A Quantum Detectable Byzantine Agreement Protocol Using Only EPR Pairs

Abstract

In this paper, we introduce a new quantum protocol for Detectable Byzantine Agreement. What distinguishes the proposed protocol among similar quantum protocols, is the fact that it uses only EPR pairs, and, in particular, $|{\mathsf{\Psi }}^{+}⟩$ pairs. There are many sophisticated quantum protocols that guarantee Detectable Byzantine Agreement, but they do not easily lend themselves to practical implementations, due to present-day technological limitations. For a large number n of players, $|GHZ⟩$n-tuples, or other more exotic entangled states, are not easy to produce, a fact which might complicate the scalability of such protocols. In contrast, Bell states are, undoubtedly, the easiest to generate among maximally entangled states. This will, hopefully, facilitate the scalability of the proposed protocol, as only EPR pairs are required, irrespective of the number n of players. Finally, we mention that, even for arbitrary many players n, our protocol always completes in a constant number of rounds, namely 4.

1. Introduction

The term “Byzantine Agreement” has its origins in the landmark paper [1]. The paper studied the problem of using a playful terminology, involving Byzantium, a commanding general and many lieutenant generals, some loyal and some traitors. In another seminal work [2] the same authors had previously tackled the same problem but in a more formal way. The approach in [2] was perfectly distributed and symmetrical, whereas the approach in [1] has an slight asymmetry because the commanding general assumes the role of coordinating the lieutenant generals.

Currently, probably the most important application of Byzantine Agreement protocols would be in facilitating the implementation of a distributed consensus mechanism that enforces the consistency of data. Byzantine Agreement protocols are critical for successfully tackling distributed fault scenarios in the presence of adversaries (traitors) and enhancing the security of blockchain networks.

Today, it is clear that we have entered the quantum era. This is much more than a buzzword, as it promises to bring fundamental changes in our capabilities, indicated by the impressive progress in the construction of new, more powerful than before, quantum computers, such as IBM’s 127 qubit processor Eagle [3] and the more recent 433 qubit Osprey [4] quantum processor. At the same time, caution is warranted because these new powerful quantum computers bring us closer to the practical implementation of the quantum algorithms developed by Peter Shor and Lov Grover [5,6], that can compromise the security of the classical world.

It is fitting that the quantum paradigm can also be employed to provide us with novel quantum algorithms that adequately protect our critical information and achieve uncompromised security. The unique quantum phenomena are exploited in the design of secure protocols, e.g., for key distribution, as in [7,8,9,10,11,12,13], for secret sharing, as in [14,15], for cloud storage [16,17] or blockchain [18,19,20]. The emerging quantum setting has inspired researchers to approach the problem of Byzantine Agreement from a quantum perspective.

In an influential paper [21] in 2001, the authors introduced a variant of Byzantine Agreement, called “Detectable Byzantine Agreement” and gave the first quantum protocol for Detectable Byzantine Agreement. Their protocol, which tackled only the case of 3 players, used entangled qutrits in the Aharonov state. Since then, the concept of Detectable Byzantine Agreement has become widely accepted and has generated a plethora of similar works. Other early efforts include [22], where another protocol was proposed utilizing a four-qubit singlet state, and [23] that introduced a continuous variable solution to the Byzantine Agreement problem with multipartite entangled Gaussian states. More recently, notable contributions were made by [24], presenting a quantum protocol based on tripartite GHZ-like states and homodyne measurements in the continuous variable scenario, by [19], devising a protocol without entanglement, with the additional attractive feature of achieving agreement in only three rounds, and by [20], introducing a general n-party quantum protocol based on GHZ states, with possible use in a quantum blockchain network.

In this work, we introduce a novel quantum protocol, named EPRQDBA, and formally prove that EPRQDBA achieves detectable Byzantine Agreement. Almost all previous analogous protocols have been cast in the form of a game, and, we, too, follow this tradition. In particular, in our protocol, the familiar protagonists Alice, Bob and Charlie make one more appearance. It is instructive to mention that the pedagogical nature of games often makes expositions of difficult and technical concepts easier to understand and appreciate. Ever since their introduction in 1999 [25,26], quantum games, have offered additional insight because quite often quantum strategies seem to achieve better results than classical ones [27,28,29]. The famous prisoners’ dilemma game provides the most prominent example [26,30], which also applies to other abstract quantum games [31]. The quantization of many classical systems can even apply to political structures, as was shown in [32].

