REVIEW 3 major objections 4 minor 32 references
Improvements on "Secure multi-party quantum summation based on quantum Fourier transform"
T0 review · 3 major / 4 minor · reviewed 2026-08-14 · deepseek-v4-flash
Pith's one-line read The state preparer in a quantum summation protocol can silently recover all private strings, and a two-basis check closes the attack.
desk verdict The attacks on Yang-Ye 2018 are correct and likely invalidate that protocol, but the improved protocol's security argument has a scaling hole: Eq. (21)'s N/(N+q) is close to 1 for fixed q and large N, and the stated pass probability is not derived. read the letter →
The pith
A machine-rendered reading of the paper's core claim, the machinery that carries it, and where it could break.
The reading
What carries the argument
The central object is the d-level n-component entangled state $|\omega\rangle_{12\ldots n} = \frac{1}{\sqrt{d}}\sum_{r=0}^{d-1}|r\rangle_1|r\rangle_2\cdots|r\rangle_n$. Rewriting it in the Fourier basis gives $|\omega\rangle_{12\ldots n} = \frac{1}{(\sqrt{d})^{n-1}}\sum_{l_1\oplus\cdots\oplus l_n=0}F|l_1\rangle_1\cdots F|l_n\rangle_n$, which is the correlation that makes the protocol work: computational-basis measurements agree, and Fourier-basis measurements satisfy $l_1\oplus\cdots\oplus l_n=0$. The attacks exploit that P1 can deviate from genuine states while retaining knowledge of the hidden $r_t$; the defense checks exactly this correlation in S3. The simplified protocol relies on the equivalence between the encoding operation $U_k^F$ and measuring in the Fourier basis followed by modulo-$d$ addition, which removes the need for participant-side quantum gates.
What would settle it
Exhibit a concrete fake state, for some $d\ge2$ and $n>2$, whose probability of passing the S3 checks is at least the claimed bound, $\frac{N}{N+q}$ when it is not selected for checking and $\frac12+\frac{1}{2d}$ when it is, and for which the announced measurement values $m_j^t$ allow P1 to compute $k_j^t$. The paper gives no proof that no such state exists, so finding one would refute the claimed security.
Extended reading notes
Core claim
The central claim is that YY2018's protocol is vulnerable to participant attacks by P1, the state preparer. In Attack 1, P1 measures each entangled state in the computational basis, applies $F^\dagger$ to each component, and distributes the resulting product states; because she knows the hidden value $r_t$, each announced result $m_j^t = r_t \oplus k_j^t$ directly reveals $k_j^t$. In Attack 2, she keeps $n-1$ components of a genuinely entangled state and uses the correlation $l_1 \oplus \cdots \oplus l_n = 0$ to recover one private integer per entangled state. The improved protocol adds an S3 detection round in which randomly selected states are measured in either the computational or the Fourier basis and checked against the correlation, so the attacks are caught before encoding. It then computes the sum by having every party measure the remaining states in the Fourier basis and add their private strings modulo $d$.
Load-bearing premise
The improved protocol's security depends on the unproven assumption that any fake state that passes the random two-basis checks in S3 cannot still be used by P1 to recover another party's private number; if such a fake state exists, the fix fails.
Editorial extensions
If this is right
- As published, the 2018 protocol leaves every other private string recoverable by P1 using only N prepared states, so it should not be used without an entanglement-verification step.
- The improved protocol removes the need for the quantum Fourier transform and participant encoding operations; each party just measures in the Fourier basis and adds modulo d, simplifying implementation.
- The random two-basis check is a reusable countermeasure for any multi-party protocol in which one party supplies shared entangled states, because it tests the exact correlation a genuine state must have.
- For large q, the probability that a single fake state escapes detection in S3 is $N/(N+q)$ when unselected and at most $\frac12+\frac{1}{2d}$ when selected, so the security parameter can be tuned to make undetected leakage arbitrarily small.
Reading between the lines
- An adaptive P1 who chooses fake states after seeing the check positions is not analyzed; a complete security proof would need to bound the maximum pass probability over all fake states, not just the product states considered in equation (20).
