Unitary Reconstruction of Secret for Stabilizer Based Quantum Secret Sharing

We propose a unitary procedure to reconstruct quantum secret for a quantum secret sharing scheme constructed from stabilizer quantum error-correcting codes. Erasure correcting procedures for stabilizer codes need to add missing shares for reconstruction of quantum secret while unitary reconstruction procedures for certain class of quantum secret sharing are known to work without adding missing shares. The proposed procedure also works without adding missing shares.


Introduction
Secret sharing (SS) [16] is a cryptographic scheme to encode a secret to multiple shares being distributed to participants, so that only qualified sets of participants can reconstruct the original secret from their shares.Traditionally both secret and shares were classical information (bits).Several authors [4,6,8,17] extended the traditional SS to quantum one so that a quantum secret can be encoded to quantum shares.
There was a difference between early pionieering works [4,6,8,17] of quantum SS.The first quantum SS [8] was based on the controlled teleportation [9,20], whose reconstruction of quantum secret involved classical communication among participants.On the other hand, the others works [4,6,17] related reconstruction to quantum error correction [3,18], and their reconstruction procedures were generally unitary operations on quantum shares.This paper studies reconstruction in the second category.
When we require unqualified sets of participants to have zero information of the secret, the size of each share must be larger than or equal to that of secret.By tolerating partial information leakage to unqualified sets, the size of shares can be smaller than that of secret.Such SS is called ramp SS [2,19].The quantum ramp SS was proposed by Ogawa et al. [14].If an unqualified set has absolutely no information about quantum secret (see [14] for a formal definition), it is called a forbidden set.
When we have a quantum error-correcting code (QECC) of length n, use it for quantum secret sharing and it can correct erasures in a set J ⊂ {1, . . ., n}, it was shown [4,6] that J = {1, . . ., n} \ J is a qualified set and J is a forbidden set.The above statement also holds for quantum ramp SS [14].In such a situation, a straightforward method for the set J of participants to reconstruct quantum secret is as follows: Firstly, initialize quantum systems in J to any quantum states and apply the erasure decoding procedure of QECC.This method is wasteful because decoding procedures usually involve measurement and they also need to attach |J| extra quantum systems.For example, if |J| = 70 and |J| = 30, adding 30 quantum systems and performing measurement on 100 systems are wasteful.
To overcome this waste, unitary reconstruction methods were proposed for previous proposals of quantum SS [4,12,14,21].On the other hand, while quantum SS constructed from the stabilizer QECC had been already studied [10,11,15], no unitary reconstruction procedure has been proposed for stabilizer based quantum SS.Stabilizer based quantum SS is important because it can realize access structures that cannot be realized by quantum SS based on CSS codes [3,18].For example, only the [ [5,1,3]] binary stabilizer QECC can realize quantum SS distributing 1 qubit of secret to 5 participants receiving 1-qubit shares and allowing only 3 or more participants to reconstruct secret.In addition, when sharing classical secret, it was recently shown that stabilizer QECC can realize an access structure that cannot be realized by classical information processing [13].
In this paper, we propose a unitary reconstruction method that can be executed by a qualified set J of participants without adding extra quantum systems.In Section 2, we introduce notations of stabilizer QECC and prove some properties of stabilizer QECC used later in the proposed reconstruction procedure.Section 3 describes the proposed procedure.Section 4 gives an explicit computational example of the proposed procedure applied to the well-known [ [5,1,3]] binary stabilizer QECC.In the Appendix, we discuss the security of quantum SS based on stabilizer QECCs.

Notations for Stabilizer Codes
Let q be a prime power, and we consider the q-dimensional complex linear space C q .A quantum system whose state is expressed by C q is called a qudit in this paper.Each share is assumed to be a qudit, and quantum secret consists of one or more qudits.If quantum secret has two or more qudits, the quantum SS becomes a ramp scheme.We fix a q-ary stabilizer QECC encoding k qudits to n qudits.The materials in this subsection is not new at all, and can be found in, for example, [1,7].Its stabilizer can be expressed as an (n − k)-dimensional F q -linear subspace C of F 2n q , where F q is the finite field with q elements.For two vectors q , we define its symplectic inner product as Let