Contribution. This paper presents a new quantum protocol for Detectable Byzantine Agreement, called EPRQDBA. Indeed there exist many sophisticated quantum protocols guaranteed to achieve Detectable Byzantine Agreement, so why a new one? The distinguishing feature of the EPRQDBA protocol, which does not utilize a quantum signature scheme, is the fact that it only relies on EPR pairs. Exotic multi-particle entangled states employed in other protocol are not so easy to produce with our current quantum apparatus. This increases preparation time and complicates their use in situations where the number n of players is large. Similarly, although for small values of n $|GH{Z}_n\rangle$ states are easily generated by contemporary quantum computers, when the number n of players increases, it becomes considerably more difficult to prepare and distribute $|GH{Z}_n\rangle$ tuples. Thus, protocols that require $|GH{Z}_n\rangle$ tuples for n players dot not facilitate scalability. In contrast, Bell states are, without a doubt the easiest to generate among maximally entangled states. The EPRQDBA only requires EPR pairs, specifically $|{\mathsf{\Psi }}^{+}\rangle$ pairs, irrespective of the number n of players. This leads to a reduction in preparation time, increases scalability, and, ultimately, practicability. Another strong point of the EPRQDBA protocol is the fact that it completes in a constant number of rounds, specifically 4 rounds. Thus, the completion time of the protocol is independent of the number n of players, which also enhances its scalability.

Organization

The paper is organized as follows. Section 1 contains an introduction to the subject along with bibliographic pointers to related works. Section 2 provides a brief exposition to all the concepts necessary for the understanding of our protocol. Section 3 contains a detailed exposition of the EPRQDBA protocol for the special case of 3 players, namely Alice, Bob and Charlie. Section 4 gives a formal presentation of the EPRQDBA protocol in the general case of n players. Finally, Section 5 contains a summary and a discussion on some of the finer points of this protocol.

2. Preliminaries

2.1. $|{\mathsf{\Psi }}^{+}\rangle$ EPR Pairs

Quantum entanglement is one of the most celebrated properties of quantum mechanics and, without exaggeration, serves as the core of the majority of quantum protocols. Mathematically, entangled states of composite systems must be described as a linear combination of two or more product states of their subsystems, as a single product state will not suffice. The famous Bell states are special quantum states of two qubits, also called EPR pairs, that represent the simplest form of maximal entanglement. These states are succinctly described by the next formula from [33].

$$\begin{array}{c}\hfill |{\beta }_{x,y}\rangle =\frac{|0\rangle |y\rangle +{(-1)}^x|1\rangle |\overline{y}\rangle }{\sqrt{2}},\end{array}$$

(1)

where $|\overline{y}\rangle$ is the negation of $|y\rangle$.

There are four Bell states and their specific mathematical expression is given below. The subscripts A and B are used to emphasize the subsystem to which the corresponding qubit belongs, that is, qubits ${|·\rangle }_A$ belong to Alice and qubits ${|·\rangle }_B$ belong to Bob.

$$\begin{array}{c}\hfill |{\mathsf{\Phi }}^{+}\rangle =|{\beta }_{00}\rangle =\frac{{|0\rangle }_A{|0\rangle }_B+{|1\rangle }_A{|1\rangle }_B}{\sqrt{2}}\end{array}$$

(2)

$$\begin{array}{c}\hfill |{\mathsf{\Phi }}^{-}\rangle =|{\beta }_{10}\rangle =\frac{{|0\rangle }_A{|0\rangle }_B-{|1\rangle }_A{|1\rangle }_B}{\sqrt{2}}\end{array}$$

(3)

$$\begin{array}{c}\hfill |{\mathsf{\Psi }}^{+}\rangle =|{\beta }_{01}\rangle =\frac{{|0\rangle }_A{|1\rangle }_B+{|1\rangle }_A{|0\rangle }_B}{\sqrt{2}}\end{array}$$

(4)

$$\begin{array}{c}\hfill |{\mathsf{\Psi }}^{-}\rangle =|{\beta }_{11}\rangle =\frac{{|0\rangle }_A{|1\rangle }_B-{|1\rangle }_A{|0\rangle }_B}{\sqrt{2}}\end{array}$$

(5)

For existing quantum computers that use the circuit model, it is quite easy to generate Bell states. The proposed protocol relies on $|{\mathsf{\Psi }}^{+}\rangle =\frac{{|0\rangle }_A{|1\rangle }_B+{|1\rangle }_A{|0\rangle }_B}{\sqrt{2}}$ pairs. Apart from $|{\mathsf{\Psi }}^{+}\rangle$ pairs, we shall make use of qubits in another well-known state, namely $|+\rangle$. For convenience, we recall the definition of $|+\rangle$

$$\begin{array}{c}\hfill |+\rangle =H|0\rangle =\frac{|0\rangle +|1\rangle }{\sqrt{2}},\end{array}$$

(6)

which can be immediately produced by applying the Hadamard transform on $|0\rangle$. Let us also clarify that all quantum registers are measured with respect to the computational basis $B=\{|0\rangle ,|1\rangle \}$.

