Beating the Fault-Tolerance Bound and Security Loopholes for Byzantine Agreement with a Quantum Solution

Beating the Fault-Tolerance Bound and Security Loopholes for Byzantine Agreement with a Quantum Solution

PDF

Chen-Xun Weng¹, Rui-Qi Gao¹, Yu Bao¹, Bing-Hong Li¹, Wen-Bo Liu¹, Yuan-Mei Xie¹, Yu-Shuo Lu¹, Hua-Lei Yin¹^,²^,^*, Zeng-Bing Chen¹^,^*

Research. Vol 6 Article ID 0272

Less

Research. Vol 6 Article ID 0272

• Research Article •

Beating the Fault-Tolerance Bound and Security Loopholes for Byzantine Agreement with a Quantum Solution

Full

Chen-Xun Weng¹, Rui-Qi Gao¹, Yu Bao¹, Bing-Hong Li¹, Wen-Bo Liu¹, Yuan-Mei Xie¹, Yu-Shuo Lu¹, Hua-Lei Yin¹^,²^,^*, Zeng-Bing Chen¹^,^*

Affiliations

¹National Laboratory of Solid State Microstructures and School of Physics, Collaborative Innovation Center of Advanced Microstructures, Nanjing University, Nanjing 210093, China.

²Department of Physics and Beijing Key Laboratory of Opto-electronic Functional Materials and Micro-nano Devices, Key Laboratory of Quantum State Construction and Manipulation (Ministry of Education), Renmin University of China, Beijing 100872, China.

About Author:

^† These authors contributed equally to this work.

Published: 2023-11-20 doi: 10.34133/research.0272

Outline

Abstract

Less

Byzantine agreement, the underlying core of blockchain, aims to make every node in a decentralized network reach consensus. Classical Byzantine agreements unavoidably face two major problems. One is 1/3 fault-tolerance bound, which means that the system to tolerate f malicious players requires at least 3f + 1 players. The other is the security loopholes from its classical cryptography methods. Here, we propose a Byzantine agreement framework with unconditional security to break this bound with nearly 1/2 fault tolerance due to multiparty correlation provided by quantum digital signatures. It is intriguing that quantum entanglement is not necessary to break the 1/3 fault-tolerance bound, and we show that weaker correlation, such as asymmetric relationship of quantum digital signature, can also work. Our work strictly obeys two Byzantine conditions and can be extended to any number of players without requirements for multiparticle entanglement. We experimentally demonstrate three-party and five-party consensus for a digital ledger. Our work indicates the quantum advantage in terms of consensus problems and suggests an important avenue for quantum blockchain and quantum consensus networks.

Cite this Article

Chen-Xun Weng, Rui-Qi Gao, Yu Bao, Bing-Hong Li, Wen-Bo Liu, Yuan-Mei Xie, Yu-Shuo Lu, Hua-Lei Yin, Zeng-Bing Chen. Beating the Fault-Tolerance Bound and Security Loopholes for Byzantine Agreement with a Quantum Solution[J]. Research, 2023 , 6 (11) : 0272 - . DOI: 10.34133/research.0272

Full Text

Less

Introduction

Less

Byzantine agreement requires solving the fundamental consensus problem initially posed in 1982 known as the Byzantine Generals Problem, which can ensure the smooth functioning of a decentralized system under the attacks of malicious players [1,2]. This problem can be translated into a “commanding general-lieutenants” model, where the commanding general is randomly selected from among all the Byzantine generals and the others become lieutenants to reach consensus on the commanding's order (see Supplementary Materials Section A for details). For a strict Byzantine agreement, there are two necessary interactive consistency (IC) Byzantine conditions. The first is that all loyal lieutenants obey the same order (IC₁), and the second is that every loyal lieutenant obeys the order of the commanding general if the commanding general is loyal (IC₂). Only when both conditions are satisfied can the system reach consensus. For an N-party system, however, classical Byzantine agreement (CBA) protocols [3–9] that tolerate f malicious players require N ≥ 3f + 1 players; namely, the fault-tolerance bound is 1/3 [10–13]. Thus, the three-party consensus problem is naturally unsolvable for CBA even using the authentication classical channel [14]. The other issue is the security loopholes of CBA’s widely used public-key encryption and one-way hash function [15], which are seriously threatened by quantum computing [16–25].

Quantum Byzantine agreement (QBA) is a promising approach for consensus problems. For three-party consensus, the first quantum solution using three-qutrit singlet states was proposed in 2001 [26] and was experimentally demonstrated using four-photon polarization-entangled states in 2008 [27]. This protocol and its subsequent protocols [28–32] using some special entanglement, called detectable QBA framework, unavoidably weaken the two original Byzantine conditions with extra assumptions, which leads to a certain probability of aborting the protocol. More seriously, these rudimentary solutions are restricted to the three-party scenario and can only reach a one-bit message consensus [26,27,29–32]. Some achievements have been made toward scalable multiparty QBA [33–36], but their fault tolerance is 1/3. In addition, QBA protocols require sophisticated techniques, such as multiparticle entanglement generation and distribution and entanglement swapping, which are difficult for practical implementations. Furthermore, the security of detectable QBA has not been proven rigorously [37,38].

Intriguingly, quantum entanglement is not necessary to break the 1/3 fault-tolerance bound and weaker correlation can also work. Here, different from detectable QBA, we propose a strict information-theoretical secure Byzantine agreement framework that exploits the recursion structure [39] and quantum digital signatures (QDS) [40–42] to address the limitation of fault-tolerance bound and security loopholes (see Table 1). It completely breaks the 1/3 fault-tolerance bound with a fault tolerance of N ≥ 2f + 1, ∀ f ∈ ℕ⁺ while strictly obeying IC₁ and IC₂ due to multiparty correlation provided by QDS. Our work is highly adaptable, because it can be achieved by any type of QDS, including the original proposal of GC01-QDS [40] and its variants such as orthogonal encoding [43–51] and non-orthogonal encoding [52–55], and OTUH-type QDS [56,57]. As QDS advances by leaps and bounds, it only requires coherent states instead of complex multiparticle entanglement and quantum memory [41,43,52]. Generating and maintaining entanglement is a sticking point in experimental setups, and the ability to relax this requirement can reduce the complexity of consensus systems and serve as a foundation for further research. Furthermore, our protocol is able to achieve consensus on multiple messages. In addition, we implement proof-of-principle experiments of the three-party and five-party consensus with three different QDS protocols, BB84 GC01-QDS [43], OTUH-QDS [56], and OTUH-QDS without perfect keys [57].

Results

Less

Protocol definition

Before stating our QBA framework, we introduce the multicast round. In a multicast round with n players, there is a primary, and the others are backups. The primary multicasts his or her message to the backups by the following operation, as shown in Fig. 1. One of the backups is selected as the forwarder, and the other unchosen backups become verifiers. The primary, the forwarder, and one of the verifiers perform a three-party QDS to transmit the message. QDS is divided into two stages—distribution and messaging stage. The distribution stage is to distribute correlated quantum keys to the players. The messaging stage uses some classical operations and quantum keys to complete digital signatures. The messaging stage contains three steps: signing, forwarding, and verification. The primary signs the message and then sends the message and corresponding signature to the forwarder. After that, the forwarder will forward the message and signature to the verifier. Only when both the forwarder and verifier accept the signature, the signing is successful, i.e., the primary cannot deny the fact that she signed the message (nonrepudiation), and the message cannot be forged by others including the forwarder (unforgeability) (see Materials and Methods for details). For a chosen forwarder, the verifiers take turns participating in such three-party QDS. The above process will be repeated until all backups have acted as the forwarder one time. In the end, each backup records a list of n − 1 messages, consisting of one message directly received from the primary and n − 2 messages forwarded by other backups. We call this list of messages broadcasting list in the later. Note that a complete multicast round consists of three steps: (1) sign and multicast, (2) forward, and (3) verify and record.

