Theory of Communication Efficient Quantum Secret Sharing
Transcript of Theory of Communication Efficient Quantum Secret Sharing
arX
iv:2
101.
1241
9v1
[qu
ant-
ph]
29
Jan
2021
1
Theory of Communication Efficient
Quantum Secret Sharing
Kaushik Senthoor and Pradeep Kiran Sarvepalli
Department of Electrical Engineering
Indian Institute of Technology Madras
Chennai 600 036, India
Abstract—A ((k, n)) quantum threshold secret sharing (QTS)scheme is a quantum cryptographic protocol for sharing aquantum secret among n parties such that the secret can berecovered by any k or more parties while k− 1 or fewer partieshave no information about the secret. Despite extensive researchon these schemes, there has been very little study on optimizingthe quantum communication cost during recovery. Recently, weinitiated the study of communication efficient quantum thresholdsecret sharing (CE-QTS) schemes. These schemes reduce thecommunication complexity in QTS schemes by accessing d ≥ k
parties for recovery; here d is fixed ahead of encoding the secret.In contrast to the standard QTS schemes which require k quditsfor recovering each qudit in the secret, these schemes have a lowercommunication cost of d
d−k+1for d > k. In this paper, we further
develop the theory of communication efficient quantum thresholdschemes. Here, we propose universal CE-QTS schemes whichreduce the communication cost for all d ≥ k simultaneously. Weprovide a framework based on ramp quantum secret sharingto construct CE-QTS and universal CE-QTS schemes. We giveanother construction for universal CE-QTS schemes based onStaircase codes. We derived a lower bound on communicationcomplexity and show that our constructions are optimal. Finally,an information theoretic model is developed to analyse CE-QTSschemes and the lower bound on communication complexity isproved again using this model.
Index Terms—quantum secret sharing, communication com-plexity, quantum cryptography, threshold secret sharing schemes,Staircase codes.
I. INTRODUCTION
QUANTUM secret sharing schemes are protocols that
enable the secure distribution of a secret among mutually
collaborating parties so that only certain collections of parties
can recover the secret. Quantum secret sharing schemes were
first proposed by Hillery et al. for classical secrets [1]. Subse-
quently, Cleve et al. proposed quantum secret sharing schemes
for quantum secrets [2]. Since these pioneering works, there
has been extensive progress in this field, and it continues
to be actively researched [3]–[14]. Quantum secret sharing
has also been experimentally demonstrated by many groups
[15]–[23]. The progress has been rapid with demonstrations
over distances as large as 50 km [22]. Furthermore, non-
binary protocols over 11-dimensional qudits have also been
demonstrated [23].
Quantum secret sharing can be done under various settings:
with classical data as the secret or an arbitrary quantum state
as the secret, with parties having classical and quantum data
(hybrid) or only quantum data, with or without pre-existing
quantum entanglement shared among the parties, to name
a few. Here, we consider the setting where the secret is
an arbitrary quantum state, with all the parties having only
quantum data and no pre-existing quantum entanglement. In
this paper we are interested in optimizing the resources needed
for quantum secret sharing. Specifically, we study the commu-
nication efficient threshold quantum secret sharing (CE-QTS)
schemes and propose the improved model of universal CE-
QTS schemes.
The most popular quantum secret sharing scheme is the
quantum threshold secret sharing scheme (QTS). In this
scheme, out of the total n parties, a minimum of k parties
are required to recover the secret. Also, here we look at only
perfect QTS schemes, where any set of less than k parties
should not have any information on the secret. It is often
denoted as a ((k, n)) scheme. The state given to each party is
called the share of the party. After the secret has been shared,
the parties who plan to recover the secret combine their shares
together and reconstruct the secret. Alternatively, the parties
involved in the recovery could communicate all or part of their
share to a third party designated as the combiner. The amount
of quantum communication to the combiner for recovering the
secret is called the communication complexity. For sharing a
secret of size m qudits under this setting, a standard ((k, n))scheme (for example, [2]) requires mn qudits to be shared for
share distribution (m qudits for each party) and at least mkqudits for recovery.
A. Previous work
The analogous problem of reducing communication com-
plexity has been studied for classical secret sharing schemes
[24]–[29] but not as much in the quantum setting. Ref. [7]
and [10] aim to reduce the quantum communication during
secret distribution to the parties but do not look at reducing
the quantum communication cost during secret recovery. Only
recently, [12] showed that the quantum communication cost
during secret recovery can be reduced by using a subset
of d parties whose cardinality is more than the threshold krequired to recover the secret. This scheme is called ((k, n, d))communication efficient quantum secret sharing (CE-QTS)
scheme. These gains can be significant and for a ((k, n =2k − 1, d)) threshold scheme, it was shown that the gains in
2
communication complexity of recovery per secret qudit can
be as large as O(k). For sharing a secret of m qudits, this
scheme requires mn qudits to be shared for secret distribution,
mk qudits for secret recovery when accessing k parties and
dm/(d−k+1) qudits when accessing d parties. However, the
improvement in communication cost only works for a fixed
value of d in the range of k < d ≤ n. The value of d is
decided prior to encoding of the secret and cannot be changed.
B. Contributions
In this paper, we develop the theory of communication
efficient quantum secret sharing schemes. Specifically, we
address the problem of designing quantum threshold schemes
that are universal in the sense that any subset of parties of
an arbitrary size greater than k would provide further gains
in communication cost during recovery. This is the first such
class of universal communication efficient quantum threshold
secret sharing schemes where the number of parties contacted
for secret recovery can be varied from k to n.
First, we give a framework for constructing CE-QTS
schemes from a combination of ramp QSS schemes and
threshold schemes. We also propose a construction of CE-QTS
schemes for both fixed d and universal d with this framework
using the ramp secret sharing schemes proposed in [30]. This
framework can also be used to derive other constructions for
CE-QTS schemes by using different ramp QSS schemes.
Second, we propose a class of universal CE-QTS schemes
based on the Staircase codes. These schemes are inspired by
the classical communication efficient secret sharing schemes
of [25], [26]. The constructions for these classical schemes are
also related to codes for distributed storage aimed at reducing
communication cost [31].
The constructions for universal CE-QTS schemes proposed
in this paper, when an arbitrary d ≥ k number of parties
are contacted, achieve the same communication complexity
as that of fixed d. So there is no penalty in communication
complexity with the increased flexibility to change d. The
universal CE-QTS constructions provide the same storage cost
and communication cost (normalized to secret size) as the CE-
QTS constructions. But the universal CE-QTS constructions
need to have larger secret sizes to provide communication
efficiency for various values of d. For a short summary of
our constructions, refer Table I.
Third, we devive lower bounds on the communication
complexity of CE-QTS schemes (both fixed d and universal).
We also propose an information-theoretic model of CE-QTS
schemes and prove that our constructions are optimal with
respect to both share size and communication cost. The
information theoretic model is used to give an alternative proof
for the bound on communication cost.
Some preliminary results of this paper are discussed in the
upcoming conference publication [32].
C. Organization
We begin with a brief review of quantum secret sharing
schemes in Section II. Then we give a concrete illustration
of the universal communication efficient quantum secret shar-
ing schemes in Section III. In Section IV, we propose the
Concatenation framework for constructing CE-QTS schemes
from ramp and threshold QSS schemes. We also extend this
framework to construct universal CE-QTS schemes. In Sec-
tion V, we give a construction of universal CE-QTS schemes
based on Staircase codes. We derive lower bounds on the
communication complexity of CE-QTS schemes in Section VI.
In Section VII, we propose an information theoretic model for
studying CE-QTS schemes. Finally, we conclude with a brief
sketch of further directions of research.
II. BACKGROUND
A. Notation
Let q be a prime and Fq denote a finite field with q elements.
We take the standard basis of Cq to be {|x〉 | x ∈ Fq}. We
denote |x1x2 · · ·xℓ〉 by |x〉 where x is the vector with the
entries (x1, x2, . . . , xℓ). The standard basis for Cqn is taken
to be {|x〉 | x ∈ Fnq }. For any invertible matrix K ∈ Fℓ×ℓ
q , we
define the unitary operation UK
UK |x〉 = |Kx〉 =∣
∣y⟩
,
where y = (y1, . . . , yn) and yi =∑
j Kijxj . We define the
two qudit unitary operator Lα as
Lα |i〉c |j〉t = |i〉c |j + αi〉t ,
where i, j ∈ Fq and α ∈ Fq is a constant. The subscript c and
t indicate that they are control and target qudits respectively.
This operator generalizes the CNOT gate.
We use the notation [n] := {1, 2, . . . , n} and [i, j] :={i, i + 1, . . . , j}. Let V be a m × n matrix and A ⊆ [m],B ⊆ [n]. We denote by VA, the submatrix of V formed by
taking the rows indexed by entries in A. Similarly, we can
form a submatrix of V by taking the columns of V . This is
indicated as V B . We can also form a submatrix V BA of V
which takes rows indexed by A and columns indexed by B.
For a matrix V ∈ Fm×nq , the notation |V 〉 indicates the state
|v11v21 . . . vm1〉|v12v22 . . . vm2〉. . .|v1nv2n . . . vmn〉 where vijis the element of V in ith row and jth column. Let A ∈ Fm×n
q
matrix and K is an invertible m × m matrix, then we can
transform the state |A〉 to |KA〉 by the unitary operation U⊗nK .
We refer to this operation as applying K on |A〉 to obtain
|KA〉.
B. Quantum secret sharing (QSS)
A quantum secret sharing scheme is a protocol to encode the
secret in arbitrary quantum state and share it among n parties
such that certain subsets of parties, called authorized sets,
can recover the secret (recoverability) and certain subsets of
parties, called unauthorized sets, do not have any information
about the secret (secrecy). The access structure Γ of a QSS
scheme is defined as
Γ = {X ⊆ [n] : X is an authorized set}.
A QSS scheme is called perfect quantum secret sharing
scheme if any subset of the n parties is either an authorized
3
Number of parties Secret size, m Communication Dimension ofaccessed by combiner, d cost, CCn(d)/m qudits, q (prime)
QTS [5] d = k, fixed 1 k ≥ 2k − 1
CE-QTS (Staircase codes) [12] k ≤ d ≤ n, fixed d− k + 1 d
d−k+1> 2k − 1
CE-QTS (Concatenation) k ≤ d ≤ n, fixed d− k + 1 d
d−k+1> d+ k − 1
Universal CE-QTS (Staircase codes) k ≤ d ≤ n, variable lcm{1, 2, . . . , k} d
d−k+1> 2k − 1
Universal CE-QTS (Concatenation) k ≤ d ≤ n, variable lcm{1, 2, . . . , n− k + 1} d
d−k+1> n+ k − 1
TABLE I: Parameters of various ((k, n)) QTS constructions. Here 2 ≤ k ≤ n ≤ 2k − 1. For all these constructions, the
individual share size is m and CCn(k)/m = k.
set or an unauthorized set and non-perfect otherwise. For non-
perfect schemes, some subsets of the n parties are allowed to
have partial information about the secret. These sets are called
intermediate sets.
A concrete realization of a quantum secret sharing scheme
is specified by giving an encoding for the basis states of
the secret. An encoding has to satisfy the properties of
recoverability and secrecy to realize a QSS scheme.
Definition 1. A quantum secret sharing scheme for an access
structure Γ is the encoding and distribution of the secret in
an arbitrary quantum state among n parties such that
• (Recoverability) any authorized set A ∈ Γ can recover
the secret i.e. there exists some recovery operation which
can decode the secret from the shares in A,
• (Secrecy) any unauthorized set B /∈ Γ has no information
about the secret.
In a pure state QSS scheme, the encoding is such that the
combined state of all shares is a pure state whenever the secret
is in pure state. Otherwise, the scheme is called mixed state
scheme.
Lemma 1 (Mixed state schemes from pure state schemes).
[5, Theorem 3] Any mixed state QSS scheme can be described
as a pure state QSS scheme with one share discarded.
The no-cloning theorem implies that the complement of an
authorized set is unauthorized set. In pure state schemes the
converse also holds as given in the following result.
Lemma 2 (Authorized sets in pure state schemes). [5,
Corollary 2] In a pure state quantum secret sharing scheme,
complement of any unauthorized set is an authorized set.
We use the following notation for parameters of QSS
schemes: q is the fixed dimension of all the qudits in the
scheme, m gives the size of the secret in qudits and wi gives
the size of the ith share in qudits.
C. Quantum threshold secret sharing (QTS)
An important class of perfect quantum secret sharing
schemes are the quantum threshold secret sharing schemes.
In threshold schemes, a set of parties is either authorized or
unauthorized based on the number of parties in the set.
Definition 2 (Quantum threshold scheme). A ((k, n)) quantum
threshold secret sharing scheme for 1 < k ≤ n ≤ 2k − 1 is
a QSS scheme with n parties where any k or more parties
can recover the secret, but k − 1 or fewer parties have no
information on the secret.
If n > 2k, then there exist two non-overlapping authorized
sets which can give two copies of the secret thus violating
no-cloning theorem.
Cleve et al. [2] have given a construction for ((k, n)) QTS
schemes as follows. Consider the case of n = 2k − 1. Take
m = 1 and a prime q ≥ 2k−1. The encoding for a basis state
of the secret s ∈ Fq is given by the following superposition.
|s〉 7→∑
r∈Fk−1q
|v1(r, s)〉 |v2(r, s)〉 . . . |vn(r, s)〉 (1)
Here r = (r1, r2, . . . , rk−1) ∈ Fk−1q and vi(r, s) ∈ Fq is the
evaluation of the polynomial
vi(r, s) = r1 + r2xi + . . .+ rk−1xk−2i + sxk−1
i .
where x1, x2, . . . , xn are distinct constants from Fq . Each of
the n parties is given one qudit from the encoded state.
For example, the encoding for a ((k = 2, n = 3)) QTS
scheme will be as follows where each qudit has dimension
three.
|s〉 7→∑
r∈F3
|r〉 |r + s〉 |r + 2s〉
To obtain a ((k, n)) QTS scheme for n < 2k − 1, simply
discard 2k − 1 − n shares after encoding the secret in the
above scheme.
Lemma 3. [2] The encoding in (1) provides a q-ary ((k, n))quantum threshold secret sharing scheme for n ≤ 2k− 1 with
the following parameters.
q ≥ 2k − 1 (prime)
m = 1
w1 = w2 = · · · = wn = 1
This scheme can be used to encode a secret of m > 1 qudits
by individually encoding each qudit in the secret.
D. Storage and communication complexity
The storage cost of a secret sharing scheme is directly
related to the sizes of the shares. In this context the following
result has been shown about the size of a share.
4
Lemma 4 (Share size, [5]). The size of each share in a
threshold QSS scheme should be at least as large as the size
of the secret.
Clearly, the QTS scheme in Lemma 3 has optimal storage
cost. Apart from storage cost which depends on how the
secret is encoded and distributed among the parties, it is
also important to see how much quantum communication is
needed during the secret recovery. There are two prominent
approaches to reconstructing the secret. In the first approach,
the parties from an authorized set could collaborate among
themselves by means of nonlocal operations to recover the
secret. In the second approach, they can communicate all or
part of their shares to a third party called the combiner. In this
paper, we focus on the latter method of secret reconstruction.
Definition 3 (Communication cost for an authorized set). The
communication cost for an authorized set in a QSS scheme is
the number of qudits sent to the combiner by the parties in
that set for recovering the secret.
For the same encoding of the secret, it is possible to have
different recovery operations for a given authorized set, thus
giving multiple values for the communication cost. However
the above definition for communication cost is defined for a
particular recovery operation defined by the QSS scheme for
an authorized set.
Definition 4 (Communication cost for d in QTS). The com-
munication cost for threshold d ≥ k in a ((k, n)) quantum
threshold secret sharing scheme is the maximum communica-
tion cost over all the authorized sets of size d. This will be
denoted as CCn(d).
Thus, for the QTS scheme defined in Lemma 3, the com-
munication cost for secret recovery is CCn(k) = k.
E. Fixed d communication efficient QTS (CE-QTS)
Assume that the combiner in a QTS scheme has access to
more than k parties in the scheme. Then, the ((k, n)) QTS
scheme will still have the same communication cost of kqudits. However, by allowing each party in a ((k, n)) QTS
scheme to send only a part of its share to the combiner, it is
possible to reduce this communication cost further.
