Quantum Leakage Resilience of Shamir Secret Sharing
Abstract
We initiate the study of quantum leakage resilience of unmodified Shamir secret sharing over prime fields. A well-studied leakage model for Shamir's secret sharing classically is single-bit local leakage from each share. We consider its quantum analogue where, for each party, a local leakage channel takes as input the party's share and outputs a leaked qubit. Without preshared entanglement, we show that the distinguishing advantage is 2−Ω(n) when the threshold rate t/n=τ exceeds τ⋆≈0.73339 by a fixed positive margin. More generally, we allow disjoint entangled blocks of any fixed maximum size where there is no entanglement between different blocks or with the adversary, and each block emits at most a fixed number of qubits. Security holds when the threshold rate is high enough (sufficiently close to one). We then allow a specified set of devices to share entanglement with the adversary. We show that security holds even when a linear number of devices (αn for small α>0) share entanglement with each other and with the adversary for a large enough threshold rate. As a complementary negative result, we also show that even classical single-bit leakage makes Shamir scheme insecure if we allow arbitrarily large entanglement between the leakage devices. A GHZ state shared by exactly t leakage devices makes even classical one-bit leakage insecure, without any entanglement with the adversary. In this attack, each participating device emits only one classical bit, and their joint parity distinguishes any chosen pair of secrets with a constant advantage. Thus, for fixed threshold rates above τ⋆, the maximum number of devices that may share arbitrary entanglement with one another and with the adversary while preserving security is linear in n up to constant factors, although the optimal support fraction remains open.
Related
- Improved Local Leakage Resilience of Shamir Secret Sharing and Worst-Case Optimal Polynomial Intersection
- Quantum Leakage from Shamir Sharing with Correlated Resources
- Quantum secret sharing in a tripartite superconducting network
- Combinatorial aspects of holographic quantum secret sharing
- Traceable Quantum Secret Sharing
BibTeX
@misc{batra2026quantum,
title = {{Quantum Leakage Resilience of Shamir Secret Sharing}},
author = {Rishabh Batra and Fuyuki Kitagawa and Ryo Nishimaki and Takashi Yamakawa},
howpublished = {arXiv},
year = {2026},
month = sep,
doi = {10.48550/arxiv.2609.37276},
eprint = {2609.37276},
archivePrefix = {arXiv},
url = {https://arxiv.org/abs/2609.37276},
note = {CC BY 4.0},
}
RIS
TY - UNPB
TI - Quantum Leakage Resilience of Shamir Secret Sharing
AU - Rishabh Batra
AU - Fuyuki Kitagawa
AU - Ryo Nishimaki
AU - Takashi Yamakawa
PY - 2026
DA - 2026/09/29
PB - arXiv
DO - 10.48550/arxiv.2609.37276
UR - https://arxiv.org/abs/2609.37276
AB - We initiate the study of quantum leakage resilience of unmodified Shamir secret sharing over prime fields. A well-studied leakage model for Shamir's secret sharing classically is single-bit local leakage from each share. We consider its quantum analogue where, for each party, a local leakage channel takes as input the party's share and outputs a leaked qubit. Without preshared entanglement, we show that the distinguishing advantage is 2^−Ω(n) when the threshold rate t/n=τ exceeds τ_⋆≈0.73339 by a fixed positive margin. More generally, we allow disjoint entangled blocks of any fixed maximum size where there is no entanglement between different blocks or with the adversary, and each block emits at most a fixed number of qubits. Security holds when the threshold rate is high enough (sufficiently close to one). We then allow a specified set of devices to share entanglement with the adversary. We show that security holds even when a linear number of devices (αn for small α>0) share entanglement with each other and with the adversary for a large enough threshold rate. As a complementary negative result, we also show that even classical single-bit leakage makes Shamir scheme insecure if we allow arbitrarily large entanglement between the leakage devices. A GHZ state shared by exactly t leakage devices makes even classical one-bit leakage insecure, without any entanglement with the adversary. In this attack, each participating device emits only one classical bit, and their joint parity distinguishes any chosen pair of secrets with a constant advantage. Thus, for fixed threshold rates above τ_⋆, the maximum number of devices that may share arbitrary entanglement with one another and with the adversary while preserving security is linear in n up to constant factors, although the optimal support fraction remains open.
ER -