- The stated equivalence between $U_k^F$ encoding and Fourier-basis measurement plus modular addition probably extends to other quantum-Fourier-transform-based summation or private-comparison protocols, letting them drop participant-side quantum gates.
- Under channel noise, the S3 error threshold must sit above the physical noise rate but below the deviation caused by a fake state; deriving the finite-size trade-off among q, noise, and undetected leakage is a natural next step.
- Attack 2's entangling-probe strategy, in which P1 keeps n-1 components while sending one to a victim, may be a general threat to any GHZ-type state-distribution protocol, not only summation.
Signed reviews
Editorial analysis
A structured set of objections, weighed in public.
Referee Report
Summary. The paper revisits Yang and Ye's 2018 quantum Fourier transform based multiparty quantum summation protocol (YY2018) and claims that the protocol is vulnerable to participant attacks by the state-preparing party P1. It presents two attacks: Attack 1, in which P1 measures all entangled states in the computational basis, applies F-dagger before distribution, and later recovers each honest party's private integer from the announced measurement results because she knows the initial measurement outcomes; and Attack 2, in which P1 exploits the correlation l1 xor ... xor ln = 0 of the Fourier-basis representation to recover one private integer of a party. The authors then propose an improved protocol that adds q extra states and a random two-basis checking step S3 to detect fake states, and that replaces the encoding operations by Fourier-basis measurements followed by modular addition. The paper concludes that the improved protocol resists P1's attacks and also removes the need for quantum Fourier transform encoding operations.
Significance. The two attacks described in Section 3 are genuine and are derived directly from the protocol equations; they are a useful contribution because they identify a realistic cheating strategy for the state-preparing party that YY2018 overlooked. The proposed simplification of replacing encoding operations with Fourier-basis measurements plus modular addition is elegant and is correctly argued at the algebraic level. The paper is also transparent in comparing itself with the concurrent work by Gu and Hwang. However, the security analysis of the improved protocol is not yet convincing: the detection-failure probability is mishandled, the claimed numerical pass probability is unsubstantiated and in fact wrong for the explicit fake state, and the crucial premise that the S3 checks certify the remaining N states is not proved. These issues are load-bearing for the paper's central claim that the improved protocol is secure against P1.
major comments (3)
- [Sec. 4.1, Eq. (21)] The detection-failure probability is N/(N+q), and the text says this 'will approach 0 when q is sufficiently large.' This is not correct as a scaling statement: for any fixed q, N/(N+q) tends to 1 as N increases. For example, N=1000 and q=20 gives 0.98. Since the analyzed case is exactly P1's single-fake-state Attack 1, the improved protocol is not shown to be secure for large N unless q grows with N, e.g., q = Omega(N), and the paper never states or proves such a requirement. This gap directly affects the central security claim.
- [Sec. 4.1, pass-probability claim] The claimed pass probability (1/2 + 1/(2d)) for a fake state selected in the S3 check is asserted without derivation, and it is incorrect for the explicit fake state in Eq. (20). If the computational basis is chosen, all honest parties measuring F|r> obtain the same value r and the state passes with probability 1, not 1/(2d); if the Fourier basis is chosen, the outcomes are all r and pass only when n r is 0 modulo d, which is not generally 1/d. For d=2, n=3 the actual pass probability is 1/2, whereas (1/2 + 1/(2d)) = 3/4. A correct analysis of the optimal fake state and of the S3 test is needed.
- [Sec. 4, S3 and S4] The security argument assumes that passing the S3 checks on q randomly chosen states certifies that the remaining N states are genuine |omega> shared by all parties. This premise is unproven. S3 is a randomized two-basis spot check performed against an adversarial state preparer, and the paper provides no bound on the probability that an unselected state differs from |omega> conditional on all checks passing, nor does it analyze what P1 learns from the check rounds or whether her announcements can be adaptive. Without such a bound, the statement in S4 that 'all parties share, with a high probability, N genuine d-level n-component entangled states' is not supported. This gap is load-bearing because the privacy of the honest parties' inputs in S4 relies exactly on l^t_1 xor ... xor l^t_n = 0 and on P1 not knowing the l^t_j values.
minor comments (4)
- [Abstract and Section 4] The claim that the improved protocol removes the need for the quantum Fourier transform is overstated: the parties still measure in the Fourier basis in S4, which requires a Fourier-basis measurement or an equivalent operation. Please rephrase to say that the protocol removes the need for the participants to perform the encoding operation U_k F.
