Traceable Quantum Secret Sharing

AI summary

Overview

Research area: Quantum cryptography — specifically threshold quantum secret sharing (QSS) with added accountability and tracing mechanisms.

Technical level: Advanced. The paper assumes familiarity with quantum channels (CPTP maps), trace distance, quantum polynomial-time adversaries, quantum-secure hash functions, post-quantum symmetric-key encryption, and simulation-based security definitions.

Scope: The paper defines, constructs, and proves security for two traceable variants of threshold quantum secret sharing — one for honest participants who leak shares, and one for malicious participants who submit forged shares during reconstruction.

What This Paper Is About

Quantum secret sharing lets a dealer split a quantum state among m parties so that any k of them can reconstruct it, while fewer than k learn nothing. Existing schemes guarantee only correctness and confidentiality: if a participant leaks a valid share, or submits a forged share to sabotage reconstruction, the scheme offers no way to identify who did it. This paper builds the missing accountability layer, introducing two protocols — one that traces leaked quantum shares back to their owners, and one that identifies participants who submit forged shares during reconstruction, with evidence other parties can independently verify.

Key Contributions

1. Leakage-verifiable and traceable QSS (LVT-QSS). A (k, m)-threshold scheme in which each share carries a unique tag stored in an auxiliary register, and a leakage-verification mechanism attributes leaked shares held inside a black-box "reconstruction box" back to the coalition that supplied them.

2. Malicious-traceable and accountable QSS (MTA-QSS). A second scheme for the case where malicious participants deviate during reconstruction by submitting forged shares. Because the reconstruction-box abstraction no longer applies, tracing is performed directly on the auxiliary information generated during reconstruction, producing publicly verifiable compliance proofs that exclude honest parties and isolate the culprits.

3. Formal security definitions for both settings. Correctness, secrecy, tracer secrecy, traceability, and non-imputability are each defined for LVT-QSS (Definitions 2–7), and correctness, secrecy, tracer secrecy, traceability, and non-imputability for MTA-QSS (Definitions 13–14 and following, with formal versions in Appendices B and D).

4. Security proofs and noise simulations. Theorems 8–12 establish correctness, secrecy, tracer secrecy, traceability, and non-imputability for LVT-QSS, and numerical simulations under per-share depolarizing noise quantify robustness and identify verification as the dominant noise-sensitive stage.

Main Findings

• Correctness (Theorem 8): The (k, m)-threshold LVT-QSS scheme recovers the secret. Shares are evaluations of a degree-(k−1) polynomial over distinct field points with the secret embedded in one coefficient, so any k evaluations form an invertible Vandermonde system and reconstruction is a reversible linear transformation. The recovered state is negligibly close to the original.

• Secrecy (Theorem 9): For a fixed secret basis value s, the coefficient c_{k−1} = s is fixed while the remaining coefficients, including c_0 = uk, are sampled independently of s. Any unauthorized set with fewer than k members sees fewer than k evaluations of a polynomial with k−1 uniformly random coefficients, so its view is uniform and independent of the secret.

• Tracer secrecy (Theorem 10): Secrecy survives even when the tracing key is handed to an unauthorized coalition. The share registers are already independent of the secret, and the auxiliary registers hold only tracing data derived from the tracing key, local randomness, and the user key.

• Traceability (Theorem 11, informal): Assuming H is quantum-secure collision-resistant and preimage-resistant and that the symmetric-key encryption scheme satisfies the sparse-hit property with negligible parameter α_max(λ), every useful reconstruction box built from leaked shares can be traced to the coalition that created it, except with negligible probability — provided the number of sparse-hit trials is polynomially bounded in λ. The argument splits failures into verification incompleteness, hash collisions from forged tags, and sparse-hit acceptance of honest tags, then applies a union bound over polynomially many trials.

• Non-imputability (Theorem 12, informal): No honest participant can be falsely accused of leaking, except with negligible probability. A successful false accusation would yield either a preimage or a collision for H.

• Noise sensitivity: Numerical simulations under per-share depolarizing noise quantify robustness of the proposed schemes and single out the verification stage as the dominant noise-sensitive stage. Specific numerical error thresholds or fidelity values are not stated in the portion of the paper available here.

• Threshold restriction is essential: In the malicious setting the adversarial set is restricted to t < k parties. If t ≥ k, the malicious parties can reconstruct and leak the secret using only their own shares, so no nontrivial tracing guarantee is possible. The same reasoning restricts the leakage setting to coalitions smaller than the reconstruction threshold.