Definition 5 (CE-QTS). A ((k, n)) threshold secret sharing
scheme is said to be communication efficient, if for some dsuch that k < d ≤ n,
CCn(d) < CCn(k) (2)
Such schemes are denoted as ((k, n, d)) CE-QTS schemes.
Here, d is a fixed integer satisfying k < d ≤ n. The
strict inequality (2) in this definition is necessary because
any ((k, n)) scheme can allow recovery from d parties by
communicating some k shares from these d parties thus
achieving CCn(d) = CCn(k).A construction for ((k, n, d)) CE-QTS schemes based on
Staircase codes is given in [12]. For n = 2k−1, this CE-QTS
scheme is constructed as follows. The encoding for a basis
state of the secret s = (s1, s2, . . . , sm) ∈ Fq is given by the
following superposition
|s1s2 . . . sm〉 7→∑
r∈Fm(k−1)q
2k−1⊗
i=1
|ci1ci2 . . . cim〉 (3)
where r = (r1, r2, . . . , rm(k−1)) ∈ Fm(k−1)q and cij is the
(i, j)th entry of the matrix
C = V Y.
Here, V is a Vandermonde matrix defined as
V =
1 x1 . . . xd−11
1 x2 . . . xd−12
......
. . ....
1 xn . . . xd−1n
.
where x1, x2, ..., xn are distinct non-zero constants from Fq.The matrix Y is given by
Y =
s1s2...
0(m−1)×(m−1)
sm rk−m+1 rk−m+2 . . . rk−1
r1r2...
rk−1
rk r2(k−1)+1 . . . r(m−1)(k−1)+1
rk+1 r2(k−1)+2 . . . r(m−1)(k−1)+2
..
....
. . ....
r2(k−1) r3(k−1) . . . rm(k−1)
.
After encoding, the first set of m qudits are given to the first
party, the second set of m qudits given to the second party
and so on till the nth party. When the combiner accesses kparties, each of these k parties sends all its m = d − k + 1qudits. When the combiner accesses d parties, each of these
d parties sends only its first qudit.
Lemma 5. [12] The encoding in (3) provides a q-ary
((k, n, d)) communication efficient quantum threshold secret
sharing scheme with the following parameters
q > 2k − 1 (prime)
m = d− k + 1
w1 = w2 = . . . = wn = d− k + 1
CCn(k) = k(d− k + 1)
CCn(d) = d.
To obtain a ((k, n, d)) CE-QTS scheme for n < 2k − 1,
simply discard 2k − 1− n shares after encoding the secret in
the above scheme. By Lemma 4, this scheme has an optimal
storage cost. It is also proved in [12] that this scheme gives
an optimal communication cost when the combiner accesses
d parties, for the specific case of n = 2k − 1. In this paper,
we prove that optimality of this scheme holds for n < 2k− 1as well.
5
For example, for k = 3, d = 5, this construction gives a
((3, 5, 5)) CE-QTS scheme with the parameters
q = 7 (4a)
m = 3 (4b)
w1 = w2 = . . . = w5 = 3 (4c)
CCn(3) = 9, CCn(5) = 5. (4d)
The matrices V and Y in this scheme are given by
V =
1 1 1 1 11 2 4 1 21 3 2 6 41 4 2 1 41 5 4 6 2
and Y =
s1 0 0
s2 0 0
s3 r1 r2r1 r3 r5r2 r4 r6
.
The encoding for the scheme is given by the following
mapping
|s〉 7→∑
r∈F67
|c11c12c13〉 |c21c22c23〉 |c31c32c33〉 (5)
|c41c42c43〉 |c51c52c53〉
where s = (s1, s2, s3) indicates a basis state of the quantum
secret, r = (r1, r2, . . . , r6) and cij is the (i, j)th entry of the
matrix
C = V Y.
The encoded state in (5) can also be written as,
∑
r∈F67
|v1(s, r1, r2)〉 |v1(0, 0, r1, r3, r4)〉 |v1(0, 0, r2, r5, r6)〉|v2(s, r1, r2)〉 |v2(0, 0, r1, r3, r4)〉 |v2(0, 0, r2, r5, r6)〉|v3(s, r1, r2)〉 |v3(0, 0, r1, r3, r4)〉 |v3(0, 0, r2, r5, r6)〉|v4(s, r1, r2)〉 |v4(0, 0, r1, r3, r4)〉 |v4(0, 0, r2, r5, r6)〉|v5(s, r1, r2)〉 |v5(0, 0, r1, r3, r4)〉 |v5(0, 0, r2, r5, r6)〉 .
vi() indicates the polynomial evaluation given by
vi(f1, f2, f3, f4, f5) = f1 + f2.xi + f3.x2i + f4.x
3i + f5.x
4i
where the expression vi(s, r1, r2) denotes vi(s1, s2, s3, r1, r2).Here we have taken xi = i for 1 ≤ i ≤ 5.
When combiner requests k = 3 parties, each party sends
its complete share. When d = 5, the combiner downloads the
first qudit of each share from all the five parties. The secret
recovery for this scheme is explained in detail in Appendix A.
F. Ramp quantum secret sharing (RQSS)
The QTS scheme defined earlier is a perfect QSS scheme
i.e. any set of parties is either authorized or unauthorized. But
it is also possible to design a non-perfect threshold scheme
such that a set of parties may be neither authorized nor
unauthorized. A generalization of the threshold schemes leads
to the ramp quantum secret sharing.
Definition 6 (Ramp secret sharing schemes). A ((t, n; z))ramp quantum secret sharing scheme for 1 ≤ z < t ≤ n ≤t + z is a QSS scheme with n parties where any t or more
parties can recover the secret, but z or fewer parties have no
information on the secret.
Note that the notation for RQSS schemes should not be
confused with that of CE-QTS schemes.
When z = t − 1, then the ramp scheme is identical to a
((t, n)) perfect threshold scheme. For z < t−1, there are sets
which may not be able to reconstruct the secret but can have
partial information about the secret.
Ogawa et al. [30] provided a construction for ((t, n; z))ramp QSS schemes for n ≤ t + z as follows. Consider
the case of n = t + z. Take m = t − z and a prime
q > t + z. The encoding for the basis state of the secret
s = (s1, s2, . . . , sm) ∈ Fmq is given by the superposition
|s1s2 . . . sm〉 7→∑
r
|u1(s, r), u2(s, r), . . . , un(s, r)〉 . (6)
Here r = (r1, r2, . . . , rz) ∈ Fzq and ui(s, r) is the polynomial
evaluation
ui(s, r) = s1 + s2xi + . . .+ smxm−1i
+r1xmi + r2x
m+1i + . . .+ rzx
t−1i
where x1, x2, . . . , xn are distinct non-zero constants from Fq.
Remark 1. A ((t, n; z)) ramp QSS scheme can be obtained
from a ((t, n+ℓ; z)) scheme by simply dropping some ℓ shares.
Thus, this construction gives ((t, n; z)) ramp schemes for
any n ≤ t + z. For example, an encoding for a ((t = 3, n =4; z = 1)) ramp QSS scheme will be as follows where each
qudit has dimension 5.
|s1s2〉 7→∑
r1∈F5
|s1 + s2 + r1〉 |s1 + 2s2 + 4r1〉
|s1 + 3s2 + 4r1〉 |s1 + 4s2 + r1〉
Each party is given one of the qudits from the encoded state.
Lemma 6. [30] The encoding in (6) provides a q-ary
((t, n; z)) ramp quantum secret sharing scheme for z < t, n ≤t+ z with the following parameters
q > t+ z (prime)
m = t− z
w1 = w2 = . . . = wn = 1.
This scheme can be used to encode a secret of m = ℓ(t−z)qudits by individually encoding every set of t − z qudits in
the secret. For t = k, z = k − 1, this scheme is very similar
to the ((k, n)) QTS scheme in Lemma 3.
Lemma 7. [30, Corollary 2] The share size averaged over
all parties in a ((t, n; z)) ramp QSS scheme should be at least
as large as 1t−z times the size of the secret.
Note that the bound on storage cost in ramp QSS is in terms
of average share size rather than individual share size. Clearly,
the RQSS scheme from Lemma 6 achieves this bound.
G. Quantum information theory
We briefly recall some of the terms of quantum information
theory and introduce the notation used in the paper. For further
reading, we refer the reader to [33].
6
The von Neumann entropy of a quantum system A with
density matrix ρA is given by
S(A) = − tr(ρA log ρA) = −
MA∑
i=1
λi log λi.
Here {λi} are the eigenvalues of ρA acting on a Hilbert space
HA of dimension MA. The maximum value for S(A) is given
by
S(A) ≤ logMA. (7)
Consider the bipartite quantum system AB whose density
matrix ρAB over the Hilbert space HA ⊗HB . Joint quantum
entropy of AB is defined as
S(AB) = − tr(ρAB log ρAB).
It satisfies two important properties.
S(AB) ≤ S(A) + S(B) (8)
S(AB) ≥ |S(A) − S(B)| (9)
The property (8) is called subadditivity and (9) is called the
Araki-Lieb inequality.
Mutual information between two quantum systems A and
B is defined as
I(A : B) = S(A) + S(B)− S(AB).
Consider an operator W acting on the system B and the
obtained state be represented by the system B′ i.e. ρB′ =W(ρB). Then the data processing inequality states that
I(A : B′) ≤ I(A : B) (10)
where A is another quantum system.
Lemma 8 (Quantum data processing inequality [34]). Con-
sider an arbitrary quantum state Q with a reference system Rsuch that QR is in pure state. If W is a quantum operation
which takes state Q to Q′, then
S(Q) ≥ S(Q′)− S(RQ′)
with equality achieved if and only if the original state Q can
be completely recovered from Q′.
III. UNIVERSAL CE-QTS: A FIRST LOOK
In this section, we take the first steps for a formal treat-
ment of universal communication efficient quantum thresh-
old schemes. After defining them, we illustrate the gains in
communication complexity for a suitably designed quantum
threshold scheme. Later sections in this paper provide con-
structions for such universal communication efficient quantum
secret sharing schemes.
Definition 7 (Universal CE-QTS). A ((k, n)) threshold secret
sharing scheme is said to be universal communication efficient,
if for any di and dj such that k ≤ di < dℓ ≤ n, CC(dℓ) <CC(di). Such schemes are denoted as ((k, n, ∗)) universal CE-
QTS schemes
In other words, in universal CE-QTS schemes, CCn(n) <CCn(n − 1) < . . . < CCn(k + 1) < CCn(k). Similar to
Definition 5, this definition also requires strict reduction in
communication cost CCn(d) for increasing values of d.
A. An example for universal CE-QTS
Consider the example of ((k = 3, n = 5, ∗)) universal CE-
QTS scheme with the following parameters.
q = 7 (11a)
m = 3 (11b)
w1 = w2 = . . . = w5 = 3 (11c)
CC5(3) = 9, CC5(4) = 8, CC5(5) = 5. (11d)
The encoding for the scheme is given by the following
mapping
|s〉 7→∑
r∈F67
|c11c12c13〉 |c21c22c23〉 |c31c32c33〉 (12)
|c41c42c43〉 |c51c52c53〉
where s = (s1, s2, s3) ∈ F37 indicates a basis state of the
quantum secret, r = (r1, r2, . . . , r6) ∈ F67 and cij is the
(i, j)th entry of the matrix
C = V Y.
Here the matrices V and Y are defined as follows.
V =
1 1 1 1 11 2 4 1 21 3 2 6 41 4 2 1 41 5 4 6 2
and Y =
s1 0 0
s2 r1 0
s3 r2 r3r1 r3 r5r2 r4 r6
.
The encoded state in (12) can also be written as,
∑
r∈F67
|v1(s, r1, r2)〉 |v1(0, r1, r2, r3, r4)〉 |v1(0, 0, r3, r5, r6)〉|v2(s, r1, r2)〉 |v2(0, r1, r2, r3, r4)〉 |v2(0, 0, r3, r5, r6)〉|v3(s, r1, r2)〉 |v3(0, r1, r2, r3, r4)〉 |v3(0, 0, r3, r5, r6)〉|v4(s, r1, r2)〉 |v4(0, r1, r2, r3, r4)〉 |v4(0, 0, r3, r5, r6)〉|v5(s, r1, r2)〉 |v5(0, r1, r2, r3, r4)〉 |v5(0, 0, r3, r5, r6)〉 .
Here vi() indicates the polynomial evaluation given by
vi(f1, f2, f3, f4, f5) = f1 + f2.xi + f3.x2i + f4.x
3i + f5.x
4i
and the expression vi(s, r1, r2) denotes vi(s1, s2, s3, r1, r2).Here, we have taken xi = i for 1 ≤ i ≤ 5.
When combiner requests d = 5 parties, they send the first
qudit from each of their shares. When d = 4, the combiner
downloads the first two qudits of each share of the four parties
contacted. When d = 3, the combiner downloads all three
qudits of the share of the three parties contacted. (For clarity,
the qudits accessible to the combiner have been highlighted in
blue in the description below.)
Consider the case when d = 5 i.e. the first qudits from all
five parties are accessed.
∑
r∈F67
|v1(s, r1, r2)〉 |v1(0, r1, r2, r3, r4)〉 |v1(0, 0, r3, r5, r6)〉|v2(s, r1, r2)〉 |v2(0, r1, r2, r3, r4)〉 |v2(0, 0, r3, r5, r6)〉|v3(s, r1, r2)〉 |v3(0, r1, r2, r3, r4)〉 |v3(0, 0, r3, r5, r6)〉|v4(s, r1, r2)〉 |v4(0, r1, r2, r3, r4)〉 |v4(0, 0, r3, r5, r6)〉|v5(s, r1, r2)〉 |v5(0, r1, r2, r3, r4)〉 |v5(0, 0, r3, r5, r6)〉
Applying the operation UV −1 on these five qudits, we obtain
|s〉∑
r∈F67
|v1(0, r1, r2, r3, r4)〉 |v1(0, 0, r3, r5, r6)〉|v2(0, r1, r2, r3, r4)〉 |v2(0, 0, r3, r5, r6)〉|v3(0, r1, r2, r3, r4)〉 |v3(0, 0, r3, r5, r6)〉|r1〉 |v4(0, r1, r2, r3, r4)〉 |v4(0, 0, r3, r5, r6)〉|r2〉 |v5(0, r1, r2, r3, r4)〉 |v5(0, 0, r3, r5, r6)〉
7
Here, the three qudits containing the basis state of the secret
are not entangled with any of the other qudits. Thus, any
arbitrary superposition of the basis states can be recovered
with the above step.
Consider the case when d = 4. Assume that the first four
parties are accessed. The first two qudits from the four parties
are sent to the combiner.
∑
r∈F67
|v1(s, r1, r2)〉 |v1(0, r1, r2, r3, r4)〉 |v1(0, 0, r3, r5, r6)〉|v2(s, r1, r2)〉 |v2(0, r1, r2, r3, r4)〉 |v2(0, 0, r3, r5, r6)〉|v3(s, r1, r2)〉 |v3(0, r1, r2, r3, r4)〉 |v3(0, 0, r3, r5, r6)〉|v4(s, r1, r2)〉 |v4(0, r1, r2, r3, r4)〉 |v4(0, 0, r3, r5, r6)〉|v5(s, r1, r2)〉 |v5(0, r1, r2, r3, r4)〉 |v5(0, 0, r3, r5, r6)〉
Applying the operation UK1 on the set of four second qudits,
where K1 is the inverse of V[2,5][4] , we obtain
∑
r∈F67
|v1(s, r1, r2)〉 |r1〉 |v1(0, 0, r3, r5, r6)〉|v2(s, r1, r2)〉 |r2〉 |v2(0, 0, r3, r5, r6)〉|v3(s, r1, r2)〉 |r3〉 |v3(0, 0, r3, r5, r6)〉|v4(s, r1, r2)〉 |r4〉 |v4(0, 0, r3, r5, r6)〉|v5(s, r1, r2)〉 |v5(0, r1, r2, r3, r4)〉 |v5(0, 0, r3, r5, r6)〉 .
