arX

iv:2

101.

1241

9v1

[qu

ant-

ph]

29

Jan

2021

1

Theory of Communication Efficient

Quantum Secret Sharing

Kaushik Senthoor and Pradeep Kiran Sarvepalli

Department of Electrical Engineering

Indian Institute of Technology Madras

Chennai 600 036, India

Abstract—A ((k, n)) quantum threshold secret sharing (QTS)scheme is a quantum cryptographic protocol for sharing aquantum secret among n parties such that the secret can berecovered by any k or more parties while k− 1 or fewer partieshave no information about the secret. Despite extensive researchon these schemes, there has been very little study on optimizingthe quantum communication cost during recovery. Recently, weinitiated the study of communication efficient quantum thresholdsecret sharing (CE-QTS) schemes. These schemes reduce thecommunication complexity in QTS schemes by accessing d ≥ k

parties for recovery; here d is fixed ahead of encoding the secret.In contrast to the standard QTS schemes which require k quditsfor recovering each qudit in the secret, these schemes have a lowercommunication cost of d

d−k+1for d > k. In this paper, we further

develop the theory of communication efficient quantum thresholdschemes. Here, we propose universal CE-QTS schemes whichreduce the communication cost for all d ≥ k simultaneously. Weprovide a framework based on ramp quantum secret sharingto construct CE-QTS and universal CE-QTS schemes. We giveanother construction for universal CE-QTS schemes based onStaircase codes. We derived a lower bound on communicationcomplexity and show that our constructions are optimal. Finally,an information theoretic model is developed to analyse CE-QTSschemes and the lower bound on communication complexity isproved again using this model.

Index Terms—quantum secret sharing, communication com-plexity, quantum cryptography, threshold secret sharing schemes,Staircase codes.

I. INTRODUCTION

QUANTUM secret sharing schemes are protocols that

enable the secure distribution of a secret among mutually

collaborating parties so that only certain collections of parties

can recover the secret. Quantum secret sharing schemes were

first proposed by Hillery et al. for classical secrets [1]. Subse-

quently, Cleve et al. proposed quantum secret sharing schemes

for quantum secrets [2]. Since these pioneering works, there

has been extensive progress in this field, and it continues

to be actively researched [3]–[14]. Quantum secret sharing

has also been experimentally demonstrated by many groups

[15]–[23]. The progress has been rapid with demonstrations

over distances as large as 50 km [22]. Furthermore, non-

binary protocols over 11-dimensional qudits have also been

demonstrated [23].

Quantum secret sharing can be done under various settings:

with classical data as the secret or an arbitrary quantum state

as the secret, with parties having classical and quantum data

(hybrid) or only quantum data, with or without pre-existing

quantum entanglement shared among the parties, to name

a few. Here, we consider the setting where the secret is

an arbitrary quantum state, with all the parties having only

quantum data and no pre-existing quantum entanglement. In

this paper we are interested in optimizing the resources needed

for quantum secret sharing. Specifically, we study the commu-

nication efficient threshold quantum secret sharing (CE-QTS)

schemes and propose the improved model of universal CE-

QTS schemes.

The most popular quantum secret sharing scheme is the

quantum threshold secret sharing scheme (QTS). In this

scheme, out of the total n parties, a minimum of k parties

are required to recover the secret. Also, here we look at only

perfect QTS schemes, where any set of less than k parties

should not have any information on the secret. It is often

denoted as a ((k, n)) scheme. The state given to each party is

called the share of the party. After the secret has been shared,

the parties who plan to recover the secret combine their shares

together and reconstruct the secret. Alternatively, the parties

involved in the recovery could communicate all or part of their

share to a third party designated as the combiner. The amount

of quantum communication to the combiner for recovering the

secret is called the communication complexity. For sharing a

secret of size m qudits under this setting, a standard ((k, n))scheme (for example, [2]) requires mn qudits to be shared for

share distribution (m qudits for each party) and at least mkqudits for recovery.

A. Previous work

The analogous problem of reducing communication com-

plexity has been studied for classical secret sharing schemes

[24]–[29] but not as much in the quantum setting. Ref. [7]

and [10] aim to reduce the quantum communication during

secret distribution to the parties but do not look at reducing

the quantum communication cost during secret recovery. Only

recently, [12] showed that the quantum communication cost

during secret recovery can be reduced by using a subset

of d parties whose cardinality is more than the threshold krequired to recover the secret. This scheme is called ((k, n, d))communication efficient quantum secret sharing (CE-QTS)

scheme. These gains can be significant and for a ((k, n =2k − 1, d)) threshold scheme, it was shown that the gains in

2

communication complexity of recovery per secret qudit can

be as large as O(k). For sharing a secret of m qudits, this

scheme requires mn qudits to be shared for secret distribution,

mk qudits for secret recovery when accessing k parties and

dm/(d−k+1) qudits when accessing d parties. However, the

improvement in communication cost only works for a fixed

value of d in the range of k < d ≤ n. The value of d is

decided prior to encoding of the secret and cannot be changed.

B. Contributions

In this paper, we develop the theory of communication

efficient quantum secret sharing schemes. Specifically, we

address the problem of designing quantum threshold schemes

that are universal in the sense that any subset of parties of

an arbitrary size greater than k would provide further gains

in communication cost during recovery. This is the first such

class of universal communication efficient quantum threshold

secret sharing schemes where the number of parties contacted

for secret recovery can be varied from k to n.

First, we give a framework for constructing CE-QTS

schemes from a combination of ramp QSS schemes and

threshold schemes. We also propose a construction of CE-QTS

schemes for both fixed d and universal d with this framework

using the ramp secret sharing schemes proposed in [30]. This

framework can also be used to derive other constructions for

CE-QTS schemes by using different ramp QSS schemes.

Second, we propose a class of universal CE-QTS schemes

based on the Staircase codes. These schemes are inspired by

the classical communication efficient secret sharing schemes

of [25], [26]. The constructions for these classical schemes are

also related to codes for distributed storage aimed at reducing

communication cost [31].

The constructions for universal CE-QTS schemes proposed

in this paper, when an arbitrary d ≥ k number of parties

are contacted, achieve the same communication complexity

as that of fixed d. So there is no penalty in communication

complexity with the increased flexibility to change d. The

universal CE-QTS constructions provide the same storage cost

and communication cost (normalized to secret size) as the CE-

QTS constructions. But the universal CE-QTS constructions

need to have larger secret sizes to provide communication

efficiency for various values of d. For a short summary of

our constructions, refer Table I.

Third, we devive lower bounds on the communication

complexity of CE-QTS schemes (both fixed d and universal).

We also propose an information-theoretic model of CE-QTS

schemes and prove that our constructions are optimal with

respect to both share size and communication cost. The

information theoretic model is used to give an alternative proof

for the bound on communication cost.

Some preliminary results of this paper are discussed in the

upcoming conference publication [32].

C. Organization

We begin with a brief review of quantum secret sharing

schemes in Section II. Then we give a concrete illustration

of the universal communication efficient quantum secret shar-

ing schemes in Section III. In Section IV, we propose the

Concatenation framework for constructing CE-QTS schemes

from ramp and threshold QSS schemes. We also extend this

framework to construct universal CE-QTS schemes. In Sec-

tion V, we give a construction of universal CE-QTS schemes

based on Staircase codes. We derive lower bounds on the

communication complexity of CE-QTS schemes in Section VI.

In Section VII, we propose an information theoretic model for

studying CE-QTS schemes. Finally, we conclude with a brief

sketch of further directions of research.

II. BACKGROUND

A. Notation

Let q be a prime and Fq denote a finite field with q elements.

We take the standard basis of Cq to be {|x〉 | x ∈ Fq}. We

denote |x1x2 · · ·xℓ〉 by |x〉 where x is the vector with the

entries (x1, x2, . . . , xℓ). The standard basis for Cqn is taken

to be {|x〉 | x ∈ Fnq }. For any invertible matrix K ∈ Fℓ×ℓ

q , we

define the unitary operation UK

UK |x〉 = |Kx〉 =∣

∣y⟩

,

where y = (y1, . . . , yn) and yi =∑

j Kijxj . We define the

two qudit unitary operator Lα as

Lα |i〉c |j〉t = |i〉c |j + αi〉t ,

where i, j ∈ Fq and α ∈ Fq is a constant. The subscript c and

t indicate that they are control and target qudits respectively.

This operator generalizes the CNOT gate.

We use the notation [n] := {1, 2, . . . , n} and [i, j] :={i, i + 1, . . . , j}. Let V be a m × n matrix and A ⊆ [m],B ⊆ [n]. We denote by VA, the submatrix of V formed by

taking the rows indexed by entries in A. Similarly, we can

form a submatrix of V by taking the columns of V . This is

indicated as V B . We can also form a submatrix V BA of V

which takes rows indexed by A and columns indexed by B.

For a matrix V ∈ Fm×nq , the notation |V 〉 indicates the state

|v11v21 . . . vm1〉|v12v22 . . . vm2〉. . .|v1nv2n . . . vmn〉 where vijis the element of V in ith row and jth column. Let A ∈ Fm×n

q

matrix and K is an invertible m × m matrix, then we can

transform the state |A〉 to |KA〉 by the unitary operation U⊗nK .

We refer to this operation as applying K on |A〉 to obtain

|KA〉.

B. Quantum secret sharing (QSS)

A quantum secret sharing scheme is a protocol to encode the

secret in arbitrary quantum state and share it among n parties

such that certain subsets of parties, called authorized sets,

can recover the secret (recoverability) and certain subsets of

parties, called unauthorized sets, do not have any information

about the secret (secrecy). The access structure Γ of a QSS

scheme is defined as

Γ = {X ⊆ [n] : X is an authorized set}.

A QSS scheme is called perfect quantum secret sharing

scheme if any subset of the n parties is either an authorized

3

Number of parties Secret size, m Communication Dimension ofaccessed by combiner, d cost, CCn(d)/m qudits, q (prime)

QTS [5] d = k, fixed 1 k ≥ 2k − 1

CE-QTS (Staircase codes) [12] k ≤ d ≤ n, fixed d− k + 1 d

d−k+1> 2k − 1

CE-QTS (Concatenation) k ≤ d ≤ n, fixed d− k + 1 d

d−k+1> d+ k − 1

Universal CE-QTS (Staircase codes) k ≤ d ≤ n, variable lcm{1, 2, . . . , k} d

d−k+1> 2k − 1

Universal CE-QTS (Concatenation) k ≤ d ≤ n, variable lcm{1, 2, . . . , n− k + 1} d

d−k+1> n+ k − 1

TABLE I: Parameters of various ((k, n)) QTS constructions. Here 2 ≤ k ≤ n ≤ 2k − 1. For all these constructions, the

individual share size is m and CCn(k)/m = k.

set or an unauthorized set and non-perfect otherwise. For non-

perfect schemes, some subsets of the n parties are allowed to

have partial information about the secret. These sets are called

intermediate sets.

A concrete realization of a quantum secret sharing scheme

is specified by giving an encoding for the basis states of

the secret. An encoding has to satisfy the properties of

recoverability and secrecy to realize a QSS scheme.

Definition 1. A quantum secret sharing scheme for an access

structure Γ is the encoding and distribution of the secret in

an arbitrary quantum state among n parties such that

• (Recoverability) any authorized set A ∈ Γ can recover

the secret i.e. there exists some recovery operation which

can decode the secret from the shares in A,

• (Secrecy) any unauthorized set B /∈ Γ has no information

about the secret.

In a pure state QSS scheme, the encoding is such that the

combined state of all shares is a pure state whenever the secret

is in pure state. Otherwise, the scheme is called mixed state

scheme.

Lemma 1 (Mixed state schemes from pure state schemes).

[5, Theorem 3] Any mixed state QSS scheme can be described

as a pure state QSS scheme with one share discarded.

The no-cloning theorem implies that the complement of an

authorized set is unauthorized set. In pure state schemes the

converse also holds as given in the following result.

Lemma 2 (Authorized sets in pure state schemes). [5,

Corollary 2] In a pure state quantum secret sharing scheme,

complement of any unauthorized set is an authorized set.

We use the following notation for parameters of QSS

schemes: q is the fixed dimension of all the qudits in the

scheme, m gives the size of the secret in qudits and wi gives

the size of the ith share in qudits.

C. Quantum threshold secret sharing (QTS)

An important class of perfect quantum secret sharing

schemes are the quantum threshold secret sharing schemes.

In threshold schemes, a set of parties is either authorized or

unauthorized based on the number of parties in the set.

Definition 2 (Quantum threshold scheme). A ((k, n)) quantum

threshold secret sharing scheme for 1 < k ≤ n ≤ 2k − 1 is

a QSS scheme with n parties where any k or more parties

can recover the secret, but k − 1 or fewer parties have no

information on the secret.

If n > 2k, then there exist two non-overlapping authorized

sets which can give two copies of the secret thus violating

no-cloning theorem.

Cleve et al. [2] have given a construction for ((k, n)) QTS

schemes as follows. Consider the case of n = 2k − 1. Take

m = 1 and a prime q ≥ 2k−1. The encoding for a basis state

of the secret s ∈ Fq is given by the following superposition.

|s〉 7→∑

r∈Fk−1q

|v1(r, s)〉 |v2(r, s)〉 . . . |vn(r, s)〉 (1)

Here r = (r1, r2, . . . , rk−1) ∈ Fk−1q and vi(r, s) ∈ Fq is the

evaluation of the polynomial

vi(r, s) = r1 + r2xi + . . .+ rk−1xk−2i + sxk−1

i .

where x1, x2, . . . , xn are distinct constants from Fq . Each of

the n parties is given one qudit from the encoded state.

For example, the encoding for a ((k = 2, n = 3)) QTS

scheme will be as follows where each qudit has dimension

three.

|s〉 7→∑

r∈F3

|r〉 |r + s〉 |r + 2s〉

To obtain a ((k, n)) QTS scheme for n < 2k − 1, simply

discard 2k − 1 − n shares after encoding the secret in the

above scheme.

Lemma 3. [2] The encoding in (1) provides a q-ary ((k, n))quantum threshold secret sharing scheme for n ≤ 2k− 1 with

the following parameters.

q ≥ 2k − 1 (prime)

m = 1

w1 = w2 = · · · = wn = 1

This scheme can be used to encode a secret of m > 1 qudits

by individually encoding each qudit in the secret.

D. Storage and communication complexity

The storage cost of a secret sharing scheme is directly

related to the sizes of the shares. In this context the following

result has been shown about the size of a share.

4

Lemma 4 (Share size, [5]). The size of each share in a

threshold QSS scheme should be at least as large as the size

of the secret.

Clearly, the QTS scheme in Lemma 3 has optimal storage

cost. Apart from storage cost which depends on how the

secret is encoded and distributed among the parties, it is

also important to see how much quantum communication is

needed during the secret recovery. There are two prominent

approaches to reconstructing the secret. In the first approach,

the parties from an authorized set could collaborate among

themselves by means of nonlocal operations to recover the

secret. In the second approach, they can communicate all or

part of their shares to a third party called the combiner. In this

paper, we focus on the latter method of secret reconstruction.

Definition 3 (Communication cost for an authorized set). The

communication cost for an authorized set in a QSS scheme is

the number of qudits sent to the combiner by the parties in

that set for recovering the secret.

For the same encoding of the secret, it is possible to have

different recovery operations for a given authorized set, thus

giving multiple values for the communication cost. However

the above definition for communication cost is defined for a

particular recovery operation defined by the QSS scheme for

an authorized set.

Definition 4 (Communication cost for d in QTS). The com-

munication cost for threshold d ≥ k in a ((k, n)) quantum

threshold secret sharing scheme is the maximum communica-

tion cost over all the authorized sets of size d. This will be

denoted as CCn(d).

Thus, for the QTS scheme defined in Lemma 3, the com-

munication cost for secret recovery is CCn(k) = k.

E. Fixed d communication efficient QTS (CE-QTS)

Assume that the combiner in a QTS scheme has access to

more than k parties in the scheme. Then, the ((k, n)) QTS

scheme will still have the same communication cost of kqudits. However, by allowing each party in a ((k, n)) QTS

scheme to send only a part of its share to the combiner, it is

possible to reduce this communication cost further.

