Secure N -dimensional Simultaneous Dense Coding and Applications
aa r X i v : . [ qu a n t - ph ] F e b Secure N -dimensional simultaneous dense coding andapplications Haozhen Situ ∗ Daowen Qiu † Paulo Mateus ‡ Nikola Paunkovi´c § Department of Computer Science, Sun Yat-sen University, Guangzhou 510006, China College of Mathematics and Informatics, South China Agricultural University, Guangzhou 510642,China The Guangdong Key Laboratory of Information Security Technology, Sun Yat-sen University, Guangzhou510006, China Departamento de Matem´atica, Instituto Superior T´ecnico, Universidade de Lisboa, Av. Rovisco Pais1049-001, Lisboa, Portugal SQIG – Security and Quantum Information Group, Instituto de Telecomunica¸c˜oes, Av. Rovisco Pais1049-001, Lisboa, Portugal
Abstract
Simultaneous dense coding guarantees that Bob and Charlie simultaneously receive their respec-tive information from Alice in their respective processes of dense coding. The idea is to use theso-called locking operation to “lock” the entanglement channels, thus requiring a joint unlockingoperation by Bob and Charlie in order to simultaneously obtain the information sent by Alice. Wepresent some new results on simultaneous dense coding: (1) We propose three simultaneous densecoding protocols, which use different N -dimensional entanglement (Bell state, W state and GHZstate). (2) Besides the quantum Fourier transform, two new locking operators are introduced (thedouble controlled-NOT operator and the SWAP operator). (3) In the case that spatially distant Boband Charlie have to finalise the protocol by implementing the unlocking operation through commu-nication, we improve our protocol’s fairness, with respect to Bob and Charlie, by implementing theunlocking operation in series of steps. (4) We improve the security of simultaneous dense codingagainst the intercept-resend attack. (5) We show that simultaneous dense coding can be used to im-plement a fair contract signing protocol. (6) We also show that the N -dimensional quantum Fouriertransform can act as the locking operator in simultaneous teleportation of N -level quantum systems. Keywords : Quantum communication, Teleportation, Dense coding ∗ [email protected] † [email protected] ‡ [email protected] § [email protected] Introduction
Due to the Holevo bound [1], at most log N bits of information can be transmitted via a qu N it ( N -levelquantum system). Dense coding, proposed by Bennett and Wiesner [2] in 1992, increases the classicalcapacity of a quantum communication channel with the help of prior entanglement [3]. If the sender andthe receiver share a pair of entangled qu N its, 2 log N bits can be transmitted via a qu N it [2].In the simplest case of dense coding two parties, Alice and Bob, share a pair of entangled qubits (2-level quantum systems) in a Bell state. Alice first performs one of the four local unitary operations I , σ x , iσ y and σ z (where σ j are the Pauli matrices) on her qubit to encode 2 bits of information, transformingthe entangled pair into one of the four mutually orthogonal Bell states. Then Alice sends her qubit toBob through a quantum channel. Bob is now able to measure both qubits in the Bell basis to obtainone of the four possible outcomes correlated with the operations performed by Alice. Thus, Alice cantransmit 2 bits of information to Bob by manipulating and sending only one qubit.Thus far, dense coding has been extensively studied in various ways. For example, dense codingthat utilises high-dimensional entangled states has been studied in [4, 5, 6], non-maximally entanglementchannels in [7, 8, 9, 10, 11, 12, 13, 14, 15, 16, 17, 18, 19], while multipartite entanglement channelshave also been considered in [20, 21, 22, 23, 24, 25, 26, 27]. Another generalisation is to perform thecommunication task under the control of a third party, so-called controlled dense coding [28, 29, 30, 31].Inspired by the simultaneous teleportation scheme proposed by Wang et al [32], we have proposeda simultaneous dense coding (SDC) scheme [33], which guarantees that Bob and Charlie (the receivers)simultaneously receive their respective information from Alice (the sender) in their respective processesof dense coding. In this scheme, Alice first performs a locking operation to entangle the particles fromtwo independent quantum entanglement channels, and therefore the receivers cannot obtain their respec-tive information separately, before performing the unlocking operation together. The quantum Fouriertransform and its inverse are used as the locking and unlocking operators, respectively.Simultaneous dense coding may be relevant and useful in various applications in which Bob and Charliecan be either close or separated. If Alice has two different secrets, one for Bob and another for Charlie,she can utilise simultaneous dense coding to guarantee that Bob and Charlie simultaneously reveal theirrespective secrets. Bob does not know Charlie’s secret and vice versa. For example, boss wants twoemployees to simultaneously carry out two confidential commercial activities under the condition thatthe sensitive information of each activity is only revealed to whom is in charge of that activity.There are other applications improving some models or tasks of quantum communication. In Sec. 5,we show that simultaneous dense coding can be used to implement a fair contract signing protocol [34]between spatially distant Bob and Charlie. In this case, Bob and Charlie are separated so that there isa problem of how to implement the unlocking operation fairly. We discuss this problem in Sec.3.In this paper, we give some new results on simultaneous dense coding and teleportation. The mainimprovements over earlier proposals are: (i) introduction of new locking operations (the double-controlled-NOT and the SWAP operators) for SDC schemes that were not used before, showing that the protocol canbe achieved by using three different N -dimensional quantum states (Bell, W and GHZ states) that werenot mentioned in that context in the literature before; (ii) designing a strategy which achieves the fairnessof SDC, allowing for the protocol to be performed even when mutually mistrustful Bob and Charlie aresituated on spatially distant locations, a feature which previous SDC proposals do not allow; (iii) designinga strategy which also achieves the security of SDC against intercept-resend attack, improving the securityof SDC over the previous proposals; (iv) introducing simultaneous teleportation scheme for the transfer ofarbitrary number of N -level quantum states. In addition to that, we proposed contract signing protocol2ased on a fair and secure SDC protocol. Having more options for achieving simultaneous transmission of(densely coded) information presents opportunities for designing SDC protocols with improved securityfeatures, and in addition provides wider range of possibly suitable experimental realisations. Indeed,achieving the fairness of SDC scheme, a feature not satisfied by previous SDC proposals, is only possiblewith the double-controlled-NOT and the SWAP locking operator. Also, the security of the protocolagainst intercept-resend attack is a novel feature of SDC schemes introduced in our paper.The paper is organised as follows. In Sec. 2, we introduce the locking operators (i.e. the quantumFourier transform, the double controlled-NOT operator and the SWAP operator) and propose threesimultaneous dense coding protocols utilising different N -dimensional quantum states (i.e., Bell states,W states, and GHZ states). In Sec. 3, we improve the fairness of the protocol by implementing theunlocking operation between spatially distant Bob and Charlie. In Sec. 4, we improve the security ofsimultaneous dense coding against the intercept-resend attack. In Sec. 5, we show that simultaneousdense coding can be used to implement a fair contract signing protocol. In Sec. 6, we show that the N -dimensional quantum Fourier transform can act as the locking operator in simultaneous teleportationof qu N its. A brief conclusion follows in Sec. 7. N -dimensional simultaneous dense coding A qu N it is an N -dimensional quantum system. States of N -dimensional quantum systems can be mappedonto n = log ( N ) qubits, and throughout the paper we will assume that a qu N it is