In SQSS protocols, there are participants restricted to using only the quantum states in the fixed computational basis 0 , 1 , and they only have classical computing power. All participants of an SQSS protocol are required to perform the following operations only: (a) reflect the qubits undisturbed; (b) measure the qubits with the classical 0 , 1 basis; (c) generate a (fresh) qubit with the classical 0 , 1 basis and send it; and (d) reorder the qubits, so they can never prepare or measure qubits arbitrarily. The qubits with the classical basis are regarded as “classical bits”, and the participants restricted to performing the above operations are known as “classical participants”.

Shamir [1] proposed a (t, n) threshold scheme based on polynomial interpolation in 1979. According to the property of polynomial interpolation, this technique enables the construction of secret sharing schemes that can function even when fewer than n participants want to reconstruct the secret. Therefore, Shamir’s scheme has been widely used in the field of quantum cryptography, such as quantum secret sharing [28–30] and quantum key distribution [31].

Given that there is a secret holder Alice and n participants B o b 1 , B o b 2 , . . . , B o b n , Shamir’s secret sharing consists of two phases:

In the secret sharing phase, the secret holder Alice selects a polynomial of t–1 degree: f x = S + a 1 x + a 2 x 2 + . . . + a t − 1 x t − 1 . (1)

Here, S is Alice’s secret, t is the lower limit of the number of participants who can reconstruct Alice’s secret S, and a i i = 1 , 2 , . . . , t − 1 is the coefficient Alice picks. Alice selects n integers as x i and computes f x i as shadows. Then she distributes them among n participants. B o b i only knows x i and f x i , where i = 1 , 2 , . . . , n .

In secret reconstruction phase, t participants use the Lagrange interpolation formula and their shares to reconstruct the secret. The Lagrange interpolation formula is as follows: f x = ∑ r = 1 t f x r ∏ 1 ≤ j ≤ t , j ≠ r x − x j x r − x j . (2)

Participants can calculate the polynomial under the condition that x = 0 to obtain f 0 , which is just the secret S.

Alice picks a polynomial f x = 1 + x + x 2 . She respectively announces x 1 = 1 , x 2 = 2 , x 3 = 3 , x 4 = 4 to B o b 1 , B o b 2 , B o b 3 , a n d B o b 4 . Alice also computes f x 1 = 3 , f x 2 = 7 , f x 3 = 13 , f x 4 = 21 , which are the values Alice wants to distribute to classical participants.

Alice randomly prepares 5 decoy particles in one of the states 0 , 1 , + , − , which compose S 0 = 0 A , 1 A , + A , − A , 0 A .

Alice sends S 0 to B o b 1 . After that, B o b 1 creates a 5-bit private key b 1 = 00000 for himself. Therefore, B o b 1 prepares 5 particles in 0 and inserts these particles into S 0 to form a new sequence S 1 = 0 A , 0 B 1 , 1 A , 0 B 1 , + A , 0 B 1 , − A , 0 B 1 , 0 A , 0 B 1 . Then B o b 1 sends S 1 to B o b 2 .

B o b 2 creates his private key b 2 = 01010. He prepares corresponding particles and inserts them into S 1 . Therefore, the new sequence is S 2 = 0 B 2 , 0 A ,   0 B 1 , 1 A , 1 B 2 , 0 B 1 , + A , 0 B 2 , 0 B 1 , − A , 0 B 1 , 0 A , 1 B 2 , 0 B 1 , 0 B 2 . B o b 3 ’s private key is b 3 = 11100 and B o b 4 ’s private key is b 4 = 11111. They do the operations similar to B o b 1 and B o b 2 . The final sequence received by Alice is S 4 . Here, S 4 = 1 B 4 , 0 B 2 , 1 B 4 , 1 B 3 , 1 B 3 , 1 B 3 , 0 A , 0 B 3 , 0 B 3 , 0 B 1 , 1 A , 1 B 2 , 0 B 1 , + A , 0 B 2 , 0 B 1 , − A , 0 B 1 , 0 A , 1 B 2 , 0 B 1 , 0 B 2 , 1 B 4 , 1 B 4 , 1 B 4 .

For eavesdropping detection, participants announce where they insert their particles. Alice can obtain the positions of her particles. She measures these particles with proper measurement basis and checks the error rate. For example, if Alice prepares + in S 0 , she should measure the corresponding particle in S 4 with X basis after receiving the final sequence from B o b 4 . If there is no eavesdropper, the measurement result will be + . Once the result is different from + , there exists an eavesdropper. Then, Alice can evaluate the error rate. If the error rate exceeds the predefined threshold value, they will restart the protocol.

