© 2026 Aqora Quantum S.A.S.

Terms Privacy Legal Notice

ACM Conference on Post-Quantum and Quantum-based Security

Practical Post-Quantum Secure Publicly Verifiable Secret Sharing and Applications

Aniket Kate, Pratyay Mukherjee, Hamza Saleem, Pratik Sarkar, Rohit Sinha

Published Oct 26, 2026• 0 citations

Abstract

We present a new framework for constructing practically efficient publicly verifiable secret sharing (PVSS) with non-interactive dealers , in that the dealer may go offline after sending a single message, and is not involved in the share verification process. We use identity-based encryption (IBE) and commitments as the main ingredients and avoid expensive zero-knowledge proofs. By instantiating them with post-quantum secure schemes, a lattice-based IBE and a hash-based commitment, we obtain our first construction: a post-quantum secure PVSS with non-interactive dealers that outperforms the prior lattice-based practical construction by Gentry et al. [Eurocrypt 2022]. However, to enable the aggregation of PVSS transcripts (which facilitates many additional applications such as secure voting), we propose our second construction by replacing hash-based commitments with Pedersen's homomorphic commitments. While this does not achieve full-fledged post-quantum security (as Pedersen's scheme is not quantum safe), it still provides privacy against a post-quantum adversary. We prove the security of this construction in a new model, which we call long-lasting security. This model guarantees that the protocol is secure in the present (pre-quantum era) while maintaining privacy in the long term (post-quantum era). This new model is of independent interest for constructing efficient schemes that are resilient to the harvest-now-decrypt-later line of attacks. In this model, we propose a blockchain-compatible secure voting scheme using our PVSS scheme. Our PVSS schemes demonstrate practical efficiency: our post-quantum PVSS shares a secret among 1024 receivers in 667 ms and verifies the dealing in < 5 ms, and communicates 4.4MB, overall whereas the state of the art [Gentry et al., Eurocrypt 2022] communicates 251MB and requires 2060s for dealing the secret.

DOI: 10.1145/3839338.3857267

Related papers

Epoque: Practical End-to-End Verifiable Post-Quantum-Secure E-Voting

Xavier Boyen, Thomas Haines, Johannes Müller

The ultimate goal in modern secure e-voting is to enable everyone to verify whether the final election result correctly reflects the votes chosen by the (human) voters, without exposing how each individual voted. These fundamental security properties are called end-to-end verifiability and voter privacy. Unfortunately, it turns out to be very challenging to pursue these properties simultaneously, especially when the latter must be future-proofed against the rise of quantum computers. In this work, we show, for the first time, a practical approach to do this. We present Epoque, the first end-to-end verifiable, voter-private, post-quantum-secure homomorphic e-voting protocol. It achieves its properties through the combination of practical lattice-based cryptographic primitives only, in a novel way. We formally prove all our security claims under common trust and hardness assumptions. At the core of Epoque lies an efficient identity-based encryption (IBE) scheme with blazingly fast master-key decryption. It is the component that makes the efficient tallying of thousands or millions of ballots a practical possibility. In order to demonstrate its practicality, we fully implemented it and provide detailed benchmarks; we believe this latter contribution is of independent interest beyond the specific e-voting application.

IEEE European Symposium on Security and Privacy•Sep 1, 2021•16 citations

Post-Quantum Access Control with Application to Secure Data Retrieval

Behzad Abdolmaleki, Hannes Blümel, Tianxiang Dai +4 more

Servan-Schreiber et al. [IEEE S& P, 2023] presented a new notion called private access control lists (PACL) for function secret sharing (FSS), where the FSS evaluators can ensure that the FSS dealer is authorized to share the given function. Their construction relies on costly non-interactive secret-shared proofs and is not secure in the post-quantum setting. We give a construction of PACL from publicly verifiable secret sharing (PVSS) under the short integer solution (SIS) problem. Our construction adapts the Gentry et al.'s scheme [EUROCRYPT, 2022] for the post-quantum setting based on the learning with error (LWE) assumption aimed at ensuring that database access control policies are enforced by FSS evaluators, who verify that the FSS dealer is authorized to share the specified database query function. The benchmarks of our PACL show a trade-off between proving and verification efficiency, making the optimal choice dependent on application requirements. This construction has many applications for access control by applying FSS. We also present a secure data retrieval scheme using DPF-PACL for access control, which complements the PACL framework while providing independent utility.