realised as an orderedarray of qubits. We also assume that the dimension N of qu N its satisfies the requirement N = 2 n , with n ∈ N . In other words, one qu N it consists of (or can be mapped to) n qubits.In the task of N -dimensional simultaneous dense coding (SDC), Alice intends to use dense codingto send two c N its (arrays of classical bits) b , b ∈ { , , . . . , N − } to Bob and two c N its c , c ∈{ , , . . . , N − } to Charlie, under the condition that Bob and Charlie must collaborate to simultaneouslyfind out what she sends.In the following subsections, we propose three protocols, one using N -dimensional Bell states, the otherusing W states, and the third using GHZ states, as the entanglement channels, respectively. The ideabehind these protocols is to perform the locking operator on Alice’s qu N its before sending them to Boband Charlie. After receiving Alice’s qu N its, the states of Bob’s subsystem and Charlie’s subsystem areindependent of ( b , b ) and ( c , c ), respectively, so that they know nothing about the encoded information.Only after performing the unlocking operator (the inverse of the locking operator) together, Bob andCharlie can obtain ( b , b ) and ( c , c ), respectively.In this section, we assume that Bob and Charlie are at the same site. In order to implement theunlocking operator, they can input their particles into a physical device that can unlock the particles,and then get their respective output particles. The problem of how distant Bob and Charlie can performthe unlocking operator fairly is discussed in Sec. 3. Before introducing the protocols, let us first have a look at the DCNOT (double controlled-NOT) operator,which is used as the locking operator. The DCNOT operator is composed of two CNOT (controlled-NOT)operators. The CNOT operator has two input qubits. If the first qubit (the control qubit) is in state | i , CNOT flips the state of the second qubit (the target qubit). If the control qubit is in state | i ,CNOT does nothing to the target qubit ( | i and | i are the basis vectors). Its action can be described3s ( x, y = 0 , | x i| y i → | x i| x ⊕ y i , (1)where ⊕ denotes bitwise addition modulo 2.The DCNOT operator is formed by performing the first CNOT with the first qubit as the control andthe second being the target, and then a second CNOT with inverse roles of the qubits (the first qubit asthe target and the second being the control). Its action can be described as: | x i| y i → | y i| x ⊕ y i , (2)and the inverse DCNOT operator can be described as: | x i| y i → | x ⊕ y i| x i . (3)Our qu N its | x i A | y i A , with x, y ∈ { , , . . . , N − } , are arrays of n qubits, and can be written as: | x , . . . , x n i A , ...A ,n | y , . . . , y n i A , ...A ,n , (4)where x . . . x n and y . . . y n are binary representations of x and y , respectively, and A i,j denote differentqubits ( i = 1 , j = 1 , , . . . N ). We define the N -dimensional DCNOT operator by applying theDCNOT operator on each pair of A ,j A ,j : | x , . . . , x n i A , ...A ,n | y , . . . , y n i A , ...A ,n → | y , . . . , y n i A , ...A ,n | x ⊕ y , . . . , x n ⊕ y n i A , ...A ,n , (5)that is ( A = A , A , . . . A ,N and analogously for A ), | x i A | y i A → | y i A | x ⊕ y i A . (6)Analogously, by applying the inverse DCNOT operator on each pair of A ,j A ,j , we have the N -dimensional inverse DCNOT operator: | x , . . . , x n i A , ...A ,n | y , . . . , y n i A , ...A ,n → | x ⊕ y , . . . , x n ⊕ y n i A , ...A ,n | x , . . . , x n i A , ...A ,n , (7)that is, | x i A | y i A → | x ⊕ y i A | x i A . (8) N -dimensional Bell state Protocol 1 uses the following N -dimensional Bell basis [35], for composite systems of two qu N its 1 and2: | φ ( xy ) i = 1 √ N N − X j =0 e πiN jx | j + y i | j i , (9)where x, y ∈ { , , . . . , N − } . In the rest of the paper, addition and subtraction inside kets are donemodulo N . 4he local (acting onto system 1 only) unitary operators U ( xy ) transform | φ (00) i into | φ ( xy ) i : (cid:16) U ( xy ) ⊗ I (cid:17) | φ (00) i = | φ ( xy ) i , (10)where U ( xy ) = X y Z x , X : | j i −→ | j + 1 i is the shift operator, and Z : | j i −→ e πiN j | j i is the rotationoperator.The set {| φ ( xy ) i } forms an orthonormal basis of completely distinguishable states, and for thatreason each of its elements can be used to carry information ( xy ). The unitary operators U ( xy ) are thenused to encode that information ( xy ) into the initial state | φ (00) i .In the initialisation phase of Protocol 1, Alice, Bob and Charlie share two pairs of entangled qu N its | φ (00) i A B and | φ (00) i A C , where subscripts A and A denote Alice’s two qu N its, subscript B denotesBob’s qu N it and subscript C denotes Charlie’s qu N it. The initial quantum state of the composite systemis (note that for reasons of simplicity, we drop the subscript A BA C for Ω-states | Ω(0) i etc.) | Ω(0) i = | φ (00) i A B ⊗ | φ (00) i A C . (11)Protocol 1 consists of five steps:(1) Encoding.
Alice performs unitary operators U ( b b ) on qu N it A and U ( c c ) on qu N it A toencode ( b , b ) and ( c , c ), respectively, like in the original dense coding scheme [2]. After that, the stateof the composite system becomes | Ω(1) i = U A ( b b ) ⊗ U A ( c c ) | Ω(0) i = | φ ( b b ) i A B ⊗ | φ ( c c ) i A C . (12)(2) Locking.
Alice performs the DCNOT operator on qu N its A A to lock the entanglement channels.The state of the composite system becomes | Ω(2) i = DCN OT A A (cid:16) | φ ( b b ) i A B ⊗ | φ ( c c ) i A C (cid:17) . (13)(3) Communication.
Alice sends qu N it A to Bob and qu N it A to Charlie, like the original densecoding scheme [2].(4) Unlocking.
Bob and Charlie collaborate to perform the inverse
DCN OT operator on qu N its A A . The state of the composite system becomes | Ω(3) i = DCN OT † A A | Ω(2) i = | φ ( b b ) i A B ⊗ | φ ( c c ) i A C . (14)(5) Decoding.
Bob and Charlie measure qu N its A B and qu N its A C in the N -dimensional Bell basisrespectively to obtain ( b , b ) and ( c , c ), like the original dense coding scheme [2].The following theorem demonstrates the validity of Protocol 1. Theorem 1.
Neither Bob nor Charlie alone can learn the encoded information from the states oftheir subsystems before step 4 (Unlocking) of Protocol 1.Proof
After step 2 (
Locking ), the state of the composite system becomes | Ω(2) i = DCN OT A A √ N N − X j =0 e πiN jb | j + b i A | j i B ⊗ √ N N − X k =0 e πiN kc | k + c i A | k i C ! = 1 N N − X j,k =0 e πiN ( jb + kc ) | k + c i A | ( j + b ) ⊕ ( k + c ) i A | j i B | k i C , (15)5nd the reduced density matrix in subsystem A B is ρ A B = N − X j,k =0 ( A h j | C h k | ) | Ω(2) ih Ω(2) | ( | j i A | k i C )= 1 N N − X j,k =0 | j i A | k i BA h j | B h k | = I A B /N . (16)We can calculate the reduced density matrix in subsystem A C in the same way and get ρ A C = I A C /N . Because ρ A B and ρ A C are independent of ( b , b ) and ( c , c ), Bob and Charlie know nothingabout the encoded information before step 4 ( Unlocking ). (cid:3) N -dimensional W state Li and Qiu [26] presented a sufficient and necessary condition for a N -dimensional W state to be suitablefor perfect teleportation and dense coding, and then they generalised the states of W-class to multi-particle systems with N -dimension: | W (00) i = 1 √ N (cid:16) √ N − X j =1 | j − i ( | j i + | j i ) + | N − i | i (cid:17) . (17)Alice uses unitary operators U ( xy ) = N − X j =0 e πiN ( j − y ) x | j − y ih j | (18)to encode her information: | W ( xy ) i = (cid:16) U ( xy ) ⊗ I ⊗ I (cid:17) | W (00) i , (19)where x, y ∈ { , , . . . , N − } .In the initialisation phase of Protocol 2, Alice, Bob and Charlie share two pairs of entangled qu N its | W (00) i A B and | W (00) i A C , where subscript A and A denote Alice’s two qu N its, subscript B denotesBob’s two qu N its and subscript C denotes Charlie’s two qu N its. Protocol 2 consists of five steps:(1) Encoding.
Alice performs unitary operators U ( b b ) on qu N it A and U ( c c ) on qu N it A toencode ( b , b ) and ( c , c ), respectively.(2) Locking.
Alice performs the DCNOT operator on qu N its A A .(3) Communication.
Alice sends qu N it A to Bob and qu N it A to Charlie.(4) Unlocking.
Bob and Charlie collaborate to perform the inverse
DCN OT operator on qu N its A A .(5) Decoding.
