Continuous-variable ramp quantum secret sharing with Gaussian states and operations

TL;DR

This paper develops a framework for continuous-variable ramp quantum secret sharing using Gaussian states, introduces a certification procedure via quantum interactive proofs, and quantifies information leakage through quantum mutual information.

Contribution

It formulates a new continuous-variable ramp quantum secret sharing protocol with a certification method and derives a formula for quantum mutual information to assess security.

Findings

Certification procedure for ramp quantum secret sharing schemes

Expression for quantum mutual information in terms of squeezing

Quantification of information leakage in the scheme

Abstract

Our aim is to formulate continuous-variable quantum secret sharing as a continuous-variable ramp quantum secret sharing protocol, provide a certification procedure for it and explain the criteria for the certification. Here we introduce a technique for certifying continuous-variable ramp quantum secret-sharing schemes in the framework of quantum interactive-proof systems. We devise pseudocodes in order to represent the sequence of steps taken to solve the certification problem. Furthermore, we derive the expression for quantum mutual information between the quantum secret extracted by any multi-player structure and the share held by the referee corresponding to the Tyc-Rowe-Sanders continuous-variable quantum secret-sharing scheme. We solve by converting the Tyc-Rowe-Sanders position representation for the state into a Wigner function from which the covariance matrix can be found, then insert the covariance matrix into the standard formula for continuous-variable quantum mutual information to obtain quantum mutual information in terms of squeezing. Our quantum mutual information result quantifies the leakage of the ramp quantum secret-sharing schemes.

Equations

$$\text{HW}(n)⋊\text{Sp}\left(2n,\mathbb{R}\right),$$

$${\mathcal{H}}^{\otimes n}=\underset{\begin{array}{c}k=1\end{array}}{\overset{k=n}{⨂}}{\mathcal{H}}_k\sim {\mathcal{L}}^2\left({\mathbb{R}}^n\right),$$

$$\hat{\mathbf{x}}:=({\hat{q}}_1,{\hat{p}}_1,...,{\hat{q}}_n,{\hat{p}}_n{)}^{\top }$$

$$\left[{\hat{\mathbf{x}}}_i,{\hat{\mathbf{x}}}_j\right]={\Omega }_{ij},\mathbf{\Omega }=\underset{k=1}{\overset{n}{⨁}}\left(\begin{array}{cc}0& 1\\ -1& 0\end{array}\right),$$

$$\rho \in \mathcal{S}(\mathcal{H}),$$

$$W\left(\mathbf{x}\right)=\frac{1}{(2\pi {)}^{2n}}{\int }_{{\mathbb{R}}^{2n}}{\text{d}}^{2n}\mathbf{\xi }\exp \left(-\text{i}{\mathbf{x}}^{\top }\mathbf{\xi }\right)\chi \left(\mathbf{\xi }\right)$$

$$\chi (\mathbf{\xi }):=\mathrm{tr}\left[\rho \hat{D}(\mathbf{\xi })\right],$$

$$\hat{D}\left(\mathbf{\xi }\right):=\exp \left(\text{i}{\mathbf{x}}^{\top }\mathbf{\xi }\right),\mathbf{\xi }\in {\mathbb{R}}^{2n}$$

$$\mathrm{tr}\left[\rho S\left({\hat{q}}^b{\hat{p}}^d\right)\right]=\int \text{d}q\text{d}pW\left(\mathbf{x}\right)q^b{p}^d.$$

$$V_{ij}:=\frac{1}{2}\mathrm{tr}\left[\{\mathbf{\Delta }{\hat{\mathbf{x}}}_i,\mathbf{\Delta }{\hat{\mathbf{x}}}_j\}\right],\mathbf{\Delta }{\hat{\mathbf{x}}}_i:={\hat{\mathbf{x}}}_i-\mathrm{tr}\left({\hat{\mathbf{x}}}_i\rho \right),i,j\in \{1,\dots ,2n\},$$

$${\mathbf{S}\mathbf{\Omega }\mathbf{S}}^{\top }=\mathbf{\Omega }.$$

$$\mathbf{V}=\mathbf{S}\left[\underset{k=1}{\overset{n}{⨁}}{\nu }_k{\mathbf{I}}_k\right]{\mathbf{S}}^{\top },$$

$$\mathbf{\nu }:=\left({\nu }_1,\dots ,{\nu }_n\right)$$

$$\prod _{k=1}^n{\nu }_k^2=\det \mathbf{V}.$$

$$\mathbf{V}=\left(\begin{array}{cc}\mathbf{A}& \mathbf{C}\\ \mathbf{C}& \mathbf{B}\end{array}\right);\mathbf{A}={\mathbf{A}}^{\top },\mathbf{B}={\mathbf{B}}^{\top },\mathbf{C}\in {\mathbb{R}}^{2\times 2}.$$

$${\nu }_{\pm }=\sqrt{\frac{\Delta \pm \sqrt{{\Delta }^2-4\det \mathbf{V}}}{2}},$$

$$\Delta :=\det \mathbf{A}+\det \mathbf{B}+2\det \mathbf{C}.$$

$$\left(\mathbf{S},\mathbf{d}\right):\mathbf{S}\hat{\mathbf{x}}+\mathbf{d},\mathbf{d}\in {\mathbb{R}}^{2n},$$

$$\bar{\mathbf{x}}\mapsto \mathbf{S}\bar{\mathbf{x}}+\mathbf{d},\mathbf{V}\mapsto \mathbf{S}\mathbf{V}{\mathbf{S}}^{\top }.$$

$$S_1={\text{e}}^{\frac{1}{2}\left({\zeta }^{\star }{\hat{a}}^2-\zeta {\hat{a}}^{†2}\right)},$$

$$S_2={\text{e}}^{\frac{1}{2}\left({\zeta }^{\star }{\hat{a}}_1{\hat{a}}_2-\zeta {\hat{a}}_1^{†}{\hat{a}}_2^{†}\right)},$$

$${\hat{a}}_k=\frac{{\hat{q}}_k+\text{i}{\hat{p}}_k}{\sqrt{2}},{\hat{a}}_k^{†}=\frac{{\hat{q}}_k-\text{i}{\hat{p}}_k}{\sqrt{2}},\zeta =s{\text{e}}^{\text{i}\theta },s\in {\mathbb{R}}^{+}.$$

$${|\zeta ⟩}_{\text{TMSV}}:=S_2\left(\zeta \right)|0⟩,\zeta \in \mathbb{C}.$$

$$\mathbf{x}={\left(x_1,x_2,\dots ,x_{2k-1}\right)}^{\top }\in {\mathbb{R}}^{2k-1},$$

$$\mathbf{f}:={\left(f_1,f_2,\dots ,f_{2k-1}\right)}^{\top }\in {\mathbb{F}}^{2k-1}$$

$$f_i:{\mathbb{R}}^{2k-1}\to \mathbb{R}:\left(\mathbf{x}\right)=x_i$$

$$|\Psi ⟩=|\psi ⟩\otimes \underset{k-1}{\underbrace{|{\varphi }_a⟩\otimes \cdots \otimes |{\varphi }_a⟩}}\otimes \underset{k-1}{\underbrace{|{\varphi }_{1/a}⟩\otimes \cdots \otimes |{\varphi }_{1/a}⟩}},$$

$${\varphi }_a\left(x\right)=⟨x⟩{\varphi }_a={\left(\pi a^2\right)}^{-1/4}{\text{e}}^{-x^2/2a^2}.$$

$$|\Psi ⟩=$$

$$=$$

$$|\Psi ⟩=\psi \left(x_1\right)\prod _{i=2}^k{\varphi }_a\left(x_i\right)\prod _{i=k+1}^n{\varphi }_{1/a}\left(x_i\right).$$

