of the system $\mathcal{P}_{1}\mathcal{P}_{2}$.

Using the GSS distillable rate, one can define irreducible GSS state, as irreducible private state is defined in Ref. Horodecki et al. (2009). For any GSS state $\Upsilon_{\mathbb{A}\mathbb{A^{\prime}}}$ whose secret part is of dimension $d^{N}$, the state is said to be irreducible if $D_{G}\left(\Upsilon_{\mathbb{A}\mathbb{A^{\prime}}}\right)=\log d$. Then the following theorem provides a way to check that a given GSS state is irreducible.