Bob and Charlie make the von Neumann measurement using the orthogonal states {| W ( xy ) i} on qu N its A B and qu N its A C , respectively, to obtain ( b , b ) and ( c , c ).The following theorem demonstrates the validity of Protocol 2.6 heorem 2. Neither Bob nor Charlie alone can learn the encoded information from the states oftheir subsystems before step 4 (Unlocking) of Protocol 2.Proof
The proof is similar to that of Protocol 1. After step 2 (
Locking ), the reduced density matrix ρ A B = 1 N N − X j =0 | j i A | i BA h j | B h | + 12 N N − X k =1 N − X j =0 | j i A ( | k i + | k i ) BA h j | B ( h k | + h k | )= 1 N N − X j =0 | j i A h j | ⊗ N " | i B h | + 12 N − X k =1 ( | k i + | k i ) B ( h k | + h k | ) , (20)and analogously for rho A C . Because ρ A B and ρ A C are independent of ( b , b ) and ( c , c ), Bob andCharlie know nothing about the encoded information before step 4 ( Unlocking ). (cid:3) N -dimensional GHZ state Protocol 3 uses the following N -dimensional GHZ states [4]: | GHZ ( xy ) i = 1 √ N N − X j =0 e πiN jx | j + y i | jj i , (21)where x, y ∈ { , , . . . , N − } .The unitary operators U ( xy ) transform | GHZ (00) i into | GHZ ( xy ) i : (cid:16) U ( xy ) ⊗ I ⊗ I (cid:17) | GHZ (00) i = | GHZ ( xy ) i , (22)where U ( xy ) = X y Z x , X : | j i −→ | j + 1 i is the shift operator, Z : | j i −→ e πiN j | j i is the rotationoperator.Protocol 3 is similar to Protocols 1 and 2, and the proof of its validity is analogous to those of Protocols1 and 2. In this subsection, we introduce another two locking operators: the quantum Fourier transform and theSWAP operator.The two-qu N it quantum Fourier transform is defined by | x i A | y i A → N N − X j =0 N − X k =0 e πiN ( xN + y )( jN + k ) | j i A | k i A . (23)The SWAP operator simply swaps two qubits (or qu N its): | ϕ i A | ϕ ′ i A −→ | ϕ ′ i A | ϕ i A . (24)When the N -dimensional quantum Fourier transform or the SWAP operator are substituted for theDCNOT operator in the above three protocols, the states of Bob’s subsystem and Charlie’s subsystemafter step 2 ( Locking ) are also independent of ( b , b ) and ( c , c ). Neither Bob nor Charlie alone canlearn the encoded information from the states of their subsystems before step 4 ( Unlocking ). Only after7erforming the inverse quantum Fourier transform or the SWAP operator together, they can achieve( b , b ) and ( c , c ) respectively.When the SWAP operator is used as the locking operator, Protocols 1-3 become simpler. Step 2( Locking ) can be omitted. In step 3 (
Communication ), Alice sends qu N it A to Charlie and qu N it A to Bob. In step 4 ( Unlocking ), Bob and Charlie swap qu N it A and qu N it A . However, if one of thereceivers, say Bob, is malicious, he can fool Charlie in step 4 ( Unlocking ) by detaining the qu N it thatcarries ( c , c ) (i.e. qu N it A ) and swapping a randomly prepared fake qu N it for the qu N it that carries( b , b ) (i.e. qu N it A ). Then, Bob would receive ( b , b ) from qu N its A B , but Charlie would not receiveachieve ( c , c ), because qu N it A is still at Bob’s side. The clients (Bob and Charlie) can decode the messages only by the joint unlocking quantum operation,which requires either a quantum channel, shared entanglement, or direct interaction between them. By“direct interaction”, we mean that the clients meet and input their particles into a physical device thatcan unlock the particles, and then get their respective output particles.In this section, we discuss the problem of achieving a global unlocking operation between the distantparties (Bob and Charlie) by the means of local operations and classical communication (LOCC), someprior shared resources (such as entanglement, etc.) and/or quantum communication. Also, we discussthe problem of the fairness of the protocol, in case the clients do not trust each other. The solution is aprobabilistic protocol based on sequential exchange of information (quantum, or classical with the helpof prior shared entanglement) between the clients.
The problem of achieving a global operation by the actions of spatially distant clients (Bob and Charlie)lies in the fact that the unlocking operation (whether it is the inverse DCNOT, quantum Fourier transformor SWAP ) has a feature that it can entangle initially separable states. Since it is impossible to createentanglement by the means of LOCC only, in order to implement the unlocking operation, Bob andCharlie have to share prior entanglement, or use a quantum channel for one of the clients to send hisqu N it to the other, who would then perform the unlocking operation on qu N its A A locally (i.e. at hissite).The problem with any such protocol is that it can be neither simultaneous, nor symmetric, withrespect to the two parties involved, which clearly sets an unfair situation.This is a general problem that arises within asynchronous distributed networks [36]. Namely, in orderto achieve the joint operation of the qu N its A A , clients can each perform local measurements, andthen send, conditional to the measurement outcomes, (classical or quantum) information to the other.Since the clients are far apart, it is impossible to achieve simultaneous message exchange - the messagesare always sent one at a time, from one client to the other (the network is “asynchronous”). This meansthat, whatever the protocol that achieves the unlocking operation is, there always exists the last message , The case of the SWAP operation is particularly interesting. Namely, after Bob and Charlie swap the states of qubits A and A , the very qubits do not become entangled with each other. Nevertheless, the distant sites of Bob and Charliedo become entangled: qubits A are now entangled with qubits C , while qubits A are entangled with qubits B . The otherway to look at this is through the no-cloning theorem: there is no way for Bob to learn the unknown state of the system A B and transfer (swap) its partial state of A together with its entanglement with B using only LOCC, without priorentanglement shared with Charlie. b , b ), while Charlie does not. This isobviously unfair, with respect to Charlie. The situation is similar to the one presented in the contract signing problem [34]. The solution, similarto the one proposed for quantum contract signing [37], is to perform the unlocking operation on qu N its A and A (i.e., arrays of qubits A , . . . A ,n and A , . . . A ,n ) in series of steps, such that after eachstep, one pair of qubits are unlocked. In the course of the unlocking stage, the clients increase theirprobabilities to obtain the needed classical information (( b , b ) and ( c , c ), respectively), such that ateach step one client has slightly higher probability of successful recovery than the other. Therefore, theprotocol is probabilistic, and also fair in the sense that at each step, one client is only slightly privilegedover the other.The information can be transferred in two equivalent ways: either by sending quantum information(qubits) via a quantum channel, or by teleporting qubits’ quantum states using LOCC and shared en-tanglement. Without the loss of generality, we will assume that the clients are exchanging the actualqubits, rather than teleporting their states. The only difference between the two cases is that in thelatter case, the clients use the previously shared entanglement and exchange classical instead of quantuminformation.The main problem in this approach is that a client, say Charlie, cannot be sure if Bob sent him theright information or not. Therefore, we introduce additional 2 s “control qubits” that are used by theclients to check each other’s honesty during the unlocking stage: s control qubits would be joined with n “message qubits ” that carry the message ( b , b ), to form ( n + s ) qubits A , . . . A ,n + s , and given toBob; other s control qubits joined with n message qubits that carry ( c , c ), to form A , . . . A ,n + s andgiven to Charlie.The position Cpos ( j ) ∈ { , , . . . , n + s } of each control qubit j = 1 , , . . . , s within the ( n + s ) qubits A , . . . A ,n + s is chosen randomly by Alice and this information ( s integers Cpos ( j )) is given to Bob;analogously, random positions Cpos ( j ) of control qubits from A , . . . A ,n + s are given to Charlie.The control qubits are prepared by Alice in pure states and are uncorrelated from the message qubits.The state of each control qubit is randomly chosen by Alice from a publicly known set S of pure states. S isthe union of two mutually unbiased bases, computational Z basis {| i , | i} and rotated X basis {| + i , |−i} ,with |±i = √ ( | i ± | i ); therefore, S = {| i , | i , | + i , |−i} . The pure state of j -th control qubit in theposition Cpos ( j ) among qubits A , . . . A ,n + s is Cstate ( j ), with Cstate ( j ) ∈ S . Analogously, thestates of control qubits from A , . . . A ,n + s are encoded by Cstate ( j ) ∈ S . Alice gives the information { Cstate ( j ) | j = 1 , , . . . , s } about the states of control qubits from A , . . . A ,n + s to Bob, and theinformation { Cstate ( j ) | j = 1 , , . . . , s } about the states of control qubits from A , . . . A ,n + s to Charlie.Therefore, prior to Alice sending the message to clients (via sending the qubits A , . . . A ,n + s to Boband A , . . . A ,n + s to Charlie), Bob has, apart from qu N it B , the information { Cpos ( j ) | j = 1 , , . . . , s } of the positions and { Cstate ( j ) | j = 1 , , . . . , s } of the the states of the control qubits from A , . . . A ,n + s ,and analogously for Charlie.During the initialisation phase, Alice, Bob and Charlie share two pairs of entangled qu N its, denotedas | φ (00) i A B ⊗ | φ (00) i A C . (25)9lice and Bob also share classical information of the control qubits: { Cpos ( j ) | j = 1 , , . . . , s } and { Cstate ( j ) | j = 1 , , . . . , s } . Alice and Charlie also share classical information { Cpos ( j ) | j = 1 , , . . . , s } and { Cstate ( j ) | j = 1 , , . . . , s } .The protocol of simultaneous dense coding of classical messages ( b , b ) and ( c , c ) works as follows:(1) Encoding.
