WO2006074153A2

WO2006074153A2 - Single-particle quantum-enhanced secret sharing

Info

Publication number: WO2006074153A2
Application number: PCT/US2006/000072
Authority: WO
Inventors: Mohamed Bourennane; Christian Kurtsiefer; Christian Schmid; Pavel Trojek; Harald Weinfurter; Marek Zukowski
Original assignee: Magiq Technologies, Inc.
Priority date: 2005-01-03
Filing date: 2006-01-03
Publication date: 2006-07-13
Also published as: WO2006074153A3

Abstract

A single-particle quantum-enhanced secret sharing (QESS) system (10) and protocol (method) are disclosed. The system includes a distributor (D) that prepares single-particle qubits, such as photons (Y), in one of a number of possible initial states, such as an initial polarization states. The distributor then distributes the qubits to each of a number recipients (RJ) that each randomly encodes the qubit with encoding states that fall into one of two encoding classes. The final state of the qubit is then measured by an encoded-state analyzer (86). Each recipient shares the encoding class used to encode the qubit, which allows the distributor to establish which distributions of qubits constitute valid runs (VR) resulting in correlated and anti-correlated qubit measurements. The recipients share their encoding information with one another for the valid runs to establish the distributor's initial encoded state, which represents corresponding logical states (e.g., 0 and 1). The collective sharing among the parties allows the parties to share a secret message (information).

Description

SINGLE-PARTICLE QUANTUM-ENHANCED SECRET SHARING

Technical Field of the Invention

The present invention relates to and has industrial utility in connection with quantum cryptography, and in particular relates to and has industrial utility with respect to quantum-enhanced secret sharing (QESS).

Background Art

Splitting a secret message in a way that a single person is not able to reconstruct it is a common task in information processing, especially for high- security applications. A solution to this problem and its generalization including several variations is provided by classical cryptography and is called "secret sharing." Classical secret sharing involves splitting a message using mathematical algorithms and distributing the pieces to two or more legitimate users via classical communication. However, all classical communication systems are susceptible to eavesdropping attacks, which makes the secret vulnerable to unauthorized disclosure to unintended recipients.

Quantum cryptography systems exploit the quantum nature of particles to create an unconditionally secure communication system. Quantum cryptography systems that rely on multi-particle entanglement have been proposed for "quantum-enhanced secret sharing" or QESS. One protocol for QESS involves a shared Greenberger-Home-Zeilinger (GHZ) state that allows for both information splitting and eavesdropper protection simultaneously. However, the protocol relies on multi-photon states, and the lack of suitable multi-photon sources has stood in the way of an experimental demonstration of this approach to QESS. Accordingly, only the principal feasibility of an experimental realization of QESS using entangled multi-photon states has been demonstrated.

The current state of the art for generating the entangled multi-photon states required for multi-party protocols like QESS is four, thus significantly limiting the number of recipients to three. The needed laser and optics system, however, is far from being practical for real-world use. The principle of QESS relies on the particular correlations between the results observed in measurements of the entangled particles. Standard QESS protocol

A standard protocol for QESS begins with the generation of an entangled state of N particles. Next, the N particles are distributed to the sender of the secret and to N-I recipients. It is assumed that the N particles are in the GHZ state given by:

|ψ) = -Uoo ...o) ₊ |n ... i)) v z where |θθ...θ) stands for "all TV particles are in the state 0", and |l l...l) stands for

"all N particles are in the 1 state." The sender and the recipients perform measurements on their particles according to the dichotomic observable defined by the eigenstates

for preselected parameters ^, giving two possible results, k, = +1, -1. According to quantum mechanics, the conditional probability P for a particular realization of results k, depending on the chosen parameters φ_i is given by:

Based on the above, a possible scenario involves using polarized photons as quantum particles. The generic states|θ), |l) translate to the states | V), | H) denoting vertical (V) and horizontal (H) polarization, respectively. The photons are generated in the state

