#  One-to-Many Simultaneous Secure Quantum Information Transmission

Theodore Andronikos1 and Alla Sirokofskich2

1 Department of Informatics, Ionian University,
7 Tsirigoti Square, 49100 Corfu, Greece;
<EMAIL_ADDRESS>
2 Department of History and Philosophy of Sciences,
National and Kapodistrian University of Athens,
Athens 15771, Greece;
<EMAIL_ADDRESS>
###### Abstract

This paper presents a new quantum protocol designed to simultaneously transmit
information from one source to many recipients. The proposed protocol, which
is based on the phenomenon of entanglement, is completely distributed and is
provably information-theoretically secure. Numerous existing quantum protocols
guarantee secure information communication between two parties but are not
amenable to generalization in situations where the source must transmit
information to two or more parties, so they must be applied sequentially two
or more times in such a setting. The main novelty of the new protocol is its
extensibility and generality to situations involving one party that must
simultaneously communicate different, in general, messages to an arbitrary
number of spatially distributed parties. This is achieved by the special way
employed to encode the transmitted information in the entangled state of the
system, one of the distinguishing features compared to previous protocols.
This protocol can prove expedient whenever an information broker, say, Alice,
must communicate distinct secret messages to her agents, all in different
geographical locations, in one go. Due to its relative complexity, compared to
similar cryptographic protocols, as it involves communication among $n$
parties, and relies on $\ket{GHZ_{n}}$ tuples, we provide an extensive and
detailed security analysis so as to prove that it is information-theoretically
secure. Finally, in terms of its implementation, the prevalent characteristic
of the proposed protocol is its uniformity and simplicity because it only
requires CNOT and Hadamard gates, and the local quantum circuits are identical
for all information recipients.

Keywords:: Quantum cryptography, quantum entanglement, quantum protocols, GHZ
states, information-theoretically secure, quantum games.

##  1 Introduction

In today’s world, advocating for the significance of privacy and security in
every facet of our lives as individuals hardly needs justification. Privacy is
not just a fundamental constitutional right but a cornerstone that demands
respect and safeguarding in all circumstances. This imperative has driven the
development and deployment of robust technical tools aimed at securing our
digital data. The pursuit of foolproof algorithms and protocols to protect our
privacy from unauthorized access stands as a prominent theme in current
research. However, this endeavor is far from simple, given that we’ve entered
a new scientific epoch, the quantum era, offering the potential of
unprecedented computational power. This untapped power introduces novel
algorithms that have the potential to compromise the security provided by
well-established classical methods. Two illustrative examples underscoring
this point are Shor’s algorithm [1] and Grover’s algorithm [2]. Shor’s
algorithm has the capability to factorize large numbers in polynomial time,
posing a practical threat to public key cryptosystems. Grover’s algorithm
accelerates unordered search tasks and may also be leveraged to attack
symmetric key cryptosystems like AES.

As of today, quantum computers with the potential to challenge the classical
status quo have not materialized. However, recent remarkable progress, as
exemplified by IBM’s 127-qubit Eagle processor [3] and the more recent
433-qubit Osprey processor [4], suggests that this may change sooner than
initially expected. It appears prudent, if not imperative, to enhance our
algorithms and protocols significantly before they become a vulnerability to
our security infrastructure. This tremendous effort has given rise to two new
scientific fields: post-quantum or quantum-resistant cryptography and quantum
cryptography. The former represents an evolutionary step from the current
state of affairs [5, 6, 7, 8], addressing security concerns by relying on
carefully chosen computationally challenging problems, an approach that has
proven effective thus far. The latter, quantum cryptography, capitalizes on
the laws of nature, such as entanglement, monogamy of entanglement, the no-
cloning theorem, and nonlocality, to establish unassailable security.

In our view, the long-term trajectory of cryptography inevitably leads to
quantum cryptography, which stands as a pivotal and contemporary research
focus. This transition arises from the overwhelming advantages offered by the
fundamental properties of quantum mechanics. These properties not only enable
the secure protection of information but also facilitate efficient information
transmission through the utilization of entangled states, as initially
proposed by Arthur Ekert [9]. Ekert’s groundbreaking E91 quantum key
distribution protocol (QKD) demonstrated the feasibility of key distribution
using EPR pairs. Following this seminal work by Ekert, the field of quantum
cryptography experienced a rapid proliferation of entanglement-based QKD
protocols [10, 11, 12, 13, 14, 15]. This proliferation has underscored the
significance of this approach and has spurred the research community to
further extend the field by exploring other cryptographic primitives, such as
quantum secret sharing. Quantum cryptography harnesses these unique and potent
quantum phenomena to design secure protocols for a wide array of critical
applications, including key distribution [16, 9, 11, 12, 13, 14, 15], secret
sharing [17, 18, 19], quantum teleportation [20], cloud storage [21, 22],
quantum Byzantine Agreement [23], and blockchain [24, 25, 26].

Another notable research direction in this field is Quantum Secure Direct
Communication (QSDC for short) that was initiated in [27]. The most important
characteristic of QSDC, which distinguishes it from standard key distribution
that establishes a common random key between two parties, is that QSDC
transmits information directly and without using an existing key. The
classical channel is employed only for detection purposes and not for
transmitting information necessary to decipher the secret message. The
intended recipient deciphers the secret information after receiving the
quantum states via the quantum channel. For a though and comprehensive review
of the current state of the field, we refer the reader to the recent [28]. In
a similar vein, the concept of Direct Secure Quantum Communication (DSQC) was
initially proposed and further pursued in [29, 30, 31] DSQC, also different
from quantum key distribution, is designed to transmit a secret message
directly without establishing in advance a shared random key to encrypt it.
The characteristic trait of DSQC is that in order to decode the secret
information, one additional classical bit is required for each qubit. We also
mention the important concept of Quantum Private Comparison (QPC), which
applies to situations where multiple users who do not trust each other want to
conduct secure multi-party computation and obtain the results without
revealing their private information. QPC allows all participants to obtain the
privacy comparison results at the same time, while ensuring that the privacy
information of each participant is confidential and cannot be stolen by other
participants. For more details, one may consult the recent [32] and references
therein.

In this work, we introduce a new entanglement-based protocol for one-to-many
simultaneous secure quantum information transmission, or OtMSQIT for short.
The characteristic property of the new protocol is its extensibility, as it
can be seamlessly generalized to an arbitrary number of entities. The protocol
is described as a quantum game, involving the usual suspect Alice. Although,
Alice’s agents are assumed too many to be named individually, in some small
scale examples they are referred to as the usual sidekicks Bob and Charlie. It
is expected that the pedagogical nature of games will make the presentation of
the technical concepts easier to follow. Quantum games, from their inception
in 1999 [33, 34], have known great acceptance since quantum strategies are
sometimes superior to classical ones [35, 36, 37]. The famous prisoners’
dilemma game provides such the most prominent example, which also applies to
other abstract quantum games [34, 38], which also applies to other abstract
quantum games [39]. The quantization of many classical systems can even apply
to political structures, as was shown in [40]. In the broader context of the
use of game-theoretic While on the subject of games on unconventional
environments, it is worth to point out that games in biological systems have
recently attracted significant attention [41, 42, 43]. It is interesting to
observe that biological systems may give rise to biostrategies superior
compared to the classical ones, even in the Prisoners’ Dilemma iconic game
[44, 45, 46, 47, 48].

Contribution. This paper presents a new quantum protocol designed to
simultaneously transmit information from one source to many recipients. The
proposed entanglement-based protocol is completely distributed and is provably
information-theoretically secure. Although there many quantum protocols that
achieve secure information communication between two parties, most of them are
not amenable to generalization to situations where the source must transmit
information to two or more recipients in parallel. The main novelty of the new
protocol is its extensibility and generality to situations involving one
source that must simultaneously communicate different, in general, messages to
an arbitrary number of spatially distributed parties. This is achieved by the
special way the transmitted information is embedded in the entangled state of
the system, one of the distinguishing features compared to previous protocols.
This protocol can prove expedient whenever an information broker, say, Alice,
must communicate distinct secret messages to a distributed network of agents
in one go. Due to its relative complexity, compared to similar cryptographic
protocols, as it involves communication among $n$ parties, and relies on
$\ket{GHZ_{n}}$ tuples, we provide an extensive and detailed security analysis
so as to prove that it is information-theoretically secure. In terms of the
capabilities of modern quantum apparatus, the implementation of the proposed
protocol does not present any difficulty because it only requires CNOT and
Hadamard gates. An additional advantage is that the local quantum circuits are
identical for all information recipients.

### Organization

The paper is organized as follows. Section 1 contains an introduction to the
subject along with bibliographic pointers to related works. Section 2 presents
the underlying machinery necessary for understanding the technicalities of the
protocol. Section 3 provides an analytical and rigorous exposition of the
proposed quantum protocol. Section 4 is devoted to the detailed security
analysis of the protocol, and, finally, Section 5 gives a brief summary of
this work, and outlines directions for future research.

