带身份认证的的高效量子秘密共享方案

High-efficient Quantum Secret Sharing with IdentityCertification*SUN Ying(孙莹)1**, WEN Qiao-Yan(温巧燕) 1, ZHU Fu-Chen(朱甫臣) 21School of Science, Beijing University of Posts and Telecommunications, Beijing 1008762National Laboratory for Modern Communications, P.O. Box 810, Chengdu 610041**Email: 2005amanda@We present a high-efficient quantum secret sharing (QSS) scheme with identity certification using two-particle maximum entangled pairs. The identity sequences and one-way hash functions are shared beforehand for avoiding wasting particles while establishing the shared key. And all particles are transmitted for only one time in the quantum channels. We consider that the scheme is optimal as both the intrinsic efficiency for qubits and the total efficiency approach maximum.Key words: quantum secret sharing, quantum cryptography, identity certification PACS: 03.67.Hk, 03.67.Dd, 03.65.UdQSS is one of the useful tools in the cryptographic applications. Suppose Trent wants his two agents, Alice and Bob, who are at remote places to deal with his business. However Trent doubts that one of them may be dishonest and he does not know who the dishonest one is, but he knows that the number of dishonest persons is less than two. To prevent the dishonest man from destroying the business, classical cryptography provides the secret sharing scheme in which Trent splits his secret*Supposed by the National High Technology Research and Development Program of China, Grant No. 2006AA01Z419; the National Natural Science Foundation of China, Grants Nos. 90604023, 60373059; the National Research Foundation for the Doctoral Program of Higher Education of China, Grant No. 20040013007; the National Laboratory for Modern Communications Science Foundation of China, Grant No. 9140C1101010601; the Natural Science Foundation of Beijing.message (M T ) into two sequences (M A and M B ) and sends them to Alice and Bob, respectively. Alice and Bob can read out the message B T A M M M =⊕only when theycooperate. In quantum information, the task can be completed by quantum secret sharing (QSS). Both classical information and quantum information can be shared with quantum mechanics. In this paper, we only consider the issue of sharing the classical secret information.The first QSS scheme proposed by Hillery, Bužek, and Berthiaume (hereafter we refer to HBB protocol) used a three-particle entangled Greenberger-Horne-Zeilinger (GHZ) state [1]. Although this scheme elegantly showed the essence of QSS, it is hard to realize experimentally because of the inefficiency as regards the generation of a three-particle entangled state [2]. Several variations and theoretical expansions of QSS have been reported since the publication of this pioneering work [3-15]. Among them, schemes based on two-particle entangled states [3, 4, 12, 13] have better experimental feasibility with optical setups than ones based on three-particle entangled states. However, the schemes based on two-particle entangled states do not always have satisfying efficiency. In the KKI protocol [3], for example, only half of the data obtained by expensive quantum communication can be used at most. It’s meaningful enough to improve the efficiency without loss of security. In this paper, we proposed a novel QSS scheme with identity certification and one-way transmission used two-particle maximum entangled states. In this scheme, Trent shares two secret identity sequences with Alice and Bob, respectively, before they start the protocol. We repeatedly employ the identity sequences encrypted by one-way hash functions to control the measurement basis (MB). So there are no particles wasted in the random base choosing process. Furthermore, all instances are transmitted through the quantum channel only once which means fewer particles is wasted in channel noisy. In other words, we can obtain an optimal efficiency in our QSS scheme.The paper is outlined as follows: First, we briefly review two complete orthogonal basis sets in the two-particle quantum system and the one-way hash function. Then, we give the details of the high-efficient QSS scheme with identity certification, and discuss the security of the scheme against eavesdropping. At last, we give a conclusion.There are two nonorthogonal basis sets of two-particle entangled states involved in this paper. First, we show two complete orthogonal basis sets in (1) ~ (4) and (5) ~ (8), respectively. Every state is expressed in both z direction base {},z z +− andx direction base {,x x +−as follows,))|||||||||AB A B A B A B A B z z z z x x x x φ+〉=+〉+〉+−〉−〉=+〉+〉+−〉−〉;(1)))|||||||||AB A B A B A B A B z z z z x x x x φ−〉=+〉+〉−−〉−〉=+〉−〉+−〉+〉;(2)))|||||||||AB A B A B A B A B z z z z x x x x ψ+〉=+〉−〉+−〉+〉=+〉+〉−−〉−〉;(3)))|||||||||AB A B A B A B A B z z z z x x x x ψ−〉=+〉−〉−−〉+〉=−〉+〉−+〉−〉;(4))))|||||||||||AB AB AB A B A B A B A B x z x z z x z x φψ++−Φ〉≡〉+〉=−〉+〉++〉−〉=+〉+〉−−〉−〉;(5))))|||||||||||AB AB AB A B A B A B A B x z x z z x z x φψ−−+Φ〉≡〉+〉=+〉−〉−−〉+〉=+〉−〉−−〉+〉;(6))))|||||||||||ABAB AB A B A B A B A B x z x z z x z x φψ+−+Ψ〉≡〉−〉=+〉+〉+−〉−〉=+〉+〉+−〉−〉.