Ψ ) = -γ=§W ...V ) + \ HH ... H)) V 2

The photons are then distributed, one to the sender and to each of the receivers. The preselected parameter determines the orientation of the polarisation measurement. Preferred values are ^ =O₁ corresponding to a measurement along 45° linear polarisation, and φ - π /2 corresponding to a measurement of circular polarisation. The partners measure according to the randomly selected parameters. The partners i = 1... N will observe the result k,. If the sum of all the preselected parameters φ_: equals 0,2π, ...2nπ, the

N product of results equals Y[Jc₁ = 1 and is said to be "correlated", while if the sum

J=I of all the preselected parameters equals 0,π, ...(2n+l)π, the product of results

N equals Y[Jc₁ = -l and is said to be "anti-correlated." If the sum of all the

(=1 parameters is not an integer multiple of7r , the data are not considered any further, and the protocol starts from the beginning again. In order to decide which run of the protocol leads to correlated or anti-correlated results, each party (including the sender) announces the chosen value of φ_t- but keeps the observed result Jc₁ secret.

Since the product of the results is known, the result of the sender makes up the secret bit, which can be reproduced by the N-I partners only by the cooperation of all of them. The procedure is repeated several times until the desired amount of bits is established. The security of the protocol is tested by publicly comparing the measurement results of randomly selected runs. Any eavesdropping attack causes errors and deviations from the quantum mechanical prediction.

The main drawback of the above-described QESS scheme lies in the daunting technical requirements for the generation, distribution and detection of the desired entangled multi-particle quantum state. Although photons seem to be, in principle, the most preferable quantum system for cryptographic communication tasks like QESS, it remains a daunting technological challenge to generate the required quantum states for more than two photons, as mentioned above. This is why only a maximum of four entangled photons have been observed in experimental demonstrations, restricting the number of recipients in a QESS system to three.

Moreover the distribution of these entangled multi-photon states is limited in practice to a few tens of centimetres, and an extension to realistic distances of at least a few meters (say, to separate rooms) introduces further intolerable losses. Current single-photon detectors have a limited efficiency. As each of the photons has to be detected, the number of successful runs decreases exponentially with the number of partners. The yield of entangled multi-photon states in present-day runs is approximately 1 per second. The very high price of the necessary laser system and optics (~€ 250,000), as well as the additionally needed maintenance, makes the above-described scheme for QESS unattractive for practical use, not to mention for commercial applications.

Description of the Invention

The present invention is a QESS system and protocol that requires only the transmission of a single quantum particle. Because the QESS system and protocol requires only a single particle, it is much more scalable with respect to the number of participating parties ("recipients") than prior art QESS approaches. The ability to perform QESS with a single particle tremendously reduces the technical requirements and costs for a QESS system. Possible attacks by an eavesdropper are discoverable before the secret code is used. Thus, it is guaranteed that no eavesdropper can gain access to the secret and no authorized recipient can gain advantage over the others.

Brief Description of the Drawing

Figure 1 is a schematic diagram of an example embodiment of the single- particle QESS system of the present invention.

The various elements depicted in the drawing are merely representational and are not necessarily drawn to scale. Certain sections thereof may be exaggerated, while others may be minimized. The drawing is intended to illustrate an example embodiment of the invention that can be understood and appropriately carried out by those of ordinary skill in the art.

In Figure 1 , like elements are identified by like reference numbers or symbols when convenient. Also, the polarization directions shown in Figure 1 and discussed below are selected for the sake of convenience and one skilled in the art will recognize that other polarization directions are possible. Detailed Description of the Best Mode of the Invention

In the description below, the QESS protocol of the present is described, followed by a description of an example embodiment of a QESS system that employs the protocol.

The protocol

Consider (N+ 1) parties where one of them, called the sender or "distributor" D, wants to distribute a bit value among the remaining (N) persons ("recipients") R₁ (where j = 1 to N) in a way that only if all (N) recipients are working together they are able to infer the bit value of the distributor. In order to accomplish this task, they use a single two-level quantum system, in the following referred to as "qubit".

