††thanks: These authors contributed equally to this work††thanks: These
authors contributed equally to this work††thanks: These authors contributed
equally to this work††thanks: These authors contributed equally to this work

# Experimental quantum secret sharing based on phase encoding of coherent
states

Ao Shen  National Laboratory of Solid State Microstructures and School of
Physics, Collaborative Innovation Center of Advanced Microstructures, Nanjing
University, Nanjing 210093, China  Xiao-Yu Cao  National Laboratory of Solid
State Microstructures and School of Physics, Collaborative Innovation Center
of Advanced Microstructures, Nanjing University, Nanjing 210093, China  Yang
Wang  National Laboratory of Solid State Microstructures and School of
Physics, Collaborative Innovation Center of Advanced Microstructures, Nanjing
University, Nanjing 210093, China  Henan Key Laboratory of Quantum Information
and Cryptography, SSF IEU, Zhengzhou, China  Yao Fu  Beijing National
Laboratory for Condensed Matter Physics and Institute of Physics, Chinese
Academy of Sciences, Beijing 100190, China  Jie Gu  National Laboratory of
Solid State Microstructures and School of Physics, Collaborative Innovation
Center of Advanced Microstructures, Nanjing University, Nanjing 210093, China
Wen-Bo Liu  National Laboratory of Solid State Microstructures and School of
Physics, Collaborative Innovation Center of Advanced Microstructures, Nanjing
University, Nanjing 210093, China  Chen-Xun Weng  National Laboratory of Solid
State Microstructures and School of Physics, Collaborative Innovation Center
of Advanced Microstructures, Nanjing University, Nanjing 210093, China  Hua-
Lei Yin<EMAIL_ADDRESS>National Laboratory of Solid State Microstructures
and School of Physics, Collaborative Innovation Center of Advanced
Microstructures, Nanjing University, Nanjing 210093, China  Zeng-Bing Chen
<EMAIL_ADDRESS>National Laboratory of Solid State Microstructures and
School of Physics, Collaborative Innovation Center of Advanced
Microstructures, Nanjing University, Nanjing 210093, China

###### Abstract

Quantum secret sharing (QSS) is one of the basic communication primitives in
future quantum networks which addresses part of the basic cryptographic tasks
of multiparty communication and computation. Nevertheless, it is a challenge
to provide a practical QSS protocol with security against general attacks. A
QSS protocol that balances security and practicality is still lacking. Here,
we propose a QSS protocol with simple phase encoding of coherent states among
three parties. Removing the requirement of impractical entangled resources and
the need for phase randomization, our protocol can be implemented with
accessible technology. We provide the finite-key analysis against coherent
attacks and implement a proof-of-principle experiment to demonstrate our
scheme’s feasibility. Our scheme achieves a key rate of 85.3 bps under a 35 dB
channel loss. Combined with security against general attacks and accessible
technology, our protocol is a promising candidate for practical multiparty
quantum communication networks.

Keywords: quantum secret sharing, coherent state, phase encoding, coherent
attack, finite-size

##  I INTRODUCTION

Quantum communication has attracted much attention [1, 2, 3, 4, 5, 6, 7, 8, 9]
due to its unconditional security during the communication process. Quantum
communication has many branches, such as quantum key distribution [10, 11, 12,
13, 14, 15, 16, 17, 18, 19, 20, 21], digital signatures [22, 23, 24], quantum
secret sharing (QSS) [25, 26] and so on. As an important branch of quantum
communication, QSS is the quantum generalization of secret sharing. Secret
sharing is an important primitive in quantum classical cryptography and was
independently introduced by Shamir [27] and Blakley [28]. In a secret sharing
scheme, a dealer splits a message into several parts and distributes each part
to the corresponding player. In secret sharing, any unauthorized subset of
players cannot reconstruct the message and the message can be reconstructed
only when the authorized players cooperate. Since the security of classical
secret sharing depends heavily on computational complexity, which has been
proven vulnerable to future quantum computers, QSS is proposed to provide
unconditional security based on the laws of quantum mechanics. The first QSS
protocol was proposed by Hillery [25] in 1999 by using the Greenberger-Horne-
Zeilinger (GHZ) states. Since then, many QSS protocols have been proposed
theoretically [29, 30, 31, 32, 33, 34, 35, 36, 37, 38, 39, 40] and
demonstrated experimentally [41, 42, 43, 44, 45, 46, 47]. Although QSS has
been studied extensively, it is still a challenge to provide a practical QSS
protocol with security against general attacks. The first QSS protocol using
GHZ states is not secure with a malicious player [36]. In addition, due to its
insufficient transmission distance and a lack of efficient multiphoton
sources, this QSS is highly impractical. To remove the requirement of the GHZ
states, several single-qubit QSS schemes have been proposed [48, 42, 49].
However, single-qubit schemes have drawbacks in their security [50, 51] and
are vulnerable to Trojan horse attacks [52]. In recent years, differential
phase shift (DPS) QSS schemes [53, 54, 55] and round-robin (RR) QSS [56, 57]
have been proposed. Using weak coherent states, DPS QSS schemes further
simplify the experimental setup. Nevertheless, DPS QSS schemes [53, 54, 55]
can defend against only individual attacks, such as photon number splitting
and beam splitting attacks. RR QSS [56, 57] provides unconditional security
against coherent attacks and removes the monitoring signal disturbance.
However, implementation of the RR QSS lies in the realization of a variable-
delay Mach-Zehnder interferometer, which improves the complexity of the
experimental setup and constrains the practical application of this scheme. To
date, a QSS protocol that balances security and practicality is still lacking.

Here, we present a QSS protocol that is secure against coherent attacks. By
encoding logic bits with phase modulation on coherent states, our protocol
removes the requirements for intensity modulation and phase randomization,
which simplifies the experimental setup. Our protocol adopts the same remote
single-photon interference method as twin-field quantum key distribution to
resist the Trojan horse attack in single-qubit QSS. Using the concentration
inequality [58, 59] to consider statistical fluctuations, we provide the
finite-key analysis against coherent attacks. In addition, we implement a
proof-of-principle experiment of our protocol to demonstrate its feasibility
in a plug-and-play system. We successfully generate secure key over various
channel losses, up to 35 dB, under which a key rate of 85.3 bps can be
obtained. Our protocol can be implemented by existing devices [60, 61, 62, 63,
64, 65, 66] while achieving security against coherent attacks, which provides
a possible solution for the application of QSS. Furthermore, as dishonest
participants are allowed in QSS schemes, our protocol can be directly used for
efficient quantum digital signatures [24]. Addressing the bottleneck problems
of QSS in both security and practicality, our QSS protocol paves the way to
practical QSS networks.

##  II Protocol description

The schematic diagram of our protocol is shown in Fig. 1. In our protocol, two
symmetric distant players Alice and Bob send two weak coherent pulses, which
are phase-encoded with logic bits and selected bases, to central dealer
Charlie. After adding phase modulation to the optical pulse sent by Bob,
Charlie performs an interference measurement on the two optical pulses sent by
Alice and Bob and obtains the phase difference of the two pulses according to
the clicking information of his detectors. Based on the measurement results
and the basis choices of Alice, Bob and Charlie, each of the three parties in
our protocol generates their own raw keys. Employing the same setup as the
twin-field quantum key distribution, the key rate of our protocol scales with
the square root of the total channel transmittance (between Alice and Bob)
with single-photon interference. The detailed process of this QSS is as
follows.

