Quantum Secret Sharing: GHZ-State Alliance Correlations

The Alliance

Parties in the alliance 3

This Round

Press "Run one round" to distribute a GHZ state.

Alliance Result

No shares combined yet.

X-basis rounds

Z-check pass rate

—

Any single party's own outcome is a fair coin, 50/50, whichever secret bit the dealer chose — watch the "your view" readout below stay at ~50% no matter what.

Party 1's view of s=1

—

Total rounds run

How it works

The dealer prepares an n-qubit GHZ state and sends one qubit to each of the n parties:

|GHZ_n⟩ = (|00...0⟩ + |11...1⟩) / √2

This state is a +1 eigenstate of the all-X stabilizer X⊗X⊗...⊗X (n factors). To encode a secret bit s, the dealer applies a Pauli-Z to one qubit before sending it, which flips the stabilizer's eigenvalue:

X^⊗n |GHZ_n⟩  =  (+1)|GHZ_n⟩         (s = 0)
X^⊗n (Z_1|GHZ_n⟩) = (−1)(Z_1|GHZ_n⟩)  (s = 1)

If every party measures their qubit in the X basis and
multiplies the ±1 outcomes together:
  o_1 · o_2 · ... · o_n = (−1)^s   (exact, every round)

Individually, each o_i is a uniformly random ±1 — the marginal distribution of any proper subset of parties carries zero information about s. Only when all n outcomes are multiplied together does the secret bit fall out exactly. That is the whole point of secret sharing: the "alliance" of all shareholders can recover the secret, but any smaller coalition sees pure noise.

A second use of the same GHZ state catches cheating. In occasional "check" rounds every party measures in the Z basis instead. An undisturbed GHZ state always yields all-equal Z outcomes (000...0 or 111...1). A dishonest party — or an eavesdropper doing intercept-resend on one qubit — measures that qubit in a random basis and resends a fresh state, which decorrelates its Z outcome from the rest about half the time. The check-round pass rate is exactly the disturbance test real quantum secret-sharing and QKD protocols (e.g. Hillery–Bužek–Berthiaume) use to bound how much information a spy could have learned.

Parties slider — how many shareholders split the secret (n = 3–6 qubits in the GHZ state).
Secret = 0/1 — the dealer's bit, set before running a round.
Dishonest party — toggles an intercept-resend attack on the last party's qubit.
Run one round — samples one real measurement round (mostly X-basis, occasionally a Z-basis security check) and animates the GHZ qubits flying out.
Combine all shares — takes every X-round product recorded so far and majority-votes the recovered secret bit, exactly as the honest alliance would after pooling their measurement logs.

round: 0

Dealer (GHZ source) Outcome +1 Outcome −1

⚠ Couldn't load the 3D engineThree.js failed to load from the CDN. Check your connection and reload.