The distributor D randomly prepares a qubit in one of the four states of two mutually orthogonal bases x and y, i.e.:

± >> =^(|o> ±|i» Eq- (¹ A)

±j;) = -jL(|θ)±i|l» Eq. (1B)

Note that these states are of the form

l± «>, - ^O^θ>+ β'" lθ) Eq^{. (}2⁾ where φ_d is chosen (typically, by the distributor D) to have one out of the four values { 0, π, π/2, 3π/2 }.

The qubit is thus prepared in a suitable initial state

The generation and preparation takes place at some arbitrary location, i.e. either at the distributor, at one of the recipients, or at some independent other location. From there the particle is sent to all participants, i.e. to (or from) the distributor D and to the recipients R₁, (or simply handed over by one to the other). During the transmission, the distributor D and each of the recipients R₁ perform a unitary transformation on the quantum state of the qubit, represented mathematically as

This transformation is determined by the randomly preselected parameter

π 3π

W) 0, π , — , Eq. (4)

^J 1 2 2

The value for this parameter is chosen out of at least two possible sets. Each set contains two values of φ_} that encode corresponding logical values (e.g., 0 and 1), and their application results in two mutually orthogonal quantum states. The final state of the qubit is given by:

U>, - -ir(l»>⁺ e""^*Σ'"'|ⁱ>) ^Eq- ^(S)

and is measured either at the location of the last participant receiving the particle, or at some other location. If the final measurement is based on one of for possible bases, then the result of the measurement k , (Jc = ±l) is publicly announced. If it is based only two possible bases, then the result of the measurement is kept secret.

After this communication stage, each participant (that is, distributor D and all of the recipients RJ) divides his action (i.e., encoding) for every run into two encoding classes: an encoding class X and an encoding class Y that respectively correspond to the choices:

φ )_j e {0, π } Eq. (6A)

Following this classification, each receiver R, informs the distributor D about the encoding class used to encode each qubit for each run. Note that each keeps secret the particular value of φ,.

In an example embodiment, the order in which the recipients R_j announce the encoding class used is randomly determined by the distributor. The random announcement order avoids privileging a certain receiver by assigning him/her a fixed place in the announcement order. Imagine, for example, if one of the parties would like to manipulate the run of the protocol for whatever reason. It is then harder for him/her to do so if he/she does not know when it their turn to announce his/her result. For example, if the same announcement order were kept, the last receiver is the first to hear all the results of the others. He/she could then lie to the others about his/her value and he/she would be the only one who knows the secret correctly. Also, during the announcement of the classes, he/she could, as he is the last receiver, decide whether the run should be considered as valid or not.

The last (N*'¹) recipient R_N finally measures the received qubit in the x basis. As mentioned above, in an example embodiment where the last recipient R_N measures using only two bases φ_N = 0 or φ_N = π/2, he/she can keep the outcome JC_N of the measurement secret.

The probability p₊ that the last recipient R_N detects a state + x) is given by:

whereas the probability^, of detecting the state |- x) is given by: Eq. (8)

The expectation value A of the resulting measurement is given by:

A(φ_d , φ_v...φ_N ) = p₊ - p_ = cos(>_rf + ∑ φ _;) Eq. (9) y=i

From the broadcasted class affiliations of all introduced encodings (e.g., phase shifts) φ_Jt the distributor D is able to decide which runs lead to perfect correlation and anti-correlation, i.e., when

which is the result obtained in half of the runs and which constitutes a valid run VR of the protocol. While an example embodiment of the invention includes using only runs that result in either a correlation or an anti-correlation (but not both), this approach cuts down the number of valid runs by Vz for a given number of qubit distributions. Thus, the preferred embodiment uses both correlation and anti-correlation as indicated by Eq. 10.

For each of the valid runs VR, each recipient R_j is able to infer the distributor's choice of ψ_d if and only if he/she knows the choice of ψ_j of the other recipients. Consequently, the collaboration of all of the recipients is necessary to deduce the shared secret message (information).

