Depeng Meng,Zhihui Li,Shuangshuang Luo,Zhaowei Han
A Kind of (t, n) Threshold Quantum Secret Sharing with Identity Authentication
quantum secret sharing,identity authentication,mutually unbiased bases,(t, n) threshold scheme
Quantum secret sharing (QSS) is an important branch of quantum cryptography. Identity authentication is a significant means to achieve information protection, which can effectively confirm the identity information of both communication parties. Due to the importance of information security, more and more communications require identity authentication. We propose a d-level threshold QSS scheme in which both sides of the communication use mutually unbiased bases for mutual identity authentication. In the secret recovery phase, the sharing of secrets that only the participant holds will not be disclosed or transmitted. Therefore, external eavesdroppers will not get any information about secrets at this phase. This protocol is more secure, effective, and practical. Security analysis shows that this scheme can effectively resist intercept–resend attacks, entangle–measure attacks, collusion attacks, and forgery attacks.
A Kind of (t, n) Threshold Quantum Secret Sharing with Identity Authentication

Quantum secret sharing (QSS) is an important branch of quantum cryptography. Identity authentication is a significant means to achieve information protection, which can effectively confirm the identity information of both communication parties. Due to the importance of information security, more and more communications require identity authentication. We propose a d-level threshold QSS scheme in which both sides of the communication use mutually unbiased bases for mutual identity authentication. In the secret recovery phase, the sharing of secrets that only the participant holds will not be disclosed or transmitted. Therefore, external eavesdroppers will not get any information about secrets at this phase. This protocol is more secure, effective, and practical. Security analysis shows that this scheme can effectively resist intercept–resend attacks, entangle–measure attacks, collusion attacks, and forgery attacks.

Secret sharing is an important research field in cryptography. It has important applications in many aspects, such as network communication, signature checking, and identity verification. In 1979, Shamir [1] proposed the first secret-sharing protocol based on Lagrange interpolation formula. With the rapid development of quantum technology, quantum secret sharing (QSS) has also made great progress. In 1999, Hillery et al. [2] proposed the first QSS protocol using the Greenberger–Horne–Zeilinger (GHZ) state. Since then, more and more relatively complete QSS protocols [3,4,5,6,7,8,9,10,11,12,13,14,15,16,17] have been proposed by scholars. Like the threshold QSS protocol [3,4,5], the secret is divided into n parts. Only n participants can cooperate to recover the secret. However, due to practical needs and consideration of flexibility, some threshold QSS protocols [6,7,8,9,10,11,12,13,14,15,16,17] have received great attention. The secret is also divided into n parts, but t participants can recover the secret and fewer than t participants cannot recover the secret. In addition, to detect the existence of external attackers and check the integrity of internal participants, some verifiable QSS protocols [11,12,13,14,15,16,17] have been proposed. They mainly include message authentication (verify the correctness of the message) and identity authentication (verify the correctness of identity). Identity authentication is a systematic process to verify the identity of legitimate users, components and devices. Therefore, it is the security guarantee of various encryption tasks. In the identity authentication scheme, the sender registers the secret information as his identity information in the receiver’s database before communication. Afterwards, the sender proves the secret identification information to the receiver, that is, his identity information. The receiver can prove that the sender is a legitimate user before establishing the communication channel by using an authentication scheme, so he avoids the occurrence of an illegal sender. In quantum cryptography, quantum secret sharing [15,16,17], quantum key distribution [18,19,20,21], quantum secure direct communication [22,23], etc., all require identity authentication. In real life, the importance of identity authentication is also reflected everywhere. In 2013, Yang et al. [3] constructed an QSS using entangled state and quantum Fourier transform (QFT). In 2015, Tavakoli [4] proposed a d-level QSS based on GHZ state and mutually unbiased bases. The above two schemes are threshold. In 2017, Song et al. [7] proposed a d-level threshold QSS based on Shamir’s secret-sharing scheme and the Lagrange interpolation formula. However, restricted by private secret shares, the scheme is infeasible. In 2020, Sutradhar et al. [8] proposed an QSS without credible participants. Nevertheless, in the actual process, the reconstructor needs to compare secrets and the hash value of secrets, so the reconstructor must be trustworthy. In 2020, Mashhadi [9] pointed out the problems in the protocol of Song et al. [7] and gave an improvement scheme. In this improved protocol, each participant applies the inverse quantum Fourier transform (IQFT) on its own particle. Then, each participant measures and publishes the measurement results. At this time, everyone can recover the original secret, but there is no identity authentication process in the transmission of quantum states, and we cannot guarantee that the corresponding operation is performed by the corresponding participant. In 2021, Hu et al. [17] proposed a dynamic QSS using GHZ state in a high-dimensional quantum system. In this protocol, each participant performs corresponding unitary operations according to its own measurement results. In this paper, we overcome the above problems. The innovation of this article is to improve [8] by combining relevant knowledge. We mainly add identity authentication content to make the protocol more secure and complete. Our protocol is a d-level threshold scheme that both parties can be mutually verified. Each participant can act as a reconstructor to recover the secret. When a participant wants to recover the secret, he can cooperate with participants in an authorized subset to obtain the secret. The direct communication parties will conduct mutual identity authentication through mutually unbiased bases. After passing the authentication, other participants use direct product operation on their own particles and auxiliary particle passed by the reconstructor. Then, the reconstructor measures the final secret after performing the IQFT. Finally, he verifies whether the correct secret is obtained by comparing the secret and the hash value of the secret published by the dealer. The rest of the article is organized as follows. In Section 2, we give the preliminary knowledge needed for this article. In Section 3, we propose a threshold quantum secret sharing scheme with identity authentication. In Section 4, we give the correctness proof of the agreement. In Section 5, we analyze the security of the protocol. In Section 6, we compare and analyze this protocol with some previous protocols. In Section 7, we give a specific example to better understand the protocol. In Section 8, we summarize the full text and draw conclusions.