Full text

1 Introduction

Secret sharing (SS) is an information theoretically secure cryptographic protocol that is applicable to online auctions, electronic voting, shared electronic banking and cooperative activation in the classical domain [1], and distributed quantum computing in the quantum regime [2]. Ramp classical [3, 4] and quantum [5, 6] secret-sharing (SS) schemes were proposed to reduce the communication complexity by the sacrifice of security conditions. Continuous-variable quantum secret sharing (CV QSS) [7, 8, 9] has been formulated in the framework of discrete-variable quantum SS schemes [10], which does not accommodate the quantum-information leakage inherent in continuous representations of quantum information. Our aim is to formulate CV QSS as a continuous-variable (CV) ramp quantum secret sharing (RQSS) protocol and introduce a technique to certify the protocol.

In order to reach our aims, we introduce four advances in our work. We develop the quantum mutual-information approach to the continuous-variable regime for evaluating the security of CV QSS schemes. We derive quantum mutual information between referee and any multi-player structure corresponding to the Tyc-Rowe-Sanders (TRS03) CV QSS scheme [7]. Furthermore, we introduce a certification technique for CV QSS in the framework of quantum-interactive proofs [11, 12, 13] and demonstrating the necessity of it being a RQSS scheme. Also we give an upper bound for the failure probability in terms of the number of experimental runs from which the referee knows how many rounds are required to have sufficient information.

We focus on the “quantum-quantum” (QQ) SS schemes [10] (in which the secret is a quantum state and communication occurs over quantum channels) because the “classical quantum” (CQ) SS schemes (which is for sharing a classical message over quantum channels) [14, 15], can be simulated by QKD and classical secret sharing [16]. The QQ case was extended to CV regime by Tyc and Sanders [8] and has been realized experimentally for three players, any two of whom are authorized to extract the secret state [9, 17]. Importantly, TRS03 later showed that the continuous-variable quantum state sharing could be extended to a $(k,n)$ threshold scheme (a class of QSS schemes in which the authorized structure consists of all groups of $k$ or more players while there are $n$ players in total [10]), without a corresponding scale up in quantum resources.

Whereas conditional entropy is employed for evaluating the security of CC schemes, quantum mutual information is needed for the quantum case [18]. Quantum mutual information has been used as a means to evaluate the secrecy condition of Cleve-Gottesman-Lo QSS in the $(2,3)$ case [18]. TRS03 characterized the quality of secret extraction for their scheme by calculating the fidelity in terms of squeezing parameter between the original and the extracted secret for an arbitrary coherent state as the secret. However, fidelity is not a distance measure [19].

Hence, we develop the alternative and more meaningful quantum mutual-information approach for evaluating the CV QSS security. Restricting to Gaussian states and operations allows all the calculation to be performed within the convenient framework of the semidirect product

[TABLE]

which is the continuous-variable Clifford group, with $\text{Sp}\left(2n,\mathbb{R}\right)$ the symplectic group and HW$\left(2n,\mathbb{R}\right)$ the Heisenberg-Weyl group for $n$ modes [20]. This representation makes calculations tractable but ignores potentially powerful non-Gaussian operations [21].

Our paper is organized as follows. In §2, we briefly review the theoretical background on continuous-variable quantum information with Gaussian states and Gaussian operations, mutual information and discrete-variable ramp quantum SS protocols. We detail our approach in §3. The mathematical results are presented in §4. We conclude with a discussion of our results in §5.

2 Background

This section provides the required context to tackle the problem which is solved in this paper. We begin the section by theoretical background on continuous-variable quantum information with Gaussian states and Gaussian operations. Then we discuss quantum mutual information, which is a necessary tool for defining and evaluating quantum SS schemes. Finally, we discuss basic results of RQSS schemes.

2.1 Continuous-variable quantum information with Gaussian states and Gaussian operations

In this subsection, we begin by introducing Gaussian states [22] and some of their important properties. Then we explain the Gaussian preserving maps, which preserve the Gaussian property of quantum states. Finally, we discuss continuous-variable quantum secret sharing based on TRS03 CV QSS scheme.

2.1.1 Gaussian states

A continuous-variable quantum state is an continuously parameterized element of Hilbert space described by observables with continuous eigenspectra. Typically, a continuous-variable quantum state is described by $n$ bosonic modes, associated with a tensor-product Hilbert space

[TABLE]

i.e., square integrable complex-valued functions over $\mathbb{R}^{N}$ and a vector of quadrature operators

[TABLE]

for ⊤ denoting transpose. The vector $\hat{\bm{x}}$ satisfies the commutation relation

[TABLE]

known as the symplectic form.

An arbitrary continuous-variable quantum state is characterized by a density operator

[TABLE]

where $\mathcal{S}(\mathscr{H})$ is the set of positive semidefinite trace-class operators. These positive trace-class operators can be represented by the Wigner function [23]

[TABLE]

for

[TABLE]

being the the Wigner characteristic function and

[TABLE]

being the Weyl operator. Wigner functions are particularly useful for calculating expectation values of symmetrically ordered functions $\hat{q}$ and $\hat{p}$ denoted by $S\left(\hat{q}^{b}\hat{p}^{d}\right)$, with $S$ denoting symmetric ordering, and with expectation value

[TABLE]

Thus far, we have the Wigner representation for any state; now we restrict to Gaussian states.

A Gaussian state is defined to be a state whose Wigner representation is Gaussian. A Gaussian state can be completely characterized by its first moment \bar{\bm{x}}=\operatorname{tr}\big{(}\hat{\bm{x}}\rho\big{)} and covariance matrix $\bm{V}$. The covariance matrix entries are

[TABLE]

with $\{,\}$ the anticommutator.

The symplectic manipulation of a Gaussian state’s covariance matrix can be used to express its fundamental properties. By definition, a $2n\times 2n$ real-valued matrix $\bm{S}$ is called symplectic if it preserves the symplectic form of Eq. (3); i.e.,

[TABLE]

According to the Williamson theorem [24], each covariance matrix $\bm{V}$ has a corresponding symplectic transformation $\bm{S}$ satisfying

[TABLE]

with symplectic spectrum defined by the vector

[TABLE]

unique to each $\bm{V}$ and satisfying

[TABLE]

As an example, a two-mode Gaussian state has covariance matrix

[TABLE]

The symplectic spectrum is [25]

[TABLE]

where

[TABLE]

As Gaussian states are easy to describe mathematically, a large class of transformations acting on such states are easy to characterize as well. In the next section, we discuss this class of transformations called Gaussian preserving maps.