1\. Preparation. In each turn, Alice (Bob) prepares a weak coherent pulse with
intensity $\mu$ and selects $X$ and $Y$ bases with probabilities $p_{x}$ and
$p_{y}=1-p_{x}$, respectively. In the $X$ basis, Alice (Bob) randomly
modulates the phase of the pulse by $\\{0,\pi\\}$ and records her (his) logic
bit as 0 (1) when the modulated phase is $0~{}(\pi)$. In the Y basis, Alice
(Bob) randomly modulates the phase of the pulse by $\\{\pi/2,3\pi/2\\}$ and
records her (his) logic bit as 1 (0) when the modulated phase is
$\pi/2~{}(3\pi/2)$. Then, Alice and Bob send their pulses to the central
dealer Charlie.

2\. Measurement. Charlie imparts a phase 0 on the pulse sent by Bob with
probability $p_{x}$ and imparts a phase $\pi/2$ with probability
$p_{y}=1-p_{x}$. When the phase is $0~{}(\pi/2)$, Charlie records his basis as
$X~{}(Y)$. Then Charlie performs an interference measurement on the two
received pulses with a beam splitter. When the measurement is completed,
Charlie records which detector clicks. If D1 (D2) clicks, then Charlie records

Figure 1: Setup of our quantum secret sharing protocol. Alice and Bob utilize
lasers to emit optics pulses. They modulate the phase of their pulses with the
phase modulator (PM) according to their basis choices and logic bits. After
being dimmed by attenuators (Att), the pulses emitted by Alice and Bob are
sent to Charlie. After adding a phase shift $\\{0,\pi/2\\}$ on pulses sent by
Bob, Charlie lets the two pulses interfere with each other with a beam
splitter (BS) and measures their phase difference with two single-photon
detectors D1 and D2.

his logic bit as 0 (1). If both detectors click, then Charlie randomly records
his logic bit out of 0 or 1.

Figure 2: Experimental setup of our QSS protocol. Cir, circulator; PC,
polarization controller; D1/D2, single-photon detector; BSi
(i$\in\\{1.2.3.4.5\\}$), beam splitter ; PM1/PM2/PM3/PM4, phase modulator;
VOA, variable optical attenuator; DWDM, dense wavelength division
multiplexing. Note that the components including DWDMs and Di
(i$\in\\{3,4,5,6\\}$) are not experimentally implemented due to resource
limitations.

3\. Sifting. After sufficient turns of the above two steps, Alice, Bob and
Charlie announce their basis choices. We denote the basis choice as
$Z_{i}~{}(Z\in\\{X,Y\\},i\in\\{a,b,c\\})$, where the subscript denotes who
chooses the basis. If the basis choice of Alice, Bob and Charlie is one of
$\\{X_{a},X_{b},X_{c}\\}$, $\\{X_{a},Y_{b},Y_{c}\\}$ and
$\\{Y_{a},Y_{b},X_{c}\\}$, their logic bits are sifted to form their raw key
bits. If the basis choice of Alice, Bob and Charlie is
$\\{Y_{a},X_{b},Y_{c}\\}$, Alice and Bob sift their logic bits as their raw
key bits, Charlie flips his corresponding logic bits to form his raw key bits.
Otherwise, they discard their logic bits.

4\. Parameter estimation. When the basis choice is one of
$\\{X_{a},X_{b},X_{c}\\}$ and $\\{X_{a},Y_{b},Y_{c}\\}$, the raw key bits are
used to form secure key bits and part of them are consumed to analyze the bit
error rate $E_{b}^{\rm X}$. When the basis choice is one of
$\\{Y_{a},X_{b},Y_{c}\\}$ and $\\{Y_{a},Y_{b},X_{c}\\}$, Alice, Bob and
Charlie disclose their raw key bits to bound the phase error rate $E_{p}$.

5\. Post-processing. Alice, Bob and Charlie conduct classical error correction
and privacy amplification on the raw key bits, whose corresponding basis
choice is $\\{X_{a},X_{b},X_{c}\\}$ or $\\{X_{a},Y_{b},Y_{c}\\}$, to distill
the final keys.

To introduce our QSS protocol more explicitly, we demonstrate the bit
correlation among Alice, Bob and Charlie. We denote $S_{i}\in\\{0,1\\}$
$(i\in{a,b,c})$ as a classical bit, whose subscript denotes who holds this
bit. In Step 1, the weak coherent states prepared by Alice (Bob) under the X
basis can be expressed as
$\mathinner{|{e^{iS_{a}\pi}\sqrt{\mu}}\rangle}~{}\left(\mathinner{|{e^{iS_{b}\pi}\sqrt{\mu}}\rangle}\right)$;
the weak coherent states prepared by Alice (Bob) under the Y basis can be
expressed as
$\mathinner{|{e^{i(-S_{a}+\frac{3}{2})\pi}\sqrt{\mu}}\rangle}~{}\left(\mathinner{|{e^{i(-S_{b}+\frac{3}{2})\pi}\sqrt{\mu}}\rangle}\right)$.
Since the period of the coherent state is $2\pi$, the weak coherent states
prepared by Alice (Bob) under the Y basis can be equivalently expressed as
$\mathinner{|{e^{i(S_{a}-\frac{1}{2})\pi}\sqrt{\mu}}\rangle}~{}\left(\mathinner{|{e^{i(S_{b}-\frac{1}{2})\pi}\sqrt{\mu}}\rangle}\right)$
after being imparted the phase $2(S_{a}-1)\pi~{}\left(2(S_{b}-1)\pi\right)$.
In Step 2, the phase modulation added by Charlie is 0 $(\pi/2)$ under the X
(Y) basis. After Charlie modulates the phase of the pulse sent by Bob, we
determine the phase difference between the two pulses sent by Alice and Bob.
When the basis choice of Alice, Bob and Charlie is one of
$\\{X_{a},X_{b},X_{c}\\}$, $\\{X_{a},Y_{b},Y_{c}\\}$ and
$\\{Y_{a},Y_{b},X_{c}\\}$, the phase difference can be written as
$\Delta\Phi=(S_{b}-S_{a})\pi$, based on which we can calculate the bit
correlation as $S_{c}=S_{a}\oplus S_{b}$. When the basis choice of Alice, Bob
and Charlie is $\\{Y_{a},X_{b},Y_{c}\\}$, the phase difference can be written
as $\Delta\Phi=(S_{b}-S_{a}+1)\pi$. Note that Charlie flips his bits when the
basis choice of Alice, Bob and Charlie is $\\{Y_{a},X_{b},Y_{c}\\}$;
therefore, the bits of the three participants satisfy the same relationship
that $S_{c}=S_{a}\oplus S_{b}$. In other words, Charlie’s raw key bits are
exclusive ORs of Alice’s and Bob’s raw key bits.

##  III Experimental demonstration

Fig. 2 shows the experimental setup of our QSS protocol. This is a plug-and-
play system consisting of a Sagnac interferometer. The frequency of the whole
system is 100 MHz. The radio frequency signals provided for all PMs and
synchronization signals of the whole system are from a high-speed arbitrary
waveform generator with a sampling rate of 2.5 Gs/s (Tabor Electronics,
P2588B).