(7))))|||||||||||ABAB AB A B A B A B A B x z x z z x z x φψ−+−Ψ〉≡〉−〉=+〉+〉−−〉−〉=+〉−〉+−〉+〉. (8) where z + and z − denote the spin eigenstates, or equivalently the horizontal and vertical polarization eigenstates, and the subscripts A and B denote the two particles respectively.In order to simplify the security analysis later on, we use the same set of states {},,,φψ−+−+ΦΨ in our scheme as in KKI protocol [3]. The crucial feature of the four states we want to point out can be expressed as |φψ−+=|−+ΦΨ=0 and 2|ψ++Ψ=2|φ+−Ψ=2|ψ−+Φ=2|φ−−Φ=1/2. In this scheme, the boss Trentappears to switch randomly between {},φψ−+and {},−+ΦΨ, which is not the fact.In our scheme, either of the agents shares a prior identity sequence and k one-way hash functions which need to be kept secret with the boss Trent. We can make use of the standard BB84 protocol for sharing identity sequences and hash functions before the first round of secret sharing. Generally, hash functions are used to do message integrity checks and digital signatures in various information security applications. Here we use the one-way hash functions for keeping the identity sequences secret during the transmission and also relaxing the restriction on length of the identity sequences. If any participant has detected eavesdropping during the protocol, only hash functions have to be replaced. In our scheme, the one-way hash function has the following form:{}{}{}*:0,10,10,1l h ×→m （9）where the asterisk represents the input length of the hash function which is an arbitrary number, l represents the length of a counter, and m represents the outputlength of the hash function which is a fixed number. The functions (),Alice Alice Alice h Base C and are used to encrypt Alice’s and Bob’s identity sequences, where (,Bob Bob Bob h Base C ))(Alice Bob C represents the counter of calls on Alice or Bob’s hash function.Now let us describe the high-efficient QSS scheme with identity certification, whose essence has been narrated above. Instead of letting all participants make a measurement on the entangled particles in different bases randomly [1, 3], we let each participant choose the right basis under the control of the hash value of his own identity sequence. The particular process of this scheme is detailed as follows:1. Trent agrees on the hash function to be used and the value of the counter with Alice and Bob, respectively. According to the chosen hash function and the value of the counter, he computes the hash value of two agents’ identity sequences (suppose the length of the hash value is m ).2. If the length of the secret message is L , Trent prepares mN (1L N m ⎡⎤=+⎢⎥⎣⎦－１) two-particle maximum entangled states as follows:1) If the i th bits of the hash value of two agents’ identity sequences are identical, Trent will prepare one of the four sates {},φψ−+ randomly. Otherwise he will go to next step.2) If the i th bits of the hash value of two agents’ identity sequences are nonidentical, Trent will prepare one of the four sates {},−+ΦΨ randomly.3) Trent repeats step1) and 2) for N times until mN two-particle maximum entangled states have been completed.We denote the sequences comprised of two entangled particles in each pair with and , respectively. Both of and are divided into N blocks, denoted withA SB S A S B S []12,,,A A A AN S S S S =" and []12,,,B B B BN S S S S =", respectively. We can see that each of the blocks contains m particles.3. Trent generates 2mn decoy photons each of which is randomly in one of the four states {,,,z z x x +−+−. He divides the sequence comprised of decoy photons into 2n blocks each of which contains m particles. Denote the first n blocks as sequence and the second n blocks as sequence . Then Trent respectively inserts and in the sequences 1d S 2d S 1d S 2d S []12,,,A A A S S S "N and []12,,,B B BN S S S ".Through the quantum channels, He respectively sends the new sequences denoted as 1d AS and to Alice and Bob. 2d B S 4. After receiving the particles sent