Generally, our QBA framework consists of two phases, namely, broadcasting phase and gathering phase. Suppose there is a system of total N players including f malicious ones. The commanding general (initial primary) is denoted as S, and the lieutenants are denoted as R_i, for i = 1, 2, ⋯, N − 1. The flow chart of the two phases is shown in Table 2. The broadcasting phase is designed for R_i to exchange the message received from S with each other, and the gathering phase is designed for R_i to deduce the original message of S according to the information gathered by themselves.

Broadcasting phase. The broadcasting phase consists of successive multicast rounds. For clarity, we denote the multicast round as

M R ζ d

, where ζ represents the route of delivering the message and d is the depth of the multicast round. The first multicast round started by the commanding general S is denoted as

M R S 1

. In

M R S 1

, S signs and then multicasts his message

m S 1

to all the lieutenants R_i. In the multicast round of next depth,

M R S → R i 2

, R_i acts as a primary, and then signs and multicasts the message

m S → R i 2

, which is he received from S, to the other lieutenants. The process will be repeated until d = f. We denote a list for the lieutenants R_i to record the messages received by him in

M R ζ d

as aforementioned broadcasting list

B ζ d, R i

In the broadcasting phase, the consistency check occurs between step 1 and step 3. Consider a general case: In

M R ζ d

, the primary signs and multicasts the message

m ζ d

to the backups, assuming that R_j acts as the forwarder and R_k acts as a verifier. In the multicast round at next depth d + 1,

M R ζ → R j d + 1

, R_j will act as a primary and R_k will act as the forwarder. The messages R_j delivers to R_k in the two rounds,

M R ζ d

and

M R ζ → R j d + 1

, must be consistent, because R_k can check the consistency of the two messages. If the two messages are inconsistent, R_k will reject them and ask R_j to repeat the process until the two messages are consistent.

Gathering phase. The deterministic function we used in the gathering phase is called the majority function. It outputs the value of the majority element in the input set (see Materials and Methods). In

M R ζ d

, the gathering list held by the lieutenant R_i, denoted as

G ζ d, R i

, is used for R_i to deduce the message delivered by the primary of

M R ζ d

. In the bottom layer d = f, R_i directly sets his or her own gathering list to

G ζ f, R i = B ζ f, R i

and outputs

m ζ f, R i = majority G ζ f, R i

. Then,

m ζ f, R i

becomes an element of the gathering list of d = f − 1. Considering general case where 1 ≤ d < f, all elements of R_i’s gathering list

G ζ d, R i

are deduced from the lists

G ζ → R p d + 1, R i

in multicast round

M R ζ → R p d + 1

(R_p visits all players who do not appear in route ζ). When p = i, this element is directly set as the message that R_i directly received from the primary in

M R ζ d

. With the recursive process, the gathering phase ends up when d = 1, and then R_i outputs

m S 1, R i = majority G S 1, R i

as the final decision. Note that the broadcasting lists record the messages that are the lieutenants themselves actually received during the broadcast phase, and the gathering lists record the messages that are the lieutenants deduced according to the information of the previous depth. Only when d = f, the gathering lists are the same as the broadcasting lists, i.e.,

G ζ f, R i = B ζ f, R i

Experimental implementation

We show proof-of-principle experimental implementation of our QBA framework for reaching consensus on a decentralized digital ledger, one of the most important application of blockchain. The digital ledger is a 1.10-MB document that is a virtual transaction including time, clients, merchants, commodity, and the amount. It is converted into a binary string of bits. We denote the correct message as m1, and the incorrect messages as m2, m3, and so on.

To show a high degree of adaptability of our work, we implement three-party consensus with single-bit GC01-QDS [43], one-time universal₂ hashing (OTUH) QDS [56], and OTUH-QDS without perfect keys [57], respectively (see Supplementary Materials Section B for details). In addition, we utilize OTUH-QDS to realize the five-party consensus. The key idea of single-bit GC01-QDS is to first generate two pairs of raw quantum keys and then exchange half of the Bob’s and Charlie’s quantum keys with each other, which is called symmetrization step, to construct the correlation. On the contrary, OTUH-QDS is to first construct the three-party correlation X_a = X_b ⊕ X_c and Y_a = Y_b ⊕ Y_c among the quantum keys of Alice (signer), Bob (forwarder), and Charlie (verifier). Alice signs the message with X_a and Y_a, and then Bob and Charlie exchange their keys to complete the verification. These correlated raw quantum keys can be achieved by any quantum key generation process [58–67]. Here, we utilize four-intensity decoy-state BB84 key generation process for the three QDS protocols [58].

There are five independent players S and R_i (i = 1, 2, 3, 4). The correlated quantum keys of different pairwise players are pre-distributed in the laboratory via fiber spool, i.e., the distribution stage of QDS is completed in the laboratory. They do not disclose any information of their own quantum keys to others, and then bring the keys to five different buildings in Fig. 2 to simulate the real-life situation where the users are geographically separated, and then use these quantum keys to complete digital signatures, i.e., classical operations of the messaging stage are performed in the real locations. Note that, to simplify the proof-of-principle experiment, we employ the above method due to the immaturity of real-life multi-node quantum networks. It is anticipated that as quantum networks progress in maturity, enabling their widespread deployment and utilization, our QBA framework can be seamlessly integrated into practical quantum networks without the necessity of laboratory-based quantum key preparation.

S, R₁, and R₂ perform three-party consensus, and all the five players perform five-party consensus. According to IC₁ and IC₂, we consider whether S is honest or not. Here, we exemplify the three-party and five-party consensus in Fig. 3. Moreover, we show the consensus rates of our QBA framework when adopting these three QDS in Table 3. OTUH-QDS, which can sign a multi-bit message each time, leads to much higher efficiency of QBA framework that the system can reach consensus 11.95 times per second, while single-bit GC01-QDS only reaches 4.5 × 10⁻⁸ times consensus per second under the same security parameter (see Supplementary Materials Section D for calculation details).

(a) The commanding general S is honest in three-party consensus. There is only one malicious player R₂ and thus only one layer d = 1 in the three-party consensus. In

M R S 1

, S sends correct message m1 via multicasting. R₁ records m1 when he acts as a forwarder, and records m1 received from R₂ when he acts as a verifier. The malicious R₂ must honestly forward m1 when he acts as a forwarder due to the unforgeability of QDS. Hence, as shown in Fig. 3A, the gathering list of honest R₁, which is also the broadcasting list, is

G S 1, R 1 = B S 1, R 1 = m 1, m 1

. The final output of R₁ is

m S 1, R 1 = majority G S 1, R 1 = m 1

, which is consistent with the message sent by honest S. That satisfies IC₁.

(b) The commanding general S is dishonest in three-party consensus. There is only one malicious player S. In

M R S 1

, S sends conflicting messages m1 and m2 to honest R₁ and R₂, respectively. R₁ records m1 when he acts as a forwarder, and records m2 received from R₂ when he acts as a verifier. R₂ records m2 when he acts as a forwarder, and records m1 received from R₁ when he acts as a verifier. Hence, as shown in Fig. 3B, the gathering list of honest R₁, which is also the broadcasting list, is

G S 1, R 1 = B S 1, R 1 = m 1, m 2

. The gathering list of honest R₂ is

G S 1, R 2 = B S 1, R 2 = m 1, m 2

, which is the same as that of R₁. The final outputs of R₁ and R₂ are both

m S 1, R 1 = m S 1, R 2 = majority m 1, m 2 = Δ

. Although the dishonest primary S sends conflicting messages, honest R₁ and R₂ obtain the same output Δ. That satisfies IC₂.