Then, on applying the operators L6 |r2〉 |v1(s, r1, r2)〉,L5 |r2〉 |v2(s, r1, r2)〉, L3 |r2〉 |v3(s, r1, r2)〉 and L3 |r2〉|v4(s, r1, r2)〉, we obtain
∑
r∈F67
|v1(s, r1, 0)〉 |r1〉 |v1(0, 0, r3, r5, r6)〉|v2(s, r1, 0)〉 |r2〉 |v2(0, 0, r3, r5, r6)〉|v3(s, r1, 0)〉 |r3〉 |v3(0, 0, r3, r5, r6)〉|v4(s, r1, 0)〉 |r4〉 |v4(0, 0, r3, r5, r6)〉|v5(s, r1, r2)〉 |v5(0, r1, r2, r3, r4)〉 |v5(0, 0, r3, r5, r6)〉 .
Applying the operation UK2 on the set of four first qudits,
where K2 is the inverse of V[4][4] , we obtain the following state.
|s〉∑
r∈F67
|r1〉 |v1(0, 0, r3, r5, r6)〉|r2〉 |v2(0, 0, r3, r5, r6)〉|r3〉 |v3(0, 0, r3, r5, r6)〉|r1〉 |r4〉 |v4(0, 0, r3, r5, r6)〉|v5(s, r1, r2)〉 |v5(0, r1, r2, r3, r4)〉 |v5(0, 0, r3, r5, r6)〉
(13)
We disentangle the basis state |s〉 from the rest of qudits
by applying the operator UK3 on |r1〉 |r2〉 |r3〉 |r4〉 to get
|r1〉 |r2〉 |r3〉 |v5(0, r1, r2, r3, r4)〉 and then applying UK4 on
|s1〉 |s2〉 |s3〉 |r1〉 |r2〉 to get |s1〉 |s2〉 |s3〉 |r1〉 |v5(s, r1, r2)〉.
K3 =
1 0 0 0
0 1 0 0
0 0 1 0
V[2,5]{5}
and K4 =
1 0 0 0 0
0 1 0 0 0
0 0 1 0 0
0 0 0 1 0
V{5}
Now, we obtain
|s〉∑
r∈F67
|r1〉 |v1(0, 0, r3, r5, r6)〉|v5(s, r1, r2)〉 |v2(0, 0, r3, r5, r6)〉|r3〉 |v3(0, 0, r3, r5, r6)〉|r1〉 |v5(0, r1, r2, r3, r4)〉 |v4(0, 0, r3, r5, r6)〉|v5(s, r1, r2)〉 |v5(0, r1, r2, r3, r4)〉 |v5(0, 0, r3, r5, r6)〉
(14)
= |s〉∑
(r1,r2,r3,r′4,
r5,r6)∈F67
|r1〉 |v1(0, 0, r3, r5, r6)〉|v5(s, r1, r2)〉 |v2(0, 0, r3, r5, r6)〉|r3〉 |v3(0, 0, r3, r5, r6)〉|r1〉 |r
′4〉 |v4(0, 0, r3, r5, r6)〉
|v5(s, r1, r2)〉 |r′4〉 |v5(0, 0, r3, r5, r6)〉
(15)
= |s〉∑
(r1,r′2,r3,r
′4,
r5,r6)∈F67
|r1〉 |v1(0, 0, r3, r5, r6)〉|r′2〉 |v2(0, 0, r3, r5, r6)〉|r3〉 |v3(0, 0, r3, r5, r6)〉|r1〉 |r
′4〉 |v4(0, 0, r3, r5, r6)〉
|r′2〉 |r′4〉 |v5(0, 0, r3, r5, r6)〉 .
(16)
The variable change in (15) is possible because the
qudits∑
r4∈F7|v5(0, r1, r2, r3, r4)〉 |v5(0, r1, r2, r3, r4)〉 give
the uniform superposition∑
r′4∈F7|r′4〉 |r
′4〉 independent of
r1, r2, r3, r5, r6. The variable change from r2 to r′2 can also
be obtained similarly.
Now, the secret is disentangled with the rest of the qudits.
Thus, any arbitrary superposition of the basis states can be
recovered with above steps for d = 4.
In the case when d = 3, each of the three contacted parties
sends all three qudits in its share.
∑
r∈F67
|v1(s, r1, r2)〉 |v1(0, r1, r2, r3, r4)〉 |v1(0, 0, r3, r5, r6)〉|v2(s, r1, r2)〉 |v2(0, r1, r2, r3, r4)〉 |v2(0, 0, r3, r5, r6)〉|v3(s, r1, r2)〉 |v3(0, r1, r2, r3, r4)〉 |v3(0, 0, r3, r5, r6)〉|v4(s, r1, r2)〉 |v4(0, r1, r2, r3, r4)〉 |v4(0, 0, r3, r5, r6)〉|v5(s, r1, r2)〉 |v5(0, r1, r2, r3, r4)〉 |v5(0, 0, r3, r5, r6)〉
The secret recovery for d = 3 also uses operations similar
to those in the case of d = 4. For sake of completeness, the
secret recovery for d = 3 in this scheme has been explained
in Appendix B.
In all the three cases, the first step was to recover the basis
state |s〉 = |s1s2s3〉. The recovery is complete at this point
if the secret is any one of the basis states (identical to a
classical secret). But the quantum secret can be in an arbitrary
superposition of basis states. To recover this quantum secret,
the three qudits containing information on the secret needs
to be disentangled from the rest of the qudits. For example,
the first three qudits in (13), though they have information on
the basis states, are still entangled with the other qudits while
these qudits are disentangled form the other qudits in (16).
B. Comparison with fixed d CE-QTS
In contrast with the above scheme, for the standard ((3, 5))QSS scheme due to Cleve et al. 3 qudits need to be communi-
cated for recovery of 1 qudit of secret whenever the combiner
accesses three or more parties. The ((3, 5, 5)) CE-QTS scheme
from [12] described in (4) gives a better communication cost
of 5/3 qudits per 1 qudit of secret when the combiner accesses
5 parties. But this scheme does not provide the flexibility of
also contacting four parties communication efficiently. The
scheme provided above can solve that problem. It provides
communication efficiency at both d = 5 and d = 4.
At d = 4, the above scheme gives communication cost of
8 qudits to recover secret of 3 qudits i.e. 8/3 qudits per one
qudit of secret. However this is not the optimal communication
8
cost for d = 4. Because, for d = 4, the communication cost
in a ((3, 5, 4)) fixed d CE-QTS scheme from [12] gives 2
qudits per one qudit of secret. The constructions proposed in
the coming sections can give a ((3, 5, ∗)) universal CE-QTS
scheme with the same communication efficiency as the fixed
d CE-QTS schemes of [12] at both d = 4 and d = 5.
IV. CONCATENATION FRAMEWORK FOR CONSTRUCTING
COMMUNICATION EFFICIENT QTS SCHEMES
In this section, we develop a framework for constructing
communication efficient quantum secret sharing schemes. We
propose a general framework which can be used to derive
many classes of CE-QTS schemes. Ramp secret sharing
schemes and threshold schemes are the central ingredients of
the proposed constructions. First, we give a systematic method
to construct CE-QTS schemes where the combiner can contact
d parties, and reconstruct the secret. Here d is determined
prior to secret distribution. Then, we provide a systematic
method to construct CE-QTS schemes where the combiner
can contact any d parties to reconstruct the secret. Here, dcan be determined after secret distribution arbitrarily by the
combiner.
A. Fixed d CE-QTS from ramp QSS
Suppose we have a ((k, n, d)) CE-QTS scheme. Consider
any authorized set of d ≥ k parties. Since this is an authorized
set, we can reconstruct the secret. In a communication efficient
scheme, these d parties do not communicate their entire shares
to the combiner. They only communicate a portion of their
share. For gaining the intuition, let us assume that the portion
communicated by a party when a set of d parties are contacted
by the combiner is independent of the choice of the remaining
d− 1 parties. Since this is a ((k, n, d)) scheme, any k − 1 or
fewer portions i.e. partial shares cannot reveal any information
about the secret. However, k or more portions may reveal
partial information about the secret, while d out of all the nportions can completely recover the secret. Therefore, the set
of portions communicated by all the n parties to the combiner
can be modelled as a ((d, n; k − 1)) ramp QSS scheme.
Now let us see if we can build a ((k, n)) QTS scheme out
of this ((d, n; k−1)) ramp QSS scheme. If k of these n parties
attempt to reconstruct the secret with just their shares from the
ramp scheme, then their k shares may not be enough for the
reconstruction of the secret. The combiner will need shares
from d−k more parties of the ramp scheme for the additional
information required to recover the secret for sure. So we
extend the ramp scheme to a ((d, n + d − k; k − 1)) scheme
by allowing for d− k more new shares in the previous ramp
scheme. These additional d − k shares of the ramp scheme
are distributed to the n parties after encoding by a ((k, n))threshold scheme so that even if only k parties are contacted
by the combiner these d− k extra shares necessary for secret
recovery can be recovered. The full scheme is illustrated in
Fig. 1 and formally proved in Theorem 1.
Theorem 1 (Concatenation framework for fixed d CE-QTS).
A ((k, n, d)) CE-QTS scheme exists, if a ((d, n+d−k; k−1))
((t′,n′;z′))
ramp QSS
n′=n+d−k
t′=d
z′=k−1
|φ〉
...
n
...
d− k
Layer 1 encoding Layer 2 encoding
((k,n))QTS
...
n
A1 B1S1
A2 B2S2
A3 B3S3
......
...
An BnSn
Fig. 1: Concatenation framework for constructing ((k, n, d))CE-QTS scheme with ((d, n+d−k; k−1)) ramp QSS scheme.
Algorithm 1 Encoding for a ((k, n, d)) CE-QTS scheme using
a ((d, n+ d− k; k − 1)) ramp QSS and a ((k, n)) QTS.
Input: Secret |φ〉Output: Shares of the n parties, Sj for 1 ≤ j ≤ n
1: Encode the secret |φ〉 using the ((d, n + d − k; k − 1))ramp QSS scheme. Denote the jth share generated by the
ramp scheme as Aj for 1 ≤ j ≤ n+ d− k such that the
last d− k shares have the largest share sizes.
2: Encode the quantum state in (An+1, An+2, . . . , An+d−k)using a ((k, n)) quantum threshold scheme. Denote the
jth share of this QTS scheme as Bj for 1 ≤ j ≤ n.
3: Distribute Sj = (Aj , Bj) to the jth party for 1 ≤ j ≤ n.
ramp QSS scheme and a ((k, n)) QTS scheme exist. The
encoding for this scheme is given in Algorithm 1 and the
recovery in Algorithm 2.
Proof. The proof is by giving an explicit construction of a
((k, n, d)) CE-QTS scheme from the given ramp QSS and
((k, n)) threshold schemes. The encoding for the ((k, n, d))CE-QTS scheme is as given in Algorithm 1. Each share Sj
consists of two portions (Aj , Bj). We say that Aj forms the
first layer of the share Sj and Bj the second layer. Here, for
any L ⊆ [n], SL denotes {Sj}j∈L and |Sj | gives the number
of qudits in the share Sj . Similar notations are used for {Aj}and {Bj} as well.
(i) Recoverability: The secret recovery for the ((k, n, d))CE-QTS scheme is as given in Algorithm 2. While the
combiner accesses any set of d parties, it just needs
layer 1 of these parties to recover the secret from the
underlying ramp scheme. But while accessing only kparties, the combiner needs d−k more shares of the ramp
scheme to recover the secret. These d − k extra shares
are recovered from the ((k, n)) scheme with qudits from
second layer.
(ii) Secrecy: Consider any set L ⊆ [n] such that |L| =k − 1. By Lemma 1, let E1 be the purifying state
for the ramp QSS scheme such that the shares
A1, A2, . . . , An+d−k, E1 give a pure state scheme en-
coding |φ〉. Similarly, let E2 be the purifying state
9
Algorithm 2 Secret recovery for the ((k, n, d)) CE-QTS
scheme from the encoding in Algorithm 1
Input: Shares of k parties or layer 1 from any d parties
Output: Secret |φ〉1: if combiner has access to only k shares then
2: Download full shares from the k parties.
3: Use layer 2 from the k parties to recover the input to the
((k, n)) QTS scheme i.e. (An+1, An+2, . . . , An+d−k).
4: Use (An+1, An+2, . . . , An+d−k) and layer 1 from the
k parties to get d shares of the ramp QSS scheme and
recover the secret |φ〉.5: else if combiner has access to d shares then
6: Download layer 1 from the d parties.
7: Use layer 1 from the d parties to get d shares of the
ramp QSS scheme and recover the secret |φ〉.8: end if
for the perfect QSS scheme such that the shares
B1, B2, . . . , Bn, E2 give a pure state scheme encoding
(An+1, An+2, . . . , An+d−k). Overall, S[n] ∪ {E1, E2}gives a pure state scheme encoding |φ〉. If it can be
proved that S[n]\L ∪ {E1, E2} can recover the secret,
then by no-cloning theorem, SL has no information on
the secret which proves the secrecy property of the CE-
QTS scheme of Algorithm 1.
Assume that Alice has the shares S[n]\L ∪ {E1, E2}.
Clearly, BL is an unauthorized set in the QTS scheme.
By Lemma 2, B[n]\L ∪ {E2} is an authorized set
for recovering (An+1, An+2, . . . , An+d−k). Thus, Al-
ice recovers (An+1, An+2, . . . , An+d−k) from the QTS
scheme. Now, Alice has the shares A[n+d−k]\L ∪ {E2}.
AL is an unauthorized set in the ramp QSS scheme. By
Lemma 2, A[n−d+k]\L∪{E1} is an authorized set in the
ramp QSS scheme. Hence, Alice recovers the secret |φ〉from the ramp QSS scheme.
(iii) Communication efficiency: Consider the set of d parties
given by D ⊆ [n] which has maximum communication
cost among all sets of d parties. By definition, the com-
munication cost of this set of d parties equals CCn(d).Pick a K ⊂ D such that |K| = k.
CCn(k) =∑
j∈K
|Sj | =∑
j∈K
(|Aj |+ |Bj |)
≥∑
j∈K
|Aj |+∑
j∈K
n+d−k∑
ℓ=n+1
|Aℓ| (17)
=∑
j∈K
|Aj |+ k
n+d−k∑
ℓ=n+1
|Aℓ|
>∑
j∈K
|Aj |+
n+d−k∑
ℓ=n+1
|Aℓ| (18)
≥∑
j∈K
|Aj |+∑
j∈D\K
|Aj | (19)
=∑
j∈D
|Aj | = CCn(d)
where J = D\K . The bound on (17) is due to
Lemma 4 which implies that each share Bi of the QTS
scheme is at least as large as the input state given by
(An+1, An+2, . . . , An+d−k). The strict inequality in (18)
is because k > 1. The inequality (19) is due to the
fact that the shares An+1, An+2, . . . , An+d−k have the
largest sizes among all the n+ d− k shares of the ramp
scheme.
This concludes the proof of the theorem.
Theorem 1 can be used with various ramp QSS and
threshold schemes. Note that Theorem 1 does not require
the alphabet q to be a prime. The communication complexity
of the resulting schemes clearly depends on the underlying
ramp QSS scheme and QTS scheme. Here, we propose a
construction for CE-QTS scheme using the ramp QSS scheme
proposed by Ogawa et al. [30] and the QTS scheme from
Cleve et al. [2].
Corollary 1 (Concatenated construction for fixed d CE-QTS).
A q-ary ((k, n, d)) communication efficient QTS scheme can
be constructed using the encoding in Algorithm 1 with the
following parameters.
q > d+ k − 1 (prime)
m = d− k + 1
w1 = w2 = . . . = wn = d− k + 1
CCn(k) = k(d− k + 1)
CCn(d) = d.
Proof. Consider the Concatenation framework from Theo-
rem 1. Use the ramp scheme from [30] given in Lemma 6 and
the QTS scheme from [2] given in Lemma 3 for the underlying
schemes.
By Lemma 6, the dimension of the qudits has to be a prime
q such that q > d− k+1. This also satisfies the constraint on
the dimension for the QTS scheme from Lemma 3. The size
of the secret in the ramp scheme is m = d− k + 1 qudits.