Definition 5 (CE-QTS). A ((k, n)) threshold secret sharing

scheme is said to be communication efficient, if for some dsuch that k < d ≤ n,

CCn(d) < CCn(k) (2)

Such schemes are denoted as ((k, n, d)) CE-QTS schemes.

Here, d is a fixed integer satisfying k < d ≤ n. The

strict inequality (2) in this definition is necessary because

any ((k, n)) scheme can allow recovery from d parties by

communicating some k shares from these d parties thus

achieving CCn(d) = CCn(k).A construction for ((k, n, d)) CE-QTS schemes based on

Staircase codes is given in [12]. For n = 2k−1, this CE-QTS

scheme is constructed as follows. The encoding for a basis

state of the secret s = (s1, s2, . . . , sm) ∈ Fq is given by the

following superposition

|s1s2 . . . sm〉 7→∑

r∈Fm(k−1)q

2k−1⊗

i=1

|ci1ci2 . . . cim〉 (3)

where r = (r1, r2, . . . , rm(k−1)) ∈ Fm(k−1)q and cij is the

(i, j)th entry of the matrix

C = V Y.

Here, V is a Vandermonde matrix defined as

V =

1 x1 . . . xd−11

1 x2 . . . xd−12

......

. . ....

1 xn . . . xd−1n

.

where x1, x2, ..., xn are distinct non-zero constants from Fq.The matrix Y is given by

Y =

s1s2...

0(m−1)×(m−1)

sm rk−m+1 rk−m+2 . . . rk−1

r1r2...

rk−1

rk r2(k−1)+1 . . . r(m−1)(k−1)+1

rk+1 r2(k−1)+2 . . . r(m−1)(k−1)+2

..

....

. . ....

r2(k−1) r3(k−1) . . . rm(k−1)

.

After encoding, the first set of m qudits are given to the first

party, the second set of m qudits given to the second party

and so on till the nth party. When the combiner accesses kparties, each of these k parties sends all its m = d − k + 1qudits. When the combiner accesses d parties, each of these

d parties sends only its first qudit.

Lemma 5. [12] The encoding in (3) provides a q-ary

((k, n, d)) communication efficient quantum threshold secret

sharing scheme with the following parameters

q > 2k − 1 (prime)

m = d− k + 1

w1 = w2 = . . . = wn = d− k + 1

CCn(k) = k(d− k + 1)

CCn(d) = d.

To obtain a ((k, n, d)) CE-QTS scheme for n < 2k − 1,

simply discard 2k − 1− n shares after encoding the secret in

the above scheme. By Lemma 4, this scheme has an optimal

storage cost. It is also proved in [12] that this scheme gives

an optimal communication cost when the combiner accesses

d parties, for the specific case of n = 2k − 1. In this paper,

we prove that optimality of this scheme holds for n < 2k− 1as well.

5

For example, for k = 3, d = 5, this construction gives a

((3, 5, 5)) CE-QTS scheme with the parameters

q = 7 (4a)

m = 3 (4b)

w1 = w2 = . . . = w5 = 3 (4c)

CCn(3) = 9, CCn(5) = 5. (4d)

The matrices V and Y in this scheme are given by

V =

1 1 1 1 11 2 4 1 21 3 2 6 41 4 2 1 41 5 4 6 2

and Y =

s1 0 0

s2 0 0

s3 r1 r2r1 r3 r5r2 r4 r6

.

The encoding for the scheme is given by the following

mapping

|s〉 7→∑

r∈F67

|c11c12c13〉 |c21c22c23〉 |c31c32c33〉 (5)

|c41c42c43〉 |c51c52c53〉

where s = (s1, s2, s3) indicates a basis state of the quantum

secret, r = (r1, r2, . . . , r6) and cij is the (i, j)th entry of the

matrix

C = V Y.

The encoded state in (5) can also be written as,

∑

r∈F67

|v1(s, r1, r2)〉 |v1(0, 0, r1, r3, r4)〉 |v1(0, 0, r2, r5, r6)〉|v2(s, r1, r2)〉 |v2(0, 0, r1, r3, r4)〉 |v2(0, 0, r2, r5, r6)〉|v3(s, r1, r2)〉 |v3(0, 0, r1, r3, r4)〉 |v3(0, 0, r2, r5, r6)〉|v4(s, r1, r2)〉 |v4(0, 0, r1, r3, r4)〉 |v4(0, 0, r2, r5, r6)〉|v5(s, r1, r2)〉 |v5(0, 0, r1, r3, r4)〉 |v5(0, 0, r2, r5, r6)〉 .

vi() indicates the polynomial evaluation given by

vi(f1, f2, f3, f4, f5) = f1 + f2.xi + f3.x2i + f4.x

3i + f5.x

4i

where the expression vi(s, r1, r2) denotes vi(s1, s2, s3, r1, r2).Here we have taken xi = i for 1 ≤ i ≤ 5.

When combiner requests k = 3 parties, each party sends

its complete share. When d = 5, the combiner downloads the

first qudit of each share from all the five parties. The secret

recovery for this scheme is explained in detail in Appendix A.

F. Ramp quantum secret sharing (RQSS)

The QTS scheme defined earlier is a perfect QSS scheme

i.e. any set of parties is either authorized or unauthorized. But

it is also possible to design a non-perfect threshold scheme

such that a set of parties may be neither authorized nor

unauthorized. A generalization of the threshold schemes leads

to the ramp quantum secret sharing.

Definition 6 (Ramp secret sharing schemes). A ((t, n; z))ramp quantum secret sharing scheme for 1 ≤ z < t ≤ n ≤t + z is a QSS scheme with n parties where any t or more

parties can recover the secret, but z or fewer parties have no

information on the secret.

Note that the notation for RQSS schemes should not be

confused with that of CE-QTS schemes.

When z = t − 1, then the ramp scheme is identical to a

((t, n)) perfect threshold scheme. For z < t−1, there are sets

which may not be able to reconstruct the secret but can have

partial information about the secret.

Ogawa et al. [30] provided a construction for ((t, n; z))ramp QSS schemes for n ≤ t + z as follows. Consider

the case of n = t + z. Take m = t − z and a prime

q > t + z. The encoding for the basis state of the secret

s = (s1, s2, . . . , sm) ∈ Fmq is given by the superposition

|s1s2 . . . sm〉 7→∑

r

|u1(s, r), u2(s, r), . . . , un(s, r)〉 . (6)

Here r = (r1, r2, . . . , rz) ∈ Fzq and ui(s, r) is the polynomial

evaluation

ui(s, r) = s1 + s2xi + . . .+ smxm−1i

+r1xmi + r2x

m+1i + . . .+ rzx

t−1i

where x1, x2, . . . , xn are distinct non-zero constants from Fq.

Remark 1. A ((t, n; z)) ramp QSS scheme can be obtained

from a ((t, n+ℓ; z)) scheme by simply dropping some ℓ shares.

Thus, this construction gives ((t, n; z)) ramp schemes for

any n ≤ t + z. For example, an encoding for a ((t = 3, n =4; z = 1)) ramp QSS scheme will be as follows where each

qudit has dimension 5.

|s1s2〉 7→∑

r1∈F5

|s1 + s2 + r1〉 |s1 + 2s2 + 4r1〉

|s1 + 3s2 + 4r1〉 |s1 + 4s2 + r1〉

Each party is given one of the qudits from the encoded state.

Lemma 6. [30] The encoding in (6) provides a q-ary

((t, n; z)) ramp quantum secret sharing scheme for z < t, n ≤t+ z with the following parameters

q > t+ z (prime)

m = t− z

w1 = w2 = . . . = wn = 1.

This scheme can be used to encode a secret of m = ℓ(t−z)qudits by individually encoding every set of t − z qudits in

the secret. For t = k, z = k − 1, this scheme is very similar

to the ((k, n)) QTS scheme in Lemma 3.

Lemma 7. [30, Corollary 2] The share size averaged over

all parties in a ((t, n; z)) ramp QSS scheme should be at least

as large as 1t−z times the size of the secret.

Note that the bound on storage cost in ramp QSS is in terms

of average share size rather than individual share size. Clearly,

the RQSS scheme from Lemma 6 achieves this bound.

G. Quantum information theory

We briefly recall some of the terms of quantum information

theory and introduce the notation used in the paper. For further

reading, we refer the reader to [33].

6

The von Neumann entropy of a quantum system A with

density matrix ρA is given by

S(A) = − tr(ρA log ρA) = −

MA∑

i=1

λi log λi.

Here {λi} are the eigenvalues of ρA acting on a Hilbert space

HA of dimension MA. The maximum value for S(A) is given

by

S(A) ≤ logMA. (7)

Consider the bipartite quantum system AB whose density

matrix ρAB over the Hilbert space HA ⊗HB . Joint quantum

entropy of AB is defined as

S(AB) = − tr(ρAB log ρAB).

It satisfies two important properties.

S(AB) ≤ S(A) + S(B) (8)

S(AB) ≥ |S(A) − S(B)| (9)

The property (8) is called subadditivity and (9) is called the

Araki-Lieb inequality.

Mutual information between two quantum systems A and

B is defined as

I(A : B) = S(A) + S(B)− S(AB).

Consider an operator W acting on the system B and the

obtained state be represented by the system B′ i.e. ρB′ =W(ρB). Then the data processing inequality states that

I(A : B′) ≤ I(A : B) (10)

where A is another quantum system.

Lemma 8 (Quantum data processing inequality [34]). Con-

sider an arbitrary quantum state Q with a reference system Rsuch that QR is in pure state. If W is a quantum operation

which takes state Q to Q′, then

S(Q) ≥ S(Q′)− S(RQ′)

with equality achieved if and only if the original state Q can

be completely recovered from Q′.

III. UNIVERSAL CE-QTS: A FIRST LOOK

In this section, we take the first steps for a formal treat-

ment of universal communication efficient quantum thresh-

old schemes. After defining them, we illustrate the gains in

communication complexity for a suitably designed quantum

threshold scheme. Later sections in this paper provide con-

structions for such universal communication efficient quantum

secret sharing schemes.

Definition 7 (Universal CE-QTS). A ((k, n)) threshold secret

sharing scheme is said to be universal communication efficient,

if for any di and dj such that k ≤ di < dℓ ≤ n, CC(dℓ) <CC(di). Such schemes are denoted as ((k, n, ∗)) universal CE-

QTS schemes

In other words, in universal CE-QTS schemes, CCn(n) <CCn(n − 1) < . . . < CCn(k + 1) < CCn(k). Similar to

Definition 5, this definition also requires strict reduction in

communication cost CCn(d) for increasing values of d.

A. An example for universal CE-QTS

Consider the example of ((k = 3, n = 5, ∗)) universal CE-

QTS scheme with the following parameters.

q = 7 (11a)

m = 3 (11b)

w1 = w2 = . . . = w5 = 3 (11c)

CC5(3) = 9, CC5(4) = 8, CC5(5) = 5. (11d)

The encoding for the scheme is given by the following

mapping

|s〉 7→∑

r∈F67

|c11c12c13〉 |c21c22c23〉 |c31c32c33〉 (12)

|c41c42c43〉 |c51c52c53〉

where s = (s1, s2, s3) ∈ F37 indicates a basis state of the

quantum secret, r = (r1, r2, . . . , r6) ∈ F67 and cij is the

(i, j)th entry of the matrix

C = V Y.

Here the matrices V and Y are defined as follows.

V =

1 1 1 1 11 2 4 1 21 3 2 6 41 4 2 1 41 5 4 6 2

and Y =

s1 0 0

s2 r1 0

s3 r2 r3r1 r3 r5r2 r4 r6

.

The encoded state in (12) can also be written as,

∑

r∈F67

|v1(s, r1, r2)〉 |v1(0, r1, r2, r3, r4)〉 |v1(0, 0, r3, r5, r6)〉|v2(s, r1, r2)〉 |v2(0, r1, r2, r3, r4)〉 |v2(0, 0, r3, r5, r6)〉|v3(s, r1, r2)〉 |v3(0, r1, r2, r3, r4)〉 |v3(0, 0, r3, r5, r6)〉|v4(s, r1, r2)〉 |v4(0, r1, r2, r3, r4)〉 |v4(0, 0, r3, r5, r6)〉|v5(s, r1, r2)〉 |v5(0, r1, r2, r3, r4)〉 |v5(0, 0, r3, r5, r6)〉 .

Here vi() indicates the polynomial evaluation given by

vi(f1, f2, f3, f4, f5) = f1 + f2.xi + f3.x2i + f4.x

3i + f5.x

4i

and the expression vi(s, r1, r2) denotes vi(s1, s2, s3, r1, r2).Here, we have taken xi = i for 1 ≤ i ≤ 5.

When combiner requests d = 5 parties, they send the first

qudit from each of their shares. When d = 4, the combiner

downloads the first two qudits of each share of the four parties

contacted. When d = 3, the combiner downloads all three

qudits of the share of the three parties contacted. (For clarity,

the qudits accessible to the combiner have been highlighted in

blue in the description below.)

Consider the case when d = 5 i.e. the first qudits from all

five parties are accessed.

∑

r∈F67

|v1(s, r1, r2)〉 |v1(0, r1, r2, r3, r4)〉 |v1(0, 0, r3, r5, r6)〉|v2(s, r1, r2)〉 |v2(0, r1, r2, r3, r4)〉 |v2(0, 0, r3, r5, r6)〉|v3(s, r1, r2)〉 |v3(0, r1, r2, r3, r4)〉 |v3(0, 0, r3, r5, r6)〉|v4(s, r1, r2)〉 |v4(0, r1, r2, r3, r4)〉 |v4(0, 0, r3, r5, r6)〉|v5(s, r1, r2)〉 |v5(0, r1, r2, r3, r4)〉 |v5(0, 0, r3, r5, r6)〉

Applying the operation UV −1 on these five qudits, we obtain

|s〉∑

r∈F67

|v1(0, r1, r2, r3, r4)〉 |v1(0, 0, r3, r5, r6)〉|v2(0, r1, r2, r3, r4)〉 |v2(0, 0, r3, r5, r6)〉|v3(0, r1, r2, r3, r4)〉 |v3(0, 0, r3, r5, r6)〉|r1〉 |v4(0, r1, r2, r3, r4)〉 |v4(0, 0, r3, r5, r6)〉|r2〉 |v5(0, r1, r2, r3, r4)〉 |v5(0, 0, r3, r5, r6)〉

7

Here, the three qudits containing the basis state of the secret

are not entangled with any of the other qudits. Thus, any

arbitrary superposition of the basis states can be recovered

with the above step.

Consider the case when d = 4. Assume that the first four

parties are accessed. The first two qudits from the four parties

are sent to the combiner.

∑

r∈F67

|v1(s, r1, r2)〉 |v1(0, r1, r2, r3, r4)〉 |v1(0, 0, r3, r5, r6)〉|v2(s, r1, r2)〉 |v2(0, r1, r2, r3, r4)〉 |v2(0, 0, r3, r5, r6)〉|v3(s, r1, r2)〉 |v3(0, r1, r2, r3, r4)〉 |v3(0, 0, r3, r5, r6)〉|v4(s, r1, r2)〉 |v4(0, r1, r2, r3, r4)〉 |v4(0, 0, r3, r5, r6)〉|v5(s, r1, r2)〉 |v5(0, r1, r2, r3, r4)〉 |v5(0, 0, r3, r5, r6)〉

Applying the operation UK1 on the set of four second qudits,

where K1 is the inverse of V[2,5][4] , we obtain

∑

r∈F67

|v1(s, r1, r2)〉 |r1〉 |v1(0, 0, r3, r5, r6)〉|v2(s, r1, r2)〉 |r2〉 |v2(0, 0, r3, r5, r6)〉|v3(s, r1, r2)〉 |r3〉 |v3(0, 0, r3, r5, r6)〉|v4(s, r1, r2)〉 |r4〉 |v4(0, 0, r3, r5, r6)〉|v5(s, r1, r2)〉 |v5(0, r1, r2, r3, r4)〉 |v5(0, 0, r3, r5, r6)〉 .