(c) The commanding general S is honest in five-party consensus. There are two malicious players R₃ and R₄ (f = 2), and there are two layers d = 1 and d = 2 in five-party consensus.

Broadcasting phase. At depth d = 1, in

M R S 1

, S broadcasts the correct message m₁ via multicast process. In

M R S 1

, every one must forward the correct message m₁ to honest players because S is honest and there are two honest players in QDS. Therefore, the broadcasting lists of honest R₁ and R₂ are both

B S 1, R 1 = B S 1, R 2 = m 1, m 1, m 1, m 1

(see Fig. 3C).

The results of the multicast processes at depth d = 2 are shown in Fig. 3D. In

M R S → R 1 2

, because of the honest primary R₁ and Lemma 1 (see Materials and Methods for two lemmas), every one must forward the correct message m₁, and the broadcasting list of honest R₂ is

B S → R 1 2, R 2 = m 1, m 1, m 1

. In

M R S → R 2 2

, because of the honest primary R₂ and Lemma 1, every one must forward the correct message m1, and the broadcasting list of honest R₁ is

B S → R 2 2, R 1 = m 1, m 1, m 1

. In

M R S → R 3 2

, because of the dishonest primary R₃ and Lemma 2, only when dishonest R₃ and R₄ collude together can R₄ successfully forward the conflicting message m2 to honest players. The broadcasting lists of honest R₁ and R₂ are both

B S → R 3 2, R 1 = B S → R 3 2, R 2 = m 1, m 1, m 2

. Similar to the analysis of

M R S → R 3 2

, only when dishonest R₃ and R₄ collude together, R₄ can successfully forward the conflicting message m₂ to honest players. The broadcasting lists of honest R₁ and R₂ are both

B S → R 3 2, R 1 = B S → R 3 2, R 2 = m 1, m 1, m 3

Gathering phase. At the bottom depth d = 2, each player obtains the initial gathering lists

G ζ 2, R i = B ζ 2, R i

For R₁ at depth d = 2,

G S → R 2 2, R 1 = B S → R 2 2, R 1 = m 1, m 1, m 1, G S → R 3 2, R 1 = B S → R 3 2, R 1 = m 1, m 1, m 2, G S → R 4 2, R 1 = B S → R 4 2, R 1 = m 1, m 1, m 3, m S → R 1 2, R 1 = m 1, m S → R 2 2, R 1 = majority G S → R 2 2, R 1 = m 1, m S → R 3 2, R 1 = majority G S → R 3 2, R 1 = m 1, m S → R 4 2, R 1 = majority G S → R 4 2, R 1 = m 1,

(1)

where the message

m S → R 1 2, R 1

is directly received from S when R₁ acts as the forwarder. R₁ deduced that

m S → R 2 2, R 1

is the message that R₂ received from S,

m S → R 3 2, R 1

is the message that R₃ received from S, and

m S → R 4 2, R 1

is the message that R₄ received from S. Then,

m S → R 1 2, R 1

m S → R 2 2, R 1

m S → R 3 2, R 1

, and

m S → R 4 2, R 1

constitute the gathering list of R₁ at depth d = 1, where

G S 1, R 1 = m S → R 1 2, R 1, m S → R 2 2, R 1, m S → R 3 2, R 1, m S → R 4 2, R 1 = m 1, m 1, m 1, m 1

. Thus, at depth d = 1, R₁ obtains the final output

m S 1, R 1 = majority G S 1, R 1 = majority m 1, m 1, m 1, m 1 = m 1 .

(2)

For R₂ at depth d = 2,

G S → R 1 2, R 2 = B S → R 1 2, R 2 = m 1, m 1, m 1, G S → R 3 2, R 2 = B S → R 3 2, R 2 = m 1, m 1, m 2, G S → R 4 2, R 2 = B S → R 4 2, R 2 = m 1, m 1, m 3, m S → R 1 2, R 2 = majority G S → R 1 2, R 2 = m 1, m S → R 2 2, R 2 = m 1, m S → R 3 2, R 2 = majority G S → R 3 2, R 2 = m 1, m S → R 4 2, R 2 = majority G S → R 4 2, R 2 = m 1,

(3)

where the message

m S → R 2 2, R 2

is directly received from S when R₂ acts as the forwarder. R₂ deduced that

m S → R 1 2, R 2

is the message that R₁ received from S,

m S → R 3 2, R 2

is the message that R₃ received from S, and

m S → R 4 2, R 2

is the message that R₄ received from S. Then,

m S → R 1 2, R 2

m S → R 2 2, R 2

m S → R 3 2, R 2

, and

m S → R 4 2, R 2

constitute the gathering list of R₂ at depth d = 1, where

G S 1, R 2 = m S → R 1 2, R 2, m S → R 2 2, R 2, m S → R 3 2, R 2, m S → R 4 2, R 2 = m 1, m 1, m 1, m 1

. Thus, at depth d = 1, R₂ obtains the final output

m S 1, R 2 = majority G S 1, R 2 = majority m 1, m 1, m 1, m 1 = m 1 .

(4)

The final outputs of R₁ and R₂ are both

m S 1, R 1 = m S 1, R 2 = m S 1, R 1 = m S 1, R 2 = majority m 1, m 1, m 1 m 1 = m 1

, which is consistent with the initial message sent by the honest primary S. This result satisfies IC₁.

(d) The commanding general S is dishonest in five-party consensus. There are two malicious players S and R₄ (f = 2), and there are two layers d = 1 and d = 2 in five-party consensus.

Broadcasting phase. At depth d = 1, in

M R S 1

, the dishonest primary S can broadcast the different messages m1, m2, and m3 to honest R₁, R₂, and R₃, respectively, via multicast process. Additionally, due to Lemma 2, malicious S and R₄ can collude together and then R₄ can deliberately forward different messages m4₁, m4₂, and m4₃ to honest R₁, R₂, and R₃, respectively. Therefore, the broadcasting lists of honest R₁, R₂, and R₃ are

B S 1, R 1 = m 1, m 2, m 3, m 41

B S 1, R 2 = m 1, m 2, m 3, m 42

, and

= B S 1, R 3 = m 1, m 2, m 3, m 43

, respectively (see Fig. 3E).