2.2. Detectable Byzantine Agreement

In the landmark paper [1], the authors used the term the “Byzantine Generals Problem” to formulate the problem we study in this paper. A little later, two other influential works [34,35] changed the terminology a bit and refereed to the same problem as the “Byzantine Agreement Problem,” a term that has been consistently used in the literature ever since. The problem itself involves n generals of the Byzantine empire, one of them being the commanding general and the rest $n-1$ being lieutenant generals. The commanding general must communicate his order to the lieutenant generals who are in different geographical locations. The overall situation is further complicated by the existence of traitors among the generals (possibly including even the commanding general). The notion of Byzantine Agreement was defined in [1] as follows.

Definition 1

(Byzantine Agreement). A protocol achieves Byzantine Agreement (BA) if it satisfies the following conditions.

(BA₁)

All loyal lieutenant generals follow the same order.

(BA₂)

When the commanding general is loyal, all loyal lieutenant generals follow the commanding general’s order.

The authors in [1] not only presented an algorithm that, under certain assumptions, achieves BA, but also obtained the significant result that, under the assumption of pairwise authenticated channels among the generals, BA can be attained if and only if $t<\frac{n}{3}$, where n is the number of generals and t is the number of traitors. Later it was established that this bound can’t be improved even if additional resources are assumed (see [36]). An important special illustration of this fact, is the case of $n=3$ generals, exactly one of which is a traitor because it is impossible to achieve BA in such a case, by any classical protocol.

In the seminal paper [21] a variant of BA called Detectable Byzantine Agreement (DBA from now on) was introduced. By slightly relaxing the requirements of the BA protocol, and, in particular, allowing the loyal generals to abort the protocol, an action that is not permitted in the original protocol, the authors were able to give the first quantum protocol for DBA. Their protocol relied on Aharonov states and improved the previous bound by achieving agreement in the special case of one traitor among three generals. Although [21] considered only the case of 3 generals, later works introduced DBA protocols for n parties. In this work we use the Definition 2 for DBA.

Definition 2

(Detectable Byzantine Agreement). A protocol achieves Detectable Byzantine Agreement (DBA) if it satisfies the following conditions.

(DBA₁)

If all generals are loyal, the protocol achieves Byzantine Agreement.

(DBA₂)

Consistency: All loyal generals either follow the same order or abort the protocol.

(DBA₃)

Validity: If the commanding general is loyal, then either all loyal lieutenant generals follow the commanding general’s order or abort the protocol.

A comparison of Definition 1 with Definition 2 shows that the critical difference between BA and DBA lies in the extra capability of the generals to abort the protocol in the DBA case. As is common practice, we shall assume that the commanding general’s orders are either 0 or 1, and we shall use the symbol ⊥ to signify that the decision to abort.

2.3. Assumptions and Setting

In this section we begin the presentation of our EPR-based protocol for Detectable Byzantine Agreement, or EPRQDBA for short. For the sake of completeness, we explicitly state the assumptions that underlie the execution of the EPRQDBA protocol.

(A₁)

There is a “quantum source” responsible for generating single qubits in the $|+\rangle$ state and EPR pairs entangled in the $|{\mathsf{\Psi }}^{+}\rangle$ state. The source distributes these qubits to each general through a quantum channel.

(A₂)

A complete network of pairwise authenticated classical channels connects all generals.

(A₃)

The classical network is synchronous coordinated by a global clock.

(A₄)

The protocol unfolds in rounds. In every round each general may receive messages, perform computations, and send messages. The messages sent during the current round are guaranteed to have arrived to their intended recipients by the beginning of the next round.

(A₅)

All measurements are performed with respect to the computational basis $B=\{|0\rangle ,|1\rangle \}$.