By associating the particular values of φ_d with different logical values such as "0" and "1", say, e.g.,

^ e j o. y U o Eq. (11A)

and

the parties are able to collaborate to deduce the contents of the encoded bit string. This is possible because the required correlations based on local manipulation of relative phases can be established by communicating a single qubit instead of employing the prior art approach that requires using multiple qubits of the GHZ-type state as described above. In an example embodiment, the secret information constitutes a key, wherein each recipient only knows his or her part of the key, and the entire key is only known upon each receiver sharing their (true) encoding information with the others.

Protocol security

To ensure the security of the protocol against eavesdropping or cheating, the distributor D arbitrarily selects a certain number of particular valid runs. The number of runs selected depends on the degree of security verification desired. For this selected subset of runs, the correlations are publicly compared, again in a random order of the recipients. The public comparison reveals any intercept/resend eavesdropping or cheating strategy with the probability going exponentially fast to 1 with respect to the size of the selected subset.

This can be seen as follows. Imagine, for instance, the first recipient R₁ tries to infer the secret without the help or authorization of the other participants by measuring the qubit sent by the distributor before acting on the qubit with CX₁Op₁) and afterwards sending it ahead to the second recipient R₂. For convenience, it is assumed that R₁ chooses for this measurement one of the protocol bases x ory. As the distributor D randomly applies one of four different phase shifts, the probability that the initial state

is an eigenstate of the measurement chosen by R₁ is Vz. In the other half of the cases, the measurement result of Ri will be completely random because it holds that

\(± y\ ± x}\

= l/2. Eq. (12) This means that recipient R₁ gets no information about the distributor's choice of øtø. Furthermore, such cheating will cause an overall error of 25% in the correlations. This is because if Ri chooses the wrong basis, the final state of the qubit after all (N+l) introduced phase shifts is given by:

χ ) _r = V^ o> + e >-> i > Eq. (13)

This state, when measured by the last recipient R_N, gives with probability VT. a result that is incompatible with the expected correlations. An eavesdropper employing the same strategy is faced with the same situation.

The security of the QESS protocol of the present invention has its basis in the proven security of the well-known BB84 protocol y. Each communication step between two successive participants in the QESS protocol corresponds to the BB84 protocol with bases x and y. From this fact, it follows that using these bases for an intercept/resend strategy is already the optimal one concerning information gain on the valid run.

An eavesdropper might consider an intercept/resend strategy that employs the intermediate Breidbart bases, defined as:

± b) ) Eq. (14)

which gives an eavesdropper maximum information on all exchanged qubits. However, even using these intermediate bases, the error rate necessarily goes up to 25%.

Example realization

Any single-particle quantum system can be used to implement the protocol of the present invention. For example, one can define two states of a single quantum particle to represent a qubit of quantum information, wherein the required state manipulations can be performed, and wherein each qubit can be prepared and measured in these states and in superpositions tnereoT, ana wherein the qubits can be transported between the participants efficiently and with minimum decoherence.

An example embodiment of a preferred realization of the new protocol uses single photons as the single-particle quantum systems (qubits). In an example embodiment, the photons are generated in the process of triggered parametric down conversion. Alternatively, strongly attenuated light pulses can be used. Similar to quantum cryptography, free-space or optical fiber quantum channels can be used to optically couple the parties (i.e., the distributor and the recipients).

In an example embodiment, information is encoded in the photon's internal degrees of freedom, namely the polarization. The photon is prepared in the initial state

\ %), = ^ H) ₊ ]V)), Eq. (15)

where | H) and | V) denote the state of horizontal (H) and vertical (V) polarization of the photon respectively. As the photon is passing all participants each is acting on it according to the unitary transformation:

This is accomplished, for example, using a birefringent plate that changes the phase of the vertical polarization component.