The results of the multicast processes at depth d = 2 are shown in Fig. 3F. In

M R S → R 1 2

, because of the honest primary R₁ and Lemma 1, every one must forward R₁’s message m₁, and the broadcasting lists of honest R₂ and R₃ are both

B S → R 1 2, R 2 = B S → R 1 2, R 3 = m 1, m 1, m 1

. In

M R S → R 2 2

, because of the honest primary R₂ and Lemma 1, every one must forward R₁’s message m2, and the broadcasting lists of honest R₁ and R₃ are both

B S → R 2 2, R 1 = B S → R 2 2, R 3 = m 2, m 2, m 2

. In

M R S → R 3 2

, because of the honest primary R₂ and Lemma 1, every one must forward R₃’s message m3, and the broadcasting lists of honest R₁ and R₂ are both

B S → R 3 2, R 1 = B S → R 3 2, R 2 = m 3, m 3, m 3

. In

M R S → R 4 2

, because the dishonest primary R₄ can successfully broadcast the conflicting messages m4₁, m4₂, and m4₃ to honest players R₁, R₂, and R₃, respectively. The broadcasting lists of honest R₁, R₂, and R₃ are all

B S → R 4 2, R 1 = B S → R 4 2, R 2 = B S → R 4 2, R 3 = m 41, m 42, m 43

Gathering phase. At the bottom depth d = 2, each player obtains the initial gathering lists

G ζ 2, R i = B ζ 2, R i

For R₁ at depth d = 2,

G S → R 2 2, R 1 = B S → R 2 2, R 1 = m 2, m 2, m 2, G S → R 3 2, R 1 = B S → R 3 2, R 1 = m 3, m 3, m 3, G S → R 4 2, R 1 = B S → R 4 2, R 1 = m 41, m 42, m 43, m S → R 1 2, R 1 = m 1, m S → R 2 2, R 1 = majority G S → R 2 2, R 1 = m 2, m S → R 3 2, R 1 = majority G S → R 3 2, R 1 = m 3, m S → R 4 2, R 1 = majority G S → R 4 2, R 1 = Δ 1,

(5)

where the message

m S → R 1 2, R 1

is directly received from S when R₁ acts as the forwarder. R₁ deduced that

m S → R 2 2, R 1

is the message that R₂ received from S,

m S → R 3 2, R 1

is the message that R₃ received from S, and

m S → R 4 2, R 1

is the message that R₄ received from S. Then,

m S → R 1 2, R 1

m S → R 2 2, R 1

m S → R 3 2, R 1

, and

m S → R 4 2, R 1

constitute the gathering list of R₁ at depth d = 1, where

G S 1, R 1 = m S → R 1 2, R 1, m S → R 2 2, R 1, m S → R 3 2, R 1, m S → R 4 2, R 1 = m 1, m 2, m 3, Δ 1

. Thus, at depth d = 1, R₁ obtains the final output

m S 1, R 1 = majority G S 1, R 1 = majority m 1, m 2, m 3 Δ 1 = Δ 2 .

(6)

For R₂ at depth d = 2,

G S → R 1 2, R 2 = B S → R 1 2, R 2 = m 1, m 1, m 1, G S → R 3 2, R 2 = B S → R 3 2, R 2 = m 3, m 3, m 3, G S → R 4 2, R 2 = B S → R 4 2, R 2 = m 41, m 42, m 43, m S → R 1 2, R 2 = majority G S → R 2 2, R 2 = m 1, m S → R 2 2, R 2 = m 2, m S → R 3 2, R 2 = majority G S → R 3 2, R 2 = m 3, m S → R 4 2, R 2 = majority G S → R 4 2, R 2 = Δ 1,

(7)

where the message

m S → R 2 2, R 2

is directly received from S when R₂ acts as the forwarder. R₂ deduced that

m S → R 1 2, R 2

is the message that R₁ received from S,

m S → R 3 2, R 2

is the message that R₃ received from S, and

m S → R 4 2, R 2

is the message that R₄ received from S. Then,

m S → R 1 2, R 2

m S → R 2 2, R 2

m S → R 3 2, R 2

, and

m S → R 4 2, R 2

constitute the gathering list of R₂ at depth d = 1, where

G S 1, R 2 = m S → R 1 2, R 2, m S → R 2 2, R 2, m S → R 3 2, R 2, m S → R 4 2, R 2 = m 1, m 2, m 3, Δ 1

. Thus, at depth d = 1, R₂ obtains the final output

m S 1, R 2 = majority G S 1, R 2 = majority m 1, m 2, m 3, Δ 1 = Δ 2 .

(8)

For R₃ at depth d = 2,

G S → R 1 2, R 3 = B S → R 1 2, R 2 = m 1, m 1, m 1, G S → R 2 2, R 3 = B S → R 2 2, R 2 = m 2, m 2, m 2, G S → R 4 2, R 3 = B S → R 4 2, R 2 = m 41, m 42, m 43, m S → R 1 2, R 3 = majority G S → R 2 2, R 3 = m 1, m S → R 2 2, R 3 = majority G S → R 2 2, R 3 = m 2, m S → R 3 2, R 3 = m 3, m S → R 4 2, R 3 = majority G S → R 4 2, R 3 = Δ 1,

(9)

where the message

m S → R 2 2, R 2

is directly received from S when R₃ acts as the forwarder. R₃ deduced that

m S → R 1 2, R 3

is the message that R₁ received from S,

m S → R 2 2, R 3

is the message that R₂ received from S, and

m S → R 4 2, R 3

is the message that R₄ received from S. Then,

m S → R 1 2, R 3

m S → R 2 2, R 3

m S → R 3 2, R 3

, and

m S → R 4 2, R 3

constitute the gathering list of R₃ at depth d = 1, where

G S 1, R 3 = m S → R 1 2, R 3, m S → R 2 2, R 3, m S → R 3 2, R 3, m S → R 4 2, R 3 = m 1, m 2, m 3, Δ 1

. Thus, at depth d = 1, R₃ obtains the final output

m S 1, R 3 = majority G S 1, R 3 = majority m 1, m 2, m 3, Δ 1 = Δ 2 .

(10)

The final outputs of honest R₁, R₂, and R₃ are all

m S 1, R 1 = m S 1, R 2 =

m S 1, R 1 = m S 1, R 2 =

m S 1, R 3 = Δ 2

. Although the dishonest primary S sends conflicting messages, the honest players R₁, R₂, and R₃ obtain the same output Δ₂. This result satisfies IC₂.

In conclusion, our experimental results show that in real three-party and five-party consensus, our protocol can not only satisfy the two original Byzantine conditions IC₁ and IC₂ but also achieve the fault tolerance of N ≥ 2f + 1, which breaks the 1/3 fault-tolerance lower bound.

Discussion

Less

The 1/3 fault-tolerance bound cannot be beaten for any arbitrary pairwise communication [10–13]; not even quantum channels can help solve this problem. If the nodes of a system are linked by the channels that are independent of each other, the bound is unable to be beaten. Intriguingly, when quantum entanglement is introduced into the system, it is possible to surpass this bound because quantum entanglement provides the correlation and removes the independence [26]. Although detectable QBA framework is designed according to multi-particle entanglement [26–32], they cannot extend to more than three participants and unavoidably weaken the Byzantine conditions, because multi-particle entangled states are very hard to prepare and maintain, and these protocols do not fully utilize the correlation to protect the unforgeability and nonrepudiation that leads to a certain probability of failure.

Is quantum entanglement necessary or can weaker multiparty correlation work in Byzantine agreement? Fortunately, QDS is a useful tool for solving this problem due to its asymmetric relationship among three players. In addition, three-party QDS is naturally decentralized due to its structure without a fully trusted third party. The two essential properties of QDS, unforgeability and nonrepudiation, effectively curtail the malevolent activities of malicious players within the system, preventing them from deliberately delivering conflicting messages. Asymmetric relationship of QDS makes the channels no longer independent of each other. Consequently, our protocol can break the 1/3 fault-tolerance bound.

Note that the most important thing to break the fault-tolerance bound is to provide a decentralized multiparty correlation to remove the independence of pairwise channels. Intriguingly, quantum entanglement and asymmetric relationship of QDS both satisfy the above requirement. In addition, if we can find a three-party information-theoretically secure classical digital signature scheme that has the same decentralized structure as QDS [68], our framework can also break the bound. However, up to now, we do not find classical correlation greater than QDS without any additional assumptions because these classical schemes require extra assumptions such as the existence of a trusted third party and authenticated broadcast channels, which disobeys decentralization of Byzantine agreement [69]. By bridging two prominent research themes, the Byzantine agreement and QDS, our work paves the way for practical quantum blockchain and quantum consensus networks.