We follow the tradition and describe the EPRQDBA protocol as a game. The players in this game are the n spatially distributed generals. It will be convenient to divide them into two groups. The commanding general alone comprises the first group. From now on the famous Alice will play the role of the commanding general. The $n-1$ lieutenant generals make up the second group. In the special case of $n=3$ that we shall examine shortly, the venerable Bob and Charlie will play the 2 lieutenant generals. In the general case, where $n>3$, we will mostly employ generic names such LT${}_0$, …, LT${}_{n-2}$, LT standing of course for “lieutenant general.” Occasionally, to emphasize some point, we may use again Bob or Charlie. To make the presentation easier to follow, we shall first show how the EPRQDBA protocol works in the special case of only 3 players, namely Alice, Bod and Charlie.

3. The 3 Player EPRQDBA Protocol

3.1. Entanglement Distribution Phase

The EPRQDBA protocol can be conceptually organized into 3 distinct phases. The first is the entanglement distribution phase, which refers to the generation and distribution of qubits and entangled EPR pairs. As we have briefly explained in assumption (${\mathbf{A}}_1$), we assume the existence of a trusted quantum source that undertakes this role. It is a relatively easy task, in view of the capabilities of modern quantum apparatus. Hence, the quantum source will have no difficulty in producing

• $2m$ qubits in the $|+\rangle$ state by simply applying the Hadamard transform on $|0\rangle$, and
• $2m$ EPR pairs in the $|{\mathsf{\Psi }}^{+}\rangle$ state, which can be easily generated by contemporary quantum computers.

In the above scheme, the parameter m is a properly chosen positive integer. Further suggestions regarding appropriate values of m are provided in the mathematical analysis of the protocol.

Afterwards, the source transmits the qubits to the intended recipients through the quantum channels following the pattern outlined below.

(3D₁)

The $2m$ EPR pairs are numbered from 0 to $2m-1$.

(3D₂)

From every EPR pair k, where $0\le k\le 2m-1$, the first qubit is sent to Alice.

(3D₃)

The source sends to Bob $2m$ qubits: $q_0^{\prime }$, $q_1^{\prime }$, …, $q_{2m-2}^{\prime }$, $q_{2m-1}^{\prime }$. The transmission alternates qubits in the $|+\rangle$ state (in the even positions of this sequence) with the second qubit of the odd-numbered EPR pairs (in the odd positions of this sequence).

(3D₄)

Symmetrically, the source sends to Charlie $2m$ qubits: $q_0^{″}$, $q_1^{″}$, …, $q_{2m-2}^{″}$, $q_{2m-1}^{″}$. In the even positions of this sequence, the source inserts the second qubit of the even-numbered EPR pairs and in the odd positions qubits in the $|+\rangle$ state.

The end result is that the quantum registers of Alice, Bob and Charlie are populated as shown in Figure 1. Qubits of the same EPR pair are shown in the same color. Red is used to indicate the EPR pairs shared between Alice and Bob, which occupy the odd-numbered positions in their quantum registers. Analogously, green is used for the EPR pairs shared between Alice and Charlie that occupy the even-numbered positions in their quantum registers. The gray qubits represent those in the $|+\rangle$ state that occupy the remaining positions in Bob and Charlie’s registers.

3.2. Entanglement Verification Phase

This phase is crucial because the entire protocol is based on entanglement. If entanglement is not guaranteed, then agreement cannot not be guaranteed either. Obviously, the verification process can lead to two dramatically different outcomes. If entanglement verification is successfully established, then the EPRQDBA protocol is certain to achieve agreement. Failure of verification implies absence of the necessary entanglement. This could be attributed either to noisy quantum channels or insidious sabotage by an active adversary. Whatever the true reason is, the only viable solution is to abort the current execution of the protocol, and initiate the whole procedure again from scratch, after taking some corrective measures.

This phase is very important because if entanglement is broken, then agreement can’t be guaranteed. For this reason, the entanglement verification phase has been extensively analyzed in the relative literature. The EPRQDBA protocol adheres to the previously established methods that have been introduced in previous works, such as [20,21,22,23,24]. In order to avoid repeating well-known techniques, we refer the reader to the these papers that describe in detail the implementation of this phase.

3.3. Agreement Phase

The EPRQDBA protocol achieves detectable agreement during its third and last phase, aptly named agreement phase. Alice, Bob and Charlie initiate the agreement phase by measuring their quantum registers. The distribution scheme, as analyzed in Section 3.1, leads to some crucial correlations among the contents of Alice, Bob and Charlie’s registers.

Definition 3.

