Verifiable Quantum Anonymous Transmission: Difference between revisions

This [example protocol] implements the task of anonymous transmission in a multi-node quantum network. The protocol uses an untrusted $n$-partite GHZ state to enable two nodes, Sender and Receiver, to establish a link which they use to transmit a quantum message. In addition to adversarial nodes, the source of the GHZ state may be controlled by an adversary. To address this, the protocol includes verification of the GHZ state. It incorporates a reduced fidelity GHZ state used for anonymous transmission, resulting in a notion of anonymity for imperfect scenarios called $\epsilon$-anonymity.

* '''Network''': The network consists of $n$ nodes (honest or adversarial) with pairwise authenticated classical channels and a classical broadcast channel.  

* {{Smallcaps|Parity}} \cite{Broadbent}: privately computes the parity of an input string.

* {{Smallcaps|LogicalOR}} \cite{Broadbent}: privately computes the logical OR of an input string, using a modified version of {{Smallcaps|Parity}}.

* {{Smallcaps|Notification}} \cite{Broadbent}: allows one player to anonymously notify another player, using {{Smallcaps|LogicalOR}}.

* {{Smallcaps|RandomBit}} \cite{Unnikrishnan}: allows one player to anonymously choose a bit according to a probability distribution, using {{Smallcaps|LogicalOR}}.

* {{Smallcaps|Verification}} \cite{Pappa, McCutcheon}: allows one player (the Verifier) to run a test to check if the shared state is the GHZ state. The Verifier instructs each player to measure their qubit in a particular basis and checks the parity of the measurement outcomes.  

* {{Smallcaps|Anonymous Entanglement}} \cite{Wehner}: $n-2$ nodes (all except for $\mathcal{S}$ and $\mathcal{R}$) measure in the $X$ basis and broadcast their measurement outcome. $\mathcal{S}$ and $\mathcal{R}$ broadcast random dummy bits. The parity of measurement outcomes allows the establishment of an entangled link between $\mathcal{S}$ and $\mathcal{R}$ which is called anonymous entanglement.

# \textit{Receiver notification}: The Sender $\mathcal{S}$ notifies the Receiver $R$ by running {{Smallcaps|Notification}}.

# \textit{Verification or anonymous transmission}: $\mathcal{S}$ anonymously chooses whether to verify the state or use it for anonymous transmission, using {{Smallcaps|RandomBit}.  

If verification is chosen, a player is chosen to run {{Smallcaps|Verification}}, using $\log_2 n$ repetitions of  {{Smallcaps|RandomBit}}.  

If anonymous transmission is chosen, the players run {{Smallcaps|Anonymous Entanglement}}, establishing an anonymous entanglement link between $\mathcal{S}$ and $\mathcal{R}$.

* $\ket{GHZ}  = \frac{1}{\sqrt{2}} (\ket{0^n} + \ket{1^n})$: GHZ state.  

P_{\text{guess}} [\mathcal{S} | C, \mathcal{S} \notin \mathcal{A} ] \leq \frac{1}{n-t} + \epsilon, \\

P_{\text{guess}} [\mathcal{R} | C, \mathcal{S} \notin \mathcal{A} ] \leq \frac{1}{n-t} + \epsilon,

===={{Smallcaps|$\epsilon$-anonymous transmission of a quantum message}}====

Run {{Smallcaps|Notification}} for $\mathcal{S}$ to notify $\mathcal{R}$ as the Receiver.

## Run {{Smallcaps|RandomBit}}, with the input of $\mathcal{S}$ chosen as follows: she flips $q$ fair classical coins, and if all coins are heads, she inputs 0, else she inputs 1. Let the outcome be $x$.

### Run {{Smallcaps|RandomBit}} $\log_2 n$ times, with the input of $\mathcal{S}$ chosen according to the uniform random distribution. Let the outcome be $v$.

### Run {{Smallcaps|Verification}} with player $v$ as the Verifier. If she accepts the outcome of the test, return to step 2, otherwise abort.

Else if $x=0$, run {{Smallcaps|Anonymous Transmission}}.

===={{Smallcaps|Parity}}====

===={{Smallcaps|LogicalOR}}====

## Run {{Smallcaps|Parity}} with input $\{p_i\}_{i=1}^n$, with a regular broadcast channel rather than simultaneous broadcast, and with the players broadcasting according to the current ordering. If the result is $1$, then $y_i = 1$.  

## Repeat steps 2(a) - 2(b) $q$ times in total. If the result of {{Smallcaps|Parity}} is never $1$, then $y_i = 0$.

===={{Smallcaps|Notification}}====

## Run {{Smallcaps|Parity}} with input $\{p_i\}_{i=1}^n$, with the following differences: player $i$ does not broadcast her value, and they use a regular broadcast channel rather than simultaneous broadcast. If the result is $1$, then $y_i = 1$.

## Repeat steps 1(a) - (b) $q$ times. If the result of {{Smallcaps|Parity}} is never 1, then $y_i = 0$.  

===={{Smallcaps|RandomBit}}====

# Run {{Smallcaps|LogicalOR}} with input $\{ x_i \}_{i=1}^n$ and security parameter $q$ and output its outcome.

===={{Smallcaps|Verification}}====

# Player $j$ measures in the basis $\{\ket{+_{\theta_j}},\ket{-_{\theta_j}}\}=\{\frac{1}{\sqrt{2}}(\ket{0}+e^{i\theta_j}\ket{1}),\frac{1}{\sqrt{2}}(\ket{0}-e^{i\theta_j}\ket{1})\}$, and sends the outcome $Y_j=\{0,1\}$ to the Verifier.  

===={{Smallcaps|Anonymous Transmission}}====

# $\mathcal{R}$ applies a phase flip $Z$ to her qubit, if $b \oplus \underset{j \in [n] \backslash \{ \mathcal{S}, \mathcal{R} \}}{\bigoplus} m_j = 1$.   

* Although {{Smallcaps|Parity}} requires a simultaneous broadcast channel, only modified versions of {{Smallcaps|Parity}} that remove this requirement are used in the anonymous transmission protocol.

* To send classical teleportation bits $m_0, m_1$, the players can run {{Smallcaps|Fixed Role Anonymous Message Transmission}} from \cite{Broadbent}, or the anonymous transmission protocol for classical bits with quantum resources from \cite{Wehner}.

* {{Smallcaps|Verification}} was experimentally demonstrated for 3- and 4-party GHZ states in \cite{McCutcheon}.