Each share of the ramp QSS is of size one qudit. Thus the
first layer of each share in the CE-QTS has one qudit. The
input state for the ((k, n)) QTS will have d − k qudits. By
Lemma 3, the size of each share of the QTS scheme is also
d− k. Hence, the second layer of each share in CE-QTS has
d− k qudits. In total, each share in the CE-QTS scheme has
wj = d− k + 1 qudits for 1 ≤ j ≤ n.
When the combiner attempts to recover from just k parties,
each of them transmits the entire share of d − k + 1 qudits.
Thus CCn(k) = k(d − k + 1). When the combiner contacts
any d parties, each of them sends a qudit from the first layer,
giving CCn(d) = d.
In the CE-QTS scheme as described in Corollary 1, note
that the dimension of each of the d−k+1 qudits in the secret
has to be more than d + k − 1. Compare this with the CE-
QTS scheme from [12] which can give a smaller dimension
of q > 2k − 1. (Refer Table I.) However, using other ramp
schemes in this framework could lead to CE-QTS schemes
with qudits of dimension less than or equal to d− k + 1.
10
B. Universal CE-QTS from ramp QSS
Consider an ((n, n; k−1)) ramp QSS scheme (marked black
in Fig. 2). Now, if a combiner has access to only n − 1 out
of the n parties, the combiner will not be able to recover the
secret unless he receives one more share from this scheme. If
these n− 1 parties can send the combiner some more qudits
containing information about an extra share, then the combiner
can recover the secret with this extra share.
This flexibility can be achieved by instead taking an ((n+1, n; k − 1)) ramp QSS scheme where the first n shares are
given to n parties and the (n + 1)th share is encoded and
distributed among the n parties through an ((n − 1, n; k −1)) scheme (which is indicated with blue in Fig. 2). Then,
whenever the combiner has access to only n−1 parties, he will
first decode the ((n−1, n; k−1)) scheme to recover the extra
share and then use the n−1 shares from the ((n, n+1; k−1))ramp scheme along with this extra share to recover the secret.
((t,n′;z))
ramp QSS
n′=n+1
t=n
z=k−1
|φ〉
...
n
Layer 1 encoding Layer 2 encoding
((t,n′;z))
ramp QSS
n′=n
t=n−1
z=k−1
...
n
S(1)1
S1
S(1)2
S2
S(1)3
S3
...
...
S(1)n
Sn
S(2)1
S(2)2
S(2)3...
S(2)n
Fig. 2: Concatenation of two ramp quantum secret sharing
schemes to construct a ((t, n; k− 1)) ramp QSS scheme with
flexible t ∈ {n− 1, n}.
Thus, by concatenating an ((n− 1, n; k− 1)) ramp scheme
which encodes the extra share from an ((n, n+1; k−1)) ramp
scheme, a ((t, n; k−1)) ramp QSS with a flexible threshold t ∈{n− 1, n} can be designed. Similarly, a ((k, n, ∗)) universal
CE-QTS scheme is a QTS scheme in which the secret recovery
can happen efficiently for all thresholds d ∈ {k, k+1, . . . , n}.
The main idea in our following framework for constructing
universal CE-QTS schemes is that this generalization of d can
be achieved by concatenating n − k + 1 ramp schemes with
increasing threshold t successively.
Theorem 2. If ((di, n + di − k; k − 1)) ramp QSS schemes
exist for 1 ≤ i ≤ n − k + 1 where di = n + 1 − i, then a
q-ary ((k, n, ∗)) universal communication efficient QTS exists.
The encoding for this scheme is given in Algorithm 3 and the
recovery in Algorithm 4.
Proof. The proof is by giving a construction for the CE-QTS
scheme from the given ramp QSS schemes. The encoding of
the ((k, n, ∗)) universal CE-QTS is as given in Algorithm 3.
The ((di, n+ di − k; k− 1)) ramp QSS scheme is referred to
|φ〉
RQSS1
n1=n+h-1
t1=n
z1=k-1
n
To RQSS3
To RQSS4......
RQSS2
n2=n+h-2
t2=n-1
z2=k-1
n
To RQSS3
To RQSS4...
...
. . .
RQSSi
ni=n+h-i
ti=n-i+1
zi=k-1
n
. . .
. . .
...
From RQSSi−2
From RQSSi−1
To RQSSi+1
To RQSSi+2
...
. . .
RQSSh
nh=n
th=k
zh=k-1
n
. . .
. . .
...
. . .
...
From RQSSh−2
From RQSSh−1
Layer 1
...
...
Layer 2
...
...
. . .
...
...
Layer i
...
S(i)j
...
. . .
...
...
Layer h=n-k+1
...
...
S1
S2
...
Sj
...
Sn
Fig. 3: Concatenation framework for constructing ((k, n, ∗))universal CE-QTS scheme by concatenating multiple ramp
QSS schemes. Here di = n + 1 − i for 1 ≤ i ≤ n − k + 1and the ((ti = di, ni = n + di − k; zi = k − 1)) ramp QSS
scheme is denoted by RQSSi.
Algorithm 3 Encoding for a ((k, n, ∗)) universal CE-QTS
scheme
Input: Secret |φ〉Output: Shares of the n parties, Sj for 1 ≤ j ≤ n
1: Encode the secret |φ〉 using the RQSS1 scheme.
2: for i = 1 to n− k + 1 do
3: Distribute the smallest n shares from the RQSSi scheme
(S(i)1 , S
(i)2 , . . . , S
(i)n ) to the n parties. This is called the
ith layer of the encoding.
4: if di > k then
5: For all 1 ≤ ℓ ≤ di − k, the share S(i)n+ℓ goes as part
of input to the RQSSi+ℓ scheme.
6: The combined state of all the qudits passed from the
previous i ramp schemes to the RQSSi+1 scheme is
encoded using the RQSSi+1 scheme.
7: end if
8: end for
as RQSSi here. Here, for any L ⊆ [n], SL denotes {Sj}j∈L
and |Sj | gives the number of qudits in the share Sj . Similar
notations are used for {S(i)j } as well.
(i) Recoverability: The secret recovery for the ((k, n, ∗))universal CE-QTS scheme is as given in Algorithm 4.
Whenever the combiner accesses di parties, each of those
11
Algorithm 4 Secret recovery for the ((k, n, ∗)) universal CE-
QTS scheme in Algorithm 3.
Input: The first i layers of qudits from any di parties for any
1 ≤ i ≤ n− k + 1Output: Secret |φ〉
1: Use the ith layer of the di parties to recover the input
state of the RQSSi scheme.
2: for ℓ = i − 1 to 1 step -1 do
3: Consider the RQSSℓ scheme. The ℓth layer of the diparties will give di shares of this ramp scheme.
4: Collect dℓ−di = i−ℓ more shares of this ramp scheme
one each from the input states recovered from the layers
ℓ+ 1 to i.5: Use all these dℓ = di+ i− ℓ shares to recover the input
state of the RQSSℓ scheme.
6: end for
7: The input state of the RQSS1 scheme gives the secret |φ〉.
parties send the first i layers to the combiner. Once
this is done, the combiner has di shares in the RQSSi
scheme. Hence, RQSSi can be decoded and its input
qudits recovered. However, for decoding RQSSℓ schemes
for 1 ≤ ℓ ≤ i−1, the combiner still needs dℓ−di = i−ℓshares. For each RQSSℓ, these deficit shares can be
provided by the input qudits recovered from the schemes
RQSSℓ+1, RQSSℓ+2, . . . , RQSSi, one share from each
of these i−ℓ schemes. This iterative decoding of RQSSℓ
will finally give the secret |φ〉 after decoding RQSS1.
(ii) Secrecy: Consider the set J ⊂ [n] such that |J | = k− 1.
By Lemma 1, let Ei be the purifying state for the RQSSi
scheme for all 1 ≤ i ≤ n − k + 1. Assume Alice
has the set of shares {S[n]\J , E1, E2, . . . , En−k+1}. For
RQSSn−k+1, now Alice has the purifying state and
every share except some k − 1 shares. This set of
k − 1 shares in RQSSn−k+1 has no information on
its qudits. Therefore, by Lemma 2, Alice has an au-
thorized set for RQSSn−k+1, from which she recovers
its input qudits. These qudits will now give one extra
share to each of the schemes RQSSn−k till RQSS1.
With this extra share, RQSSn−k will have an authorized
set and from which Alice recovers its input qudits
and retrieves one extra share to each of the schemes
RQSSn−k−1 till RQSS1. By this iterative recovery pro-
cess, finally Alice can recover the secret |φ〉 from
RQSS1. Thus, the secret can be recovered from the set
of shares {S[n]\J , E1, E2, . . . , En−k+1}. Hence, by no-
cloning theorem, SJ has no information on the secret i.e.
any k−1 or less parties in this scheme has no information
on the secret.
(iii) Communication efficiency: Here, we will prove that for
any di such that k < di ≤ n, the communication cost in
our scheme is less than that of di − 1. By definition,
CCn(di) is the maximum among the communication
costs of all authorized sets of size di. Let D ⊆ [n] be the
authorized set which has this maximum communication
cost CCn(di). Let p ∈ D be one of these di parties.
Clearly, CCn(di − 1) should be greater than or equal to
the communication cost of the authorized set given by
D\{p}.
CCn(di − 1) ≥∑
j∈D\{p}
i+1∑
ℓ=1
|S(ℓ)j |
=∑
j∈D\{p}
i∑
ℓ=1
|S(ℓ)j |+
∑
j∈D\{p}
|S(i+1)j |
(20)
The di−1 shares in {S(i+1)j }j∈D\{p} are from the ((di−
1, n+di−1−k; k−1)) RQSSi ramp scheme. Recall from
Remark 1 that after dropping the remaining n−k shares
from RQSSi scheme, this set of shares alone will give a
((di − 1, di− 1; k− 1)) ramp scheme which encodes the
same state as RQSSi scheme. By Lemma 7, the average
share size of this ramp scheme is at least 1di−k times the
total input size.
1
di − 1
∑
j∈D\{p}
|S(i+1)j | ≥
1
di − k
i∑
j=1
|S(j)n+i+1−j |
Applying this bound in (20), we obtain
CCn(di − 1)
≥∑
j∈D\{p}
i∑
ℓ=1
|S(ℓ)j |+
di − 1
di − k
i∑
ℓ=1
|S(ℓ)n+i−ℓ+1|
>∑
j∈D\{p}
i∑
ℓ=1
|S(ℓ)j |+
i∑
ℓ=1
|S(ℓ)n+i−ℓ+1| (21)
≥∑
j∈D\{p}
i∑
ℓ=1
|S(ℓ)j |+
i∑
ℓ=1
|S(ℓ)p | (22)
=∑
j∈D
i∑
ℓ=1
|S(ℓ)j | = CCn(di)
The strict inequality in (21) is because k > 1. The
inequality (22) is due to the fact that the shares
S(i)n+1, S
(i)n+2, . . . , S
(i)n+di−k have the largest sizes among
the n + di − k shares of the RQSSi scheme. This
concludes the proof.
With the above framework, the following construction for
a universal CE-QTS can be provided by using the ramp QSS
scheme by Ogawa et al [30].
Corollary 2 (Concatenated construction for universal
CE-QTS). A q-ary ((k, n, ∗)) universal communication effi-
cient QTS scheme can be constructed using the encoding in
Algorithm 3 with the following parameters.
q > n+ k − 1 (prime)
m = lcm{1, 2, . . . , n− k + 1}
w1 = w2 = . . . = wn = m
CCn(d) =dm
d− k + 1for d ∈ {k, k + 1, . . . , n}
12
Proof. Consider the universal CE-QTS scheme from Algo-
rithm 3 and use the schemes from [30] given in Lemma 6 for
the underlying ramp schemes. Clearly the dimension of each
qudit q should be above ti + zi = di + k− 1 = n+ k − i for
all 1 ≤ i ≤ n− k + 1. Therefore, q > n+ k − 1.
Let ei be the number of qudits in the input state of the ramp
QSS scheme RQSSi corresponding to the ith layer. The secret
is the input to the scheme RQSS1. Clearly, e1 = m. For i > 1,
the input state of the ramp QSS scheme RQSSi has one share
each from the ramp QSS schemes RQSS1 to RQSSi−1.
ei =
i−1∑
ℓ=1
|S(ℓ)n+i−ℓ| (23)
Recall that, in the ((ti, ni; zi)) ramp schemes given in
Lemma 6, the size of each share is 1ti−zi
times the secret
size i.e. for any 1 ≤ j ≤ n+ di − k,
|S(i)j | =
eidi − k + 1
. (24)
Solving the recursion from (23) and (24) with the initial
condition e1 = m, we obtain, for 2 ≤ i ≤ n− k + 1,
ei =m
di−1 − k + 1.
Note that for each 1 ≤ i ≤ n − k + 1, implementing the
scheme RQSSi requires ei to be divisible by ti−zi = di−k+1.
This can be achieved by taking m = lcm{1, 2, . . . , n−k+1}.
From (24), the size of the jth share from RQSSi is
|S(1)j | =
m
(d1 − k + 1)
|S(i)j | =
m
(di − k + 1)(di−1 − k + 1)
for 2 ≤ i ≤ n − k + 1. The total communication cost during
secret recovery from a set of any di parties given by D can
be calculated as
CCn(di) =∑
j∈D
i∑
ℓ=1
|S(ℓ)j | =
dim
di − k + 1
Also, for 1 ≤ j ≤ n, the size of the jth share is given by
wj =
n−k+1∑
i=1
|S(i)j | =
n−k+1∑
i=1
eidi − k + 1
= m.
The above corollary gives a construction based on the
concatenation framework for a universal CE-QTS scheme. In
the next section, we give another construction for universal
CE-QTS schemes.
V. UNIVERSAL CE-QTS SCHEMES BASED ON STAIRCASE
CODES
In this section, we propose an alternate construction of
universal CE-QTS based on classical communication efficient
secret schemes constructed using Staircase codes [26]. While
constructing QSS schemes based on classical secret sharing
schemes, there are some important differences. For QSS
schemes, the secret recovery should recover not just the basis
states but also any arbitrary superposition of the basis states.
Hence the qudits containing the secret have to be disentangled
from the remaining qudits, thus making the secret recovery in
QSS schemes more involved.
A. Encoding
Communication efficient quantum secret sharing schemes for
particular values of k and n = 2k − 1 can be designed to
work for all possible values of d in the range k through nwhere k ≤ d ≤ n. We introduce the following terms before
discussing the scheme. For 1 ≤ i ≤ k,
di = n+ 1− i = 2k − i (25a)
m = lcm{k, k − 1, . . . , 1} (25b)
ai = m/(di − k + 1) (25c)
bi = ai − ai−1 for i > 1, b1 = a1 (25d)
Here m is the total number of secret qudits shared. The total
number of qudits with each party is also given by m. This
is consistent with the fact that in a perfect threshold secret
sharing scheme the size of the share must be at least as large
as the secret [5], [8].
Now ai gives the number of qudits communicated from each
accessible share when di parties are accessed to recover the
secret. This means that aidi qudits are communicated to the
combiner when di parties are contacted. Pick a prime number
q > 2k − 1.
Consider the basis state of the secret s = (s1, s2, . . . , sm) ∈
Fmq and r = (r1, r2, . . . , rm(k−1)) ∈ F
m(k−1)q .
Entries in s are rearranged into the matrix S of size k ×(m/k).
S =
s1 sk+1 · · · sm−k+1
s2 sk+2 · · · sm−k+2
......
. . ....
sk s2k · · · sm
(26)
Entries in r are rearranged into k matrices i.e. R1 of size
(k− 1)× b1, R2 of size (k− 1)× b2 and so on till Rk of size
(k − 1)× bk.
R1 =
r1 rk · · · r(a1−1)(k−1)+1
r2 rk+1 · · · r(a1−1)(k−1)+2
......
. . ....
rk−1 r2(k−1) · · · ra1(k−1)
For 2 ≤ i ≤ k, Ri is given by
rai−1(k−1)+1 r(ai−1+1)(k−1)+1 · · · r(ai−1)(k−1)+1
rai−1(k−1)+2 r(ai−1+1)(k−1)+2 · · · r(ai−1)(k−1)+2
......
. . ....
r(ai−1+1)(k−1) r(ai−1+2)(k−1) · · · rai(k−1)
.