Alice performs unitary operators U ( b b ) on qu N it A and U ( c c ) on qu N it A toencode ( b , b ) and ( c , c ), respectively.(2) Locking.
Alice joins the s control qubits with n message qubits A , . . . A ,n , to form the ordered setof ( n + s ) qubits A , . . . A ,n + s . The j -th control qubit is prepared in Cstate ( j ) ∈ S and is in the position Cpos ( j ), while the relative positions of the n message qubits are the same as before. Analogously, sheforms the set A , . . . A ,n + s .For j = 1 to n + s , Alice applies the locking operator on A ,j A ,j .(3) Communication.
Alice sends ( n + s ) qubits A , . . . A ,n + s to Bob, and ( n + s ) qubits A , . . . A ,n + s to Charlie.(4) Unlocking.
For j = 1 to n + s , Bob sends qubit A ,j to Charlie, and then Charlie returns A ,j toBob after performing the unlocking operator on A ,j A ,j at his site.If ∃ k, Cpos ( k ) = j (i.e., if the j -th qubit given to Bob is a controlled one), Bob measures A ,j ineither X or Z basis, according to Cstate ( k ). If the measurement result does not match Cstate ( k ), heknows that Charlie did not return the real A ,j and stops the unlocking stage.Analogously, if ∃ k, Cpos ( k ) = j , Charlie measures A ,j in either X or Z basis, according to Cstate ( k ).If the measurement result does not match Cstate ( k ), he knows that Bob did not send the real A ,j andstops the unlocking stage.The remaining n qubits received at Bob’s site form the ordered set A , . . . A ,n , and the remaining n qubits received at Charlie’s site form the ordered set A , . . . A ,n .(5) Decoding.
Bob and Charlie measure qu N its A B and qu N its A C in the Bell basis respectivelyto achieve ( b , b ) and ( c , c ).The unlocking of qubits A , . . . A ,n + s and A , . . . A ,n + s is done in ( n + s ) steps, such that ineach step one pair of qubits is unlocked. The order of qubits must be maintained. Without the loss ofgenerality, we assume that the unlocking operation is done at Charlie’s site. We will assume that Bobis an honest client who sends qubits A , . . . A ,n + s to Charlie, as long as he is convinced that Charlie isreturning the exact resulting qubit after the local unlocking operation at Charlie’s site. The way to checkif Charlie is indeed doing so is the following: in each step Cpos ( j ) of the unlocking stage (i.e., when thequbit given by Alice to Bob is a controlled one), Bob measures the state of the qubit received back fromCharlie during that step in one of the two mutually unbiased bases – Z if Cstate ( j ) is in {| i , | i} , X otherwise. If the measurement result matches the classical information Cstate ( j ), i.e. if Bob’s outcomeis consistent with Charlie returning the control qubit in Cstate ( j ), Bob continues with the unlockingstage. Otherwise, it means that Charlie did not return the control qubit in Cstate ( j ) and Bob stopsthe unlocking stage. Since Charlie does not know the positions of control qubits from A , . . . A ,n + s ,he has to return all of the resulting qubits to Bob. Otherwise, he will inevitably return some qubits ascontrol ones in states different from those prepared by Alice, and Bob will, with high probability, be ableto detect it.Note that the whole analysis is done for the ideal case where no measurement errors or decoherenceeffects occur. The existence of measurement errors will set the threshold value η > Cstate ( j )), which will increase the number s of the control qubits. After receiving, in thecourse of exchange, k ≤ s controlled qubits, we require that not more than ηk wrong results are obtained.10he parameter η is determined by the experimental set-up, which sets the probability of obtaining thewrong result when the right qubit is sent.The protocol is optimistic [38]: if both clients are honest, if they execute the protocol by unlocking thequbits Alice gave them, upon finishing the unlocking stage both parties will have the whole informationsent by Alice.Unfortunately, if we insist on the perfect fidelity of data transmission, situations when one client (sayCharlie) knows that he obtained the whole information, while the other hasn’t, clearly puts Bob in adisadvantaged situation. For example, if the unlocking operation is done at Charlie’s site, Charlie candecide not to return the last resulting qubit to Bob, which would leave him without the whole state | φ ( b b ) i A B , and thus ( b , b ), in case Cpos ( s ) < n + s . The perfect fidelity was for the same reasonsrelaxed for quantum contract signing as well, by introducing the factor α < N of qubits sent to a client [37]. Therefore, we will also introducefactor α < α (2 n ) message bits sent to him by Alice.The above protocol is clearly probabilistic . At each step of the unlocking stage, Bob has a finiteprobability, which increases with the execution of the protocol, to obtain correct values of 2 αn bits of themessage ( b , b ) that Alice sent him, and analogously for Charlie.Due to its probabilistic nature, during the execution of the protocol one client is always privilegedover the other. By privileged, we mean that one client has higher probability of obtaining the requiredfraction α of the message Alice encoded for him, than the other. The difference between the clients’probabilities to obtain the information sent by Alice is due to the random distribution of control qubits.On the other side, since neither of the clients know the distribution of both sets of control qubits, eventhough one of them might be privileged over the other at a certain step of the unlocking stage, he wouldnot know that: the protocol is a priori symmetric with respect to the clients.Yet, the protocol is fair [39]: throughout the execution, one client is only slightly privileged over theother, the difference being smaller with the increase of s and could be made arbitrarily small for bigenough s . The argument here is exactly the same as the one presented for the fairness of the quantumcontract signing protocol [37].Namely, the role of the control qubits is to signal possible cheating of a client. By cheating, wemean not sending the qubits received by Alice. For example, if one of the clients, say Charlie, startssending qubits each randomly in one of four states {| i , | i , | + i , |−i} , he will send wrong message qubits A sent by Alice, but also wrong control qubits. Therefore, for each control qubit he will have a finiteprobability of 1 / p w to detect a wrong qubit (Charlie’s cheating) is approaching to one exponentiallyfast, p w = 1 − (1 / m , where m is a number of controlled qubits that are sent as random, it is not difficultto estimate the expected difference between Bob and Charlie, depending on the total number n of themessage qubits to be sent from one client to another and the number s of the controlled qubits given toeach client.One simply has to estimate the expected value for m , the expected number h m i of wrongly sentcontrol qubits after which Bob notices the cheating and stops communication. During that time, Bobreceived certain number w of random qubits as the message qubits, while Charlie was still receiving theproper ones. Therefore, he is in advantage by having about w/ / w isa simple function of m , w = w ( m ), and the dependence on m can be straightforwardly determined by n and s . For big enough n , w ( h m i ) << n and therefore Charlie’s advantage is negligible.Of course, Charlie can try to send qubits in some other states (completely random, etc.), but as11ong as he’s not sending the right qubits in the right states, there will be a finite probability p > n . Charlie can try to decrease the value of p , but can nevermake it zero. Otherwise, he would be able to perfectly distinguish between the non-orthogonal statesand this would violate the security of the BB84 cryptographic protocol [40], for example.In the case of quantum contract signing [37] the role of message and control qubits was given tothe same N qubits sent by a trusted party (in our case Alice) to clients (in our case Bob and Charlie),while in the case of simultaneous dense coding the two roles are given to separate sets of qubits. This willintroduce a slight change in the expressions for the probabilities involved in calculation, but this change isminor, conceptually straightforward to calculate and does not affect the main result of protocol’s fairness.Nevertheless, knowing the exact expressions for the probabilities in case of different cheating strategiesis of crucial importance, and may technically be quite non-trivial, which clearly presents interesting andchallenging topics for future research.The fairness condition can be even straightened, as was done in [37], by requiring the negligible probability to cheat : the probability that one client has 2 αn right bits, while the other does not. Thisquantity may be quite relevant in various possible scenarios, like in the case of signing contracts for buyingand selling the goods on the market (see [37]). While for a fixed value of α the probability to cheat maybe as high as 1 /