In this section, we introduce some basic knowledge needed in this article, including quantum measurement, mutually unbiased bases, QFT, IQFT, and operation.

Quantum measurement can be described based on a set of measurement operators . These measurement operators satisfy the completeness equation: When the quantum state is measured, the probability that the result is i is: After measurement, the quantum state collapses as follows: Therefore, quantum measurement will change the original state of the quantum state.

Let d be an odd prime number and be a finite field. Suppose , are two sets of standard orthogonal bases on d-dimensional Hilbert space. If they satisfy: Then these two groups of bases are called mutually unbiased bases. If any two sets of bases in are mutually unbiased, V is called mutual unbiased bases set. Additionally, there are at most elements in set V. Specifically, the calculation base , , is one of them. The remaining d groups can be expressed as: where , , j represents the sequence of bases, and l represents vector sequence in a set of bases. They satisfy the following relation: Additionally, among mutually unbiased bases, the following unitary operation makes them transform each other: let We have

The QFT in the d-dimensional system can be expressed as follows: where , . Similarly, the IQFT can be expressed as: It is easy to know that both discrete QFT and discrete IQFT are unitary transformations. In addition, by We can obtain

is a two-qubit gate. In the d-dimensional system, it can be expressed as follows: where is control bit, is the target bit, .

In this section, we propose a quantum secret-sharing scheme with d-level and threshold. Participants can verify each other mutually. Dealer Alice distributes secret shares among the set of participants B = {Bob,Bob,⋯,Bob}. At least t participants can recover the secret. As the participants mutually verify, the protocol is more secure and practical. The entire scheme consists of three stages, namely the secret-sharing stage, identity authentication stage, and secret-recovery stage. The continuous identity authentication is included in the entire secret-recovery phase. Here, we use Figure 1 to briefly represent the entire process. The specific scheme of the protocol is shown below.