##  2 Background & terminology

In the realm of quantum physics, one encounters peculiar hallmark properties
that defy classical physics and challenge our everyday intuition. One of the
prime examples of this strangeness is entanglement, a phenomenon that not only
bewilders but also holds immense potential for accomplishing feats that are
difficult or even impossible in the classical world. Entanglement arises in
composite quantum systems, typically composed of at least two subsystems,
often situated at separate locations. From a mathematical standpoint, a
composite system is considered entangled when its state can only be described
as a linear combination of two or more product states involving its
subsystems. One of the remarkable advantages of quantum entanglement is that
when a measurement is performed on one qubit of an entangled pair or tuple,
the other qubit(s) instantaneously collapse(s) to the corresponding basis
state in the product, regardless of the physical distance separating them. It
is precisely this celebrated characteristic of quantum entanglement that finds
application in various quantum cryptographic protocols, such as key
distribution and secret sharing, among others.

Arguably, the most well-known examples of maximal entanglement are pairs of
qubits in one of the four Bell states, also referred to as EPR pairs. For more
details, including their precise mathematical description, the interested
reader may consult any standard textbook, such as [49, 50, 51]. Fortunately,
maximal entanglement is generalized in the most straightforward and intuitive
way in the case of multipartite systems. Perhaps, the most celebrated form of
maximal entanglement encountered in composite systems consisting of $n$
qubits, where $n\geq 3$, is the $\ket{GHZ_{n}}$ state (GHZ are the initials of
the researchers Greenberger, Horne, and Zeilinger). In such a scenario, a
composite quantum system consists of $n$ individual qubits, possibly spatially
separated, with each qubit considered as a separate subsystem. All these $n$
qubits are entangled in the $\ket{GHZ_{n}}$ state, which is mathematically
described as follows:

$\displaystyle\ket{GHZ_{n}}=\frac{\ket{0}_{n-1}\ket{0}_{n-2}\dots\ket{0}_{0}+\ket{1}_{n-1}\ket{1}_{n-2}\dots\ket{1}_{0}}{\sqrt{2}}\
.$ (2.1)

In the previous formula (2.1), the subscript $i,\ 0\leq i\leq n-1$, designates
the $i^{th}$ individual qubit. Today, existing quantum computers can produce
arbitrary GHZ states using standard quantum gates such as the Hadamard and
CNOT gates. Moreover, the circuits that generate these states are very
efficient because they require $\lg n$ steps for the $\ket{GHZ_{n}}$ state
[52].

The protocol introduced in this work requires a more elaborate and general
distributed quantum system, in which each individual subsystem is not just a
single qubit, but a quantum register $r_{i}$, $0\leq i\leq n-1$, consisting of
$m$ qubits. In this respect, the defining property of this setting is that the
_corresponding_ qubits of all the $n$ registers are entangled in the
$\ket{GHZ_{n}}$ state. This is formalized by the following Definition 2.1.

######  Definition 2.1 (Entanglement Distribution Scheme).

The $(n,m)$ Symmetric Bit-wise Entanglement Distribution Scheme, denoted by
$SBEDS_{n,m}$, asserts the existence of $n$ spatially distributed quantum
registers $r_{0},r_{1},\dots,r_{n-1}$, each containing $m$ bits, satisfying
the property that for each $j,0\leq j\leq m-1$, the $n$ qubits occupying the
$j^{th}$ position of each register are entangled in the $\ket{GHZ_{n}}$ state.

As a result, the global state of the composite distributed system is expressed
by the next equation, proved in [19].

$\displaystyle\ket{GHZ_{n}}^{\otimes m}$
$\displaystyle=\frac{1}{\sqrt{2^{m}}}\sum_{\mathbf{x}\in\mathbb{B}^{m}}\ket{\mathbf{x}}_{n-1}\dots\ket{\mathbf{x}}_{0}\
.$ (2.2)

In the above equation (2.2), the following notation is employed.

  * •

$\mathbb{B}$ stands for $\\{0,1\\}$.

  * •

We follow the typical convention of writing bit vectors
$\mathbf{x}\in\mathbb{B}^{m}$ in boldface. A bit vector $\mathbf{x}$ of length
$m$ is simply a sequence of $m$ bits $\mathbf{x}=x_{m-1}\dots x_{0}$. In this
fashion, the zero bit vector is designated by $\mathbf{0}=0\dots 0$.

  * •

The notation $\mathbf{x}\in\mathbb{B}^{m}$ means that the bit vector
$\mathbf{x}$ ranges through all the $2^{m}$ bit vector representations of the
basis kets.

  * •

To avoid any possible confusion, we use again the indices $i,\ 0\leq i\leq
n-1$, to make clear that $\ket{\mathbf{x}}_{i}$ denotes the state of the
$i^{th}$ quantum register.

A visual depiction of this setup is given in Figure 1, where the corresponding
qubits comprising the $\ket{GHZ_{n}}$ $n$-tuple are drawn with the same color.
This composite system contains $mn$ distributed qubits in total because there
exist $m$ qubits in each of the $n$ registers. The registers are all assumed
to be in different geographic locations, but the entanglement effect due to
the $m$ $\ket{GHZ_{n}}$ $n$-tuples provides the necessary correlation that
enables us to view this as one, albeit distributed, system.

A distributed system consisting of $n$ spatially separated quantum registers
$r_{0},\dots,r_{n-1}$. Each register has $m$ qubits and the corresponding
qubits are entangled in the $\ket{GHZ_{n}}$ state. $\mathbf{r_{0}}$: –
$\ket{q_{m-1}}$ …$\ket{q_{1}}$ $\ket{q_{0}}$ $\mathbf{r_{1}}$: –
$\ket{q_{m-1}}$ …$\ket{q_{1}}$ $\ket{q_{0}}$ ……$\mathbf{r_{n-2}}$:
$\ket{q_{m-1}}$ …$\ket{q_{1}}$ $\ket{q_{0}}$ $\mathbf{r_{n-1}}$:
$\ket{q_{m-1}}$ …$\ket{q_{1}}$ $\ket{q_{0}}$ Figure 1: In the above figure,
qubits that belong to the same $\ket{GHZ_{n}}$ $n$-tuple are drawn with the
same color.

######  Example 2.1 (Alice, Bob & Charlie).

Let us consider a special case of the general setting, featuring the $3$
prolific players Alice, Bob, and Charlie. They are all in different
geographical locations, and they possess their own local quantum registers.
Moreover, each register contains $9$ qubits. According to the $SBEDS_{3,9}$
entanglement distribution scheme, there are nine triplets of qubits, and in
each triplet the qubits of are entangled in the $\ket{GHZ_{3}}$ state. The
resulting setting is shown in Figure 2. $\triangleleft$

Charlie $\phantom{-}8$ $\phantom{-}7$ $\phantom{--}6$ $\phantom{--}5$
$\phantom{--}4$ $\phantom{--}3$ $\phantom{--}2$ $\phantom{--}1$
$\phantom{--}0$ $\mathbf{r_{0}}$: Bob $\mathbf{r_{1}}$: Alice
$\mathbf{r_{2}}$:  Figure 2: This figure is a pictorial representation of the
setting outlined in this example. The $3$ spatially separated players, Alice,
Bob, and Charlie possess the $3$ quantum registers $\mathbf{r_{2}}$,
$\mathbf{r_{1}}$, and $\mathbf{r_{0}}$, respectively, each containing $9$
qubits. The $3$ qubits occupying the $j^{th}$ position of each register,
$0\leq j\leq 8$, are entangled in the $\ket{GHZ_{3}}$ state. To visually
indicate this fact, we have drawn the qubits of the same quadruple with the
same color.

In addition to $\ket{GHZ_{n}}$ tuples, our communication scheme makes use of
two other signature states, namely $\ket{+}$ and $\ket{-}$, defined as

$\displaystyle\ket{+}=H\ket{0}=\frac{\ket{0}+\ket{1}}{\sqrt{2}}$ (2.3)
$\displaystyle\ket{-}=H\ket{1}=\frac{\ket{0}-\ket{1}}{\sqrt{2}}$ (2.4)

During the formal mathematical analysis of the proposed protocol, it will be
necessary to apply the important and useful formula that expresses the
$m$-fold Hadamard transform of an arbitrary basis ket. This formula, proved in
most standard textbooks, such as [49] and [53], is given below.

$\displaystyle H^{\otimes m}\ket{\mathbf{x}}$
$\displaystyle=\frac{1}{\sqrt{2^{n}}}\sum_{\mathbf{z}\in\mathbb{B}^{m}}(-1)^{\mathbf{z\cdot
x}}\ket{\mathbf{z}}\ .$ (2.5)

In (2.5), the symbolism $\mathbf{x\cdot y}$ denotes the _inner product modulo_
$2$ operation. Given bit vectors $\mathbf{x},\mathbf{y}\in\mathbb{B}^{m}$,
with $\mathbf{x}=x_{m-1}\dots x_{0}$ and $\mathbf{y}=y_{m-1}\dots y_{0}$,
$\mathbf{x\cdot y}$ is defined as

$\displaystyle\mathbf{x\cdot y}$
$\displaystyle=x_{n-1}y_{n-1}\oplus\dots\oplus x_{0}y_{0}\ ,$ (2.6)

where $\oplus$ stands for _addition modulo_ $2$. The inner product modulo $2$
operation satisfies the following characteristic property. If
$\mathbf{c}\in\mathbb{B}^{m}$ is different from $\mathbf{0}$, then for half of
the elements $\mathbf{x}\in\mathbb{B}^{m}$, the result of the operation
$\mathbf{c}\cdot\mathbf{x}$ is $0$, and for the remaining half, the result of
the operation $\mathbf{c}\cdot\mathbf{x}$ is $1$. Obviously, if
$\mathbf{c}=\mathbf{0}$, then for all $\mathbf{x}\in\mathbb{B}^{m}$,
$\mathbf{c}\cdot\mathbf{x}=0$ (a more detailed analysis can be found in [19]).
For future reference, this property is referred to as the characteristic inner
product (CIP) property.