Then, on applying the operators L6 |r2〉 |v1(s, r1, r2)〉,L5 |r2〉 |v2(s, r1, r2)〉, L3 |r2〉 |v3(s, r1, r2)〉 and L3 |r2〉|v4(s, r1, r2)〉, we obtain

∑

r∈F67

|v1(s, r1, 0)〉 |r1〉 |v1(0, 0, r3, r5, r6)〉|v2(s, r1, 0)〉 |r2〉 |v2(0, 0, r3, r5, r6)〉|v3(s, r1, 0)〉 |r3〉 |v3(0, 0, r3, r5, r6)〉|v4(s, r1, 0)〉 |r4〉 |v4(0, 0, r3, r5, r6)〉|v5(s, r1, r2)〉 |v5(0, r1, r2, r3, r4)〉 |v5(0, 0, r3, r5, r6)〉 .

Applying the operation UK2 on the set of four first qudits,

where K2 is the inverse of V[4][4] , we obtain the following state.

|s〉∑

r∈F67

|r1〉 |v1(0, 0, r3, r5, r6)〉|r2〉 |v2(0, 0, r3, r5, r6)〉|r3〉 |v3(0, 0, r3, r5, r6)〉|r1〉 |r4〉 |v4(0, 0, r3, r5, r6)〉|v5(s, r1, r2)〉 |v5(0, r1, r2, r3, r4)〉 |v5(0, 0, r3, r5, r6)〉

(13)

We disentangle the basis state |s〉 from the rest of qudits

by applying the operator UK3 on |r1〉 |r2〉 |r3〉 |r4〉 to get

|r1〉 |r2〉 |r3〉 |v5(0, r1, r2, r3, r4)〉 and then applying UK4 on

|s1〉 |s2〉 |s3〉 |r1〉 |r2〉 to get |s1〉 |s2〉 |s3〉 |r1〉 |v5(s, r1, r2)〉.

K3 =

1 0 0 0

0 1 0 0

0 0 1 0

V[2,5]{5}

and K4 =

1 0 0 0 0

0 1 0 0 0

0 0 1 0 0

0 0 0 1 0

V{5}

Now, we obtain

|s〉∑

r∈F67

|r1〉 |v1(0, 0, r3, r5, r6)〉|v5(s, r1, r2)〉 |v2(0, 0, r3, r5, r6)〉|r3〉 |v3(0, 0, r3, r5, r6)〉|r1〉 |v5(0, r1, r2, r3, r4)〉 |v4(0, 0, r3, r5, r6)〉|v5(s, r1, r2)〉 |v5(0, r1, r2, r3, r4)〉 |v5(0, 0, r3, r5, r6)〉

(14)

= |s〉∑

(r1,r2,r3,r′4,

r5,r6)∈F67

|r1〉 |v1(0, 0, r3, r5, r6)〉|v5(s, r1, r2)〉 |v2(0, 0, r3, r5, r6)〉|r3〉 |v3(0, 0, r3, r5, r6)〉|r1〉 |r

′4〉 |v4(0, 0, r3, r5, r6)〉

|v5(s, r1, r2)〉 |r′4〉 |v5(0, 0, r3, r5, r6)〉

(15)

= |s〉∑

(r1,r′2,r3,r

′4,

r5,r6)∈F67

|r1〉 |v1(0, 0, r3, r5, r6)〉|r′2〉 |v2(0, 0, r3, r5, r6)〉|r3〉 |v3(0, 0, r3, r5, r6)〉|r1〉 |r

′4〉 |v4(0, 0, r3, r5, r6)〉

|r′2〉 |r′4〉 |v5(0, 0, r3, r5, r6)〉 .

(16)

The variable change in (15) is possible because the

qudits∑

r4∈F7|v5(0, r1, r2, r3, r4)〉 |v5(0, r1, r2, r3, r4)〉 give

the uniform superposition∑

r′4∈F7|r′4〉 |r

′4〉 independent of

r1, r2, r3, r5, r6. The variable change from r2 to r′2 can also

be obtained similarly.

Now, the secret is disentangled with the rest of the qudits.

Thus, any arbitrary superposition of the basis states can be

recovered with above steps for d = 4.

In the case when d = 3, each of the three contacted parties

sends all three qudits in its share.

∑

r∈F67

|v1(s, r1, r2)〉 |v1(0, r1, r2, r3, r4)〉 |v1(0, 0, r3, r5, r6)〉|v2(s, r1, r2)〉 |v2(0, r1, r2, r3, r4)〉 |v2(0, 0, r3, r5, r6)〉|v3(s, r1, r2)〉 |v3(0, r1, r2, r3, r4)〉 |v3(0, 0, r3, r5, r6)〉|v4(s, r1, r2)〉 |v4(0, r1, r2, r3, r4)〉 |v4(0, 0, r3, r5, r6)〉|v5(s, r1, r2)〉 |v5(0, r1, r2, r3, r4)〉 |v5(0, 0, r3, r5, r6)〉

The secret recovery for d = 3 also uses operations similar

to those in the case of d = 4. For sake of completeness, the

secret recovery for d = 3 in this scheme has been explained

in Appendix B.

In all the three cases, the first step was to recover the basis

state |s〉 = |s1s2s3〉. The recovery is complete at this point

if the secret is any one of the basis states (identical to a

classical secret). But the quantum secret can be in an arbitrary

superposition of basis states. To recover this quantum secret,

the three qudits containing information on the secret needs

to be disentangled from the rest of the qudits. For example,

the first three qudits in (13), though they have information on

the basis states, are still entangled with the other qudits while

these qudits are disentangled form the other qudits in (16).

B. Comparison with fixed d CE-QTS

In contrast with the above scheme, for the standard ((3, 5))QSS scheme due to Cleve et al. 3 qudits need to be communi-

cated for recovery of 1 qudit of secret whenever the combiner

accesses three or more parties. The ((3, 5, 5)) CE-QTS scheme

from [12] described in (4) gives a better communication cost

of 5/3 qudits per 1 qudit of secret when the combiner accesses

5 parties. But this scheme does not provide the flexibility of

also contacting four parties communication efficiently. The

scheme provided above can solve that problem. It provides

communication efficiency at both d = 5 and d = 4.

At d = 4, the above scheme gives communication cost of

8 qudits to recover secret of 3 qudits i.e. 8/3 qudits per one

qudit of secret. However this is not the optimal communication

8

cost for d = 4. Because, for d = 4, the communication cost

in a ((3, 5, 4)) fixed d CE-QTS scheme from [12] gives 2

qudits per one qudit of secret. The constructions proposed in

the coming sections can give a ((3, 5, ∗)) universal CE-QTS

scheme with the same communication efficiency as the fixed

d CE-QTS schemes of [12] at both d = 4 and d = 5.

IV. CONCATENATION FRAMEWORK FOR CONSTRUCTING

COMMUNICATION EFFICIENT QTS SCHEMES

In this section, we develop a framework for constructing

communication efficient quantum secret sharing schemes. We

propose a general framework which can be used to derive

many classes of CE-QTS schemes. Ramp secret sharing

schemes and threshold schemes are the central ingredients of

the proposed constructions. First, we give a systematic method

to construct CE-QTS schemes where the combiner can contact

d parties, and reconstruct the secret. Here d is determined

prior to secret distribution. Then, we provide a systematic

method to construct CE-QTS schemes where the combiner

can contact any d parties to reconstruct the secret. Here, dcan be determined after secret distribution arbitrarily by the

combiner.

A. Fixed d CE-QTS from ramp QSS

Suppose we have a ((k, n, d)) CE-QTS scheme. Consider

any authorized set of d ≥ k parties. Since this is an authorized

set, we can reconstruct the secret. In a communication efficient

scheme, these d parties do not communicate their entire shares

to the combiner. They only communicate a portion of their

share. For gaining the intuition, let us assume that the portion

communicated by a party when a set of d parties are contacted

by the combiner is independent of the choice of the remaining

d− 1 parties. Since this is a ((k, n, d)) scheme, any k − 1 or

fewer portions i.e. partial shares cannot reveal any information

about the secret. However, k or more portions may reveal

partial information about the secret, while d out of all the nportions can completely recover the secret. Therefore, the set

of portions communicated by all the n parties to the combiner

can be modelled as a ((d, n; k − 1)) ramp QSS scheme.

Now let us see if we can build a ((k, n)) QTS scheme out

of this ((d, n; k−1)) ramp QSS scheme. If k of these n parties

attempt to reconstruct the secret with just their shares from the

ramp scheme, then their k shares may not be enough for the

reconstruction of the secret. The combiner will need shares

from d−k more parties of the ramp scheme for the additional

information required to recover the secret for sure. So we

extend the ramp scheme to a ((d, n + d − k; k − 1)) scheme

by allowing for d− k more new shares in the previous ramp

scheme. These additional d − k shares of the ramp scheme

are distributed to the n parties after encoding by a ((k, n))threshold scheme so that even if only k parties are contacted

by the combiner these d− k extra shares necessary for secret

recovery can be recovered. The full scheme is illustrated in

Fig. 1 and formally proved in Theorem 1.

Theorem 1 (Concatenation framework for fixed d CE-QTS).

A ((k, n, d)) CE-QTS scheme exists, if a ((d, n+d−k; k−1))

((t′,n′;z′))

ramp QSS

n′=n+d−k

t′=d

z′=k−1

|φ〉

...

n

...

d− k

Layer 1 encoding Layer 2 encoding

((k,n))QTS

...

n

A1 B1S1

A2 B2S2

A3 B3S3

......

...

An BnSn

Fig. 1: Concatenation framework for constructing ((k, n, d))CE-QTS scheme with ((d, n+d−k; k−1)) ramp QSS scheme.

Algorithm 1 Encoding for a ((k, n, d)) CE-QTS scheme using

a ((d, n+ d− k; k − 1)) ramp QSS and a ((k, n)) QTS.

Input: Secret |φ〉Output: Shares of the n parties, Sj for 1 ≤ j ≤ n

1: Encode the secret |φ〉 using the ((d, n + d − k; k − 1))ramp QSS scheme. Denote the jth share generated by the

ramp scheme as Aj for 1 ≤ j ≤ n+ d− k such that the

last d− k shares have the largest share sizes.

2: Encode the quantum state in (An+1, An+2, . . . , An+d−k)using a ((k, n)) quantum threshold scheme. Denote the

jth share of this QTS scheme as Bj for 1 ≤ j ≤ n.

3: Distribute Sj = (Aj , Bj) to the jth party for 1 ≤ j ≤ n.

ramp QSS scheme and a ((k, n)) QTS scheme exist. The

encoding for this scheme is given in Algorithm 1 and the

recovery in Algorithm 2.

Proof. The proof is by giving an explicit construction of a

((k, n, d)) CE-QTS scheme from the given ramp QSS and

((k, n)) threshold schemes. The encoding for the ((k, n, d))CE-QTS scheme is as given in Algorithm 1. Each share Sj

consists of two portions (Aj , Bj). We say that Aj forms the

first layer of the share Sj and Bj the second layer. Here, for

any L ⊆ [n], SL denotes {Sj}j∈L and |Sj | gives the number

of qudits in the share Sj . Similar notations are used for {Aj}and {Bj} as well.

(i) Recoverability: The secret recovery for the ((k, n, d))CE-QTS scheme is as given in Algorithm 2. While the

combiner accesses any set of d parties, it just needs

layer 1 of these parties to recover the secret from the

underlying ramp scheme. But while accessing only kparties, the combiner needs d−k more shares of the ramp

scheme to recover the secret. These d − k extra shares

are recovered from the ((k, n)) scheme with qudits from

second layer.

(ii) Secrecy: Consider any set L ⊆ [n] such that |L| =k − 1. By Lemma 1, let E1 be the purifying state

for the ramp QSS scheme such that the shares

A1, A2, . . . , An+d−k, E1 give a pure state scheme en-

coding |φ〉. Similarly, let E2 be the purifying state

9

Algorithm 2 Secret recovery for the ((k, n, d)) CE-QTS

scheme from the encoding in Algorithm 1

Input: Shares of k parties or layer 1 from any d parties

Output: Secret |φ〉1: if combiner has access to only k shares then

2: Download full shares from the k parties.

3: Use layer 2 from the k parties to recover the input to the

((k, n)) QTS scheme i.e. (An+1, An+2, . . . , An+d−k).

4: Use (An+1, An+2, . . . , An+d−k) and layer 1 from the

k parties to get d shares of the ramp QSS scheme and

recover the secret |φ〉.5: else if combiner has access to d shares then

6: Download layer 1 from the d parties.

7: Use layer 1 from the d parties to get d shares of the

ramp QSS scheme and recover the secret |φ〉.8: end if

for the perfect QSS scheme such that the shares

B1, B2, . . . , Bn, E2 give a pure state scheme encoding

(An+1, An+2, . . . , An+d−k). Overall, S[n] ∪ {E1, E2}gives a pure state scheme encoding |φ〉. If it can be

proved that S[n]\L ∪ {E1, E2} can recover the secret,

then by no-cloning theorem, SL has no information on

the secret which proves the secrecy property of the CE-

QTS scheme of Algorithm 1.

Assume that Alice has the shares S[n]\L ∪ {E1, E2}.

Clearly, BL is an unauthorized set in the QTS scheme.

By Lemma 2, B[n]\L ∪ {E2} is an authorized set

for recovering (An+1, An+2, . . . , An+d−k). Thus, Al-

ice recovers (An+1, An+2, . . . , An+d−k) from the QTS

scheme. Now, Alice has the shares A[n+d−k]\L ∪ {E2}.

AL is an unauthorized set in the ramp QSS scheme. By

Lemma 2, A[n−d+k]\L∪{E1} is an authorized set in the

ramp QSS scheme. Hence, Alice recovers the secret |φ〉from the ramp QSS scheme.

(iii) Communication efficiency: Consider the set of d parties

given by D ⊆ [n] which has maximum communication

cost among all sets of d parties. By definition, the com-

munication cost of this set of d parties equals CCn(d).Pick a K ⊂ D such that |K| = k.

CCn(k) =∑

j∈K

|Sj | =∑

j∈K

(|Aj |+ |Bj |)

≥∑

j∈K

|Aj |+∑

j∈K

n+d−k∑

ℓ=n+1

|Aℓ| (17)

=∑

j∈K

|Aj |+ k

n+d−k∑

ℓ=n+1

|Aℓ|

>∑

j∈K

|Aj |+

n+d−k∑

ℓ=n+1

|Aℓ| (18)

≥∑

j∈K

|Aj |+∑

j∈D\K

|Aj | (19)

=∑

j∈D

|Aj | = CCn(d)

where J = D\K . The bound on (17) is due to

Lemma 4 which implies that each share Bi of the QTS

scheme is at least as large as the input state given by

(An+1, An+2, . . . , An+d−k). The strict inequality in (18)

is because k > 1. The inequality (19) is due to the

fact that the shares An+1, An+2, . . . , An+d−k have the

largest sizes among all the n+ d− k shares of the ramp

scheme.

This concludes the proof of the theorem.

Theorem 1 can be used with various ramp QSS and

threshold schemes. Note that Theorem 1 does not require

the alphabet q to be a prime. The communication complexity

of the resulting schemes clearly depends on the underlying

ramp QSS scheme and QTS scheme. Here, we propose a

construction for CE-QTS scheme using the ramp QSS scheme

proposed by Ogawa et al. [30] and the QTS scheme from

Cleve et al. [2].

Corollary 1 (Concatenated construction for fixed d CE-QTS).

A q-ary ((k, n, d)) communication efficient QTS scheme can

be constructed using the encoding in Algorithm 1 with the

following parameters.

q > d+ k − 1 (prime)

m = d− k + 1

w1 = w2 = . . . = wn = d− k + 1

CCn(k) = k(d− k + 1)

CCn(d) = d.

Proof. Consider the Concatenation framework from Theo-

rem 1. Use the ramp scheme from [30] given in Lemma 6 and

the QTS scheme from [2] given in Lemma 3 for the underlying

schemes.

By Lemma 6, the dimension of the qudits has to be a prime

q such that q > d− k+1. This also satisfies the constraint on

the dimension for the QTS scheme from Lemma 3. The size

of the secret in the ramp scheme is m = d− k + 1 qudits.