Let the bit vectors $\mathbf{a}$, $\mathbf{b}$, and $\mathbf{c}$ denote the contents of Alice, Bob and Charlie’s registers after the measurement, and assume that their explicit form is as given below:

$$\begin{array}{cc}\hfill \mathbf{a}& =\underset{pairm-1}{\underbrace{a_{2m-1}{a}_{2m-2}}}\underset{pairm-2}{\underbrace{a_{2m-3}{a}_{2m-4}}}\cdots \underset{pair1}{\underbrace{a_3{a}_2}}\underset{pair0}{\underbrace{a_1{a}_0}},\hfill \end{array}$$

(7)

$$\begin{array}{cc}\hfill \mathbf{b}& =\underset{pairm-1}{\underbrace{b_{2m-1}{b}_{2m-2}}}\underset{pairm-2}{\underbrace{b_{2m-3}{b}_{2m-4}}}\cdots \underset{pair1}{\underbrace{b_3{b}_2}}\underset{pair0}{\underbrace{b_1{b}_0}},\hfill \end{array}$$

(8)

$$\begin{array}{cc}\hfill \mathbf{c}& =\underset{pairm-1}{\underbrace{c_{2m-1}{c}_{2m-2}}}\underset{pairm-2}{\underbrace{c_{2m-3}{c}_{2m-4}}}\cdots \underset{pair1}{\underbrace{c_3{c}_2}}\underset{pair0}{\underbrace{c_1{c}_0}}.\hfill \end{array}$$

(9)

The $k^{th}$ pair of $\mathbf{a}$, $0\le k\le m-1$, is the pair of bits $a_{2k+1}{a}_{2k}$, and is designated by ${\mathbf{a}}_k$. Similarly, the $k^{th}$ pairs of $\mathbf{b}$ and $\mathbf{c}$ are designated by ${\mathbf{b}}_k$ and ${\mathbf{c}}_k$. Hence, $\mathbf{a}$, $\mathbf{b}$, and $\mathbf{c}$ can be written succinctly as:

$$\begin{array}{cc}\hfill \mathbf{a}& ={\mathbf{a}}_{m-1}{\mathbf{a}}_{m-2}\dots {\mathbf{a}}_1{\mathbf{a}}_0,\hfill \end{array}$$

(10)

$$\begin{array}{cc}\hfill \mathbf{b}& ={\mathbf{b}}_{m-1}{\mathbf{b}}_{m-2}\dots {\mathbf{b}}_1{\mathbf{b}}_0,\hfill \end{array}$$

(11)

$$\begin{array}{cc}\hfill \mathbf{c}& ={\mathbf{c}}_{m-1}{\mathbf{c}}_{m-2}\dots {\mathbf{c}}_1{\mathbf{c}}_0.\hfill \end{array}$$

(12)

We also define a special type of pair, termed the uncertain pair, that is denoted by $\mathbf{u}=\bigsqcup \bigsqcup$, where ⊔ is a new symbol, different from 0 and 1. In contrast, pairs consisting of BITS 0 and/or 1 are called definite pairs.

When we want refer to either Bob’s or Charlie’s bit vector, but without specifying precisely which one, we will designate it by

$$\begin{array}{cc}\hfill \mathbf{l}& ={\mathbf{l}}_{m-1}{\mathbf{l}}_{m-2}\dots {\mathbf{l}}_1{\mathbf{l}}_0\hfill \\ \hfill & =\underset{\mathrm{pair}m-1}{\underbrace{l_{2m-1}{l}_{2m-2}}}\underset{\mathrm{pair}m-2}{\underbrace{l_{2m-3}{l}_{2m-4}}}\dots \underset{\mathrm{pair}1}{\underbrace{l_3{l}_2}}\underset{\mathrm{pair}0}{\underbrace{l_1{l}_0}}.\hfill \end{array}$$

(13)

According to the distribution scheme, Alice and Bob share the odd-numbered $|{\mathsf{\Psi }}^{+}\rangle =\frac{{|0\rangle }_A{|1\rangle }_B+{|1\rangle }_A{|0\rangle }_B}{\sqrt{2}}$ pairs, and Alice and Charlie share the even-numbered $|{\mathsf{\Psi }}^{+}\rangle =\frac{{|0\rangle }_A{|1\rangle }_C+{|1\rangle }_A{|0\rangle }_C}{\sqrt{2}}$ pairs. Therefore, the next Lemma 1 holds. Its proof is trivial and is omitted.