Finally, the polarization of the photon is measured, e.g., along the 457-45° direction

(| 45 °> = -^(\ H ) ₊ \V )} I - 45 ° ) = -±= (\ H ) - \ V ))) Eq. (17) and detected by a single-photon detector (SPD). The two sets of preselected

parameters are given by the values {θ,π} and \— ,— L The rest of the protocol

is performed as discussed above in order to obtain a secure shared secret.

QESS system

FIG. 1 is a schematic diagram of an example embodiment of a single- particle QESS system 10 according to the present invention. QESS system 10 includes a distribution unit ("distributor") D and a number of recipients R₁ through R₅. Distributor D includes a single-photon source (SPS) 16. In an example embodiment, SPS 16 is a heralded photon source that employs spontaneous parametric downconversion (SPDC). In an example embodiment, SPS 16 includes a pump light source 20 that emits a pump light beam 22 and that optically coupled to a non-linear optical medium 30. Pump light source 20 and non-linear medium 30 lie along an optical axis A1. In an example embodiment, pump light source 20 is a single-mode diode laser outputting pump light beam 22 at a wavelength of 402.5 nm at an optical power of -10 mW, and non-linear optical medium 30 is a non-linear optical crystal such as a β-barium borate (BBO) crystal.

SPS 16 also includes an absorber 40 arranged adjacent non-linear optical medium along axis A1 on the opposite pump light source 20 to absorb the portion of pump light beam 22 that passes directly through the non-linear medium. SPS 16 further includes a mirror M1 arranged downstream of and optically coupled non-linear optical medium 30, Mirror M1 is arranged opposite pump light source 20, but not along axis A1 , so that it can receive and reflect photons generated in non-linear optical medium 30, as explained below. Mirror M1 is optically coupled to an SPD DT along a second optical axis A2. SPD DT serves as a "trigger" detector, as explained below. In an example embodiment, SPD DT is or includes a passively quenched silicon avalanche photodiode (Si-APD). SPS 16 also includes a vertical polarizer PD arranged between mirror M1 and SPD DT along optical axis A2. Distributor D further includes an adjustable polarizer PO arranged downstream of non-linear optical medium 30 along an optical axis A3. In an example embodiment, adjustable polarizer PO is a motorized half-wave plate adapted to provide select polarizations (e.g., 0°, 45°, 22.5° and -22.5°) relative to a reference (e.g., horizontal) polarization direction. In another example embodiment, adjustable polarizer is a fast electro-optical phase modulator. Adjustable polarizer PO is operably coupled to a random number generator (RNG) drive unit UO adapted to randomly change the polarization to one of the allowable polarization states. A quarter-wave plate 66 is arranged downstream of adjustable polarizer PO. Distributor 12 also includes a controller CO operably coupled to pump light source 20, RNG drive unit UO and to SPD DT. Controller CO is adapted to control the operation of these elements as described below.

Recipients R₁ through R₅ reside downstream of distributor D along optical axis A3, with recipient R₁ optically coupled to the distributor. In an example embodiment, optical coupling distributor D and between adjacent recipients R₁ through R₅ is accomplished via respective optical fiber sections F1 through F5. Each recipient R₁ through R₅ respectively includes an adjustable polarizer P1 through P5, which are operatively coupled to respective RNG drive units U1 through U5. Each RNG drive unit in turn is operably coupled to a corresponding controller unit C1 though C5 adapted to control the operation of the connected RNG drive unit and record the polarization states of the associated adjustable polarizers as caused by the corresponding RNG drive unit. To synchronize the operation of the distributor and the recipients, and to allow the participants to communicate with one another, a communication link 70 operably connects controllers CO through C5. In an example embodiment, communication link 70 carries a synchronization channel with associated sync signals SS as well as a communication channel with communication signals SC.

In an example embodiment of QESS system 10, a dispersion compensator 80 is arranged downstream of adjustable polarizer R₅ and is adapted to compensate for dispersion effects experienced by light travelling from distributor D to the various recipients R,-. In an example embodiment, dispersion compensator 80 is or includes a birefringent crystal, such as the same crystals used in example embodiments of adjustable polarizers P1 through P5.