After eavesdropping detection, Alice measures the remaining particles with Z basis. Subsequently, she obtains b i of B o b i . According to the relationship established in Step 7, Alice computes a i = b i ⊕ c i , where c i is the binary bit string of f x i . She obtains a new binary sequence K A = 00110001010101011010 , which is composed of a i . Then Alice announces K A .

All participants declare where they insert their particles in Step 6, so B o b i knows the positions of his particles. B o b i can obtain his a i from K A and calculate c i , because c i = b i ⊕ a i = b i ⊕ b i ⊕ c i . For B o b 1 , c 1 = a 1 ⊕ b 1 = 00011 ⊕ 00000 = 00011 . For B o b 2 , c 2 = a 2 ⊕ b 2 = 01101 ⊕ 01010 = 00111 . For B o b 3 , c 3 = a 3 ⊕ b 3 = 10001 ⊕ 11100 = 01101 . For B o b 4 , c 4 = a 4 ⊕ b 4 = 01010 ⊕ 11111 = 10101

Finally, B o b i transforms the binary bit c i into the integer f x i .

Suppose three participants, B o b 1 , B o b 2 , a n d B o b 3 , try to recover Alice’s secret. According to the Lagrange interpolation, S = ∑ i = 1 t f x i ∏ j = 1 , j ≠ i t x j x j − x i = f x 1 ⋅ x 2 x 2 − x 1 ⋅ x 3 x 3 − x 1 ⋅ x 4 x 4 − x 1 + f x 2 ⋅ x 1 x 1 − x 2 ⋅ x 3 x 3 − x 2 ⋅ x 4 x 4 − x 2 + f x 3 ⋅ x 1 x 1 − x 3 ⋅ x 2 x 2 − x 3 ⋅ x 4 x 4 − x 3 = 3 ⋅ 2 2 − 1 ⋅ 3 3 − 1 ⋅ 4 4 − 1 + 7 ⋅ 1 1 − 2 ⋅ 3 3 − 2 ⋅ 4 4 − 2 + 13 ⋅ 1 1 − 3 ⋅ 2 2 − 3 ⋅ 4 4 − 3 = 9 − 21 + 13 = 1 . (5)

In this way, they complete a (3,4) threshold SQSS protocol and recover the secret shared by Alice.

Suppose that B o b i is the malicious participant. To obtain Alice’s shared integers B o b i needs to intercept the sequence S n when B o b n sends it to Alice. Then B o b i measures all particles in S n with Z basis. After that, B o b i can get any participant’s private key b j after every participant announces where he inserts his particles. However, without knowing the positions of the particles prepared by Alice, B o b i would be detected by the security checks in Step 4. Concretely speaking, if Alice prepares 0 or 1 , the state will not be changed. But if Alice prepares + or − , B o b i ’s attack will make the particle collapse into 0 or 1 . For each decoy particle prepared in X basis, B o b i ’s measure-resend attack on it will be detected by the security check with a probability of 50%. To sum up, the probability that Alice can detect B o b i ’s eavesdropping is 1 − 1 2 k , where k represents the num of + or − in S 0 . If k is large enough, the detection probability will approach to 100%. Therefore, K A will not be declared. According to c j = a j ⊕ b j , B o b i is unable to calculate any B o b j ’s c j or f x j without a j . Finally, B o b i cannot get Alice’s secret S.

To obtain Alice’s shared integers, the malicious participant B o b i needs to intercept the sequence S n when B o b n sends it to Alice. Afterward, B o b i keeps the (n+1)N particles in his hand and prepares (n+1)N fake particles with Z basis. Subsequently, he sends the fake sequence to Alice. However, B o b i does not know the positions of Alice’s particles. He replaces Alice’s particles with his fake particles. When Alice measures B o b i ′ s fake particles in X basis in Step 6, she will obtain an incorrect result with a probability of 50%. Assume that there are k decoy particles prepared with X basis in S 0 , the probability that B o b i ′ s eavesdropping will be detected is 1 − 1 2 k , which approaches 100%. So B o b i cannot pass the security check. That is, Alice will not declare K A , which makes it impossible for B o b i to obtain Alice’s secret.

