Classical access structures of ramp secret sharing based on quantum stabilizer codes

In this paper, we consider to use the quantum stabilizer codes as secret sharing schemes for classical secrets. We give necessary and sufficient conditions for qualified and forbidden sets in terms of quantum stabilizers. Then, we give a Gilbert–Varshamov-type sufficient condition for existence of secret sharing schemes with given parameters, and by using that sufficient condition, we show that roughly 19% of participants can be made forbidden independently of the size of classical secret, in particular when an n-bit classical secret is shared among n participants having 1-qubit share each. We also consider how much information is obtained by an intermediate set and express that amount of information in terms of quantum stabilizers. All the results are stated in terms of linear spaces over finite fields associated with the quantum stabilizers.


Introduction
Secret sharing is a scheme to share a secret among multiple participants so that only qualified sets of participants can reconstruct the secret, while forbidden sets have no information about the secret [36].A piece of information received by a participant is called a share.A set of participants that is neither qualified nor forbidden is said to be intermediate.Both secret and shares are traditionally classical information.There exists a close connection between secret sharing and classical error-correcting codes [3,7,10,11,19,23,31].
After the importance of quantum information became well-recognized, secret sharing schemes with quantum shares were proposed [8,[15][16][17]37].A connection between quantum secret sharing and quantum error-correcting codes has been well known for many years [8,13,15,21,22,35,37], none of which has determined the access structure of secret sharing schemes with classical secrets and quantum shares constructed from quantum stabilizer codes.The well-known classes of quantum error-correcting codes are the CSS codes [6,38], the stabilizer codes [4,5,14] that include the CSS codes as a special case, and their non-binary generalizations [2,18,29].
The access structure of a secret sharing scheme is the set of qualified sets, that of intermediate sets and that of forbidden sets.For practical use of secret sharing, one needs sufficient (and desirably necessary) conditions on qualified sets and forbidden sets.It is natural to investigate access structures of secret sharing schemes constructed from quantum error-correcting codes.For secret sharing schemes with quantum secret and quantum shares, necessary and sufficient conditions for qualified sets and forbidden sets were clarified for the CSS codes [26,37] and the stabilizer codes [13,25].For classical secret and quantum shares, the access structure was clarified in [26,Section 4.1] with [33, Theorem 1] for the CSS codes but has not been clarified for secret sharing schemes based on quantum stabilizer codes, as far as this author knows.
Advantages of using quantum shares for sharing a classical secret are that we can have smaller size of shares [15, Section 4] and that we can realize access structures that cannot be realized by classical shares [24,27].For example, it is well known that the size of classical shares cannot be smaller than that of the classical secret in a perfect secret sharing scheme, where perfect means that there is no intermediate set, while ramp or non-perfect means that there exist intermediate sets [39].On the other hand, the superdense coding can be a secret sharing scheme sharing 2 bits by 2 qubits sent to 2 participants [15, Section 4].Any participant has no information about the secret, while the 2 participants can reconstruct the secret.We see a perfect threshold scheme sharing 2-bit classical secret by 1-qubit shares.This paper will generalize Gottesman's secret sharing [15,Section 4] to the arbitrary number of participants and the arbitrary size of classical secrets.
In this paper, we give necessary and sufficient conditions for qualified and forbidden sets in terms of the underlying linear spaces over finite fields of quantum stabilizers in Sect.3, after introducing necessary notations in Sect. 2. Section 3 also includes sufficient conditions in terms of a quantity similar to relative generalized Hamming weight [20] of classical linear codes related to the quantum stabilizers.We also consider how much information is obtained by an intermediate set and express that amount of information in terms of the underlying linear spaces of quantum stabilizers in Sect. 4.Then, we translate our theorems over prime finite fields by the symplectic inner product into arbitrary finite fields, the Euclidean, and the hermitian inner products in Sect. 5. Section 5 also includes an elementary construction by the Reed-Solomon codes as an example of Sect.5.3.Finally, we give a Gilbert-Varshamov-type sufficient condition for existence of secret sharing schemes with given parameters, and by using that sufficient condition, we show that roughly 19% of participants can be made forbidden independently of the size of classical secret, which cannot be realized by classical shares, in Sect.6. Concluding remarks are given in Sect.7. The extended abstract [28] in the workshop had no mathematical proofs and only few examples due to space limitation, and there were confusing typographical errors in the main theorems [28,Theorems 18 and 19].