Lemma 1

(Pair Differentiation Property). The next property, termed pair differentiation property, characterizes the corresponding bits and pairs of the bit vectors $\mathbf{a}$, $\mathbf{b}$, and $\mathbf{c}$.

• For every odd-numbered bit $b_k$ in $\mathbf{b}$, where $k=1,3,\dots ,2m-1$, it holds that

  $$\begin{array}{cc}\hfill b_k& =\overline{a_k},k=1,3,\dots ,2m-1.\hfill \end{array}$$

  (14)
• For every even-numbered bit $c_k$ in $\mathbf{c}$, where $k=0,2,\dots ,2m-2$, it holds that

  $$\begin{array}{cc}\hfill c_k& =\overline{a_k},k=0,2,\dots ,2m-2.\hfill \end{array}$$

  (15)
• Every ${\mathbf{a}}_k$ pair, where $0\le k\le m-1$, differs from the corresponding pairs ${\mathbf{b}}_k$ and ${\mathbf{c}}_k$.

  $$\begin{array}{c}\hfill {\mathbf{a}}_k\ne {\mathbf{b}}_k\mathrm{and}{\mathbf{a}}_k\ne {\mathbf{c}}_k,\mathrm{for}\mathrm{every}k,0\le k\le m-1.\end{array}$$

  (16)

In the above relations (14) and (15), $\overline{a_k}$ is the negation of $a_k$.

Visually, the situation regarding the correlations among corresponding bits is shown in Figure 2. Again bits resulting from the same EPR pair are shown in the same color.

Definition 4

(Command Vectors). Alice sends to Bob and Charlie either the command 0 or the command 1. Besides her command, as a “proof”, she also sends an appropriate command vector. The idea is that the command vector for Bob is always different from the command vector for Charlie, even when the command is the same. For the command 0, the command vectors for Bob and Charlie are ${𝟘}_B$ and ${𝟘}_C$, respectively, whereas for the command 1 the corresponding command vectors are ${\mathbb{1}}_B$ and ${\mathbb{1}}_C$. The explicit form of the command vectors is the following.

$$\begin{array}{cc}\hfill {\mathbb{0}}_B& ={\mathbf{v}}_{m-1}{\mathbf{v}}_{m-2}\dots {\mathbf{v}}_1{\mathbf{v}}_0,where{\mathbf{v}}_k=\left\{\begin{array}{cc}{\mathbf{a}}_k=a_{2k+1}{a}_{2k}\hfill & if{a}_{2k+1}=0\\ \mathbf{u}=\bigsqcup \bigsqcup \hfill & if{a}_{2k+1}\ne 0\end{array}\right.,0\le k\le m-1.\hfill \end{array}$$

(17)

$$\begin{array}{cc}\hfill {\mathbb{0}}_C& ={\mathbf{v}}_{m-1}{\mathbf{v}}_{m-2}\dots {\mathbf{v}}_1{\mathbf{v}}_0,where{\mathbf{v}}_k=\left\{\begin{array}{cc}{\mathbf{a}}_k=a_{2k+1}{a}_{2k}\hfill & if{a}_{2k}=0\\ \mathbf{u}=\bigsqcup \bigsqcup \hfill & if{a}_{2k}\ne 0\end{array}\right.,0\le k\le m-1.\hfill \end{array}$$

(18)

$$\begin{array}{cc}\hfill {\mathbb{1}}_B& ={\mathbf{v}}_{m-1}{\mathbf{v}}_{m-2}\dots {\mathbf{v}}_1{\mathbf{v}}_0,where{\mathbf{v}}_k=\left\{\begin{array}{cc}{\mathbf{a}}_k=a_{2k+1}{a}_{2k}\hfill & if{a}_{2k+1}=1\\ \mathbf{u}=\bigsqcup \bigsqcup \hfill & if{a}_{2k+1}\ne 1\end{array}\right.,0\le k\le m-1.\hfill \end{array}$$

(19)

$$\begin{array}{cc}\hfill {\mathbb{1}}_C& ={\mathbf{v}}_{m-1}{\mathbf{v}}_{m-2}\dots {\mathbf{v}}_1{\mathbf{v}}_0,where{\mathbf{v}}_k=\left\{\begin{array}{cc}{\mathbf{a}}_k=a_{2k+1}{a}_{2k}\hfill & if{a}_{2k}=1\\ \mathbf{u}=\bigsqcup \bigsqcup \hfill & if{a}_{2k}\ne 1\end{array}\right.,0\le k\le m-1.\hfill \end{array}$$

(20)

