Quantum secret sharing without entanglement

Transcription

1 Quantum seret sharing without entanglement Guo-Ping Guo, Guang-Can Guo Key Laboratory of Quantum Information, University of Siene and Tehnology of China, Chinese Aademy of Sienes, Hefei, Anhui, P.R.China, After analysing the main quantum seret sharing protool based on the entanglement states, we propose an idea to diretly enode the qubit of quantum key distributions, and then present a quantum seret sharing sheme where only produt states are employed. As entanglement, espeially the inaessable multi-entangled state, is not neessary in the present quantum seret sharing protool, it may be more appliable when the number of the parties of seret sharing is large. Its theoreti effiieny is also doubled to approah 100%. PACS number(s): Hk, I. INTRODUCTION Suppose the president of a bank, Alie, wants to give aess to a vault to two vie presidents, Bob and Charlie, who are not entirely trusted. Instead of giving the ombination to any one individual, it may be desirable to distribute information in suh a way that no vie president alone has any knowledge of the ombination, but both of them an jointly determine the ombination. Classial ryptography provides an answer whih is known as seret sharing [1]. Alie reates two oded messages and one of them is sent to Bob and the other to Charlie. Eah of the enrypted message ontains no information about her original message, but together they ontain the omplete message. However, either a fourth party or the dishonest member of the Bob-Charlie pair gains aess to both of Alie s transmissions an learn the ontents of her message in this lassial proedure. Quantum seret sharing protools have been proposed to aomplish this work seurely [2 4,?] where multi-photon entanglement is employed. Reently, many kinds quantum seret sharing with entanglement have been proposed [6 9]. As the quantum key distribution and lassial sharing protool an be used straightforward to aomplish seret sharing safely, the aim of the quantum seret sharing protools is to allow one to determine whether an eavesdropper has been ative during the seret sharing and redue the resoures neessary to implement suh multi-party seret sharing tasks [2,6]. But the effiieny of those quantum seret sharing protools using entanglement an only approah 50% in priniple, the lak of the multi-parties entanglement also holds their experimental implementation. The effiieny of preparing even tripartite or four-partite entangled states is very low [10,11]. There is another thing that should be noted in this quantum seret sharing sheme with GHZ states. It uses the orrelation of the measurement value of the three qubits of the GHZ state [2]: σ b x = σ b y = σ b y = σ b x = 1,where σj i means the measurements value ±1 of qubit i along basis j with i = a, b, and Eletroni address: harryguo@mail.ust.edu.n Eletroni address: gguo@ust.edu.n 1