2.1.2 Gaussian-preserving maps

Gaussian (linear) unitary Bogoliubov transformations are interactions that preserve the Gaussian character of a quantum state. In terms of the quadrature operators, a Gaussian map is described by the affine map

[TABLE]

where $\bm{S}$ (10) is the matrix representation of the symplectic group. The most general form of a Gaussian map in terms of its action on the statistical moments $\bar{\bm{x}}$ and $\bm{V}$ is

[TABLE]

A special class of Gaussian maps are linear canonical point transformations, for which the positions and momenta transform separately and do not mix [26].

For single-mode squeezing we have the infinite-dimensional unitary representation [27]

[TABLE]

and for two-mode squeezing we have the infinite-dimensional unitary representation

[TABLE]

where

[TABLE]

A two-mode squeezed vacuum (TMSV) state is mathematically represented as [27]

[TABLE]

In the next section, we explain TRS03 continuous-variable quantum SS scheme in which the Gaussian maps are used for encoding and decoding.

2.1.3 Continuous-variable quantum secret sharing

In this subsection, we explain the TRS03 CV QSS scheme. In a $\left(k,2k-1\right)$-threshold scheme, the dealer possesses a pure secret state $\ket{\psi}\in\mathscr{H}$ and encodes the quantum secret into an entangled state of $2k-1$ modes of the electromagnetic field by combining it with $2k-2$ ancillary states. The dealer then distributes them among the $n$ players, each of whom receive one share, and at least $k$ players must combine their shares in an active interferometer to extract the secret state.

Let $\mathscr{H}^{(2k-1)}$ be the tensor product of $2k-1$ copies of $\mathscr{H}^{(1)}$ and each player owns one of these copies. Let us define $\mathbb{F}^{2k-1}$ as the real linear space of coordinate functions for $\mathbb{R}^{2k-1}$. Then a system of Euclidean coordinates

[TABLE]

is equivalent to choosing an orthonormal basis of coordinate functions

[TABLE]

such that

[TABLE]

with $x_{i}$ the $i^{\text{th}}$ coordinate of $\bm{x}$ (24), and $f_{i}\cdot f_{j}=\delta_{ij}$.

Initially, the dealer starts with an unentangled tensor product

[TABLE]

where $\ket{\psi}$ is the secret state and

[TABLE]

Let us write this state as

[TABLE]

where

[TABLE]

The dealer then performs the encoding using a linear canonical point transformation

[TABLE]

The corresponding unitary transformation then maps the state $\ket{\Psi}$ to

[TABLE]

The dealer, however, has to choose $\{g_{i}\}$ such that any $k$ players are able to disentangle the secret state but that fewer is unable to do so. For this purpose, in the case of sufficiently large $a$, only the orthogonal projection $\iota_{i}$ of each vector $g_{i}$ into the space spanned by the vectors $\{f_{1},\ldots,f_{2k-1}\}$ is important. The vectors $\{g_{i}\}$ then must be chosen such that any $k$ vectors from the set $\{f_{1},\iota_{1},\ldots,\iota_{2k-1}\}$ are linearly independent. This linear independence condition guarantees that any $k$ players are able to extract the secret.

For convenience, let us express $\mathbb{F}^{2k-1}\in\mathbb{R}^{2k-1}$ as a direct sum of three mutually orthogonal subspaces

[TABLE]

where $\mathbb{X}$ is the one-dimensional space spanned by $f_{1}$ and $\mathbb{Y}$ and $\mathbb{Z}$ are $k-1$-dimensional spaces spanned by $\{f_{2},\ldots,f_{k}\}$ and $\{f_{k+1},\ldots,f_{2k-1}\}$, respectively. Now let us relabel $\{x_{i}\}$ coordinates as $(x,y_{i},z_{i})$ coordinates with

[TABLE]

The wavefunction $\Psi$ is then

[TABLE]

Without loss of generality, the first $k$ players collaborate to retrieve the quantum secret. The players then make the linear coordinate transformation

[TABLE]

assuming $\xi_{i}=g_{i}$ for all $i>k$.

For convenience, let us define a decomposition for every vector $\xi_{i}$ as a sum of three mutually orthogonal vectors, each of which belongs to subspaces $\mathbb{X}$, $\mathbb{Y}$ and $\mathbb{Z}$

[TABLE]

Equivalently, we can write

[TABLE]

In the case that the vectors $g_{i}$ are chosen in such a way that any $k$ vectors from the set $\{f_{1},\iota_{1},\ldots,\iota_{2k-1}\}$ are linearly independent, the players can design the transformation $g_{i}\mapsto\xi_{i}$ such that

[TABLE]

where $i\in\{1,\ldots,k-1\}$. Then transformation (2.1.3) extracts the secret for sufficiently large values of parameter $a$.

2.2 Mutual information

Here we review the key notions of mutual information, which is the method for quantifying information security and defining quantum secret sharing. We begin by presenting salient facts about Shannon and von Neumann entropy followed by requisite knowledge concerning classical and quantum mutual information. Finally, in this subsection, we discuss the security for discrete quantum secret sharing as our aim is to analyze security for continuous-variable quantum secret sharing.

2.2.1 Shannon and von Neumann entropy

Here we review Shannon and von Neumann entropy as these notions of entropy underpin the formulation of classical and quantum mutual information. This subsubsection also helps to elucidate the compact notation we use throughout this paper.

Shannon entropy.

Let $Z$ be a statistical ensemble defined by a classical random variable $z$ and its associated probability distribution $\{p_{j}\}=\{p_{1},\ldots,p_{n}\}$, which can be expressed as a probability vector $\bm{p}=(p_{1},\ldots,p_{n})^{\top}$. The logarithm of this vector (always using base 2 here) is

[TABLE]

Using the Hadamard (elementwise) product $\bm{a}\circ\bm{b}:=(a_{i}b_{i})$ [28] for vectors and the sum of such elements $\bm{a}\odot\bm{b}:=\sum_{i}a_{i}b_{i}$, the Shannon entropy is

[TABLE]

Thus, $H_{\text{Sh}}$ yields the number of bits per letter needed to completely specify $Z$ in the asymptotic limit of infinitely long strings [29]. Shannon entropy is thus a measure for the uncertainty of $z$ or it indicates how much information each letter in the string that uses the alphabet $Z$ carries.

Von Neumann entropy

In the same vein, the information content of a quantum state $\rho$ (5) can be quantified by determining how many qubits are needed to represent state $\rho$ in the asymptotic limit of an infinite ensemble of physical systems. This quantum-information content, known as the von Neumann entropy [30], amounts to computing a classical Shannon entropy (41)

[TABLE]

for $\operatorname{spec}\bm{\rho}$ a vector comprising eigenvalues of the state $\rho$.