4, if it is unknown to the clients and chosen randomly by Alice from a certain interval I α ⊂ (1 / , n (see [37]).The locking and unlocking operators performed on two qu N its (i.e., two arrays of qubits) in thissection are actually products of two-qubit locking and unlocking operators. The N -dimensional DCNOToperator and the SWAP operator are of this kind. But the N -dimensional quantum Fourier transformcannot be done qubit(pair)-by-qubit(pair). Therefore, the quantum Fourier transform cannot be used toimplement the SDC protocol proposed in this section. We now consider the security of simultaneous dense coding. We assume that in the initialisation phase,the entangled pairs have been securely distributed among Alice, Bob and Charlie. Because only part ofthe entangled pairs travel through the quantum channel, an outsider knows nothing about the encodedinformation. If the two receivers are honest and follow the protocols exactly, they must collaborate toachieve their respective information. However, if one of the receivers, say Bob, is dishonest and has theability to intercept and resend the qubits going through the quantum channel between Alice and Charlie,he can obtain ( b , b ) without collaborating with Charlie by the following intercept-resend attack: (1)intercept qu N it A ; (2) perform the unlocking operation on qu N its A A ; (3) measure qu N its A B toobtain ( b , b ); (4) perform the locking operation on qu N its A A ; (5) send qu N it A back to Charlie.To detect such a cheating behaviour, we insert additional 2 r “ detect qubits ” into the array of 2 n message qubits during the communication phase: r detect qubits would be joined with n message qubitsthat carry the message ( b , b ), to form ( n + r ) qubits A , . . . A ,n + r , and given to Bob; other r detectqubits joined with n message qubits that carry ( c , c ), to form A , . . . A ,n + r and given to Charlie.The position Dpos ( j ) ∈ { , , . . . , n + r } of each detect qubit j = 1 , , . . . , r within the ( n + r ) qubits A , . . . A ,n + r is chosen randomly by Alice, and analogously for Dpos ( j ) of each detect qubit within A , . . . A ,n + r .The state of each detect qubit is randomly chosen by Alice from set S = Z ∪ X = {| i , | i , | + i , |−i} .12able 1: Comparison between different protocolsProtocol Properties Extra costprotocol in Sec. 2 and Ref. [33]protocol in Sec. 3 fair s control qubitsprotocol in Sec. 4 secure r detect qubitsprotocol in Appendix fair, secure s control qubits + r detect qubitsThe pure state of j -th detect qubit in the position Dpos ( j ) among qubits A , . . . A ,n + r is Dstate ( j ),with Dstate ( j ) ∈ S . Analogously, the states of detect qubits from A , . . . A ,n + r are encoded by Dstate ( j ) ∈ S .Only after the transmission of all the message qubits and detect qubits, Alice tells Bob and Charlie thepositions and the bases of the detect qubits and requires them to return the results of the measurementsperformed on the detect qubits. Therefore Alice can check if after the transmission the states of thedetect qubits have been altered by a dishonest client.Because the position of the detect qubits in the array are chosen randomly by Alice, curious Bob doesnot know which qubits are the message qubits. If his intercept-resend attack involves a detect qubit, thestate of the detect qubit may probably be changed, the probability of being detected grows exponentiallywith the increase of r and could be made arbitrarily large for big enough r .During the initialisation phase, Alice, Bob and Charlie share two pairs of entangled qu N its, denotedas | φ (00) i A B ⊗ | φ (00) i A C . (26)The protocol of simultaneous dense coding of classical messages ( b , b ) and ( c , c ) works similarlyas in the previous case. For completeness, in A we present a detailed description of the combination ofthe two strategies that assure fair and secure simultaneous dense coding protocol.We summarise the above protocols in Table 1 in order to demonstrate their qualitative and quantitativedifferences. The original SDC protocol in [33] and the N -dimensional SDC protocol in Sec. 2 arevulnerable to intercept-resend attacks and require the receivers to perform the unlocking operation atthe same site, otherwise the fairness problem arises. The improved SDC protocol in Sec. 3 can guaranteefairness in the unlocking phase even if the receivers are separated spatially, by implementing the unlockingoperation in series of steps of communication and introducing additional control qubits for cheat detection.On the other hand, the improved SDC protocol in Sec. 4 can guarantee security against the intercept-resend attack in the communication phase, by introducing additional detect qubits in the communicationphase. The protocol in Appendix incorporates both fairness and security properties. We can also seefrom the table that the cost of the protocol increase with these improvements. Contract signing [34] is a security task involving two parties, Charlie and Bob, that do not trust eachother and want to exchange a common contract signed with each other’s signature. At the end of theprotocol Charlie should have the contract signed by Bob and vice-versa. The purpose of the signedcontract is to bind the parties to the terms of the contract, which can be enforced by a judge (Alice). Thereal challenge to this problem is when both Charlie and Bob are physically apart and want to remotely13ign the contract. This situation is becoming more and more common due to e-business, and may leadto fraud. For instance, if Bob gets the contract signed by Charlie without committing himself, Charlieand Bob are in an unfair situation. By having Charlie’s commitment, Bob is able to appeal to Alice toenforce the contract, while Charlie has no means to do the same, since he does not possess the contractsigned by Bob. Note that even if Bob did not commit, but having Charlie’s commitment, puts him in aposition to later in time choose whether to bind the contract or not, while Charlie has no power to doeither of the two.A simple solution to this unfair situation is to have a trusted third party (again Alice) mediatingthe transaction – Bob sends to Alice the contract signed by him and Charlie does the same; then Aliceexchanges the contracts only after she has received both of the commitments. Note that this procedureincreases significantly the cost of remote contract signing, as Alice’s time and resources are expensive.What is particularly costly is Alice being constantly online and alert waiting for the clients to contact her.Also, avoiding the communication with the trusted party at the very moment of determining a contractand committing to it removes the danger of overloading Alice and creating a bottleneck.Unfortunately, it has been shown that the attendance of Alice is mandatory [34, 36], if the protocolis to fulfil the following two important properties: • fairness : either both parties get each other’ commitment or none gets; • viability : if both parties behave honestly, they will both get each other’s commitments.One way to overcome this difficulty is to consider optimistic protocols that do not require communi-cation with Alice unless something wrong comes up [38]. Another workaround is to relax the fairnesscondition, allowing one agent to have ǫ more probability of binding the contract than the other agent( probabilistic fairness ). In this case, for an arbitrary small ǫ solutions have been found where the numberof exchanged messages between the agents is minimised [39].In this section we present a probabilistically fair quantum protocol based on a secure SDC for remoteagents, such as the one described in A (a combination of protocols presented in Section 3.2 and Section 4).In such protocol, Alice, the trusted party, does not interact with the signing parties while they (Bob andCharlie) are determining the contract and then committing to it (the Exchange Phase). Note that inthe below construction of a contract signing scheme, a SDC protocol is used iteratively many times as a black box . Thus, any protocol that achieves simultaneous transmission of (densly) coded information thatsatisfies the fairness and the security conditions, as presented in Section 3 and Section 4, respectively,allows for constructing probabilistically fair contract signing scheme.In order to lower the use of resources, it is possible to map long contracts into messages of a smallfixed size, say of k bits. Such short messages (digests) are obtained by so called hash