arXiv:1801.09500v1 [quant-ph] 29 Jan 2018

Communication Efficient Quantum Secret Sharing
Kaushik Senthoor

Pradeep Kiran Sarvepalli

Department of Electrical Engineering
Indian Institute of Technology Madras
Chennai 600 036, India
Email: ee15d042@ee.iitm.ac.in

Department of Electrical Engineering
Indian Institute of Technology Madras
Chennai 600 036, India
Email: pradeep@ee.iitm.ac.in

Abstract—Building upon the recent work in communication
efficient classical secret sharing schemes of Bitar and El Rouayheb, we study communication efficient quantum secret sharing
schemes. In the standard model of quantum secret sharing,
typically one is interested in minimal authorized sets for the
reconstruction of the secret. In such a setting, reconstruction
requires the communication of all the shares of the corresponding
authorized set. If we allow for non-minimal authorized sets, then
we can trade off the size of the authorized sets with the amount
of communication required for reconstruction. Based on the
staircase codes proposed by Bitar and El Rouayheb, we propose
a class of quantum threshold secret sharing schemes that are
also communication efficient. In the standard model of quantum
secret sharing, sharing a qudit using a ((k, 2k − 1)) threshold
scheme requires k qudits to be communicated to reconstruct the
secret. In the proposed schemes, we can recover the secret by
d
qudits for every qudit of the secret, where
communicating d−k+1
d ≥ k. Further, we show that these schemes are optimal.

I. I NTRODUCTION
A quantum secret sharing scheme is a protocol by which a
dealer can distribute an arbitrary secret state (in an encoded
form) among n participants so that only authorized subsets of
participants can reconstruct the secret [2], [5], [6]. The secret
can be a classical or quantum state. In this paper we only
consider the case when the secret is a quantum state. The
states distributed to the participants are called shares.
Following the distribution of the secret by the dealer, the
participants can, at a later time, recover the secret. This is the
reconstruction phase of the scheme. In reconstruction phase
it is assumed that the participants constituting the authorized
set pool their shares together and then recover the secret.
Alternatively, the participants could communicate their shares
to a third party or user, called the combiner, whose job is
to recover the secret from the data communicated to the
combiner. In this model, a metric of interest is the amount
of communication between the participants and the combiner.
The amount of communication from the participants to the
combiner is called the communication cost. Quite naturally, we
would like to minimize this cost. Furthermore, quantum secret
sharing has become experimentally viable and there are many
demonstrations, see for instance [4], [7]. However, quantum
information is still an expensive resource, and we would like to
reduce the cost of storing and transmitting it. Our results have
a direct bearing for experimental implementations of quantum
secret sharing.

In this paper we propose schemes which aim to minimize
the communication cost of quantum secret sharing schemes.
We focus on an important class of secret sharing schemes,
namely, the ((k, n)) quantum threshold schemes (QTS) where
any subset of t participants with k ≤ t ≤ n can reconstruct
the secret. The problem of communication cost in classical
secret sharing schemes was studied by many authors, [1], [8]–
[10]. However, the corresponding problem for quantum secret
sharing schemes has not been studied thus far. The closest
work related to ours appears to be that of [3] who also aimed
at reducing the communication cost in quantum secret sharing
schemes. However, there are important differences, their work
uses a combination of imperfect secret sharing schemes along
with a hybrid quantum secret sharing scheme. A hybrid QSS
scheme is one which participants have (partly or wholly)
classical shares. Our schemes in contrast are purely quantum
in that no share is classical. Furthermore, the work in [3] is
concerned with the communication cost of the secret sharing
schemes during distribution of the (encoded) secret more than
the cost during reconstruction which is our focus here.
Our contributions are as follows. Based on the staircase
codes proposed by Bitar et al, we propose a class of quantum
threshold secret sharing schemes that are also communication
efficient. In the standard model of quantum secret sharing,
sharing a qudit using a ((k, 2k −1)) threshold scheme requires
k qudits to be communicated to reconstruct the secret. In the
proposed schemes, we can recover the secret of m qudits by
dm
qudits where d ≥ k. Further, we show
communicating d−k+1
that these schemes are optimal in the given model of quantum
secret sharing.
The intuition behind the communication efficient secret
sharing schemes lies in using a nonminimal authorized set to
recover the secret. (An authorized set is said to be a minimal
authorized set if every proper subset of the authorized set is
unable to recover the secret.)
To make the discussion concrete, we consider some quantum secret sharing schemes which illustrate how communication efficiency comes into play. Consider the ((2, 3)) quantum
threshold scheme proposed by Cleve et al [2]. In this scheme,
the secretPstate s ∈ F3 is encoded into three qudits as
|si 7→ √13 2r=0 |r, s + r, 2s + ri, where Fq is finite field with
q elements. This encoding is extended to an arbitrary state
|ψi = α |0i + β |1i + γ |2i by linearity. Any single share will
not have any information about |ψi and any two shares can