QESS system 10 further includes encoded-state analyzer 86 downstream of dispersion compensator 80. In the example embodiment of Figure 1 , polarization encoding is used and encoded-state analyzer 86 is a polarization- state analyzer that includes a half-wave plate 92 arranged, for example, at 22.5°, followed by a polarizing beam-splitter (PBS) 94 having two output ports 96A and 96B. A first SPD DA is optically coupled to output port 96A and a second SPD DB is optically coupled to output port 96B. In an example embodiment, SPDs DA and DB are or include passively quenched silicon avalanche photodiodes (Si- APDs).

In an example embodiment, adjustable polarizers P1 through P5 are or include birefringent uniaxial crystals, such as a Yttrium Vanadate (YVO₄), with their optic axes lying parallel to the polarizer surface and aligned such that horizontal (H) and vertical (F) polarization states correspond to their normal modes. Rotation of the crystals along their optic axis for a certain angle as caused by the associated RNG drive unit imparts a specific relative phase shift to a photon passing therethrough that is independent of the incoming polarization state of the photon. In another example embodiment, adjustable polarizers P1 through P5 are high-speed electro-optical phase modulators.

Method of operation of the example QESS system

With continuing reference to FIG. 1 , in the operation of example QESS system 10, controller CO activates pump light source 20 with an initialization signal Sl. In response thereto, pump light source 20 generates pump light beam 22, which is incident upon and travels through non-linear optical medium 30. In response to pump light beam 22, non-linear optical medium 30 generates two orthogonally polarized entangled photons γ1 and γ2. In an example embodiment, type Il phase matching is used to generate photons γ1 and γ2 at a wavelength λ = 805 nm (Δλ ~ 6 nm). The remaining part of pump light beam 22 that makes it through non-linear optical medium 30 is absorbed by absorber 40. One of the photons — say γ1 — is directed to mirror M1 , which is arranged to receive this photon and reflect it along axis A2 so that it passes through vertical polarizer PD and is detected by trigger SPD DT. This polarization and detection process heralds the existence of the other photon γ2 used to carry out the protocol. Also, because the two photons are strongly time-correlated, the process allows for synchronizing the operation of the system and also ensures that only initially horizontally polarized photons can lead to a coincidence detection at encoded-state analyzer 86, as discussed further below.

Second photon γ2, which is heralded by the detection of first γ1 at trigger SPD DT, proceeds through adjustable polarizer PO, which is driven by RNG drive unit UO activated by a control signal SO from controller CO. Second photon then travels through quarter-wave plate 66 arranged at an angle of 45° with respect to vertical. In response to control signal SO, RNG drive unit UO sends a signal SUO to adjustable polarizer PO. Signal SUO is representative of one of the allowed polarizations states, e.g., 0°, 45°, 22.5° and -22.5°. The action of adjustable polarizer PO and quarter-wave plate 66 places the horizontally polarized photons γ2 to one of the four possible states | + y) and | ± x) , which correspond to

—,-— \ and φ_d e {θ, ^ } , respectively. 1 Z )

The polarization state imparted ("encoded") to photon γ2 is stored in controller CO. Controller CO also sends out over communication link 70 a synchronization ("sync") signal SS over the synchronization channel to controllers C1 through C5. The timing of sync signal SS based on the detection of detector signal ST from trigger detector DT, since photons γ1 and γ2 are strongly time-correlated.

Photon γ2 then travels from distributor D to adjustable polarizer P1 of first recipient R₁. Controller C1 sends out a timed control signal S1 in response to sync signal SS. Signal S1 activates RNG driver U1 , which in response thereto sends a signal SU 1 to adjustable polarizer P1 that is representative of one of the allowed polarizations states, e.g., 0°, 45°, 22.5° and -22.5°. This further transforms the polarization state of photon γ2. The imparted polarization state is recorded in controller C1. This process is repeated as the photon passes through each of the adjustable polarizers for each of the recipients. After being transformed by adjustable polarizer P5 of recipient R5, the final polarization state of photon γ2 is measured by polarization state detector 86.