IACR Communications in Cryptology•Oct 6, 2025•0 citations

A Verifiable Multi-Secret Sharing Scheme Based on Short Integer Solution

Fulin Li, Jiayun Yan, Shixin Zhu +1 more

With the possible birth of the quantum computer, traditional secret sharing schemes have been unable to meet security requirements. We proposed a new verifiable multi-secret sharing scheme based on the short integer solution problem. By utilizing a symmetric binary polynomial,$k$secrets and secret shares can be generated, and then we convert the secret shares into binary string on$\mathbb{Z}_{q}$, which can be identified by one-way anti-collision hash function on the lattice, so that multiple secrets can be reconstructed safely. The advantages mainly focus on verifiability without interaction in the distribution phase and less memory requirement. In a secret sharing scheme, verifiability prevents the dealer to share the wrong shares and forces the participants to submit their shares correctly. Meanwhile, the interaction can be reduced, which means the security is improved. In a multi-secret sharing scheme, releasing the public values is inevitable, this paper has less public values and less size of shares per secret size to reduce the pressure of memory consumption in the proper parameters. In the end, it can also effectively resist the quantum attack.

Chinese Journal of Electronics•May 1, 2023•8 citations

Post-Quantum Threshold Oblivious Signature

Altana Felixovna Khutsaeva, Sergey Valentinovich Bezzateev

A novel post-quantum threshold oblivious signature scheme is presented. Oblivious signatures enable a requester to obtain a signature on a single selected message from a set of candidates without revealing the selection to the signer. Unlike blind signatures, the signer may be aware of the candidate set. To mitigate single-point failures the scheme employs Shamir’s secret sharing to distribute signing authority among multiple participants. To address quantum threats, it leverages isogeny-based cryptography founded on the Group Action Inverse Problem for post-quantum resilience. The construction adapts an existing isogeny-based oblivious signature by introducing a trusted dealer. The signing protocol is multi-party; verification confirms signature validity on the selected message without revealing secret information. Security reduces to the hardness of Group Action Inverse Problem and the security of the secret-sharing scheme in the semi-honest model, covering corrupted dealers, users, and coalitions of fewer than the threshold number of signers. The threshold design eliminates dependence on a single signer, preventing unauthorized signatures after key compromise. Theoretical contributions advance threshold cryptography with post-quantum primitives; practical applications include anonymous voting, secure transactions, and privacy-preserving distributed systems. Future directions include malicious adversary models and integrations with other post-quantum primitives.

International Scientific-Technical Conference on Actual Problems of Electronic Instrument Engineering (APEIE)•Nov 14, 2025•0 citations

Practical Quantum-Safe Voting from Lattices

Rafaël del Pino, Vadim Lyubashevsky, Gregory Neven +1 more

We propose a lattice-based electronic voting scheme, EVOLVE (Electronic Voting from Lattices with Verification), which is conjectured to resist attacks by quantum computers. Our protocol involves a number of voting authorities so that vote privacy is maintained as long as at least one of the authorities is honest, while the integrity of the result is guaranteed even when all authorities collude. Furthermore, the result of the vote can be independently computed by any observer. At the core of the protocol is the utilization of a homomorphic commitment scheme with strategically orchestrated zero-knowledge proofs: voters use approximate but efficient "Fiat-Shamir with Aborts" proofs to show the validity of their vote, while the authorities use amortized exact proofs to show that the commitments are well-formed. We also present a novel efficient zero-knowledge proof that one of two lattice-based statements is true (so-called OR proof) and a new mechanism to control the size of the randomness when applying the homomorphism to commitments. We give concrete parameter choices to securely instantiate and evaluate the efficiency of our scheme. Our prototype implementation shows that the voters require $8$ milliseconds to submit a vote of size about $20$KB to each authority and it takes each authority $0.15$ seconds per voter to create a proof that his vote was valid. The size of the vote share that each authority produces is approximately $15$KB per voter, which we believe is well within the practical bounds for a large-scale election.