by Trent, Alice and Bob choose the measurement basis according to their own hash value as follows:1) If the i th bit of the hash value of the identity sequence is 0, Alice (Bob) chooses the X-basis to measure the i th particle of each block. Otherwise she or he turns to the next step.2) If the i th bit of the hash value of the identity sequence is 1, Alice (Bob) chooses the Z-basis to measure the i th particle of each block. They record the measurement results as 00z +→, 01z −→, 10x +→, 11x −→.5. Eavesdropping Checking. Alice and Bob tell Trent that they have completed themeasurement on 1d AS and , respectively, through the classical channels. Trent announces the positions of the decoy sequences and , and the initial state of every decoy photon. Alice and Bob compare their measurement results with the initial states announced by Trent. The result is valuable if and only if the measurement basis consists with the basis of the decoy photon. If Alice (Bob) finds the error rate of the measurement results of the decoy photons is too high, she (he) asks Trent to abort this protocol. When Trent decides to start the protocol again, he turns to step 5. Otherwise they will terminate the protocol. If both Alice and Bob affirm their error rates are reasonable, they turn to step 6.2d B S 1d S 2d S ′5′. Trent notifies two agents to change the employed hash functions and the value of their counters. Turn to the step 2.6. Identity Certification. Alice (Bob) transforms the hash value of the identity sequence to quantum states according bit as follows: 0x →+ or x −; 1z →+ or z −The new quantum sequence is denoted as .()A B ID S Then Alice (Bob) generates ()1m n ′− decoy photons randomly in one of the four states {,,,z z x x +−+−. Put every m decoy photons in a sequence and denote the()1n ′− sequences formed as ()()()()121,,,A B A B A Bd d d n S S S ′′′′−⎡⎤⎣⎦". Alice (Bob) inserts()A B ID S into randomly, and sends the new sequence to Trent.()()()()121,,,A B A B A B d d d n S S S ′′′′−⎡⎣"⎤⎦Trent measures groups of quantum states sent by Alice (Bob) and records the measurement results. He chooses the measurement basis according to the hash value of Alice (Bob)’s identity sequence as follows:n ′1) If the i th bit of the hash value is 0, he chooses the X-basis to measure the i th particle of each block. Otherwise she or he turns to the next step.2) If the i th bit of the hash value of the identity sequence is 1, he chooses the Z-basis to measure the i th particle of each block. The measurement results are recorded according to:z + or 0x +→, z − or 1.x −→After receiving and measuring all the particles sent by the agents, Trent asks them to announce the initial states of all the decoy photons and the positions of A ID S and B ID S . Trent compares his measurement results with the initial statesannounced by the agents. Trent’s measurement result is valuable if and only if the measurement basis is consist with the basis of the decoy photon. If the error rate is too high, Trent asks Alice and Bob to repeat the step 6. Otherwise, Trent asks Alice and Bob to announce the initial states of the particles in A ID S and B ID S , respectively, as follows:z + or 0x +→; z − or 1.x −→Trent compares his measurement results with the value announced by Alice (Bob). If not all the bits are identical, Trent considers Alice (Bob) as an illegal agent and terminates the protocol. Go to step 7 if and only if both Alice and Bob have passed identity certification.7. Secret Sharing. In our scheme, only Trent knows both the initial states of the entangled pairs generated by himself and the hash values of two agents’ identity sequences. Therefore Trent can deduce the classical bit sequences used to record Alice and Bob’s measurement results in step 4. Then he builds the secret key used to encrypt the sharing message by doing XOR operation on the two classical bit sequences.For example, suppose that the k th (1k m ≤≤) bits of the hash values of two agents’ identity sequences are 1 and 0, respectively, and the initial state of the k th entangled pair prepared by Trent is )+|||+||AB A B A B x z x z Ψ〉=+〉+〉−〉−〉. Trent can deduce that Alice and Bob’s measurement results of the same position are 10 and 00, or 11 and 01. The values after a XOR operation on the two results are both 10 in two cases.If the quantum channels are noisy, Trent and two agents can estimate the channel bit error rate from step 5. In order to obtain the shared key with high fidelity and eliminate Eve’s information about the shared key, Trent is advised