The matrix C, called code matrix, is defined as follows.
C = V Y
13
where Y is given by
Y =
S
00
. . .0
D1 D2 Dk−1
R1 R2 R3 . . . Rk
and V is a n× n Vandermonde matrix given by
V =
1 x1 . . . xd−11
1 x2 . . . xd−12
......
. . ....
1 xn . . . xd−1n
. (27)
where x1, x2, ..., xn are distinct non-zero constants from Fq.
Here, Di of size (k − i)× bi+1 is constructed by rearranging
the entries in ith row of the matrix [R1 R2 . . . Ri]. Clearly,
Di contains ai = (k − i)bi+1 entries.
The encoding for a universal QTS is given as follows:
|s1s2 . . . sm〉 7→∑
r∈Fm(k−1)q
n⊗
i=1
|ci,1ci,2 . . . ci,m〉 (28)
where cij is the entry in C = V Y from ith row and jthcolumn. After encoding, the uth set of m qudits is given to
the uth party.
For example, take k = 3. The ((k = 3, n = 5, ∗)) scheme
will have the following parameters.
q = 7
m = lcm{1, 2, 3} = 6
w1 = w2 = w3 = w4 = w5 = 6
d1 = 5, d2 = 4, d3 = 3
a1 = 2, a2 = 3, a3 = 6
b1 = 2, b2 = 1, b3 = 3
Then C, the coding matrix for k = 3 is given as.
1 1 1 1 1
1 2 4 1 2
1 3 2 6 4
1 4 2 1 4
1 5 4 6 2
s1 s4 0 0 0 0
s2 s5 r1 0 0 0
s3 s6 r3 r2 r4 r6r1 r3 r5 r7 r9 r11r2 r4 r6 r8 r10 r12
The encoding for this ((3, 5, ∗)) scheme is then given by
(28). Note that each entry in matrix C, cij is a function of
s and r. However, Di are functions of r alone. For a detailed
description of this scheme, refer to the appendix in [35].
Our encoding matrix is somewhat similar to the matrix used
in [26]. However, there are some minor structural differences.
Since we are encoding quantum states in superposition, there
is no need for generating random bits. Furthermore, due to the
no-cloning theorem, the total number of parties cannot exceed
2k − 1.
B. Reconstruction of the secret
The combiner can reconstruct the secret depending upon
the choice of d. Once d = di is chosen, the combiner contacts
a set of any di parties to reconstruct the secret. Each of the
contacted party sends ai =m
di−k+1 qudits to the combiner. In
total, the combiner has dimdi−k+1 = aidi qudits.
With respect to the ((3, 5, ∗)) example in the previous
section, suppose that the third party is contacted for recon-
struction. If the party belongs to recovery set of size d1 = 5,
then a1 = 2 qudits are communicated to the combiner.
Similarly, if d2 = 4, then a2 = 3 and if d3 = 3, then a3 = 6qudits are sent.
The secret reconstruction happens in two stages. First, the
basis states of the secret are reconstructed through suitable
unitary operations. The classical secret sharing schemes stop
the reconstruction at this point. But, the qudits containing the
basis states of the secret can be entangled with the remaining
qudits. So, in the second stage, the secret is extracted into a
set of qudits that are disentangled with the remaining qudits.
Lemma 9 (Secret recovery). For a ((k, 2k − 1, ∗)) scheme
with the encoding given in (28), we can recover the secret
from any d = 2k− i shares where 1 ≤ i ≤ k by downloading
only the first ai =m
d−k+1 qudits from each share where m is
as given in (25).
Proof. Each of the d participants sends their first ai qudits
to the combiner for reconstructing the secret. Let D ={j1, j2, . . . , jd} ⊆ {1, 2, . . . , 2k − 1} be the set of d shares
chosen and E = {jd+1, jd+2, . . . , j2k−1} be the complement
of D. Then, (28) can be rearranged as
∑
r∈Fm(k−1)q
|cj1,1cj2,1...cjd,1〉 |cj1,2cj2,2...cjd,2〉
. . . |cj1,acj2,a...cjd,a〉∣
∣cjd+1,1cjd+2,1...cjn,1⟩ ∣
∣cjd+1,2cjd+2,2...cjn,2⟩
. . .∣
∣cjd+1,acjd+2,a...cjn,a⟩
|c1,a+1c2,a+1...cn,a+1〉 |c1,a+2c2,a+2...cn,a+2〉
. . . |c1,mc2,m...cn,m〉 (29)
where we have highlighted (in blue) the qudits communicated
to the combiner. For the sake exposition we will first cover
the case of i = 1 i.e. di = 2k − 1 where all the parties are
contacted for their first a1 qudits by the combiner.
Case (i): i = 1For i = 1, d = 2k − 1 = n. Now (29) can be rewritten as
∑
r∈Fm(k−1)q
|V (S,R1)〉 |V (0, D1, R2)〉 |V (0, D2, R3)〉
. . . |V (0, Dk−1, Rk)〉
where we slightly abused the notation. By A(B1, B2, B3) we
actually refer to the matrix product A[
Bt1 Bt
2 Bt3
]t.
Since V is a n×n Vandermonde matrix and, we can apply
V −1 to the state |V (S,R1)〉, to obtain
|S〉∑
r∈Fm(k−1)q
|R1〉 |V (0, D1, R2)〉 |V (0, D2, R3)〉
. . . |V (0, Dk−1, Rk)〉
14
We can clearly see that the secret is disentangled with the rest
of the qudits. Therefore, we can recover arbitrary superposi-
tions also.
Case (ii): 2 ≤ i ≤ k: Under this case, the state of
the system is as follows. (This is the same as (29), only the
qudits in possession of the combiner have been highlighted.)
∑
r∈Fm(k−1)q
|VD(S,R1)〉 |VD(0, D1, R2)〉 . . . |VD(0, Di−1, Ri)〉
|VE(S,R1)〉 |VE(0, D1, R2)〉 . . . |VE(0, Di−1, Ri)〉
|V (0, Di, Ri+1)〉 . . . |V (0, Dk−1, Rk)〉
We can simplify this state using the fact VD(0, Dj , Rj+1) =
V[j+1,n]D (Dj , Rj+1).
=∑
r∈Fm(k−1)q
|VD(S,R1)〉∣
∣
∣VD
[2,2k−1](D1, R2)⟩
. . .∣
∣
∣VD
[i,2k−1](Di−1, Ri)⟩
|VE(S,R1)〉 |VE(0, D1, R2)〉
. . . |VE(0, Di−1, Ri)〉
|V (0, Di, Ri+1)〉 . . . |V (0, Dk−1, Rk)〉
Since VD[i,2k−1] is a d×d Vandermonde matrix, the combiner
can apply the inverse of VD[i,2k−1] to
∣
∣
∣V
[i,n]D (Di−1, Ri)
⟩
to
transform the state as follows.
∑
r∈Fm(k−1)q
|VD(S,R1)〉∣
∣
∣VD
[2,2k−1](D1, R2)⟩
. . .∣
∣
∣VD
[i−1,2k−1](Di−2, Ri−1)⟩
|Di−1〉 |Ri〉
|VE(S,R1)〉 |VE(0, D1, R2)〉 . . . |VE(0, Di−1, Ri)〉
|V (0, Di, Ri+1)〉 . . . |V (0, Dk−1, Rk)〉
Note that the matrix Di−1 contains elements from the (i−1)throw of Ri−1. Rearranging the qudits, we get
∑
r∈Fm(k−1)q
|VD(S,R1)〉∣
∣
∣VD
[2,2k−1](D1, R2)⟩
. . .∣
∣
∣VD
[i−2,2k−1](Di−3, Ri−2)⟩
|Wi−1(Di−2, Ri−1)〉 |Di−1\{Ri−1}〉 |Ri〉
|VE(S,R1)〉 |VE(0, D1, R2)〉 . . . |VE(0, Di−1, Ri)〉
|V (0, Di, Ri+1)〉 . . . |V (0, Dk−1, Rk)〉
where Dℓ\{Rj, Rj+1, . . . , Rℓ} indicates a vector with entries
from Dℓ which are not in the matrices Rj , Rj+1, . . . , Rℓ.
Here Wℓ = [VD[ℓ,2k−1]t wℓ,k+1 wℓ,k+2 . . . wℓ,k+i−ℓ]
t for
1 ≤ ℓ ≤ i−1 where wℓ,j is a column vector of length (2k−ℓ)with one in the jth position and zeros elsewhere. Wℓ is a
(2k − ℓ)× (2k − ℓ) full-rank matrix. Clearly,
Wℓ
[
Dℓ−1
Rℓ
]
=
[
VD[ℓ,2k−1](Dℓ−1, Rℓ)Rℓ,[ℓ,i−1]
]
Now applying W−1i−1 to the state |Wi−1(Di−2, Ri−1)〉, we
obtain∑
r∈Fm(k−1)q
|VD(S,R1)〉∣
∣
∣VD
[2,2k−1](D1, R2)⟩
. . .∣
∣
∣VD
[i−2,2k−1](Di−3, Ri−2)⟩
|Di−2〉 |Ri−1〉 |Di−1\{Ri−1}〉 |Ri〉
|VE(S,R1)〉 |VE(0, D1, R2)〉 . . . |VE(0, Di−1, Ri)〉
|V (0, Di, Ri+1)〉 . . . |V (0, Dk−1, Rk)〉
Rearranging the qudits, we obtain,∑
r∈Fm(k−1)q
|VD(S,R1)〉∣
∣
∣VD
[2,2k−1](D1, R2)⟩
. . . |Wi−2(Di−3, Ri−2)〉
|Di−2\Ri−2〉 |Ri−1〉 |Di−1\{Ri−1, Ri−2}〉 |Ri〉
|VE(S,R1)〉 |VE(0, D1, R2)〉 . . . |VE(0, Di−1, Ri)〉
|V (0, Di, Ri+1)〉 . . . |V (0, Dk−1, Rk)〉
Repeating this process for (Di−3, Ri−2) through (S,R1), by
applying the inverses of Wi−2,Wi−3, . . .W1 in successive
steps to the suitable sets of qudits and rearranging, we obtain,
|S〉∑
r∈
Fm(k−1)q
|R1〉 |R2〉 . . . |Ri〉
|VE(S,R1)〉 |VE(0, D1, R2)〉 . . . |VE(0, Di−1, Ri)〉
|V (0, Di, Ri+1)〉 . . . |V (0, Dk−1, Rk)〉
The m qudits corresponding to |S〉 is still entangled with other
qudits in the system.
Since Di−1 is formed by entries from the (i− 1)th row in
[R1 R2 . . . Ri−1], we can rearrange the qudits to obtain
|S〉∑
r∈
Fm(k−1)q
∣
∣R1,Ji−1
⟩ ∣
∣R2,Ji−1
⟩
. . .∣
∣Ri−1,Ji−1
⟩
|Di−1〉 |Ri〉
|VE(S,R1)〉 |VE(0, D1, R2)〉 . . . |VE(0, Di−1, Ri)〉
|V (0, Di, Ri+1)〉 . . . |V (0, Dk−1, Rk)〉
where Jℓ = [k − 1]\{ℓ} for 1 ≤ ℓ ≤ i− 1.
Consider the (2k − ℓ)× (2k − ℓ) full-rank matrix
Pℓ =
Ik−ℓ+1 0
V[ℓ,2k−1]E
0 Ik−i
where 1 ≤ ℓ ≤ i− 1. Apply Pi−1 on |Di−1〉 |Ri〉 to obtain
|S〉∑
r∈
Fm(k−1)q
∣
∣R1,Ji−1
⟩ ∣
∣R2,Ji−1
⟩
. . .∣
∣Ri−1,Ji−1
⟩
|Di−1〉 |VE(0, Di−1, Ri)〉∣
∣Ri,[i,k−1]
⟩
|VE(S,R1)〉 |VE(0, D1, R2)〉 . . . |VE(0, Di−1, Ri)〉
|V (0, Di, Ri+1)〉 . . . |V (0, Dk−1, Rk)〉
Now, this can be rearranged to get
|S〉∑
(R1,R2,...Ri−1,Ri,[i,k−1],
Ri+1...Rk)
∈Fm(k−1)−(i−1)biq
|R1, R2, . . . , Ri−1〉∣
∣Ri,[i,k−1]
⟩
|VE(S,R1)〉 |VE(0, D1, R2)〉
. . . |VE(0, Di−2, Ri−1)〉
|V (0, Di, Ri+1)〉 . . . |V (0, Dk−1, Rk)〉∑
Ri,[1,i−1]
∈F(i−1)×biq
|VE(0, Di−1, Ri)〉 |VE(0, Di−1, Ri)〉
15
= |S〉∑
(R1,R2,...Ri−1,Ri,[i,k−1],
Ri+1...Rk)
∈Fm(k−1)−(i−1)biq
|R1, R2, . . . , Ri−1〉∣
∣Ri,[i,k−1]
⟩
|VE(S,R1)〉 |VE(0, D1, R2)〉
. . . |VE(0, Di−2, Ri−1)〉
|V (0, Di, Ri+1)〉 . . . |V (0, Dk−1, Rk)〉∑
Ti∈F(i−1)×biq
|Ti〉 |Ti〉
because the state∑
Ri,[1,i−1]
∈F(i−1)×biq
|VE(0, Di−1, Ri)〉 |VE(0, Di−1, Ri)〉
is a uniform superposition of states |Ti〉 |Ti〉 over Ti ∈
F(i−1)×biq independent of the value of Di−1 and Ri,[i,k−1].
Repeating these operations with all |Rj〉 for 1 ≤ j ≤ i− 1,
we obtain,
|S〉∑
(Ri+1...Rk)
∈F(m−ai)(k−1)q
(R1,[i,k−1],...Ri,[i,k−1])
∈F(k−i)aiq
∣
∣R1,[i,k−1], R2,[i,k−1], . . . Ri,[i,k−1]
⟩
|V (0, Di, Ri+1)〉 . . . |V (0, Dk−1, Rk)〉
∑
T1∈
F(i−1)×b1q
|T1〉 |T1〉∑
T2∈
F(i−1)×b2q
|T2〉 |T2〉 . . .∑
Ti∈
F(i−1)×biq
|Ti〉 |Ti〉
At this point the secret is completely disentangled with the
rest of the qudits and the recovery is complete.
C. Secrecy
In the scheme given by (28), the combiner can recover the
secret by accessing k parties (from case (ii) when i = k in the
proof of Lemma 9). So, by no-cloning theorem, the remaining
k− 1 parties in the scheme should have no information about
the secret. Thus, this scheme satisfies the secrecy property.
With these results in place we have our central contribution.
Theorem 3 (Staircase construction for universal CE-QTS).
The encoding given in (28) gives a ((k, n = 2k − 1, ∗))universal CE-QTS scheme with the following parameters.
q > 2k − 1 (prime)
m = lcm{1, 2, . . . , k}
w1 = w2 = . . . = wn = m
CCn(d) =dm
d− k + 1for d ∈ {k, k + 1, . . . , 2k − 1}
We can compare this universal CE-QTS scheme with the
scheme from Corollary 2. (Refer Table I.) Both give the same
values for the parameters wj/m and CCn(d)/m. Though the
scheme based on Staircase codes gives a better bound on the
dimension of the qudits, the concatenated construction could
give a smaller secret size for n < 2k − 1.
D. Discussion on communication complexity gains
In the standard ((k, n)) QTS scheme from [2], the secret
can be recovered when the combiner communicates with kparties. Here, if the secret is of size m qudits, then the number
of qudits communicated to the combiner is km qudits. The
communication cost per secret qudit is k qudits.
In the ((k, n, d)) communication efficient QTS schemes
from [12] and concatenated construction in Corollary 1, the
secret can be recovered when the combiner contacts k parties
and receiving km qudits where m = d − k + 1. This leads
to a cost of k qudits per secret qudit. However, when the
combiner contacts d parties, where d is a fixed value such that
k ≤ d ≤ n, the secret can be recovered with a communication
cost of dmd−k+1 qudits. The cost per qudit is d
d−k+1 which is
strictly less than k for d > k.