Continuous-variable quantum entropy.

For continuous-variable Gaussian states, we define the vectors

[TABLE]

with $\bm{\nu}$ the symplectic spectrum (13) and $\mathds{1}$ the vector with all entries being unity. Thus, the von Neumann entropy is [31]

[TABLE]

These entropy expressions are used in the formulæ for mutual information.

Convenient notation for states in entropy formulæ

A convenient notation for entropy, which is independent of being classical or quantum, uses a label for the classical or quantum state. Rather than specify the state as $\bm{p}$ classically or $\rho$ quantumly, we label the state by a capital letter such as A and B, with these labels commensurate with the usual Alice-and-Bob nomenclature in cryptology [32].

Conditional entropy.

Labelling the joint state held by A and B as AB, the conditional entropy is abstractly expressed as

[TABLE]

for any valid formula for entropy, whether classical (41) or quantum (42).

Classical conditional entropy.

The classical conditional entropy [33] is obtained from Eq. (45) by replacing

[TABLE]

for $\bm{p}_{\text{A}}$ the distribution held by A. Similarly, we replace

[TABLE]

and

[TABLE]

$H\left(\text{A}|\text{B}\right)$ quantifies the correlation between A and B as the reduction of the number of bits per letter needed to specify A given B is known.

Quantum conditional entropy.

The quantum conditional entropy [19] is obtained from Eq. (45) by replacing

[TABLE]

for $\rho_{\text{A}}$ the quantum state held by A. Similarly, we replace

[TABLE]

and

[TABLE]

Although classical conditional entropy is always positive, for evaluatingquantum conditional entropy can be negative [34].

2.2.2 Classical and quantum mutual information

We explain classical mutual information [33] and quantum mutual information [19], first as an abstract concept regardless of whether classical or quantum information is chosen. Then we explain each of classical and quantum mutual information. Quantum mutual information is vital for evaluating security for secret sharing.

Mutual information.

Labelling the joint state held by A and B as AB, mutual information is abstractly expressed as

[TABLE]

for any valid formula for entropy, whether classical (41) or quantum (42). Classical mutual information [19] is obtained from Eq. (52) by replacing

[TABLE]

with $\text{X}\in\{\text{A},\text{B}\}$ for $\bm{p}_{\text{X}}$ and

[TABLE]

as discussed in ¶2.2.1. Classical mutual information quantifies the correlation between two statistical ensembles A and B as the reduction of the number of bits per letter needed to specify one of the variables given the other variable is known.

Quantum mutual information.

The quantum mutual information [19] is obtained from Eq. (52) by replacing

[TABLE]

for $\rho_{\text{A}}$ the quantum state held by A. Similarly, we replace

[TABLE]

and

[TABLE]

Quantum mutual information is always positive and quantifies the total correlations contained in the bipartite state $\rho_{\text{AB}}$. Quantum mutual information is employed to define and evaluate the security of quantum secret-sharing schemes (QSS).

Relation between conditional entropy and mutual information.

The relation between conditional entropy and mutual information is

[TABLE]

for any valid formula for entropy, whether classical (41) or quantum (42). The relation between classical mutual information and classical conditional entropy is obtained from Eq. (58) by replacing

[TABLE]

with $\text{X}\in\{\text{A},\text{B}\}$ and

[TABLE]

with $\left(\text{X},\text{Y}\right)\in\{\left(\text{A},\text{B}\right),\left(\text{B},\text{A}\right)\}$ as discussed in $\P$2.2.1.

The relation between quantum mutual information and quantum conditional entropy is obtained from Eq. (58) by replacing

[TABLE]

with $\text{X}\in\{\text{A},\text{B}\}$ and

[TABLE]

with $\left(\text{X},\text{Y}\right)\in\{\left(\text{A},\text{B}\right),\left(\text{B},\text{A}\right)\}$ as discussed in $\P$2.2.1.

2.2.3 Classical and quantum secret sharing

In this subsubsection, we explain classical and quantum secret-sharing protocols. We begin by establishing the agents of the protocol namely dealer and players and the structures corresponding to the set of players. Afterwards, we explain classical secret-sharing schemes along with classical secrecy and recoverability conditions corresponding to them. Then we define quantum secret sharing and provide the secrecy and recoverability conditions corresponding to them based on quantum mutual information.

Dealer and players.

We establish the agents of the protocol and the structures corresponding to sets of players, who are one kind of agent. Specifically, secret sharing comprises $n+1$ agents, namely one dealer $\mathcal{D}$ and $n$ players labelled

[TABLE]

The power set of players is $2^{\mathcal{P}}$, which is the set of all subsets of the set of players (63).

The role of the dealer is to encode the secret message $S\in\{0,1\}^{*}$ (classically) or $\rho_{s}\in\mathcal{S}\left(\mathscr{H}\right)$ (5) quantumly, into $n$ shares and distributes them among players in such a way that specific elements of $2^{\mathcal{P}}$ form the authorized structure $\mathcal{A}$ to retrieve the secret message whereas other elements are denied any information about the secret whatsoever. The set of elements that are denied any information is known as the forbidden structure $\mathcal{F}$.

Access structure.

Let

[TABLE]

where $\mathcal{F}$ is monotonically decreasing and $\mathcal{A}$ is monotonically increasing, and

[TABLE]

Then the set

[TABLE]

is the access structure on $\mathcal{P}$. Quantumly, the no-cloning theorem implies that the existence of two disjoint authorized group is forbidden [35].

Secret-sharing protocol.

Let $\mathscr{H}$ be a Hilbert space and let $\mathcal{S}(\mathscr{H})$ be all density operators on a Hilbert space $\mathscr{H}$. In a quantum secret-sharing scheme, the dealer’s task is to encrypt a quantum secret $\rho_{\text{s}}\in\mathcal{S}\left(\mathscr{H}\right)$ into a composite system of Hilbert spaces

[TABLE]

each of which is called a share labelled by $S_{1},S_{2},\ldots,S_{n}$. Let

[TABLE]

be the entire set of shares and

[TABLE]

be the corresponding Hilbert space. The dealer then distributes the shares among players (63). For a subset $A\subseteq N$ of shares

[TABLE]

the QSS encoding is

[TABLE]

which is a completely positive and trace preserving map [5].

The composition map of the encoder $W_{N}$ for a subset $X\subseteq N$, and the partial trace of the complement $N\setminus X$ is

[TABLE]

A QSS scheme is then defined by the quantum operation $W_{N}$ (71) that is reversible with respect to $\mathcal{S}(\mathscr{H})$. The set $N$ is divided into two mutually disjoint structures $\mathcal{A}$ and $\mathcal{F}$ [5].

1. (i)

A set $X\subseteq N$ is authorized if $W_{X}$ is reversible with respect to $\mathcal{S}(\mathscr{H})$. 2. (ii)

A set $X\subseteq N$ is forbidden if $W_{X}$ is vanishing with respect to $\mathcal{S}(\mathscr{H})$.