Suppose that B o b i is the dishonest participant. He cannot discover the difference between the particles prepared by Alice and those prepared by other participants. Therefore, he has to entangle his auxiliary particles with all of them. B o b i uses a unitary operation U E to entangle an ancillary particle on each of the transmitted particles and then measures the ancillary particles to obtain Alice’s shared secret information. U E 0 E = α 0 0 e 00 + β 0 1 e 01 . (6) U E 1 E = α 1 0 e 10 + β 1 1 e 11 . (7) U E + E = 1 2 α 0 e 00 + α 1 e 10 0 + 1 2 β 0 e 01 + β 1 e 11 1 = 1 2 α 0 e 00 + α 1 e 10 + β 0 e 01 + β 1 e 11 + + 1 2 α 0 e 00 + α 1 e 10 − β 0 e 01 − β 1 e 11 − . (8) U E − E = 1 2 α 0 e 00 − α 1 e 10 0 + 1 2 β 0 e 01 − β 1 e 11 1 = 1 2 α 0 e 00 − α 1 e 10 + β 0 e 01 − β 1 e 11 + + 1 2 α 0 e 00 − α 1 e 10 − β 0 e 01 + β 1 e 11 − . (9)

Here, α 0 2 + β 0 2 = α 1 2 + β 1 2 = 1 . If B o b i wants to avoid introducing an error, he must make his operation meet the following relations: U E 0 E = 0 e 0 , U E 1 E = 1 e 1 , U E + E = + e + , U E − E = − e − . (10)

We can infer β 0 e 01 = 0 , α 1 e 10 = 0 , α 0 e 00 + α 1 e 10 − β 0 e 01 − β 1 e 11 = 0 , α 0 e 00 − α 1 e 10 + β 0 e 01 − β 1 e 11 = 0 . (11)

Here, 0 denotes a column zero vector.

Then, the deduced results are as follows: α 1 = β 0 = 0 , α 0 = β 1 = 1 . (12)

From Eq. 12, we can create Eq. 13: e 00 = e 11 . (13)

In this way, the final results can be deduced as the following, Eq. 14: U E 0 E = 0 e 00 = 0 e 11 , U E 1 E = 1 e 11 = 1 e 00 . (14)

So, B o b i cannot distinguish 0 , 1 without introducing an error. Once errors are found in the eavesdropping checks, Alice will abort the protocol, and B o b i will obtain no information about Alice’s secret.

Two or more dishonest participants may try to steal other participants’ secret shadows by stealing their private keys. First, we assume that B o b i − 1 and B o b i + 1 are the ones who start the collusion attack to obtain B o b i ’s private key. After receiving the sequence S i − 1 , B o b i − 1 prepares fake particles and then sends the fake sequence to B o b i . Then B o b i inserts his particles into the fake sequence and sends it to B o b i + 1 . B o b i − 1 and B o b i + 1 try to perform measurement on the new sequence to steal B o b i ’s private key. Neither B o b i − 1 nor B o b i + 1 knows the positions of B o b i ’s particles because the order is disrupted after B o b i inserts his particles. That means it is impossible for B o b i + 1 to distinguish B o b i ’s particles from the fake particles after measuring all the particles with Z basis. So B o b i + 1 cannot obtain B o b i ′ s private key without being detected in Step 6. If dishonest participants cannot pass through Alice’s check, Alice will not declare K A . As a result, dishonest participants cannot get any information about B o b i ′ s secret shadow.

Subsequently, we will discuss the situation where B o b 1 , B o b 2 , … , a n d B o b i − 1 and B o b i + 1 , B o b i + 2 , … , a n d B o b t cooperate to steal B o b i ′ s private key. Because of the collusion among B o b 1 , B o b 2 , … , a n d B o b i − 1 , dishonest participants can master the positions of Alice’s decoy particles in S i − 1 . B o b i − 1 prepares a fake sequence and sends it to B o b i . However, upon receiving the new sequence from B o b i , B o b i + 1 , B o b i + 2 , … , B o b t are unable to know where B o b i inserts his particles. That is, B o b i + 1 , B o b i + 2 , … , B o b t can no longer distinguish B o b i ’s particles from the fake particles. In this case, it is almost impossible for dishonest participants to steal B o b i ’s private key and pass the security check. If the collusion attack is detected, Alice will not declare K A , and dishonest participants cannot get any information about B o b i ′ s secret shadow.

In this section, we prove that the proposed protocol is secure enough to resist measure-resend attack, intercept-resend attack, entangle-measure attack, and collusion attack.

Here, we will give a comparison with some SQSS protocols. The comparison results are displayed in Table 1. The qubit efficiency is defined as η = n / m , where n denotes the number of the useful qubits, and m denotes the number of the qubits transmitted.

In terms of the threshold structure, our protocol is (t, n) threshold protocol. That is, the proposed protocol is more flexible than the (n, n) threshold protocols in Refs. [17, 21, 16, 24]. For quantum resources, all participants in our protocol use single particles, which are easier to prepare than entangled states used in the protocols in Refs. [17, 21, 16]. Furthermore, in our protocol, except for the decoy particles, all particles prepared are used to carry the secret shadows in principle. Thus, the qubit efficiency of our protocol can achieve 100%. Therefore, our protocol has better qubit efficiency than the protocols in Refs. [17, 21, 16]. In summary, our protocol is efficient, and it is more flexible than these protocols.