2 j = x, y, z. So only the ases that even of the three qubits are measured along the y diretion are kept to share seret in this sheme and its theory effiieny is only 50%. In the seurity analysis of the ase that Bob eavesdrops both qubits b and, the authors assume that he measures them jointly in the ( 00 ± 11 ) / 2or ( 00 ±i 11 ) / 2basis. But we find if Bob measures qubits b and separately (measures qubits b and in produt states ), he an heat and get Alie s seret without being deteted. For example, suppose Bob measures the qubits b and in the produt basis σy b σ y, he an thus infer Alie s value if she measures in the basis σx. a ThenBobansendaqubitinarbitrarystatetoCharlie. In the proedure of announing basis, Bob tries to announe his diretion after Charlie and heats his announement to let Alie keep the hoose that she has measured his partile in the basis σx. a Different from the eavesdropping analysis in the paper [2], this eavesdropping will not introdue a higher than usual failure rate. For example, if Charlie announes that he has hosen his measurement in the basis σx, Bob an announe that his measurement is also in the basis σx b. Then if Alie also makes her measurement in the basis σa x, she will believe that there is orrelation between those three man s measurement value and keep this measurement value as seret. But Bob has suessfully eavesdrop this seret value. Although Bob has hanged the state of qubit sending to Charlie, he an heat again in the hek proedure if Charlie announes his hek bit before Bob and then esapes detetion. For example, when he had measured the qubits b and in the produt basis suh as σy b σ y, Bob an infer that if Alie measures her partile in the basis σx a will gets the value +1. When Charlie that his measurement is 1, Bob an announes that his measurement is also 1. Then no error will our in this hek proedure. Thus Bob suessfully eavesdrops the seret without being deteted by Alie and Charlie. It means that if one party (say Bob) an reveal his diretions and values after the other party (say Charlie), he is able to disover Alie s seret bit value, without any assistane from Charlie, and esape being deteted. The feature of this eavesdropping is that Bob diretly measures qubits b and in produt basis to learn Alie s value. He heats in the basis announing proedure and hek proedure again. Bob needn t know Alie measurement diretion, but he an let Alie only keep the measurements he desired by announing his diretion aording to Charlie s measurement diretion. Then this eavesdropping is more powerful than those having been analyzed in the paper [2]. In order to detet this kind of eavesdropping, Alie should randomly require one party to reveal his diretions before the other one, sometimes Bob before Charlie, sometimes Charlie before Bob. And in the hek proedure, she also randomly requires one party to reveal his value before the other. This random an ensure the seurity of this quantum seret sharing protool based on GHZ state orrelation. It has also been pointed out in the paper [6], Alie and Bob an prevent this eavesdropping by releasing the outomes for the hek bits before the announement of their measurement diretions. We an see that the paper [6] introdue the EPR state orrelations to split the seret. The effiieny of those quantum seret sharing protools with entanglement an only reah 50% in priniple. In this paper, we propose the idea to diretly enode the qubits of quantum key distributions lassially and present a quantum seret sharing sheme employing produt states to ahieve the aim mentioned above. Its seurity is based on the quantum no-loning theory just as the BB84 quantum key distribution. Comparing with the effiieny 50% limiting for the existing quantum seret sharing protools with quantum entanglement, the present sheme an be 100% effiient in priniple. It has been pointed out in the paper [2,6] that the quantum key distribution an aomplish the task of seret sharing, the resoures neessary an be muh smaller with our present protool although it is very simple and alike the BB84 quantum key distribution sheme. Our emphasis is that the lassially enoding the qubits of quantum key distributions simply may be more eonomial than the idea of the paper [6] to use EPR states orrelations to split seret. This may suggests that the introdue of entanglement into the quantum seret sharing may be unworthiness. 2