In this phase, The dealer Alice performs the following operations: (I) Alice selects a binary symmetric polynomial of degree in the . The degree polynomial can be defined as: where is a finite field, S is secret, d is an odd prime number, coefficients , , . (II) Alice calculates polynomials F(,y) , respectively, by (15) and sends them to the corresponding participants Bob through a secure classical channel, where is the public identity information of the corresponding participant Bob with for . (III) According to the characteristics of binary symmetric polynomials, we define the following two groups of constants: Remark 1. Here, these four values are the same. However, in the following text, different symbols have different meanings. and represent the symmetry keys during encryption and decryption. and represent one’s own identity information, used to indicate one’s identity, which can be understood as one’s own signature information. (IV) Alice chooses a one-way hash function . Then, Alice discloses the hash algorithm and hash value of the secret S.

Suppose Bob(reconstructor) wants to get the secret S. Then at least another participants need to be selected to form a qualified subset with him to jointly recover the secret S. Let us suppose B = {Bob, Bob, ⋯, Bob} is a qualified subset from all the qualified subsets. Each participant in the set has the ability to independently produce a single photon. The corresponding participant will perform the following processes to recover the secret: (I) Each participant Bob, , calculates the shadow of the share according to own polynomial and prepares computational basis state with d-level. Remark 2. Here, is the modular multiplicative inverse of the integer . According to the recent literature, this calculation has a fast calculation method. We will not expand here as readers can refer to [24]. (II) Bob applies QFT on the computational basis state and gets the result . (III) Bob again prepares computational basis state with d-level and performs operation according to and . is the control bit and is the target bit. When the operation is completed, Bob obtains the entangled state . The subscript H and T here are used to distinguish two particles. (IV) Bob and Bob mutually conduct identity authentication: Step 1. Bob prepares a d-level initial quantum state , two random numbers , , and opens . Bob performs the unitary transformation on the initial quantum state and obtains a new quantum state . Then according to own polynomial , Bob can obtain . Subsequently, Bob performs the unitary transformation on and obtains . Bob again determines a random moment . Lastly, Bob sends messages , which has been encrypted, and to Bob through secure classical channel and quantum channel, respectively. Step 2. After Bob receives the quantum state and encrypted information, he first calculates according to the own polynomial . Afterwards Bob performs the unitary transformation on and obtains . Then, Bob obtains a number pair by decrypting the received classic information. Finally, Bob uses the basis to measure to obtain the measurement result and compares with the published random number . If ; then, Bob considers that all the information comes from Bob. The identity information of Bob is authenticated. Otherwise, Bob considers that the message does not come from Bob or is destroyed in the middle of the process and terminates this agreement. Step 3. After Bob confirms that the message originated from Bob, he also prepares a d-level initial quantum state , two random numbers , , and opens . Then, Bob performs the unitary transformation on and obtains a new quantum state . Bob decides another moment and sends encrypted message to Bob. Lastly, Bob is ready to send to Bob at moment . Step 4. Bob decrypts the encrypted classical information to obtain a random number pair . After receiving the message particle from Bob at moment , Bob selects the basis to measure to obtain the measurement result and compares with the published random number . If , Bob believes that all the information comes from Bob and Bob has received an own message. So, Bob will send the auxiliary state in his own hand to Bob through the secure quantum channel at moment . The entire identity authentication process is shown in Figure 2 below: Remark 3. Here, secure quantum channel refers to a quantum channel that is not subject to external interference. That is, an authenticated quantum channel. Participants can engage in quantum direct communication. (V) After Bob receives at moment , he treats as the control bit and as the target bit. Then, Bob performs controlled black box operation on these two quantum states, where can be expressed as: U is a linear transformation and it satisfies . That is to say, is an eigenvector of U with an eigenvalue of . After performing the controlled black box operation, Bob next conducts the direct product operation of and . Then, the whole quantum state system becomes . (VI) Each participant, Bob and Bob, repeat the above mutual authentication and operation process of Bob and Bob. When Bob and Bob complete mutual authentication, Bob will send the auxiliary state in his own hand to Bob through the secure quantum channel at moment . Bob also performs a similar controlled black box operation first. Then, he performs the direct product operation on his quantum state and the whole quantum system, and so on, until the last participant Bob completes the direct product operation. At this time, the whole quantum system becomes . (VII) When Bob completes the direct product operation, Bob completes the identity authentication process with Bob in the same way. After completing the authentication operation, Bob retransmits the auxiliary state back to Bob through a secure quantum channel. After Bob receives the auxiliary state again, he performs operation on the two particles in his hand, where is control bit and is target bit. At this time, the whole quantum system becomes . (VIII) Bob uses computational basis to measure the quantum state which has been handled by the operation. If the measurement result is , Bob believes that his auxiliary particles have not been destroyed or replaced. Bob will continue to perform the following steps. Otherwise Bob has reason to believe that the auxiliary state is damaged or replaced during the transmission process, thus ending the entire agreement. (IX) Bob applies IQFT on his first quantum state and measures the output to obtain the final secret . (X) Bob calculates according to hash function released by Alice and compares it with public . If , , the secret obtained by Bob is the real secret. If not, Bob has reason to believe that there is at least one dishonest participant, thus terminating the agreement.