The arguments so far are valid in the classical cases, which is verified by replacing the corresponding notions with the classical ones [5].

Classical secrecy and recoverability conditions.

Classical secrecy is expressed in terms of conditional entropy but equivalently can be expressed in terms of mutual information. Strictly speaking, conditional entropy is between shares. However, for simplicity, in the literature there is a tendency to refer to conditional entropy between players. $\Pi$ is a perfect SS scheme on $\Gamma$ if

• •

$\forall\mathcal{B}\in\mathcal{A}\,\,H\left(S|\mathcal{B}\right)=0$

• •

$\forall\mathcal{B}\notin\mathcal{A}\,H\left(S|\mathcal{B}\right)=H\left(S\right)$.

Quantum secrecy and recoverabiliy conditions.

Here we discuss quantum secrecy conditions in terms of quantum mutual information. Strictly speaking, quantum mutual information is between shares. However, for simplicity, in the literature there is a tendency to refer to quantum mutual information between players. We can imagine that the system $\rho_{\text{s}}$ is part of a larger system and that this compound system is initially in a pure state $\ket{\psi^{\text{RS}}}$. Therefore,

[TABLE]

In a QSS, if a subset $X\in 2^{\mathcal{P}}$ satisfies

[TABLE]

then $\rho^{X}$ does not contain any information about $\rho_{s}$ [18]. On the other hand, if a subset $X$ satisfies

[TABLE]

then $X$ contains full information about $\rho_{\text{s}}$ [18].

Access structure.

Specific subsets of players form the authorized structure

[TABLE]

to retrieve the message whereas the other subsets, i.e., the forbidden structure

[TABLE]

are denied any information about the secret whatsoever. We define the QSS access structure as

[TABLE]

Threshold secret sharing.

$((k,n))$ threshold QSS schemes are a class of QSS schemes in which the authorized structure comprises all groups of $k$ or more players while there are $n$ players in total (the use of double parentheses distinguishes it from a classical scheme). $((k,n))$ quantum threshold schemes exists provided no-cloning theorem is satisfied [35]. Any quantum secret sharing scheme can be reduced to $((k,2k-1))$ threshold schemes [35]. In QSS schemes, the size of shares allocated to each player must be at least as large as the size of the secret [35, 5].

2.3 Ramp quantum secret-sharing scheme

As an extension of $(k,n)$–threshold SS schemes discussed in $\P$2.2.3, ramp secret-sharing (RSS) schemes were proposed by Blakley-Meadows [3] and Yamamoto [4]. In RSS schemes, the dimension of each share is reduced compared to that of the original system by sacrifice security for admitting the intermediate property for some sets of shares, which are denoted as intermediate sets.

In a $(k,L,n)$ threshold RSS scheme, any $k$ or more players are able to fully reconstruct the secret $s$, whereas any $k-L$ or less players are denied to obtain any information of it. Furthermore, from arbitrary $k-j$ shares for $j\in\{1,\ldots,L-1\}$, some information of the secret leak out with the size of $\frac{j}{L}$ in $s$.

A QSS scheme $W_{N}$ is called perfect if any set $X\subseteq N$ is either authorized or forbidden. Otherwise, $W_{N}$ is a RQSS scheme. The access structure of a RQSS scheme is the list of the forbidden, intermediate, and authorized sets. A set $X\subseteq N$ is called intermediate if $W_{X}$ is neither vanishing nor reversible with respect to $\mathcal{D}(\mathscr{H})$ [5]. Formally, the access structure of the set $N$ is defined by a map

[TABLE]

where $0,1$ and $2$ represent $\mathcal{F}$,$\mathcal{I}$ and $\mathcal{A}$, respectively. Now that we have the essential background, we proceed in the next section to explain our approach to CVRQSS.

3 Approach

In this section, we introduce a CV RQSS protocol and explain how to certify. We discuss the success criterion of the certification protocol. Furthermore, we specify what the parties need to do to complete the certification.

3.1 Continuous-variable ramp quantum secret-sharing protocol with Gaussian states and operations

Here we modify the discrete-variable RQSS protocol discussed in §2.3 into a continuous-variable counterpart. We choose Gaussian states and operations, which are convenient mathematically due to the elegance of techniques based on the semidirect product of the symplectic group and the Heisenberg-Weyl group (1). However, the price paid for this convenience is discarding potentially powerful universal operations [21]. Whereas, in the discrete case, specification of number of players and threshold condition $L$ suffices to determine the cardinality of the three structures, the CV case is more complicated due to squeezing limitations.

3.1.1 Quantum-optical resources

The optical realization comprises displacers that generate Heisenberg-Weyl group elements and single-mode squeezers, passive beam-splitters and phase-shifters that generate the semidirect product of the symplectic group  (1). The inputs are vacuum states of light. For the closed disk

[TABLE]

the dealer’s and players’ single-mode squeezers (20) have limited squeezing capability corresponding to $\zeta\in D_{s}$, with $s=s_{\text{max}}^{\text{D}}$ for the dealer and $s=s_{\text{max}}^{\text{P}}$ for the player.

3.1.2 Dealer’s task

Here we specify the dealer’s task in the RQSS protocol. Dealer’s tasks include preparing a quantum secret, choosing an access structure, encoding the quantum secret and distributing shares.

Two-mode squeezed-vacuum source.

The dealer prepares a TMSV state (23) drawn randomly from the uncountable set

[TABLE]

The dealer’s task is to encode one mode of this quantum state into an $n$-mode entangled state by mixing it with $n-1$ ancillary states in an $n$-mode active interferometer. The dealer then sends one share to each of the players in such a way that the elements of power set of players are divided into three predetermined mutually disjoint sets known as authorized, intermediate and forbidden structures.

In order for the dealer to prepare the TMSV randomly, first, he needs to decide the complex two-mode squeezing parameter $\zeta=s\text{e}^{\text{i}\theta}$ (22), where $s$ is bounded by $s_{\text{max}}^{\text{D}}$. The dealer generates two random numbers $a,b\in\left[0,1\right]$. Then the dealer assigns

[TABLE]

Choosing a useful, feasible access structure.

The dealer chooses an access structure $\Gamma$ based on the desired application. The dealer then runs an algorithm that accepts $\Gamma$, covariance matrix of TMSV state $\bm{V}$, $s_{\text{ max}}^{\text{D}}$ and $s_{\text{ max}}^{\text{P}}$ as input and yields the encoding transformation or else null as the output. The dealer then performs the encoding transformation and distributes the shares among players.

3.1.3 Players’ task

The players’ task in any authorized set is to reconstruct the quantum secret. One player is assigned to hold the secret after reconstruction. The aforementioned player forms a structure with other players in the authorized set who perform a Gaussian unitary operation on their shares such that the state of the share belonging to the assigned player become the same as the original secret state. The players in any intermediate set are allowed to partially reconstruct the secret state. Furthermore, the players in a forbidden structure should not gain any information about the quantum secret whatsoever.