Each share of the ramp QSS is of size one qudit. Thus the

first layer of each share in the CE-QTS has one qudit. The

input state for the ((k, n)) QTS will have d − k qudits. By

Lemma 3, the size of each share of the QTS scheme is also

d− k. Hence, the second layer of each share in CE-QTS has

d− k qudits. In total, each share in the CE-QTS scheme has

wj = d− k + 1 qudits for 1 ≤ j ≤ n.

When the combiner attempts to recover from just k parties,

each of them transmits the entire share of d − k + 1 qudits.

Thus CCn(k) = k(d − k + 1). When the combiner contacts

any d parties, each of them sends a qudit from the first layer,

giving CCn(d) = d.

In the CE-QTS scheme as described in Corollary 1, note

that the dimension of each of the d−k+1 qudits in the secret

has to be more than d + k − 1. Compare this with the CE-

QTS scheme from [12] which can give a smaller dimension

of q > 2k − 1. (Refer Table I.) However, using other ramp

schemes in this framework could lead to CE-QTS schemes

with qudits of dimension less than or equal to d− k + 1.

10

B. Universal CE-QTS from ramp QSS

Consider an ((n, n; k−1)) ramp QSS scheme (marked black

in Fig. 2). Now, if a combiner has access to only n − 1 out

of the n parties, the combiner will not be able to recover the

secret unless he receives one more share from this scheme. If

these n− 1 parties can send the combiner some more qudits

containing information about an extra share, then the combiner

can recover the secret with this extra share.

This flexibility can be achieved by instead taking an ((n+1, n; k − 1)) ramp QSS scheme where the first n shares are

given to n parties and the (n + 1)th share is encoded and

distributed among the n parties through an ((n − 1, n; k −1)) scheme (which is indicated with blue in Fig. 2). Then,

whenever the combiner has access to only n−1 parties, he will

first decode the ((n−1, n; k−1)) scheme to recover the extra

share and then use the n−1 shares from the ((n, n+1; k−1))ramp scheme along with this extra share to recover the secret.

((t,n′;z))

ramp QSS

n′=n+1

t=n

z=k−1

|φ〉

...

n

Layer 1 encoding Layer 2 encoding

((t,n′;z))

ramp QSS

n′=n

t=n−1

z=k−1

...

n

S(1)1

S1

S(1)2

S2

S(1)3

S3

...

...

S(1)n

Sn

S(2)1

S(2)2

S(2)3...

S(2)n

Fig. 2: Concatenation of two ramp quantum secret sharing

schemes to construct a ((t, n; k− 1)) ramp QSS scheme with

flexible t ∈ {n− 1, n}.

Thus, by concatenating an ((n− 1, n; k− 1)) ramp scheme

which encodes the extra share from an ((n, n+1; k−1)) ramp

scheme, a ((t, n; k−1)) ramp QSS with a flexible threshold t ∈{n− 1, n} can be designed. Similarly, a ((k, n, ∗)) universal

CE-QTS scheme is a QTS scheme in which the secret recovery

can happen efficiently for all thresholds d ∈ {k, k+1, . . . , n}.

The main idea in our following framework for constructing

universal CE-QTS schemes is that this generalization of d can

be achieved by concatenating n − k + 1 ramp schemes with

increasing threshold t successively.

Theorem 2. If ((di, n + di − k; k − 1)) ramp QSS schemes

exist for 1 ≤ i ≤ n − k + 1 where di = n + 1 − i, then a

q-ary ((k, n, ∗)) universal communication efficient QTS exists.

The encoding for this scheme is given in Algorithm 3 and the

recovery in Algorithm 4.

Proof. The proof is by giving a construction for the CE-QTS

scheme from the given ramp QSS schemes. The encoding of

the ((k, n, ∗)) universal CE-QTS is as given in Algorithm 3.

The ((di, n+ di − k; k− 1)) ramp QSS scheme is referred to

|φ〉

RQSS1

n1=n+h-1

t1=n

z1=k-1

n

To RQSS3

To RQSS4......

RQSS2

n2=n+h-2

t2=n-1

z2=k-1

n

To RQSS3

To RQSS4...

...

. . .

RQSSi

ni=n+h-i

ti=n-i+1

zi=k-1

n

. . .

. . .

...

From RQSSi−2

From RQSSi−1

To RQSSi+1

To RQSSi+2

...

. . .

RQSSh

nh=n

th=k

zh=k-1

n

. . .

. . .

...

. . .

...

From RQSSh−2

From RQSSh−1

Layer 1

...

...

Layer 2

...

...

. . .

...

...

Layer i

...

S(i)j

...

. . .

...

...

Layer h=n-k+1

...

...

S1

S2

...

Sj

...

Sn

Fig. 3: Concatenation framework for constructing ((k, n, ∗))universal CE-QTS scheme by concatenating multiple ramp

QSS schemes. Here di = n + 1 − i for 1 ≤ i ≤ n − k + 1and the ((ti = di, ni = n + di − k; zi = k − 1)) ramp QSS

scheme is denoted by RQSSi.

Algorithm 3 Encoding for a ((k, n, ∗)) universal CE-QTS

scheme

Input: Secret |φ〉Output: Shares of the n parties, Sj for 1 ≤ j ≤ n

1: Encode the secret |φ〉 using the RQSS1 scheme.

2: for i = 1 to n− k + 1 do

3: Distribute the smallest n shares from the RQSSi scheme

(S(i)1 , S

(i)2 , . . . , S

(i)n ) to the n parties. This is called the

ith layer of the encoding.

4: if di > k then

5: For all 1 ≤ ℓ ≤ di − k, the share S(i)n+ℓ goes as part

of input to the RQSSi+ℓ scheme.

6: The combined state of all the qudits passed from the

previous i ramp schemes to the RQSSi+1 scheme is

encoded using the RQSSi+1 scheme.

7: end if

8: end for

as RQSSi here. Here, for any L ⊆ [n], SL denotes {Sj}j∈L

and |Sj | gives the number of qudits in the share Sj . Similar

notations are used for {S(i)j } as well.

(i) Recoverability: The secret recovery for the ((k, n, ∗))universal CE-QTS scheme is as given in Algorithm 4.

Whenever the combiner accesses di parties, each of those

11

Algorithm 4 Secret recovery for the ((k, n, ∗)) universal CE-

QTS scheme in Algorithm 3.

Input: The first i layers of qudits from any di parties for any

1 ≤ i ≤ n− k + 1Output: Secret |φ〉

1: Use the ith layer of the di parties to recover the input

state of the RQSSi scheme.

2: for ℓ = i − 1 to 1 step -1 do

3: Consider the RQSSℓ scheme. The ℓth layer of the diparties will give di shares of this ramp scheme.

4: Collect dℓ−di = i−ℓ more shares of this ramp scheme

one each from the input states recovered from the layers

ℓ+ 1 to i.5: Use all these dℓ = di+ i− ℓ shares to recover the input

state of the RQSSℓ scheme.

6: end for

7: The input state of the RQSS1 scheme gives the secret |φ〉.

parties send the first i layers to the combiner. Once

this is done, the combiner has di shares in the RQSSi

scheme. Hence, RQSSi can be decoded and its input

qudits recovered. However, for decoding RQSSℓ schemes

for 1 ≤ ℓ ≤ i−1, the combiner still needs dℓ−di = i−ℓshares. For each RQSSℓ, these deficit shares can be

provided by the input qudits recovered from the schemes

RQSSℓ+1, RQSSℓ+2, . . . , RQSSi, one share from each

of these i−ℓ schemes. This iterative decoding of RQSSℓ

will finally give the secret |φ〉 after decoding RQSS1.

(ii) Secrecy: Consider the set J ⊂ [n] such that |J | = k− 1.

By Lemma 1, let Ei be the purifying state for the RQSSi

scheme for all 1 ≤ i ≤ n − k + 1. Assume Alice

has the set of shares {S[n]\J , E1, E2, . . . , En−k+1}. For

RQSSn−k+1, now Alice has the purifying state and

every share except some k − 1 shares. This set of

k − 1 shares in RQSSn−k+1 has no information on

its qudits. Therefore, by Lemma 2, Alice has an au-

thorized set for RQSSn−k+1, from which she recovers

its input qudits. These qudits will now give one extra

share to each of the schemes RQSSn−k till RQSS1.

With this extra share, RQSSn−k will have an authorized

set and from which Alice recovers its input qudits

and retrieves one extra share to each of the schemes

RQSSn−k−1 till RQSS1. By this iterative recovery pro-

cess, finally Alice can recover the secret |φ〉 from

RQSS1. Thus, the secret can be recovered from the set

of shares {S[n]\J , E1, E2, . . . , En−k+1}. Hence, by no-

cloning theorem, SJ has no information on the secret i.e.

any k−1 or less parties in this scheme has no information

on the secret.

(iii) Communication efficiency: Here, we will prove that for

any di such that k < di ≤ n, the communication cost in

our scheme is less than that of di − 1. By definition,

CCn(di) is the maximum among the communication

costs of all authorized sets of size di. Let D ⊆ [n] be the

authorized set which has this maximum communication

cost CCn(di). Let p ∈ D be one of these di parties.

Clearly, CCn(di − 1) should be greater than or equal to

the communication cost of the authorized set given by

D\{p}.

CCn(di − 1) ≥∑

j∈D\{p}

i+1∑

ℓ=1

|S(ℓ)j |

=∑

j∈D\{p}

i∑

ℓ=1

|S(ℓ)j |+

∑

j∈D\{p}

|S(i+1)j |

(20)

The di−1 shares in {S(i+1)j }j∈D\{p} are from the ((di−

1, n+di−1−k; k−1)) RQSSi ramp scheme. Recall from

Remark 1 that after dropping the remaining n−k shares

from RQSSi scheme, this set of shares alone will give a

((di − 1, di− 1; k− 1)) ramp scheme which encodes the

same state as RQSSi scheme. By Lemma 7, the average

share size of this ramp scheme is at least 1di−k times the

total input size.

1

di − 1

∑

j∈D\{p}

|S(i+1)j | ≥

1

di − k

i∑

j=1

|S(j)n+i+1−j |

Applying this bound in (20), we obtain

CCn(di − 1)

≥∑

j∈D\{p}

i∑

ℓ=1

|S(ℓ)j |+

di − 1

di − k

i∑

ℓ=1

|S(ℓ)n+i−ℓ+1|

>∑

j∈D\{p}

i∑

ℓ=1

|S(ℓ)j |+

i∑

ℓ=1

|S(ℓ)n+i−ℓ+1| (21)

≥∑

j∈D\{p}

i∑

ℓ=1

|S(ℓ)j |+

i∑

ℓ=1

|S(ℓ)p | (22)

=∑

j∈D

i∑

ℓ=1

|S(ℓ)j | = CCn(di)

The strict inequality in (21) is because k > 1. The

inequality (22) is due to the fact that the shares

S(i)n+1, S

(i)n+2, . . . , S

(i)n+di−k have the largest sizes among

the n + di − k shares of the RQSSi scheme. This

concludes the proof.

With the above framework, the following construction for

a universal CE-QTS can be provided by using the ramp QSS

scheme by Ogawa et al [30].

Corollary 2 (Concatenated construction for universal

CE-QTS). A q-ary ((k, n, ∗)) universal communication effi-

cient QTS scheme can be constructed using the encoding in

Algorithm 3 with the following parameters.

q > n+ k − 1 (prime)

m = lcm{1, 2, . . . , n− k + 1}

w1 = w2 = . . . = wn = m

CCn(d) =dm

d− k + 1for d ∈ {k, k + 1, . . . , n}

12

Proof. Consider the universal CE-QTS scheme from Algo-

rithm 3 and use the schemes from [30] given in Lemma 6 for

the underlying ramp schemes. Clearly the dimension of each

qudit q should be above ti + zi = di + k− 1 = n+ k − i for

all 1 ≤ i ≤ n− k + 1. Therefore, q > n+ k − 1.

Let ei be the number of qudits in the input state of the ramp

QSS scheme RQSSi corresponding to the ith layer. The secret

is the input to the scheme RQSS1. Clearly, e1 = m. For i > 1,

the input state of the ramp QSS scheme RQSSi has one share

each from the ramp QSS schemes RQSS1 to RQSSi−1.

ei =

i−1∑

ℓ=1

|S(ℓ)n+i−ℓ| (23)

Recall that, in the ((ti, ni; zi)) ramp schemes given in

Lemma 6, the size of each share is 1ti−zi

times the secret

size i.e. for any 1 ≤ j ≤ n+ di − k,

|S(i)j | =

eidi − k + 1

. (24)

Solving the recursion from (23) and (24) with the initial

condition e1 = m, we obtain, for 2 ≤ i ≤ n− k + 1,

ei =m

di−1 − k + 1.

Note that for each 1 ≤ i ≤ n − k + 1, implementing the

scheme RQSSi requires ei to be divisible by ti−zi = di−k+1.

This can be achieved by taking m = lcm{1, 2, . . . , n−k+1}.

From (24), the size of the jth share from RQSSi is

|S(1)j | =

m

(d1 − k + 1)

|S(i)j | =

m

(di − k + 1)(di−1 − k + 1)

for 2 ≤ i ≤ n − k + 1. The total communication cost during

secret recovery from a set of any di parties given by D can

be calculated as

CCn(di) =∑

j∈D

i∑

ℓ=1

|S(ℓ)j | =

dim

di − k + 1

Also, for 1 ≤ j ≤ n, the size of the jth share is given by

wj =

n−k+1∑

i=1

|S(i)j | =

n−k+1∑

i=1

eidi − k + 1

= m.

The above corollary gives a construction based on the

concatenation framework for a universal CE-QTS scheme. In

the next section, we give another construction for universal

CE-QTS schemes.

V. UNIVERSAL CE-QTS SCHEMES BASED ON STAIRCASE

CODES

In this section, we propose an alternate construction of

universal CE-QTS based on classical communication efficient

secret schemes constructed using Staircase codes [26]. While

constructing QSS schemes based on classical secret sharing

schemes, there are some important differences. For QSS

schemes, the secret recovery should recover not just the basis

states but also any arbitrary superposition of the basis states.

Hence the qudits containing the secret have to be disentangled

from the remaining qudits, thus making the secret recovery in

QSS schemes more involved.

A. Encoding

Communication efficient quantum secret sharing schemes for

particular values of k and n = 2k − 1 can be designed to

work for all possible values of d in the range k through nwhere k ≤ d ≤ n. We introduce the following terms before

discussing the scheme. For 1 ≤ i ≤ k,

di = n+ 1− i = 2k − i (25a)

m = lcm{k, k − 1, . . . , 1} (25b)

ai = m/(di − k + 1) (25c)

bi = ai − ai−1 for i > 1, b1 = a1 (25d)

Here m is the total number of secret qudits shared. The total

number of qudits with each party is also given by m. This

is consistent with the fact that in a perfect threshold secret

sharing scheme the size of the share must be at least as large

as the secret [5], [8].

Now ai gives the number of qudits communicated from each

accessible share when di parties are accessed to recover the

secret. This means that aidi qudits are communicated to the

combiner when di parties are contacted. Pick a prime number

q > 2k − 1.

Consider the basis state of the secret s = (s1, s2, . . . , sm) ∈

Fmq and r = (r1, r2, . . . , rm(k−1)) ∈ F

m(k−1)q .

Entries in s are rearranged into the matrix S of size k ×(m/k).

S =

s1 sk+1 · · · sm−k+1

s2 sk+2 · · · sm−k+2

......

. . ....

sk s2k · · · sm

(26)

Entries in r are rearranged into k matrices i.e. R1 of size

(k− 1)× b1, R2 of size (k− 1)× b2 and so on till Rk of size

(k − 1)× bk.

R1 =

r1 rk · · · r(a1−1)(k−1)+1

r2 rk+1 · · · r(a1−1)(k−1)+2

......

. . ....

rk−1 r2(k−1) · · · ra1(k−1)

For 2 ≤ i ≤ k, Ri is given by

rai−1(k−1)+1 r(ai−1+1)(k−1)+1 · · · r(ai−1)(k−1)+1

rai−1(k−1)+2 r(ai−1+1)(k−1)+2 · · · r(ai−1)(k−1)+2

......

. . ....

r(ai−1+1)(k−1) r(ai−1+2)(k−1) · · · rai(k−1)

.

The matrix C, called code matrix, is defined as follows.