collaborate to recover |ψi. In order to reconstruct the secret
we need to communicate two qudits to the combiner. We
propose an alternate ((2, 3)) quantum threshold scheme where
we can obtain better communication costs. In this scheme
(s1 , s2 ) ∈ F25 is encoded as follows.
|s1 s2 i 7→

X

r1 ,r2 ∈F5

|s1 + s2 + r1 , r1 + r2 i
|s1 + 2s2 + 4r1 , 2r1 + 4r2 i
|s1 + 3s2 + 4r1 , 3r1 + 4r2 i

(1)

where we have ignored the normalizing factors. In this case,
the secret is encoded into six qudits, equivalently each secret
qudit is encoded into three qudits as in previous scheme [2].
Each row in the above state corresponds to two qudits; the ith
row is distributed to the ith participant.
Let us look at the reconstruction of the secret from the four
qudits of the first two participants. The reconstruction steps
are similar for other choices of two participants as well. By
unitary operations on the first four qudits, we can obtain the
following global state. (Changes are indicated in bold).
|s1 + s2 + r1 , r1 i
|s1 + 2s2 + 4r1 , r2 i
|s1 + 3s2 + 4r1 , 3r1 + 4r2 i

(2)

This can be further transformed to
|s1 , r1 i
X
|s2 , r2 i
r1 ,r2 ∈F5 |s1 + 3s2 + 4r1 , 3r1 + 4r2 i

(3)

X

r1 ,r2 ∈F5

Since we have s1 , s2 , r1 , r2 , we can easily obtain the following
state
X |s1 + 3s2 + 4r1 , 3r1 + 4r2 i
|s1 i |s2 i
(4)
|s1 + 3s2 + 4r1 , 3r1 + 4r2 i
r1 ,r2 ∈F5

This does not end the reconstruction process because the secret
is still entangled with the rest of the system and we may not
be able to recover an arbirary superposition. Further steps are
required to recover the secret completely. Setting t1 = s1 +
3s2 + 4r1 and then t2 = 2t1 + 3s1 + 4s2 + 4r2 , we obtain the
following state
X
|t1 , 2t1 + 3s1 + 4s2 + 4r2 i
|s1 , s2 i
t1 ,r2 ∈F5
|t1 , 2t1 + 3s1 + 4s2 + 4r2 i
(5)
X
= |s1 , s2 i
|t1 , t2 i |t1 , t2 i .
(6)
t1 ,t2 ∈F5

At this point the secret is completely disentangled with the
rest of the qudits and the state of the remaining qudits is
independent of the secret, thereby ensuring we can recover
the secret.
Suppose now we try to recover the secret when we have
access to all three participants (they constitute a non-minimal
authorized set). We do not need to have access to all the six
qudits of the participants. Just three qudits i.e., one qudit,
specifically the first qudit, from each share will suffice. By
unitary operations on these three qudits, this can be used to
obtain,
X
|s1 , r1 + r2 i |s2 , 2r1 + 4r2 i |r1 , 3r1 + 4r2 i
(7)
r1 ,r2 ∈F5

Rewriting this we have
X
|r1 i |r1 + r2 i |2r1 + 4r2 i |3r1 + 4r2 i
|s1 i |s2 i
r1 ,r2