$\displaystyle\mathbf{c}=\mathbf{0}\Rightarrow\left\\{\text{for all
}2^{m}\text{ bit vectors }\mathbf{x}\in\mathbb{B}^{m},\text{
}\mathbf{c}\cdot\mathbf{x}=0\right\\}$
$\displaystyle\mathbf{c}\neq\mathbf{0}\Rightarrow\left\\{\begin{matrix}[l]\text{for
}2^{m-1}\text{ bit vectors }\mathbf{x}\in\mathbb{B}^{m},\
\mathbf{c}\cdot\mathbf{x}=0\\\ \text{for }2^{m-1}\text{ bit vectors
}\mathbf{x}\in\mathbb{B}^{m},\
\mathbf{c}\cdot\mathbf{x}=1\end{matrix}\right\\}$ (CIP)

As a final note, let us clarify that measurements are performed with respect
to the computational basis $\\{\ket{0},\ket{1}\\}$, unless otherwise
specified. During the implementation of our protocol, when performing the
first validation test, it will also be necessary to make measurements with
respect to the Hadamard basis $\\{\ket{+},\ket{-}\\}$. Whenever such an
occasion arises, it will be mentioned explicitly.

##  3 The One-to-Many Simultaneous Secure Quantum Information Transmission
Protocol

This section contains an in-depth presentation of the entanglement-based
protocol for the one-to-many simultaneous secure quantum information
transmission, abbreviated to OtMSQIT from now on. The presentation has the
form of a quantum game, involving $n$ players. One of them, is the famous
spymaster Alice, who must simultaneously communicate to each of her $n-1$
agents a secret message. In the general exposition of the game, we refer
collectively to the $n-1$ who remain anonymous. In the examples, where the
game is played by a small number of players, namely $3$ or $4$, Alice’s agents
are the equally prominent heroes Bod, Charlie, and Dave. The secret messages
are generally different for every agent, although it is conceivable that in
special cases all the messages are identical. The messages themselves may
encode secret commands, or encryption keys, or some other type of instruction.
Their exact purpose is not important; the crucial thing is that the whole
process be information-theoretically secure, so as to ensure that Eve, the
adversary who eavesdrops, will not obtain any secret information. The most Eve
can do is to obstruct the execution of the OtMSQIT protocol, but even in this
case, she will be detected and the protocol will be aborted before the final
decryption takes place. The envisioned situation is specified by the next
Definition 3.1.

######  Definition 3.1 (One to Many Simultaneous Secure Quantum Information
Transmission).

Consider the following situation.

  * •

Alice controls a network of $n-1$ agents: Agent0, …, Agentn-2. Alice and all
her agents reside in different geographical locations.

  * •

Alice must transmit to each of her agents a _personalized information bit
vector_ , abbreviated to PIV from now on, $\mathbf{i}_{k},\ 0\leq k\leq n-2$.

  * •

Time is of the essence, so, to speed things up, Alice wants the information
transmission to her agents to take place _simultaneously_ , in one go.

  * •

Given the PIVs $\mathbf{i}_{0},\dots,\mathbf{i}_{n-2}$, Alice constructs the
_aggregated information bit vector_ , AIV from now on, $\mathbf{i}$ as their
concatenation.

  * •

Most importantly, the communication must be _information-theoretically secure_
, so that her adversary, the eavesdropper Eve, can’t obtain any secret
information.

The task at hand is to come up with a quantum protocol that will provably
guarantee that Alice attains all the above goals.

Let us make some clarifications, to eliminate any possible misunderstanding.

  * •

Theoretically, the number $n$ of players is totally arbitrary, i.e., it may be
any large integer. The only conceivable limitation could be the ability of our
currently available apparatus to generate $\ket{GHZ_{n}}$ tuples when $n$ goes
beyond a certain limit.

  * •

Alice assigns a specific ordering to her network of agents. The position $i,\
0\leq i\leq n-2$, of each agent in this ordering is common knowledge, that is
Alice and all her agents know who is Agent0, …, Agentn-2.

  * •

In general, the PIVs are assumed to be of different lengths. This is more
realistic and flexible than assuming PIVs of the same length. Obviously, our
protocol can easily handle the special case where the information bit vectors
have a fixed length.

  * •

Alice communicates via the classical channel to all of her agents the length
of the AIV and the lengths $|\mathbf{i}_{0}|,\dots,|\mathbf{i}_{n-2}|$ of the
PIVs. This does not compromise secrecy because knowing the length of a secret
vector does not reveal its contents. We use the symbolism $|\cdot|$ to
designate the length, i.e., number of bits, of the enclosed bit vector.

We make the important remark that in the construction of the AIV, the order
with which PIVs are concatenated is in accordance with the ordering depicted
in Figure 1. This is because for consistency we adhere to the Qiskit [54]
convention in the ordering of qubits, by placing the least significant qubit
at the top of the figure and the most significant at the bottom. To rigorously
define the AIV, we must first define an auxiliary sequence of positive
integers as follows:

$\displaystyle m_{0}=|\mathbf{i}_{0}|,\
m_{1}=|\mathbf{i}_{1}|+|\mathbf{i}_{0}|,\dots,m_{n-3}=|\mathbf{i}_{n-3}|+\cdots+|\mathbf{i}_{0}|,\
m=|\mathbf{i}_{n-2}|+\cdots+|\mathbf{i}_{0}|\ ,$ (3.1)

which allows us to proceed to the following definition of the AIV
$\mathbf{i}$.

$\displaystyle\mathbf{i}=i_{m-1}\cdots i_{0}=\underbrace{i_{m-1}\cdots
i_{m_{n-3}}}_{\mathbf{i_{n-2}}}\ \underbrace{i_{m_{n-3-1}}\cdots
i_{m_{n-4}}}_{\mathbf{i}_{n-3}}\ \dots\underbrace{i_{m_{1}-1}\cdots
i_{m_{0}}}_{\mathbf{i}_{1}}\ \underbrace{i_{m_{0}-1}\cdots
i_{0}}_{\mathbf{i}_{0}}\ .$ (3.2)

From now on, and in accordance with the previous equation (3.2), we will use
$m$ to designate the length of the AIV.

###  3.1 Entanglement distribution & validation stage

It is helpful to describe the evolution of the OtMSQIT protocol in stages. The
first is the entanglement distribution & validation stage, during which the
following tasks take place.

  1. (EDV1)

Alice prepares a sequence of $m$ $\ket{GHZ_{n}}$ tuples, that is $mn$ qubits,
called the _information sequence_ IS, which will be used for the actual
transmission of the AIV.

  2. (EDV2)

Additionally, Alice prepares the _decoy sequence_ DS consisting of $d$
nonentangled $n$-tuples, called _decoy tuples_ , which will be used during the
first stage of the protocol for the _validation test_. In a decoy tuple, each
qubit is prepared in a state that is chosen randomly and with equal
probability from the states $\\{\ket{+},\ket{-}\\}$. It is important to
emphasize that each qubit of the decoy tuple is prepared independently of the
other qubits of the same tuple. Altogether, $dn$ decoy qubits will be prepared
in the Hadamard basis.

  3. (EDV3)

Assuming that in each $n$-tuple the qubits are numbered from $0$ (the least
significant) to $n-1$ (the most significant), Alice

     * $\diamond$

stores in her input register, denoted by $AIR$ in Figure 3, the $(n-1)^{th}$
qubit of each of the $m+d$ in total $n$-tuples, and

     * $\diamond$

sends to Agenti the $i^{th}$ qubit, $0\leq i\leq n-2$, of each of the $m+d$
tuples through the quantum channel. These qubits will populate Agenti’s input
register, designated by $IR_{i}$ in Figure 3. Overall, Alice prepares $(m+d)n$
qubits, and transmits $(m+d)(n-1)$ qubits to her agents, out of which the
$m(n-1)$ are information carriers and the $d(n-1)$ are decoys.

  4. (EDV4)

It is of critical importance that Alice inserts the decoy sequence randomly
and uniformly within the information sequence, using an appropriate
probability distribution. Obviously, Alice must keep track of the positions of
decoy tuples. Moreover, for each decoy tuple, Alice must record the states of
all of its qubits.

  5. (EDV5)

After the distribution of the $m+d$ tuples has been completed, Alice proceeds
to conduct the validation test, which is analyzed in detail in Section 4.
During this test, the $d$ decoy tuples are measured and consumed. If the
outcome of the test is deemed a success, Alice knows that her adversary Eve
did not manage to tamper with the distribution of the entangled qubits. Thus,
the OtMSQIT protocol can safely proceeds to the next stage, in which only the
$m$ $\ket{GHZ_{n}}$ tuples are used. If the outcome of the test considered a
failure, the execution of the protocol is aborted.