C = V Y

13

where Y is given by

Y =

S

00

. . .0

D1 D2 Dk−1

R1 R2 R3 . . . Rk

and V is a n× n Vandermonde matrix given by

V =

1 x1 . . . xd−11

1 x2 . . . xd−12

......

. . ....

1 xn . . . xd−1n

. (27)

where x1, x2, ..., xn are distinct non-zero constants from Fq.

Here, Di of size (k − i)× bi+1 is constructed by rearranging

the entries in ith row of the matrix [R1 R2 . . . Ri]. Clearly,

Di contains ai = (k − i)bi+1 entries.

The encoding for a universal QTS is given as follows:

|s1s2 . . . sm〉 7→∑

r∈Fm(k−1)q

n⊗

i=1

|ci,1ci,2 . . . ci,m〉 (28)

where cij is the entry in C = V Y from ith row and jthcolumn. After encoding, the uth set of m qudits is given to

the uth party.

For example, take k = 3. The ((k = 3, n = 5, ∗)) scheme

will have the following parameters.

q = 7

m = lcm{1, 2, 3} = 6

w1 = w2 = w3 = w4 = w5 = 6

d1 = 5, d2 = 4, d3 = 3

a1 = 2, a2 = 3, a3 = 6

b1 = 2, b2 = 1, b3 = 3

Then C, the coding matrix for k = 3 is given as.

1 1 1 1 1

1 2 4 1 2

1 3 2 6 4

1 4 2 1 4

1 5 4 6 2

s1 s4 0 0 0 0

s2 s5 r1 0 0 0

s3 s6 r3 r2 r4 r6r1 r3 r5 r7 r9 r11r2 r4 r6 r8 r10 r12

The encoding for this ((3, 5, ∗)) scheme is then given by

(28). Note that each entry in matrix C, cij is a function of

s and r. However, Di are functions of r alone. For a detailed

description of this scheme, refer to the appendix in [35].

Our encoding matrix is somewhat similar to the matrix used

in [26]. However, there are some minor structural differences.

Since we are encoding quantum states in superposition, there

is no need for generating random bits. Furthermore, due to the

no-cloning theorem, the total number of parties cannot exceed

2k − 1.

B. Reconstruction of the secret

The combiner can reconstruct the secret depending upon

the choice of d. Once d = di is chosen, the combiner contacts

a set of any di parties to reconstruct the secret. Each of the

contacted party sends ai =m

di−k+1 qudits to the combiner. In

total, the combiner has dimdi−k+1 = aidi qudits.

With respect to the ((3, 5, ∗)) example in the previous

section, suppose that the third party is contacted for recon-

struction. If the party belongs to recovery set of size d1 = 5,

then a1 = 2 qudits are communicated to the combiner.

Similarly, if d2 = 4, then a2 = 3 and if d3 = 3, then a3 = 6qudits are sent.

The secret reconstruction happens in two stages. First, the

basis states of the secret are reconstructed through suitable

unitary operations. The classical secret sharing schemes stop

the reconstruction at this point. But, the qudits containing the

basis states of the secret can be entangled with the remaining

qudits. So, in the second stage, the secret is extracted into a

set of qudits that are disentangled with the remaining qudits.

Lemma 9 (Secret recovery). For a ((k, 2k − 1, ∗)) scheme

with the encoding given in (28), we can recover the secret

from any d = 2k− i shares where 1 ≤ i ≤ k by downloading

only the first ai =m

d−k+1 qudits from each share where m is

as given in (25).

Proof. Each of the d participants sends their first ai qudits

to the combiner for reconstructing the secret. Let D ={j1, j2, . . . , jd} ⊆ {1, 2, . . . , 2k − 1} be the set of d shares

chosen and E = {jd+1, jd+2, . . . , j2k−1} be the complement

of D. Then, (28) can be rearranged as

∑

r∈Fm(k−1)q

|cj1,1cj2,1...cjd,1〉 |cj1,2cj2,2...cjd,2〉

. . . |cj1,acj2,a...cjd,a〉∣

∣cjd+1,1cjd+2,1...cjn,1⟩ ∣

∣cjd+1,2cjd+2,2...cjn,2⟩

. . .∣

∣cjd+1,acjd+2,a...cjn,a⟩

|c1,a+1c2,a+1...cn,a+1〉 |c1,a+2c2,a+2...cn,a+2〉

. . . |c1,mc2,m...cn,m〉 (29)

where we have highlighted (in blue) the qudits communicated

to the combiner. For the sake exposition we will first cover

the case of i = 1 i.e. di = 2k − 1 where all the parties are

contacted for their first a1 qudits by the combiner.

Case (i): i = 1For i = 1, d = 2k − 1 = n. Now (29) can be rewritten as

∑

r∈Fm(k−1)q

|V (S,R1)〉 |V (0, D1, R2)〉 |V (0, D2, R3)〉

. . . |V (0, Dk−1, Rk)〉

where we slightly abused the notation. By A(B1, B2, B3) we

actually refer to the matrix product A[

Bt1 Bt

2 Bt3

]t.

Since V is a n×n Vandermonde matrix and, we can apply

V −1 to the state |V (S,R1)〉, to obtain

|S〉∑

r∈Fm(k−1)q

|R1〉 |V (0, D1, R2)〉 |V (0, D2, R3)〉

. . . |V (0, Dk−1, Rk)〉

14

We can clearly see that the secret is disentangled with the rest

of the qudits. Therefore, we can recover arbitrary superposi-

tions also.

Case (ii): 2 ≤ i ≤ k: Under this case, the state of

the system is as follows. (This is the same as (29), only the

qudits in possession of the combiner have been highlighted.)

∑

r∈Fm(k−1)q

|VD(S,R1)〉 |VD(0, D1, R2)〉 . . . |VD(0, Di−1, Ri)〉

|VE(S,R1)〉 |VE(0, D1, R2)〉 . . . |VE(0, Di−1, Ri)〉

|V (0, Di, Ri+1)〉 . . . |V (0, Dk−1, Rk)〉

We can simplify this state using the fact VD(0, Dj , Rj+1) =

V[j+1,n]D (Dj , Rj+1).

=∑

r∈Fm(k−1)q

|VD(S,R1)〉∣

∣

∣VD

[2,2k−1](D1, R2)⟩

. . .∣

∣

∣VD

[i,2k−1](Di−1, Ri)⟩

|VE(S,R1)〉 |VE(0, D1, R2)〉

. . . |VE(0, Di−1, Ri)〉

|V (0, Di, Ri+1)〉 . . . |V (0, Dk−1, Rk)〉

Since VD[i,2k−1] is a d×d Vandermonde matrix, the combiner

can apply the inverse of VD[i,2k−1] to

∣

∣

∣V

[i,n]D (Di−1, Ri)

⟩

to

transform the state as follows.

∑

r∈Fm(k−1)q

|VD(S,R1)〉∣

∣

∣VD

[2,2k−1](D1, R2)⟩

. . .∣

∣

∣VD

[i−1,2k−1](Di−2, Ri−1)⟩

|Di−1〉 |Ri〉

|VE(S,R1)〉 |VE(0, D1, R2)〉 . . . |VE(0, Di−1, Ri)〉

|V (0, Di, Ri+1)〉 . . . |V (0, Dk−1, Rk)〉

Note that the matrix Di−1 contains elements from the (i−1)throw of Ri−1. Rearranging the qudits, we get

∑

r∈Fm(k−1)q

|VD(S,R1)〉∣

∣

∣VD

[2,2k−1](D1, R2)⟩

. . .∣

∣

∣VD

[i−2,2k−1](Di−3, Ri−2)⟩

|Wi−1(Di−2, Ri−1)〉 |Di−1\{Ri−1}〉 |Ri〉

|VE(S,R1)〉 |VE(0, D1, R2)〉 . . . |VE(0, Di−1, Ri)〉

|V (0, Di, Ri+1)〉 . . . |V (0, Dk−1, Rk)〉

where Dℓ\{Rj, Rj+1, . . . , Rℓ} indicates a vector with entries

from Dℓ which are not in the matrices Rj , Rj+1, . . . , Rℓ.

Here Wℓ = [VD[ℓ,2k−1]t wℓ,k+1 wℓ,k+2 . . . wℓ,k+i−ℓ]

t for

1 ≤ ℓ ≤ i−1 where wℓ,j is a column vector of length (2k−ℓ)with one in the jth position and zeros elsewhere. Wℓ is a

(2k − ℓ)× (2k − ℓ) full-rank matrix. Clearly,

Wℓ

[

Dℓ−1

Rℓ

]

=

[

VD[ℓ,2k−1](Dℓ−1, Rℓ)Rℓ,[ℓ,i−1]

]

Now applying W−1i−1 to the state |Wi−1(Di−2, Ri−1)〉, we

obtain∑

r∈Fm(k−1)q

|VD(S,R1)〉∣

∣

∣VD

[2,2k−1](D1, R2)⟩

. . .∣

∣

∣VD

[i−2,2k−1](Di−3, Ri−2)⟩

|Di−2〉 |Ri−1〉 |Di−1\{Ri−1}〉 |Ri〉

|VE(S,R1)〉 |VE(0, D1, R2)〉 . . . |VE(0, Di−1, Ri)〉

|V (0, Di, Ri+1)〉 . . . |V (0, Dk−1, Rk)〉

Rearranging the qudits, we obtain,∑

r∈Fm(k−1)q

|VD(S,R1)〉∣

∣

∣VD

[2,2k−1](D1, R2)⟩

. . . |Wi−2(Di−3, Ri−2)〉

|Di−2\Ri−2〉 |Ri−1〉 |Di−1\{Ri−1, Ri−2}〉 |Ri〉

|VE(S,R1)〉 |VE(0, D1, R2)〉 . . . |VE(0, Di−1, Ri)〉

|V (0, Di, Ri+1)〉 . . . |V (0, Dk−1, Rk)〉

Repeating this process for (Di−3, Ri−2) through (S,R1), by

applying the inverses of Wi−2,Wi−3, . . .W1 in successive

steps to the suitable sets of qudits and rearranging, we obtain,

|S〉∑

r∈

Fm(k−1)q

|R1〉 |R2〉 . . . |Ri〉

|VE(S,R1)〉 |VE(0, D1, R2)〉 . . . |VE(0, Di−1, Ri)〉

|V (0, Di, Ri+1)〉 . . . |V (0, Dk−1, Rk)〉

The m qudits corresponding to |S〉 is still entangled with other

qudits in the system.

Since Di−1 is formed by entries from the (i− 1)th row in

[R1 R2 . . . Ri−1], we can rearrange the qudits to obtain

|S〉∑

r∈

Fm(k−1)q

∣

∣R1,Ji−1

⟩ ∣

∣R2,Ji−1

⟩

. . .∣

∣Ri−1,Ji−1

⟩

|Di−1〉 |Ri〉

|VE(S,R1)〉 |VE(0, D1, R2)〉 . . . |VE(0, Di−1, Ri)〉

|V (0, Di, Ri+1)〉 . . . |V (0, Dk−1, Rk)〉

where Jℓ = [k − 1]\{ℓ} for 1 ≤ ℓ ≤ i− 1.

Consider the (2k − ℓ)× (2k − ℓ) full-rank matrix

Pℓ =

Ik−ℓ+1 0

V[ℓ,2k−1]E

0 Ik−i

where 1 ≤ ℓ ≤ i− 1. Apply Pi−1 on |Di−1〉 |Ri〉 to obtain

|S〉∑

r∈

Fm(k−1)q

∣

∣R1,Ji−1

⟩ ∣

∣R2,Ji−1

⟩

. . .∣

∣Ri−1,Ji−1

⟩

|Di−1〉 |VE(0, Di−1, Ri)〉∣

∣Ri,[i,k−1]

⟩

|VE(S,R1)〉 |VE(0, D1, R2)〉 . . . |VE(0, Di−1, Ri)〉

|V (0, Di, Ri+1)〉 . . . |V (0, Dk−1, Rk)〉

Now, this can be rearranged to get

|S〉∑

(R1,R2,...Ri−1,Ri,[i,k−1],

Ri+1...Rk)

∈Fm(k−1)−(i−1)biq

|R1, R2, . . . , Ri−1〉∣

∣Ri,[i,k−1]

⟩

|VE(S,R1)〉 |VE(0, D1, R2)〉

. . . |VE(0, Di−2, Ri−1)〉

|V (0, Di, Ri+1)〉 . . . |V (0, Dk−1, Rk)〉∑

Ri,[1,i−1]

∈F(i−1)×biq

|VE(0, Di−1, Ri)〉 |VE(0, Di−1, Ri)〉

15

= |S〉∑

(R1,R2,...Ri−1,Ri,[i,k−1],

Ri+1...Rk)

∈Fm(k−1)−(i−1)biq

|R1, R2, . . . , Ri−1〉∣

∣Ri,[i,k−1]

⟩

|VE(S,R1)〉 |VE(0, D1, R2)〉

. . . |VE(0, Di−2, Ri−1)〉

|V (0, Di, Ri+1)〉 . . . |V (0, Dk−1, Rk)〉∑

Ti∈F(i−1)×biq

|Ti〉 |Ti〉

because the state∑

Ri,[1,i−1]

∈F(i−1)×biq

|VE(0, Di−1, Ri)〉 |VE(0, Di−1, Ri)〉

is a uniform superposition of states |Ti〉 |Ti〉 over Ti ∈

F(i−1)×biq independent of the value of Di−1 and Ri,[i,k−1].

Repeating these operations with all |Rj〉 for 1 ≤ j ≤ i− 1,

we obtain,

|S〉∑

(Ri+1...Rk)

∈F(m−ai)(k−1)q

(R1,[i,k−1],...Ri,[i,k−1])

∈F(k−i)aiq

∣

∣R1,[i,k−1], R2,[i,k−1], . . . Ri,[i,k−1]

⟩

|V (0, Di, Ri+1)〉 . . . |V (0, Dk−1, Rk)〉

∑

T1∈

F(i−1)×b1q

|T1〉 |T1〉∑

T2∈

F(i−1)×b2q

|T2〉 |T2〉 . . .∑

Ti∈

F(i−1)×biq

|Ti〉 |Ti〉

At this point the secret is completely disentangled with the

rest of the qudits and the recovery is complete.

C. Secrecy

In the scheme given by (28), the combiner can recover the

secret by accessing k parties (from case (ii) when i = k in the

proof of Lemma 9). So, by no-cloning theorem, the remaining

k− 1 parties in the scheme should have no information about

the secret. Thus, this scheme satisfies the secrecy property.

With these results in place we have our central contribution.

Theorem 3 (Staircase construction for universal CE-QTS).

The encoding given in (28) gives a ((k, n = 2k − 1, ∗))universal CE-QTS scheme with the following parameters.

q > 2k − 1 (prime)

m = lcm{1, 2, . . . , k}

w1 = w2 = . . . = wn = m

CCn(d) =dm

d− k + 1for d ∈ {k, k + 1, . . . , 2k − 1}

We can compare this universal CE-QTS scheme with the

scheme from Corollary 2. (Refer Table I.) Both give the same

values for the parameters wj/m and CCn(d)/m. Though the

scheme based on Staircase codes gives a better bound on the

dimension of the qudits, the concatenated construction could

give a smaller secret size for n < 2k − 1.

D. Discussion on communication complexity gains

In the standard ((k, n)) QTS scheme from [2], the secret

can be recovered when the combiner communicates with kparties. Here, if the secret is of size m qudits, then the number

of qudits communicated to the combiner is km qudits. The

communication cost per secret qudit is k qudits.

In the ((k, n, d)) communication efficient QTS schemes

from [12] and concatenated construction in Corollary 1, the

secret can be recovered when the combiner contacts k parties

and receiving km qudits where m = d − k + 1. This leads

to a cost of k qudits per secret qudit. However, when the

combiner contacts d parties, where d is a fixed value such that

k ≤ d ≤ n, the secret can be recovered with a communication

cost of dmd−k+1 qudits. The cost per qudit is d

d−k+1 which is

strictly less than k for d > k.

In the ((k, n, ∗)) universal QTS schemes, the secret can

be recovered by the combiner by accessing any d parties,

where the number of parties accessed given by k ≤ d ≤ ncan also be chosen by the combiner. For the chosen value

of d, the secret can be recovered by downloading dmd−k+1

qudits. The communication cost for each qudit of the secret

is dd−k+1 which is same as that of [12]. The communication

cost decreases with the increasing number of parties accessed.

