Quantum Secret Sharing

Overview

Secret sharing splits a secret among several people so that only certain groups can recover it. In the classical version introduced by Shamir and Blakley in 1979, a secret is divided into n shares and any k of them reconstruct it, while any fewer than k reveal nothing. Quantum secret sharing uses quantum states, typically entangled states, for the same purpose, with the added feature that eavesdropping can be detected.

There are two flavors. In the first, a classical secret is shared using quantum states, as in the protocol of Hillery, Bužek, and Berthiaume. In the second, the secret itself is a quantum state, shared among several parties as in the threshold schemes of Cleve, Gottesman, and Lo. Both rely on entanglement and on the no-cloning theorem.

The problem it solves

Distributing a sensitive piece of information among several people so that no single person (or small group) can access it alone, but a sufficient quorum acting together can.

History and background

Hillery, Bužek, and Berthiaume published Quantum Secret Sharing in Physical Review A in 1999. They showed how three or more parties holding the particles of a Greenberger-Horne-Zeilinger (GHZ) state can share a secret bit. In the same year, Cleve, Gottesman, and Lo published How to Share a Quantum Secret in Physical Review Letters, which gave threshold schemes for sharing quantum states and proved that the no-cloning theorem forces the threshold k to be greater than n over 2. Gottesman gave a more general theory in 2000.

Experiments followed. Tittel, Zbinden, and Gisin reported a demonstration of secret sharing in 2001, and Schmid, Trojek, Bourennane, Kurtsiefer, Żukowski, and Weinfurter reported experimental single-qubit secret sharing in 2005. Bogdanski, Rafiei, and Bourennane demonstrated a version over telecommunication fiber in 2008, and later experiments used graph states and multiple-photon entanglement. Recent work looks at networks and at use with quantum key distribution infrastructure.

How it works

Distributes shares of a multi-party entangled state to each participant; reconstructing the original secret requires combining measurements from enough participants according to the protocol's threshold rules.

Entanglement correlates measurements in a way that no single party can see. For the three-qubit GHZ state, an equal superposition of all three qubits being 0 and all three being 1, each party measures their qubit in either the X or the Y basis. The outcomes are plus or minus 1, and each individual outcome is completely random. But certain combinations of the three outcomes have a fixed product.

The product of the three outcomes is plus 1 if all three measure X, and minus 1 if one party measures X and the other two measure Y. In those four allowed combinations, the product is determined. That means if Bob and Charlie combine their results, they can deduce Alice's outcome, but neither of them alone learns anything about it.

Alice therefore uses her own random outcome as the secret bit, and the other two can recover it only by working together. Because the three bases are chosen at random and compared afterwards, an eavesdropper who intercepts a particle disturbs the correlations, and the group detects it by checking a sample.

Step by step

1. A trusted source, or one of the parties, prepares a GHZ state of three qubits and sends one qubit to each participant.
2. Each participant chooses at random to measure in the X basis or the Y basis and records the outcome.
3. The participants publicly announce their bases but not their outcomes.
4. They keep only the rounds where the bases form one of the four allowed combinations, which happens in half of the rounds.
5. In those rounds, the product of the three outcomes is known, so Bob and Charlie, by combining their outcomes, can compute Alice's bit, while no single party can.
6. They check a random sample of the rounds for consistency to detect eavesdropping, and use the remaining rounds as the shared secret bits.

A worked example

Suppose in one round Alice, Bob, and Charlie measure in the bases X, Y, Y. This is an allowed combination, with a product of outcomes of minus 1. Alice gets the outcome plus 1, which becomes her secret bit 0. Bob gets minus 1 and Charlie gets plus 1. Together, they multiply their outcomes, which gives minus 1, and use the rule that the total product is minus 1 to deduce that Alice's outcome was plus 1.

If instead the bases are X, X, Y, the product is not fixed, so the round is discarded. Over many rounds, about half are kept. For quantum states as secrets, a five-qubit error-correcting code can encode a state into five shares so that any three can reconstruct it and any two learn nothing, which is a threshold scheme with k equal to 3 and n equal to 5.

Complexity and resources

What hardware it needs

• Sources of multi-photon or multi-qubit entangled states with good fidelity.
• Distribution of entangled particles to several sites with low loss, which becomes harder as the number of parties grows.
• Fast measurement in at least two bases and authenticated classical communication.

Applications

• Distributing control of sensitive keys among several officials or servers, so that no single party can act alone.
• Secure multi-party quantum computation and quantum cloud tasks, where a quantum state must be split among servers.
• Quantum error correction, which is mathematically linked to threshold secret sharing.
• Network research on how entanglement can support cooperative security tasks.

Limitations and caveats

• Generating and distributing multi-party entangled states is difficult, so experiments are small.
• Detection loss and noise reduce the rates, and the number of parties is limited.
• Classical secret sharing is simple, efficient, and information-theoretically secure for classical secrets, so the quantum advantage is limited to detecting eavesdropping and to sharing quantum information.

Common misconceptions

• Quantum secret sharing is not required for sharing classical secrets securely. Shamir's scheme already does that.
• It does not let one party recover the secret alone. A quorum must cooperate.
• The no-cloning theorem is not a flaw, it is the reason the threshold must exceed half.

How it compares

• Shamir's classical scheme is efficient and flexible but cannot detect eavesdropping on the channel.
• QKD protects communication between two parties, while secret sharing protects a secret among many.
• Quantum error-correcting codes are equivalent to threshold schemes for quantum secrets.

Real-world impact

Relevant to securing highly sensitive information (like nuclear launch codes or critical cryptographic keys) where distributed trust and quantum-level security guarantees both matter.

Why it matters

Quantum secret sharing shows the close ties between quantum cryptography and quantum error correction. The same code that protects a qubit against errors can protect a secret against dishonest subsets.

It also points toward multi-party applications of a future quantum internet, where entanglement among several nodes is a shared resource.

Frequently asked questions

Keep learning

• Related algorithm: Quantum Teleportation Protocol
• Related algorithm: Quantum Error-Correcting Codes (Shor Code, Surface Code)
• Related algorithm: BB84 Quantum Key Distribution
• Related algorithm: Quantum Digital Signatures

This page is written for educational purposes. Complexity statements describe the best known results at the time of review (September 30, 2026), and research in this area moves quickly, so check recent papers before relying on a specific bound.

← Back to Algorithms Database