to apply error correction and privacy amplification to the rude key with Alice and Bob before he encrypts his secret.Our scheme can be regarded as secure. Suppose there is an eavesdropper, say Eve, who wants to extract out Trent’s secret message in a way that cannot be detected. It will be seen that this goal can never be achieved after the following discussion.Above all, the agents’ identity sequences are used repeatedly after encrypted by hash functions. If Eve can get the agents’ identity sequences and the hash functions which are used for every time, he can attain the secret which Trent wants to share with the agents and vice versa. So we only consider the security of the agents’ identity sequences.The effect of the hash value of every agent’s identity sequence is similar to the basis sequence in Refs. [7, 16-20]. As discussed in Refs. [16, 17], the basis sequence can be used repeatedly without loss of security. In Refs. [7, 16-20], they abort the protocol once they detect the eavesdropping and share a new basis sequence for distributing the key again. However, in this paper, we only need to replace the hash function and the new output will work for a new round of secret sharing. The identity sequence and hash functions shared by Trent and one agent are kept secret to any third party including the other agent. So the sequence used to control the measurement basis is new to any third party for every round. Eve has to introduce remarkable errors due to his eavesdropping for every time. Therefore, we can conclude that any attacker cannot get information about the agents’ identity sequences.The security of using two-particle quantum entanglement in QSS has been discussed by Karlsson, Koashi and Imoto in Refs. [3]. In this paper, the particle of a two-particle entangled state sent to an agent seems to be a random state in {,,,z z x x+−+−for the other agent and any other attacker. Therefore, the discussion in Refs. [3] can also be adapted here with considering the secrecy of identity sequences and hash functions which have been proved to be security.Then let us discuss the step of identity certification in this paper. If the agent is not the right one Trent wants to share his secret, in the step of identity certification, Trent will detect the illegal agent. Because the illegal agent doesn’t have the correct identity sequence, he has to randomly guess the basis about every photon which will be sent to Trent for authentication. The error rate will be as high as 25%. The details are shown in Table I.Table I. Illegal agent has to introduce remarkable errorsWe have shown a high-efficient QSS scheme using two-particle quantum entanglement and reusable identity sequences in this paper. This scheme inherits high-efficiency of the QKD protocols using reusable basis sequence without loss of security [16-20]. The three participants share some prior information for avoiding wasting particles while establishing a shared key. Comparing with the former QSS protocols, the theoretic efficiency for qubits of this scheme is improved to approach 100% as almost all the instances can be used for generating a shared key and any particle is transmitted in the quantum channel for only one time. Moreover, each quantum entangled pair can build 2 bits of shared key without quantum storage.References[1] Hillery M, Buzěk V, Berthiaume A 1999 Phys. Rev. A59 1829[2] Bouwmeester D, Pan Jian-Wei, Daniell M, et al. 1999 Phys. Rev. Lett.82 1345[3] Karlsson A, Koashi M, Imoto N 1999 Phys. Rev. A59 162[4] Tittel W, Zbinden H, Gisin N 2001 Phys. Rev. A63 042301[5] Bagherinezhad S, Karimipour V 2003 Phys. Rev. A67 044302[6] Hsu Li-Yi 2003 Phys. Rev. A68 022306[7] Xiao Li, Long Gui-Lu, Deng Du-Guo, et al. 2004 Phys. Rev. A 69 052307[8] Kumar Singh S, and Srikanth R 2005 Phys. Rev. A71 012328 .[9] Zhang Zhan-Jun, Li Yong, Man Zhong-Xiao 2005 Phys. Rev. A71 044301[10] Schmid C, Trojek P, Bourennane M, et al. 2005 Phys. Rev. Lett.95 230505[11] Yan Feng-Li, Gao Ting 2005 Phys. Rev. A72 012304[12] Zhang Zhan-Jun, Man Zhong-Xiao 2005 Phys. Rev. A72 022303[13] Deng Fu-Guo, Li Xi-Han, Li Chun-Yan, et al. 2006 /abs/quant-ph/0602160v2/[14] Gordon G, Rigolin G 2006 Phys. Rev. A 73 062316[15] Takesue H, Inoue K 2006 Phys. Rev. A 74 012304[16] Hwang W Y, Koh I G, Han Y D 1998 Phys. Lett. A244489[17] Hwang W Y, Koh I G, Han Y D 2003 Phys. Rev. A 67 0123042[18] Deng Fu-Guo, Long Gui-Lu 2003 Phys. Rev. A 68 042315[19] Wen Kai, Long Gui-Lu 2005 Phys. Rev. A72 022336[20] Wen Kai, Deng Fu-Guo, Long Gui-Lu 2007 /abs/0706.3791/。