Optical pulses are generated by a pulsed laser held by Charlie, with an
extinction ratio greater than 30 dB. The temperature of the DFB laser is
modulated appropriately to provide optical pulses with a wavelength of 1550.12
nm. Charlie sends the optical pulses with a pulse width of 150 ps to Alice and
Bob. The pulses go through a circulator (Cir) and are then separated by a
50:50 beam splitter (BS) into two identical pulses before entering the Sagnac
loop. The Sagnac loop is used to stabilize the phase fluctuation of the
channel automatically. The counterclockwise (clockwise) pulses are only
modulated by Alice (Bob) without any other modulations. Since the pulses are
generated by a third party, dense wavelength division multiplexings (DWDM),
BSs and single-photon detectors should be added in the system, which are used
for filtering and intensity monitoring, to prevent attacks from the injected
pulses. Alice and Bob both select X and Y bases with probabilities
$p_{x}=80\%$ and $p_{y}=20\%$. Specifically, for the $X$ basis, a 0 or $\pi$
phase will be randomly added, while for the $Y$ basis, a $\pi/2$ or $3\pi/2$
phase will be added.

Alice (Bob) sends pulses after phase modulation to Charlie. Alice’s pulses
interfere with Bob’s pulses at Charlie’s BS after passing through a variable
optical attenuator (VOA) and a PM. The loss of communication channels is
simulated with the VOA between Alice (Bob) and Charlie. Charlie adds only a
phase 0 ($\pi/2$) on Bob’s pulses with a probability $80\%$ ($20\%$) while
adding an unmodulated phase 0 on Alice’s pulses. Since the detection
efficiencies of the two detectors are different, even if we randomly encode
the pulse signals with logic bits 0/1, the number of 0/1 bits in the two
detectors’ detection results are different. To avoid the effect of such a
difference on the final results, we added an extra 0 ($\pi$) phase to PM1,
with a probability of 50% (50%), to balance the 0/1 bits of the two detectors’
detection results. Two outputs of this BS are detected by two superconducting
nanowire single photon detectors, D1 and D2. The time windows of D1 and D2 are
1.7 ns and 2.1 ns, respectively, which are selected according to detection
data. For D1, the detection efficiency $\eta_{1}$ is $86.5\%$ and the dark
count rate $p_{d}^{1}=2.5\times{10}^{-8}$. For D2, $\eta_{2}=93.4\%$ and
$p_{d}^{2}=3.5\times{10}^{-8}$. Detailed experimental data during
implementation can be seen in Appendix. A. Random numbers used in
implementation are generated by Python’s module random.

##  IV Security analysis

In this section, we present the security proof of our protocol. For
simplicity, we assume that the source used in our protocol is perfect and only
consider an internal eavesdropper when considering the security of the
protocol. Since the information leaked to inside eavesdroppers is more than
the information leaked to outside eavesdroppers, such an approximation does
not compromise the security of our protocol. Then, we show that the security
of our protocol against an inside eavesdropper is equivalent to the security
of phase-encoded QKD. Based on the equivalence, the security of our QSS
protocol can be demonstrated by utilizing the security analysis of phase-
encoded QKD [67, 68]. Furthermore, we present the finite-key analysis of our
QSS protocol in Appendix. B and prove the security against coherent attacks in
the finite-key regime.

###  IV.1 Security equivalence

In Fig. 3, we show the setup of phase-encoded QKD and our protocol. Fig. 3a
shows the setup of phase-encoded QKD.

Figure 3: Configuration of phase-encoded QKD and our QSS protocol. (a) We
present a typical schematic of phase-encoded QKD. In one period, Alice
prepares a signal pulse (red) and a reference pulse (blue). After modulating
the phase of the signal pulse, Alice sends the signal pulse and the reference
pulse to Bob. Bob modulates the phase of the reference pulse and then makes
the two pulses interfere to obtain their phase difference. (b) An equivalent
scheme of phase-encoded QKD, in which eavesdropper Eve sends the reference
pulses. (c) To build an equivalence between the security of phase-encoded QKD
and our QSS protocol, we show the setup of our QSS protocol.

The laser source at Alice’s site generates two pulses in one period, referring
to one pulse as the signal pulse and the other pulse as the reference pulse.
Alice modulates only the phase of the signal pulse and does not modulate the
phase of the reference pulse. For the signal pulse, Alice selects one basis
from X and Y. In the X basis, Alice phase modulates the signal pulse with
$\\{0,\pi\\}$. In the Y basis, Alice phase modulates the signal pulse with
$\\{\pi/2,3\pi/2\\}$. When the pulses reach Bob’s site, Bob selects one basis
from X and Y for each pulse. Under the X(Y) basis, Bob imparts a phase 0
($\pi/2$) to the reference pulse. Then, Bob makes the two pulses interfere and
measures them with two detectors D1 and D2.

As an intermediate step, we consider an equivalent scheme (Fig. 3b) of phase-
encoded QKD (Fig. 3a). In this scheme, Alice sends signal pulses in the same
way as phase-encoded QKD, while the eavesdropper Eve sends the reference
pulses. Since the security of phase-encoded QKD can be proven even if the
eavesdropper knows the phase of the reference pulse [67], the two schemes are
equivalent from a security perspective. To build the equivalence of security
between phase-encoded QKD and our QSS protocol, we present the setup of our
protocol in Fig. 3c. We consider the case with an inside eavesdropper and
assume that Bob is the inside eavesdropper. Comparing Fig. 3b and Fig. 3c, we
find that the difference between the two schemes is that Eve, the eavesdropper
in phase-encoded QKD, sends reference pulses, while Bob, the eavesdropper in
our QSS scheme, sends phase-encoded pulses. Since the phase information
imparted on the pulse sent by the eavesdropper has no influence on the
security of phase-encoded QKD, the security of phase-encoded QKD can be proven
to be equivalent to the security against an inside eavesdropper of our QSS
protocol.

###  IV.2 Inside eavesdropper

Without loss of generality, let us assume that Bob is an internal
eavesdropper. We introduce the concept of “quantum coin” to bound the
information leakage of the signal sent by Alice. The imbalance $\Delta$ of the
“quantum coin” is related to the basis dependence of the signal of Alice.
Alice’s basis-dependent entangled states can be expressed as

$\displaystyle\mathinner{|{\Psi_{x}}\rangle}=(\mathinner{|{0_{X}}\rangle}\otimes\mathinner{|{\alpha}\rangle}+\mathinner{|{1_{X}}\rangle}\otimes\mathinner{|{-\alpha}\rangle})/\sqrt{2},$
(1)
$\displaystyle\mathinner{|{\Psi_{y}}\rangle}=(\mathinner{|{1_{Y}}\rangle}\otimes\mathinner{|{i\alpha}\rangle}+\mathinner{|{0_{Y}}\rangle}\otimes\mathinner{|{-i\alpha}\rangle})/\sqrt{2},$

where ${\mathinner{|{0_{X}}\rangle},\mathinner{|{1_{X}}\rangle}}$ are
eigenstates of the Pauli operator $\sigma_{x}$ and
${\mathinner{|{0_{Y}}\rangle},\mathinner{|{1_{Y}}\rangle}}$ are eigenstates of
the Pauli operator $\sigma_{y}$. To quantify the basis dependence of Alice’s
signal pulses, we can relate the basis dependence with the “balance” of a
“quantum coin” in an equivalent protocol [67]. In this equivalent protocol,
Alice measures the quantum coin in the basis
${\mathinner{|{0_{Z}}\rangle},\mathinner{|{1_{Z}}\rangle}}$ to determine
whether Alice sends state $\mathinner{|{\Psi_{x}}\rangle}$ or state
$\mathinner{|{\Psi_{y}}\rangle}$. The joint state of the quantum coin state
and Alice source state can be taken to be

