Unconditional security of entanglement-based continuous-variable quantum secret sharing

The need for secrecy and security is essential in communication. Secret sharing is a conventional protocol to distribute a secret message to a group of parties, who cannot access it individually but need to cooperate in order to decode it. While several variants of this protocol have been investigated, including realizations using quantum systems, the security of quantum secret sharing schemes still remains unproven almost two decades after their original conception. Here we establish an unconditional security proof for entanglement-based continuous-variable quantum secret sharing schemes, in the limit of asymptotic keys and for an arbitrary number of players. We tackle the problem by resorting to the recently developed one-sided device-independent approach to quantum key distribution. We demonstrate theoretically the feasibility of our scheme, which can be implemented by Gaussian states and homodyne measurements, with no need for ideal single-photon sources or quantum memories. Our results contribute to validating quantum secret sharing as a viable primitive for quantum technologies.

Figure 1

The QSS secure key rate $K$, Eq. (15), is plotted against the squeezing $r$ of a three-mode noisy Gaussian cluster state, obtained from a pure state [20] ${\widehat{U}}_{AB}{\widehat{U}}_{BC}{|r\rangle }_A{|r\rangle }_B{|r\rangle }_C$, with ${\widehat{U}}_{ij}=exp\left({\mathrm{\Omega }}_{ij}{\widehat{x}}_i{\widehat{x}}_j\right)$, after Bob and Charlie's modes undergo individual pure-loss channels (i.e., quantum-limited attenuating channels), each modeled by a beam splitter with transmissivity $T$ and zero excess noise (see inset). From top to bottom, the curves correspond to $T=1,0.95,0.9,0.85$. All parties are assumed to be performing homodyne measurements of ${\widehat{x}}_i,{\widehat{p}}_i$, with $i=A,B,C$. The current experimentally accessible squeezing is limited to $r\lesssim 1.15$ (10 dB), or $\sigma \gtrsim 0.32$ [57, 58], in which regime a nonzero $K$ is still guaranteed for sufficiently large $T$, demonstrating the feasibility of our scheme.