3 II. EFFICIENCY QUANTUM SECRET SHARING WITHOUT ENTANGLEMENT Now we present a quantum seret sharing protool where no entanglement is employed. Its essene is to enode the soures of two BB84 key distribution shemes. The partiular proess of this quantum seret sharing is as follows: 1. Alie reates two random n-bit string L and A. ForeahbitofL and A, she reates a two-qubit produt state b in the basis ( if the orresponding bit of L is 0) or the basis (if the bit of L is 1) where the XOR result of the two qubits b and equals to the bit value of the string A. The two-qubit vetors of the basis and are S1( αβ b )= { 00 b, 10 b, 01 b, 11 b } and S2( α β b ) = { ++ b, + b, + b, b } respetively where + = 1 2 ( ) and = 1 2 ( 0 1 ). Table 1 summarizes the oding two-qubit states in the orresponding basis. For example, if the bits of L and A are 1 and 0 respetively, then the two-qubit state Alie prepared an be ++ b or b eah with 50% probability. But she knows exatly whih pair he prepares. 2. Alie sends the resulting two strings B and C to Bob and Charlie separately. It should be emphasized that every bit of the two strings B and C are orresponding and their XOR result equals to the orresponding bit of the string A. 3. When both Bob and Charlie have announed the reeiving of their strings B and C, Alie announes the string L. 4. Bob and Charlie then measure eah qubit of their string in the basis or aording to the orresponding bit value of string L. 5. In the hek proedure, Bob and Charlie are required to announe the values of their hek bits. If Alie finds too few of these values agree, they abort this round of operation and restart from the first step. 6. The rest unheked bits of strings A, B and C an be used as raw keys for seret sharing. Alie s seret enrypted by her keys an only be derypted by Bob and Charlie when they ooperate with eah other. Obviously, the qubits b and need not be sent out simultaneously in this quantum seret sharing sheme. Alie an send them separately to Bob and Charlie. They an hold their strings until Alie wants them to extrat out her information and announes her the string L. It is virtually a ombination of two modified BB84 quantum key distribution protools, Alie to Bob and Alie to Charlie, where the states Alie sent out have been lassially enoded so that her keys are shared in the strings B and C. Either of them an learn nothing about Alie s keys without the ooperation of the other one. Furthermore, this seret sharing protool is almost 100% effiient as all the keys an be used in the ideal ase of no eavesdropping, while the quantum seret sharing protools with entanglement states [2] an be at most 50% effiient in priniple. However, in this proedure of making measurements after the announement of bases, quantum memory is required to store the qubits whih has been shown available in the present experimental tehnique [12]. Adjusting the measurements order in the similar way the BB84 quantum key distribution protool an also double its effiieny of to nearly 100% [13]. When no quantum memory is employed, Bob and Charlie measure their qubits before Alie s announement of basis in our protool, the effiieny of the present protool falls to 50%. As the present sheme is more effiient than employing two BB 84 proedures, one between Alie and Bob and the other between Alie and Charlie, whih has been briefly disussed in the referenes [2,6], it allows the possible eavesdropper, who obtains both of the partiles that Alie sent, to gain more information than the two-bb-84 sheme, when the qubits b and are sent simultaneously. Suppose an eavesdropper, Eve, obtains both of the partiles that Alie sent, and measures them in the Bell basis. Then when the two qubits b and are measured in the state Φ = 1 2 ( ), Eve an infers that the seret is 1. Andiftheyinthestate Ψ + = 1 2 ( ), he knows that the seret is 0. But we 3

4 an prevent this kind of information leakage ausing by the jointed measurements, either by sending the two qubit un-synhronously or by enoding the two qubit as Table 2. Then in the same seurity degree, the present protool is double effiient as the two-bb-84 sheme. III. EAVESDROPPING AND GENERALIZATION TO THE MULTI-PARTY SECRET SHARING In this quantum seret sharing sheme, only produt states are employed and one annot get any information about the value of one qubit from measurement on the other qubit. In fat it is exatly two independent BB84 quantum key distribution protools, whih has been proved seurity generally [14,15]. The only differene is that the qubits Alie sent out have been lassial enoded. Obviously, any eavesdropping on individual quantum hannel for example Alie to Charlie will get nothing useful and will unavoidably introdue errors. Now suppose an adversary ( who ould also be either Bob or Charlie) eavesdrops the qubits b and jointly. His objet is to extrat out Alie s information without any assistane from Charlie in a way that annot be deteted. But what ever he does, if Bob eavesdrops qubit, Alie will find some error in the hek proedure although Bob ould heat again in this hek proedure. Then the seurity for the present quantum seret sharing is guaranteed. The generalization of this quantum seret sharing sheme to multi-parties is straightforward.. For eah bit of L and A, Alie an reates an N-qubit produt state b 1 b 2...b N in the basis ( if the orresponding bit of L is 0) or the basis (if the bit of L is 1) where the XOR result of the N qubits b 1,b 2...b N equals to the bit value of the string A. The two-qubit vetors of the basis and are S1( α 1 α 2...α N 12...N )={ N, N,..., N } and S2( α 1 α 2...α N 12...N ) = { N, N,..., N }. Obviously, if there are odd numbers 1 in α 1 α 2...α N 12...N ( in α 1 α 2...α N 12...N ), the bit value of A is 1. The ase of even numbers 1 stands for 0. The following steps are the same as the above two-party sharing ase. As no entanglement, espeially inaessible multiparties entangled states, are required, it may be more experimentally realizable than the original one [2]. Finally, let us disuss the resoures neessary to implement this quantum seret sharing protool. In the most obvious way of sharing seret, Alie first must establish mutual keys among different pairs of parties, and then use quantum ryptographi protools to send eah of the bit strings whih result from the lassial proedure. While in our seret sharing protool of diret enoding the qubits of the two BB84 quantum key distribution, one the key has been established, Alie needs to send only one string of lassial bits to either Bob or Charlie. Then in order to share a lassial bit(bit) information between two parties, Bob and Charlie, quantum ryptography as BB84 protool ideally needs 2 qubits, 2 bit and no ebit on average. The quantum seret sharing with EPR states needs 4 qubits, 1bit and 2ebits. While our protool with produt states needs only 2 qubits, 1bit and no ebit. In general, the more parts into whih the seret is split, the greater the differene between the number of lassial bits whih be sent in those two ways. We see the diret enoding to the soure qubits is able to at as a substitute for transmitted random bits. Furthermore, the effiieny of the existing entangled-state sheme an only reah 50% in priniple while the present seret sharing protool an be 100% effiient. IV. CONCLUSION In this paper, we analyze the main quantum seret sharing protool based on the GHZstate and propose a quantum seret sharing sheme where only produt states are employed. 4