In the end, we want to highlight that although our QBA framework utilizes QDS, it is still unable to surpass the famous blockchain trilemma (see Materials and Methods).The blockchain trilemma highlights the intricate balance required among three fundamental attributes: decentralization, security, and scalability. Within our QBA framework, we have achieved notable success in security, surpassing the 1/3 fault-tolerance bound while maintaining information-theoretical security. Moreover, our approach has full decentralization. However, it falls short in scalability, exhibiting exponential communication complexity, as shown in Eq. 11. Consequently, our research remains bound by the constraints posed by the blockchain trilemma. Intriguing inquiries linger as we ponder the blockchain trilemma’s resilience to quantum resources. Is it an irrefutable theorem or an assailable postulate? The possibility of quantum resources challenging the blockchain trilemma beckons us toward further scholarly exploration.

Materials and Methods

Less

Quantum digital signatures

QDSs with information-theoretical security have two major properties, nonrepudiation and unforgeability. They are all divided into the two stages, distribution stage and messaging stage. The distribution stage is to distribute the correlated raw quantum keys of Alice–Bob and Alice–Charlie for the messaging stage. The correlated quantum keys can be achieved by some classical operations, such as symmetrization step used in CV-QDS [49], BB84 GC01-QDS [43], and MDI-QDS [45,51], test bits used in SARG04-QDS [52,54,55], and secret sharing used in OTUH-QDS [56,57]. The messaging stage is to complete the digital signature to determine whether it is successful or not.

The brief process of messaging stage can be described as follows. Alice is a “signer.” Bob is a “forwarder.” Charlie is a “verifier.” Alice signs a message with her quantum keys and then transmits the message and corresponding signature to Bob. Bob forwards the message and corresponding signature to the verifier Charlie. Then, Bob and Charlie will check the message and corresponding signature, respectively. The process of QDS is successful when and only when both Bob and Charlie accept the message and the corresponding signature. The signature rate, SR, is defined as the number of times the players can perform the QDS per second.

Nonrepudiation. Nonrepudiation refers to a situation in which the signer cannot successfully dispute the authorship of his signature. This means that Alice cannot deny the fact that she signed the message if the signature is accepted by both Bob and Charlie.

Unforgeability. Unforgeability refers to a situation in which no one can forge a message and its corresponding signature. This means that if Bob forwards a forged message and signature, it will be impossible for him to successfully make Charlie accept the forged message and signature.

Majority function

The majority function we apply in our protocol aims to output the element that appears most often for an input set. For example, when the input set is M = {m₁, m₁, m₁, m₂, m₂}, the output will be majority(M) = m₁. In a few cases, more than one element appears most frequently in the input set, and the systems that calculate the majority function on the input set are often deliberately biased toward one of them that we set initially. For example, when the input set is M = {m₁, m₁, m₁, m₂, m₂, m₂}, the output will be majority(M) = m₁ (m₂), which is determined by the biased output m₁ (m₂) that we set before calculation. Note that for the same input sets with different players, the majority function outputs the same value, which we will denote as Δ.

Communication complexity and consensus rate

To measure the consumed resources, we define the number of times the QDS process is implemented to reach consensus as the communication complexity, denoted as C. The total communication complexity of our QBA protocol can be expressed by

C = A N − 1 2 + N − 1 A N − 2 2 + N − 2 A N − 3 2 + ⋯ + N − 1 N − 2 ⋯ N − f + 1 A N − f 2 = ∑ m = 0 f − 1 A N − 1 2 + m,

(11)

where

A a b = a! a − b!

is b-permutations of a, f is the number of dishonest players, and N is the number of all players. Here,

A n − 1 2 + m

represents the communication complexity at depth m + 1. In reality, we need to perform

N − 1 2

recursions for a real-life consensus system with unknown f, where [x] is the greatest integer less than or equal to x.

Consider the simple case that the system uses the QDS protocol, which has the same signature rate, denoted as SR, in all the multicast rounds. We define the consensus rate of our QBA protocol as

CR = SR C = SR ∑ m = 0 f − 1 ‍ A N − 1 2 + m,

(12)

where C is the communication complexity of the system. CR is the important index to indicate the efficiency of QBA. To get the higher consensus rate, we need to adopt the QDS protocol that has the higher signature rate. We can find that as the total number of players and the number of malicious players increase, the communication complexity will increase, which leads to the decrease of the consensus rate.

Two important lemmas in security analysis

In our protocol, the performance of honest (dishonest) players follows the same rule. Therefore, the players can be divided into two groups, the honest and dishonest. Also, the elements of a gathering list can be divided in the same way. Therefore, we can simplify the protocol with a perfect binary tree model where one tree node represents the set of multicast rounds with honest or dishonest primaries. The left (right) child tree node represents the multicast rounds with honest (dishonest) primaries of the next depth. In what follows, when we say a tree node is honest (dishonest), it means that the primaries in this tree node is honest (dishonest). We can obtain the important Lemma 1 and Lemma 2. The proofs for two lemmas and complete security analysis for our protocol can be found in Supplementary Materials Section C in detail.

Lemma 1: Suppose that B is a right child tree node of a parent node A who is honest, and C is the left child tree node of B. The messages delivered in C are consistent with those of A, which protects the consistency of the delivered messages.

Lemma 2: Suppose that B is a right child tree node of a parent node A who is honest, and E is the right child tree node of B. The message multicast in E can be inconsistent with those of A, which disrupts the consistency of the delivered messages.

Experimental setting

The master laser generates phase-randomized 1.6-ns-wide laser pulses with a repetition rate of 100 MHz at 1550.12 nm. The system frequency is 100 MHZ, but due to the 400-ns dead time every 10 us, the effective frequency of optical pulse is 96 MHz. Two pairs of pulses with relative phases 0 and π at a 2-ns time delay generated by an asymmetric interferometer are injected into two slave lasers through the optical circulator, respectively. By controlling the trigger electrical signal of two slave lasers, Alice randomly prepares quantum states in the Z (time) and X (phase) bases by using 400-ps-wide slave laser pulses. The programmable delay chip with a 10-ps timing resolution is used to calibrate the time consistency. The spectral consistency is naturally satisfied because of the laser seeding technique [70]. A 50-GHz nominal bandwidth fiber Bragg grating is used to remove extra spurious emission and precompensate for the pulse broadening in the fiber transmission. The 2-ns-wide synchronization pulses with repetition rates of 100 kHz are transmitted via the quantum channel using multiplexed wavelength division. The intensities are set as μ = 0.40, ν = 0.20, ω = 0.4, and 0 with the corresponding probabilities p_μ = 0.60, p_ν = 0.20, p_ω = 0.15, and p₀ = 0.05, respectively. If trigger signal is not provided to the slave laser, the vacuum state is generated. The amplitude modulator generates two different intensities, and the intensity of ω is double that of ν (ω = 2ν) since it has two pulses in the X basis. At the receiving end, a 30:70 biased beam splitter is used to perform passive basis detection after a wavelength division demultiplexer. A probability of 30% is measured in the phase basis, and the probability of 70% is used to receive in the time basis. A Faraday–Michelson interferometer is used for the phase measurement, in which phase drift is compensated in real time by using the phase shifter. The total insertion losses of the time and phase bases are 4.25 and 8 dB, respectively. The efficiency of single-photon detectors is 20% at a 160 dark count per second. To decrease the after-pulse probability, we set the dead times to 10 μs for the links.