$\displaystyle\mathinner{|{\Phi}\rangle}=\sqrt{p_{x}}\mathinner{|{0_{Z}}\rangle}\otimes\mathinner{|{\Psi_{x}}\rangle}+\sqrt{p_{y}}\mathinner{|{1_{Z}}\rangle}\otimes\mathinner{|{\Psi_{y}}\rangle},$
(2)

where $p_{x}$ and $p_{y}$ are the probability with which Alice encodes her
signal in the X basis and in the Y basis, respectively. Furthermore, we assume
that the measurement of the coin is delayed until after the eavesdropper is
finished eavesdropping on the signals. In our QSS protocol, when Alice, Bob
and Charlie’s basis choice is $\\{Y_{a},X_{b},Y_{c}\\}$ or
$\\{Y_{a},Y_{b},X_{c}\\}$, their logical bits are used to calculate phase
errors. The phase error rate $E_{p}$ can be bounded by a function of
$E_{b}^{\rm Y}$ and $\Delta$ and expressed as

$\begin{split}E_{p}=~{}&E_{b}^{\rm Y}+4\Delta(1-\Delta)(1-2E_{b}^{\rm Y})\\\
&+4(1-2\Delta)\sqrt{\Delta(1-\Delta)E_{b}^{\rm Y}(1-E_{b}^{\rm Y})},\\\
\end{split}$ (3)

where $E_{b}^{\rm Y}$ is the bit error rate, which is calculated by using the
key bits corresponding to basis choice $\\{Y_{a},X_{b},Y_{c}\\}$ or
$\\{Y_{a},Y_{b},X_{c}\\}$, and $\Delta$ quantifies the basis dependence of
Alice’s signals. $\Delta$ can be calculated by

$\displaystyle 1-2Q_{\mu}\Delta=\langle\Psi_{y}|\Psi_{x}\rangle,$ (4)

where $Q_{\mu}$ is the total gain of the protocol.

In the asymptotic case, the final key rate of our QSS protocol can be
expressed as

$\displaystyle R=Q_{\mu}[1-f_{e}H(E_{\rm b}^{\rm X})-H(E_{\rm p})],$ (5)

where $f_{e}$ is the error-correction efficiency; $E_{\rm b}^{\rm X}$ is the
bite error rate of the raw key bits whose corresponding basis choice is
$\\{X_{a},Y_{b},Y_{c}\\}$ or $\\{X_{a},X_{b},X_{c}\\}$;
$H(x)=-x\log_{2}{x}-(1-x)\log_{2}{(1-x)}$ is Shannon entropy. For Charlie’s
two detectors, we assume that the dark count rate of both is $p_{\rm d}$.
$Q_{\mu}$ is the gain corresponding to the basis choice
$\\{X_{a},Y_{b},Y_{c}\\}$ and $\\{X_{a},X_{b},X_{c}\\}$. With a light
intensity $\mu$ of weak coherent states, $Q_{\mu}$ is given by
$Q_{\mu}=(1-p_{\rm d})[1-(1-2p_{\rm d})e^{-2\mu\eta}]$. The bit error rate
$E_{\rm b}^{\rm X}$ is given by $E_{\rm b}^{\rm X}Q_{\mu}=e_{\rm d}(1-p_{\rm
d})[1-(1-p_{\rm d})e^{-2\mu\eta}]+(1-e_{\rm d})p_{\rm d}(1-p_{\rm
d})e^{-2\mu\eta}$, where $e_{\rm d}$ is the misalignment error rate of the
detectors.

##  V Results

Here, to evaluate the performance of our protocol, we conduct the finite key
rate of our QSS protocol. In the above section, we obtain the information
leakage to malicious Bob. Since the information leakage to malicious Bob is
greater than that to external Eve, we can consider the information leakage in
our protocol to be the information leakage to malicious Bob. Alice and Bob are
two symmetric participants in our protocol, so we take the total distance
between Alice and Bob as $L$ in the simulation. Based on such a configuration,
the channel transmittance $\eta$ becomes $\eta_{\rm d}\times 10^{-\alpha
L/20}$, where $\eta_{\rm d}$ is the detection efficiency of Charlie’s
detectors and $\alpha$ is the attenuation coefficient of the ultra-low fiber.

###  V.1 Simulation results

The finite key rate of our QSS protocol can be given by

$\displaystyle l=$ $\displaystyle~{}n_{x}\bigg{[}1-H(\overline{E}_{\rm
p})-{\rm leak}_{\rm EC}$ (6)
$\displaystyle-\frac{1}{n_{x}}\log_{2}{\frac{2}{\epsilon_{\rm
c}}}-\frac{1}{n_{x}}\log_{2}{\frac{1}{4\epsilon^{2}_{\rm PA}}}\bigg{]},$

$\epsilon_{\rm c}$ and $\epsilon_{\rm PA}$ represent the probability of
failure in error correction and privacy amplification, respectively. $n_{x}$
denotes the number of raw key bits used to generate the secret key bits whose
corresponding basis choice is $\\{X_{a},X_{b},X_{c}\\}$ or
$\\{X_{a},Y_{b},Y_{c}\\}$. ${\rm leak_{\rm EC}}=f_{e}H(E_{\rm b}^{\rm X})$
represents the fraction of bits

Figure 4: Simulation key rate with variant misalignment rates. Simulation
results for finite final key rate as a function of fiber transmission length
with a fixed key length $N=10^{10}$ and misalignment rate $e_{\rm
d}=2\%,4\%,6\%$.

consumed for error correction, where $f_{e}$ is the error-correction
efficiency and $E_{\rm b}^{\rm X}$ represents the bit error rate of the raw
key bits whose corresponding basis choice is $\\{X_{a},X_{b},X_{c}\\}$ or
$\\{X_{a},Y_{b},Y_{c}\\}$. $\overline{E}_{\rm p}$ is the upper bound of the
phase error rate, whose detailed formulas are given in Appendix. B.

Assuming the size of the finite key is $N=10^{10}$, we utilize the genetic
algorithm to optimize the finite key rate under a certain distance with the
misalignment rate $e_{\rm d}=2\%,4\%,6\%$. Other simulation parameters are
summarized as follows: $\eta_{\rm d}=56\%$, $p_{\rm d}=10^{-8}$,
$\alpha=0.167$, and $f_{e}=1.16$. We show our simulation result in Fig. 4. As
shown in Fig. 4, our QSS protocol achieves a transmission distance of more
than 230 km when the misalignment rate $e_{\rm d}=2\%$. Furthermore, our
protocols show tolerance for high misalignment error rates. With an error rate
of 6 %, a transmission distance of 150 km can still be obtained.

###  V.2 Experimental results

Table 1: Experimental data. We demonstrate the feasibility of our protocol under different channel losses. N is the number of pulses sent, $\mu$ is the higher intensity of the pulses sent by Alice and Bob, $E_{\rm b}^{\rm X}$ and $E_{\rm b}^{\rm Y}$ are the experimental quantum bit error rates in the $X$ basis and $Y$ basis, $n_{x}$ and $n_{y}$ are the number of clicks in the $X$ basis and $Y$ basis, $R$ is the key rate. Loss |  N |  $\mu$ |  $E_{\rm b}^{\rm X}$ |  $E_{\rm b}^{\rm Y}$ |  $n_{x}$ |  $n_{y}$ |  $R$
---|---|---|---|---|---|---|---
20 dB |  $10^{10}$ |  5.8$\times 10^{-3}$ |  0.16% |  0.09% |  2776599 |  315364 |  7.51$\times 10^{-5}$
30 dB |  $10^{10}$ |  1.6$\times 10^{-3}$ |  0.19% |  0.09% |  239619 |  27474 |  4.67$\times 10^{-6}$
35 dB |  $10^{10}$ |  8.6$\times 10^{-4}$ |  0.30% |  0.30% |  73954 |  8346 |  8.53$\times 10^{-7}$

We implement our protocol in the finite-key regime over various losses of 20,
30, and 35 dB. Under various losses, we performed this protocol with optimized
intensity and a fixed ratio of X basis to Y basis (4:1).