Once again the secret is completely disentangled from the rest
of the system and we are able to recover using only three
qudits. However, note that in this case we are able to recover
a secret of two qudits. Had we used the ((2, 3)) threshold
scheme of Cleve et al, we would have needed four qudits
even when we allow access to all the three participants.
This example demonstrates how to reduce the number of
qudits to be communicated when reconstructing the secret. The
rest of the paper is structured as follows. In Section II, we give
a construction for communication efficient quantum threshold
secret sharing schemes. In Section III we prove their optimality
with respect to communication efficiency. We conclude with
a brief discussion on possible future directions in Section IV.
II. C OMMUNICATION

EFFICIENT QUANTUM SECRET
SHARING SCHEMES

A. Background
Formally, to specify a quantum secret sharing we give the
encoding for the basis states of the secret. An encoding E
specifies a perfect quantum secret sharing scheme if it satisfies
the following constraints.
(i) Any authorized set can recover the secret.
(ii) Any unauthorized has no information about the secret.
(iii) The complement of an authorized set is unauthorized.
The last condition is only required for quantum secret sharing
schemes. To show the first condition in this paper we explictly
show that the set can recover the secret. To show the second
condition, we show that the complement of the set contains
an authorized set. Then by the no-cloning theorem the given
set cannot have any information about the secret. The last
condition is a consequence of the no-cloning theorem and is
satisfied by the threshold schemes considered in this paper. A
quantum secret sharing scheme is said to be pure if encodes
pure state secrets to global pure states.
B. Encoding for communication efficient QTS
We denote by ((k, n, d)) a quantum threshold scheme with
n participants, where any k participants can recover the secret
and d ≥ k participants can recover the secret with lower
communication cost. We assume that number of participants
is n = 2k − 1 and fewer than k cannot recover the secret. Fix
an integer k ≤ d ≤ n, and a prime q > n. The secret contains
m qudits where each qudit is q-dimensional and
m = d − k + 1.

(8)

Consider the vectors s = (s1 , s2 , ...sm ) ∈ Fm
q
m(k−1)
=
(r1 , r2 , ...rm(k−1) )
∈
Fq
. The
and r
=
vector r is further split into m vectors r 1
(r1 , r2 , ...rk−1 ), r2
=
(rk , rk+1 ..., r2(k−1) ) . . . and
r m = (r(m−1)(k−1)+1 , r(m−1)(k−1)+1 ..., rm(k−1) ). The
vector r 1 alone is further split into two vectors with its first
(k − m) values in u and the remaining (m − 1) values in v.

We denote by Vn,d a Vandermonde matrix (over Fq ) given
as




Vn,d = 


1
1
..
.

x1
x2
..
.

1

xn

. . . xd−1
1
. . . xd−1
1
..
..
.
.
. . . xd−1
1







(9)

m(k−1)

r∈Fq

Let si , rj ∈ Fq , where 1 ≤ i ≤ m and 1 ≤ j ≤ m(k − 1).
We define the following matrix M .














s1
s2
..
.
sm
r1
r2
..
.
rk−1



0

(m−1)×(m−1)

rk−m+1 rk−m+2
rk
r2(k−1)+1
rk+1
r2(k−1)+2
..
..
.
.
r2(k−1)
r3(k−1)

...
...
...
..
.
...

rk−1
r(m−1)(k−1)+1
r(m−1)(k−1)+2
..
.
rm(k−1)














vt

r2 r3 . . . rm

(10)

(11)

Consider the matrix C = Vn,d M where M is defined as in
Eq. (10). Each entry in matrix C, cij is a function of s and r.
The encoding for the basis states (s1 , . . . , sm ) ∈ Fm
q is given
by E, where
E : |s1 s2 . . . sm i 7→