Notations
Let p be a prime number, F p the finite field with p elements, and C p the p-dimensional complex linear space.The quantum state space of n qudits is denoted by C ⊗n p with its orthonormal basis {|v : v ∈ F n p }.For two vectors a, b ∈ F n p , denote by a, b E the standard Euclidean inner product.For two vectors (a|b) and (a |b ) ∈ F 2n p , we define the standard symplectic inner product For an F p -linear space C ⊂ F 2n p , C ⊥s denotes its orthogonal space in F 2n p with respect to •, • s .Throughout this paper, we always assume dim For (a|b) ∈ F 2n p , define the p n × p n complex unitary matrix X (a)Z (b) as defined in [18].An [[n, k]] p quantum stabilizer codes Q encoding k qudits into n qudits can be defined as a simultaneous eigenspace of all X (a)Z (b) ((a|b) ∈ C).Unlike [18], we do not require the eigenvalue of Q to be one.
It is well known in mathematics [1,Chapter 7] that there always exists C ⊆ C max ⊆ C ⊥s such that C max = C ⊥s max .Note that C max is not unique and usually there are many possible choices of C max .We have dim C max = n and have an isomorphism f : F k p → C ⊥s /C max as linear spaces without inner products.Since C max = C ⊥s max , C max defines an [[n, 0]] p quantum stabilizer code Q 0 .Without loss of generality, we may assume Q 0 ⊂ Q.Let |ϕ ∈ Q 0 be a quantum state vector.Since C max = C ⊥s max , for a coset V ∈ C ⊥s /C max and (a|b), (a |b ) ∈ V , X (a)Z (b)|ϕ and X (a )Z (b )|ϕ differ by a constant multiple in C and physically express the same quantum state in Q.By an abuse of notation, for a coset V ∈ C ⊥s /C max we will write |V ϕ to mean For a given classical secret m ∈ F k p , we consider the following secret sharing scheme with n participants: We can also consider a secret sharing scheme for a k-qudit secret |m with n participants as follows.The reason why we also consider secret sharing schemes with quantum secrets is to contrast the difference between the classical and the quantum access structures of a secret sharing scheme constructed from the same quantum stabilizer in Remarks 7 and 10, while the main focus of the present paper is to share classical secrets.Let A ⊂ {1, . . ., n} be a set of shares (or equivalently participants), A = {1, . . ., n}\ A, and Tr A the partial trace over A. For a density matrix ρ, col(ρ) denotes its column space.When col(ρ 1 ), . . ., col(ρ n ) are orthogonal to each other, that is, ρ i ρ j = 0 for i = j, we can distinguish ρ 1 , . . ., ρ n by a suitable projective measurement with probability 1.

Definition 1
We say A to be c-qualified We say A to be c-forbidden is the same density matrix regardless of classical secret m.By a classical access structure, we mean the set of c-qualified sets and the set of c-forbidden sets.
For a quantum secret, the quantum qualified (q-qualified) sets and the quantum forbidden (q-forbidden) sets are mathematically defined in [33].By a quantum access structure, we mean the set of q-qualified sets and the set of q-forbidden sets.
Remark 2 When classical shares on A are denoted by S A , the conventional definition of qualifiedness is I (m; S A ) = H (m) and that of forbiddenness is I (m; S A ) = 0 [39], where H (•) denotes the entropy and I (•; •) denotes the mutual information [9].
, where p(m) is the probability distribution of classical secrets m.The quantum counterpart of mutual information for classical random variables is the Holevo information , and is c-forbidden if and only if I (m; ρ A ) = 0. Therefore, Definition 1 is a natural generalization of the conventional definition in [39].