The experimental results we obtained are listed in Table 1 and shown in Fig.
5. Given the 100-MHz repetition rate, our protocol can achieve a secure key
rate of 85.3 bps with a channel loss of over 35 dB, allowing it to be deployed
over 175 km with available technologies. A secure key rate of 7.51 kbps was
generated at 20 dB ($\sim$ 100 km) while at 30 dB ($\sim$ 150 km), it was 467
bps. Note that the intensities of pulses sent by Alice and Bob are different

Figure 5: Secure key rate of our QSS scheme. The secure key rates are plotted
against the total loss from Alice to Bob with the total number of pulses sent
by Alice or Bob $N=10^{10}$. The triangular-type dots correspond to the
experimental results with fiber transmitting losses of 20 dB, 30 dB, and 35
dB.

due to the different insertion losses of Charlie’s PMs and the difference has
little influence on results. We used the larger value of the pulse intensity
to calculate the final result, which results in a lower key rate.

As a tradeoff for automatic phase stabilization, long-distance optical fibers
were not used in the system and the two users were connected with a one-meter-
long fiber. Two users in the plug-and-play system are unable to resist Trojan
horse attacks. Additionally, due to the lack of DWDMs and photodiodes, we did
not actually monitor the intensity and filter pulses, which should be
addressed to prevent potential attacks. However, instead of establishing a
complete system with all necessary elements, we concentrate on demonstrating
the feasibility of our protocol. The lacking devices can be directly added to
our system without invalidating the obtained experimental results. Employing
the developed technology in twin-field QKD, such as phase-locking and phase-
tracking [60, 61, 62, 63, 64, 65, 66], a scheme with two independent users and
long-distance fibers can be realized.

##  VI Conclusion

In summary, we propose a quantum secret sharing protocol that balances
security and practicality. The use of weak coherent states in our protocol
removes the requirements for impractical entangled sources. Our protocol
removes the requirements for intensity modulation and phase randomization,
which avoids pattern effects in experimental implementation and enables
commercial applications of our protocol. In addition, our protocol uses the
same device as twin-field QKD [60, 61, 62, 63, 64, 65, 66] and can therefore
be implemented with existing devices. Furthermore, our QSS protocol can be
directly used for efficient quantum digital signatures [24]. Using the
concentration inequality [58, 59] to consider statistical fluctuations, we
provide a finite-key analysis against coherent attacks for our QSS protocol.
In the finite-key regime, our QSS protocol achieves a theoretical transmission
distance over 230 km under a small misalignment error rate while showing
tolerance for high misalignment rates, which makes field tests possible.

Furthermore, we experimentally demonstrate our protocol in a plug-and-play
system. Our protocol can be demonstrated over 35 dB with the ability to resist
coherent attacks. Without intensity modulation and phase randomization, our
protocol can still achieve a key rate of 85.3 bps under a 35 dB channel loss,
which outperforms other experimental implementations of QSS protocols. In
addition, we also achieve key rates of 7.51 kbps and 0.467 kbps at 20 dB and
30 dB, respectively. Combined with high security and simple apparatus
requirements, our protocol paves the way for secure multiparty communication
in future quantum networks.

## Acknowledgments

This study was supported by the National Natural Science Foundation of China
(No. 12274223), the Natural Science Foundation of Jiangsu Province (No.
BK20211145), the Fundamental Research Funds for the Central Universities (No.
020414380182), the Key Research and Development Program of Nanjing Jiangbei
New Aera (No. ZDYD20210101), the Program for Innovative Talents and
Entrepreneurs in Jiangsu (No. JSSCRC2021484), and the Program of Song Shan
Laboratory (Included in the management of Major Science and Technology Program
of Henan Province) (No. 221100210800-02).

##  Appendix A Detailed experimental data

Detailed experimental data are presented in Table 3, including the number of
all detection events n and the number of detection events under different
added phases. The number of detection events under different phases added is
named as “Detected ABC”, where “A” (“B” or “C”) means an A (B or C) phase was
added on the pulses by Alice (Bob or Charlie) . The pre-calibrated losses are
depicted in Table 2. The elements include PMs, PCs, Cir, and BSs. The results
are given for each output (D1/D2) as appropriate.

Table 2: Efficiencies of the elements of the measurement station. Optical devices | Insertion loss
---|---
Cir 2$\rightarrow$3 | 0.62 dB
BS-A | 0.69 dB
BS-B | 0.70 dB
PM-A | 1.93 dB
PM-B | 2.01 dB
$\rm{PC_{1}}$ | 0.18 dB
$\rm{PC_{2}}$ | 0.16 dB
Table 3: Detailed experimental data under different channel losses. Channel loss |  20 dB |  30 dB |  35 dB
---|---|---|---
n |  5135663 |  442749 |  136412
Detector |  D1 |  D2 |  D1 |  D2 |  D1 |  D2
Detected 000 |  567134 |  1426 |  48972 |  127 |  15129 |  74
Detected 0$\pi$0 |  1085 |  762615 |  104 |  66325 |  48 |  20236
Detected $\pi$00 |  725 |  718749 |  92 |  61975 |  39 |  19103
Detected $\pi$$\pi$0 |  581843 |  1002 |  49848 |  111 |  15535 |  51
Detected 0$\frac{\pi}{2}$$\frac{\pi}{2}$ |  29 |  36425 |  4 |  3085 |  2 |  964
Detected 0$\frac{3\pi}{2}$$\frac{\pi}{2}$ |  33149 |  87 |  2785 |  9 |  886 |  4
Detected $\pi$$\frac{\pi}{2}$$\frac{\pi}{2}$ |  31191 |  41 |  2648 |  5 |  817 |  4
Detected $\pi$$\frac{3\pi}{2}$$\frac{\pi}{2}$ |  21 |  41077 |  5 |  3524 |  2 |  1060
Detected $\frac{\pi}{2}$$\frac{\pi}{2}$0 |  37300 |  30 |  3261 |  0 |  1032 |  1
Detected $\frac{\pi}{2}$$\frac{3\pi}{2}$0 |  22 |  40704 |  0 |  3515 |  1 |  1065
Detected $\frac{3\pi}{2}$$\frac{\pi}{2}$0 |  42 |  44354 |  4 |  3864 |  4 |  1222
Detected $\frac{3\pi}{2}$$\frac{3\pi}{2}$0 |  39512 |  50 |  3462 |  6 |  1055 |  6
Detected $\frac{\pi}{2}$0$\frac{\pi}{2}$ |  37565 |  45 |  3231 |  5 |  975 |  2
Detected $\frac{\pi}{2}$$\pi$$\frac{\pi}{2}$ |  38 |  37342 |  3 |  3199 |  6 |  959
Detected $\frac{3\pi}{2}$0$\frac{\pi}{2}$ |  28 |  38821 |  5 |  3412 |  3 |  987
Detected $\frac{3\pi}{2}$$\pi$$\frac{\pi}{2}$ |  39469 |  42 |  3505 |  2 |  1026 |  2

##  Appendix B Finite-key analysis

Here, we provide the finite-key analysis of our protocol. Using the
concentration inequality [59] in Ref. [58], we provide security against
coherent attacks. The formula of the finite key rate can be expressed as