X

m(k−1)

r∈Fq

2k−1
O

|ci1 ci2 . . . cim i ,

(12)

i=1

where we have omitted the normalizing factor for convenience.
The shares of the ith participant are indexed by i. The first
share contains the first m qudits, the second share contains
the next set of m qudits and so on till the (2k − 1)th share.
C. Secret recovery from d shares
Lemma 1. For the encoding scheme given in Eq. (12), we
can recover the secret from any d shares by accessing only
the first qudit in each share.
Proof. We shall prove this by giving the sequence of operations to be performed so that the d shares can recover the
secret with only d qudits. Each of the d participants sends their
first qudit to the combiner for reconstructing the secret. Let
D = {i1 , i2 , . . . , id } ⊂ {1, 2, . . . , 2k−1} be the set of d shares
chosen and E = {id+1 , id+2 , . . . , i2k−1 } be the complement
of D. Let VD and VE be the matrices containing the rows of
Vn,d corresponding to D and E respectively. Then, Eq. (12)
can be rearranged as
X
|ci1 ,1 ci2 ,1 ...cid ,1 i |cid+1 ,1 cid+2 ,1 ...ci2k−1 ,1 i
m(k−1)

r∈Fq

Since VD is a d × d Vandemonde matrix, we can apply VD−1
to the d qudits with the combiner to transform the state as
follows.
X
|s, r 1 i |VE (s, r 1 )i |V (0, rk−m+1 , r 2 )i · · ·
m(k−1)

0







· · · |V (0, rk−1 , r m )i

r∈Fq

We also represent M in a slightly compact form as follows.


 s

M =


r1

where we have highlighted (in blue) the qudits accessed by
the combiner. Now using the fact that cij is the product of ith
row of Vn,q and jth column of M and r = (r 1 , . . . , rm ), we
can rewrite this as
X
|VD (s, r 1 )i |VE (s, r 1 )i |V (0, rk−m+1 , r 2 )i · · ·

|(ci1 ,2 ci2 ,2 ...ci2k−1 ,2 )...(ci1 ,m ci2 ,m ...ci2k−1 ,m )i ,

· · · |V (0, rk−1 , r m )i

Then from Eq. (10) we have r 1 = (u, v), and rk−m+j = vj
for 1 ≤ j ≤ m − 1, we can write
X
X
|si
|ui |vi |VE (s, u, v)i |V (0, v1 , r 2 )i · · ·
(v,r 2 ,r 3 ,..rm ) u∈Fk−m
q
∈Fqk(m−1)

· · · |V (0, vm−1 , r m )i

Since the combiner has access to |si, |ui, and |vi, we can
transform the |ui to |VE (s, u, v)i.
X
X
|si
|VE (s, u, v)i |vi |VE (s, u, v)i
(v,r 2 ,r 3 ,..rm ) u∈Fq k−m
∈Fq k(m−1)

|V (0, v1 , r 2 )i · · · |V (0, vm−1 , r m )i

Rearranging qudits |vi |VE (s, u, v)i to |VE (s, u, v)i |vi,
!
X
X
|si
|VE (s, u, v)i |VE (s, u, v)i |vi
(v,r 2 ,r 3 ,..rm )
∈Fq k(m−1)

u∈Fk−m
q

|V (0, v1 , r2 )i · · · |V (0, vm−1 , r m )i

Since E is of size (2k − 1 − d), with Eq. (8), we see that
VE is a Vandermonde matrix of size (k − m) × d and rank
k−m
k
and
P− m < d. Therefore, the image of VE spans Fq
k−m |VE (s, u, v)i |VE (s, u, v)i is independent of s. The
u∈Fq
state can be written as
X
X
|si
|f i |f i
|vi |V (0, v1 , r 2 )i
f ∈Fq k−m

(v,r 2 ,r3 ,..rm )
∈Fq k(m−1)

. . . |V (0, vm−1 , r m )i

The secret is now completely disentangled from the rest of
the system, therefore even when the secret is an arbitrary
superposition we can recover the secret from d shares as
claimed.
D. Secret recovery from k shares
Lemma 2. For the encoding scheme given in Eq. (12), we
can recover the secret by accessing (all) the qudits of any k
shares.
Proof. For secret recovery from k shares, all the qudits
from each chosen share are sent to the user. Let K =
{j1 , j2 , . . . , jk } ⊂ {1, 2, . . . , 2k − 1} be the set of k shares
chosen and L = {jk+1 , jk+2 , . . . , j2k−1 } be the complement
of K. Let VK and VL be the matrices containing the rows of
Vn,d corresponding to K and L respectively. Then, grouping