In an example embodiment, the measurement of the encoded qubit is recorded in controller C5. It is assumed here that recipient R₅ need only randomly select from the set of encoding polarizations {0, π/2} and thus keeps this last measurement secret. In an example embodiment, encoded-state analyzer 86 is part of the last recipient (here, recipient R₅).

The above process is repeated for a number (e.g., thousands) of photons γ2 distributed per above, and the protocol as described above is carried out to identify valid runs VR (i.e., runs that lead to correlation or anti-correlation) and to share encoding information among all the recipients to establish the shared secret.

In an example embodiment, the distributor D sends non-randomly encoded photons to the receivers, but this approach is less secure. Therefore the preferable choice is for the distributor to use random settings. This is because any kind of quantum cryptographic scheme is secure against eavesdropping because it reveals the presence of an eavesdropper. But even in quantum cryptography, an eavesdropper is able to gain information about the transmission. As long as one just tries to establish a random bit sequence as a key for the encryption of the real message later on, such information leakage to the eavesdropper has no impact on the security. This is because the eavesdropper has gained only some information on some random bit sequence, and this information is not going to be used once the presence of an eavesdropper is discovered. The eavesdropper therefore cannot gain information about the actual message. This situation changes if one tries to transmit not just random bits but some kind of predetermined information. In the case where the distributor U sends non-randomiy encoαeα pamcies, then the announcement order of the receivers is preferably fixed in reconstructing the shared secret.

Results using an example QESS system

The inventors used the above-described QESS system 10 with a distributor and five recipients, as shown in Figure 1 , to established a secret message (key) between the parties. Light source 16 was a single-mode blue laser diode operating at 402.5 nm, non-linear medium 30 was a 2 mm (axially) long BBO crystal, and type Il phase matching (degenerate case) was used to create entangled pairs of photons γ1 and γ2 of wavelength λ = 805 nm with a bandwidth of Δλ ~ 6 nm. Adjustable polarizers were formed from motorized half- wave plates formed from uniaxial Yttrium Vanadate (YVO4) with an axial thickness of 200 μm, with the optic axes arranged so that rotation of the half- wave plates imparted a relative phase shift to photons γ2 regardless of their polarization state. Dispersion compensator 80 was formed from a YVO4 crystal of 1000 μm thick. Polarization state analyzer 86 was as shown in Figure 1 , with SPDs DA and DB being passively quenched silicon avalanche photodiodes with an efficiency of ~ 35%.

The protocol was repeated a number of times ZTOTAL = 25,000. Each "run" involved adjusting adjustable polarizers PO through P5 by rotating the crystalline half-wave plates and opening SPDs DT and DA and DB for a collection time window T = 200 μs, so that one run took ~ 1 second. The RNG drive units randomly drove the corresponding half-wave plates of the adjustable polarizers to one of four positions corresponding to one of four possible phase shifts. Coincident detection between trigger SPD DT and SPDs SA and SB within a select time window (e.g., 4 ns) confirms communication of a single photon γ2 only. For this coincidence time window and single-count rates of about 7000 s-1 in SPDs DA and DB, accidental coincidences were negligible.

Out of ZT_OTAL, only ZONE = 9125 times was a single photon detected at trigger SPD DT within the time window T due to Poissonian photon counting statistics. Of these runs, a coincident detection happened ZRA_W = 2107 times, which provided a raw key. From the raw key, a number ZVAL = 982 of valid runs VR were extracted with either complete correlation (+1) or anti-correlation (-1). Of these, 506 runs had a +1 correlation and 476 runs had a -1 anti-correlation. The quantum bit-error rate (QBER) was determined to be 2.34% ± 0.48%.

Simulation of an eavesdropping attack

A simulated eavesdropping attack was performed on the example single- particle QESS system as described immediately above. An intercept/resend eavesdropping attack was simulated by inserting a polarizer between distributor 12 and first recipient R1. The attack was performed in the protocol bases |+x) and \± y) well as in the intermediate (Breidbart) bases|± δ) , described above.