Example 3
We will see how one can express the secret sharing scheme based on superdense coding [15,Section 4] by a quantum stabilizer.Let p = 2, n = 2 and C be the zero-dimensional linear space consisting of only the zero vector.Then, C ⊥s = F 4  2 .We choose C max as the space spanned by (1, 1|0, 0) and (0, 0|1, 1).For a classical secret code Q 0 as the one-dimensional complex linear space spanned by the Bell state which corresponds to the two-bit secret (0, 0).The secret It is clear that the share set {1, 2} is c-qualified.When A = {1} or A = {2}, we have which means {1}, {2} and ∅ are c-forbidden.We have determined the classical access structure completely, and we see that this scheme is perfect [39] in the sense that there is no intermediate set.
For completeness, we also note its quantum access structure.The set {1, 2} is qqualified and ∅ is q-forbidden, of course.By [25, Eq. ( 3)], we see that {1} and {2} are intermediate, that is, neither qualified nor forbidden.This quantum access structure exemplifies the fact that q-qualifiedness implies c-qualifiedness, that q-forbiddenness implies c-forbiddenness and that their converses are generally false [33, Theorems 1 and 2].It also exemplifies the fact that if quantum secret is larger than quantum shares, then the scheme cannot be perfect [8,15].

Theorem 4 For the secret sharing scheme described in Sect. 2, A is c-qualified if and only if
dim A is c-forbidden if and only if The proof is given after showing two examples below.
Example 5 Consider the situation in Example 3.For A = {1} or A = {2}, we see that C max ∩ F A 2 and C ∩ F A 2 are the zero linear space and that Eq. ( 2) holds.For A = {1, 2}, Eq. ( 1) is clearly true.

Example 6
In this example, we show that a different choice of C max gives a different access structure.Let C be as Example 5 and C max be the linear space generated by (0, 0|1, 0) and (0, 0|0, 1).A classical secret (m 1 , m 2 ) is now encoded to |m 1 m 2 .For A = {1} or A = {2}, both (1) and ( 2) are false and both A = {1} and A = {2} are intermediate sets.This example shows that the choice of C max is important.
Proof (Theorem 4) Assume Eq. (1).Then, there exists a basis {(a 1 |b 1 )+C, . . ., (a have the same value of the symplectic inner product against a fixed (a i |b i ), which will be denoted by (a i |b i ), V s .Suppose that we have two differ- , a contradiction.We have seen that any two different cosets have different symplectic inner product values against some (a i |b i ).For each i, the n participants can collectively perform quantum projective measurement corresponding to the eigenspaces of X (a i )Z (b i ) and can determine the symplectic inner product1 (a i |b i ), f (m) s as [18, Lemma 5] when the classical secret is m.Since (a i |b i ) has nonzero components only at A, the above measurement can be done only by A, which means A can reconstruct m.
Assume that Eq. ( 1) is false.Since the orthogonal space of C in F A p is isomorphic to P A (C ⊥s ), which can be seen as the almost same argument as the duality between shortened linear codes and punctured linear codes [34], we see that dim P A (C ⊥s )/P A (C max ) < dim C ⊥s /C max .This means that there exists two different classical secrets m 1 and m 2 such that P A ( f (m 1 )) = P A ( f (m 2 )).This means that the encoding procedures of m 1 and m 2 are exactly same on A and produce the same density matrix on A, which shows that A is not c-qualified.
Assume Eq. ( 2).Then, we have dim P A (C ⊥s )/P A (C max ) = 0.This means that for all classical secrets m, P A ( f (m)) and their encoding procedures on A are same, which produces the same density matrix on A regardless of m.This shows that A is c-forbidden.
Assume that Eq. ( 2) is false.Then, there exist two different classical secrets m 1 , m 2 , and (a|b) By [18,Lemma 5], this means that the quantum measurement corresponding to X (a)Z (b) gives different outcomes with Tr can be performed only by participants in A. These observations show that A is not c-forbidden.

Remark 7 A necessary and sufficient condition for
Since ker(P A ) = F A p , we have dim P A (C ⊥s )/P A (C max ) = k.The relation between duals of punctured codes and shortened codes [34] implies dim C max ∩F A p /C ∩F A p = k.Therefore, Eq. (3) implies Eq. (1).
Similarly, by [15,Corollary 2], necessary and sufficient condition for A being qforbidden is By a similar argument, we see that Eq. ( 4) implies Eq. ( 2).
Next, we give sufficient conditions in terms of the coset distance [11] or the first relative generalized Hamming weight [20].To do so, we have to slightly modify them.For (a|b) = (a 1 , . . ., a n |b 1 , . . ., b n ) ∈ F n p , define its symplectic weight swt(a|b) = |{i : p , we define their coset distance as Example 9 Consider the situation in Example 5. We have d s (C ⊥ , C max ) = 1, which implies that 2 shares form a c-qualified set.We also have d s (C max , C) = 2, which implies that 1 share forms a c-forbidden set.
we see that Eq. ( 1) holds with A.
Remark 10 By Remark 7 and a similar argument to the last proof, we see that if then A is q-qualified.Note that these observations can also be deduced from quantum erasure decoding and [15, Corollary 2] and are not novel.