the (ith) qudits of K and L, the encoded state in Eq. (12) can
be written as
X
|cj1 ,1 cj2 ,1 . . . cjk ,1 i · · · |cj1 ,m cj2 ,m . . . cjk ,m i
m(k−1)

|cjk+1 ,1 cjk+2 ,1 . . . cj2k−1 ,1 i

r∈Fq

We now modify each of the registers |r i i, for 2 ≤ i ≤ m to
|VL (0, rk−m+i−1 , ri )i.
X
|si
|r 1 i |VL (0, rk−m+1 , r2 ) . . . VL (0, rk−1 , r m )i
r∈Fq m(k−1)

|VL (0, rk−m+1 , r 2 ) . . . VL (0, rk−1 , rm )i

· · · |cjk+1 ,m cjk+2 ,m · · · cj2k−1 ,m i
This can be written in terms of VK and VL as
X
|VK (s, r 1 )i |VK (0, rk−m+1 , r 2 )i · · ·
m(k−1)

r∈Fq

|VK (0, rk−1 , r m )i
|VL (s, r1 )i |VL (0, rk−m+1 , r 2 )i · · ·
|VL (0, rk−1 , r m )i

Letting VK,ℓ be the submatrix of VK consisting of the last k
columns. Then we can simplify the state as
X
|VK (s, r 1 )i |VK,ℓ (rk−m+1 , r 2 )i ... |VK,ℓ (rk−1 , rm )i
m(k−1)

r∈Fq

|VL (s, r1 )i |VL (0, rk−m+1 , r 2 )i ... |VL (0, rk−1 , rm )i

Since VK,ℓ is a k × k Vandermonde matrix, we can further
transform the state as
X
|VK (s, r 1 )i |rk−m+1 , r2 i ... |rk−1 , r m i |VL (s, r 1 )i
m(k−1)

r∈Fq

|VL (0, rk−m+1 , r2 )i ... |VL (0, rk−1 , r m )i

Then from Eq. (10) we have r1 = (u, v), and rk−m+j = vj
for 1 ≤ j ≤ m − 1, and rearranging the qudits, we can write
the state as
X
|VK (s, u, v)i |vi |r2 , r3 , . . . r m i |VL (s, u, v)i
m(k−1)

r∈Fq

|VL (0, rk−m+1 , r 2 )i · · · |VL (0, rk−1 , r m )i

Let VK,f be the first k columns of VK and VK,f¯ be the
submatrix of remaining columns. Note that VK,f¯ has m − 1
columns. Then VK (s, u, v) = VK,f (s, u) + VK,f¯(v). At this
point the combiner has access to |hi and using the above
relation we can modify the state as
X
|VK (s, u, 0)i |vi |r 2 , r 3 , . . . r m i |VL (s, u, v)i

|VL (s, r 1 )i

On rearranging the qudits, we obtain
X
|si
|r 1 i |VL (s, r 1 )i
r 1 ∈Fq k−1X
|VL (0, rk−m+1 , r 2 )i |VL (0, rk−m+1 , r 2 )i
..
r 2 ∈Fq k−1
.
X
|VL (0, rk−1 , r m )i |VL (0, rk−1 , r m )i
rm ∈Fq k−1

Now VL is a Vandermonde matrix of size (k − 1) × d with
d
P> k−1. So the image of VL is of dimension k−1. Therefore
|VL (0, rk−m+i−1 , r i )i |VL (0, rk−m+i−1 , r i )i is a
ri ∈Fk−1
q
uniform superposition independent of rk−m+i−1 , for 2 ≤ i ≤
m.
X
|si
|r 1 i |VL (s, r 1 )i
X
X
r 1 ∈Fq k−1
|f 2 i |f 2 i . . .
|f m i |f m i
f2 ∈Fq k−1

fm ∈Fq k−1

P
|VL (s, r 1 )i is a
Now we can argue again that
r i ∈Fk−1
q
uniform superposition independent of s.
X
X
|si
|f 1 i |f 1 i · · ·
|f m i |f m i
f1 ∈Fq k−1

fm ∈Fq k−1

At this point the state is as follows with the secret completely
disentangled from the rest of the system and we can recover
any arbitrary superposition. This completes the proof that k
shares can recover the secret.
E. Secrecy
Lemma 3. In the encoding scheme defined in Eq. (12), any
k − 1 or lesser number of shares do not give any information
about the secret |si.