In the ((k, n, ∗)) universal QTS schemes, the secret can
be recovered by the combiner by accessing any d parties,
where the number of parties accessed given by k ≤ d ≤ ncan also be chosen by the combiner. For the chosen value
of d, the secret can be recovered by downloading dmd−k+1
qudits. The communication cost for each qudit of the secret
is dd−k+1 which is same as that of [12]. The communication
cost decreases with the increasing number of parties accessed.
(Refer Fig. 4.) However, we are able to achieve this for all
possible d using the same scheme and not fixing d a priori.
Refer Table I for a comparison of the different QTS schemes
we discussed so far. The optimality of our construction with
respect to the communication complexity will be discussed in
the next section.
∼ ∼
di
CCn(di)
0k
k ◦
k+1
k+12
◦
k+2
k+23
◦...
◦
. . .
. . .
◦
2k−1
2k−1k
◦
Fig. 4: Communication cost for d ∈ {k, k + 1, . . . , n} in
((k, n = 2k − 1, ∗)) universal CE-QTS schemes from Con-
catenated construction and Staircase construction
VI. OPTIMALITY OF CE-QTS SCHEMES
In this section, we derive lower bounds on the quantum
communication complexity of the quantum threshold schemes.
Our bounds are applicable for both universal and non-universal
communication efficient schemes. Specifically, we show that
secret recovery from a set of d shares in communication
16
efficient QTS schemes (for both fixed d and universal) requires
at least dd−k+1 qudits to be transmitted to the combiner for
each qudit in the secret. Then we show that our constructions
satisfies these bounds on communication complexity. We also
discuss the optimality of our constructions with respect to the
storage cost.
A. Lower bound on communication complexity
Bound on communication complexity for the ((k, n, d))CE-QTS was already shown in [12] for the special case
of n = 2k − 1. Here we generalize these bounds to both
((k, n, d)) and ((k, n, ∗)) QTS and also lift the restriction that
n = 2k−1. We first bound the combined size of partial shares
from d− k + 1 parties. The generalization of the result from
n = 2k − 1 to n ≤ 2k − 1 is mainly due to a difference in
our approach to prove this bound. Then we use this to prove
the bound on the communication cost i.e. the combined size
of partial shares from all d parties in a way similar to [12].
Our bounds imply that the proposed CE-QTS and universal
CE-QTS constructions for all n ≤ 2k − 1 are optimal with
respect to the communication cost. First we need the following
lemmas.
Lemma 10. [5, Theorem 5] A party having access to an
authorized set of shares in a quantum secret sharing scheme
can replace the secret encoded with any arbitrary state (of
the same dimension as the secret) without disturbing the
remaining shares. After this replacement, secret recovery from
any of the authorized sets will give only the new state.
Lemma 11. [12, Lemma 5] Even in the presence of pre-
existing entanglement between two parties, transmitting an
arbitrary quantum state from a Hilbert space of dimension
M requires a channel of dimension M .
With these two lemmas we can bound the combined size
of partial shares from d− k+1 parties in the secret recovery
from d parties.
Lemma 12. In any ((k, n)) QSS scheme, which recovers a
secret of dimension M by accessing a set of d parties, the total
communication to the combiner from any d − k + 1 parties
among the d parties is of dimension at least M .
Proof. Let S1, S2, . . . , Sn be the shares of the n parties in
the ((k, n)) QSS scheme. By Lemma 1, consider an extra
share E for the given ((k, n)) scheme such that the new QSS
scheme with n+ 1 parties thus obtained is a pure state QSS
scheme. (This pure state QSS scheme need not be a threshold
QSS scheme.) Now, we prove the lemma by means of a
communication protocol between Alice and Bob based on this
pure state QSS scheme. The objective of the protocol is for
Alice to send an arbitrary state |ψ〉 of dimension M to Bob.
First, encode the state |0〉 using the pure state QSS scheme.
Consider the set of d parties D ⊆ [n] where each participant
in D can send a part of its share to the combiner to recover
the secret. Consider any subset L ⊆ D with d− k+1 parties.
Bob is given the k− 1 shares from the parties in D\L, which
form an unauthorized set. Alice is given the d− k + 1 shares
from L, the n− d shares from [n]\D and the extra share E.
By Lemma 2, the set of shares with Alice form an authorized
set, as this set is actually a complement of the unauthorized
set with Bob.
Now, Alice replaces the secret |0〉 in the scheme with |ψ〉(by Lemma 10). Clearly, Bob has no prior information on |ψ〉even though he may share some entanglement with Alice due
to qudits he received so far.
Now, if Alice needs to transmit |ψ〉 to Bob, she needs to
transmit some of the qudits with her to Bob so that Bob can use
the secret recovery of the underlying QSS scheme to recover
|ψ〉. To achieve this, Alice can transmit to Bob the necessary
parts from the d − k + 1 shares from L (which along with
necessary parts from the k− 1 shares from D\L already with
him will give complete information about the secret). Applying
Lemma 11 here, it is implied that the communication from the
shares in L during the secret recovery from the shares in Dhas to be at least M .
Next we use Lemma 12 to obtain a lower bound on
communication complexity of d partial shares. We use the
same technique as in [12] to achieve this.
Theorem 4 (Lower bound on communication cost). In any
((k, n)) quantum secret sharing scheme, recovery of a secret
of dimension M by accessing d parties requires communi-
cation of a state from a Hilbert space of dimension at least
Md/(d−k+1) to the combiner.
Proof. Consider a set of d parties given by D ⊆ [n] accessed
by the combiner for secret recovery. For each i ∈ D, let the
part of the share transmitted by the jth party to the combiner
be denoted as Hj,D . Clearly Hj,D is a subsystem of Sj .
Without loss of generality, we take the set of parties to be
given by D = {1, 2, . . . , d} such that
dim(H1,D) ≥ dim(H2,D) ≥ . . . ≥ dim(Hd,D). (30)
Applying Lemma 12 for the partial shares
Hk,D, Hk+1,D, . . . Hd,D sent to the combiner, the overall
communication from these d− k + 1 shares is bounded as
d∏
j=k
dim(Hj,D) ≥M. (31)
Then by (30), we have
dim(Hk,D)d−k+1 ≥M
dim(Hk,D) ≥M1/(d−k+1).
This implies
dim(Hj,D) ≥M1/(d−k+1) (32)
for 1 ≤ j ≤ k. From (31) and (32), the communication to the
combiner from the d shares in D can be lower bounded as
d∏
j=1
dim(Hj,D) =
k−1∏
j=1
dim(Hj,D)
d∏
j=k
dim(Hj,D)
≥
( k−1∏
j=1
M1/(d−k+1)
)
M
=Md/d−k+1)
17
This shows that the set of d parties D must communicate
a state that is in a Hilbert space of dimension at least
Md/(d−k+1).
In the next subsection, we use this bound to evaluate the
performance of our constructions for CE-QTS schemes.
B. Optimality of the proposed schemes
The bound on the dimension of the communication cost in
Theorem 4 can be used to obtain a bound on the communica-
tion cost in terms of qudits.
Corollary 3. In a ((k, n, d)) CE-QTS scheme sharing a secret
of m qudits, the communication cost is bounded as
CCn(d) ≥dm
d− k + 1.
Proof. Let q be the dimension of each qudit in the scheme.
Clearly, the dimension of the secret M = qm. By Theorem 4,
the communication from any d shares is going to be at least
qdm
d−k+1 . Thus, the d parties need to send at least dmd−k+1 qudits
for recovering the secret.
Recall from Lemma 4 that, for any QTS scheme, the share
size is lower bounded by the size of the secret i.e. for all
1 ≤ j ≤ n
wj ≥ m.
Remark 2. ((k, n, d)) CE-QTS scheme from [12] based on
Staircase codes has optimal storage cost and optimal commu-
nication cost.
Remark 3. ((k, n, d)) CE-QTS scheme from Corollary 1
based on ramp schemes from [30] has optimal storage cost
and optimal communication cost.
Note that these bounds apply for both fixed d and universal
CE-QTS schemes.
Corollary 4. In a ((k, n, ∗)) universal CE-QTS scheme shar-
ing a secret of m qudits, for any d such that k ≤ d ≤ n, the
communication cost is bounded as
CCn(d) ≥dm
d− k + 1.
Remark 4. ((k, n, ∗)) universal CE-QTS scheme from Theo-
rem 3 based on Staircase codes has optimal storage cost and
optimal communication cost.
Remark 5. ((k, n, ∗)) universal CE-QTS scheme from Corol-
lary 2 based on ramp schemes from [30] has optimal storage
cost and optimal communication cost.
In the following section, we prove the bound on communi-
cation cost of CE-QTS schemes using a quantum information
theoretic approach.
VII. INFORMATION THEORETIC MODEL OF CE-QTS
The storage cost and the communication complexity re-
quired for secret sharing schemes can also be studied with in-
formation theory. For classical threshold schemes, such results
have been obtained in [36], [24], [27]. In this section, we will
be using quantum information theory to develop a framework
to get similar results for communication efficient quantum
threshold schemes building upon the work by Imai et al [8].
We propose a quantum information theoretic framework for
CE-QTS schemes and use this to study their communication
complexity. We refer the reader to Section II for some of the
definitions and terms.
A. Information theoretic model for quantum secret sharing
Let S be the quantum secret from the Hilbert space HS
of dimension M . Then the density matrix corresponding to Scan be defined as
ρS =
M−1∑
i=0
pi |φi〉〈φi|
where {pi} gives the probability distribution in a
measurement over some basis of orthonormal states
{|φ0〉 , |φ1〉 , . . . , |φM−1〉}. Let R be the reference system
such that the combined system SR is in pure state i.e.
S(SR) = 0. Thus, by Araki-Lieb inequality, S(R) = S(S).Let S1, S2, . . . , Sn be the quantum systems corresponding
to the n shares defined over the Hilbert spaces H1,H2, . . . ,Hn
respectively. Then the encoding of the secret is given by the
encoding map E : HS → H1 ⊗H2 ⊗ · · · ⊗Hn. A subset of ℓparties can be indicated by the set L ⊆ [n] corresponding to
their indices. The combined system of these parties are then
denoted as
SL = Si1Si2 . . . Siℓ
where L = {i1, i2, . . . , iℓ} with i1 < i2 < . . . < iℓ. Then the
density matrix of the ith party for i ∈ [n] can be written as
ρi = trS[n]\iE(ρS).
With these notations, we can define the requirements of
a quantum secret sharing scheme as quantum information
theoretical constraints.
Definition 8. A quantum secret sharing scheme for an access
structure Γ is a quantum operation which encodes the quantum
secret S into shares S1, S2, . . . , Sn where
• (Recoverability) For every authorized set A ∈ Γ,
I(R : SA) = I(R : S), (33)
• (Secrecy) For every unauthorized set B /∈ Γ,
I(R : SB) = 0. (34)
The same definition expands to QTS schemes where the
authorized set is given by A ⊆ [n] such that |A| ≥ k and the
unauthorized set is given by B ⊂ [n] such that |B| ≤ k − 1.
The following result from [8] gives a bound on the entropy of
each share.
18
Lemma 13. In any quantum secret sharing scheme realizing
an access structure Γ for any subsets of parties A and B such
that A,B /∈ Γ but A ∪ B ∈ Γ it holds that S(SA) ≥ S(S)where S is the secret being shared.
Corollary 5. In any ((k, n)) QTS scheme, the entropy of any
share Sj is bounded as
S(Sj) ≥ S(S)
where S is the secret being shared.
Proof. Take A = {j} and some B ⊆ [n]\{j} such that |B| =k − 1 in Theorem 13.
The conditions in the above definition follow from the
quantum data processing inequality. This is the same set of
conditions as defined in [8] for quantum threshold secret shar-
ing schemes. However for communication efficient quantum
threshold schemes, more conditions have to be defined for
when the combiner recovers the secret from partial shares from
d > k parties.
B. Extension of information theoretic model to CE-QTS
Let D ⊆ [n], where |D| = d, give the indices of some
d parties being accessed by the combiner for communication
efficient recovery. For each j ∈ D, consider a superoperator
πj,D acting on Sj such that the resultant state Hj,D is then
transmitted to the combiner. The density matrix for Hj,D can
be written as
σj,D = πj,D(ρj).
Here πj,D is the operator acting on Sj . Consider E ⊆ Dcorresponding to some e of these d parties. The combined
system of the partial shares sent to the combiner by these eparties is denoted as
HE,D = Hj1,DHj2,D . . . Hje,D
where E = {j1, j2, . . . , je} with j1 < j2 < . . . < je.
Clearly, the number of qudits in Hj,D is logq dim(Hj,D).Now, CCn(d) can be written as
CCn(d) = maxD⊆[n]
s.t. |D|=d
∑
j∈D
logq dim(Hj,D)
CCn(d) ≥1
log qmaxD⊆[n]
s.t. |D|=d
∑
j∈D
S(Hj,D). (35)
The inequality in (35) is from the bound on entropy given by
(7).
Similarly, the communication cost for secret recovery in a
standard ((k, n)) threshold scheme can be bounded as,
CCn(k) ≥1
log qmaxA⊆[n]
s.t. |A|=k
∑
i∈A
S(Si). (36)
Now, the following set of constraints can be included to define
the model for a communication efficient quantum threshold
scheme.
Definition 9. A ((k, n, d)) CE-QTS scheme is a quantum
operation which encodes the quantum secret S into shares
S1, S2, . . . , Sn where
• (Recoverability from k shares) For every A ⊆ [n] such
that |A| ≥ k,
I(R : SA) = I(R : S). (37)
• (Recoverability from d partial shares) For every D ⊆ [n]such that |D| = d,
I(R : HD,D) = I(R : S) (38)
• (Secrecy) For every B ⊂ [n] such that |B| < k,
I(R : SB) = 0. (39)
• (Communication efficiency)
CCn(d) < CCn(k). (40)
Definition 10. A ((k, n, ∗)) universal CE-QTS scheme is a
quantum operation which encodes the quantum secret S into
shares S1, S2, . . . , Sn where
• (Recoverability) For every D ⊆ [n] such that k ≤ |D| ≤n,
I(R : HD,D) = I(R : S) (41)
• (Secrecy) For every B ⊂ [n] such that |B| < k,
I(R : SB) = 0. (42)
• (Universal communication efficiency)
CCn(n) < CCn(n− 1) < . . . < CCn(k + 1) < CCn(k).(43)
In the above definition for universal CE-QTS, a separate
condition for the threshold of k shares is not needed as dcan be assumed to take any value from k to n. With these
definitions, we can bound the communication cost of CE-
QTS schemes (both fixed d and universal) using quantum
information theoretic inequalities. In the following theorem,
a similar bound on the entropy of partial shares sent to the
combiner has been derived. This result is then used to obtain
a bound on the communication cost.
Theorem 5. In any ((k, n)) quantum secret sharing scheme,
recovery of a secret of dimension M by accessing d parties
requires communication of a state from a Hilbert space of
dimension at least Md/(d−k+1) to the combiner.
Proof. Let D represent the indices of the d parties from
which partial shares are sent to the combiner. Clearly, D is
an authorized set. For simplicity, we will drop the second
subscript D in HE,D for any E ⊆ D and write it simply
as HE .
Choose some F ⊆ D such that |F | = d − k + 1. By
considering HD as the bipartite quantum system HD\FHF ,
(37) gives
I(R : HD\FHF ) = I(R : S)
S(HD\FHF )− S(RHD\FHF ) = S(S) − S(RS)
S(HD\FHF )− S(RHD\FHF ) = S(S) (44)
Applying the Araki-Lieb inequality to S(RHD\FHF ) gives
S(RHD\FHF ) ≥ S(RHD\F )− S(HF ).