functions (such asSHA1) and are well established in the field of cryptography [41]. Hash functions are not injective, that is,there exist pairs of different messages x, x ′ with the same digest d . Nevertheless, given a message x andits digest d , it is computationally hard to find a different message x ′ = x with the same digest d . For thisreason, digests can be used to identify a message. From this point on, instead of contracts themselves weconsider their digests, obtained by some hash function, with k bits, say ( b . . . b k ), where b i ∈ { , } .We also assume that Alice can sign messages using some public key signing scheme (such as DSS, formore detail see [41]). In short, a public key signature scheme for Alice is a pair of functions ( sig, ver )together with a pair of keys ( A, ˆ A ) where A is the private key of Alice (known only by Alice) and ˆ A isthe corresponding public key (known by Alice, Bob and Charlie). For Alice to sign a message m , she usesher private key A and obtains the signature sig A ( m ). Bob (or Charlie) verifies if sig A ( m ) is the message m signed by Alice by checking whether ver ˆ A ( m, sig A ( m )) = 1. If ver ˆ A ( m, sig A ( m )) = 1 then sig A ( m )14oes not correspond to the signature of Alice over m . Signing can be seen as an encryption, unique toAlice: only she can do it using her private key A . But Bob and Charlie can, given the message m and asignature s , by using Alice’s public key ˆ A verify whether s is indeed the signature of m by Alice or not.In our contract signing protocol, Alice does not know a priori to which particular contract/digest( b . . . b k ) Bob and Charlie are going to agree upon. However, at the end of the protocol Alice (and alsoBob and Charlie) needs some irrefutable proof of the particular contract that was agreed upon. Moreover,we do not want Alice to be contacted during the exchange phase. A solution for this problem is for Aliceto produce 4 k triples { ( b, i, Bob) , ( b, i, Charlie) : b ∈ { , } , i = 1 . . . k } that can be used to represent anyparticular contract ( b . . . b k ) that Bob and Charlie will agree upon latter. Next, Alice signs those 4 k triples and prepares 2 k SDC protocols for Bob and Charlie, where in each of these SDC protocols themessages to be simultaneously received are sig A ( b, i, Charlie) by Bob and sig A ( b, i, Bob) by Charlie, with b ∈ { , } and i ∈ { . . . k } .Thus, Bob can enforce the contract ( b . . . b k ) against Charlie (and no other person) if he shows toAlice the signatures sig A ( b , , Charlie) . . . sig A ( b k , k, Charlie). By using SDC, it is possible to force Bobto obtain this information (and no other) only with the collaboration of Charlie, and vice-versa. In detailthe contract signing protocol based on SDC works as follows:
Initialization Phase:
1. Alice signs the following 4 k messages: (0 , i, Bob), (1 , i,
Bob), (0 , i,
Charlie), (1 , i,
Charlie) with i =1 , , . . . , k .2. Alice arranges for 2 k different SDC’s for the case of distant parties such that the message to be sentto Bob in one of such SDC’s is sig A ( b, i, Charlie) and to Charlie is sig A ( b, i, Bob) for i = 1 , , . . . , k and b = 0 , Exchange Phase:
1. Bob and Charlie agree on contract ( b . . . b k ) ∈ { , } k .2. For i = 1 to k , Bob and Charlie collaborate to obtain from the entangled quNits of the 2 k SDC’s themessages sig A ( b i , i, Charlie) and sig A ( b i , i, Bob), respectively, and ignore the remaining quantum datasent by Alice. Thus, at the end of the SDC’s Bob has sig A ( b i , i, Charlie), for i = 1 . . . k , and mutatismutandis for Charlie. Binding Phase:
1. Alice enforces contract ( b . . . b k ) when either Bob presents sig A ( b , , Charlie) . . . sig A ( b k , k, Charlie)or Charlie presents sig A ( b , , Bob) . . . sig A ( b k , k, Bob).The size of each signature, say sig A ( b i , i, Charlie), is given by the length of a message a client receivesin each SDC, which is 2 n bits (the factor 2 comes from the fact that the coding is dense). Since eachSDC is probabilistic, a client only needs to present to Alice α i (2 n ) bits, with < α i <
1, of the signature sig A ( b i , i, Charlie) for each i = 1 . . . k . Moreover, if each α i is random we achieve even stronger fairnesscondition, namely the expected probability to cheat on each SDC can be made arbitrarily small (theprobability to cheat is the probability that an agent obtains at least α i (2 n ) bits of a signature and theother does not [37]).The contract signing protocol described above, unlike the one presented in [37], allows for Bob andCharlie to determine the contract after the Initialisation Phase. This is due to the fact that public key15ignatures were introduced. However, this introduction leads to a poorer security assumption, as publickey signatures are only computationally secure (as well as hash functions).We can improve the security of the above protocol by removing both hash functions and public keysignatures. Removing hash function accounts to consider a large enough k such that all potential contractsby Bob and Charlie would fit in k bits. To remove public key signatures, which are not perfectly secure,Alice can, during the initialisation phase, share a symmetric key k AB with Bob and another, k AC , withCharlie. These symmetric keys might be made perfectly secure by using one-time pad cryptosystems (see,for example [41]). Then, in each SDC the message that Bob receives is k AB ( b i , i, r i ( b i )) and the messagethat Charlie receives is k AC ( b i , i, r i ( b i )). Here, k AB ( m ) is the encryption of m with the symmetric key k AB and r i ( b i ) is a random string for each i and b i , sampled and known only by Alice, that is associatedto a contract between Bob and Charlie. So, for Bob to enforce contract ( b . . . b k ) against Charlie, he hasto present to Alice the random numbers r ( b ) . . . r k ( b k ). Note that in this case Alice has to store all theserandom numbers r i ( b i ) in her private memory keeping in mind to whom they are associated. In this waythe protocol’s perfect security is obtained by the laws of physics, which is stronger than computationalsecurity used in classical protocols. N -dimensional simultaneous teleportation Dense coding and quantum teleportation are dual protocols intimately linked to each other, both intheir purpose as well as in the construction. The former is used to transmit (densely coded) classicalinformation, while the latter transfers quantum states (i.e., quantum information). In Introduction, as amotivation for SDC the following situation was described: an agent, say a boss of a company, needs for twoemployees to simultaneously carry out two different confidential tasks, such that each employee is unawareof the other’s activity. SDC allows that the two tasks, encoded by classical information, are confidentiallycommunicated to the employees. Similarly, one could imagine a situation in which the employees arerequested to each execute a predetermined quantum protocol (say, a quantum computation algorithm)for a given confidential initial state. The solution for such situation is achieved by a simultaneousteleportation protocol.Simultaneous teleportation was proposed by Wang et al [32], in which all the receivers simultaneouslyobtain their respective quantum states from the sender. In their scheme, the sender first performs alocking operation to entangle the particles from two independent quantum entanglement channels, andtherefore the receivers cannot restore their quantum states separately before performing the unlockingoperation together. The locking operator is composed of the Hadamard and the CNOT operators.Ref. [33] showed that the quantum Fourier transform can alternatively be used as the locking operatorin simultaneous teleportation. In this section, we further investigate simultaneous teleportation of qu N itsusing the N -dimensional quantum Fourier transform.In the task of N -dimensional simultaneous teleportation, Alice intends to teleport the unknown qu N its | ϕ t i T t = P N − s =0 α t,s | s i T t to Bob t (1 ≤ t ≤ M ) under the condition that all the receivers must collaborateto simultaneously obtain | ϕ t i T t .In the initialisation phase, Alice shares with each Bob t a pair of entangled qu N its | φ (00) i A t B t , wheresubscript A t denotes Alice’s qu N it, and subscript B t denotes Bob t ’s qu N it. The initial quantum state16f the composite system is | χ (0) i = M O t =1 | φ (00) i A t B t M O t =1 | ϕ t i T t = 1 √ N M N M − X j =0 | j i A ...A M | j i B ...B M M O t =1 | ϕ t i T t , (27)where j is a base- N -number which can be written as j j . . . j M , j t ∈ { , , . . . , N − } . The protocol for simultaneous teleportation of qu N its consists of five steps:(1) Locking.
