Verifiable Quantum Anonymous Transmission
This example protocol implements the task of Anonymous Transmission in a multi-node quantum network. The protocol uses an untrusted -partite GHZ state to enable two nodes, Sender and Receiver, to establish a link which they use to transmit a quantum message. In addition to adversarial nodes, the source of the GHZ state may be controlled by an adversary. To address this, the protocol includes verification of the GHZ state. It incorporates a reduced fidelity GHZ state used for anonymous transmission, resulting in a notion of anonymity for imperfect scenarios called -anonymity.
- Network: The network consists of nodes (honest or adversarial) with pairwise authenticated classical channels and a classical broadcast channel.
- Source: Untrusted multipartite state source.
- Adversarial model: Active adversary who can control the source.
- Parity : privately computes the parity of an input string.
- LogicalOR : privately computes the logical OR of an input string, using a modified version of Parity.
- Notification : allows one player to anonymously notify another player, using LogicalOR.
- RandomBit : allows one player to anonymously choose a bit according to a probability distribution, using LogicalOR.
- Verification [4,5]: allows one player (the Verifier) to run a test to check if the shared state is the GHZ state. The Verifier instructs each player to measure their qubit in a particular basis and checks the parity of the measurement outcomes.
- Anonymous Entanglement : nodes (all except for and ) measure in the basis and broadcast their measurement outcome. and broadcast random dummy bits. The parity of measurement outcomes allows the establishment of an entangled link between and which is called anonymous entanglement.
The protocol for quantum anonymous transmission consists of the following steps:
- Receiver notification: The Sender notifies the Receiver by running Notification.
- State distribution: A source, who may be untrusted, distributes a state claiming to be the GHZ state.
- Verification or anonymous transmission: anonymously chooses whether to verify the state or use it for anonymous transmission, using RandomBit.
If verification is chosen, a player is chosen to run Verification, using repetitions of RandomBit. If the test passes, the protocol goes back to the State distribution stage and runs again. If the test fails, the players abort.
If anonymous transmission is chosen, the players run Anonymous Entanglement, establishing an anonymous entanglement link between and . then teleports the message state to using the established anonymous entanglement. The classical message associated with teleportation is also sent anonymously.
- : number of network nodes taking part in the anonymous transmission.
- : number of adversarial network nodes taking part in the anonymous transmission.
- : quantum message which the Sender wants to send anonymously.
- : GHZ state.
- : state provided by the untrusted source for anonymous transmission (in the ideal case, this is the GHZ state).
- : the Sender of the quantum message.
- : the Receiver of the quantum message.
- : the security parameter.
The pseudocode given below implements anonymous transmission of a quantum message, incorporating a verification stage. Further, the following analysis considers anonymous transmission with a reduced fidelity state rather than a perfect GHZ state.
Let be the event that the protocol does not abort and the state used for anonymous transmission is such that, no matter what operation the adversarial players do to their part, the fidelity of the state with the GHZ state is at most . Then,
By doing many repetitions of the protocol, the honest players can ensure that this probability is negligible.
If the state used for anonymous transmission is of fidelity at least with the GHZ state,
where is the subset of adversaries among nodes and is the register that contains all classical and quantum side information accessible to the adversaries.
-anonymous transmission of a quantum message
Input: Security parameter .
Goal: sends message qubit to with -anonymity.
- Receiver notification : Run Notification for to notify as the Receiver.
- Distribution of state : A source (who may be untrusted) generates a state and distributes it to the players (in the ideal case, is the GHZ state).
- anonymously chooses verification or anonymous transmission :
- Run RandomBit, with the input of chosen as follows: she flips fair classical coins, and if all coins are heads, she inputs 0, else she inputs 1. Let the outcome be .
- If ,
- Run RandomBit times, with the input of chosen according to the uniform random distribution. Let the outcome be .
- Run Verification with player as the Verifier. If she accepts the outcome of the test, return to step 2, otherwise abort. Else if , run Anonymous Transmission.