Blockchain trilemma

Blockchain possesses three crucial attributes: decentralization, security, and scalability. Decentralization forms the fundamental core of blockchain technology, emphasizing its inherent nature. Security stands as a paramount concern in any blockchain system, while scalability presents a formidable challenge. However, the blockchain trilemma emerges from the inherent difficulty of achieving a harmonious balance among these three essential elements. Blockchains are often forced to make trade-offs that prevent them from achieving all the three aspects. Note that the trilemma is just a model to conceptualize the various challenges facing blockchain technology. There is no strict proof that the three aspects cannot be achieved. However, to date, there are no protocols able to break down the trilemma. The design needs to weaken the requirements for a certain feature.

Funding

Less

National Natural Science Foundation of China(12274223)
Natural Science Foundation of Jiangsu Province(BK20211145)
Fundamental Research Funds for the Central Universities(020414380182)
Key Research and Development Program of Nanjing Jiangbei New Area(ZDYD20210101)
Program for Innovative Talents and Entrepreneurs in Jiangsu(JSSCRC2021484)

References

Less

Lamport

, Shostak

, Pease

. The Byzantine Generals Problem. ACM Trans Program Lang Syst. 1982;4:382–401.

Extance

. The future of cryptocurrencies: Bitcoin and beyond. Nature. 2015;7571(526):21–23.

Castro M, Liskov B. Practical Byzantine fault tolerance. In: OSDI Vol. 99. 1999:173–86.

Castro

, Liskov

. Practical Byzantine fault tolerance and proactive recovery. ACM Trans Comput Syst. 2002;20:398–461.

Aublin PL, Mokhtar SB, Quéma V. RBFT: Redundant Byzantine fault tolerance. Paper presented at: 2013 IEEE 33rd International Conference on Distributed Computing Systems; 2013; Philadelphia, PA, USA.

Miller A, Xia Y, Croman K, Shi E, Song D. The honey badger of BFT protocols. Paper presented at: Proceedings of the 2016 ACM SIGSAC Conference on Computer and Communications Security. CCS ’16. Association for Computing Machinery; 2016; New York, NY, USA.

Yin M, Malkhi D, Reiter MK, Gueta GG, Abraham I. HotStuff: BFT consensus with linearity and responsiveness. Paper presented at: Proceedings of the 2019 ACM Symposium on Principles of Distributed Computing. PODC ’19. Association for Computing Machinery; 2019; New York, NY, USA.

Guo B, Lu Z, Tang Q, Xu J, Zhang Z. Dumbo: Faster asynchronous BFT protocols. Paper presented at: Proceedings of the 2020 ACM SIGSAC Conference on Computer and Communications Security. CCS ’20. Association for Computing Machinery; 2020:803–818.

Lu Y, Lu Z, Tang Q, and Wang G. Dumbo-MVBA: Optimal multi-valued validated asynchronous Byzantine agreement, revisited. Paper presented at: Proceedings of the 39th Symposium on Principles of Distributed Computing. PODC ’20. Association for Computing Machinery; 2020; New York, NY, USA.

10.

Pease

, Shostak

, Lamport

. Reaching agreement in the presence of faults. J ACM. 1980;27:228–234.

11.

Dolev

, Halpern

, Strong

. On the possibility and impossibility of achieving clock synchronization. J Comput Syst Sci. 1986;32:230–250.

12.

Fischer

, Lynch

, Merritt

. Easy impossibility proofs for distributed consensus problems. Distrib Comput. 1986;1:26–39.

13.

Fitzi M, Garay J, Maurer U, Ostrovsky R. Advances in Cryptology-CRYPTO 2001: Proceedings of the 21-st Annual International Cryptology Conference, Santa Barbara, CA, 2001. Lecture Notes in Computer Science (Springer, Berlin, New York, 2001).

14.

Kiktenko

, Pozhar

, Anufriev

. Quantum-secured blockchain. Quant Sci Technol. 2018;3(3):Article 035004.

15.

Menezes AJ, Van Oorschot PC, Vanstone SA. Handbook of applied cryptography. Boca Raton (FL): CRC Press; 2018.

16.

Shor P. Algorithms for quantum computation: Discrete logarithms and factoring. Paper presented at: Proceedings 35th Annual Symposium on Foundations of Computer Science; 1994; Santa Fe, NM, USA.

17.

Grover

. Quantum mechanics helps in searching for a needle in a haystack. Phys Rev Lett. 1997;79(2):325.

18.

Arute

, Arya

, Babbush

, Bacon

, Bardin

, Barends

, Biswas

, Boixo

, Brandao

FGSL

, Buell

, et al.Quantum supremacy using a programmable superconducting processor. Nature. 2019;574(7779):505–510.

19.

Fedorov

, Kiktenko

, Lvovsky

. Quantum computers put blockchain security at risk. Nature. 2018;563(7732):465–467.

20.

Wei

, Li

, Long

. A full quantum eigensolver for quantum chemistry simulations. Research. 2020;2020:1486935.

21.

Fernández-Caramès

, Fraga-Lamas

. Towards post-quantum blockchain: A review on blockchain cryptography resistant to quantum computing attacks. IEEE Access. 2020;8:21091–21116.

22.

Zhou

, Cao

, Lu

, Wang

, Bao

, Jia

, Fu

, Yin

, Chen

. Experimental quantum advantage with quantum coupon collector. Research. 2022;2022:9798679.

23.

Huang S, Yin HL, Chen ZB, Wu S. Quantum-accelerated algorithms for generating random primitive polynomials over finite fields. arXiv preprint arXiv:2203.12884. 2022.

24.

Pan

, Chen

, Sun

, Zhang

. Electric-circuit realization of fast quantum search. Research. 2021;2021:9793071.

25.

Long

. Toward applications of cloud quantum computation. Sci Chin Phys Mech Astron. 2022;65:Article 110361.

26.

Fitzi

, Gisin

, Maurer

. Quantum solution to the Byzantine agreement problem. Phys Rev Lett. 2001;87(21):Article 217901.

27.

Gaertner

, Bourennane

, Kurtsiefer

, Cabello

, Weinfurter

. Experimental demonstration of a quantum protocol for Byzantine agreement and liar detection. Phys Rev Lett. 2008;100(7):070504.

28.

Fitzi M, Gottesman D, Hirt M, Holenstein T, Smith A. Detectable Byzantine agreement secure against faulty majorities. Paper presented at: Proceedings of the Twenty-First Annual Symposium on Principles of Distributed Computing; 2002; New York, NY, USA.

29.

Iblisdir

, Gisin

. Byzantine agreement with two quantum-key-distribution setups. Phys Rev A. 2004;70(3):034306.

30.

Neigovzen

, Rodó

, Adesso

, Sanpera

. Multipartite continuous-variable solution for the Byzantine agreement problem. Phys Rev A. 2008;77(6):062307.

31.

Rahaman

, Wieśniak

, Żukowski

. Quantum Byzantine agreement via Hardy correlations and entanglement swapping. Phys Rev A. 2015;92(4):042302.

32.

Smania

, Elhassan

, Tavakoli

, Bourennane

. Experimental quantum multiparty communication protocols. npj Quantum Inf. 2016;2:16010.

33.

Ben-Or M, Hassidim A. Fast quantum Byzantine agreement. In: Proceedings of the Thirty-Seventh Annual ACM Symposium on Theory of Computing. New York (NY): Association for Computing Machinery, 2005:481–485.

34.