Qualified Sets and Related Properties
To use any reconstruction procedure, the set J of participants must be qualified to reconstruct the secret.In this subsection, we clarify a necessary and sufficient condition for qualified sets and related properties that are later used for the proposed reconstruction procedure.For a set J ⊂ {1, . . ., n} of participants to be qualified, the erasures in J must be decodable, where an erasure means a quantum error with known location.In other words, when the errors are only in J, the stabilizer QECC defined by the stabilizer C ⊂ F 2n q must be able to correct the error.
Let g 1 , . . ., g n−k be a basis of C. A quantum error can also be identified with a vector e = (a 1 , b 1 , . . ., a n , b n ) ∈ F 2n q (see, for example, [1,7]).Measurement in the standard decoding procedure gives the symplectic inner products e, g i for i = 1, . . ., n − k.Let Observe that dim F J q = 2|J| and dim F J q = 2|J|.Under the assumption j ∈ J ⇒ (a j , b j ) = (0, 0) for e, we can correct all errors e ∈ F J q if and only if the implication ∀i, e, holds.The condition (2) implies (with the assumption that errors belong to J) On the other hand, the assumption Therefore the condition (2) is equivalent to We will study the linear spaces consisting of qudits in J or J of quantum codewords.
be stabilizer QECCs defined by C, C ∩ F J q , and C ∩ F J q , respectively.When we consider qudits in J (resp.J) of codewords in Q(C), their quantum states are density matrices whose row spaces are contained in Q(C ∩F J q ) (resp.Q(C ∩ F J q )).In order to evaluate their dimensions, firstly we have to evaluate dim C ∩ F J q and dim C ∩ F J q , where dim C ∩ F J q denotes the dimension of the linear space C ∩ F J q .We have The linear space C ∩ F J q consists of vectors in C whose (2 j − 1)-th component and 2 j-th component are zero if j ∈ J, which implies dim C − dim C ∩ F J q ≤ 2|J|.Eq. ( 4) holds because dim For x = (a 1 , b 1 , . . ., a n , b n ) ∈ F 2n q , let P J (x) = (a j , b j ) j∈J , that is, the projection to the index set J. Then we have C ∩ F J q = C ∩ ker(P J ) and dim Suppose that Eq. ( 5) does not hold, then we have dim P J (C) < |J| by Eq. ( 6) and the contradicts with Eq. ( 3).So we see that Eq. ( 5) is true when J is a qualified set.
In light of Eqs. ( 4) and ( 5), let dim We consider dim C ∩ F J q .By Eq. ( 3) we have which means that Q(C ∩ F J q ) encodes ℓ qudits to |J| qudits.Readers might wonder if ℓ = |J| is always true.The equality ℓ = |J| usually holds as we will see in Section 4 with an example.But ℓ = |J| is sometimes false in general cases, for example, consider an unpractical stabilizer QECC whose codewords are always set to |00 • • • 0 in J, which gives ℓ = 0.

Proposed Unitary Reconstruction
For ease of presentation, without loss of generality we may assume J = {1, . . ., |J|} and J = {|J| + 1, . . ., n}, by reordering indices.Let be an orthonormal basis (ONB) of have the same nonzero length for all i (k) and i (ℓ) , where I J is the identity matrix on qudits in J.Because otherwise the Holevo information between classical information i (k) and the qudits in J would have strictly positive value which contradicts by [14] to our assumption that J is a qualified set Define a state vector |ϕ ) is of length one and orthogonal to each other for different (i (k) , i (ℓ) ).Therefore {|ϕ is an ONB of Q(C ∩ F J q ).By using the above notations we can express We can define a unitary operation are ONBs with the same number of quantum state vectors in them.Suppose that quantum secret is where α(i (k) ) are complex coefficients.Then the whole quantum state of all shares is, by Eq. ( 12), Applying U rec on the qualified set J yields Equation ( 13) means that the quantum secret is reconstructed in the rightmost k qudits, and that it is unentangled from the rest of qudits.

A Security Analysis
For the completeness of this paper, in this appendix we discuss the security of quantum SS based on stabilizer QECCs.For the security analysis of quantum secret sharing based on quantum error correction, such as [4,6], we need to clarify (a) which share sets are qualified (being able to reconstruct secret perfectly) and (b) which share sets are forbidden (having no information about secret).The characterization of qualified sets in the proposed scheme is given by Eq. ( 3).Observe also that from a given basis g 1 , . . ., g n−k of C, we can easily verify by standard linear algebra whether or not Eq.( 3) holds for an arbitrarily given share set J. The characterization of forbidden sets also immediately follows from the fact that a share set is forbidden if and only if the rest of shares is qualified, as shown in [4,6,14].