Alice performs the N -dimensional quantum Fourier transform | j i A ...A M −→ √ N M N M − X k =0 e πiNM jk | k i A ...A M (28)on qu N its A . . . A M to lock the entanglement channels. After that, the state of the composite systembecomes | χ (1) i = 1 √ N M N M − X j =0 QF T A ...A M | j i A ...A M | j i B ...B M M O t =1 | ϕ t i T t = 1 √ N M N M − X j =0 √ N M N M − X k =0 e πiNM jk | k i A ...A M | j i B ...B M M O t =1 | ϕ t i T t . (29)(2) Measuring.
Alice measures each pair of qu N its A t T t in the N -dimensional Bell basis. M O t =1 A t T t h φ ( x t y t ) | χ (1) i = 1 N M M O t =1 N − X j =0 e − πiN jx t A t h j + y t | T t h j | !" N M − X k =0 (cid:16) M O t =1 | k t i A t | ϕ t i T t (cid:17) √ N M N M − X j =0 e πiNM jk | j i B ...B M = 1 N M N M − X k =0 M Y t =1 N − X j =0 e − πiN jx t h j + y t | k t ih j | N − X s =0 α t,s | s i ! QF T B ...B M | k i B ...B M = 1 N M QF T B ...B M N M − X k =0 M O t =1 e − πiN x t ( k t − y t ) α t,k t − y t | k t i B t = 1 N M QF T B ...B M N M − X k =0 M O t =1 e − πiN x t k t α t,k t | k t + y t i B t = 1 N M QF T B ...B M N M − X k =0 M O t =1 α t,k t X y t ( Z † ) x t | k t i B t = 1 N M QF T B ...B M M O t =1 X y t ( Z † ) x t N − X s =0 α t,s | s i B t , (30)17here X : | j i −→ | j + 1 i is the shift operator, Z : | j i −→ e πiN j | j i is the rotation operator.If the measurement result of qu N its A t T t is | φ ( x t y t ) i , the state of qu N its B . . . B M collapses into | χ (2) i = QF T B ...B M M O t =1 X y t ( Z † ) x t | ϕ t i B t . (31)(3) Communication.
Alice sends the measurement result ( x t , y t ) to each Bob t .(4) Unlocking.
All the receivers collaborate to perform the inverse quantum Fourier transform onqu N its B . . . B M , and the state of qu N its B . . . B M becomes | χ (3) i = QF T † B ...B M | χ (2) i = M O t =1 X y t ( Z † ) x t | ϕ t i B t . (32)(5) Recovering.
Each Bob t performs Z x t ( X † ) y t on qu N it B t to obtain | ϕ t i . Dense coding [2] and teleportation [35] are important quantum communication tasks. Simultaneousdense coding [33] and simultaneous teleportation [32], which guarantee that the receivers simultaneouslyachieve their respective information from one sender, may be relevant and useful for improvement ofsome models or tasks of quantum communication. In this paper, we have given a number of new resultson simultaneous dense coding and teleportation. More specifically, we have given three protocols forsimultaneous dense coding utilising different N -dimensional quantum states (i.e., Bell state, W state,and GHZ state). Besides the quantum Fourier transform, we have introduced two new locking operators(i.e. the double controlled-NOT operator and the SWAP operator) for simultaneous dense coding. Thenwe have analysed the fairness and the security of the simultaneous dense coding protocol and proposed aprotocol which guarantees both the fairness and the security, thus allowing for mutually distant receiversto execute the protocol. We have shown that any fair simultaneous dense coding scheme that is secureagainst intercept-resend attack can be used to implement a fair contract signing protocol. In addition,we have shown that the N -dimensional quantum Fourier transform can act as the locking operator insimultaneous teleportation of qu N its. Acknowledgments
The authors are grateful to the anonymous referee for invaluable comments and suggestions that helpus improve the quality of the paper. This work is supported in part by the National Natural Sci-ence Foundation (Nos. 61272058, 61572532, 61502179), the Natural Science Foundation of GuangdongProvince of China (No. 10251027501000004, 2014A030310265), the Research Foundation for the Doc-toral Program of Higher School of Ministry of Education of China (No. 20100171110042), FCT projectUID/EEA/50008/2013 and IT initiatives PQDR (Probabilistic, Quantum and Differential Reasoning)and CaPri (Capacity and Privacy with Quantum Continuous Variables).
A Combination of the two strategies
In this appendix, we combine in one protocol the two strategies described in the above two sections:(i) if Bob and Charlie have the ability to intercept and resend the qubits going through the quantum18hannel, Alice can detect such behaviour and interrupt the protocol; (ii) if Bob and Charlie are spatiallyseparated, they can fairly decode their respective messages simultaneously through communication.In the initialisation phase, Alice, Bob and Charlie share two pair of entangled qu N its, denoted as | φ (00) i A B ⊗ | φ (00) i A C . (33)Alice and Bob also share classical information of the control qubits: { Cpos ( j ) | j = 1 , , . . . , s } and { Cstate ( j ) | j = 1 , , . . . , s } . Alice and Charlie also share classical information { Cpos ( j ) | j = 1 , , . . . , s } and { Cstae ( j ) | j = 1 , , . . . , s } .The protocol of simultaneous dense coding of classical messages ( b , b ) and ( c , c ) works as follows:(1) Encoding.
Alice performs unitary operators U ( b b ) on qu N it A and U ( c c ) on qu N it A toencode ( b , b ) and ( c , c ), respectively.(2) Locking.
Alice joins the s control qubits with n message qubits A , . . . A ,n , to form the ordered setof ( n + s ) qubits A , . . . A ,n + s . The j -th control qubit is prepared in Cstate ( j ) ∈ S and is in the position Cpos ( j ), while the relative positions of the n message qubits are the same as before. Analogously, sheforms the set A , . . . A ,n + s .For j = 1 to n + s , Alice applies the locking operator on qubits A ,j A ,j .(3) Communication.
Alice joins the r detect qubits with ( n + s ) message and control qubits A , . . .A ,n + s , to form the ordered set of ( n + s + r ) qubits A , . . . A ,n + s + r . The j -th detect qubit is preparedin Dstate ( j ) ∈ S and is in the position Dpos ( j ), while the relative positions of the remaining ( n + s )qubits are the same as before. Analogously, she forms the set A , . . . A ,n + s + r .Alice sends ( n + s + r ) qubits A , . . . A ,n + s + r to Bob, and ( n + s + r ) qubits A , . . . A ,n + s + r toCharlie.Alice waits for Bob and Charlie’s acknowledgements of receiving all the 2( n + s + r ) qubits. After theyhave sent their acknowledgements through unjammable classical communication channel, Alice sends { Dpos ( j ) | j = 1 , , . . . , r } and the bases of { Dstate ( j ) | j = 1 , , . . . , r } to Bob. Analogously, Alicesends { Dpos ( j ) | j = 1 , , . . . , r } and the bases of { Dstate ( j ) | j = 1 , , . . . , r } to Charlie.For each j = Dpos ( k ), Bob measures qubit A ,j in either X or Z basis, according to Dstate ( k ),and returns the measurement result to Alice. If the measurement result is not equal to Dstate ( k ), Aliceannounces that a cheating behaviour has been detected and stops the protocol.Analogously, for each j = Dpos ( k ), Charlie measures qubit A ,j in either X or Z basis, accordingto Dstate ( k ), and returns the measurement result to Alice. If the measurement result is not equal to Dstate ( k ), Alice announces that a cheating behaviour has been detected and stops the protocol.Now the remaining ( n + s ) received qubits at Bob’s site form the ordered set A , . . . A ,n + s , and theremaining ( n + s ) received qubits at Charlie’s site form the ordered set A , . . . A ,n + s .(4) Unlocking.