Amount of information possessed by an intermediate set
Let A ⊂ {1, . . ., n} with A = ∅ and A = {1, . . ., n}.In this section, we study the amount of information possessed by A.

Lemma 11
For two classical secrets m 1 and m 2 , we have Assume that f (m 1 ) and f (m 2 ) give different symplectic inner products for some vector (a|b) in C max ∩ F A p .Then, the quantum measurement corresponding to X (a)Z (b) can be performed only by the participants in A and by [18,Lemma 5] the outcomes for | f (m 1 )ϕ and | f (m 2 )ϕ are different with probability 1.This means that col(Tr A (| f (m 1 )ϕ f (m 1 )ϕ|)) and col(Tr A (| f (m 2 )ϕ f (m 2 )ϕ|)) are orthogonal to each other.
There are p elements in P A (C ⊥s )/P A (C max ), which shows the first claim.
The composite F p -linear map "mod P A (C max )" •P A • f from F k p to P A (C ⊥s )/ P A (C max ) is surjective.Thus, the dimension of its kernel is k − , which shows the second claim.

Definition 13
In light of Proposition 12, the amount of information possessed by a set A of participants is defined as Remark 14 When the probability distribution of classical secrets m is uniform, the quantity in Definition 13 is equal to the Holevo information [32, Section 12.1.1]counted in log 2 .To see this, firstly, the set Λ in Proposition 12 consists of nonoverlapping projection matrices and each matrix commutes with every other matrices in Λ.So the Holevo information is just equal to the classical mutual information [9] between random variable X , corresponding to classical secrets in F k p , and random variable Y , corresponding to matrices in Λ, where Y is given as a surjective function of X .By Proposition 12, Y has the uniform probability distribution.Therefore, I (X ; Y ) = H (Y ) = log 2 |Λ| = Eq.( 5).
We say that a secret sharing scheme is r i -reconstructible if |A| ≥ r i implies A has i log 2 p or more bits of information [12].We say that a secret sharing scheme is t i -private if |A| ≤ t i implies A has less than i log 2 p bits of information [12].In order to express r i and t i in terms of combinatorial properties of C, we introduce a slightly modified version of the relative generalized Hamming weight [20].

Definition 15 For two linear spaces
p and i = 1, . . ., k, define the ith relative generalized symplectic weight Note that d 1 s = d s .The following theorem generalizes Theorem 8.

Theorem 16
Example 17 Consider the situation of Example 9. We have . which shows the second claim.

Translation to arbitrary finite fields
Let q = p μ with μ ≥ 1, and {γ 1 , . . ., γ μ } be a fixed F p -basis of F q .Ashikhmin and Knill [2] proposed the following translation from F q to F p for quantum stabilizer codes.Let M be a μ×μ invertible matrix over F p whose (i, j) element is Tr q/ p (γ i γ j ), where Tr q/ p is the trace map from F q to F p .Let φ be an F p -linear isomorphism sending where Ashikhmin and Knill proved the following.
and we can construct a secret sharing scheme by φ −1 (C) ⊂ φ −1 (C max ).It encodes kμ log 2 p = k log 2 q bits of classical secrets m ∈ F k q into μn qudits in C p , which can also be seen as n qudits in C q , where C q is the q-dimensional complex linear space.Let A ⊂ {1, . . ., n}. : a i, j = b i, j = 0 for i / ∈ A and j = 1, . . ., μ}.We consider each qudit in C q of the quantum codeword as a share and examine the property of a share set A. We have

By abuse of notation, by F
Equation ( 7) together with Theorem 4 implies -A is qualified if and only if dim The above observation shows that Theorems 4 and 8 also hold for F q .In addition, Eq. ( 7) means that a share set A has (log 2 q × dim F q C max ∩ F A q /C ∩ F A q )-bits of information about the secret m ∈ F k q , also generalizes the proof argument of Theorem 16, and implies that Theorem 16 also holds for F q .In the sequel, we consider a qudit in C q as each share and dim means the dimension over F q .