In this section, we show the correctness of the protocol in the secret recovery phase through two theorems. Theorem 1. The sum of t shares of participants is the secret to be recovered. Proof. According to the Lagrange interpolation formula, we have □ Theorem 2. When Bob applies the IQFT on the first quantum state in his hand and measures the output result, he could gobtain the secret S. Proof. □

In this section, we analyze the security of our scheme against quantum attacks [25,26,27,28,29].

Suppose that there is an eavesdropper, Eve, who wants to steal secret information by performing an intercept–resend attack. When Bob communicates with Bob, there will be three quantum states interacting through the quantum channel. They are , , and auxiliary state . When Eve intercepts and , she needs to obtain information by measuring, but Eve does not know the measurement basis and . If Eve arbitrarily chooses a set of bases to measure, the probability of success is when , . Therefore, the possibility of success is negligible. Even if Eve succeeds, and are also just the quantum states needed for Bob and Bob to verify their identities. These two quantum states have no information about secrets. As for auxiliary state , it is only the control bit in the secret recovery process and also has no information about secrets. Therefore, the intercept–resend attack is not successful.

In this attack, the eavesdropper Eve prepares an auxiliary state . By using unitary transformation to entangle the auxiliary state onto the transmission particle, Eve measures the auxiliary state and compares it with the original result to obtain relevant information about the secret. In our scheme, only particle is transferred between participants in the secret recovery phase. Therefore, suppose that when Bob transfers particle to Bob, Eve performs the d-level operation to entangle the auxiliary state to the particle . At this time, becomes . When Bob completes its own operation and transfers particle to Bob, Eve performs d-level operation again. Where particle is the control bit and auxiliary state is target bit. At this time, becomes . Next, Eve obtains the result e by measuring the auxiliary state particle. She concludes that the particles transmitted between participants are the same. The particle has no information about sharing the secret. She cannot obtain any information about the secret. Therefore, the entangle–measure attack is not feasible.

In the collusion attack, some collusive participants want to obtain information about others’ sharing of secrets through cooperation. Then, they can obtain the original secret. In our protocol, the sharing of secrets is calculated by each participant Bob through the own share polynomial . Each participant only knows his own share. In addition, the sharing of secrets will not be disclosed or transferred to other participants. As a consequence, it is impossible for participants to obtain the others’ sharing of secrets. So collusive attack is not feasible.