$\displaystyle l=$ $\displaystyle~{}n_{x}\bigg{[}1-H(\overline{E}_{\rm
p})-{\rm leak}_{\rm EC}$ (7)
$\displaystyle-\frac{1}{n_{x}}\log_{2}{\frac{2}{\epsilon_{\rm
c}}}-\frac{1}{n_{x}}\log_{2}{\frac{1}{4\epsilon^{2}_{\rm PA}}}\bigg{]},$

which is proven to be $\epsilon_{\rm c}$-correct and $\epsilon_{s}$-secure,
with $\epsilon_{s}=\sqrt{\epsilon}+\epsilon_{\rm PA}$. $\epsilon$ is the
failure probability associated with the estimation of the phase error rate.
$\epsilon_{\rm c}$ and $\epsilon_{\rm PA}$ represent the probability of
failure in error correction and privacy amplification, respectively. $n_{x}$
denotes the number of raw key bits used to generate the secret key bits whose
corresponding basis choice is $\\{X_{a},X_{b},X_{c}\\}$ or
$\\{X_{a},Y_{b},Y_{c}\\}$. ${\rm leak_{\rm EC}}=f_{e}H(E_{\rm b}^{\rm X})$
represents the fraction of bits consumed for error correction, where $f_{e}$
is the error-correction efficiency and $E_{b}^{X}$ represents the bit error
rate of the raw key bits whose corresponding basis choice is
$\\{X_{a},X_{b},X_{c}\\}$ or $\\{X_{a},Y_{b},Y_{c}\\}$. In addition, we apply
statistical fluctuations to calculate the upper bound of the observed phase
error rate $\overline{E}_{\rm p}$. When considering statistical fluctuations,
we use the concentration inequality [59, 58] to estimate the upper bound of
the deviation between a sum of correlated random variables and its expected
value. The concentration inequality is tighter than the widely employed
Azuma’s inequality [69] and proves the security against coherent attacks.

We define $\xi_{1},...,\xi_{n}$ to be a sequence of Bernoulli random variables
and define $\Lambda_{j}$ to be the sum of these random variables, i.e.
$\Lambda_{j}=\sum_{u=1}^{j}\xi_{u}$. Let $\mathcal{F}_{j}$ denote the
$\sigma$-algebra generated by $\\{\xi_{1},...,\xi_{n}\\}$ that is the natural
filtration of those Bernoulli random variables. Let $\epsilon_{a}$ denote the
failure probabilities for the concentration bound for sums of dependent random
variables. Using the results in Refs. [58, 59], we find that for any $b>0$

$\displaystyle{\rm Pr}\left[\Lambda_{n}-\sum\limits_{u=1}^{n}{\rm
Pr}(\xi_{u}=1|\mathcal{F}_{u-1})\geq b\sqrt{n}\right]\leq{\rm exp}[-2b^{2}],$
(8) $\displaystyle{\rm Pr}\left[\sum\limits_{u=1}^{n}{\rm
Pr}(\xi_{u}=1|\mathcal{F}_{u-1})-\Lambda_{n}\geq b\sqrt{n}\right]\leq{\rm
exp}[-2b^{2}].$

Equating the right-hand sides of eq. (8) to $\epsilon_{a}$ and solving for
$b$, we find a simple bound of concentration inequality, which can be
expressed as

$\displaystyle\sum\limits_{u=1}^{n}{\rm
Pr}(\xi_{u}=1|\xi_{1},...,\xi_{u-1})\leq\Lambda_{n}+\Delta_{c},$ (9)
$\displaystyle\Lambda_{n}\leq\sum\limits_{u=1}^{n}{\rm
Pr}(\xi_{u}=1|\xi_{1},...,\xi_{u-1})+\Delta_{c},$

where $\Delta_{c}=\sqrt{\frac{1}{2}n\ln\epsilon_{\rm a}^{-1}}$ and
$\epsilon_{a}$ is the maximum of failure probability in each of the bounds in
eq. (9). Without loss of generation, we set $\epsilon_{\rm c}=\epsilon_{\rm
PA}=\epsilon=\epsilon_{\rm a}=10^{-10}$.

With the concentration inequalities, we can estimate the upper bound of the
phase error rate $\overline{E}_{\rm p}$. Assuming that Bob is the internal
eavesdropper, the raw key bits are divided into two parts based on Alice’s
basis. The raw key bits in the X basis are used to form secure key bits and
estimate the bit error rate and the raw key bits in the Y basis are used to
bound the phase error rate. First, we offer the number of bit errors and the
number of detection events in the Y basis and then record them as $m_{y}$ and
$n_{y}$. In addition, the number of detection events in the X basis is also
offered and recorded as $n_{x}$. Then, we use the concentration inequality to
obtain the upper bound ${m^{\prime}_{y}}$ on the expected number of bit errors
in the Y basis, with which we find the upper bound
${E_{b}^{Y}}^{\prime}={m^{\prime}_{y}}/n_{y}$ on the expected bit error rate
in the Y basis. Based on eq. (3), the expected phase error rate in the X basis
$E^{\prime}_{\rm p}$ can be bounded by ${E_{b}^{Y}}^{\prime}$. Then we find
the expected number of phase errors in the X basis ${m^{\prime}_{\rm
p}}=n_{x}{E^{\prime}_{\rm P}}$. Next, we use the concentration inequality to
calculate the upper bound $\overline{m}_{\rm p}$ on the observed number of
phase errors in the X basis. Then we can derive $\overline{E}_{\rm p}$ with
the formula $\overline{E}_{\rm p}=\overline{m}_{\rm p}/n_{x}$.