3.2 Certification protocol

In this subsection we introduce a certification protocol that ascertains whether the RQSS protocol succeeds. The success criterion is discussed in this subsection. We specify what the parties need to do to complete the certification.

3.2.1 Agents and resources

In this subsection, we establish the agents of the certification protocol, namely, the dealer, the players and the referee who serves as skeptical certifier. Furthermore, we specify available resources for each party.

The dealer and players share trusted error-free classical and quantum communication channels between each other, and the referee also shares trusted error-free classical and quantum communication channels with each player and with the dealer. In our continuous-variable setting, the referee possesses single-mode homodyne detectors [22]. Henceforth, we only refer explicitly to homodyne measurement, without loss of generality. The dealer possesses a classical computer to choose the access structure $\Gamma$ discussed in $\P$3.1.2, and the referee possesses a classical computer to run the certification algorithm.

3.2.2 Dealer’s encoding and announcement

The dealer chooses an access structure $\Gamma$ discussed in $\P$3.1.2 and announces $\Gamma$ to the players and to the referee. The dealer encodes shares based on the choice of $\Gamma$ and the quantum secret, such as a randomly chosen state in the parameter disk (81), and announces this encoding to the players.

3.2.3 Rounds

In this subsubsection, we define ‘rounds’, which are repetitions of the protocol between the dealer, players and referees. The concept for these rounds is depicted in Fig. 1.

First the dealer prepare a suitable two-mode Gaussian state, which is the same two-mode Gaussian state for all rounds, and sends one mode to the referee and the other mode into an encoder, which is also unchanging over all rounds. This encoder creates shares that are sent to each player.

After the shares are received by players, the referee requests a subset of players, which can be authorized, forbidden or intermediate, to try to reconstruct the quantum secret and then send their shares to the referee. The referee then performs single-mode homodyne measurements and save the measurement results. Rounds continue until the referee permits the dealer and players to stop.

3.2.4 Referee’s certification strategy

The referee’s task is to certify the protocol by ascertaining the dealer’s announcement that the access structure is the announced $\Gamma$. The referee conducts tests by requiring many rounds per instance, with each instance corresponding to testing whether a fixed subset of players is in $\mathcal{A}$, $\mathcal{I}$ or $\mathcal{F}$ structures determined by $\Gamma$. Due to the statistical nature of the test, the referee cannot be 100% sure that the inference is correct; rather the referee makes a decision if the probability of being correct exceeds some threshold value, itself strictly greater than $1/2$.

Sufficiency condition.

When a sufficiency condition is met to ascertain whether the subset of players are determined to be in a structure compatible with the dealer’s announced $\Gamma$, the referee instructs the players to stop. If that instance passes the test, the referee announces a new subset of players to test and the rounds repeat until the referee has enough data to pass the sufficiency test. If the instance results in the dealer and players failing, the procedure stops as the team of dealer and players has failed the test. The dealer and players pass only if every instance passes.

3.3 Summary of approach

Here we modified the discrete-variable RQSS protocol as the CV counterpart in the case of Gaussian states and operations. Furthermore, we introduced a certification protocol that ascertains whether the RQSS protocol succeeds. Also we discussed the success criterion and we specified what the parties need to do to complete the certification.

4 Results

In this section we present our main results. Our first result is a CV version of quantum mutual information. This CV quantum mutual information is then used to quantify quantum-information leakage for Gaussian states and operations. Based on this leakage characterization, we introduce a certification test, in the framework of quantum-interactive proofs, and provide a practical test to implement this test.

4.1 CV quantum mutual information

In this subsection, we develop the quantum mutual information for the CV RQSS quantum access structures and employ it to quantify quantum-information leakage for Gaussian states and operations. We define $\mathcal{I}$ corresponding to CV RQSS protocols based on quantum mutual information.

Let $\ket{\psi}^{\text{RS}}$ be a pure two-mode Gaussian state and let the quantum secret be $\rho_{\text{s}}$ (73). Then

[TABLE]

and  $\mathcal{A}$ and $\mathcal{F}$ are obtained from Eqs. (76) and (77), respectively.

We now calculate mutual information between the referee and any multiplayer structure for TRS03. Specifically, we consider a two-mode entangled state (80) such that one mode is used for the secret and the other mode is used for the reference system. We choose this system because that way the referee can do a sensitive entanglement check to verify that the reconstructed state is entangled with a reference system as it should be. To simplify matters, without loss of generality, we investigate in particular a TMSV with one mode being the quantum secret and the other mode being the reference system.

We solve the quantum mutual information between an extracted secret obtained by any player structure with $k$ elements and the reference system. In order to do so, by using Eq. (5), we transform the density function of the reference system and the extracted secret (A) into a Gaussian Wigner function represented by a mean vector and a covariance matrix from which the symplectic eigenvalues (13) are calculated.

The symplectic eigenvalues (13) are inserted into Eq. (44) in order to calculate the local and global von Neumann entropy of the extracted secret and reference system from which the quantum mutual information is solved (52). Figure 2 shows the resultant quantum mutual information versus squeezing parameter in the case of $|\zeta|=2$.

In §4.2 we employ the CV quantum mutual-information approach to introduce a certification technique for CV RQSS schemes.

4.2 Certification test for RQSS protocols

In this subsection, we establish our model for certification tests. Specifically, we introduce certification tests for $\mathcal{A}$, $\mathcal{F}$ and $\mathcal{I}$, respectively.

RQSS certification for $\mathcal{A}$.

Let $I_{\text{T}}^{\mathcal{A}}$ be a threshold quantum mutual information chosen by the referee. This quantum mutual information quantifies the minimum knowledge that players in an access structure are able to obtain about the secret. Let $\beta>0$ be a maximum failure probability. A test, which receives copies of some $X$ as input, and yields accept or reject, is a test for certifying whether $X\in\mathcal{A}$, if, with probability at least $1-\beta$, it both rejects every $\rho^{\text{X}}$ for which

[TABLE]

and accepts if

[TABLE]

These conditions correspond to soundness (84) and completeness (85)  [11, 12, 13].

RQSS certification for $\mathcal{F}$.

Let $I_{\text{T}}^{\mathcal{F}}$ be a threshold quantum mutual information chosen by the referee, which quantifies the maximum knowledge that players in the forbidden structure can obtain about the secret. A test, which receives as input copies of some $\rho^{X}$, and yields accept or reject, is a certification test for certifying whether $X\in\mathcal{F}$, if, with probability at least $1-\beta$, it both accepts every $X$ for which

[TABLE]

and rejects a different $\rho^{\text{X}}$ for

[TABLE]

These conditions are completeness (86) and soundness (87).

RQSS certification for $\mathcal{I}$.

A test that receives copies of some $X$ as input and yields accept or reject certifies whether $X\in\mathcal{I}$ if, for a least probability $1-\beta$, it both rejects every $X$ for

[TABLE]

or

[TABLE]

and accepts if

[TABLE]

Conditions (88) and 89) are soundness and condition (90) is completeness. In the next subsection we employ our certification model to propose a practical test to ascertain RQSS protocols.