Taherkhani

, Navi

, Van Meter

. Resource-aware system architecture model for implementation of quantum aided Byzantine agreement on quantum repeater networks. Quantum Sci Technol. 2018;3(1):Article 014011.

35.

Sun

, Kulicki

, Sopek

. Multi-party quantum Byzantine agreement without entanglement. Entropy. 2020;22(10):1152.

36.

Wang

, Yu

, Du

. Quantum blockchain based on asymmetric quantum encryption and a stake vote consensus algorithm. Sci Rep. 2022;12(1):8606.

37.

Gao

, Guo

, Wen

, Zhu

. Comment on “Experimental demonstration of a quantum protocol for Byzantine agreement and liar detection”. Phys Rev Lett. 2008;101(20):Article 208901.

38.

Gaertner

, Bourennane

, Kurtsiefer

, Cabello

, Weinfurter

. Gaertner et al. Reply. Phys Rev Lett. 2008;101(20):Article 208902.

39.

Kleinberg J, Tardos E. Algorithm design. Noida (Uttar Pradesh, India): Pearson Education India; 2006.

40.

Gottesman D and Chuang I. Quantum digital signatures. arXiv preprint quant-ph/0105032. 2001.

41.

Dunjko

, Wallden

, Andersson

. Quantum digital signatures without quantum memory. Phys Rev Lett. 2014;112(4):040502.

42.

Roehsner

, Kettlewell

, Batalhão

, Fitzsimons

, Walther

. Quantum advantage for probabilistic one-time programs. Nat Commun. 2018;9(1):5225.

43.

Amiri

, Wallden

, Kent

, Andersson

. Secure quantum signatures using insecure quantum channels. Phys Rev A. 2016;93(3):032325.

44.

Puthoor

, Amiri

, Wallden

, Curty

, Andersson

. Measurement-device-independent quantum digital signatures. Phys Rev A. 2016;94(2):Article 022328.

45.

Roberts

, Lucamarini

, Yuan

, Dynes

, Comandar

, Sharpe

, Shields

, Curty

, Puthoor

, Andersson

. Experimental measurement-device-independent quantum digital signatures. Nat Commun. 2017;8(1):1098.

46.

Collins

, Amiri

, Fujiwara

, Honjo

, Shimizu

, Tamaki

, Takeoka

, Sasaki

, Andersson

, Buller

. Experimental demonstration of quantum digital signatures over 43 dB channel loss using differential phase shift quantum key distribution. Sci Rep. 2017;7:3235.

47.

, Zhang

, Chen

, Wang

, Yin

, Wang

, He

, Hao

, Liu

, et al.Practical quantum digital signature with a gigahertz BB84 quantum key distribution system. Opt Lett. 2019;44(1):139–142.

48.

Thornton

, Scott

, Croal

, Korolkova

. Continuous-variable quantum digital signatures over insecure channels. Phys Rev A. 2019;99(3):Article 032341.

49.

Richter

, Thornton

, Khan

, Scott

, Jaksch

, Vogl

, Stiller

, Leuchs

, Marquardt

, Korolkova

. Agile and versatile quantum communication: Signatures and secrets. Phys Rev X. 2021;11(1):Article 011038.

50.

Qin

, Jiang

, Yu

, Wang

. Quantum digital signatures with random pairing. Phys Rev Appl. 2022;17(4):Article 044047.

51.

Yin

, Wang

, Tang

. Experimental measurement-device-independent quantum digital signatures over a metropolitan network. Phys Rev A. 2017;95(4):042338.

52.

Yin

, Fu

, Chen

. Practical quantum digital signature. Phys Rev A. 2016;93(3):032316.

53.

Yin

, Fu

, Liu

, Tang

, Wang

, You

, Zhang

, Chen

, Wang

, Zhang

, et al.Experimental quantum digital signature over 102 km. Phys Rev A. 2017;95(3):Article 032334.

54.

, Cao

, Weng

, Gu

, Xie

, Zhou

, Yin

, Chen

. Efficient quantum digital signatures without symmetrization step. Opt Express. 2021;29(7):10162–10171.

55.

Weng

, Lu

, Gao

, Xie

, Gu

, Li

, Yin

, Chen

. Secure and practical multiparty quantum digital signatures. Opt Express. 2021;29(17):27661–27673.

56.

Yin

, Fu

, Li

, Weng

, Li

, Gu

, Lu

, Huang

, Chen

. Experimental quantum secure network with digital signatures and encryption. Natl Sci Rev. 2023;10(4):nwac228.

57.

, Xie

, Cao

. One-time universal hashing quantum digital signatures without perfect keys. Phys Rev Appl. 2023;20(4):044011.

58.

Yin

, Liu

, Dai

, Ci

, Gu

, Gao

, Wang

, Shen

. Experimental composable security decoy-state quantum key distribution using time-phase encoding. Opt Express. 2020;28(20):29479–29485.

59.

, Ma

, Zhang

, Lo

, Pan

. Secure quantum key distribution with realistic devices. Rev Mod Phys. 2020;92(2):Article 025002.

60.

Pirandola

, Andersen

, Banchi

, Berta

, Bunandar

, Colbeck

, Englund

, Gehring

, Lupo

, Ottaviani

, et al.Advances in quantum cryptography. Adv Opt Photon. 2020;12(4):1012–1236.

61.

Liu

, Li

, Xie

, Weng

, Gu

, Cao

, Lu

, Li

, Yin

, Chen

. Homodyne detection quadrature phase shift keying continuous-variable quantum key distribution with high excess noise tolerance. PRX Quantum. 2021;2(4):Article 040334.

62.

, Curty

, Qi

. Measurement-device-independent quantum key distribution. Phys Rev Lett. 2012;108(13):Article 130503.

63.

Lucamarini

, Yuan

, Dynes

, Shields

. Overcoming the rate–distance limit of quantum key distribution without quantum repeaters. Nature. 2018;557(7705):400–403.

64.

Xie

, Lu

, Weng

, Cao

, Jia

, Bao

, Wang

, Fu

, Yin

, Chen

. Breaking the rate-loss bound of quantum key distribution with asynchronous two-photon interference. PRX Quantum. 2022;3(2):Article 020315.

65.

, Yin

, Chen

. Long-distance measurement-device-independent multiparty quantum communication. Phys Rev Lett. 2015, 114;9:090501.

66.

Cao

, Lu

, Chai

, Yu

, Liang

, Wang

. Realization of quantum secure direct communication with continuous variable. Research. 2023;6:0193.

67.

Shen

, Cao

, Wang

, Fu

, Gu

, Liu

, Weng

, Yin

, Chen

. Experimental quantum secret sharing based on phase encoding of coherent states. Sci Chin Phys, Mech Astron. 2023;66:Article 260311.

68.

Amiri R, Abidin A, Wallden P, Andersson E. Efficient unconditionally secure signatures using universal hashing. In: Preneel B and Vercauteren F, editors. Applied cryptography and network security. Cham (Switzerland): Springer International Publishing; 2018:143–162.

69.

Wallden

, Dunjko

, Kent

, Andersson

. Quantum digital signatures with quantum-key-distribution components. Phys Rev A. 2015;4(91):042304.

70.

Comandar

, Lucamarini

, Fröhlich

, Dynes

. Quantum key distribution without detector vulnerabilities using optically seeded lasers. Nat Photonics. 2016;10(5):312–315.