Translation to the Hamming distance and the hermitian inner product
Many of results in the symplectic construction of quantum error-correcting codes over F q are translated to F q 2 -linear codes with the hermitian inner product [2,18,29].For x ∈ F n q 2 define x q as the component-wise qth power of x.For two vectors x, y ∈ F q 2 , define the hermitian inner product as x, y h = x q , y E .For D ⊂ F n q 2 , D ⊥h denotes the orthogonal space of D with respect to the hermitian inner product.
Only in Sects.5.2, 5.3 and 5.4, for A ⊂ {1,…, n}, define F A q = {(a 1 , . . ., a n ) ∈ F n q : a i = 0 for i / ∈ A}, and define P A to be the projection map onto A, that is, Theorem 19 Let D ⊂ F n q 2 be an F q 2 -linear space.We assume dim D = k and there exists D max such that D ⊂ D max ⊂ D ⊥h and D max = D ⊥h max , which implies dim D max = n/2.Then, D defines a secret sharing scheme based on the quantum stabilizer defined by D encoding n − 2k symbols in where d H is the coset distance [11], or equivalently, the first relative generalized Hamming weight [20].

Proof
The proof is almost same as [18].

Translation to the Hamming distance and the Euclidean inner product
and Remark 22 A suitable choice of C max is unclear as of this writing.A valid choice is , which gives the standard encoding [6,38] of the CSS codes.But this choice gives no advantage over the purely classical secret sharing constructed from linear codes C 2 ⊂ C 1 [3,7,19,23].Because the necessary and sufficient condition for c-qualified A is dim P A (C 1 )/P A (C 2 ) = dim C 1 /C 2 and the necessary and sufficient condition for c-forbidden A is dim P A (C 1 )/P A (C 2 ) = 0 by combining [26,Section 4.1] and [33,Theorem 1], which are exactly same [12] as those of the purely classical secret sharing constructed from C 2 ⊂ C 1 .
Theorem 23 Let E ⊂ F n q be the F q -linear space.We assume dim E = k , and there exists E max such that E ⊂ E max ⊂ E ⊥E and E max = E ⊥E max , which implies dim E max = n/2.Then, E defines a secret sharing scheme based on the quantum stabilizer defined by E encoding n − 2k symbols in F q .A set A ⊂ {1, . . ., n} is cqualified if and only if dim

Proof
The proof is almost same as [18].
Example 24 Example 3 is restored by choosing E = {0}, E ⊥E = F 2  2 , and E max as the F 2 -linear space spanned by (1,1).Thus, we see that Theorem 23, in contrast to Remark 22, can provide a secret sharing scheme with an advantage over purely classical secret sharing.
For a linear space V ⊂ F n q , its jth generalized Hamming weight d j H (V ) is defined by [34] For RS codes, which correspond to E = RS(n, (n − k)/2) and E max = RS(n, n/2) in Theorem 23.
Then, we have In In addition, by the definitions of r i and t i , we have r i ≥ t i + 1.So we see that t i = (n + i)/2 − 1 and r i = (n + i)/2 , which also imply that inequalities (8) and ( 9) are in fact equalities by Theorem 16.Let ρ A be the density matrix of quantum shares in a share set A ⊆ {1, . . ., n}.Until the end of Sect.5.4, assume that classical secrets m are uniformly distributed.From Remark 14 and those exact values of r i and t i for i = 1, . . ., k, we see that the Holevo information [32, Section 12.1.1](quantum counterpart of the mutual information [9]) between m and ρ A is Observe here that one increment of the share size increases the Holevo information by two F q symbols.This is in sharp contrast with the classical linear secret sharing [3,7,19,23], because one increment of the share size can increase the mutual information by at most one F q symbol in classical linear secret sharing, when each share is one F q symbol.Observe also that we have completely determined the classical access structure of this quantum secret sharing scheme.