ACM SIGSAC Conference on Computer and Communications Security (CCS)•Oct 27, 2017•43 citations

Verifiable quantum secret sharing protocol based on lattice walking

Zi-Chang Xie, Chen‐Ming Bai, Su-Juan Zhang +1 more

A verifiable quantum secret sharing protocol using quantum walks on a lattice is proposed in this paper. The protocol utilizes generalized Bell states as the initial quantum resource, integrating the quantum walk evolution operator U with the global shift operator \(G_{ab}\) to facilitate joint encrypted transmission among multiple participants. A bidirectional identity authentication mechanism based on hash functions is introduced to ensure the legitimacy of all communication parties, which effectively resists impersonation attacks. Random decoy particles are randomly prepared in either the \(Z_{d}\) or \(X_{d}\) basis and inserted into the transmission sequence, enabling real-time eavesdropping detection on the quantum channel. In the secret reconstruction phase, a public verification mechanism is designed to allow participants to verify the correctness of the recovered secret and identify internal dishonest behaviors. Security analysis demonstrates that the protocol achieves information-theoretic security, resisting typical external attacks such as intercept-resend, measure-resend, and entangle-measure attacks, as well as collusion attacks from dishonest internal participants. Compared with existing quantum-walk-based secret sharing schemes, the proposed protocol maintains high qubit efficiency while supporting both identity authentication and public verifiability, thus possessing stronger practicality and security.

EPJ Quantum Technology•Aug 18, 2026•0 citations

We present a new framework for constructing practically efficient publicly verifiable secret sharing (PVSS) with non-interactive dealers , in that the dealer may go offline after sending a single message, and is not involved in the share verification process. We use identity-based encryption (IBE) and commitments as the main ingredients and avoid expensive zero-knowledge proofs. By instantiating them with post-quantum secure schemes, a lattice-based IBE and a hash-based commitment, we obtain our first construction: a post-quantum secure PVSS with non-interactive dealers that outperforms the prior lattice-based practical construction by Gentry et al. [Eurocrypt 2022]. However, to enable the aggregation of PVSS transcripts (which facilitates many additional applications such as secure voting), we propose our second construction by replacing hash-based commitments with Pedersen's homomorphic commitments. While this does not achieve full-fledged post-quantum security (as Pedersen's scheme is not quantum safe), it still provides privacy against a post-quantum adversary. We prove the security of this construction in a new model, which we call long-lasting security. This model guarantees that the protocol is secure in the present (pre-quantum era) while maintaining privacy in the long term (post-quantum era). This new model is of independent interest for constructing efficient schemes that are resilient to the harvest-now-decrypt-later line of attacks. In this model, we propose a blockchain-compatible secure voting scheme using our PVSS scheme. Our PVSS schemes demonstrate practical efficiency: our post-quantum PVSS shares a secret among 1024 receivers in 667 ms and verifies the dealing in < 5 ms, and communicates 4.4MB, overall whereas the state of the art [Gentry et al., Eurocrypt 2022] communicates 251MB and requires 2060s for dealing the secret.

The ultimate goal in modern secure e-voting is to enable everyone to verify whether the final election result correctly reflects the votes chosen by the (human) voters, without exposing how each individual voted. These fundamental security properties are called end-to-end verifiability and voter privacy. Unfortunately, it turns out to be very challenging to pursue these properties simultaneously, especially when the latter must be future-proofed against the rise of quantum computers. In this work, we show, for the first time, a practical approach to do this. We present Epoque, the first end-to-end verifiable, voter-private, post-quantum-secure homomorphic e-voting protocol. It achieves its properties through the combination of practical lattice-based cryptographic primitives only, in a novel way. We formally prove all our security claims under common trust and hardness assumptions. At the core of Epoque lies an efficient identity-based encryption (IBE) scheme with blazingly fast master-key decryption. It is the component that makes the efficient tallying of thousands or millions of ballots a practical possibility. In order to demonstrate its practicality, we fully implemented it and provide detailed benchmarks; we believe this latter contribution is of independent interest beyond the specific e-voting application.

Servan-Schreiber et al. [IEEE S& P, 2023] presented a new notion called private access control lists (PACL) for function secret sharing (FSS), where the FSS evaluators can ensure that the FSS dealer is authorized to share the given function. Their construction relies on costly non-interactive secret-shared proofs and is not secure in the post-quantum setting. We give a construction of PACL from publicly verifiable secret sharing (PVSS) under the short integer solution (SIS) problem. Our construction adapts the Gentry et al.'s scheme [EUROCRYPT, 2022] for the post-quantum setting based on the learning with error (LWE) assumption aimed at ensuring that database access control policies are enforced by FSS evaluators, who verify that the FSS dealer is authorized to share the specified database query function. The benchmarks of our PACL show a trade-off between proving and verification efficiency, making the optimal choice dependent on application requirements. This construction has many applications for access control by applying FSS. We also present a secure data retrieval scheme using DPF-PACL for access control, which complements the PACL framework while providing independent utility.