19
Applying this in (44), we obtain
S(HD\FHF )− S(RHD\F ) + S(HF ) ≥ S(S). (45)
Since any set of k − 1 or lesser shares have no information
about the secret, any set of partial shares from k− 1 or lesser
parties have no information about the secret as well. Since
|D\F | = k − 1, it follows I(R : HD\F ) = 0. This implies
S(RHD\F ) = S(R) + S(HD\F )
Substituting this in (45) and because S(R) = S(S), we obtain
S(HD\FHF ) + S(HF )− S(HD\F ) ≥ 2 S(S). (46)
By subadditivity property, S(HD\FHF ) ≤ S(HD\F )+S(HF ).Therefore,
2S(HF ) ≥ 2S(S)
S(HF ) ≥ S(S). (47)
By subadditivity property,
S(HF ) ≤∑
j∈F
S(Hj,D)
Hence, from (47), we get∑
j∈F
S(Hj,D) ≥ S(S) (48)
This inequality holds for any of the(
dd−k+1
)
possible choices
for F ⊂ D. Now, sum the inequality (48) over all these F to
get∑
F⊂Ds.t. |F |=d−k+1
∑
j∈F
S(Hj,D) ≥∑
F⊂Ds.t. |F |=d−k+1
S(S)
(
d− 1
d− k
)
∑
j∈D
S(Hj,D) ≥
(
d
d− k + 1
)
S(S)
∑
j∈D
S(Hj,D) ≥d
d− k + 1S(S) (49)
This inequality gives a bound on sum of entropies of the partial
shares from d shares to the combiner in terms of the entropy
of the secret. This can be extended to a bound on dimensions
of these systems as follows. We know that the maximum value
for entropy of a system is related to its dimension by (7). Thus,
we obtain
∑
j∈D
log dim(Hj,D) ≥d
d− k + 1S(S)
log∏
j∈D
dim(Hj,D) ≥d
d− k + 1S(S). (50)
The state of Hj,D lies in the same Hilbert space for any state
of the secret S. Thus dim(Hj,D) remains the same for any
arbitrary secret state and the bound (50) is valid for all possible
states of the secret. Consider the secret state with the density
matrix
ρS =M−1∑
ℓ=0
1
M|φℓ〉〈φℓ| .
For this state, S(S) = logM . Hence, (50) gives
∑
j∈D
log dim(Hj,D) ≥d
d− k + 1logM
∏
j∈D
dim(Hj,D) ≥Md/(d−k+1). (51)
This concludes the proof.
The above result derived using the quantum information
theoretic framework is same as Theorem 4. This framework
can be potentially generalized to bound communication costs
and share sizes for quantum secret sharing schemes with non-
threshold access structures as well.
VIII. CONCLUSION
In this paper, we proposed new constructions for CE-QTS
schemes. We introduced the universal CE-QTS schemes and
provided optimal constructions for CE-QTS and universal CE-
QTS schemes using concatenation of ramp QSS schemes.
We also proposed another optimal construction for universal
CE-QTS schemes based on Staircase codes. We proved the
bounds on communication cost during secret recovery in CE-
QTS schemes. Finally we developed a quantum information
theoretic model to study CE-QTS schemes. A natural direction
for further study would be to extend these ideas to non-
threshold access structures. In the recent years there has been
tremendous progress in experimental realization of quantum
secret sharing schemes. Hence, it would be also interesting
to see if the dimension of the secret can be reduced while
constructing CE-QTS schemes particularly for small number
of parties.
APPENDIX A
((k = 3, n = 5, d = 5)) CE-QTS SCHEME BASED ON
STAIRCASE CODES
Consider the ((3, 5, 5)) CE-QTS scheme from the construc-
tion based on Staircase codes given in [12]. This scheme has
the following parameters.
q = 7 (52a)
m = 3 (52b)
w1 = w2 = . . . = w5 = 3 (52c)
CCn(3) = 9, CCn(5) = 5. (52d)
The encoding for the scheme is given by the mapping
|s〉 7→∑
r∈F67
|c11c12c13〉 |c21c22c23〉 |c31c32c33〉 (53)
|c41c42c43〉 |c51c52c53〉
where s = (s1, s2, s3) indicates a basis state of the quantum
secret, r = (r1, r2, . . . , r6) and cij is the (i, j)th entry of the
matrix
C = V Y.
Here the matrices V and Y are given by
V =
1 1 1 1 11 2 4 1 21 3 2 6 41 4 2 1 41 5 4 6 2
and Y =
s1 0 0
s2 0 0
s3 r1 r2r1 r3 r5r2 r4 r6
.
20
The encoded state in (53) can also be written as,
∑
r∈F67
|v1(s, r1, r2)〉 |v1(0, 0, r1, r3, r4)〉 |v1(0, 0, r2, r5, r6)〉|v2(s, r1, r2)〉 |v2(0, 0, r1, r3, r4)〉 |v2(0, 0, r2, r5, r6)〉|v3(s, r1, r2)〉 |v3(0, 0, r1, r3, r4)〉 |v3(0, 0, r2, r5, r6)〉|v4(s, r1, r2)〉 |v4(0, 0, r1, r3, r4)〉 |v4(0, 0, r2, r5, r6)〉|v5(s, r1, r2)〉 |v5(0, 0, r1, r3, r4)〉 |v5(0, 0, r2, r5, r6)〉 .
vi() indicates the polynomial evaluation given by
vi(f1, f2, f3, f4, f5) = f1 + f2.xi + f3.x2i + f4.x
3i + f5.x
4i
and the expression vi(s, r1, r2) denotes vi(s1, s2, s3, r1, r2).Here we have taken xi = i for 1 ≤ i ≤ 5.
When combiner requests k = 3 parties, each party sends
its complete share. When d = 5, the combiner downloads the
first qudit of each share from all the five parties.
A. Secret recovery for d = 5
When the combiner accesses all of the five parties, each
party sends its first qudit. Thus CCn(5) = 5. The qudits with
the combiner are given as
∑
r∈F67
|v1(s, r1, r2)〉 |v1(0, r1, r2, r3, r4)〉 |v1(0, 0, r3, r5, r6)〉|v2(s, r1, r2)〉 |v2(0, r1, r2, r3, r4)〉 |v2(0, 0, r3, r5, r6)〉|v3(s, r1, r2)〉 |v3(0, r1, r2, r3, r4)〉 |v3(0, 0, r3, r5, r6)〉|v4(s, r1, r2)〉 |v4(0, r1, r2, r3, r4)〉 |v4(0, 0, r3, r5, r6)〉|v5(s, r1, r2)〉 |v5(0, r1, r2, r3, r4)〉 |v5(0, 0, r3, r5, r6)〉
Applying the operation UV −1 on these five qudits, we obtain
|s〉∑
r∈F67
|v1(0, 0, r1, r3, r4)〉 |v1(0, 0, r2, r5, r6)〉|v2(0, 0, r1, r3, r4)〉 |v2(0, 0, r2, r5, r6)〉|v3(0, 0, r1, r3, r4)〉 |v3(0, 0, r2, r5, r6)〉|r1〉 |v4(0, 0, r1, r3, r4)〉 |v4(0, 0, r2, r5, r6)〉|r2〉 |v5(0, 0, r1, r3, r4)〉 |v5(0, 0, r2, r5, r6)〉
Here, the three qudits from the first three parties contain the
basis state of the secret. Also, these qudits are not entangled
with any of the other qudits. Thus, any arbitrary superposition
of the basis states can be recovered with the above step.
B. Secret recovery for k = 3
When the combiner accesses any three parties, the all three
qudits from each of the three parties are transmitted to the
combiner. Thus CCn(3) = 9. Assume that the combiner
accesses the first three parties. Then the qudits with the
combiner are given as
∑
r∈F67
|v1(s, r1, r2)〉 |v1(0, 0, r1, r3, r4)〉 |v1(0, 0, r2, r5, r6)〉|v2(s, r1, r2)〉 |v2(0, 0, r1, r3, r4)〉 |v2(0, 0, r2, r5, r6)〉|v3(s, r1, r2)〉 |v3(0, 0, r1, r3, r4)〉 |v3(0, 0, r2, r5, r6)〉|v4(s, r1, r2)〉 |v4(0, 0, r1, r3, r4)〉 |v4(0, 0, r2, r5, r6)〉|v5(s, r1, r2)〉 |v5(0, 0, r1, r3, r4)〉 |v5(0, 0, r2, r5, r6)〉
1) Apply the operation UK5 on the set of three second qudits
and then applying UK5 on the set of third qudits where
K5 is the inverse of V[3,5][3] , to obtain
∑
r∈F67
|v1(s, r1, r2)〉 |r1〉 |r2〉|v2(s, r1, r2)〉 |r3〉 |r5〉|v3(s, r1, r2)〉 |r4〉 |r6〉|v4(s, r1, r2)〉 |v4(0, 0, r1, r3, r4)〉 |v4(0, 0, r2, r5, r6)〉|v5(s, r1, r2)〉 |v5(0, 0, r1, r3, r4)〉 |v5(0, 0, r2, r5, r6)〉
2) Then, apply the following operators.
a) L6 |r2〉 |v1(s, r1, r2)〉 to get |r2〉 |v1(s, r1, 0)〉b) L6 |r2〉 |v2(s, r1, r2)〉 to get |r2〉 |v2(s, r1, 0)〉c) L6 |r2〉 |v3(s, r1, r2)〉 to get |r2〉 |v3(s, r1, 0)〉d) L6 |r1〉 |v1(s, r1, 0)〉 to get |r1〉 |v1(s, 0, 0)〉e) L6 |r1〉 |v2(s, r1, 0)〉 to get |r1〉 |v2(s, 0, 0)〉f) L6 |r1〉 |v3(s, r1, 0)〉 to get |r1〉 |v3(s, 0, 0)〉
Now, we obtain
∑
r∈F67
|v1(s, 0, 0)〉 |r1〉 |r2〉|v2(s, 0, 0)〉 |r3〉 |r5〉|v3(s, 0, 0)〉 |r4〉 |r6〉|v4(s, r1, r2)〉 |v4(0, 0, r1, r3, r4)〉 |v4(0, 0, r2, r5, r6)〉|v5(s, r1, r2)〉 |v5(0, 0, r1, r3, r4)〉 |v5(0, 0, r2, r5, r6)〉
3) Apply the operation UK6 on the set of three first qudits,
where K6 is the inverse of V[3][3] to obtain
|s〉∑
r∈F67
|r1〉 |r2〉|r3〉 |r5〉|r4〉 |r6〉|v4(s, r1, r2)〉 |v4(0, 0, r1, r3, r4)〉 |v4(0, 0, r2, r5, r6)〉|v5(s, r1, r2)〉 |v5(0, 0, r1, r3, r4)〉 |v5(0, 0, r2, r5, r6)〉
Here, the three first qudits from the first three parties
contain the basis state of the secret. For an equivalent
classical secret sharing scheme, the secret recovery would
have been complete at this stage. However these three
qudits are still entangled with the first qudits from fourth
and fifth parties. Thus, any arbitrary superposition of
the basis states cannot be recovered at this stage for a
quantum secret.
4) Apply the following operators to disentangle the basis
state from the rest of the qudits.
a) UK7 on |r2〉 |r5〉 |r6〉 to get
|r2〉 |v4(0, 0, r2, r5, r6)〉 |v5(0, 0, r2, r5, r6)〉 where
K7 =
[
1 0 0
V[3,5][4,5]
]
b) UK8 on |r1〉 |r3〉 |r4〉 to get
|r1〉 |v4(0, 0, r1, r3, r4)〉 |v5(0, 0, r1, r3, r4)〉 where
K8 =
[
1 0 0
V[3,5][4,5]
]
c) UK9 on |s1〉 |s2〉 |s3〉 |r1〉 |r2〉 to get
|s1〉 |s2〉 |s3〉 |v4(s, r1, r2)〉 |v5(s, r1, r2)〉 where
K9 =
1 0 0 0 0
0 1 0 0 0
0 0 1 0 0
V[4,5]
21
Now, we obtain
|s〉∑
r∈F67
|v4(s, r1, r2)〉 |v5(s, r1, r2)〉|v4(0, 0, r1, r3, r4)〉 |v4(0, 0, r2, r5, r6)〉|v5(0, 0, r1, r3, r4)〉 |v5(0, 0, r2, r5, r6)〉|v4(s, r1, r2)〉 |v4(0, 0, r1, r3, r4)〉 |v4(0, 0, r2, r5, r6)〉|v5(s, r1, r2)〉 |v5(0, 0, r1, r3, r4)〉 |v5(0, 0, r2, r5, r6)〉
= |s〉∑
(r1,r2,r3,r4,
r′5,r′6)∈F
67
|v4(s, r1, r2)〉 |v5(s, r1, r2)〉|v4(0, 0, r1, r3, r4)〉 |r
′5〉
|v5(0, 0, r1, r3, r4)〉 |r′6〉
|v4(s, r1, r2)〉 |v4(0, 0, r1, r3, r4)〉 |r′5〉
|v5(s, r1, r2)〉 |v5(0, 0, r1, r3, r4)〉 |r′6〉
(54)
= |s〉∑
(r1,r2,r′3,r
′4,
r′5,r′6)∈F
67
|v4(s, r1, r2)〉 |v5(s, r1, r2)〉|r′3〉 |r
′5〉
|r′4〉 |r′6〉
|v4(s, r1, r2)〉 |r′3〉 |r
′5〉
|v5(s, r1, r2)〉 |r′4〉 |r
′6〉
= |s〉∑
(r′1,r′2,r
′3,r
′4,
r′5,r′6)∈F
67
|r′1〉 |r′2〉
|r′3〉 |r′5〉
|r′4〉 |r′6〉
|r′1〉 |r′3〉 |r
′5〉
|r′2〉 |r′4〉 |r
′6〉
The variable change in (54) is possible because indepen-
dent of r1, r2, r3, r4, the subsystem
∑
(r5,r6)∈F27
|v4(0, 0, r2, r5, r6)〉 |v4(0, 0, r2, r5, r6)〉|v5(0, 0, r2, r5, r6)〉 |v5(0, 0, r2, r5, r6)〉
gives the uniform superposition∑
(r′5,r′6)∈F
27
|r′5〉 |r′5〉 |r
′6〉 |r
′6〉 .
The succeeding expressions are derived similarly. Now,
the secret is disentangled with the rest of the qudits.
Thus, any arbitrary superposition of the basis states can
be recovered with above steps for d = 3.
APPENDIX B
SECRET RECOVERY FOR d = 3 IN THE ((3,5,*)) UNIVERSAL
CE-QTS SCHEME FROM SECTION III
Consider the example of ((k = 3, n = 5, ∗)) universal CE-
QTS scheme in section III with the following parameters.
q = 7 (55a)
m = 3 (55b)
w1 = w2 = . . . = w5 = 3 (55c)
CC5(3) = 9, CC5(4) = 8, CC5(5) = 5. (55d)
The encoding for the scheme is given by the following
mapping
|s〉 7→∑
r∈F67
|c11c12c13〉 |c21c22c23〉 |c31c32c33〉 (56)
|c41c42c43〉 |c51c52c53〉
where s = (s1, s2, s3) indicates a basis state of the quantum
secret, r = (r1, r2, . . . , r6) and cij is the (i, j)th entry of the
matrix
C = V Y.
Here the matrices V and Y are defined as follows.
V =
1 1 1 1 11 2 4 1 21 3 2 6 41 4 2 1 41 5 4 6 2
and Y =
s1 0 0
s2 r1 0
s3 r2 r3r1 r3 r5r2 r4 r6
.
The encoded state in (56) can also be written as,
∑
r∈F67
|v1(s, r1, r2)〉 |v1(0, r1, r2, r3, r4)〉 |v1(0, 0, r3, r5, r6)〉|v2(s, r1, r2)〉 |v2(0, r1, r2, r3, r4)〉 |v2(0, 0, r3, r5, r6)〉|v3(s, r1, r2)〉 |v3(0, r1, r2, r3, r4)〉 |v3(0, 0, r3, r5, r6)〉|v4(s, r1, r2)〉 |v4(0, r1, r2, r3, r4)〉 |v4(0, 0, r3, r5, r6)〉|v5(s, r1, r2)〉 |v5(0, r1, r2, r3, r4)〉 |v5(0, 0, r3, r5, r6)〉 .
vi() indicates the polynomial evaluation given by
vi(f1, f2, f3, f4, f5) = f1 + f2.xi + f3.x2i + f4.x
3i + f5.x
4i
and the expression vi(s, r1, r2) denotes vi(s1, s2, s3, r1, r2).Here we have taken xi = i for 1 ≤ i ≤ 5.
When combiner requests d = 5 parties, they send the first
qudit from each of their shares. When d = 4, the combiner
downloads the first two qudits of each share of the four parties
contacted. When d = 3, the combiner downloads all three
qudits of the share of the three parties contacted. (For clarity,
the qudits accessible to the combiner have been highlighted in
blue in the description below.)