(Refer Fig. 4.) However, we are able to achieve this for all

possible d using the same scheme and not fixing d a priori.

Refer Table I for a comparison of the different QTS schemes

we discussed so far. The optimality of our construction with

respect to the communication complexity will be discussed in

the next section.

∼ ∼

di

CCn(di)

0k

k ◦

k+1

k+12

◦

k+2

k+23

◦...

◦

. . .

. . .

◦

2k−1

2k−1k

◦

Fig. 4: Communication cost for d ∈ {k, k + 1, . . . , n} in

((k, n = 2k − 1, ∗)) universal CE-QTS schemes from Con-

catenated construction and Staircase construction

VI. OPTIMALITY OF CE-QTS SCHEMES

In this section, we derive lower bounds on the quantum

communication complexity of the quantum threshold schemes.

Our bounds are applicable for both universal and non-universal

communication efficient schemes. Specifically, we show that

secret recovery from a set of d shares in communication

16

efficient QTS schemes (for both fixed d and universal) requires

at least dd−k+1 qudits to be transmitted to the combiner for

each qudit in the secret. Then we show that our constructions

satisfies these bounds on communication complexity. We also

discuss the optimality of our constructions with respect to the

storage cost.

A. Lower bound on communication complexity

Bound on communication complexity for the ((k, n, d))CE-QTS was already shown in [12] for the special case

of n = 2k − 1. Here we generalize these bounds to both

((k, n, d)) and ((k, n, ∗)) QTS and also lift the restriction that

n = 2k−1. We first bound the combined size of partial shares

from d− k + 1 parties. The generalization of the result from

n = 2k − 1 to n ≤ 2k − 1 is mainly due to a difference in

our approach to prove this bound. Then we use this to prove

the bound on the communication cost i.e. the combined size

of partial shares from all d parties in a way similar to [12].

Our bounds imply that the proposed CE-QTS and universal

CE-QTS constructions for all n ≤ 2k − 1 are optimal with

respect to the communication cost. First we need the following

lemmas.

Lemma 10. [5, Theorem 5] A party having access to an

authorized set of shares in a quantum secret sharing scheme

can replace the secret encoded with any arbitrary state (of

the same dimension as the secret) without disturbing the

remaining shares. After this replacement, secret recovery from

any of the authorized sets will give only the new state.

Lemma 11. [12, Lemma 5] Even in the presence of pre-

existing entanglement between two parties, transmitting an

arbitrary quantum state from a Hilbert space of dimension

M requires a channel of dimension M .

With these two lemmas we can bound the combined size

of partial shares from d− k+1 parties in the secret recovery

from d parties.

Lemma 12. In any ((k, n)) QSS scheme, which recovers a

secret of dimension M by accessing a set of d parties, the total

communication to the combiner from any d − k + 1 parties

among the d parties is of dimension at least M .

Proof. Let S1, S2, . . . , Sn be the shares of the n parties in

the ((k, n)) QSS scheme. By Lemma 1, consider an extra

share E for the given ((k, n)) scheme such that the new QSS

scheme with n+ 1 parties thus obtained is a pure state QSS

scheme. (This pure state QSS scheme need not be a threshold

QSS scheme.) Now, we prove the lemma by means of a

communication protocol between Alice and Bob based on this

pure state QSS scheme. The objective of the protocol is for

Alice to send an arbitrary state |ψ〉 of dimension M to Bob.

First, encode the state |0〉 using the pure state QSS scheme.

Consider the set of d parties D ⊆ [n] where each participant

in D can send a part of its share to the combiner to recover

the secret. Consider any subset L ⊆ D with d− k+1 parties.

Bob is given the k− 1 shares from the parties in D\L, which

form an unauthorized set. Alice is given the d− k + 1 shares

from L, the n− d shares from [n]\D and the extra share E.

By Lemma 2, the set of shares with Alice form an authorized

set, as this set is actually a complement of the unauthorized

set with Bob.

Now, Alice replaces the secret |0〉 in the scheme with |ψ〉(by Lemma 10). Clearly, Bob has no prior information on |ψ〉even though he may share some entanglement with Alice due

to qudits he received so far.

Now, if Alice needs to transmit |ψ〉 to Bob, she needs to

transmit some of the qudits with her to Bob so that Bob can use

the secret recovery of the underlying QSS scheme to recover

|ψ〉. To achieve this, Alice can transmit to Bob the necessary

parts from the d − k + 1 shares from L (which along with

necessary parts from the k− 1 shares from D\L already with

him will give complete information about the secret). Applying

Lemma 11 here, it is implied that the communication from the

shares in L during the secret recovery from the shares in Dhas to be at least M .

Next we use Lemma 12 to obtain a lower bound on

communication complexity of d partial shares. We use the

same technique as in [12] to achieve this.

Theorem 4 (Lower bound on communication cost). In any

((k, n)) quantum secret sharing scheme, recovery of a secret

of dimension M by accessing d parties requires communi-

cation of a state from a Hilbert space of dimension at least

Md/(d−k+1) to the combiner.

Proof. Consider a set of d parties given by D ⊆ [n] accessed

by the combiner for secret recovery. For each i ∈ D, let the

part of the share transmitted by the jth party to the combiner

be denoted as Hj,D . Clearly Hj,D is a subsystem of Sj .

Without loss of generality, we take the set of parties to be

given by D = {1, 2, . . . , d} such that

dim(H1,D) ≥ dim(H2,D) ≥ . . . ≥ dim(Hd,D). (30)

Applying Lemma 12 for the partial shares

Hk,D, Hk+1,D, . . . Hd,D sent to the combiner, the overall

communication from these d− k + 1 shares is bounded as

d∏

j=k

dim(Hj,D) ≥M. (31)

Then by (30), we have

dim(Hk,D)d−k+1 ≥M

dim(Hk,D) ≥M1/(d−k+1).

This implies

dim(Hj,D) ≥M1/(d−k+1) (32)

for 1 ≤ j ≤ k. From (31) and (32), the communication to the

combiner from the d shares in D can be lower bounded as

d∏

j=1

dim(Hj,D) =

k−1∏

j=1

dim(Hj,D)

d∏

j=k

dim(Hj,D)

≥

( k−1∏

j=1

M1/(d−k+1)

)

M

=Md/d−k+1)

17

This shows that the set of d parties D must communicate

a state that is in a Hilbert space of dimension at least

Md/(d−k+1).

In the next subsection, we use this bound to evaluate the

performance of our constructions for CE-QTS schemes.

B. Optimality of the proposed schemes

The bound on the dimension of the communication cost in

Theorem 4 can be used to obtain a bound on the communica-

tion cost in terms of qudits.

Corollary 3. In a ((k, n, d)) CE-QTS scheme sharing a secret

of m qudits, the communication cost is bounded as

CCn(d) ≥dm

d− k + 1.

Proof. Let q be the dimension of each qudit in the scheme.

Clearly, the dimension of the secret M = qm. By Theorem 4,

the communication from any d shares is going to be at least

qdm

d−k+1 . Thus, the d parties need to send at least dmd−k+1 qudits

for recovering the secret.

Recall from Lemma 4 that, for any QTS scheme, the share

size is lower bounded by the size of the secret i.e. for all

1 ≤ j ≤ n

wj ≥ m.

Remark 2. ((k, n, d)) CE-QTS scheme from [12] based on

Staircase codes has optimal storage cost and optimal commu-

nication cost.

Remark 3. ((k, n, d)) CE-QTS scheme from Corollary 1

based on ramp schemes from [30] has optimal storage cost

and optimal communication cost.

Note that these bounds apply for both fixed d and universal

CE-QTS schemes.

Corollary 4. In a ((k, n, ∗)) universal CE-QTS scheme shar-

ing a secret of m qudits, for any d such that k ≤ d ≤ n, the

communication cost is bounded as

CCn(d) ≥dm

d− k + 1.

Remark 4. ((k, n, ∗)) universal CE-QTS scheme from Theo-

rem 3 based on Staircase codes has optimal storage cost and

optimal communication cost.

Remark 5. ((k, n, ∗)) universal CE-QTS scheme from Corol-

lary 2 based on ramp schemes from [30] has optimal storage

cost and optimal communication cost.

In the following section, we prove the bound on communi-

cation cost of CE-QTS schemes using a quantum information

theoretic approach.

VII. INFORMATION THEORETIC MODEL OF CE-QTS

The storage cost and the communication complexity re-

quired for secret sharing schemes can also be studied with in-

formation theory. For classical threshold schemes, such results

have been obtained in [36], [24], [27]. In this section, we will

be using quantum information theory to develop a framework

to get similar results for communication efficient quantum

threshold schemes building upon the work by Imai et al [8].

We propose a quantum information theoretic framework for

CE-QTS schemes and use this to study their communication

complexity. We refer the reader to Section II for some of the

definitions and terms.

A. Information theoretic model for quantum secret sharing

Let S be the quantum secret from the Hilbert space HS

of dimension M . Then the density matrix corresponding to Scan be defined as

ρS =

M−1∑

i=0

pi |φi〉〈φi|

where {pi} gives the probability distribution in a

measurement over some basis of orthonormal states

{|φ0〉 , |φ1〉 , . . . , |φM−1〉}. Let R be the reference system

such that the combined system SR is in pure state i.e.

S(SR) = 0. Thus, by Araki-Lieb inequality, S(R) = S(S).Let S1, S2, . . . , Sn be the quantum systems corresponding

to the n shares defined over the Hilbert spaces H1,H2, . . . ,Hn

respectively. Then the encoding of the secret is given by the

encoding map E : HS → H1 ⊗H2 ⊗ · · · ⊗Hn. A subset of ℓparties can be indicated by the set L ⊆ [n] corresponding to

their indices. The combined system of these parties are then

denoted as

SL = Si1Si2 . . . Siℓ

where L = {i1, i2, . . . , iℓ} with i1 < i2 < . . . < iℓ. Then the

density matrix of the ith party for i ∈ [n] can be written as

ρi = trS[n]\iE(ρS).

With these notations, we can define the requirements of

a quantum secret sharing scheme as quantum information

theoretical constraints.

Definition 8. A quantum secret sharing scheme for an access

structure Γ is a quantum operation which encodes the quantum

secret S into shares S1, S2, . . . , Sn where

• (Recoverability) For every authorized set A ∈ Γ,

I(R : SA) = I(R : S), (33)

• (Secrecy) For every unauthorized set B /∈ Γ,

I(R : SB) = 0. (34)

The same definition expands to QTS schemes where the

authorized set is given by A ⊆ [n] such that |A| ≥ k and the

unauthorized set is given by B ⊂ [n] such that |B| ≤ k − 1.

The following result from [8] gives a bound on the entropy of

each share.

18

Lemma 13. In any quantum secret sharing scheme realizing

an access structure Γ for any subsets of parties A and B such

that A,B /∈ Γ but A ∪ B ∈ Γ it holds that S(SA) ≥ S(S)where S is the secret being shared.

Corollary 5. In any ((k, n)) QTS scheme, the entropy of any

share Sj is bounded as

S(Sj) ≥ S(S)

where S is the secret being shared.

Proof. Take A = {j} and some B ⊆ [n]\{j} such that |B| =k − 1 in Theorem 13.

The conditions in the above definition follow from the

quantum data processing inequality. This is the same set of

conditions as defined in [8] for quantum threshold secret shar-

ing schemes. However for communication efficient quantum

threshold schemes, more conditions have to be defined for

when the combiner recovers the secret from partial shares from

d > k parties.

B. Extension of information theoretic model to CE-QTS

Let D ⊆ [n], where |D| = d, give the indices of some

d parties being accessed by the combiner for communication

efficient recovery. For each j ∈ D, consider a superoperator

πj,D acting on Sj such that the resultant state Hj,D is then

transmitted to the combiner. The density matrix for Hj,D can

be written as

σj,D = πj,D(ρj).

Here πj,D is the operator acting on Sj . Consider E ⊆ Dcorresponding to some e of these d parties. The combined

system of the partial shares sent to the combiner by these eparties is denoted as

HE,D = Hj1,DHj2,D . . . Hje,D

where E = {j1, j2, . . . , je} with j1 < j2 < . . . < je.

Clearly, the number of qudits in Hj,D is logq dim(Hj,D).Now, CCn(d) can be written as

CCn(d) = maxD⊆[n]

s.t. |D|=d

∑

j∈D

logq dim(Hj,D)

CCn(d) ≥1

log qmaxD⊆[n]

s.t. |D|=d

∑

j∈D

S(Hj,D). (35)

The inequality in (35) is from the bound on entropy given by

(7).

Similarly, the communication cost for secret recovery in a

standard ((k, n)) threshold scheme can be bounded as,

CCn(k) ≥1

log qmaxA⊆[n]

s.t. |A|=k

∑

i∈A

S(Si). (36)

Now, the following set of constraints can be included to define

the model for a communication efficient quantum threshold

scheme.

Definition 9. A ((k, n, d)) CE-QTS scheme is a quantum

operation which encodes the quantum secret S into shares

S1, S2, . . . , Sn where

• (Recoverability from k shares) For every A ⊆ [n] such

that |A| ≥ k,

I(R : SA) = I(R : S). (37)

• (Recoverability from d partial shares) For every D ⊆ [n]such that |D| = d,

I(R : HD,D) = I(R : S) (38)

• (Secrecy) For every B ⊂ [n] such that |B| < k,

I(R : SB) = 0. (39)

• (Communication efficiency)

CCn(d) < CCn(k). (40)

Definition 10. A ((k, n, ∗)) universal CE-QTS scheme is a

quantum operation which encodes the quantum secret S into

shares S1, S2, . . . , Sn where

• (Recoverability) For every D ⊆ [n] such that k ≤ |D| ≤n,

I(R : HD,D) = I(R : S) (41)

• (Secrecy) For every B ⊂ [n] such that |B| < k,

I(R : SB) = 0. (42)

• (Universal communication efficiency)

CCn(n) < CCn(n− 1) < . . . < CCn(k + 1) < CCn(k).(43)

In the above definition for universal CE-QTS, a separate

condition for the threshold of k shares is not needed as dcan be assumed to take any value from k to n. With these

definitions, we can bound the communication cost of CE-

QTS schemes (both fixed d and universal) using quantum

information theoretic inequalities. In the following theorem,

a similar bound on the entropy of partial shares sent to the

combiner has been derived. This result is then used to obtain

a bound on the communication cost.

Theorem 5. In any ((k, n)) quantum secret sharing scheme,

recovery of a secret of dimension M by accessing d parties

requires communication of a state from a Hilbert space of

dimension at least Md/(d−k+1) to the combiner.

Proof. Let D represent the indices of the d parties from

which partial shares are sent to the combiner. Clearly, D is

an authorized set. For simplicity, we will drop the second

subscript D in HE,D for any E ⊆ D and write it simply

as HE .

Choose some F ⊆ D such that |F | = d − k + 1. By

considering HD as the bipartite quantum system HD\FHF ,

(37) gives

I(R : HD\FHF ) = I(R : S)

S(HD\FHF )− S(RHD\FHF ) = S(S) − S(RS)

S(HD\FHF )− S(RHD\FHF ) = S(S) (44)

Applying the Araki-Lieb inequality to S(RHD\FHF ) gives

S(RHD\FHF ) ≥ S(RHD\F )− S(HF ).