Let us point out that the case where the protocol is aborted indicates that
the security measures are not up to the task at hand. Hence, measures must be
taken to enhance security, before the process can start all over again. We
also emphasize that in the mathematical analysis of the OtMSQIT protocol and
the forthcoming figures, we have intentionally omitted the decoy tuples in
order to streamline and simplify the computation, and to avoid the
overcluttering of the figures. Of course, the utilization of these tuples in
the validation test is thoroughly explained in Section 4.

###  3.2 Secret embedding stage

During this stage the AIV is embedded into the entanglement. Alice, using her
local quantum circuit, will distribute the information she wants to
communicate to her agents into the entangled input registers. At this stage,
each input register contains $m$ qubits, since the $d$ decoy tuples have been
previously consumed. Alice and her $n-1$ agents, all in different geographical
locations, operate on their local quantum circuits. Alice’s circuit consists
of her input register $AIR$ with $m$ qubits and her output register $AOR$ with
just one qubit in the $\ket{-}$ state, upon which she acts via unitary
transforms. All agents have identical local circuits, comprised of the
$m$-qubit input registers $IR_{i},\ 0\leq i\leq n-2$, respectively, on which
they apply the $m$-fold Hadamard transform. Although the quantum input
registers are spatially separated, they constitute one composite distributed
quantum circuit because of the strong correlations among their qubits due to
the $SBEDS_{n,m}$ entanglement distribution scheme of Definition 2.1. The
whole setup is shown in Figure 3. Recall that all quantum circuits in this
paper follow the Qiskit [54] convention in the ordering of qubits, by placing
the least significant qubit at the top of the figure and the most significant
at the bottom.

⋮ Spatially Separated ⋮ Spatially Separated ⋮ Spatially Separated ⋮ Spatially
Separated
$IR_{0}$$IR_{n-2}$$AIR$$AOR$$\ket{-}$U${}_{f_{A}}$H⊗mH⊗mH⊗m$\ket{\mathbf{y}_{0}}$$\ket{\mathbf{y}_{n-2}}$$\ket{\mathbf{a}}$$\ket{\psi_{0}}$
$\ket{\psi_{1}}$$\ket{\psi_{2}}$$\ket{\psi_{f}}$Agent0 Agentn-2 Alice  Figure
3: The above figure shows the quantum circuits employed by Alice and her
agents. Although these circuits are spatially separated, they are correlated
due to entanglement and constitute a composite system. The state vectors
$\ket{\psi_{0}}$, $\ket{\psi_{1}}$, $\ket{\psi_{2}}$, and $\ket{\psi_{f}}$
describe the evolution of the distributed system.

The initial state of the distributed quantum circuit (consult Figure 3) is
denoted by $\ket{\psi_{0}}$. With the help of (2.2), $\ket{\psi_{0}}$ can be
written as

$\displaystyle\ket{\psi_{0}}=\frac{1}{\sqrt{2^{m}}}\sum_{\mathbf{x}\in\mathbb{B}^{m}}\ket{-}_{A}\ket{\mathbf{x}}_{A}\ket{\mathbf{x}}_{n-2}\dots\ket{\mathbf{x}}_{0}\
.$ (3.3)

Alice initiates the execution of the OtMSQIT protocol by acting on her local
input register $AIR$ via the unitary transform $U_{f_{A}}$. By doing so, she
embeds the secret information she intends to communicate to her $n-1$ agents
to the distributed circuit. The unitary transform $U_{f_{A}}$ is based on the
function $f_{A}$, which uses the AIV $\mathbf{i}$, as shown below

$\displaystyle f_{A}(\mathbf{x})$ $\displaystyle=\mathbf{i}\cdot\mathbf{x}\ .$
(3.4)

The unitary transform $U_{f_{A}}$ itself implements the ubiquitous scheme

$\displaystyle
U_{f_{A}}\colon\ket{y}_{A}\ket{\mathbf{x}}_{A}\rightarrow\ket{y\oplus
f_{A}(\mathbf{x})}_{A}\ket{\mathbf{x}}_{A}\ .$ (3.5)

By combining (3.4) and (3.5), $U_{f_{A}}$ can be explicitly written as

$\displaystyle
U_{f_{A}}\colon\ket{-}_{A}\ket{\mathbf{x}}_{A}\rightarrow(-1)^{\mathbf{i}\cdot\mathbf{x}}\
\ket{-}_{A}\ket{\mathbf{x}}_{A}\ .$ (3.6)

The action of the $U_{f_{A}}$ drives the system at the end of Phase 1 to state
$\ket{\psi_{1}}$:

$\displaystyle\ket{\psi_{1}}$
$\displaystyle=\frac{1}{\sqrt{2^{m}}}\sum_{\mathbf{x}\in\mathbb{B}^{m}}\left(U_{f_{A}}\ket{-}_{A}\ket{\mathbf{x}}_{A}\right)\
\ket{\mathbf{x}}_{n-2}\dots\ket{\mathbf{x}}_{0}$
$\displaystyle\overset{\eqref{eq: Explicit Alice's Unitary Transform
U_f_A}}{=}\frac{1}{\sqrt{2^{m}}}\sum_{\mathbf{x}\in\mathbb{B}^{m}}(-1)^{\mathbf{i}\cdot\mathbf{x}}\
\ket{-}_{A}\ket{\mathbf{x}}_{A}\ket{\mathbf{x}}_{n-2}\dots\ket{\mathbf{x}}_{0}\
.$ (3.7)

Therefore, at the end of Phase 1, the AIV is embedded in a distributed and
implicitly way in the state $\ket{\psi_{1}}$ of the distributed quantum
circuit. The next subsection describes the process by which it can be
deciphered by the players.

###  3.3 Decryption stage

The key ingredient in the decryption of the secret is the $m$-fold Hadamard
transform that all players apply to their input registers during Phase 2, as
visualized in Figure 3. Hence, at the end of Phase 2 the state of he system
has become $\ket{\psi_{2}}$:

$\displaystyle\ket{\psi_{2}}=\frac{1}{\sqrt{2^{m}}}\sum_{\mathbf{x}\in\mathbb{B}^{m}}(-1)^{\mathbf{i}\cdot\mathbf{x}}\
\ket{-}_{A}\ H^{\otimes m}\ket{\mathbf{x}}_{A}\ H^{\otimes
m}\ket{\mathbf{x}}_{n-2}\dots H^{\otimes m}\ket{\mathbf{x}}_{0}$ (3.8)

Using formula (2.5), $H^{\otimes m}\ket{\mathbf{x}}_{A}$, $H^{\otimes
m}\ket{\mathbf{x}}_{n-2}$, …, $H^{\otimes m}\ket{\mathbf{x}}_{0}$ can be
rewritten as shown below.

$\displaystyle H^{\otimes m}\ket{\mathbf{x}}_{A}$
$\displaystyle=\frac{1}{\sqrt{2^{m}}}\sum_{\mathbf{a}\in\mathbb{B}^{m}}(-1)^{\mathbf{a}\cdot\mathbf{x}}\ket{\mathbf{a}}_{A}$
$\displaystyle H^{\otimes m}\ket{\mathbf{x}}_{n-2}$
$\displaystyle=\frac{1}{\sqrt{2^{m}}}\sum_{\mathbf{y}_{n-2}\in\mathbb{B}^{m}}(-1)^{\mathbf{y}_{n-2}\cdot\mathbf{x}}\ket{\mathbf{y}_{n-2}}_{n-2}$
$\displaystyle\dots$ $\displaystyle H^{\otimes m}\ket{\mathbf{x}}_{0}$
$\displaystyle=\frac{1}{\sqrt{2^{m}}}\sum_{\mathbf{y}_{0}\in\mathbb{B}^{m}}(-1)^{\mathbf{y}_{0}\cdot\mathbf{x}}\ket{\mathbf{y}_{0}}_{0}$

This allows us to express as $\ket{\psi_{2}}$ as

$\displaystyle\ket{\psi_{2}}=\frac{1}{(\sqrt{2^{m})^{n+1}}}\sum_{\mathbf{a}\in\mathbb{B}^{m}}\sum_{\mathbf{y}_{n-2}\in\mathbb{B}^{m}}\dots\sum_{\mathbf{y}_{0}\in\mathbb{B}^{m}}\sum_{\mathbf{x}\in\mathbb{B}^{m}}(-1)^{(\mathbf{i}\oplus\mathbf{a}\oplus\mathbf{y}_{n-2}\oplus\dots\oplus\mathbf{y}_{0})\cdot\mathbf{x}}\ket{-}_{A}\ket{\mathbf{a}}_{A}\ket{\mathbf{y}_{n-2}}_{n-2}\dots\ket{\mathbf{y}_{0}}_{0}\
.$ (3.9)

