Computing on quantum shared secrets

A ($k,n$)-threshold secret-sharing scheme allows for a string to be split into $n$ shares in such a way that any subset of at least $k$ shares suffices to recover the secret string, but such that any subset of at most $k-1$ shares contains no information about the secret. Quantum secret-sharing schemes extend this idea to the sharing of quantum states. Here we propose a method of performing computation securely on quantum shared secrets. We introduce a ($n,n$)-quantum secret sharing scheme together with a set of algorithms that allow quantum circuits to be evaluated securely on the shared secret without the need to decode the secret. We consider a multipartite setting, with each participant holding a share of the secret. We show that if there exists at least one honest participant, no group of dishonest participants can recover any information about the shared secret, independent of their deviations from the algorithm.

Figure 1

The upper portion of the figure shows the secret and the magic states, located on the first column, and shaded red and green, respectively. The unshaded qubits are initialized in the maximally mixed state. The unitaries $U_1,\cdots ,U_N$ spread the states from qubits in the first column to qubits in the remaining columns, such that the encoded secret resides in the first $s$ rows of qubits. Each party receives a single column of qubits.

Figure 2

The secret qubits are shaded red and the others in green. (a) Multipartite implementation of a logical Clifford gate $G$ on the $x\mathrm{th}$ row. (b) Multipartite implementation of a logical cnot operator. (c) A logical gate teleportation protocol that implements a logical $T$ gate on the $j\mathrm{th}$ logical qubit without the Clifford correction. Collectively, the qubits on the subsequently measured row are initialized in a logical magic state. Correction proceeds by broadcasting the measurement outcomes, and having each party apply a single Clifford gate $SX$ on the $j\mathrm{th}$ qubit only when $\mathbf{m}$ has odd parity.