- [Eq. (19)] The notation with the big operator combining a direct sum and a summation is unusual and undefined. Please define the intended expression clearly, e.g., by writing x_1 xor x_2 xor ... xor x_n each time.
- [Sec. 4, S1] There is a typo: 'entangled sates' should be 'entangled states.'
- [Sec. 3.2] In Attack 2, Step (2), the text says Pj performs U_kj F 'on the received components' while only one component was sent to Pj; the wording should be singular for clarity.
Circularity Check
No circularity: the attacks are derived from the protocol's own equations, and the improved protocol's claims are not fitted inputs or renamed results.
full rationale
The paper's central derivation is a direct cryptanalysis of the YY2018 protocol. Attack 1 derives P1's extraction from the algebraic identity U_{k_t_j}^F F^\dagger |r^t\rangle_j = |k_t_j \oplus r^t\rangle_j, so P1, knowing r^t, obtains k_t_j from the announced m_t_j. Attack 2 derives k_j from equation (14) via the Fourier-basis correlation l1 \oplus l2 \oplus ... \oplus ln = 0 and the announced value |l1 \oplus k_j\rangle. These are direct consequences of the protocol's encoding rule and the state expansion in equation (17), not fitted parameters or renamed inputs. The improved protocol's security parameter q is an explicit protocol choice, and the pass probability in equation (21) is a combinatoric calculation from the random sampling procedure; it is not a constant fitted to make the conclusion hold. The paper's citations to decoy-photon techniques and prior quantum summation work are background support, and none of the load-bearing steps reduces to a self-citation. The notable weakness is that equation (21) gives N/(N+q), which for fixed q tends to 1 as N grows, so the claim that it approaches 0 requires q to scale with N; that is a security-analysis gap rather than circularity, because it does not make the conclusion equivalent to its inputs. No self-definitional, fitted-input, uniqueness-imported, ansatz-smuggled, or renaming pattern is present.
Assumptions & free parameters
free parameters (1)
- q (detection security parameter) =
unspecified; chosen large
assumptions (6)
- standard math Discrete quantum Fourier transform relations, including F|r> and equation (17).
- domain assumption All quantum channels are ideal and noiseless.
- domain assumption P1 does not collude with other participants.
- domain assumption Random selection of q detection states is unbiased and not controllable by P1.
- domain assumption Classical announcements (M_j, l_j) are transmitted authentically.
- ad hoc to paper Passing the S3 two-basis random checks certifies that the remaining N states are genuine |ω>_{12...n} shared by all parties.
Cite this review
Pith. "Pith review of Improvements on "Secure multi-party quantum summation based on quantum Fourier transform"." pith.science (2026). https://pith.science/paper/O3WVAYYW
@misc{pith2026190806063,
author = {Pith},
title = {Pith review of: Improvements on "Secure multi-party quantum summation based on quantum Fourier transform"},
year = {2026},
howpublished = {\url{https://pith.science/paper/O3WVAYYW}},
note = {Machine review of arXiv:1908.06063}
}
read the original abstract
Recently, a quantum multi-party summation protocol based on the quantum Fourier transform has been proposed [Quantum Inf Process 17: 129, 2018]. The protocol claims to be secure against both outside and participant attacks. However, a closer look reveals that the player in charge of generating the required multi-partite entangled states can launch two kinds of attacks to learn about other parties' private integer strings without being caught. In this paper, we present these attacks, and propose countermeasures to make the protocol secure again. The improved protocol not only can resist these attacks but also remove the need for the quantum Fourier transform and encoding quantum operations by participants.