## References

  * Gisin and Thew [2007] N. Gisin and R. Thew, Quantum communication, Nat. Photonics 1, 165 (2007).
  * Kimble [2008] H. J. Kimble, The quantum internet, Nature 453, 1023 (2008).
  * Munro et al. [2012] W. J. Munro, A. M. Stephens, S. J. Devitt, K. A. Harrison, and K. Nemoto, Quantum communication without the necessity of quantum memories, Nat. Photonics 6, 777 (2012).
  * Zhang et al. [2017] W. Zhang, D.-S. Ding, Y.-B. Sheng, L. Zhou, B.-S. Shi, and G.-C. Guo, Quantum secure direct communication with quantum memory, Phys. Rev. Lett. 118, 220501 (2017).
  * Liu et al. [2021a] X. Liu, Z. Li, D. Luo, C. Huang, D. Ma, M. Geng, J. Wang, Z. Zhang, and K. Wei, Practical decoy-state quantum secure direct communication, Sci. China-Phys. Mech. Astron. 64, 120311 (2021a).
  * Zhang et al. [2021] X.-P. Zhang, L.-T. Shen, Y. Zhang, L. Sun, H. Wu, Z.-B. Yang, and Z.-Q. Yin, External control of qubit-photon interaction and multi-qubit reset in a dissipative quantum network, Sci. China-Phys. Mech. Astron. 64, 250311 (2021).
  * Liu et al. [2022a] X. Liu, D. Luo, G. Lin, Z. Chen, C. Huang, S. Li, C. Zhang, Z. Zhang, and K. Wei, Fiber-based quantum secure direct communication without active polarization compensation, Sci. China-Phys. Mech. Astron. 65, 120311 (2022a).
  * Sheng et al. [2022] Y.-B. Sheng, L. Zhou, and G.-L. Long, One-step quantum secure direct communication, Sci. Bull. 67, 367 (2022).
  * Zhou and Sheng [2022] L. Zhou and Y.-B. Sheng, One-step device-independent quantum secure direct communication, Sci. China-Phys. Mech. Astron. 65, 250311 (2022).
  * Bennett and Brassard [2014] C. H. Bennett and G. Brassard, Quantum cryptography: Public key distribution and coin tossing, Theor. Comput. Sci. 560, 7 (2014).
  * Lucamarini et al. [2018] M. Lucamarini, Z. L. Yuan, J. F. Dynes, and A. J. Shields, Overcoming the rate–distance limit of quantum key distribution without quantum repeaters, Nature 557, 400 (2018).
  * Liu et al. [2021b] W.-B. Liu, C.-L. Li, Y.-M. Xie, C.-X. Weng, J. Gu, X.-Y. Cao, Y.-S. Lu, B.-H. Li, H.-L. Yin, and Z.-B. Chen, Homodyne detection quadrature phase shift keying continuous-variable quantum key distribution with high excess noise tolerance, PRX Quantum 2, 040334 (2021b).
  * Zhou et al. [2021] C. Zhou, X. Wang, Z. Zhang, S. Yu, Z. Chen, and H. Guo, Rate compatible reconciliation for continuous-variable quantum key distribution using raptor-like ldpc codes, Sci. China-Phys. Mech. Astron. 64, 260311 (2021).
  * Chen et al. [2021a] Y.-A. Chen, Q. Zhang, T.-Y. Chen, W.-Q. Cai, S.-K. Liao, J. Zhang, K. Chen, J. Yin, J.-G. Ren, Z. Chen, et al., An integrated space-to-ground quantum communication network over 4,600 kilometres, Nature 589, 214 (2021a).
  * Liu et al. [2021c] H. Liu, C. Jiang, H.-T. Zhu, M. Zou, Z.-W. Yu, X.-L. Hu, H. Xu, S. Ma, Z. Han, J.-P. Chen, et al., Field test of twin-field quantum key distribution through sending-or-not-sending over 428 km, Phys. Rev. Lett. 126, 250502 (2021c).
  * Liu et al. [2022b] B. Liu, S. Xia, D. Xiao, W. Huang, B. Xu, and Y. Li, Decoy-state method for quantum-key-distribution-based quantum private query, Sci. China-Phys. Mech. Astron. 65, 240312 (2022b).
  * Xie et al. [2022] Y.-M. Xie, Y.-S. Lu, C.-X. Weng, X.-Y. Cao, Z.-Y. Jia, Y. Bao, Y. Wang, Y. Fu, H.-L. Yin, and Z.-B. Chen, Breaking the rate-loss bound of quantum key distribution with asynchronous two-photon interference, PRX Quantum 3, 020315 (2022).
  * Zhang et al. [2022] Y. Zhang, S. Liu, B. Jing, Q. He, and S. Luo, Revealing nonclassicality via s-ordered phase-space distribution, Sci. China-Phys. Mech. Astron. 65, 110311 (2022).
  * Chen et al. [2022] J.-P. Chen, C. Zhang, Y. Liu, C. Jiang, D.-F. Zhao, W.-J. Zhang, F.-X. Chen, H. Li, L.-X. You, Z. Wang, et al., Quantum key distribution over 658 km fiber with distributed vibration sensing, Phys. Rev. Lett. 128, 180502 (2022).
  * Gu et al. [2022] J. Gu, X.-Y. Cao, Y. Fu, Z.-W. He, Z.-J. Yin, H.-L. Yin, and Z.-B. Chen, Experimental measurement-device-independent type quantum key distribution with flawed and correlated sources, Sci. Bull. 67, 2167 (2022).
  * Xu et al. [2022] F. Xu, Y.-Z. Zhang, Q. Zhang, and J.-W. Pan, Device-independent quantum key distribution with random postselection, Phys. Rev. Lett. 128, 110506 (2022).
  * Yin et al. [2016] H.-L. Yin, Y. Fu, and Z.-B. Chen, Practical quantum digital signature, Phys. Rev. A 93, 032316 (2016).
  * Roberts et al. [2017] G. L. Roberts, M. Lucamarini, Z. L. Yuan, J. F. Dynes, L. C. Comandar, A. W. Sharpe, A. J. Shields, M. Curty, I. V. Puthoor, and E. Andersson, Experimental measurement-device-independent quantum digital signatures, Nat. Commun. 8, 1098 (2017).
  * Yin et al. [2023] H.-L. Yin, Y. Fu, C.-L. Li, C.-X. Weng, B.-H. Li, J. Gu, Y.-S. Lu, S. Huang, and Z.-B. Chen, Experimental quantum secure network with digital signatures and encryption, Natl. Sci. Rev. 10, nwac228 (2023).
  * Hillery et al. [1999] M. Hillery, V. Bužek, and A. Berthiaume, Quantum secret sharing, Phys. Rev. A 59, 1829 (1999).
  * Cleve et al. [1999] R. Cleve, D. Gottesman, and H.-K. Lo, How to share a quantum secret, Phys. Rev. Lett. 83, 648 (1999).
  * Shamir [1979] A. Shamir, How to share a secret, Commun. ACM 22, 612 (1979).
  * Blakley [1979] G. R. Blakley, Safeguarding cryptographic keys (1979).
  * Bennett [1992] C. H. Bennett, Quantum cryptography using any two nonorthogonal states, Phys. Rev. Lett. 68, 3121 (1992).
  * Guo and Guo [2003] G.-P. Guo and G.-C. Guo, Quantum secret sharing without entanglement, Phys. Lett. A 310, 247 (2003).
  * Lance et al. [2004] A. M. Lance, T. Symul, W. P. Bowen, B. C. Sanders, and P. K. Lam, Tripartite quantum state sharing, Phys. Rev. Lett. 92, 177903 (2004).
  * Xiao et al. [2004] L. Xiao, G. L. Long, F.-G. Deng, and J.-W. Pan, Efficient multiparty quantum-secret-sharing schemes, Phys. Rev. A 69, 052307 (2004).
  * Zhang et al. [2005] Z.-J. Zhang, Y. Li, and Z.-X. Man, Multiparty quantum secret sharing, Phys. Rev. A 71, 044301 (2005).
  * Yan and Gao [2005] F.-L. Yan and T. Gao, Quantum secret sharing between multiparty and multiparty without entanglement, Phys. Rev. A 72, 012304 (2005).
  * Deng et al. [2006] F.-G. Deng, H.-Y. Zhou, and G. L. Long, Circular quantum secret sharing, J. Phys. A: Math. Gen. 39, 14089 (2006).