In the case when d = 3, each of the three contacted parties
sends all three qudits in its share.
∑
r∈F67
|v1(s, r1, r2)〉 |v1(0, r1, r2, r3, r4)〉 |v1(0, 0, r3, r5, r6)〉|v2(s, r1, r2)〉 |v2(0, r1, r2, r3, r4)〉 |v2(0, 0, r3, r5, r6)〉|v3(s, r1, r2)〉 |v3(0, r1, r2, r3, r4)〉 |v3(0, 0, r3, r5, r6)〉|v4(s, r1, r2)〉 |v4(0, r1, r2, r3, r4)〉 |v4(0, 0, r3, r5, r6)〉|v5(s, r1, r2)〉 |v5(0, r1, r2, r3, r4)〉 |v5(0, 0, r3, r5, r6)〉
1) Applying the operation UK5 on the set of three third
qudits, where K5 is the inverse of V[3,5][3] , we obtain
∑
r∈F67
|v1(s, r1, r2)〉 |v1(0, r1, r2, r3, r4)〉 |r3〉|v2(s, r1, r2)〉 |v2(0, r1, r2, r3, r4)〉 |r5〉|v3(s, r1, r2)〉 |v3(0, r1, r2, r3, r4)〉 |r6〉|v4(s, r1, r2)〉 |v4(0, r1, r2, r3, r4)〉 |v4(0, 0, r3, r5, r6)〉|v5(s, r1, r2)〉 |v5(0, r1, r2, r3, r4)〉 |v5(0, 0, r3, r5, r6)〉
2) Then, on applying the operators
L6 |r3〉 |v1(0, r1, r2, r3, r4)〉, L6 |r3〉 |v2(0, r1, r2, r3, r4)〉and L1 |r3〉 |v3(0, r1, r2, r3, r4)〉, we obtain
∑
r∈F67
|v1(s, r1, r2)〉 |v1(0, r1, r2, 0, r4)〉 |r3〉|v2(s, r1, r2)〉 |v2(0, r1, r2, 0, r4)〉 |r5〉|v3(s, r1, r2)〉 |v3(0, r1, r2, 0, r4)〉 |r6〉|v4(s, r1, r2)〉 |v4(0, r1, r2, r3, r4)〉 |v4(0, 0, r3, r5, r6)〉|v5(s, r1, r2)〉 |v5(0, r1, r2, r3, r4)〉 |v5(0, 0, r3, r5, r6)〉
3) Applying the operation UK6 on the set of three second
qudits, where K6 is the inverse of V{2,3,5}[3] , we obtain
∑
r∈F67
|v1(s, r1, r2)〉 |r1〉 |r3〉|v2(s, r1, r2)〉 |r2〉 |r5〉|v3(s, r1, r2)〉 |r4〉 |r6〉|v4(s, r1, r2)〉 |v4(0, r1, r2, r3, r4)〉 |v4(0, 0, r3, r5, r6)〉|v5(s, r1, r2)〉 |v5(0, r1, r2, r3, r4)〉 |v5(0, 0, r3, r5, r6)〉
22
4) Applying operation UK7 on the qudits |v1(s, r1, r2)〉|v2(s, r1, r2)〉 |v3(s, r1, r2)〉 |r1〉 |r2〉 where
K7 =
V[3]0 0 0 1 0
0 0 0 0 1
−1
we obtain
|s〉∑
r∈F67
|r1〉 |r3〉|r2〉 |r5〉|r4〉 |r6〉|v4(s, r1, r2)〉 |v4(0, r1, r2, r3, r4)〉 |v4(0, 0, r3, r5, r6)〉|v5(s, r1, r2)〉 |v5(0, r1, r2, r3, r4)〉 |v5(0, 0, r3, r5, r6)〉
5) After recovering the basis state of the secret, we dis-
entangle it from the rest of qudits by applying suitable
operators as follows.
a) Apply UK8 on |r3〉 |r5〉 |r6〉 to get
|r3〉 |v4(0, 0, r3, r5, r6)〉 |v5(0, 0, r3, r5, r6)〉 where
K8 =
[
1 0 0
V[3,5][4,5]
]
.
b) Apply UK9 on |r1〉 |r2〉 |r3〉 |r4〉 to get
|r1〉 |r2〉 |v4(0, r1, r2, r3, r4)〉 |v5(0, r1, r2, r3, r4)〉where
K9 =
1 0 0 0
0 1 0 0
V[2,5][4,5]
.
c) Apply UK10 on |s1〉 |s2〉 |s3〉 |r1〉 |r2〉 to get
|s1〉 |s2〉 |s3〉 |v4(s, r1, r2)〉 |v5(s, r1, r2)〉 where
K10 =
1 0 0 0 0
0 1 0 0 0
0 0 1 0 0
V[4,5]
.
Now, we obtain
|s〉∑
r∈F67
|v4(s, r1, r2)〉 |v4(0, r1, r2, r3, r4)〉|v5(s, r1, r2)〉 |v4(0, 0, r3, r5, r6)〉|v5(0, r1, r2, r3, r4)〉 |v5(0, 0, r3, r5, r6)〉|v4(s, r1, r2)〉 |v4(0, r1, r2, r3, r4)〉 |v4(0, 0, r3, r5, r6)〉|v5(s, r1, r2)〉 |v5(0, r1, r2, r3, r4)〉 |v5(0, 0, r3, r5, r6)〉
= |s〉∑
r′′∈F67
|r′′1 〉 |r′′3 〉
|r′′2 〉 |r′′5 〉
|r′′4 )〉 |r′′6 〉
|r′′1 〉 |r′′3 〉 |r
′′5 〉
|r′′2 〉 |r′′4 〉 |r
′′6 〉
where r′′ = (r′′1 , r′′2 , r
′′3 , r
′′4 , r
′′5 , r
′′6 ). Now, the secret is
disentangled with the rest of the qudits.
Thus, any arbitrary superposition of the basis states can be
recovered with above steps for d = 3.
REFERENCES
[1] M. Hillery, V. Buzek, and A. Berthaume, “Quantum secret sharing,”Phys. Rev. A, vol. 59, no. 3, pp. 1829–1834, 1999. [Online]. Available:https://journals.aps.org/pra/abstract/10.1103/PhysRevA.59.1829
[2] R. Cleve, D. Gottesman, and H.-K. Lo, “How to share a quantum secret,”Phys. Rev. Lett., vol. 83, no. 3, pp. 648–651, 1999. [Online]. Available:https://journals.aps.org/prl/abstract/10.1103/PhysRevLett.83.648
[3] A. Karlsson, M. Koashi, and N. Imoto, “Quantum entanglementfor secret sharing and secret splitting,” Phys. Rev. A,vol. 59, no. 1, p. 162, 1999. [Online]. Available:https://journals.aps.org/pra/abstract/10.1103/PhysRevA.59.162
[4] A. D. Smith, “Quantum secret sharing for general accessstructures,” e-print quant-ph/0001087, 2000. [Online]. Available:https://arxiv.org/abs/quant-ph/0001087
[5] D. Gottesman, “Theory of quantum secret sharing,” Phys.
Rev. A, vol. 61, p. 042311, 2000. [Online]. Available:https://journals.aps.org/pra/abstract/10.1103/PhysRevA.61.042311
[6] S. Bandyopadhyay, “Teleportation and secret sharing with pure entan-gled states,” Phys. Rev. A, vol. 62, p. 012308, 2000. [Online]. Available:https://journals.aps.org/pra/abstract/10.1103/PhysRevA.62.012308
[7] A. C. Nascimento, J. Mueller-Quade, and H. Imai,“Improving quantum secret-sharing schemes,” Phys. Rev.
A, vol. 64, p. 042311, 2001. [Online]. Available:https://journals.aps.org/pra/abstract/10.1103/PhysRevA.64.042311
[8] H. Imai, J. Muller-Quade, A. C. Nascimento, P. Tuyls, and A. Winter,“A quantum information theoretical model for quantum secretsharing schemes,” e-print quant-ph/0311136, 2003. [Online]. Available:https://arxiv.org/abs/quant-ph/0311136
[9] P. Sarvepalli and R. Raussendorf, “Matroids and quantum-secret-sharingschemes,” Phys. Rev. A, vol. 81, p. 052333, May 2010. [Online].Available: https://link.aps.org/doi/10.1103/PhysRevA.81.052333
[10] B. Fortescue and G. Gour, “Reducing the quantum communicationcost of quantum secret sharing,” IEEE Trans. Inform. Theory,vol. 58, no. 10, pp. 6659 – 6666, 2012. [Online]. Available:https://ieeexplore.ieee.org/abstract/document/6225432
[11] D. Markham and B. C. Sanders, “Graph states for quantum secret shar-ing,” Phys. Rev. A, vol. 78, no. 4, p. 042309, 2008. [Online]. Available:https://journals.aps.org/pra/abstract/10.1103/PhysRevA.78.042309
[12] K. Senthoor and P. K. Sarvepalli, “Communication ef-ficient quantum secret sharing,” Phys. Rev. A, vol.100, no. 5, p. 052313, 2019. [Online]. Available:https://journals.aps.org/pra/abstract/10.1103/PhysRevA.100.052313
[13] T. Tyc and B. C. Sanders, “How to share a continuous-variable quantum secret by optical interferometry,” Phys.
Rev. A, vol. 65, p. 042310, 2002. [Online]. Available:https://journals.aps.org/pra/abstract/10.1103/PhysRevA.65.042310
[14] H. Qin, W. K. Tang, and R. Tso, “Hierarchical quantum secret sharingbased on special high-dimensional entangled state,” IEEE Journal ofSelected Topics in Quantum Electronics, vol. 26, pp. 1–6, 2020. [Online].Available: https://ieeexplore.ieee.org/abstract/document/9006878
[15] W. Tittel, H. Zbinden, and N. Gisin, “Experimentaldemonstration of quantum secret sharing,” Phys. Rev.A, vol. 63, p. 042301, 2001. [Online]. Available:https://journals.aps.org/pra/abstract/10.1103/PhysRevA.63.042301
[16] L. Hao, C. Wang, and G. L. Long, “Quantum secret sharingprotocol with four state grover algorithm and its proof-of-principle experimental demonstration,” Optics Communications,vol. 284, no. 14, pp. 3639 – 3642, 2011. [Online]. Available:https://www.sciencedirect.com/science/article/pii/S0030401811003105
[17] J. Bogdanski, N. Rafiei, and M. Bourennane, “Experimentalquantum secret sharing using telecommunication fiber,” Phys.
Rev. A, vol. 78, p. 062307, 2008. [Online]. Available:https://journals.aps.org/pra/abstract/10.1103/PhysRevA.78.062307
[18] B. A. Bell, D. Markham, D. A. Herrera-Martı, A. Marin,W. J. Wadsworth, J. G. Rarity, and M. S. Tame, “Experimentaldemonstration of graph-state quantum secret sharing,” Naturecommunications, vol. 5, p. 5480, 2014. [Online]. Available:https://www.nature.com/articles/ncomms6480
[19] C. Schmid, P. Trojek, M. Bourennane, C. Kurtsiefer, M. Zukowski,and H. Weinfurter, “Experimental single qubit quantum secret sharing,”Phys. Rev. Lett., vol. 95, no. 23, p. 230505, 2005. [Online]. Available:https://journals.aps.org/prl/abstract/10.1103/PhysRevLett.95.230505
[20] S. Gaertner, C. Kurtsiefer, M. Bourennane, and H. Weinfurter,“Experimental demonstration of four-party quantum secret sharing,”Phys. Rev. Lett., vol. 98, no. 2, p. 020503, 2007. [Online]. Available:https://journals.aps.org/prl/abstract/10.1103/PhysRevLett.98.020503
[21] A. M. Lance, T. Symul, W. P. Bowen, B. C. Sanders,and P. K. Lam, “Tripartite quantum state sharing,” Phys.
Rev. Lett., vol. 92, p. 177903, Apr 2004. [Online]. Available:https://link.aps.org/doi/10.1103/PhysRevLett.92.177903
[22] K. J. Wei, H. Q. Ma, and J. H. Yang, “Experimental circularquantum secret sharing over telecom fiber network,” Optics express,vol. 21, no. 14, pp. 16 663 – 16 669, 2013. [Online]. Available:https://www.osapublishing.org/oe/abstract.cfm?uri=oe-21-14-16663
23
[23] J. Pinnell, I. Nape, M. de Oliveira, N. TabeBordbar, andA. Forbes, “Experimental demonstration of 11-dimensional 10-party quantum secret sharing,” Laser & Photonics Reviews,vol. 14, p. 2000012, July 2020. [Online]. Available:https://onlinelibrary.wiley.com/doi/abs/10.1002/lpor.202000012
[24] H. Wang and D. S. Wong, “On secret reconstructionin secret sharing schemes,” IEEE Trans. Inform. Theory,vol. 54, no. 1, pp. 473–480, 2008. [Online]. Available:https://ieeexplore.ieee.org/abstract/document/4418504
[25] R. Bitar and S. El Rouayheb, “Staircase codes for secret sharingwith optimal communication and read overheads,” in Proc. 2016 IEEE
Intl. Symposium on Information Theory, Barcelona, Spain, 2016, pp.1396–1400, extended version, arXiv:1512.02990. [Online]. Available:https://ieeexplore.ieee.org/document/7541528
[26] R. Bitar and S. E. Rouayheb, “Staircase codes for secret sharing withoptimal communication and read overheads,” IEEE Transactions on
Information Theory, vol. 64, no. 2, pp. 933–943, Feb 2018.[27] W. Huang, M. Langberg, J. Kliewet, and J. Bruck, “Communication
efficient secret sharing,” IEEE Trans. Inform. Theory, vol. 62,no. 12, pp. 7195 – 7206, 2016. [Online]. Available:https://ieeexplore.ieee.org/abstract/document/7587343
[28] W. Huang and J. Bruck, “Secret sharing with optimal decoding andrepair bandwidth,” in Proc. 2017 IEEE Intl. Symposium on Information
Theory, Aachen, Germany, 2017, pp. 1813–1817. [Online]. Available:https://ieeexplore.ieee.org/abstract/document/8006842
[29] U. Martinez-Penas, “Communication efficient and strongly secure secretsharing schemes based on algebraic geometry codes,” IEEE Trans.Inform. Theory, vol. 64, no. 6, pp. 4191 – 4206, 2018. [Online].Available: https://ieeexplore.ieee.org/abstract/document/8331930
[30] T. Ogawa, A. Sasaki, M. Iwamoto, and H. Yamamoto, “Quantumsecret sharing schemes and reversibility of quantum operations,”Phys. Rev. A, vol. 72, no. 3, p. 032318, 2005. [Online]. Available:https://journals.aps.org/pra/abstract/10.1103/PhysRevA.72.032318
[31] K. V. Rashmi and P. V. Shah N. B. and, Kumar, “Optimalexact-regenerating codes for distributed storage at the msr andmbr points via a product-matrix construction.” IEEE Trans. Inform.
Theory, vol. 57, no. 8, pp. 5227 – 5239, 2011. [Online]. Available:https://ieeexplore.ieee.org/abstract/document/5961826
[32] K. Senthoor and P. K. Sarvepalli, “Universal communication efficientquantum threshold secret sharing schemes,” in Proc. 2020 IEEE Infor-
mation Theory Workshop (ITW), Riva del Garda, Italy, 2020.[33] M. A. Nielsen and I. Chuang, Quantum computation and quantum
information. Cambridge University Press, 2000.[34] B. Schumacher and M. A. Nielsen, “Quantum data processing and error
correction,” Phys. Rev. A, vol. 54, p. 052333, October 1996. [Online].Available: https://journals.aps.org/pra/pdf/10.1103/PhysRevA.54.2629
[35] K. Senthoor and P. K. Sarvepalli, “Universal communication efficientquantum threshold secret sharing,” e-print quant-ph/2002.09229, 2020.[Online]. Available: https://arxiv.org/abs/2002.09229
[36] E. Karnin, J. Greene, and M. Hellman, “On secret sharing systems,”IEEE Trans. Inform. Theory, vol. 29, no. 1, pp. 35 – 41, 1983. [Online].Available: https://ieeexplore.ieee.org/abstract/document/1056621