A command vector, besides pairs containing 0 and 1 bits, also contains an approximately equal number of pairs consisting of ⊔ characters. When we want refer to a command vector, but without providing further details, we will designate it by

$$\begin{array}{cc}\hfill \mathbf{v}& ={\mathbf{v}}_{m-1}{\mathbf{v}}_{m-2}\dots {\mathbf{v}}_1{\mathbf{v}}_0\hfill \\ \hfill & =\underset{pairm-1}{\underbrace{v_{2m-1}{v}_{2m-2}}}\underset{pairm-2}{\underbrace{v_{2m-3}{v}_{2m-4}}}\dots \underset{pair1}{\underbrace{v_3{v}_2}}\underset{\mathrm{pair}0}{\underbrace{v_1{v}_0}}.\hfill \end{array}$$

(21)

Given a command vector or a bit vector, we define the set containing the positions of the pairs that consist of a given combination of bits.

Definition 5

(Pair Designation). Given a command vector $\mathbf{v}$ or a bit vector $\mathbf{l}$, we define the set ${\mathbb{P}}_{x,y}\left(\mathbf{v}\right)$ and ${\mathbb{P}}_{x,y}\left(\mathbf{l}\right)$, respectively, of the positions of those pairs consisting precisely of the bits $x,y$.

Example 1

(Illustrating the concepts). This first example is designed to illustrate all the previous concepts. For practical purposes, i.e., to fit in a page, we take $m=12$. In a real implementation m should certainly be greater (see Table 1). Let us assume that the contents of Alice, Bob and Charlie’s registers are those shown in Figure 3.

By Definition 3, we may write that

$$\begin{array}{cc}\hfill \mathbf{a}& =\underset{pair11}{\underbrace{10}}\underset{pair10}{\underbrace{11}}\underset{pair9}{\underbrace{00}}\underset{pair8}{\underbrace{10}}\underset{pair7}{\underbrace{01}}\underset{pair6}{\underbrace{11}}\underset{pair5}{\underbrace{00}}\underset{pair4}{\underbrace{00}}\underset{pair3}{\underbrace{11}}\underset{pair2}{\underbrace{00}}\underset{pair1}{\underbrace{10}}\underset{pair0}{\underbrace{01}},\hfill \end{array}$$

(22)

$$\begin{array}{cc}\hfill \mathbf{b}& =\underset{pair11}{\underbrace{00}}\underset{pair10}{\underbrace{01}}\underset{pair9}{\underbrace{11}}\underset{pair8}{\underbrace{01}}\underset{pair7}{\underbrace{10}}\underset{pair6}{\underbrace{01}}\underset{pair5}{\underbrace{10}}\underset{pair4}{\underbrace{11}}\underset{pair3}{\underbrace{01}}\underset{pair2}{\underbrace{10}}\underset{pair1}{\underbrace{00}}\underset{pair0}{\underbrace{11}},\hfill \end{array}$$

(23)

$$\begin{array}{cc}\hfill \mathbf{c}& =\underset{\mathrm{pair}11}{\underbrace{01}}\underset{\mathrm{pair}10}{\underbrace{00}}\underset{\mathrm{pair}9}{\underbrace{11}}\underset{\mathrm{pair}8}{\underbrace{11}}\underset{\mathrm{pair}7}{\underbrace{00}}\underset{\mathrm{pair}6}{\underbrace{10}}\underset{\mathrm{pair}5}{\underbrace{01}}\underset{\mathrm{pair}4}{\underbrace{11}}\underset{\mathrm{pair}3}{\underbrace{00}}\underset{\mathrm{pair}2}{\underbrace{11}}\underset{\mathrm{pair}1}{\underbrace{01}}\underset{\mathrm{pair}0}{\underbrace{10}},\hfill \end{array}$$

(24)

where the bit vectors $\mathbf{a}$, $\mathbf{b}$, and $\mathbf{c}$ denote the contents of Alice, Bob and Charlie’s registers after the measurement.

In Figure 3, the correlated pairs of bits are drawn with the same color. Specifically, as in all previous figures, red is used to indicate the pairs of bits that originated from the measurement of the EPR pairs shared between Alice and Bob, and which occupy the odd-numbered positions in their registers. Analogously, green depicts the pairs of bits that originated from the measurement of the EPR pairs shared between Alice and Charlie, which occupy the even-numbered positions in their registers. The remaining gray bits that appear in Bob and Charlie’s registers come from qubits that were initially in the $|+\rangle$ state.