  * Qin et al. [2007] S.-J. Qin, F. Gao, Q.-Y. Wen, and F.-C. Zhu, Cryptanalysis of the hillery-bužek-berthiaume quantum secret-sharing protocol, Phys. Rev. A 76, 062324 (2007).
  * Markham and Sanders [2008] D. Markham and B. C. Sanders, Graph states for quantum secret sharing, Phys. Rev. A 78, 042309 (2008).
  * Zhou et al. [2018] Y. Zhou, J. Yu, Z. Yan, X. Jia, J. Zhang, C. Xie, and K. Peng, Quantum secret sharing among four players using multipartite bound entanglement of an optical field, Phys. Rev. Lett. 121, 150502 (2018).
  * Gao et al. [2020] Z. Gao, T. Li, and Z. Li, Deterministic measurement-device-independent quantum secret sharing, Sci. China-Phys. Mech. Astron. 63, 120311 (2020).
  * Yang et al. [2021] Y.-G. Yang, Y.-C. Wang, Y.-L. Yang, X.-B. Chen, D. Li, Y.-H. Zhou, and W.-M. Shi, Participant attack on the deterministic measurement-device-independent quantum secret sharing protocol, Sci. China-Phys. Mech. Astron. 64, 260321 (2021).
  * Chen et al. [2005] Y.-A. Chen, A.-N. Zhang, Z. Zhao, X.-Q. Zhou, C.-Y. Lu, C.-Z. Peng, T. Yang, and J.-W. Pan, Experimental quantum secret sharing and third-man quantum cryptography, Phys. Rev. Lett. 95, 200502 (2005).
  * Schmid et al. [2005] C. Schmid, P. Trojek, M. Bourennane, C. Kurtsiefer, M. Żukowski, and H. Weinfurter, Experimental single qubit quantum secret sharing, Phys. Rev. Lett. 95, 230505 (2005).
  * Gaertner et al. [2007] S. Gaertner, C. Kurtsiefer, M. Bourennane, and H. Weinfurter, Experimental demonstration of four-party quantum secret sharing, Phys. Rev. Lett. 98, 020503 (2007).
  * Bogdanski et al. [2008] J. Bogdanski, N. Rafiei, and M. Bourennane, Experimental quantum secret sharing using telecommunication fiber, Phys. Rev. A 78, 062307 (2008).
  * Wei et al. [2013] K.-J. Wei, H.-Q. Ma, and J.-H. Yang, Experimental circular quantum secret sharing over telecom fiber network, Opt. Express 21, 16663 (2013).
  * Bell et al. [2014] B. Bell, D. Markham, D. Herrera-Martí, A. Marin, W. Wadsworth, J. Rarity, and M. Tame, Experimental demonstration of graph-state quantum secret sharing, Nat. Commun. 5, 5480 (2014).
  * Lu et al. [2016] H. Lu, Z. Zhang, L.-K. Chen, Z.-D. Li, C. Liu, L. Li, N.-L. Liu, X. Ma, Y.-A. Chen, and J.-W. Pan, Secret sharing of a quantum state, Phys. Rev. Lett. 117, 030501 (2016).
  * Tavakoli et al. [2015] A. Tavakoli, I. Herbauts, M. Żukowski, and M. Bourennane, Secret sharing with a single d-level quantum system, Phys. Rev. A 92, 030302 (2015).
  * Hai-Qiang et al. [2013] M. Hai-Qiang, W. Ke-Jin, and Y. Jian-Hui, Experimental single qubit quantum secret sharing in a fiber network configuration, Opt. Lett. 38, 4494 (2013).
  * He [2007] G. P. He, Comment on “experimental single qubit quantum secret sharing”, Phys. Rev. Lett. 98, 028901 (2007).
  * Schmid et al. [2007] C. Schmid, P. Trojek, M. Bourennane, C. Kurtsiefer, M. Żukowski, and H. Weinfurter, Schmid et al. reply:, Phys. Rev. Lett. 98, 028902 (2007).
  * Xu et al. [2020] F. Xu, X. Ma, Q. Zhang, H.-K. Lo, and J.-W. Pan, Secure quantum key distribution with realistic devices, Rev. Mod. Phys. 92, 025002 (2020).
  * Inoue et al. [2008] K. Inoue, T. Ohashi, T. Kukita, K. Watanabe, S. Hayashi, T. Honjo, and H. Takesue, Differential-phase-shift quantum secret sharing, Opt. Express 16, 15469 (2008).
  * Jia et al. [2021] Z.-Y. Jia, J. Gu, B.-H. Li, H.-L. Yin, and Z.-B. Chen, Differential phase shift quantum secret sharing using a twin field with asymmetric source intensities, Entropy 23, 716 (2021).
  * Gu et al. [2021a] J. Gu, X.-Y. Cao, H.-L. Yin, and Z.-B. Chen, Differential phase shift quantum secret sharing using a twin field, Opt. Express 29, 9165 (2021a).
  * Wei et al. [2018] K. Wei, X. Yang, C. Zhu, and Z.-Q. Yin, Quantum secret sharing without monitoring signal disturbance, Quantum Inf. Process. 17, 1 (2018).
  * Gu et al. [2021b] J. Gu, Y.-M. Xie, W.-B. Liu, Y. Fu, H.-L. Yin, and Z.-B. Chen, Secure quantum secret sharing without signal disturbance monitoring, Opt. Express 29, 32244 (2021b).
  * Currás-Lorenzo et al. [2021] G. Currás-Lorenzo, Á. Navarrete, K. Azuma, G. Kato, M. Curty, and M. Razavi, Tight finite-key security for twin-field quantum key distribution, npj Quantum Inf. 7, 22 (2021).
  * Kato [2020] G. Kato, Concentration inequality using unconfirmed knowledge, arXiv preprint arXiv:2002.04357 (2020).
  * Zhong et al. [2019] X. Zhong, J. Hu, M. Curty, L. Qian, and H.-K. Lo, Proof-of-principle experimental demonstration of twin-field type quantum key distribution, Phys. Rev. Lett. 123, 100506 (2019).
  * Fang et al. [2020] X.-T. Fang, P. Zeng, H. Liu, M. Zou, W. Wu, Y.-L. Tang, Y.-J. Sheng, Y. Xiang, W. Zhang, H. Li, et al., Implementation of quantum key distribution surpassing the linear rate-transmittance bound, Nat. Photonics 14, 422 (2020).
  * Pittaluga et al. [2021] M. Pittaluga, M. Minder, M. Lucamarini, M. Sanzaro, R. I. Woodward, M.-J. Li, Z. Yuan, and A. J. Shields, 600-km repeater-like quantum communications with dual-band stabilization, Nat. Photonics 15, 530 (2021).
  * Chen et al. [2021b] J.-P. Chen, C. Zhang, Y. Liu, C. Jiang, W.-J. Zhang, Z.-Y. Han, S.-Z. Ma, X.-L. Hu, Y.-H. Li, H. Liu, et al., Twin-field quantum key distribution over a 511 km optical fibre linking two distant metropolitan areas, Nat. Photonics 15, 570 (2021b).
  * Wang et al. [2022] S. Wang, Z.-Q. Yin, D.-Y. He, W. Chen, R.-Q. Wang, P. Ye, Y. Zhou, G.-J. Fan-Yuan, F.-X. Wang, Y.-G. Zhu, et al., Twin-field quantum key distribution over 830-km fibre, Nat. Photonics 16, 154 (2022).
  * Zhou et al. [2023] L. Zhou, J. Lin, Y. Jing, and Z. Yuan, Twin-field quantum key distribution without optical frequency dissemination, Nat. Commun. 14, 928 (2023).
  * Clivati et al. [2022] C. Clivati, A. Meda, S. Donadello, S. Virzì, M. Genovese, F. Levi, A. Mura, M. Pittaluga, Z. Yuan, A. J. Shields, et al., Coherent phase transfer for real-world twin-field quantum key distribution, Nat. Commun. 13, 157 (2022).
  * Lo and Preskill [2007] H.-K. Lo and J. Preskill, Security of quantum key distribution using weak coherent states with nonrandom phases, Quantum Inf. Comput. 7, 431 (2007).
  * Koashi [2009] M. Koashi, Simple security proof of quantum key distribution based on complementarity, New J. Phys. 11, 045018 (2009).
  * Azuma [1967] K. Azuma, Weighted sums of certain dependent random variables, Tohoku Math. J. 19, 357 (1967).