At this point it is expedient to recall the characteristic inner product
property (CIP). This property implies that whenever
$\mathbf{i}\oplus\mathbf{a}\oplus\mathbf{y}_{n-2}\oplus\dots\oplus\mathbf{y}_{0}\neq\mathbf{0}$,
or, equivalently,
$\mathbf{a}\oplus\mathbf{y}_{n-2}\oplus\dots\oplus\mathbf{y}_{0}\neq\mathbf{i}$,
the sum $\sum_{\mathbf{x}\in\mathbb{B}^{m}}$
$(-1)^{(\mathbf{i}\oplus\mathbf{a}\oplus\mathbf{y}_{n-2}\oplus\dots\oplus\mathbf{y}_{0})\cdot\mathbf{x}}$
$\ket{-}_{A}$ $\ket{\mathbf{a}}_{A}$ $\ket{\mathbf{y}_{n-2}}_{n-2}$ $\dots$
$\ket{\mathbf{y}_{0}}_{0}$ in (3.9) is just $0$. In contrast, if
$\mathbf{i}\oplus\mathbf{a}\oplus\mathbf{y}_{n-2}\oplus\dots\oplus\mathbf{y}_{0}=\mathbf{0}$,
or, equivalently,
$\mathbf{a}\oplus\mathbf{y}_{n-2}\oplus\dots\oplus\mathbf{y}_{0}=\mathbf{i}$,
the sum $\sum_{\mathbf{x}\in\mathbb{B}^{m}}$
$(-1)^{(\mathbf{i}\oplus\mathbf{a}\oplus\mathbf{y}_{n-2}\oplus\dots\oplus\mathbf{y}_{0})\cdot\mathbf{x}}$
$\ket{-}_{A}$ $\ket{\mathbf{a}}_{A}$ $\ket{\mathbf{y}_{n-2}}_{n-2}$ $\dots$
$\ket{\mathbf{y}_{0}}_{0}$ is equal to $2^{m}$ $\ket{-}_{A}$
$\ket{\mathbf{a}}_{A}$ $\ket{\mathbf{y}_{n-2}}_{n-2}$ $\dots$
$\ket{\mathbf{y}_{0}}_{0}$. Thus, $\ket{\psi_{2}}$ can be cast in the
following reduced form:

$\displaystyle\ket{\psi_{2}}=\frac{1}{(\sqrt{2^{m})^{n-1}}}\sum_{\mathbf{a}\in\mathbb{B}^{m}}\sum_{\mathbf{y}_{n-2}\in\mathbb{B}^{m}}\dots\sum_{\mathbf{y}_{0}\in\mathbb{B}^{m}}\ket{-}_{A}\ket{\mathbf{a}}_{A}\ket{\mathbf{y}_{n-2}}_{n-2}\dots\ket{\mathbf{y}_{0}}_{0}\
,$ (3.10)

where

$\displaystyle\mathbf{a}\oplus\mathbf{y}_{n-2}\oplus\dots\oplus\mathbf{y}_{0}=\mathbf{i}\
.$ (3.11)

Following [19] and [55], we call equation (3.11) the Fundamental Correlation
Property that intertwines Alice and her agents’ input registers. This equation
has arisen due to the initial entanglement among all the input registers. At
the end of Phase 2, the AIV has been embedded in the global state of the
distributed quantum circuit and has manifest itself by imposing this
constraint upon the contents of the input registers.

Subsequently, Alice and her agents complete the quantum part of the OtMSQIT
Protocol by measuring the contents of their input registers in the
computational basis, and driving the system to its final state
$\ket{\psi_{f}}$.

$\displaystyle\ket{\psi_{f}}=\ket{-}_{A}\ket{\mathbf{a}}_{A}\ket{\mathbf{y}_{n-2}}_{n-2}\dots\ket{\mathbf{y}_{0}}_{0}\
,\text{ where
}\mathbf{a},\mathbf{y}_{n-2},\dots,\mathbf{y}_{0}\in\mathbb{B}^{m}\text{ and
}\mathbf{a}\oplus\mathbf{y}_{n-2}\oplus\dots\oplus\mathbf{y}_{0}=\mathbf{i}\
.$ (3.12)

We write the contents of Alice and her agents’ input registers explicitly as

$\displaystyle\mathbf{a}$ $\displaystyle=a_{m-1}\cdots a_{0}\ ,\text{ and }$
(3.13) $\displaystyle\mathbf{y}_{i}$ $\displaystyle=y_{m-1}^{i}\cdots
y_{0}^{i}\ ,\ 0\leq i\leq n-2\ .$ (3.14)

Accordingly, we may conceptually divide the AIV and each input register into
$n-1$ segments, so that corresponding segments are correlated to a PIV. We
employ the notation $\mathbf{i}^{j}$, $\mathbf{a}^{j}$, and
$\mathbf{y}_{i}^{j},\ 0\leq i,j\leq n-2$, to designate the $j^{th}$ segment of
the AIV, of Alice’s input register, and of Agenti’s input register,
respectively. The formal definition of segments, which is presented below,
relies on the sequence of positive numbers $m_{0},\dots,m_{n-3}$ that was
given in (3.1).

$\displaystyle\mathbf{i}^{0}=i_{m_{0}-1}\cdots i_{0}\ $
$\displaystyle,\quad\mathbf{i}^{j}=i_{m_{j}-1}\cdots i_{m_{j-1}}\ ,\ 1\leq
j\leq n-2\ ,$ (3.15) $\displaystyle\mathbf{a}^{0}=a_{m_{0}-1}\cdots a_{0}\ $
$\displaystyle,\quad\mathbf{a}^{j}=a_{m_{j}-1}\cdots a_{m_{j-1}}\ ,\ 1\leq
j\leq n-2\ ,\text{ and }$ (3.16)
$\displaystyle\mathbf{y}_{i}^{0}=y_{m_{0}-1}^{i}\cdots y_{0}^{i}\ $
$\displaystyle,\quad\mathbf{y}_{i}^{j}=y_{m_{j}-1}^{i}\cdots y_{m_{j-1}}^{i}\
,\ 0\leq i\leq n-2\ ,\ 1\leq j\leq n-2\ .$ (3.17)

In view of (3.15) – (3.17), we may rewrite (3.2), (3.13) and (3.14) as

$\displaystyle\mathbf{i}$ $\displaystyle=\underbrace{\mathbf{i}^{n-2}}_{\text{
segment }n-2}\underbrace{\mathbf{i}^{n-3}}_{\text{ segment
}n-3}\dots\underbrace{\mathbf{i}^{1}}_{\text{ segment
}1}\underbrace{\mathbf{i}^{0}}_{\text{ segment }0}\ ,$ (3.18)
$\displaystyle\mathbf{a}$ $\displaystyle=\underbrace{\mathbf{a}^{n-2}}_{\text{
segment }n-2}\underbrace{\mathbf{a}^{n-3}}_{\text{ segment
}n-3}\dots\underbrace{\mathbf{a}^{1}}_{\text{ segment
}1}\underbrace{\mathbf{a}^{0}}_{\text{ segment }0}\ ,\text{ and }$ (3.19)
$\displaystyle\mathbf{y}_{i}$
$\displaystyle=\underbrace{\mathbf{y}_{i}^{n-2}}_{\text{ segment
}n-2}\underbrace{\mathbf{y}_{i}^{n-3}}_{\text{ segment
}n-3}\dots\underbrace{\mathbf{y}_{i}^{1}}_{\text{ segment
}1}\underbrace{\mathbf{y}_{i}^{0}}_{\text{ segment }0}\ ,\ 0\leq i\leq n-2\ .$
(3.20)

By combining (3.2), (3.12), and (3.18) – (3.20), we conclude that

$\displaystyle\mathbf{a}^{j}\oplus\mathbf{y}_{n-2}^{j}\oplus\dots\oplus\mathbf{y}_{0}^{j}=\mathbf{i}^{j}=\mathbf{i}_{j}\
,\ 0\leq j\leq n-2\ .$ (SCP)

Equation (SCP) expresses the Fundamental Correlation Property among the $n-1$
segments, aptly named Segment Correlation Property. This property asserts that
by simply XOR-ing the $j^{th}$ segments of all the input registers, we can
recover the PIV $\mathbf{i}_{j}$.

From this point onward, the execution of the OtMSQIT protocol will utilize
only the classical channel. For the actual decryption the following
transmissions take place through the classical channel.

  1. (EV1)

Alice sends to every Agenti, $0\leq i\leq n-2$, the $i^{th}$ segment
$\mathbf{a}^{i}$ of her input register.

  2. (EV2)

Agenti, $0\leq i\leq n-2$, sends to every other Agentj, $0\leq j\neq i\leq
n-2$, the $j^{th}$ segment $\mathbf{y}_{i}^{j}$ of her input register.

Let us emphasize that during the decryption stage

  * •

No agent sends any information to Alice.

  * •

Agenti keeps to herself the $i^{th}$ segment $\mathbf{y}_{i}^{i}$ of her input
register. Ergo, Eve, despite her knowing the segments $\mathbf{a}^{i}$ and
$\mathbf{y}_{j}^{i}$, $0\leq j\neq i\leq n-2$, transmitted via the classical
channel, lacks the crucial ingredient $\mathbf{y}_{i}^{i}$ and is, thus,
unable to obtain the PIV $\mathbf{i}_{i}$.