For the intermediate bases, the polarizer was additionally sandwiched by two quarter-wave plates. The angular settings for these quarter-wave plates were {45°, 0°, -45°} and {-45°, 22.5° and 45°}. For every choice of the basis, the QBER rose by at least 25%, thereby blowing the eavesdropper's cover. Table 1 below summarizes the results of the eavesdropping simulation for the protocol and intermediate bases.

Claims

What is claimed is:

1. A method of quantum-enhanced secret sharing, comprising: preparing at a distributor D single-particle qubits in one of a number of initial encoded states that correspond to initial logical values; distributing the qubits from the distributor to a number of recipients i?wthat each randomly encodes each qubit; measuring the final encoded state of each qubit and determining which distributions of qubits lead to valid runs associated with a correlated and/or anti- correlated measurement; and for each valid run, sharing among all the recipients the encoding imparted to each qubit by each recipient so as to establish the initial logical value of each qubit.

2. The method of claim 1 , wherein the qubit is a photon and the encoding is polarization encoding.

3. The method of claim 2, wherein the polarization encoding includes imparting a phase randomly selected from a set of encoding phases.

4. The method of claim 3, wherein the set of encoding phases consists of the phases {0, π/2, π, 3π/2}.

5. The method of claim 5, wherein the phases {0, π/2} are associated with a first logical value and the phases {π, 3π/2} are associated with a second logical value.

6. The method of claim 1 , including checking security of the qubit distribution by examining a qubit error rate (QBER) associated with a subset of the valid runs.

7. The method of claim 1 , wherein the encoding is based on four possible states and including: classifying the encoding into two encoding classes eacn having two different states of the four possible states; and for each qubit distribution, each receiver informing the distributor of the encoding class used for the encoding of the qubit.

8. The method of claim 7, wherein the recipients include a last recipient, and further including: the last recipient encoding the qubit by randomly selecting only one state in each encoding class; and measuring the final encoded state of the qubit in a select basis; and sharing the result of the measurement with the distributor.

9. The method of claim 7, wherein the recipients include a last recipient, and further including: the last recipient encoding the qubit by randomly selecting only one state in each encoding class out of two possible states; measuring the final encoded state of the qubit in a select basis; and keeping the result of the measurement secret.

10. The method of claim 1 , including generating entangled pairs of first and second photons, with the first photon serving as the qubit and the second photon heralding the existence of the first photon and establishing synchronization of the qubit encoding by the recipients.

11. The method of claim 10, including performing a coincidence detection between the second photon and the first photon as the encoded qubit, to verify the distribution and subsequent measurement of the encoded qubit

12. An apparatus for performing single-particle quantum-enhanced secret sharing (QESS), comprising:

A distributor adapted to initially randomly encode and distribute single- particle qubits;

A plurality of sequentially optically coupled receivers, including a first and last receiver, with the first receiver is optically coupled to the distributor, and wherein each receiver is adapted to receive and encoαe eacn quoit wiin an encoding state randomly selected from a set of encoding states; an encoded-state analyzer optically coupled to or incorporated into the last receiver and adapted to measure a final encoded qubit state so that the distributor can establish which qubit distributions lead to valid runs associated with correlated and/or anti-correlated measurements; and a communication link that operably couples the distributor, the receivers and the encoding-state analyzer to enable sharing encoding information so as to establish a commonly shared secret between the distributor and the receivers.

13. The QESS apparatus of claim 12, wherein the distributor includes a single-photon source based on parametric downconversion.

14. The QESS apparatus of claim 12, wherein the distributor and the recipients each include adjustable polarizers adapted to randomly phase modulate the qubits based on a set of phase-encoding states.

15. The QESS apparatus of claim 12, including a control system operably coupled to and adapted to control the timing of the encoding of each receiver and the encoded-state analyzer, and process encoding information from each receiver and the encoded-state analyzer to allow the distributor to determine which qubit distributions correspond to valid runs.