Reference graph
Works this paper leans on
-
[1]
Bennett, C.H., Brassard, G.: Quantum cryptography: publ ic-key distribution and coin tossing. In: Proceedings of the IEEE International Confere nce on Computers, Systems and Signal Processing, pp. 175179. IEEE Press, Bangalore (1984 )
work page 1984
-
[2]
CMC-Com puters Materials and Continua, 2019, 58 (3): 809-827
Xu, G., Xiao, K., Li, Z.P., et al.: Controlled secure direc t communication protocol via the three-qubit partially entangled set of states. CMC-Com puters Materials and Continua, 2019, 58 (3): 809-827
work page 2019
-
[3]
Quantum Inf Process 17, 225 (2018)
Chen, X.B., Tang, X., Xu, G., et al.: Cryptanalysis of secr et sharing with a single d -level quantum system. Quantum Inf Process 17, 225 (2018)
work page 2018
-
[4]
Lo, H.K.: Insecurity of quantum secure computations. Phy s. Rev. A 56, 1154 (1997)
work page 1997
-
[5]
In: Proceedings of the thirty-fourth annual ACM symposium on Th eory of Computing, pp
Cr´ epeau, C., Gottesman, D., Smith, A.: Secure multi-par ty quantum computation. In: Proceedings of the thirty-fourth annual ACM symposium on Th eory of Computing, pp. 643-652 (2002)
work page 2002
-
[6]
F.: Quantum-classical complexity-security tra deoff in secure multiparty com- putations
Chau, H. F.: Quantum-classical complexity-security tra deoff in secure multiparty com- putations. Phys. Rev. A 61(3), 032308 (2000)
work page 2000
-
[7]
Smi th, A.: Secure multiparty quantum computation with (only) a strict honest majority
Ben-Or, M., Cr´ epeau, C., Gottesman, D., Hassidim, A. Smi th, A.: Secure multiparty quantum computation with (only) a strict honest majority. I n: Foundations of Computer Science, 2006. FOCS’06. 47th Annual IEEE Symposium on, pp. 2 49-260 (2006) 12 Cai Zhang et al
work page 2006
-
[8]
arXiv:quan t-ph/0111030 (2010)
Smith, A.: Multi-party Quantum Computation. arXiv:quan t-ph/0111030 (2010)
Show all 32 references
-
[9]
Entropy 18, 267 (2 016)
Xu, G., Chen, X.B., Dou, Z., et al.: Novel criteria for dete rministic remote state prepa- ration via the entangled six-qubit state. Entropy 18, 267 (2 016)
-
[10]
Quantum Inf Process 16, 244 (2017)
Chen, X.B., Sun, Y.R., Xu, G., et al.: Controlled bidirec tional remote preparation of three-qubit state. Quantum Inf Process 16, 244 (2017)
2017
-
[11]
Li, J., Chen, X.B., Sun, X.M., et al.: Quantum network cod ing for multi-unicast problem based on 2d and 3d cluster states. Sci. China-Inf. Sci. 59, 04 2301 (2016)
2016
-
[12]
IEEE Access, 7, 13634-13642 (2 019)
Chen, X.B., W ang, Y.L., Xu, G., et al.: Quantum network co mmunication with a novel discrete-time quantum walk. IEEE Access, 7, 13634-13642 (2 019)
-
[13]
Journal of Com- plexity, 18(1), 1-50 (2002)
Heinrich, S.: Quantum summation with an application to i ntegration. Journal of Com- plexity, 18(1), 1-50 (2002)
2002
-
[14]
Journal of Complexity, 19(1), 1-18 (2003)
Heinrich, S., Novak, E.: On a problem in quantum summatio n. Journal of Complexity, 19(1), 1-18 (2003)
2003
-
[15]
In: Monte Carlo and Quas i-Monte Carlo Methods, pp