Appendix

Less

Year 2023 volume 6 Issue 11

PDF

Cite this Article

BibTeX

Article Info

doi: 10.34133/research.0272

Receive Date：2023-10-10
Online Date：2026-10-28
Published：2023-11-20

Article Data

Affiliations

History

Received：2023-10-10
Accepted：2023-11-01

Funding

National Natural Science Foundation of China(12274223)

Natural Science Foundation of Jiangsu Province(BK20211145)

Fundamental Research Funds for the Central Universities(020414380182)

Key Research and Development Program of Nanjing Jiangbei New Area(ZDYD20210101)

Program for Innovative Talents and Entrepreneurs in Jiangsu(JSSCRC2021484)

Affiliations

¹National Laboratory of Solid State Microstructures and School of Physics, Collaborative Innovation Center of Advanced Microstructures, Nanjing University, Nanjing 210093, China.

Corresponding:

^* Address correspondence to: hlyin@ruc.edu.cn (H.-L.Y)

zbchen@nju.edu.cn (Z.-B.C.)

References

Share

https://castjournals.cast.org.cn/joweb/research/EN/10.34133/research.0272

Share to

Scan QR to access full text

Cite this article

BibTeX

Citations

表12种不同金属材料的力学参数

科 Family	属数 Number of genus	种数 Number of species	占总种数比例 Percentage of total species (%)	属 Genus	种数 Number of species	占总种数比例 Percentage of total species (%)
鹅膏菌科Amanitaceae	2	11	5.26	鹅膏菌属 Amanita	10	4.78
小菇科 Mycenaceae	2	12	5.74	丝盖伞属 Inocybe	5	2.39
多孔菌科 Polyporaceae	8	14	6.70	蜡蘑属 Laccaria	5	2.39
红菇科 Russulaceae	3	23	11.00	小皮伞属 Marasmius	6	2.87
				小菇属 Mycena	11	5.26
				光柄菇属 Pluteus	5	2.39
				红菇属 Russula	17	8.13
				栓菌属 Trametes	5	2.39

关闭全屏

BibTeX
EndNote
RefWorks
TxT

Table 1. Comparison between our work and detectable QBA framework. D-QBA, detectable QBA; N/A, not applicable; IC₁ and IC₂, two interactive consistency Byzantine conditions

Performance	This work	D-QBA [26–32]
Security analysis	Yes	N/A
Fault tolerance	N ≥ 2f + 1, ∀ f ∈ ℕ⁺	N = 3, f = 1
Message	Multiple	Binary
Decentralization	Yes	N/A
Entanglement	No	Yes
Strictly obey IC₁ and IC₂	Yes	No

Table 2. Protocol definition

Broadcasting phase

The broadcasting phase begins with d = 1 and ends with d = f. We consider a general case

M R ζ d

(d=1, 2, 3, ⋯, f):

1. Sign and multicast The primary signs and then multicasts the message

m ζ d

to the N–d backups via QDS as shown in Fig. 1.

2. Consistency check If d = 1, there is no consistency check and the players will skip to step 3. If 1 < d ≤ f, upon receiving the message from the primary, forwarder R_j checks the consistency between it and the message that he received from the primary at the previous depth d − 1. (R_j visits the players who do not appear in route ζ.) If consistency check is passed, perform step 3. Otherwise, he requests that this primary perform step 1 again until he receives a consistent message.

3. ForwardR_j forwards the message to verifiers R_k (R_k visit the players except R_j and those who have appeared in route ζ).

4. Verify and record Forwarder R_j and verifier R_k verify the message and corresponding signature. When both of them accept, the signature is successful and they add this valid message

m ς d

to their own broadcasting lists

B ς d, R j

and

B ς d, R k

, respectively.

5. Recursion The forwarder R_j acts as the primary of

MR ς → R j d + 1

, and then repeat the above four steps. The recursion process ends up when d = f.

Gathering phase

For the lieutenants R_i (i = 1, 2, ..., N − 1):

1. Input In the bottom layer d = f, R_i obtains the initial gathering lists

G ς f, R i = B ς f, R i

2. Recursion When 1 ≤ d < f, the gathering lists at the corresponding depth and route are

G ς f, R i = ∪ R p m ς → R p d + 1, R i,

where

m ς → R p d + 1, R i = majority G ς → R p d + 1, R i

and R_p visits all players except those who have appeared in the route ζ.

3. Output

m S 1, R i

= majority

G S 1, R i

Table 3. Consensus rates of our QBA framework adopting different QDS in the three-party consensus. The agreement rate, CR, is defined as the number of times a system can reach consensus per second. It can be expressed as $CR = SR C$ , where C is the communication complexity of the system and SR is the signature rate of adopted QDS (see Materials and Methods)

Different kinds of QDS	Consensus rate
GC01-QDS [43]	4.5 × 10⁻⁸
OTUH-QDS [56]	11.95
OTUH-QDS without perfect keys [57]	6.12

Fig. 1. Schematic of a multicast round including n players with primary S. The primary S signs and then multicasts his message to the backups. The forwarder is chosen from among the backups, and unchosen backups act as verifiers. The primary, the forwarder, and one of the verifiers perform a three-party QDS. The backups take turns acting as the forwarder. The arrow indicates the direction of the message delivery.

Fig. 2. Experimental implementation. (A) The five players bring their own pre-distributed correlated quantum keys to five different buildings and then perform the classical operations of the messaging stage. A, S; B, R₁; C, R₂; D, R₄; and E, R₅. In the messaging stage, the messages and corresponding signatures can be transmitted via authenticated classical channel. (B) Main parameters of BB84 key generation in the laboratory. QBER, quantum bit error rate. (C) Experimental setup of the four-intensity decoy-state quantum key generation system with a time-phase encoding. We take nodes A and B as an example. A uses a master laser, two slave lasers, and an asymmetric interferometer to prepare optical pulses in the Z and X bases. An intensity modulator is used for the decoy-state modulation. Before passing through a set of filters, a monitor and an attenuator are utilized to regulate the photon number per pulse. B uses a biased beam splitter for the passive basis detection. The pulses either go directly to the time detector or pass through an asymmetric interferometer. A synchronization signal is distributed from node A to node B through a wavelength division multiplexed quantum channel. BS, beam splitter; Circ, circulator; IM, intensity modulator; FBG, fiber Bragg grating; Att, attenuator; DWDM, dense wavelength division multiplexer; FM, Faraday mirror; PS, phase shifter; SPD, single-photon detector.

Fig. 3. Experimental results for three-party and five-party consensus. We use “F” to represent “forwarder” and “V” to represent “verifier” in the tables of lists. Each column of a table is a broadcasting list for the corresponding player. In the bottom layer d = f, R_i sets his or her gathering list as $G ζ f, R i = B ζ f, R i$ and performs the gathering phase to deduce the final output. (A) Multicast round at d = 1 in three-party consensus with an honest primary. (B) Multicast round at d = 1 in three-party consensus with a dishonest primary. Δ = majority(m1, m2). (C and D) Multicast rounds at d = 1 (d = 2) in five-party consensus with an honest initial primary. (E and F) Multicast rounds at d = 1 (d = 2) in five-party consensus with a dishonest initial primary. Δ₁ = majority(m4₁, m4₂, m4₃) and Δ₂ = majority(m1, m2, m3, Δ₁).

Articles: Latest Articles; Most Read; Collections

Updates: Events; News; Multimedia

About: About Us

Contact

No. 86 Xueyuan South Road, Haidian District, Beijing

100081

010-62662699(Operation and Technical Support)

qkjq@cast.org.cn

Copyright © 2025 China Association for Science and Technology. All rights reserved. For all open access content, the relevant licensing terms apply.
Sponsored by the Office of the Leading Group for Cybersecurity and Informatization of CAST, and supported by Science and Technology Review Publishing House