######  Example 3.1 (Alice, Bob & Charlie use the OtMSQIT protocol).

This example features our $3$ protagonists Alice, Bob, and Charlie. As, always
they are in different geographical locations, and they possess their own local
quantum input registers, each having $6$ qubits. In particular, there are six
triplets of qubits, each triplet entangled in the $\ket{GHZ_{3}}$, according
to the $SBEDS_{3,9}$ entanglement distribution scheme. Alice intends to send
the PIVs $\mathbf{i}_{B}=101$ and $\mathbf{i}_{C}=010$ to Bob and Charlie,
respectively. This implies that the resulting AIV is $\mathbf{i}=101010$,
which can be embedded into the global state of the circuit via CNOT gates. The
concrete implementation in Qiskit of the general quantum circuit of Figure 3
for this scenario, is visualized in Figure 4.

The final measurements by Alice, Bob and Charlie will produce one of the
$2^{18}=262144$ equiprobable outcomes. Clearly, showing all these outcomes
would result in an unintelligible figure, so we have depicted only 25 of them
in Figure 5. One may trivially confirm that every outcome satisfies the
Segment Correlation Property and verifies equations (3.11) and (SCP).
Therefore, if Alice and Charlie send their segment $1$ to Bob, then Bob, by
XOR-ing with his own segment $1$, will uncover $\mathbf{i}_{B}=101$.
Symmetrically, if Alice and Bob send their segment $0$ to Charlie, then
Charlie will decipher $\mathbf{i}_{C}=010$.

To see how this works in practice, let us consider the last bar of the
histogram of Figure 5. The label of this bar is $111111\ 100111\ 110010$,
which, according to the quantum circuit of Figure 3, means that Alice’s input
register contains the bit vector $\mathbf{a}=111111$, Bob’s input register
contains the bit vector $\mathbf{b}=100111$, and Charlie’s input register
contains the bit vector $\mathbf{c}=110010$. Consequently, Alice, Bob, and
Charlie’s segments $0$ are $\mathbf{a}^{0}=111$, $\mathbf{b}^{0}=111$, and
$\mathbf{c}^{0}=010$, respectively. Alice and Bob communicate their segments
$0$ to Charlie, who XORs them with his own segment $0$, i.e.,
$\mathbf{a}^{0}\oplus\mathbf{b}^{0}\oplus\mathbf{c}^{0}=111\oplus 111\oplus
010=010$. By doing so, Charlie retrieves Alice’s intended PIV
$\mathbf{i}_{C}=010$. Analogously, Alice, Bob, and Charlie’s segments $1$ are
$\mathbf{a}^{1}=111$, $\mathbf{b}^{1}=100$, and $\mathbf{c}^{1}=110$,
respectively. Alice and Charlie communicate their segments $1$ to Bob, who
XORs them with his own segment $1$, i.e.,
$\mathbf{a}^{1}\oplus\mathbf{b}^{1}\oplus\mathbf{c}^{1}=111\oplus 100\oplus
110=101$. By doing so, Bob also uncovers Alice’s intended PIV
$\mathbf{i}_{B}=101$. $\triangleleft$

⋮ Spatially Separated ⋮ Spatially Separated Figure 4: A small scale quantum
circuit simulating the OtMSQIT protocol involving Alice and her two agents Bob
and Charlie.

⋮ Spatially Separated ⋮ Spatially Separated Figure 5: A few of the possible
measurements and their corresponding probabilities for the circuit of Figure
4.

##  4 Security analysis

The current section contains the security analysis of the OtMSQIT protocol. We
proceed by assuming the existence of Eve, who is the cunning adversary that
strives to compromise the security of the protocol and obtain some secret
information like a PIV. As usual, we take for granted the existence of a
classical authenticated channel, which will enable us to detect the presence
of the eavesdropper Eve. We emphasize that the classical channel is not used
for the transition of secret information; this privilege belongs exclusively
to the quantum channel. The OtMSQIT protocol involves communication among $n$
parties, and relies on $\ket{GHZ_{n}}$ tuples, which makes it substantially
more complex than typical QKD protocols involving only Alice, Bob, and Eve.
Therefore, we provide an extensive and detailed security analysis in order to
prove that it is information-theoretically secure. When considering strategies
that may be employed by Eve, we often distinguish subcases depending on
whether acts upon just one qubit or all $n-1$ qubits from each $\ket{GHZ_{n}}$
tuple, so as to account for all possibilities. This accounts for the rather
lengthy and technical current section. For a recent comprehensive text
analyzing security issues of quantum protocols in general, we refer to [56]
and the more recent [57].

At the end of the day, the security analysis of not just the OtMSQIT protocol,
but of every quantum protocol relies on certain well-understood assumptions.
We briefly state them for the purpose of making the current work self-
contained. Naturally, we assume that quantum theory is correct, which in turn
means that hallmark features such as the no-cloning theorem [58], the monogamy
of entanglement [59], and nonlocality [60] are valid. The unique features and
enhanced efficiency of the quantum protocols are precisely due to these
properties, otherwise, they would not offer any advantage over classical
protocols. Secondly, we assume that quantum theory is complete, which implies
that Eve is bound by the laws of quantum mechanics, and she cannot obtain more
information beyond what these laws permit.

The importance of the validation test cannot be overestimated. If the test
result is considered a failure, then the OtMSQIT protocol must be aborted. The
secret embedding stage can safely begin only after the validation test has
been successfully completed. The test itself consists of the following steps.

  1. (VT1)

Alice communicates to every one of her agents Agent0, …, Agentn-2 the
positions of the decoys, so that they can measure them in the Hadamard basis.

  2. (VT2)

Each agents sends back to Alice the results of her measurements. It is
important to realize that the expected measurement outcome is, in general,
different for every agent because, according to (EDV2), each qubit of the
decoy tuple is prepared independently of the other qubits of the same tuple.

  3. (VT3)

Alice analyzes the results received from her agents, and decides whether the
test was successful or not, according to the following rationale.

     * $\diamond$

If $0$ or very few wrong measurement outcomes are found, then Alice considers
the validation test successful.

     * $\diamond$

If the number of errors is $\approx\frac{d}{4}$, or above a similar threshold,
then Alice deems that the validation test failed, in which case she aborts and
terminates the protocol.

In the ideal scenario, where there is no eavesdropping and the quantum channel
is perfect, there will be $0$ wrong measurement outcomes. In a more realistic
scenario, even when there is no eavesdropping, we anticipate a few errors due
to channel imperfections, but the number of errors is expected to be
$\ll\frac{d}{4}$. To understand the rationale behind the validation procedure,
let us consider Eve’s possible actions during the distribution phase. First,
we make the critical remark that Eve has no way of knowing the position of the
decoys. Therefore, Eve must treat all tuples in an identical manner.

  1. (EA1)

Measure & Resend. Eve intercepts one or more qubits from each $\ket{GHZ_{n}}$
$n$-tuple during their transmission from Alice to her agents. After measuring
the intercepted qubit(s), Eve sends them back to their intended recipient. We
make the following observations.

     * $\diamond$

By the act of measurement, Eve destroys the entanglement. In view of the fact
that in order to embed AIV into the global state of the distributed circuit
entanglement is absolutely necessary, the protocol will fail. Hence, it is
imperative that Alice discovers the loss of entanglement and aborts the
execution of the protocol.

     * $\diamond$

First, we examine the scenario where Eve always uses the computational basis
for her measurements. In this scenario, the probability that Eve measures one
decoy qubit and gets the wrong outcome is $\frac{1}{2}$, since all the decoys
are measured in the wrong basis, and the probability to obtain the wrong
outcome in such a case is $\frac{1}{2}$. Consequently, the probability that
Eve obtains the correct outcome is $\frac{1}{2}$. This last probability
implies that if Eve measures a second qubit from the same tuple, the
probability to get two correct outcomes is way smaller. So, if Eve intercepts
and measures two or more qubits from the same tuple, she stands to gain
nothing in case they belong to a $\ket{GHZ_{n}}$ tuple, while she risks
increasing the number of errors each time they belong to a decoy tuple.
Therefore, Eve, being rational, will only measure one qubit from each tuple.

     * $\diamond$

Now we consider the scenario where Eve randomly chooses the measurement basis
between the computational or the Hadamard basis with equal probability. In
this situation, the probability that Eve measures one decoy qubit and gets the
wrong outcome is given by $\frac{1}{4}$, since the probability that a decoy is
measured in the wrong basis is $\frac{1}{2}$, and, even then, the probability
to get the wrong outcome is $\frac{1}{2}$. Consequently, the probability that
Eve obtains the correct outcome is $\frac{3}{4}$. For the same reasons that we
explained above, Eve will only measure one qubit from each tuple.

  2. (EA2)

Intercept & Send Fake $\ket{GHZ_{n}}$ $n$-tuples. Eve intercepts a number of
qubits from every $\ket{GHZ_{n}}$ $n$-tuple during their transmission from
Alice to her agents. This number may range from just $1$ to $n-1$. Eve can’t
clone the intercepted qubits due to the no-cloning theorem, but it is
conceivable that she has prepared her own $\ket{GHZ_{n}}$ tuples. This opens
up the possibility to keep the intercepted qubits and forward her own in their
place. Again, we make the following remarks.

     * $\diamond$

By doing so, Eve tampers with the entanglement. The protocol will fail because
at least one PIV will not be encoded into the entanglement. Again, it is
crucial that Alice discovers the loss of entanglement and aborts the execution
of the protocol.