If at any point in the protocol, realises someone does not follow the protocol, she stops behaving like the Sender and behaves as any player.
Goal: Each player gets .
- Every player chooses random bits such that .
- Every player sends their th bit to player ( can equal ).
- Every player computes and reports the value in the simultaneous broadcast channel.
- The value is computed, which equals .
Input: , security parameter .
Goal: Each player gets .
- The players agree on orderings, with each ordering having a different last participant.
- For each ordering:
- Each player picks the value of as follows: if , then ; if , then with probability and with probability .
- Run Parity with input , with a regular broadcast channel rather than simultaneous broadcast, and with the players broadcasting according to the current ordering. If the result is , then .
- Repeat steps 2(a) - 2(b) times in total. If the result of Parity is never , then .
Input: Security parameter , 's choice of is player .
Goal: notifies .
For each player :
- For each player :
- Each player picks as follows: if and player is , then with probability and with probability . Otherwise, . Let .
- Run Parity with input , with the following differences: player does not broadcast her value, and they use a regular broadcast channel rather than simultaneous broadcast. If the result is , then .
- Repeat steps 1(a) - (b) times. If the result of Parity is never 1, then .
- If player obtained , then she is .
Input: All: parameter . : distribution .
Goal: chooses a bit according to .
- The players pick bits as follows: picks bit to be 0 or 1 according to ; all other players pick .
- Run LogicalOR with input and security parameter and output its outcome.
Input: players share state .
Goal: GHZ verification of for honest players.
- The Verifier generates random angles for all players including themselves (), such that is a multiple of . The angles are then sent out to all the players in the network.
- Player measures in the basis , and sends the outcome to the Verifier.
- The state passes the verification test if
- Anonymous Transmission
Input: players share a GHZ state.
Goal: Anonymous transmission of quantum message from to .
- and do not do anything to their part of the state.
- Every player :
- Applies a Hadamard transform to her qubit
- Measures this qubit in the computational basis with outcome
- Broadcasts .
- picks a random bit and broadcasts .
- applies a phase flip to her qubit if .
- picks a random bit and broadcasts .
- applies a phase flip to her qubit, if .
- and share -anonymous entanglement. then uses the quantum teleportation circuit with input , and obtains measurement outcomes .
- The players run a protocol to anonymously send bits from to (see Further Information for details).
- applies the transformation described by on her part of the entangled state and obtains .
- For simplicity, the same security parameter has been used throughout, however, this is not required.
- Although Parity requires a simultaneous broadcast channel, only modified versions of Parity that remove this requirement are used in the anonymous transmission protocol.
- The protocol assumes there is only one Sender for simplicity. However, if this is not the case, the players can run a classical  or quantum  collision detection protocol to deal with multiple Senders.
- To send classical teleportation bits , the players can run Fixed Role Anonymous Message Transmission from , or the anonymous transmission protocol for classical bits with quantum resources from .
- Verification was experimentally demonstrated for 3- and 4-party GHZ states in .
- The Broadbent-Tapp protocol  implements classical anonymous transmission. It requires pairwise authenticated classical channels and a classical broadcast channel.
- The Christandl-Wehner protocol  implements both classical and quantum anonymous transmission. However, this protocol assumes the nodes share a perfect, trusted GHZ state.
- The Brassard et. al. protocol  implements verified quantum anonymous transmission. While their protocol includes a verification stage, it requires each player to perform a size- quantum circuit and to have access to quantum communication with all other agents.
- The Lipinska et. al. protocol  implements quantum anonymous transmission with a trusted W state instead of a GHZ state. While this is beneficial in terms of robustness to noise, the protocol proceeds to create anonymous entanglement only probabilistically, whereas GHZ-based anonymous entanglement proceeds deterministically.
- Unnikrishnan et al (2018)
- Christandl and Wehner (2005)
- Broadbent and Tapp (2007)
- Pappa et al (2012)
- McCutcheon et al (2016)
- Brassard et al (2007)
- Lipinska et al (2018)