4.3 Practical realization of the certification test

In this subsection, we propose a practical algorithm, for determining if $X$ is in $\mathcal{A}$, $\mathcal{I}$ or $\mathcal{F}$. We prove propositions that the algorithm is both sound and complete. Furthermore, we provide a sufficiency test for the referee to know how many runs are required for her to have sufficient information to check if a particular element is in $\mathcal{A}$, $\mathcal{I}$ or $\mathcal{F}$.

4.3.1 Steps for certification

Below we provide the steps for certifying RQSS. Before commencing certification, the referee numerically labels each element of the power set and proceeds to test each labelled element of the power set in order according to this labelling. For simplicity, and without loss of generality, we assume that each player holds one share; thus, the number $n$ of modes equals one more than the number of players, hence shares, in the given subset. This extra mode allows a single-mode reference field in addition to the modes held by the players.

The referee conducts a test that requires many rounds (3.2.3) for each power-set element. The test evaluates whether a fixed subset of players is in $\mathcal{A}$, $\mathcal{I}$ or $\mathcal{F}$. In order to do so, the referee estimates the quantum mutual information $I_{\text{e}}\left(\text{R},\text{S}_{\text{e}}\right)$ between the reference state $\rho^{\text{R}}$ and the extracted secret state $\rho^{\text{S}_{\text{e}}}$ such that

[TABLE]

with a failure probability $\beta<1/2$. Algorithm 4 accepts $I_{\text{e}}\left(\text{R},\text{S}_{\text{e}}\right)$ as input and determines the structure of the power-set element. If the test result is consistent with the dealer’s announcement that the access structure is the announced $\Gamma$, the referee announces a new subset of players to test; otherwise the procedure halts as the team of dealer and players has failed the certification test.

To estimate $I_{\text{e}}\left(\text{R};\text{S}_{\text{e}}\right)$, the referee estimates the expectation values corresponding to each element of the matrices

[TABLE]

and

[TABLE]

with $\hat{\bm{x}}$ defined in Eq. (3). The first and second modes hold reference and reconstructed secret states, respectively. The referee’s result is then used to estimate the covariance matrix (10) of $\rho^{\text{R}\text{S}_{\text{e}}}$ according to [13]

[TABLE]

This covariance matrix is used to calculate the entropies of $\rho^{\text{S}_{\text{e}}},\rho^{\text{R}}$ and $\rho^{\text{R}\text{S}_{\text{e}}}$ using Algorithm 1. The resultant entropies are then inserted into the standard formula for quantum mutual information (58).

The expectation value of each element of (92) and (93) is calculated by performing multiple homodyne measurements on identical and independent copies of $\rho^{\text{R}\text{S}_{\text{e}}}$ and taking the average of the measurement results. Using Chebyshev’s inequality [13], the referee calculates an upper-bound for the estimation error of each expectation value as a function of number of rounds and $\beta$. Subsequently, this estimation error is then used to calculate the maximum expectation values’ estimation error $\epsilon_{\text{max}}$ of covariance-matrix entries via the standard formula for error propagation. Afterwards she calculates the bound on the estimation error of entropies following Algorithm 2. The estimation error of $I_{\text{e}}\left(\text{R};\text{S}_{\text{e}}\right)$ is bounded by summation of the entropies estimation errors. The rounds continue until the estimation error of $I_{\text{e}}\left(\text{R};\text{S}_{\text{e}}\right)$ is below a prespecified acceptable $\epsilon$ error.

Proposition 1**.**

Algorithm 3 ensures

[TABLE]

and

[TABLE]

for $N$ the number of rounds.

Proof.

Using Chebyshev’s inequality [13],

[TABLE]

Equations (103) and (104) equivalently are

[TABLE]

Assigning

[TABLE]

and assuming an independent identically distributed (iid) protocol delivers

[TABLE]

Let $\epsilon_{\text{max}}$ be the maximum estimation error of estimated covariance matrix, which is calculated in terms of $\epsilon$ (107) via standard error propagation methods. In the following we give an upper bound on the estimation error of quantum mutual information in terms of $\epsilon_{\text{max}}$. In order to do so, we introduce some helpful notation and theorems used in our proofs.

For any two Gaussian states with corresponding covariance matrices $\bm{V}_{\text{A}}$ and $\bm{V}_{\text{B}}$, the entropy difference is bounded by [36]

[TABLE]

for

[TABLE]

Also

[TABLE]

holds for any covariance matrix $\bm{A}$ [37]. Hence,

[TABLE]

By substituting Eq. (112) into Eq. (110), we obtain the perturbation bound

[TABLE]

For any $\text{Q}\in\{\text{R},\text{P},\text{RP}\}$, let $\bm{V}^{\text{e,Q}}$ and $\bm{V}^{\text{Q}}$ be the estimated and real covariance matrices, respectively. Then

[TABLE]

Also

[TABLE]

Furthermore, let us define

[TABLE]

and

[TABLE]

Thus,

[TABLE]

Due to the triangle inequality,

[TABLE]

Each of the terms in the right-hand side of Eq. (119) is suitably achieved by using Eq. (113). Substituting Eqs. (115) and (116) into the resultant equation delivers Eq. (101).

Now we show that $\epsilon_{\text{QMI}}$ scales properly with respect to number of rounds. Using the Weyl [38] perturbation bound for singular value decomposition, we conclude

[TABLE]

Therefore, the error bound scales inversely with square root of the number of rounds. Next we prove the algorithm 4 is both sound and complete. ∎

Proposition 2**.**

1. (i)

If $X\in\mathcal{A}$, Algorithm 4 passes with probability at least $1-\beta$ and 2. (ii)

if $X\notin\mathcal{A}$ then the algorithm fails with probability at least $1-\beta$.

Proof.

We show cases (i) and (ii) in sequence.

Case (i): We first recall that

[TABLE]

Also

[TABLE]

Therefore,

[TABLE]

As $\delta-\epsilon\geq\epsilon$, we conclude

[TABLE]

Thus, Algorithm 4 accepts with probability at least $1-\beta$ if $X\in\mathcal{A}$.

Case (ii): We note that

[TABLE]

Therefore, substituting Eq. (84) into Eq. (125) delivers

[TABLE]

Thus, Algorithm 4 rejects with probability at least $1-\beta$ if $X\notin\mathcal{A}$. ∎

Proposition 3**.**

1. (i)

If $X\in\mathcal{F}$, then Algorithm 4 accepts with probability at least $1-\beta$ and 2. (ii)

if $X\notin\mathcal{F}$ then Algorithm 4 rejects with probability at least $1-\beta$.

Proof.

We show cases (i) and (ii) in sequence.