     * $\diamond$

Eve, even if she were successful, will fail to gain any information. This is
because her qubits are not entangled with Alice’s qubits. The latter is the
unique source of information who embeds the PIVs to those registers that are
entangled with her own.

     * $\diamond$

The flaw in this scenario is once again that Eve has no way of knowing the
position of the decoys. If Eve intercepts just one qubit from every tuple, she
will, inadvertently, replace $d$ decoy qubits with her $\ket{GHZ_{n}}$ qubits.
When, during the validation test, these are measured in the Hadamard basis,
the probability to obtain the wrong outcome is $\frac{1}{2}$. This will
produce approximately $\approx\frac{d}{2}$ errors that will be easily noticed
by Alice. If Eve intercepts $k$ qubits from each tuple, the probability to get
at least one wrong measurement in a decoy tuple is $\frac{2^{k}-1}{2^{k}}$,
which will result in approximately $\approx d\frac{2^{k}-1}{2^{k}}$ errors. In
addition to the increased number of errors, Alice will easily notice that for
$k$ decoy qubits in every decoy tuple the measurement results from her agents
are identical, instead of uniformly distributed as they should be, as ordained
by (EDV2). Practically, this strategy has almost zero chances of success,
since Alice will, undoubtedly, infer the presence of Eve.

  3. (EA3)

Entangle with Ancilla Qubits & Measure Later. Eve intercepts one qubit from
every $\ket{GHZ_{n}}$ $n$-tuple during their transmission from Alice to her
agents. Now, instead of measuring or replacing the intercepted qubits, Eve
entangles them with her ancilla qubits, and then forwards them to their
intended recipient. Eve plans to wait until the protocol completes, before
measuring her qubits, hoping to gain useful information. In this case, we
stress the next points.

     * $\diamond$

The result of Eve’s actions is that, instead of having $m$ $\ket{GHZ_{n}}$
tuples distributed among Alice and her $n-1$ agents, we end up with $m$
$\ket{GHZ_{n+1}}$ tuples evenly distributed among Alice, her $n-1$ agents, and
Eve. Eve, even if she were successful, will fail to gain any information. This
is because in order to decipher even a single PIV, she will require the
contents of Alice and her agents’ registers.

     * $\diamond$

Of course, by doing so Eve changes the entanglement. The protocol will fail
for the same reason as above, i.e., to decipher even a single PIV, Alice and
her agents will require the contents of Eve’s register. Again, it is
imperative that Alice discovers the loss of entanglement and aborts the
execution of the protocol.

     * $\diamond$

Like in all previous case, the decoys will enable Alice to infer the presence
of Eve. Recall that Eve has no way of knowing the position of the decoys. If
Eve intercepts just one qubit from every tuple, she will entangle $d$ decoy
qubits with her ancilla qubits. When, during the validation test, these are
measured in the Hadamard basis, the probability to obtain the wrong outcome is
$\frac{1}{2}$. This will produce approximately $\approx\frac{d}{2}$ errors
that will be easily noticed by Alice. If Eve intercepts $k$ qubits from each
tuple, the probability to get at least one wrong measurement in a decoy tuple
is $\frac{2^{k}-1}{2^{k}}$, which will result in approximately $\approx
d\frac{2^{k}-1}{2^{k}}$ errors. In addition to the increased number of errors,
Alice will easily notice that for $k$ decoy qubits in every decoy tuple the
measurement results from her agents are identical, instead of uniformly
distributed as they should be, as ordained by (EDV2). This policy too has
practically zero chances of success.

The above security analysis demonstrates that by setting the error threshold
at $\approx\frac{d}{4}$ the OtMSQIT protocol is information-theoretically
secure. Let us also emphasize the fact that even if Eve successfully
eavesdrops during the entanglement distribution phase, she will get no
information whatsoever because no information has been encoded yet. However it
is still possible that she may disrupt the execution of the protocol. The
validation test is designed to detect such an interference and abort the
protocol. In closing, we remark that in the eventuality where the protocol is
aborted, the security measures are not up to the task at hand. Hence, first
measures must be taken to enhance security and then the process can start all
over again.

##  5 Discussion and conclusions

In this article, we introduce a new entanglement-based protocol for one-to-
many simultaneous secure quantum information transmission, which we call
OtMSQIT for short. The characteristic property of the new protocol is its
extensibility, as it can be seamlessly generalized to an arbitrary number of
entities. The proposed entanglement-based protocol is completely distributed
and is provably information-theoretically secure. There many quantum protocols
that achieve secure information communication between two parties, but most of
them can’t be generalized to situations involving parallel information
transmission to two or more parties. This is achieved by the special way the
transmitted information is embedded in the entangled state of the system, one
of the distinguishing features compared to previous protocols. The advantage
of this method is that it is seamlessly extensible and can be generalized to a
setting involving an arbitrary number of players. This is not only useful, but
necessary, whenever one information source must transmit simultaneously
different secret messages to many recipients, without the need to apply the
same two party protocol many times sequentially. Due to its relative
complexity, compared to similar cryptographic protocols, as it involves
communication among $n$ parties, and relies on $\ket{GHZ_{n}}$ tuples, we
provide an extensive and detailed security analysis so as to prove that it is
information-theoretically secure. In terms of the capabilities of modern
quantum apparatus, the implementation of the proposed protocol does not
present any difficulty because it only requires CNOT and Hadamard gates. An
additional advantage is that the local quantum circuits are identical for all
information recipients.