With the possible birth of the quantum computer, traditional secret sharing schemes have been unable to meet security requirements. We proposed a new verifiable multi-secret sharing scheme based on the short integer solution problem. By utilizing a symmetric binary polynomial,

k

secrets and secret shares can be generated, and then we convert the secret shares into binary string on

\mathbb{Z}_{q}

, which can be identified by one-way anti-collision hash function on the lattice, so that multiple secrets can be reconstructed safely. The advantages mainly focus on verifiability without interaction in the distribution phase and less memory requirement. In a secret sharing scheme, verifiability prevents the dealer to share the wrong shares and forces the participants to submit their shares correctly. Meanwhile, the interaction can be reduced, which means the security is improved. In a multi-secret sharing scheme, releasing the public values is inevitable, this paper has less public values and less size of shares per secret size to reduce the pressure of memory consumption in the proper parameters. In the end, it can also effectively resist the quantum attack.

A novel post-quantum threshold oblivious signature scheme is presented. Oblivious signatures enable a requester to obtain a signature on a single selected message from a set of candidates without revealing the selection to the signer. Unlike blind signatures, the signer may be aware of the candidate set. To mitigate single-point failures the scheme employs Shamir’s secret sharing to distribute signing authority among multiple participants. To address quantum threats, it leverages isogeny-based cryptography founded on the Group Action Inverse Problem for post-quantum resilience. The construction adapts an existing isogeny-based oblivious signature by introducing a trusted dealer. The signing protocol is multi-party; verification confirms signature validity on the selected message without revealing secret information. Security reduces to the hardness of Group Action Inverse Problem and the security of the secret-sharing scheme in the semi-honest model, covering corrupted dealers, users, and coalitions of fewer than the threshold number of signers. The threshold design eliminates dependence on a single signer, preventing unauthorized signatures after key compromise. Theoretical contributions advance threshold cryptography with post-quantum primitives; practical applications include anonymous voting, secure transactions, and privacy-preserving distributed systems. Future directions include malicious adversary models and integrations with other post-quantum primitives.

We propose a lattice-based electronic voting scheme, EVOLVE (Electronic Voting from Lattices with Verification), which is conjectured to resist attacks by quantum computers. Our protocol involves a number of voting authorities so that vote privacy is maintained as long as at least one of the authorities is honest, while the integrity of the result is guaranteed even when all authorities collude. Furthermore, the result of the vote can be independently computed by any observer. At the core of the protocol is the utilization of a homomorphic commitment scheme with strategically orchestrated zero-knowledge proofs: voters use approximate but efficient "Fiat-Shamir with Aborts" proofs to show the validity of their vote, while the authorities use amortized exact proofs to show that the commitments are well-formed. We also present a novel efficient zero-knowledge proof that one of two lattice-based statements is true (so-called OR proof) and a new mechanism to control the size of the randomness when applying the homomorphism to commitments. We give concrete parameter choices to securely instantiate and evaluate the efficiency of our scheme. Our prototype implementation shows that the voters require

8

milliseconds to submit a vote of size about

20

KB to each authority and it takes each authority

0.15

seconds per voter to create a proof that his vote was valid. The size of the vote share that each authority produces is approximately

15

KB per voter, which we believe is well within the practical bounds for a large-scale election.

A verifiable quantum secret sharing protocol using quantum walks on a lattice is proposed in this paper. The protocol utilizes generalized Bell states as the initial quantum resource, integrating the quantum walk evolution operator U with the global shift operator

G_{ab}

to facilitate joint encrypted transmission among multiple participants. A bidirectional identity authentication mechanism based on hash functions is introduced to ensure the legitimacy of all communication parties, which effectively resists impersonation attacks. Random decoy particles are randomly prepared in either the

Z_{d}

or

X_{d}

basis and inserted into the transmission sequence, enabling real-time eavesdropping detection on the quantum channel. In the secret reconstruction phase, a public verification mechanism is designed to allow participants to verify the correctness of the recovered secret and identify internal dishonest behaviors. Security analysis demonstrates that the protocol achieves information-theoretic security, resisting typical external attacks such as intercept-resend, measure-resend, and entangle-measure attacks, as well as collusion attacks from dishonest internal participants. Compared with existing quantum-walk-based secret sharing schemes, the proposed protocol maintains high qubit efficiency while supporting both identity authentication and public verifiability, thus possessing stronger practicality and security.