Case (i):

[TABLE]

Also

[TABLE]

Therefore,

[TABLE]

Substituting Eq. (127) in Eq. (129) delivers

[TABLE]

As $\delta-\epsilon\geq\epsilon$, we conclude

[TABLE]

Thus, Algorithm 4 accepts with probability at least $1-\beta$ if $X\in\mathcal{F}$.

Case (ii):

[TABLE]

Substituting Eq. (87) into Eq. (129) delivers

[TABLE]

Thus, Algorithm 4 rejects with probability at least $1-\beta$ if $X\notin\mathcal{F}$. ∎

Proposition 4**.**

1. (i)

If $X\in\mathcal{I}$, then Algorithm 4 accepts with probability at least $1-\beta$ and 2. (ii)

$X\notin\mathcal{I}$ then Algorithm 4 rejects with probability at least $1-\beta$.

Proof.

We show cases (i) and (ii) in sequence.

Case (i):

[TABLE]

Also

[TABLE]

Therefore,

[TABLE]

Substituting Eq. (134) into Eq. (136) delivers

[TABLE]

Thus, Algorithm 4 accepts with probability at least $1-\beta$ if $X\in\mathcal{I}$.

Case (ii):

[TABLE]

and

[TABLE]

Substituting Eq. (88) and Eq. (89) into Eq. (138) and Eq. (139), respectively, delivers

[TABLE]

and

[TABLE]

As $\delta-\epsilon\geq\epsilon$, we conclude

[TABLE]

and

[TABLE]

Thus, Algorithm 4 rejects with probability at least $1-\beta$ if $X\notin\mathcal{I}$. ∎

5 DISCUSSION

In this section we discuss our results. We have two main results. The first result is a security analysis, which assigns subsets of players to each of the three structures, namely, authorized, intermediate, and forbidden structures. The second result is certification, which is performed by a referee. In our security analysis, we not only determine structures for subset of players, but we also quantify information leakage. For certification we introduce a referee who has limited resources such as finite local oscillator field. We now discuss these two results.

We base our approach on TRS03, which divides subsets of players into authorized and forbidden structures. TRS03 do not consider the intermediate structure because their security analysis is based on assuming infinite squeezing, but finite squeezing is responsible for information leakage, which leads us to introduce the intermediate structure based on ramp secret sharing concepts. Ramp quantum secret sharing has been considered before in two cases: discrete-variable threshold ramp quantum secret sharing [5] and entanglement sharing [39]. These analysis did not treat the continuous-variable case, however. In our case, for any amount of finite squeezing, we construct encoding and decoding procedures and thereby assign each subset to the correct structure.

Now we describe our result for certification. In our protocol, the dealer supplies the players with the encoded state, and in fact the state would be entangled with another share that goes directly to the referee. The referee identifies which subset of players are to transmit the decoded state to the referee, and the referee can combine this state with any shares that did not go through the players and then performs homodyne detection [40, 13]. The referee performs homodyne measurement, and, if the local oscillator strength is infinite, then standard homodyne theory suffices to describe the statistics. We study the particular case of the referee performing tests based on Gaussian states and repeated measurements to allow the referee to estimate accurately the mean and covariance of the resultant state. The referee’s procedure is valid even in the case of limited local-oscillator strength.

As our procedure is rather complicated and involves multiple parties, we have augmented our analysis by including pseudocode to explain step-by-step instructions on how to complete the procedure. Our pseudocode analysis makes clear exactly what is required of each party in the procedure. This pseudocode description could be a useful approach for describing future continuous-variable quantum-information protocols.

6 Conclusions

We have developed continuous-variable quantum mutual information with an external reference system in order to quantify the leakage of information and evaluate the security of continuous-variable quantum secret sharing protocols. Furthermore, we prove that information leakage arising in the TRS03 scheme monotonically decreases with reduced squeezing. In addition, we introduce a certification process for continuous-variable quantum secret sharing in the framework of quantum-interactive proofs and ramp quantum secret sharing schemes.

Pseudocodes have been introduced in order to represent clearly the sequence of steps taken to solve the certification problem. Subsequently, we provide a practical realization of the certification test using homodyne detection, including a sufficiency condition on the number of experimental runs the referee has to perform. We prove that the statistical error in the referee’s estimated quantum mutual information scales with the inverse square root of number of rounds.

Our certification procedure assumes the extracted secret states are iid. In reality, this iid property does not hold due to the environmental noises. Furthermore, in quantum secret sharing schemes, malicious parties might generate highly complicated entanglement among samples to fool the referee. As a future line of research, it is important to extend our certification procedure to the case of samples that are not independent and identically distributed.

Another useful avenue of research would be to analyze the effect of systematic errors in the referee’s measurement procedure. As a final remark, we emphasize that our certification approach is applicable to certifying other quantum-information protocols such as summoning of quantum information in space time, quantum error correcting codes and quantum teleportation in the framework of quantum-interactive proof systems.

Appendix A Calculation of quantum mutual information

The total density operator $\hat{\rho}_{T}$ of all shares and the reference system after the extraction procedure is

[TABLE]

where

[TABLE]

The joint density operator

[TABLE]

of the extracted secret and the reference system is obtained by tracing $\hat{\rho}_{T}$ over shares $\{2,3,\ldots n\}$. The resultant density matrix is

[TABLE]

where $v^{2}=\bm{\gamma}_{1}\odot\bm{\gamma}_{1}$ for which $\bm{\gamma}_{1}=\left(\gamma_{11},\gamma_{12},\ldots,\gamma_{1k-1}\right)$ (38). Also, $u^{2}=\bm{u}\odot\bm{u}$ where $\{\bm{u}_{i}\}$ are the coefficients of the expansion $\alpha_{j}=\sum_{i=2}^{k-1}\bm{u}_{i}\beta_{ij}$ for which $j=2,...,k-1.$ Then, by employing Eqs. (6),(7), and (8), we transform this density matrix into a Wigner function representation (6), namely

[TABLE]

By using Eq. (9), this Wigner function is employed to derive the generic elements of the covariance matrix $\bm{V}$ corresponding to the joint reference and extracted-secret state. The elements of $\bm{V}$ are

[TABLE]

The covariance matrix of the extracted secret and reference system denoted by $V_{\text{S}}$ and $V_{\text{R}}$ are

[TABLE]

Also the joint covariance matrix of the extracted secret and reference system is

[TABLE]

For convenience, let us also define

[TABLE]

Using Eq. (14), symplectic eigenvalues of $\bm{V}_{\text{S}}$ and $\bm{V}_{\text{R}}$ denoted by $\nu_{\text{S}}$ and $\nu_{\text{R}}$ are

[TABLE]

for which $\bm{V}_{\text{S}}$ and $\bm{V}_{\text{R}}$ are defined in Eq. (150). Symplectic eigenvalues of $\bm{V}_{\rho^{\text{RS}}}$ denoted by $\nu_{\pm}$ is calculated using Eq. (16), therefore,

[TABLE]

where $\Delta=\det{\bm{V}_{\text{S}}}+\det{\bm{V}_{\text{R}}}+2\det{\bm{C}}$.