m(k−1)

r∈Fq

|VL (0, rk−m+1 , r 2 )i · · · |VL (0, rk−1 , rm )i

Then using the fact VK (s, u, 0) = VK,f (s, u) we obtain
X
|VK,f (s, u)i |vi |r 2 , r3 , . . . r m i |VL (s, u, v)i
m(k−1)

r∈Fq

|VL (0, rk−m+1 , r 2 )i · · · |VL (0, rk−1 , r m )i

As VK,f is k×k Vandermonde matrix we can further transform
the state to extract |si as shown below.
X
|si |ui |vi |r 2 , r 3 , . . . r m i |VL (s, u, v)i
r∈Fq m(k−1)

= |si

X

r∈Fq m(k−1)

|VL (0, rk−m+1 , r2 )i · · · |VL (0, rk−1 , r m )i

|r 1 i |r 2 , r3 , . . . r m i |VL (s, r 1 )i
|VL (0, rk−m+1 , r2 )i · · · |VL (0, rk−1 , rm )i

Proof. The encoding scheme is a pure state encoding scheme
with the total number of shares n = 2k − 1. If some set
of k − 1 or lesser number of shares give any information
about the secret, then the secret cannot be recovered from
the remaining k or more number of shares, because of the
no-cloning theorem. However, from lemma 2, any k shares
are enough to recover the secret completely. Hence, no set of
k − 1 (or lesser number of) shares give any information about
the secret.
Note that Lemma 3 implies that the complement of an
authorized set for the proposed scheme is unauthorized. With
these results in place we can make the following claim.
Theorem 1 (Communication efficient QSS). The encoding
given in Eq. (12) gives rise to a ((k, 2k − 1, d)) quantum
secret sharing scheme where k ≤ d ≤ 2k − 1 is a fixed

integer. The scheme shares a secret of m = d − k + 1 qudits.
The communication cost for any k participants to recover the
secret is mk qudits, while the communication cost for any d
participants is d qudits.
A standard ((k, 2k − 1)) QTS will incur a communication
cost of km qudits to share m qudits. A subtle point to be
noted is that the communication efficient scheme requires the
dealer to share a larger secret.
An ((k, 2k − 1)) QTS can be converted to ((k, n)) QTS for
k ≤ n ≤ 2k − 1 by throwing away or ignoring 2k − 1 − n
shares of the ((k, 2k − 1)) scheme, [2, Theorem 1]. If n <
2k − 1, then the scheme is a mixed state scheme. Therefore,
Theorem 1 implies the existence of ((k, n, d)) quantum secret
sharing schemes where k ≤ n ≤ 2k − 1. Note that a ((k, n))
QTS cannot exist for n ≥ 2k by [2, Theorem 2].
III. O PTIMALITY OF