Heinrich, S., Kwas, M., W o´ zniakowski, H.: Quantum Bool ean summation with repeti- tions in the worst-average setting. In: Monte Carlo and Quas i-Monte Carlo Methods, pp. 243-258. Springer, Heidelberg. (2004)
2004
-
[16]
Acta Physica Sinica 56(11), 6214 (2007)
Du, J.Z., Chen, X.B., W en, Q.Y., et al.: Secure multipart y quantum summation. Acta Physica Sinica 56(11), 6214 (2007)
2007
-
[17]
Huang, W., W en, Q.Y., Liu, B., et al.: Quantum anonymous r anking. Phys. Rev.A 89(3), 032325 (2014)
2014
-
[18]
Quantum 431 Inf
Sun, Z., Yu, J., W ang, P., et al.: Quantum private compari son with a malicious third party. Quantum 431 Inf. Process. 14, 21252133 (2015)
2015
-
[19]
W ang, Q., Yu, C., Gao, F., et al.: Self-tallying quantum a nonymous voting. Phys. Rev. A, 94, 022333 (2016)
2016
-
[20]
Quantum Information Processing
Ji, Z.X., Zhang, H.G., W ang, H.Z., et al.: Quantum protoc ols for secure multi-party summation. Quantum Information Processing. 18(6), 168 (20 19)
-
[21]
Zhang, C., Sun, Z.W., Huang, Y., et al.: High-Capacity Qu antum Summation with Single Photons in Both Polarization and Spatial-Mode Degre es of Freedom. Int. J. Theor. Phys. 53(3), 933-941 (2014)
2014
-
[22]
Liu, W., W ang, Y.B., Fan, W.Q.: An novel protocol for the q uantum secure multi-party summation based on two-particle Bell states. Int. J. Theor. Phys. 56(9), 2783-2791 (2017)
2017
-
[23]
Entropy, 21(7), 719 (2019)
Zhang, C., Razavi, M., Sun, Z., et al.: Quantum summation based on quantum telepor- tation. Entropy, 21(7), 719 (2019)
2019
-
[24]
Chen, X.B., Xu, G., Yang, Y.X., W en, Q.Y.: An efficient prot ocol for the secure multi- party quantum summation. Int. J. Theo. Phys. 49(11), 2793 (2 010)
-
[25]
Zhang, C., Sun, Z.W., Huang, X., et al.: Three-party quan tum summation without a trusted third party. Int. J. Quantum Inf. 13(02), 1550011 (2 015)
-
[26]
Shi, R.H., Mu, Y., Zhong, H., et al.: Secure multiparty qu antum computation for sum- mation and multiplication.Sci. Rep. 6, 19655 (2016)
2016
-
[27]
Quantum Information Processing
Shi, R.H., Zhang, S.: Quantum solution to a class of two-p arty private summation problems. Quantum Information Processing. 16(9), 225 (201 7)
-
[28]
Quantum Information Processing
Yang, H.Y., Ye, T.Y.: Secure multi-party quantum summat ion based on quantum Fourier transform. Quantum Information Processing. 17(6) , 129 (2018)
2018
-
[29]
Li, C.Y., Zhou, H.Y., W ang, Y., et al.: Secure Quantum Key Distribution Network with Bell States and Local Unitary Operations. Chin. Phys. Lett. 22(5), 1049-1052 (2005)
2005
-
[30]
Li, C.Y., Li, X.H., Deng, F.G., Zhou, P., Liang, Y.J., et a l.: Efficient Quantum Cryptog- raphy Network without Entanglement and Quantum Memory. Chi n. Phys. Lett. 23(11), 2896 (2006)
2006
-
[31]
Shor, P.W., Preskill, J.: Simple Proof of Security of the BB84 Quantum Key Distribution Protocol. Phys. Rev. Lett. 85(2), 441 (2000)
2000
-
[32]
Secure multi-party qu antum summation based on quantum Fourier transform
Gu, J., Hwang, T.: Improvement on “Secure multi-party qu antum summation based on quantum Fourier transform”. arXiv:1907.02656 (2019)
2019 arXiv
Reviewed August 14, 2026 · model on record in the stance chip above.
Discussion (0). Continue with ORCID to comment.