For j = 1 to n + s , Bob sends qubit A ,j to Charlie, and then Charlie returns A ,j toBob after performing the unlocking operator on qubits A ,j A ,j at his site.If ∃ k, Cpos ( k ) = j , Bob measures qubit A ,j in either X or Z basis, according to Cstate ( k ). If themeasurement result does not match Cstate ( k ), he knows that Charlie did not return the real A ,j andstops the unlocking stage.Analogously, if ∃ k, Cpos ( k ) = j , Charlie measures qubit A ,j in either X or Z basis, according to Cstate ( k ). If the measurement result does not match Cstate ( k ), he knows that Bob did not send thereal A ,j and stops the unlocking stage.Now the remaining n received qubits at Bob’s site form the ordered set A , . . . A ,n , and the remaining n received qubits at Charlie’s site form the ordered set A , . . . A ,n .195) Decoding.
Bob and Charlie measure qu N its A B and qu N its A C in the Bell basis respectivelyto achieve ( b , b ) and ( c , c ). References [1] A. Holevo. Bounds for the quantity of information transmitted by a quantum communication channel.
Problems of Information Transmission , 9(3):177–183, 1973.[2] C. H. Bennett and S. J. Wiesner. Communication via one- and two-particle operators on Einstein-Podolsky-Rosen states.
Physical Review Letters , 69:2881–2884, Nov 1992.[3] R. Horodecki, P. Horodecki, M. Horodecki, and K. Horodecki. Quantum entanglement.
Reviews ofModern Physics , 81:865–942, Jun 2009.[4] X. S. Liu, G. L. Long, D. M. Tong, and Feng Li. General scheme for superdense coding betweenmultiparties.
Physical Review A , 65:022304, Jan 2002.[5] A. Grudka and A. W´ojcik. Symmetric scheme for superdense coding between multiparties.
PhysicalReview A , 66:014301, Jul 2002.[6] Q.-B. Fan and S. Zhang. Probabilistic dense coding using a non-symmetric multipartite quantumchannel.
Physics Letters A , 348(3–6):160 – 165, 2006.[7] A. Barenco and A. K. Ekert. Dense coding based on quantum entanglement.
Journal of ModernOptics , 42(6):1253–1259, 1995.[8] P. Hausladen, R. Jozsa, B. Schumacher, M. Westmoreland, and W. K. Wootters. Classical informa-tion capacity of a quantum channel.
Physical Review A , 54:1869–1876, Sep 1996.[9] M. Ziman and V. Buˇzek. Equally distant, partially entangled alphabet states for quantum channels.
Physical Review A , 62:052301, Oct 2000.[10] J.-C. Hao, C.-F. Li, and G.-C. Guo. Probabilistic dense coding and teleportation.
Physics LettersA , 278(3):113 – 117, 2000.[11] G. Bowen. Classical information capacity of superdense coding.
Physical Review A , 63:022302, Jan2001.[12] A. K. Pati, P. Parashar, and P. Agrawal. Probabilistic superdense coding.
Physical Review A ,72:012329, Jul 2005.[13] S. Mozes, J. Oppenheim, and B. Reznik. Deterministic dense coding with partially entangled states.
Physical Review A , 71:012311, Jan 2005.[14] S. Wu, S. M. Cohen, Y. Sun, and R. B. Griffiths. Deterministic and unambiguous dense coding.
Physical Review A , 73:042311, Apr 2006.[15] P. S. Bourdon, E. Gerjuoy, J. P. McDonald, and H. T. Williams. Deterministic dense coding andentanglement entropy.
Physical Review A , 77:022305, Feb 2008.[16] M. R. Beran and S. M. Cohen. Phase boundaries in deterministic dense coding.
Physical Review A ,79:032307, Mar 2009. 2017] E. Gerjuoy, H. T. Williams, and P. S. Bourdon. Augmented message-matrix approach to deterministicdense-coding theory.
Physical Review A , 79:042315, Apr 2009.[18] C.-Y. Huang, I-C. Yu, F.-L. Lin, and L.-Y. Hsu. Deterministic dense coding and faithful teleportationwith multipartite graph states.
Physical Review A , 79:052306, May 2009.[19] H. Situ. Dense coding process with imperfect encoding operations.
International Journal of Theo-retical Physics , 52(10):3779–3789, 2013.[20] S. Bose, V. Vedral, and P. L. Knight. Multiparticle generalization of entanglement swapping.
PhysicalReview A , 57:822–829, Feb 1998.[21] H.-J. Lee, D. Ahn, and S. W. Hwang. Dense coding in entangled states.
Physical Review A , 66:024304,Aug 2002.[22] Y. Yeo and W. K. Chua. Teleportation and dense coding with genuine multipartite entanglement.
Physical Review Letters , 96:060502, Feb 2006.[23] D. Bruß, M. Lewenstein, A. Sen(De), U. Sen, G.M. D’Ariano, and C. Macchiavello. Dense codingwith multipartite quantum states.
International Journal of Quantum Information , 04(03):415–428,2006.[24] P. Agrawal and A. Pati. Perfect teleportation and superdense coding with w states. Physical ReviewA , 74:062320, Dec 2006.[25] X.-W. Wang, Y.-G. Shan, L.-X. Xia, and M.-W. Lu. Dense coding and teleportation with one-dimensional cluster states.
Physics Letters A , 364(1):7 – 11, 2007.[26] L. Li and D. Qiu. The states of w-class as shared resources for perfect teleportation and superdensecoding.
Journal of Physics A: Mathematical and Theoretical , 40(35):10871, 2007.[27] S. Muralidharan and P. K. Panigrahi. Perfect teleportation, quantum-state sharing, and superdensecoding through a genuinely entangled five-qubit state.
Physical Review A , 77:032321, Mar 2008.[28] J.-C. Hao, C.-F. Li, and G.-C. Guo. Controlled dense coding using the greenberger-horne-zeilingerstate.
Physical Review A , 63:054301, Apr 2001.[29] C.L. Luo and X.F. Ouyang. Controlled dense coding via generalized measurement.
InternationalJournal of Quantum Information , 07(01):365–372, 2009.[30] G.Q. Huang and C.L. Luo. Controlled dense coding with extended ghz state.
International Journalof Quantum Information , 07(06):1241–1248, 2009.[31] H. Situ. Controlled simultaneous teleportation and dense coding.
International Journal of TheoreticalPhysics , 53(3):1003–1009, 2014.[32] M.Y. Wang, F.L. Yan, T. Gao, and Y.C. Li. Simultaneous quantum state teleportation via thelocked entanglement channel.
International Journal of Quantum Information , 06(01):201–207, 2008.[33] H. Situ and D. Qiu. Simultaneous dense coding.
Journal of Physics A: Mathematical and Theoretical ,43(5):055301, 2010. 2134] S. Even and Y. Yacobi. Relations among public key signature systems. Technical report, Technicon,1980.[35] C. H. Bennett, G. Brassard, C. Cr´epeau, R. Jozsa, A. Peres, and W. K. Wootters. Teleporting anunknown quantum state via dual classical and einstein-podolsky-rosen channels.
Physical ReviewLetters , 70:1895–1899, Mar 1993.[36] M. J. Fischer, N. A. Lynch, and M. S. Paterson. Impossibility of distributed consensus with onefaulty process.
J. ACM , 32(2):374–382, April 1985.[37] N. Paunkovi´c, J. Bouda, and P. Mateus. Fair and optimistic quantum contract signing.
PhysicalReview A , 84:062331, Dec 2011.[38] N. Asokan, M. Schunter, and M. Waidner. Optimistic protocols for fair exchange. In
Proceedingsof the 4th ACM Conference on Computer and Communications Security , CCS ’97, pages 7–17, NewYork, NY, USA, 1997. ACM.[39] M. Ben-Or, O. Goldreich, S. Micali, and R. L. Rivest. A fair protocol for signing contracts (extendedabstract). In Wilfried Brauer, editor,
ICALP , volume 194 of
Lecture Notes in Computer Science ,pages 43–52. Springer, 1985.[40] C. Bennett and G. Brassard. Quantum cryptography: Public key distribution and coin tossing. In
Proceedings of the IEEE International Conference on Computers, Systems and Signal Processing ,pages 175–179, New York, 1984. IEEE Press.[41] A. J. Menezes, S. A. Vanstone, and P. C. V. Oorschot.