19

Applying this in (44), we obtain

S(HD\FHF )− S(RHD\F ) + S(HF ) ≥ S(S). (45)

Since any set of k − 1 or lesser shares have no information

about the secret, any set of partial shares from k− 1 or lesser

parties have no information about the secret as well. Since

|D\F | = k − 1, it follows I(R : HD\F ) = 0. This implies

S(RHD\F ) = S(R) + S(HD\F )

Substituting this in (45) and because S(R) = S(S), we obtain

S(HD\FHF ) + S(HF )− S(HD\F ) ≥ 2 S(S). (46)

By subadditivity property, S(HD\FHF ) ≤ S(HD\F )+S(HF ).Therefore,

2S(HF ) ≥ 2S(S)

S(HF ) ≥ S(S). (47)

By subadditivity property,

S(HF ) ≤∑

j∈F

S(Hj,D)

Hence, from (47), we get∑

j∈F

S(Hj,D) ≥ S(S) (48)

This inequality holds for any of the(

dd−k+1

)

possible choices

for F ⊂ D. Now, sum the inequality (48) over all these F to

get∑

F⊂Ds.t. |F |=d−k+1

∑

j∈F

S(Hj,D) ≥∑

F⊂Ds.t. |F |=d−k+1

S(S)

(

d− 1

d− k

)

∑

j∈D

S(Hj,D) ≥

(

d

d− k + 1

)

S(S)

∑

j∈D

S(Hj,D) ≥d

d− k + 1S(S) (49)

This inequality gives a bound on sum of entropies of the partial

shares from d shares to the combiner in terms of the entropy

of the secret. This can be extended to a bound on dimensions

of these systems as follows. We know that the maximum value

for entropy of a system is related to its dimension by (7). Thus,

we obtain

∑

j∈D

log dim(Hj,D) ≥d

d− k + 1S(S)

log∏

j∈D

dim(Hj,D) ≥d

d− k + 1S(S). (50)

The state of Hj,D lies in the same Hilbert space for any state

of the secret S. Thus dim(Hj,D) remains the same for any

arbitrary secret state and the bound (50) is valid for all possible

states of the secret. Consider the secret state with the density

matrix

ρS =M−1∑

ℓ=0

1

M|φℓ〉〈φℓ| .

For this state, S(S) = logM . Hence, (50) gives

∑

j∈D

log dim(Hj,D) ≥d

d− k + 1logM

∏

j∈D

dim(Hj,D) ≥Md/(d−k+1). (51)

This concludes the proof.

The above result derived using the quantum information

theoretic framework is same as Theorem 4. This framework

can be potentially generalized to bound communication costs

and share sizes for quantum secret sharing schemes with non-

threshold access structures as well.

VIII. CONCLUSION

In this paper, we proposed new constructions for CE-QTS

schemes. We introduced the universal CE-QTS schemes and

provided optimal constructions for CE-QTS and universal CE-

QTS schemes using concatenation of ramp QSS schemes.

We also proposed another optimal construction for universal

CE-QTS schemes based on Staircase codes. We proved the

bounds on communication cost during secret recovery in CE-

QTS schemes. Finally we developed a quantum information

theoretic model to study CE-QTS schemes. A natural direction

for further study would be to extend these ideas to non-

threshold access structures. In the recent years there has been

tremendous progress in experimental realization of quantum

secret sharing schemes. Hence, it would be also interesting

to see if the dimension of the secret can be reduced while

constructing CE-QTS schemes particularly for small number

of parties.

APPENDIX A

((k = 3, n = 5, d = 5)) CE-QTS SCHEME BASED ON

STAIRCASE CODES

Consider the ((3, 5, 5)) CE-QTS scheme from the construc-

tion based on Staircase codes given in [12]. This scheme has

the following parameters.

q = 7 (52a)

m = 3 (52b)

w1 = w2 = . . . = w5 = 3 (52c)

CCn(3) = 9, CCn(5) = 5. (52d)

The encoding for the scheme is given by the mapping

|s〉 7→∑

r∈F67

|c11c12c13〉 |c21c22c23〉 |c31c32c33〉 (53)

|c41c42c43〉 |c51c52c53〉

where s = (s1, s2, s3) indicates a basis state of the quantum

secret, r = (r1, r2, . . . , r6) and cij is the (i, j)th entry of the

matrix

C = V Y.

Here the matrices V and Y are given by

V =

1 1 1 1 11 2 4 1 21 3 2 6 41 4 2 1 41 5 4 6 2

and Y =

s1 0 0

s2 0 0

s3 r1 r2r1 r3 r5r2 r4 r6

.

20

The encoded state in (53) can also be written as,

∑

r∈F67

|v1(s, r1, r2)〉 |v1(0, 0, r1, r3, r4)〉 |v1(0, 0, r2, r5, r6)〉|v2(s, r1, r2)〉 |v2(0, 0, r1, r3, r4)〉 |v2(0, 0, r2, r5, r6)〉|v3(s, r1, r2)〉 |v3(0, 0, r1, r3, r4)〉 |v3(0, 0, r2, r5, r6)〉|v4(s, r1, r2)〉 |v4(0, 0, r1, r3, r4)〉 |v4(0, 0, r2, r5, r6)〉|v5(s, r1, r2)〉 |v5(0, 0, r1, r3, r4)〉 |v5(0, 0, r2, r5, r6)〉 .

vi() indicates the polynomial evaluation given by

vi(f1, f2, f3, f4, f5) = f1 + f2.xi + f3.x2i + f4.x

3i + f5.x

4i

and the expression vi(s, r1, r2) denotes vi(s1, s2, s3, r1, r2).Here we have taken xi = i for 1 ≤ i ≤ 5.

When combiner requests k = 3 parties, each party sends

its complete share. When d = 5, the combiner downloads the

first qudit of each share from all the five parties.

A. Secret recovery for d = 5

When the combiner accesses all of the five parties, each

party sends its first qudit. Thus CCn(5) = 5. The qudits with

the combiner are given as

∑

r∈F67

|v1(s, r1, r2)〉 |v1(0, r1, r2, r3, r4)〉 |v1(0, 0, r3, r5, r6)〉|v2(s, r1, r2)〉 |v2(0, r1, r2, r3, r4)〉 |v2(0, 0, r3, r5, r6)〉|v3(s, r1, r2)〉 |v3(0, r1, r2, r3, r4)〉 |v3(0, 0, r3, r5, r6)〉|v4(s, r1, r2)〉 |v4(0, r1, r2, r3, r4)〉 |v4(0, 0, r3, r5, r6)〉|v5(s, r1, r2)〉 |v5(0, r1, r2, r3, r4)〉 |v5(0, 0, r3, r5, r6)〉

Applying the operation UV −1 on these five qudits, we obtain

|s〉∑

r∈F67

|v1(0, 0, r1, r3, r4)〉 |v1(0, 0, r2, r5, r6)〉|v2(0, 0, r1, r3, r4)〉 |v2(0, 0, r2, r5, r6)〉|v3(0, 0, r1, r3, r4)〉 |v3(0, 0, r2, r5, r6)〉|r1〉 |v4(0, 0, r1, r3, r4)〉 |v4(0, 0, r2, r5, r6)〉|r2〉 |v5(0, 0, r1, r3, r4)〉 |v5(0, 0, r2, r5, r6)〉

Here, the three qudits from the first three parties contain the

basis state of the secret. Also, these qudits are not entangled

with any of the other qudits. Thus, any arbitrary superposition

of the basis states can be recovered with the above step.

B. Secret recovery for k = 3

When the combiner accesses any three parties, the all three

qudits from each of the three parties are transmitted to the

combiner. Thus CCn(3) = 9. Assume that the combiner

accesses the first three parties. Then the qudits with the

combiner are given as

∑

r∈F67

|v1(s, r1, r2)〉 |v1(0, 0, r1, r3, r4)〉 |v1(0, 0, r2, r5, r6)〉|v2(s, r1, r2)〉 |v2(0, 0, r1, r3, r4)〉 |v2(0, 0, r2, r5, r6)〉|v3(s, r1, r2)〉 |v3(0, 0, r1, r3, r4)〉 |v3(0, 0, r2, r5, r6)〉|v4(s, r1, r2)〉 |v4(0, 0, r1, r3, r4)〉 |v4(0, 0, r2, r5, r6)〉|v5(s, r1, r2)〉 |v5(0, 0, r1, r3, r4)〉 |v5(0, 0, r2, r5, r6)〉

1) Apply the operation UK5 on the set of three second qudits

and then applying UK5 on the set of third qudits where

K5 is the inverse of V[3,5][3] , to obtain

∑

r∈F67

|v1(s, r1, r2)〉 |r1〉 |r2〉|v2(s, r1, r2)〉 |r3〉 |r5〉|v3(s, r1, r2)〉 |r4〉 |r6〉|v4(s, r1, r2)〉 |v4(0, 0, r1, r3, r4)〉 |v4(0, 0, r2, r5, r6)〉|v5(s, r1, r2)〉 |v5(0, 0, r1, r3, r4)〉 |v5(0, 0, r2, r5, r6)〉

2) Then, apply the following operators.

a) L6 |r2〉 |v1(s, r1, r2)〉 to get |r2〉 |v1(s, r1, 0)〉b) L6 |r2〉 |v2(s, r1, r2)〉 to get |r2〉 |v2(s, r1, 0)〉c) L6 |r2〉 |v3(s, r1, r2)〉 to get |r2〉 |v3(s, r1, 0)〉d) L6 |r1〉 |v1(s, r1, 0)〉 to get |r1〉 |v1(s, 0, 0)〉e) L6 |r1〉 |v2(s, r1, 0)〉 to get |r1〉 |v2(s, 0, 0)〉f) L6 |r1〉 |v3(s, r1, 0)〉 to get |r1〉 |v3(s, 0, 0)〉

Now, we obtain

∑

r∈F67

|v1(s, 0, 0)〉 |r1〉 |r2〉|v2(s, 0, 0)〉 |r3〉 |r5〉|v3(s, 0, 0)〉 |r4〉 |r6〉|v4(s, r1, r2)〉 |v4(0, 0, r1, r3, r4)〉 |v4(0, 0, r2, r5, r6)〉|v5(s, r1, r2)〉 |v5(0, 0, r1, r3, r4)〉 |v5(0, 0, r2, r5, r6)〉

3) Apply the operation UK6 on the set of three first qudits,

where K6 is the inverse of V[3][3] to obtain

|s〉∑

r∈F67

|r1〉 |r2〉|r3〉 |r5〉|r4〉 |r6〉|v4(s, r1, r2)〉 |v4(0, 0, r1, r3, r4)〉 |v4(0, 0, r2, r5, r6)〉|v5(s, r1, r2)〉 |v5(0, 0, r1, r3, r4)〉 |v5(0, 0, r2, r5, r6)〉

Here, the three first qudits from the first three parties

contain the basis state of the secret. For an equivalent

classical secret sharing scheme, the secret recovery would

have been complete at this stage. However these three

qudits are still entangled with the first qudits from fourth

and fifth parties. Thus, any arbitrary superposition of

the basis states cannot be recovered at this stage for a

quantum secret.

4) Apply the following operators to disentangle the basis

state from the rest of the qudits.

a) UK7 on |r2〉 |r5〉 |r6〉 to get

|r2〉 |v4(0, 0, r2, r5, r6)〉 |v5(0, 0, r2, r5, r6)〉 where

K7 =

[

1 0 0

V[3,5][4,5]

]

b) UK8 on |r1〉 |r3〉 |r4〉 to get

|r1〉 |v4(0, 0, r1, r3, r4)〉 |v5(0, 0, r1, r3, r4)〉 where

K8 =

[

1 0 0

V[3,5][4,5]

]

c) UK9 on |s1〉 |s2〉 |s3〉 |r1〉 |r2〉 to get

|s1〉 |s2〉 |s3〉 |v4(s, r1, r2)〉 |v5(s, r1, r2)〉 where

K9 =

1 0 0 0 0

0 1 0 0 0

0 0 1 0 0

V[4,5]

21

Now, we obtain

|s〉∑

r∈F67

|v4(s, r1, r2)〉 |v5(s, r1, r2)〉|v4(0, 0, r1, r3, r4)〉 |v4(0, 0, r2, r5, r6)〉|v5(0, 0, r1, r3, r4)〉 |v5(0, 0, r2, r5, r6)〉|v4(s, r1, r2)〉 |v4(0, 0, r1, r3, r4)〉 |v4(0, 0, r2, r5, r6)〉|v5(s, r1, r2)〉 |v5(0, 0, r1, r3, r4)〉 |v5(0, 0, r2, r5, r6)〉

= |s〉∑

(r1,r2,r3,r4,

r′5,r′6)∈F

67

|v4(s, r1, r2)〉 |v5(s, r1, r2)〉|v4(0, 0, r1, r3, r4)〉 |r

′5〉

|v5(0, 0, r1, r3, r4)〉 |r′6〉

|v4(s, r1, r2)〉 |v4(0, 0, r1, r3, r4)〉 |r′5〉

|v5(s, r1, r2)〉 |v5(0, 0, r1, r3, r4)〉 |r′6〉

(54)

= |s〉∑

(r1,r2,r′3,r

′4,

r′5,r′6)∈F

67

|v4(s, r1, r2)〉 |v5(s, r1, r2)〉|r′3〉 |r

′5〉

|r′4〉 |r′6〉

|v4(s, r1, r2)〉 |r′3〉 |r

′5〉

|v5(s, r1, r2)〉 |r′4〉 |r

′6〉

= |s〉∑

(r′1,r′2,r

′3,r

′4,

r′5,r′6)∈F

67

|r′1〉 |r′2〉

|r′3〉 |r′5〉

|r′4〉 |r′6〉

|r′1〉 |r′3〉 |r

′5〉

|r′2〉 |r′4〉 |r

′6〉

The variable change in (54) is possible because indepen-

dent of r1, r2, r3, r4, the subsystem

∑

(r5,r6)∈F27

|v4(0, 0, r2, r5, r6)〉 |v4(0, 0, r2, r5, r6)〉|v5(0, 0, r2, r5, r6)〉 |v5(0, 0, r2, r5, r6)〉

gives the uniform superposition∑

(r′5,r′6)∈F

27

|r′5〉 |r′5〉 |r

′6〉 |r

′6〉 .

The succeeding expressions are derived similarly. Now,

the secret is disentangled with the rest of the qudits.

Thus, any arbitrary superposition of the basis states can

be recovered with above steps for d = 3.

APPENDIX B

SECRET RECOVERY FOR d = 3 IN THE ((3,5,*)) UNIVERSAL

CE-QTS SCHEME FROM SECTION III

Consider the example of ((k = 3, n = 5, ∗)) universal CE-

QTS scheme in section III with the following parameters.

q = 7 (55a)

m = 3 (55b)

w1 = w2 = . . . = w5 = 3 (55c)

CC5(3) = 9, CC5(4) = 8, CC5(5) = 5. (55d)

The encoding for the scheme is given by the following

mapping

|s〉 7→∑

r∈F67

|c11c12c13〉 |c21c22c23〉 |c31c32c33〉 (56)

|c41c42c43〉 |c51c52c53〉

where s = (s1, s2, s3) indicates a basis state of the quantum

secret, r = (r1, r2, . . . , r6) and cij is the (i, j)th entry of the

matrix

C = V Y.

Here the matrices V and Y are defined as follows.

V =

1 1 1 1 11 2 4 1 21 3 2 6 41 4 2 1 41 5 4 6 2

and Y =

s1 0 0

s2 r1 0

s3 r2 r3r1 r3 r5r2 r4 r6

.

The encoded state in (56) can also be written as,

∑

r∈F67

|v1(s, r1, r2)〉 |v1(0, r1, r2, r3, r4)〉 |v1(0, 0, r3, r5, r6)〉|v2(s, r1, r2)〉 |v2(0, r1, r2, r3, r4)〉 |v2(0, 0, r3, r5, r6)〉|v3(s, r1, r2)〉 |v3(0, r1, r2, r3, r4)〉 |v3(0, 0, r3, r5, r6)〉|v4(s, r1, r2)〉 |v4(0, r1, r2, r3, r4)〉 |v4(0, 0, r3, r5, r6)〉|v5(s, r1, r2)〉 |v5(0, r1, r2, r3, r4)〉 |v5(0, 0, r3, r5, r6)〉 .

vi() indicates the polynomial evaluation given by

vi(f1, f2, f3, f4, f5) = f1 + f2.xi + f3.x2i + f4.x

3i + f5.x

4i

and the expression vi(s, r1, r2) denotes vi(s1, s2, s3, r1, r2).Here we have taken xi = i for 1 ≤ i ≤ 5.

When combiner requests d = 5 parties, they send the first

qudit from each of their shares. When d = 4, the combiner

downloads the first two qudits of each share of the four parties

contacted. When d = 3, the combiner downloads all three

qudits of the share of the three parties contacted. (For clarity,

the qudits accessible to the combiner have been highlighted in

blue in the description below.)