## References

  * [1] P. Shor, “Algorithms for quantum computation: discrete logarithms and factoring,” in Proceedings 35th Annual Symposium on Foundations of Computer Science, IEEE Comput. Soc. Press, 1994.
  * [2] L. Grover, “A fast quantum mechanical algorithm for database search,” in Proc. of the Twenty-Eighth Annual ACM Symposium on the Theory of Computing, 1996, 1996.
  * [3] J. Chow, O. Dial, and J. Gambetta, “IBM Quantum breaks the 100-qubit processor barrier.” https://research.ibm.com/blog/127-qubit-quantum-processor-eagle, 2021.  Accessed: 2022-04-03.
  * [4] I. Newsroom, “IBM unveils 400 qubit-plus quantum processor.” https://newsroom.ibm.com/2022-11-09-IBM-Unveils-400-Qubit-Plus-Quantum-Processor-and-Next-Generation-IBM-Quantum-System-Two, 2022\.  Accessed: 2022-04-03.
  * [5] L. Chen, L. Chen, S. Jordan, Y.-K. Liu, D. Moody, R. Peralta, R. Perlner, and D. Smith-Tone, Report on post-quantum cryptography, vol. 12.  US Department of Commerce, National Institute of Standards and Technology, 2016.
  * [6] G. Alagic, G. Alagic, J. Alperin-Sheriff, D. Apon, D. Cooper, Q. Dang, Y.-K. Liu, C. Miller, D. Moody, R. Peralta, et al., Status report on the first round of the NIST post-quantum cryptography standardization process.  US Department of Commerce, National Institute of Standards and Technology …, 2019.
  * [7] G. Alagic, J. Alperin-Sheriff, D. Apon, D. Cooper, Q. Dang, J. Kelsey, Y.-K. Liu, C. Miller, D. Moody, R. Peralta, et al., “Status report on the second round of the nist post-quantum cryptography standardization process,” US Department of Commerce, NIST, 2020.
  * [8] G. Alagic, D. Apon, D. Cooper, Q. Dang, T. Dang, J. Kelsey, J. Lichtinger, C. Miller, D. Moody, R. Peralta, et al., “Status report on the third round of the nist post-quantum cryptography standardization process,” National Institute of Standards and Technology, Gaithersburg, 2022.
  * [9] A. K. Ekert, “Quantum cryptography based on bell’s theorem,” Physical Review Letters, vol. 67, no. 6, pp. 661–663, 1991.
  * [10] C. H. Bennett, G. Brassard, and N. D. Mermin, “Quantum cryptography without bell’s theorem,” Physical Review Letters, vol. 68, no. 5, pp. 557–559, 1992.
  * [11] N. Gisin, G. Ribordy, H. Zbinden, D. Stucki, N. Brunner, and V. Scarani, “Towards practical and fast quantum cryptography,” arXiv preprint quant-ph/0411022, 2004.
  * [12] K. Inoue, E. Waks, and Y. Yamamoto, “Differential phase shift quantum key distribution,” Physical review letters, vol. 89, no. 3, p. 037902, 2002\.
  * [13] J.-Y. Guan, Z. Cao, Y. Liu, G.-L. Shen-Tu, J. S. Pelc, M. Fejer, C.-Z. Peng, X. Ma, Q. Zhang, and J.-W. Pan, “Experimental passive round-robin differential phase-shift quantum key distribution,” Physical review letters, vol. 114, no. 18, p. 180502, 2015.
  * [14] E. Waks, H. Takesue, and Y. Yamamoto, “Security of differential-phase-shift quantum key distribution against individual attacks,” Physical Review A, vol. 73, no. 1, p. 012344, 2006.
  * [15] M. Ampatzis and T. Andronikos, “QKD based on symmetric entangled bernstein-vazirani,” Entropy, vol. 23, no. 7, p. 870, 2021.
  * [16] C. H. Bennett and G. Brassard, “Quantum cryptography: Public key distribution and coin tossing,” in Proceedings of the IEEE International Conference on Computers, Systems, and Signal Processing, pp. 175–179, IEEE Computer Society Press, 1984.
  * [17] M. Hillery, V. Bužek, and A. Berthiaume, “Quantum secret sharing,” Physical Review A, vol. 59, no. 3, p. 1829, 1999.
  * [18] M. Ampatzis and T. Andronikos, “A symmetric extensible protocol for quantum secret sharing,” Symmetry, vol. 14, no. 8, p. 1692, 2022.
  * [19] M. Ampatzis and T. Andronikos, “Quantum secret aggregation utilizing a network of agents,” Cryptography, vol. 7, no. 1, p. 5, 2023.
  * [20] C. H. Bennett, G. Brassard, C. Crépeau, R. Jozsa, A. Peres, and W. K. Wootters, “Teleporting an unknown quantum state via dual classical and einstein-podolsky-rosen channels,” Physical Review Letters, vol. 70, no. 13, pp. 1895–1899, 1993.
  * [21] V. Attasena, J. Darmont, and N. Harbi, “Secret sharing for cloud data security: a survey,” The VLDB Journal, vol. 26, no. 5, pp. 657–681, 2017\.
  * [22] T. Ermakova and B. Fabian, “Secret sharing for health data in multi-provider clouds,” in 2013 IEEE 15th conference on business informatics, pp. 93–100, IEEE, 2013.
  * [23] T. Andronikos and A. Sirokofskich, “A quantum detectable byzantine agreement protocol using only EPR pairs,” Applied Sciences, vol. 13, no. 14, p. 8405, 2023.
  * [24] J. Cha, S. K. Singh, T. W. Kim, and J. H. Park, “Blockchain-empowered cloud architecture based on secret sharing for smart city,” Journal of Information Security and Applications, vol. 57, p. 102686, 2021.
  * [25] X. Sun, P. Kulicki, and M. Sopek, “Multi-party quantum byzantine agreement without entanglement,” Entropy, vol. 22, no. 10, p. 1152, 2020.
  * [26] Z. Qu, Z. Zhang, B. Liu, P. Tiwari, X. Ning, and K. Muhammad, “Quantum detectable byzantine agreement for distributed data trust management in blockchain,” Information Sciences, vol. 637, p. 118909, 2023.
  * [27] G. L. Long and X. S. Liu, “Theoretically efficient high-capacity quantum-key-distribution scheme,” Physical Review A, vol. 65, no. 3, p. 032302, 2002.
  * [28] D. Pan, X.-T. Song, and G.-L. Long, “Free-space quantum secure direct communication: Basics, progress, and outlook,” Advanced Devices & Instrumentation, vol. 4, 2023.
  * [29] A. Beige, B. Englert, C. Kurtsiefer, and H. Weinfurter, “Secure communication with a publicly known key,” Acta Physica Polonica A, vol. 101, no. 3, pp. 357–368, 2002.
  * [30] K. Boström and T. Felbinger, “Deterministic secure direct communication using entanglement,” Physical Review Letters, vol. 89, no. 18, p. 187902, 2002\.
  * [31] B. A. Nguyen, “Quantum dialogue,” Physics Letters A, vol. 328, no. 1, pp. 6–10, 2004.
  * [32] J.-W. Zhang, G. Xu, X.-B. Chen, Y. Chang, and Z.-C. Dong, “Improved multiparty quantum private comparison based on quantum homomorphic encryption,” Physica A: Statistical Mechanics and its Applications, vol. 610, p. 128397, 2023\.
  * [33] D. A. Meyer, “Quantum strategies,” Physical Review Letters, vol. 82, no. 5, p. 1052, 1999.
  * [34] J. Eisert, M. Wilkens, and M. Lewenstein, “Quantum games and quantum strategies,” Physical Review Letters, vol. 83, no. 15, p. 3077, 1999.
  * [35] T. Andronikos, A. Sirokofskich, K. Kastampolidou, M. Varvouzou, K. Giannakis, and A. Singh, “Finite automata capturing winning sequences for all possible variants of the PQ penny flip game,” Mathematics, vol. 6, p. 20, Feb 2018\.
  * [36] T. Andronikos and A. Sirokofskich, “The connection between the PQ penny flip game and the dihedral groups,” Mathematics, vol. 9, no. 10, p. 1115, 2021\.
  * [37] T. Andronikos, “Conditions that enable a player to surely win in sequential quantum games,” Quantum Information Processing, vol. 21, no. 7, 2022.
  * [38] K. Giannakis, G. Theocharopoulou, C. Papalitsas, S. Fanarioti, and T. Andronikos, “Quantum conditional strategies and automata for prisoners’ dilemmata under the EWL scheme,” Applied Sciences, vol. 9, p. 2635, Jun 2019.
  * [39] K. Giannakis, C. Papalitsas, K. Kastampolidou, A. Singh, and T. Andronikos, “Dominant strategies of quantum games on quantum periodic automata,” Computation, vol. 3, pp. 586–599, nov 2015.
  * [40] T. Andronikos and M. Stefanidakis, “A two-party quantum parliament,” Algorithms, vol. 15, no. 2, p. 62, 2022.
  * [41] G. Theocharopoulou, K. Giannakis, C. Papalitsas, S. Fanarioti, and T. Andronikos, “Elements of game theory in a bio-inspired model of computation,” in 2019 10th International Conference on Information, Intelligence, Systems and Applications (IISA), pp. 1–4, IEEE, jul 2019.
  * [42] K. Kastampolidou, M. N. Nikiforos, and T. Andronikos, “A brief survey of the prisoners’ dilemma game and its potential use in biology,” in Advances in Experimental Medicine and Biology, pp. 315–322, Springer International Publishing, 2020.
  * [43] D. Kostadimas, K. Kastampolidou, and T. Andronikos, “Correlation of biological and computer viruses through evolutionary game theory,” in 2021 16th International Workshop on Semantic and Social Media Adaptation & Personalization (SMAP), IEEE, 2021.
  * [44] K. Kastampolidou and T. Andronikos, “A survey of evolutionary games in biology,” in Advances in Experimental Medicine and Biology, pp. 253–261, Springer International Publishing, 2020.
  * [45] K. Kastampolidou and T. Andronikos, “Microbes and the games they play,” in GeNeDis 2020, pp. 265–271, Springer International Publishing, 2021.
  * [46] K. Kastampolidou and T. Andronikos, “Game theory and other unconventional approaches to biological systems,” in Handbook of Computational Neurodegeneration, pp. 163–180, Springer International Publishing, 2023.
  * [47] C. Papalitsas, K. Kastampolidou, and T. Andronikos, “Nature and quantum-inspired procedures – a short literature review,” in GeNeDis 2020, pp. 129–133, Springer International Publishing, 2021.
  * [48] S. Adam, P. Karastathis, D. Kostadimas, K. Kastampolidou, and T. Andronikos, “Protein misfolding and neurodegenerative diseases: A game theory perspective,” in Handbook of Computational Neurodegeneration, pp. 863–874, Springer International Publishing, 2023.
  * [49] M. A. Nielsen and I. L. Chuang, Quantum computation and quantum information.  Cambridge University Press, 2010.
  * [50] N. S. Yanofsky and M. A. Mannucci, Quantum Computing for Computer Scientists.  Cambridge University Press, 2013.
  * [51] T. G. Wong, Introduction to classical and quantum computing.  Rooted Grove, 2022.
  * [52] D. Cruz, R. Fournier, F. Gremion, A. Jeannerot, K. Komagata, T. Tosic, J. Thiesbrummel, C. L. Chan, N. Macris, M.-A. Dupertuis, and C. Javerzac-Galy, “Efficient quantum algorithms for GHZ and w states, and implementation on the IBM quantum computer,” Advanced Quantum Technologies, vol. 2, no. 5-6, p. 1900015, 2019.
  * [53] N. Mermin, Quantum Computer Science: An Introduction.  Cambridge University Press, 2007.
  * [54] Qiskit, “Qiskit open-source quantum development.” https://qiskit.org.  Accessed: 2022-04-03.
  * [55] T. Andronikos and A. Sirokofskich, “An entanglement-based protocol for simultaneous reciprocal information exchange between 2 players,” Electronics, vol. 12, no. 11, p. 2506, 2023.
  * [56] R. Wolf, Quantum Key Distribution.  Springer International Publishing, 2021.
  * [57] R. Renner and R. Wolf, “Quantum advantage in cryptography,” AIAA Journal, vol. 61, no. 5, pp. 1895–1910, 2023.
  * [58] W. K. Wootters and W. H. Zurek, “A single quantum cannot be cloned,” Nature, vol. 299, no. 5886, pp. 802–803, 1982.
  * [59] V. Coffman, J. Kundu, and W. K. Wootters, “Distributed entanglement,” Physical Review A, vol. 61, no. 5, p. 052306, 2000.
  * [60] N. Brunner, D. Cavalcanti, S. Pironio, V. Scarani, and S. Wehner, “Bell nonlocality,” Reviews of Modern Physics, vol. 86, no. 2, p. 419, 2014.