Gilbert-Varshamov-type existential condition
In this section, we give a sufficient condition for existence of C ⊂ C max = C ⊥s max ⊂ C ⊥s ⊂ F 2n q , with given parameters.
Theorem 25 If positive integers n, k, δ t , δ r satisfy q n+k − q n q 2n − 1 Proof The following argument is similar to the proof of Gilbert-Varshamov bound for stabilizer codes [4].Let Sp(q, n) be the set of invertible matrices on F 2n q that does not change the values of the symplectic inner product.Let A(k) be the set of pairs of linear spaces -for nonzero e 1 , e 2 ∈ F 2n q , there exists M ∈ Sp(q, n) such that Me 1 = e 2 , and -for For nonzero e 1 , e 2 ∈ F 2n q with M 1 e 1 = e 2 (M 1 ∈ Sp(q, n)) and some fixed For each (V , W ) ∈ A(k), the number of e such that e ∈ W \V is |W | − |V | = q n − q n−k .The number of triples (e, V , W ) such that 0 = e ∈ W \V is Similarly, we have If there exists (V , W ) ∈ A(k) such that (V , W ) / ∈ B V (k, e 1 ) and (V , W ) / ∈ B V (k, e 2 ) for all 1 ≤ swt(e 1 ) ≤ δ r − 1 and 1 ≤ swt(e 2 ) ≤ δ t − 1, then there exists a pair of (V , W ) with the desired properties.The number of e such that 1 ≤ swt(e) ≤ δ − 1 is given by By combining Eqs. ( 11), ( 12) and ( 13), we see that Eq. ( 10) is a sufficient condition for ensuring the existence of (V , W ) required in Theorem 25.
We will derive an asymptotic form of Theorem 25.
Theorem 26 Let R, t and r be nonnegative real numbers ≤ 1. Define h q (x) = −x log q x − (1 − x) log q (1 − x).For sufficiently large n, if h q ( t ) + t log q (q 2 − 1) < 1 and h q ( r ) + r log q (q 2 − 1) < 1 − R, Theorem 26 has a striking implication that we can construct a secret sharing scheme with roughly 19% of participants being forbidden independently of the size (i.e., R in Theorem 26) of classical secrets for q = 2 and large n, as h 2 (0.19) + 0.19 log 2 3 1.Such properties cannot be realized by classical shares.

Conclusion
In this paper, we considered construction of secret sharing schemes for classical secrets by quantum stabilizer codes and clarified their access structures, that is, qualified and forbidden sets, in terms of underlying quantum stabilizers.We expressed our findings in terms of linear spaces over finite fields associated with the quantum stabilizers and gave sufficient conditions for qualified and forbidden sets in terms of combinatorial parameters of the linear spaces over finite fields.It allowed us to use classical coding theoretic techniques, such as the Gilbert-Varshamov-type argument, and we obtained a sufficient condition for existence of a secret sharing scheme with given parameters.By using that sufficient condition, we demonstrated that there exist infinitely many quantum stabilizers with which associated access structures cannot be realized by any purely classical information processing.We have not thoroughly considered code construction, which is a future research agenda.

1 .
Encode a given quantum secret m∈F k p α(m)|m into the quantum codeword m∈F k p α(m)| f (m)ϕ ∈ Q, where α(m) ∈ C are complex coefficients with m∈F k p |α(m)| 2 = 1. 2. Distribute each qudit in the quantum codeword m∈F k p α(m)| f (m)ϕ to a participant.
then there exist C ⊂ C max ⊂ C ⊥s ⊂ F 2n q such that dim C = n − n R , d s (C ⊥s , C max ) ≥ n r and d s (C max , C) ≥ n t .Proof Proof can be done by almost the same argument as [30, Section III.C].
and only if f (m 1 ) and f (m 2 ) give the same symplectic inner product for all vectors in C max ∩ F A p , and col(Tr A (| f (m 1 )ϕ f (m 1 )ϕ|)) and col(Tr A (| f (m 2 )ϕ f (m 2 )ϕ|)) are orthogonalto each other if and only if f (m (m 2 )}, and the encoding procedure on A is the same for m 1 and m 2 , which shows Tr A 1 ) and f (m 2 ) give different symplectic inner products for some vector (a|b) in C max ∩ F A p .Proof Assume that f (m 1 ) and f (m 2 ) give the same symplectic inner product for all vectors in C max ∩ F A p .Then, we have {P A (a|b) : (a|b) ∈ f (m 1 )} = {P A (a|b) : 123 (a|b) ∈ f and d1 s (C ⊥s , C max ) = d 2 s (C ⊥s , C max ) = 1.the relative generalized Hamming weight, we do not have the strict monotonicity in i of d i s .