In the case when d = 3, each of the three contacted parties

sends all three qudits in its share.

∑

r∈F67

|v1(s, r1, r2)〉 |v1(0, r1, r2, r3, r4)〉 |v1(0, 0, r3, r5, r6)〉|v2(s, r1, r2)〉 |v2(0, r1, r2, r3, r4)〉 |v2(0, 0, r3, r5, r6)〉|v3(s, r1, r2)〉 |v3(0, r1, r2, r3, r4)〉 |v3(0, 0, r3, r5, r6)〉|v4(s, r1, r2)〉 |v4(0, r1, r2, r3, r4)〉 |v4(0, 0, r3, r5, r6)〉|v5(s, r1, r2)〉 |v5(0, r1, r2, r3, r4)〉 |v5(0, 0, r3, r5, r6)〉

1) Applying the operation UK5 on the set of three third

qudits, where K5 is the inverse of V[3,5][3] , we obtain

∑

r∈F67

|v1(s, r1, r2)〉 |v1(0, r1, r2, r3, r4)〉 |r3〉|v2(s, r1, r2)〉 |v2(0, r1, r2, r3, r4)〉 |r5〉|v3(s, r1, r2)〉 |v3(0, r1, r2, r3, r4)〉 |r6〉|v4(s, r1, r2)〉 |v4(0, r1, r2, r3, r4)〉 |v4(0, 0, r3, r5, r6)〉|v5(s, r1, r2)〉 |v5(0, r1, r2, r3, r4)〉 |v5(0, 0, r3, r5, r6)〉

2) Then, on applying the operators

L6 |r3〉 |v1(0, r1, r2, r3, r4)〉, L6 |r3〉 |v2(0, r1, r2, r3, r4)〉and L1 |r3〉 |v3(0, r1, r2, r3, r4)〉, we obtain

∑

r∈F67

|v1(s, r1, r2)〉 |v1(0, r1, r2, 0, r4)〉 |r3〉|v2(s, r1, r2)〉 |v2(0, r1, r2, 0, r4)〉 |r5〉|v3(s, r1, r2)〉 |v3(0, r1, r2, 0, r4)〉 |r6〉|v4(s, r1, r2)〉 |v4(0, r1, r2, r3, r4)〉 |v4(0, 0, r3, r5, r6)〉|v5(s, r1, r2)〉 |v5(0, r1, r2, r3, r4)〉 |v5(0, 0, r3, r5, r6)〉

3) Applying the operation UK6 on the set of three second

qudits, where K6 is the inverse of V{2,3,5}[3] , we obtain

∑

r∈F67

|v1(s, r1, r2)〉 |r1〉 |r3〉|v2(s, r1, r2)〉 |r2〉 |r5〉|v3(s, r1, r2)〉 |r4〉 |r6〉|v4(s, r1, r2)〉 |v4(0, r1, r2, r3, r4)〉 |v4(0, 0, r3, r5, r6)〉|v5(s, r1, r2)〉 |v5(0, r1, r2, r3, r4)〉 |v5(0, 0, r3, r5, r6)〉

22

4) Applying operation UK7 on the qudits |v1(s, r1, r2)〉|v2(s, r1, r2)〉 |v3(s, r1, r2)〉 |r1〉 |r2〉 where

K7 =

V[3]0 0 0 1 0

0 0 0 0 1

−1

we obtain

|s〉∑

r∈F67

|r1〉 |r3〉|r2〉 |r5〉|r4〉 |r6〉|v4(s, r1, r2)〉 |v4(0, r1, r2, r3, r4)〉 |v4(0, 0, r3, r5, r6)〉|v5(s, r1, r2)〉 |v5(0, r1, r2, r3, r4)〉 |v5(0, 0, r3, r5, r6)〉

5) After recovering the basis state of the secret, we dis-

entangle it from the rest of qudits by applying suitable

operators as follows.

a) Apply UK8 on |r3〉 |r5〉 |r6〉 to get

|r3〉 |v4(0, 0, r3, r5, r6)〉 |v5(0, 0, r3, r5, r6)〉 where

K8 =

[

1 0 0

V[3,5][4,5]

]

.

b) Apply UK9 on |r1〉 |r2〉 |r3〉 |r4〉 to get

|r1〉 |r2〉 |v4(0, r1, r2, r3, r4)〉 |v5(0, r1, r2, r3, r4)〉where

K9 =

1 0 0 0

0 1 0 0

V[2,5][4,5]

.

c) Apply UK10 on |s1〉 |s2〉 |s3〉 |r1〉 |r2〉 to get

|s1〉 |s2〉 |s3〉 |v4(s, r1, r2)〉 |v5(s, r1, r2)〉 where

K10 =

1 0 0 0 0

0 1 0 0 0

0 0 1 0 0

V[4,5]

.

Now, we obtain

|s〉∑

r∈F67

|v4(s, r1, r2)〉 |v4(0, r1, r2, r3, r4)〉|v5(s, r1, r2)〉 |v4(0, 0, r3, r5, r6)〉|v5(0, r1, r2, r3, r4)〉 |v5(0, 0, r3, r5, r6)〉|v4(s, r1, r2)〉 |v4(0, r1, r2, r3, r4)〉 |v4(0, 0, r3, r5, r6)〉|v5(s, r1, r2)〉 |v5(0, r1, r2, r3, r4)〉 |v5(0, 0, r3, r5, r6)〉

= |s〉∑

r′′∈F67

|r′′1 〉 |r′′3 〉

|r′′2 〉 |r′′5 〉

|r′′4 )〉 |r′′6 〉

|r′′1 〉 |r′′3 〉 |r

′′5 〉

|r′′2 〉 |r′′4 〉 |r

′′6 〉

where r′′ = (r′′1 , r′′2 , r

′′3 , r

′′4 , r

′′5 , r

′′6 ). Now, the secret is

disentangled with the rest of the qudits.

Thus, any arbitrary superposition of the basis states can be

recovered with above steps for d = 3.

REFERENCES

[1] M. Hillery, V. Buzek, and A. Berthaume, “Quantum secret sharing,”Phys. Rev. A, vol. 59, no. 3, pp. 1829–1834, 1999. [Online]. Available:https://journals.aps.org/pra/abstract/10.1103/PhysRevA.59.1829

[2] R. Cleve, D. Gottesman, and H.-K. Lo, “How to share a quantum secret,”Phys. Rev. Lett., vol. 83, no. 3, pp. 648–651, 1999. [Online]. Available:https://journals.aps.org/prl/abstract/10.1103/PhysRevLett.83.648

[3] A. Karlsson, M. Koashi, and N. Imoto, “Quantum entanglementfor secret sharing and secret splitting,” Phys. Rev. A,vol. 59, no. 1, p. 162, 1999. [Online]. Available:https://journals.aps.org/pra/abstract/10.1103/PhysRevA.59.162

[4] A. D. Smith, “Quantum secret sharing for general accessstructures,” e-print quant-ph/0001087, 2000. [Online]. Available:https://arxiv.org/abs/quant-ph/0001087

[5] D. Gottesman, “Theory of quantum secret sharing,” Phys.

Rev. A, vol. 61, p. 042311, 2000. [Online]. Available:https://journals.aps.org/pra/abstract/10.1103/PhysRevA.61.042311

[6] S. Bandyopadhyay, “Teleportation and secret sharing with pure entan-gled states,” Phys. Rev. A, vol. 62, p. 012308, 2000. [Online]. Available:https://journals.aps.org/pra/abstract/10.1103/PhysRevA.62.012308

[7] A. C. Nascimento, J. Mueller-Quade, and H. Imai,“Improving quantum secret-sharing schemes,” Phys. Rev.

A, vol. 64, p. 042311, 2001. [Online]. Available:https://journals.aps.org/pra/abstract/10.1103/PhysRevA.64.042311

[8] H. Imai, J. Muller-Quade, A. C. Nascimento, P. Tuyls, and A. Winter,“A quantum information theoretical model for quantum secretsharing schemes,” e-print quant-ph/0311136, 2003. [Online]. Available:https://arxiv.org/abs/quant-ph/0311136

[9] P. Sarvepalli and R. Raussendorf, “Matroids and quantum-secret-sharingschemes,” Phys. Rev. A, vol. 81, p. 052333, May 2010. [Online].Available: https://link.aps.org/doi/10.1103/PhysRevA.81.052333

[10] B. Fortescue and G. Gour, “Reducing the quantum communicationcost of quantum secret sharing,” IEEE Trans. Inform. Theory,vol. 58, no. 10, pp. 6659 – 6666, 2012. [Online]. Available:https://ieeexplore.ieee.org/abstract/document/6225432

[11] D. Markham and B. C. Sanders, “Graph states for quantum secret shar-ing,” Phys. Rev. A, vol. 78, no. 4, p. 042309, 2008. [Online]. Available:https://journals.aps.org/pra/abstract/10.1103/PhysRevA.78.042309

[12] K. Senthoor and P. K. Sarvepalli, “Communication ef-ficient quantum secret sharing,” Phys. Rev. A, vol.100, no. 5, p. 052313, 2019. [Online]. Available:https://journals.aps.org/pra/abstract/10.1103/PhysRevA.100.052313

[13] T. Tyc and B. C. Sanders, “How to share a continuous-variable quantum secret by optical interferometry,” Phys.

Rev. A, vol. 65, p. 042310, 2002. [Online]. Available:https://journals.aps.org/pra/abstract/10.1103/PhysRevA.65.042310

[14] H. Qin, W. K. Tang, and R. Tso, “Hierarchical quantum secret sharingbased on special high-dimensional entangled state,” IEEE Journal ofSelected Topics in Quantum Electronics, vol. 26, pp. 1–6, 2020. [Online].Available: https://ieeexplore.ieee.org/abstract/document/9006878

[15] W. Tittel, H. Zbinden, and N. Gisin, “Experimentaldemonstration of quantum secret sharing,” Phys. Rev.A, vol. 63, p. 042301, 2001. [Online]. Available:https://journals.aps.org/pra/abstract/10.1103/PhysRevA.63.042301

[16] L. Hao, C. Wang, and G. L. Long, “Quantum secret sharingprotocol with four state grover algorithm and its proof-of-principle experimental demonstration,” Optics Communications,vol. 284, no. 14, pp. 3639 – 3642, 2011. [Online]. Available:https://www.sciencedirect.com/science/article/pii/S0030401811003105

[17] J. Bogdanski, N. Rafiei, and M. Bourennane, “Experimentalquantum secret sharing using telecommunication fiber,” Phys.

Rev. A, vol. 78, p. 062307, 2008. [Online]. Available:https://journals.aps.org/pra/abstract/10.1103/PhysRevA.78.062307

[18] B. A. Bell, D. Markham, D. A. Herrera-Martı, A. Marin,W. J. Wadsworth, J. G. Rarity, and M. S. Tame, “Experimentaldemonstration of graph-state quantum secret sharing,” Naturecommunications, vol. 5, p. 5480, 2014. [Online]. Available:https://www.nature.com/articles/ncomms6480

[19] C. Schmid, P. Trojek, M. Bourennane, C. Kurtsiefer, M. Zukowski,and H. Weinfurter, “Experimental single qubit quantum secret sharing,”Phys. Rev. Lett., vol. 95, no. 23, p. 230505, 2005. [Online]. Available:https://journals.aps.org/prl/abstract/10.1103/PhysRevLett.95.230505

[20] S. Gaertner, C. Kurtsiefer, M. Bourennane, and H. Weinfurter,“Experimental demonstration of four-party quantum secret sharing,”Phys. Rev. Lett., vol. 98, no. 2, p. 020503, 2007. [Online]. Available:https://journals.aps.org/prl/abstract/10.1103/PhysRevLett.98.020503

[21] A. M. Lance, T. Symul, W. P. Bowen, B. C. Sanders,and P. K. Lam, “Tripartite quantum state sharing,” Phys.

Rev. Lett., vol. 92, p. 177903, Apr 2004. [Online]. Available:https://link.aps.org/doi/10.1103/PhysRevLett.92.177903

[22] K. J. Wei, H. Q. Ma, and J. H. Yang, “Experimental circularquantum secret sharing over telecom fiber network,” Optics express,vol. 21, no. 14, pp. 16 663 – 16 669, 2013. [Online]. Available:https://www.osapublishing.org/oe/abstract.cfm?uri=oe-21-14-16663

23

[23] J. Pinnell, I. Nape, M. de Oliveira, N. TabeBordbar, andA. Forbes, “Experimental demonstration of 11-dimensional 10-party quantum secret sharing,” Laser & Photonics Reviews,vol. 14, p. 2000012, July 2020. [Online]. Available:https://onlinelibrary.wiley.com/doi/abs/10.1002/lpor.202000012

[24] H. Wang and D. S. Wong, “On secret reconstructionin secret sharing schemes,” IEEE Trans. Inform. Theory,vol. 54, no. 1, pp. 473–480, 2008. [Online]. Available:https://ieeexplore.ieee.org/abstract/document/4418504

[25] R. Bitar and S. El Rouayheb, “Staircase codes for secret sharingwith optimal communication and read overheads,” in Proc. 2016 IEEE

Intl. Symposium on Information Theory, Barcelona, Spain, 2016, pp.1396–1400, extended version, arXiv:1512.02990. [Online]. Available:https://ieeexplore.ieee.org/document/7541528

[26] R. Bitar and S. E. Rouayheb, “Staircase codes for secret sharing withoptimal communication and read overheads,” IEEE Transactions on

Information Theory, vol. 64, no. 2, pp. 933–943, Feb 2018.[27] W. Huang, M. Langberg, J. Kliewet, and J. Bruck, “Communication

efficient secret sharing,” IEEE Trans. Inform. Theory, vol. 62,no. 12, pp. 7195 – 7206, 2016. [Online]. Available:https://ieeexplore.ieee.org/abstract/document/7587343

[28] W. Huang and J. Bruck, “Secret sharing with optimal decoding andrepair bandwidth,” in Proc. 2017 IEEE Intl. Symposium on Information

Theory, Aachen, Germany, 2017, pp. 1813–1817. [Online]. Available:https://ieeexplore.ieee.org/abstract/document/8006842

[29] U. Martinez-Penas, “Communication efficient and strongly secure secretsharing schemes based on algebraic geometry codes,” IEEE Trans.Inform. Theory, vol. 64, no. 6, pp. 4191 – 4206, 2018. [Online].Available: https://ieeexplore.ieee.org/abstract/document/8331930

[30] T. Ogawa, A. Sasaki, M. Iwamoto, and H. Yamamoto, “Quantumsecret sharing schemes and reversibility of quantum operations,”Phys. Rev. A, vol. 72, no. 3, p. 032318, 2005. [Online]. Available:https://journals.aps.org/pra/abstract/10.1103/PhysRevA.72.032318

[31] K. V. Rashmi and P. V. Shah N. B. and, Kumar, “Optimalexact-regenerating codes for distributed storage at the msr andmbr points via a product-matrix construction.” IEEE Trans. Inform.

Theory, vol. 57, no. 8, pp. 5227 – 5239, 2011. [Online]. Available:https://ieeexplore.ieee.org/abstract/document/5961826

[32] K. Senthoor and P. K. Sarvepalli, “Universal communication efficientquantum threshold secret sharing schemes,” in Proc. 2020 IEEE Infor-

mation Theory Workshop (ITW), Riva del Garda, Italy, 2020.[33] M. A. Nielsen and I. Chuang, Quantum computation and quantum

information. Cambridge University Press, 2000.[34] B. Schumacher and M. A. Nielsen, “Quantum data processing and error

correction,” Phys. Rev. A, vol. 54, p. 052333, October 1996. [Online].Available: https://journals.aps.org/pra/pdf/10.1103/PhysRevA.54.2629

[35] K. Senthoor and P. K. Sarvepalli, “Universal communication efficientquantum threshold secret sharing,” e-print quant-ph/2002.09229, 2020.[Online]. Available: https://arxiv.org/abs/2002.09229

[36] E. Karnin, J. Greene, and M. Hellman, “On secret sharing systems,”IEEE Trans. Inform. Theory, vol. 29, no. 1, pp. 35 – 41, 1983. [Online].Available: https://ieeexplore.ieee.org/abstract/document/1056621