Methodology in Plain English

The dealer hides the secret inside a polynomial: each party receives the polynomial's value at a different point, and the secret sits in the top coefficient. Any k points determine the polynomial, so any k parties can invert the transform and recover the secret; fewer than k points leave the top coefficient completely undetermined. The shares are encoded as quantum registers, computed with a reversible Vandermonde transform so the whole procedure is a valid quantum operation.

Accountability comes from attaching two layers of encrypted metadata to each share. Each party's unique tag is encrypted under the master tracing key, and that ciphertext is in turn encrypted under a separate user key — both stored alongside the quantum share in auxiliary registers. The tags themselves are never revealed; only their hashes are published as verification keys.

To trace a leak, the tracer feeds the suspect reconstruction box the extra shares it needs, then measures the auxiliary registers the box outputs, peels off the two encryption layers with the tracing key, and recovers a candidate set of tags. A public verification step — checking each recovered tag against the published hashes and against the expected number of leaked shares f — confirms the evidence without revealing the tracing key. The security proofs reduce every way an adversary could cheat (a forged tag that verifies, an honest tag falsely accepted, a false accusation) to either breaking the hash function or triggering the sparse-hit property of the encryption scheme.

Why This Matters

Impact on research. This extends quantum secret sharing from a purely confidentiality-oriented primitive to one that carries accountability, mirroring the classical transition from secret sharing to traceable secret sharing (Goyal et al.; Boneh et al.). It opens a research direction — traceable distributed quantum cryptography — and supplies the first systematic framework, to the authors' knowledge, combining traceability with publicly verifiable accountability for quantum shares.

Real-world applications:

• Multi-institution custody of quantum keys or quantum states, where a leaked share must be attributed to a specific custodian.
• Quantum networks spanning organizations with limited mutual trust, where shares travel between sites and resale or leakage is a commercial risk.
• Distributed quantum computation, where a corrupted participant could sabotage reconstruction and accountability determines liability.
• Auditable multiparty cryptographic services that require evidence a third party or regulator can check independently.

Industry relevance. Any deployment of threshold quantum cryptography across organizational boundaries needs an answer to "who leaked this?" and "who broke the reconstruction?" — for insurance, contracting, audit, and incident response. Publicly verifiable accountability, rather than a trusted authority's private judgment, is what makes such answers usable in a dispute.

Future Directions

• Noise-tolerant verification. Since verification is identified as the dominant noise-sensitive stage, the natural next step is designing verification procedures or error-correcting layers that keep traceability intact at realistic depolarizing rates.
• Extending beyond the t < k regime. Both models require adversarial sets smaller than the threshold. Whether any meaningful partial accountability is possible once a coalition can reconstruct on its own is left open.
• Full protocol specification and proof details for MTA-QSS. The paper's formal statements, tracing experiments, and proofs are deferred to Appendices B–D; the details of the MTA reconstruction, tracing transcript, and check-key machinery are part of that deferred material.
• Moving from trusted-authority setup to distributed or dealer-free tag generation, and comparing efficiency and communication cost against existing QECC-based and entanglement-based QSS schemes.

Target Audience

Researchers in quantum cryptography and quantum information theory who already know threshold secret sharing and are comfortable with quantum-security reductions. It is also valuable for cryptographic protocol designers and security architects evaluating accountability requirements for distributed quantum systems, and for readers familiar with classical traceable secret sharing who want to see how far those ideas carry into the quantum setting. Beginners will find the security definitions and proof sketches hard going without background in quantum channels and indistinguishability arguments.

Authors’ abstract

Quantum secret sharing protects distributed quantum information against unauthorized reconstruction, yet existing schemes provide no intrinsic accountability when shares are leaked or forged. This missing capability is particularly relevant in realistic distributed settings, where compromised participants may either expose valid shares or maliciously interfere with reconstruction. Here we establish a framework for traceable quantum secret sharing under these two threat models. We introduce leakage-verifiable and traceable quantum secret sharing (LVT-QSS), which attributes leaked shares through an explicit leakage verification mechanism, and malicious-traceable and accountable quantum secret sharing (MTA-QSS), which identifies participants who submit forged shares during reconstruction. We formulate security definitions for both settings and prove that the proposed protocols satisfy the corresponding guarantees against the relevant adversaries. Numerical simulations under per-share depolarizing noise further quantify the robustness of the proposed schemes and identify verification as the dominant noise sensitive stage. These results incorporate accountability into quantum secret sharing and provide a foundation for traceable distributed quantum cryptography.