THE PROPOSED SCHEMES

In this section we will show that the secret sharing schemes
we proposed are optimal with respect to the communication
cost. First we need the following result due to Gottesman [5].
Lemma 4. [5, Theorem 5] Even in the presence of preexisting entanglement, sending an arbitrary state from a
Hilbert space of dimension h requires a channel of dimension
h.
We are now ready to prove some lower bounds on the
communication cost for a ((k, n, d)) quantum secret sharing
scheme. Our proof builds on the ideas of Gottesman [5] and
Huang et al [9].
Theorem 2 (Lower bounds on communication cost). In any
((k, 2k − 1, d)) quantum secret sharing scheme, recovery of
a secret of dimension M from d shares requires communication of a state from a Hilbert space of dimension at least
M d/(d−k+1) .
Proof. Consider any set of d participants which can recover
the secret. Suppose the share of the ith participant is Si and
it communicates Hi to the combiner. (Note that Hi need not
be the entire share.) Let dim(Hi ) denote the dimension of the
quantum channel required to transmit Hi . Order the shares,
relabelling if necessary, so that dim(H1 ) ≥ dim(H2 ) ≥
· · · ≥ dim(Hd ). Our goal is to obtain a lower bound on
Q
d
i=1 dim(Hi ).
Suppose Alice has the shares Si for k ≤ i ≤ 2k − 1 while
Bob has the shares Si for 1 ≤ i ≤ k − 1. Since Alice has k
shares she can reconstruct the secret. Now Bob has no information about the secret and by Lemma 4, Alice must communicate aQstate in a Hilbert space of size at least M . This implies
d
that i=k dim(Hi ) ≥ M . Because dim(Hi ) ≥ dim(Hi+1 )
Qd
Qd
for 1 ≤ i ≤ d − 1, i=k dim(Hk ) ≥
i=k dim(Hi ) ≥
M . Therefore dim(Hk ) ≥ M 1/(d−k+1) This implies that
dim(Hi ) Q
≥ M 1/(d−k+1) for
1 ≤ i ≤ k
1. Therefore
Qk−1
Q−
d
d
we have i=1 dim(Hi ) = i=1 dim(Hi ) i=k dim(Hi ) ≥
Qk−1
( i=1 M 1/(d−k+1) )M = M d/(d−k+1) . This shows that the

participants must communicate a state that is in a Hilbert space
as large as M d/(d−k+1) .
Corollary 1. A ((k, 2k − 1, d)) quatum secret sharing scheme
dm
sharing m qudits incurs a communication cost of ≥ d−k+1
qudits.
The following corollary on the optimality of the proposed
schemes with respect to the communication cost is immediate
from the previous results.
Corollary 2. The ((k, 2k − 1, d)) quantum secret sharing
scheme of Theorem 1 has optimal communication cost (for
fixed d).
IV. C ONCLUSION
In this paper we have proposed communication efficient
quantum secret sharing schemes and demonstrated their optimality with respect to communication cost. We have only
discussed the case where the number of participants contacted
is fixed. It is natural to study secret sharing schemes that are
efficient with variable d as studied classically in [1]. Another
direction for research is that of general access structures. These
will be explored elsewhere.
R EFERENCES
[1] R. Bitar and S. El Rouayheb. Staircase codes for secret sharing with
optimal communication and read overheads. In Proc. 2016 IEEE Intl.
Symposium on Information Theory, Barcelona, Spain, pages 1396–1400,
2016. Extended version, arXiv:1512.02990.
[2] R. Cleve, D. Gottesman, and H.-K. Lo. How to share a quantum secret.
Phys. Rev. Lett., 83(3):648–651, 1999.
[3] B. Fortescue and G. Gour. Reducing the quantum communication cost
of quantum secret sharing. IEEE Trans. Inform. Theory, 58(10):6659 –
6666, 2012.
[4] S. Gaertner, C. Kurtsiefer, M. Bourennane, and H. Weinfurter. Experimental demonstration of four-party quantum secret sharing. Phys. Rev.
Lett., 98(020503), 2002.
[5] D. Gottesman. Theory of quantum secret sharing. Phys. Rev. A,
61(042311), 2000.
[6] M. Hillery, V. Buzek, and A. Berthaume. Quantum secret sharing. Phys.
Rev. A, 59(3):1829–1834, 1999.
[7] W. Tittel, H. Zbinden, and N. Gisin. Experimental demonstration of
quantum secret sharing. Phys. Rev. A, 63(0423013), 2001.
[8] Huang W., and J. Bruck. Secret sharing with optimal decoding and repair
bandwidth. In Proc. 2017 IEEE Intl. Symposium on Information Theory,
Aachen, Germany, pages 1813–1817, 2017.
[9] Huang W., M. Langberg, J. Kliewet, and J. Bruck. Communication
efficient secret sharing. IEEE Trans. Inform. Theory, 62(12):7195 –
7206, 2016.
[10] H. Wang and D. S. Wong. On secret reconstruction in secret sharing
schemes. IEEE Trans. Inform. Theory, 54(1):473–480, 2008.