Suppose the participant Bob wants to perform a forgery attack. Then, in the identity authentication phase, to prove his identity to Bob and Bob, Bob must use the correct authentication information. He cannot use forged information, or the agreement will end early. In the secret-recovery phase, on the one hand, if Bob forges an auxiliary state and transmits it to Bob, then the measurement result of Bob in (VIII) will not be . Bob believes that the auxiliary state has been damaged and terminates the agreement in advance. On the other hand, if Bob uses his sharing of to forge a false computational basis state , Bob will get the wrong secret eventually. By comparing , Bob believes that at least one participant is dishonest and ends the agreement. Therefore, our protocol can resist forgery attacks.

In this section, we analyze the quantum resources needed by our protocol and compare it with some previous protocols. The protocol of Yang et al. [3] operates in d-dimensional space; it is a threshold scheme. The scheme needs message particles and performs n number of QFT operations and n number of measure operations. It uses fewer quantum resources, but the scheme is not flexible enough. This scheme can resist any computational attack, but it cannot resist collusion attacks. The protocol of Song et al. [7] operates in d-dimensional space, it is a threshold scheme. The secret reconstructor prepares t message particles and distributes number of them to the other participants. The reconstructor starts with an QFT. Until the other participants complete the operation, the reconstructor performs an IQFT and measures particles to obtain the secret. Finally, the reconstructor verifies it through the hash function. This protocol can resist various common attacks. However, after some calculation and analysis, due to the mutual entanglement between particles, simple IQFT cannot recover the secret. The protocol of Sutradhar et al. [8] is d level with threshold. Using the Lagrange interpolation formula, the reconstructor first applies QFT to a particle. After each participant adds its share to the whole recovery process, the reconstructor uses the IQFT to recover the secret and measures to obtain the secret. The whole secret recovery process is repeated twice using two polynomials to restore the secret and the hash value of the secret, respectively. Through this method, the reconstructor can verify the correctness of the message. However, the protocol must require a trusted reconstructor, so the protocol can not resist collusion attack and can resist other common attacks. The protocol of Mashhadi et al. [9] is an improvement to the protocol of Song et al. [7]. The protocol points out the inadequacy of its entanglement and proposes an improved scheme. Since the IQFT performed by the reconstructor cannot obtain the secret, t participants are required to perform IQFT in the entanglement system and summarize the measurement results to obtain the initial secret. Therefore, the protocol cannot resist intercept–resend attacks and collusion attacks. Our protocol is also d level with threshold. The dealer uses the binary symmetric polynomial to distribute the share polynomial. Each participant can use its own share polynomial to calculate the secret share and complete the identity authentication process. The protocol uses number of message particles to complete the mutual authentication process of both parties. Finally, the reconstructor restores the secret by performing IQFT and obtains the secret through measurement. Although our protocol uses more quantum resources, every step is necessary. The identity authentication process will make the protocol more secure and reliable. Our protocol can also resist some attacks well. The comparison of these protocols is shown in Table 1 below.

In this section, in order to better understand our protocol, we give a quantum secret sharing scheme with (4,6) threshold. In this protocol, t = 4, n = 6, d = 17, S = 2.

Alice performs the following operations: (I) Alice selects a binary symmetric polynomial of degree 3 in the . where secret S = 2. (II) Alice calculates polynomials F(,y) , respectively, by Equation (29) and sends them to the corresponding participants Bob through a secure channel, where . Here, the polynomial obtained by each Bob is: (III) According to the characteristics of binary symmetric polynomial, constants have the following relationship: . According to the selected binary symmetric polynomial and the identity information of each participant, we can obtain: (IV) Alice chooses a one-way hash function . Then, Alice discloses the hash algorithm and hash value of the secret S = 2.