5 As entanglement, espeially the inaessible multi-party entangled state, is not neessary in the present quantum seret sharing protool, it may be more appliable when the number of the parties of seret sharing is large. Its theoreti effiieny is also doubled to approah 100%. Although those quantum seret sharing with entanglement an be a demonstrator of onepts of various entanglement appliations, the inherent effiieny limiting of these protools and the differene for the preparation of multi-party entanglement may suggest that the employing of the quantum entanglement in quantum seret sharing be unworthiness in some ases. After all the pratiality is an important pursuit of the quantum information theory. This work was funded by National Fundamental Researh Program(2001CB309300), National Natural Siene Foundation of China, the Innovation funds from Chinese Aademy of Sienes, and also by the outstanding Ph. D thesis award and the CAS s talented sientist award entitled to Luming Duan. [1] B. Shneier, Applied Cryptograhy (Wiley, New York, 1996) p. 70; see also J. Gruska, Foundations of Computing (Thomson Computer Press, London, 1997) p [2] M. Hillery, V. Buzek, and A. Berthiaume, Phys. Rev. A 59, 1829 (1999). [3] W. Tittel, H. Zbinden, and N. Gisin, Phys. Rev. A 63, (2001). [4] D. Gottesman, Phys. Rev. A 61, (2000). [5] A. C. A. Nasimento, J. M. Quade, and H. Imai, Phys. Rev. A 64, (2002). [6] A. Karlsson, M. Koashi, and N. Imoto, Phys. Rev. A 59, 162 (1999). [7] R. Cleve, D. Gottesman, and H. K. Lo, Phys. Rev. Lett. 83, 648 (1999). [8] V. Karimipour, A. Bahraminasab, and S. Bagherinezhad, Phys. Rev. A 65, (2002). [9] S. Bagherinezhad, and V. Karimipour, quant-ph/ [10] D. Bouwmeester et al., Phys. Rev. Lett. 82, 1345 (1999). [11] J. W. Pan et al., Phys. Rev. Lett. 86, 4435 (2001). [12] G. C. Guo, and G. G. Guo, quant-ph/ [13] C. H. Bennett, and G. Brassard, Advanes in Cryptology: Proeedings of Ctypto84, August 5

6 1984, Springer-Verlag, p.475. [14] P. W. Shor, and J. Preskill, Phys. Rev. Lett. 85, 441 (2000). [15] N. J. Cerf, M. Bourennane, A. Karlsson, and N. Gisin, Phys. Rev. Lett. 88, (2002). 6