Suppose Bob(reconstructor) wants to get the secret S. Bob chooses Bob, Bob, and Bob to help him recover the secret. Each participant has the ability to independently produce a single photon. (I) Each participant Bob, , calculates the shadow of the share according to the own polynomial . Similarly, = 14, = 3, = 6. Then, they separately prepare a 17-level computational basis state , , , and . (II) Bob applies QFT on the computational basis state and obtains the result . (III) Bob again prepares computational basis state with 17-levels and performs operation according to and . is the control bit and is the target bit. When the operation is completed, Bob obtains the entangled state . (IV) Bob and Bob mutually conduct identity authentication: Step 1. Bob prepares a 17-level initial quantum state , 2 random numbers = 6, = 8, and opens . Bob performs the unitary transformation on the initial quantum state and obtains a new quantum state . Then, according to the own polynomial , Bob can obtain . Subsequently, Bob performs the unitary transformation on and obtains . Bob again determines a random moment . Lastly, Bob sends message , which has been encrypted, and to Bob through secure classical channel and quantum channel, respectively. Step 2. After Bob receives the quantum state and encrypted information, he first calculates according to the own polynomial . Afterwards, Bob performs the unitary transformation on and obtains . Then, Bob obtains a number pair by decrypting the received classic information. Finally, Bob uses the basis to measure to obtain the measurement result and compares with the published random number . If , then Bob considers that all the information comes from Bob. The identity information of Bob is authenticated. Otherwise, Bob considers that the message does not come from Bob or is destroyed in the middle of the process and terminates this agreement. Step 3. After Bob confirms that the message originated from Bob, he also prepares a 17-level initial quantum state , 2 random numbers , , and opens . Then, Bob performs the unitary transformation on and obtains a new quantum state . Bob decides another moment and sends encrypted message to Bob. Lastly, Bob is ready to send to Bob at moment . Step 4. Bob decrypts the encrypted classical information to obtain a random number pair . After receiving the message particle from Bob at moment , Bob selects the basis to measure to obtain the measurement result and compares with the published random number . If , Bob believes that all the information comes from Bob and Bob has received an own message. So, Bob will send the auxiliary state in his own hand to Bob through the secure quantum channel at moment . (V) After Bob receives at moment , he treats as the control bit and as the target bit. He performs controlled black box operation on these two quantum states. After performing the controlled black box operation, Bob next conducts the direct product operation on and . Then the whole quantum state system becomes . (VI) Each participant Bob and Bob repeat the above mutual authentication and operation process of Bob and Bob. When Bob and Bob complete mutual authentication, Bob will send the auxiliary state in his own hand to Bob through the secure quantum channel at moment . Bob also performs a similar controlled black box operation first. Then, he performs the direct product operation on his quantum state and the whole quantum system, and so on, until the last participant Bob completes the direct product operation. At this time, the whole quantum system becomes . (VII) When Bob completes the direct product operation, Bob completes the identity authentication process with Bob in the same way. After completing the authentication operation, Bob retransmits the auxiliary state back to Bob through a secure quantum channel. After Bob receives the auxiliary state again, he performs a operation on the two particles in his hand, where is control bit and is target bit. At this time, the whole quantum system becomes . (VIII) Bob uses computational basis to measure the quantum state which has been handled by operation. If the measurement result is , Bob believes that his auxiliary particles have not been destroyed or replaced. Bob will continue to perform the following steps. Otherwise Bob has reason to believe that the auxiliary state is damaged or replaced during the transmission process, thus ending the entire agreement. (IX) Bob applies IQFT on his first quantum state and measures the output to obtain the final secret . (X) Bob calculates according to hash function released by Alice and compares with public . If , , the secret obtained by is the real secret. If not, has reason to believe that there is at least one dishonest participant, thus terminating the agreement.

In this article, using QFT, IQFT, mutually unbiased bases, and other relevant knowledge, we propose a quantum secret-sharing scheme that both sides of the communication can mutually verify the identity. Each participant holds his own share which will neither be disclosed nor transferred. Only at the secret-recovery stage, each participant will directly integrate his information into the whole quantum system, which avoids being stolen. Any participant has reason to recover the secret and only the reconstructor obtains the secret and is responsible for it. Since only t participants can recover the secret, the protocol is more flexible and practical. After our analysis, the protocol can resist intercept–resend attacks, entanglement–measurement attacks, collusion attacks, and forgery attacks, so it is safe enough.