By a simple observation of the red and green pairs of bits, we immediately see that Lemma 1 is verified. In every red pair, the two bits are complementary, i.e., the second bit is the negation of the first. This is due to the fact that their values are the result of the measurement of a $|{\mathsf{\Psi }}^{+}\rangle$ pair. The red pairs correlate Alice and Bob’s registers. Exactly the same holds for the green pairs, which correlate Alice and Charlie’s registers. The initial presence of the $|{\mathsf{\Psi }}^{+}\rangle$ pairs in the entanglement distribution phase, has manifested into classical correlation among the contents of Alice, Bob, and Charlie’s registers during the agreement phase.

There are 12 pairs in $\mathbf{a}$, $\mathbf{b}$, and $\mathbf{c}$. In each of them, the $k^{th}$ pair, $0\le k\le 11$, contains the bits that occupy positions $2k+1$ and $2k$, as shown in Figure 3. The bit in position $2k+1$ is the most significant bit of the $k^{th}$ pair and the bit in position $2k$ is the least significant bit.

Let us suppose that Alice sends the order 0. According to Definition 4, Alice must prove her order by sending the command vectors ${\mathbb{0}}_B$ and ${\mathbb{0}}_C$ to Bob and Charlie, respectively. The command vector ${\mathbb{0}}_B$ is constructed by including the pairs in $\mathbf{a}$ with most significant bit 0 (irrespective of what the least significant bit is) and filling the gaps with the uncertain pair. Symmetrically, ${\mathbb{0}}_C$ is constructed by including the pairs in $\mathbf{a}$ with least significant bit 0 (irrespective of what the most significant bit is) and filling the gaps with the uncertain pair. Thus, ${\mathbb{0}}_B$ and ${\mathbb{0}}_C$ are as given below (we have also repeated $\mathbf{a}$ to facilitate the comparison).

$$\begin{array}{cc}\hfill \mathbf{a}& =\underset{pair11}{\underbrace{10}}\underset{pair10}{\underbrace{11}}\underset{pair9}{\underbrace{00}}\underset{pair8}{\underbrace{10}}\underset{pair7}{\underbrace{01}}\underset{pair6}{\underbrace{11}}\underset{pair5}{\underbrace{00}}\underset{pair4}{\underbrace{00}}\underset{pair3}{\underbrace{11}}\underset{pair2}{\underbrace{00}}\underset{pair1}{\underbrace{10}}\underset{pair0}{\underbrace{01}},\hfill \end{array}$$

(25)

$$\begin{array}{cc}\hfill {\mathbb{0}}_B& =\underset{pair11}{\underbrace{\bigsqcup \bigsqcup }}\underset{pair10}{\underbrace{\bigsqcup \bigsqcup }}\underset{pair9}{\underbrace{00}}\underset{pair8}{\underbrace{\bigsqcup \bigsqcup }}\underset{pair7}{\underbrace{01}}\underset{pair6}{\underbrace{\bigsqcup \bigsqcup }}\underset{pair5}{\underbrace{00}}\underset{pair4}{\underbrace{00}}\underset{pair3}{\underbrace{\bigsqcup \bigsqcup }}\underset{pair2}{\underbrace{00}}\underset{pair1}{\underbrace{\bigsqcup \bigsqcup }}\underset{pair0}{\underbrace{01}},\hfill \end{array}$$

(26)

$$\begin{array}{cc}\hfill {\mathbb{0}}_C& =\underset{pair11}{\underbrace{10}}\underset{pair10}{\underbrace{\bigsqcup \bigsqcup }}\underset{pair9}{\underbrace{00}}\underset{pair8}{\underbrace{10}}\underset{pair7}{\underbrace{\bigsqcup \bigsqcup }}\underset{pair6}{\underbrace{\bigsqcup \bigsqcup }}\underset{pair5}{\underbrace{00}}\underset{pair4}{\underbrace{00}}\underset{pair3}{\underbrace{\bigsqcup \bigsqcup }}\underset{pair2}{\underbrace{00}}\underset{pair1}{\underbrace{10}}\underset{pair0}{\underbrace{\bigsqcup \bigsqcup }}.\hfill \end{array}$$

(27)

Recalling Definition 5, we see that the sets ${\mathbb{P}}_{x,y}\left({\mathbb{0}}_B\right)$ and ${\mathbb{P}}_{x,y}\left({\mathbb{0}}_C\right)$ contain the positions in ${\mathbb{0}}_B$ and ${\mathbb{0}}_C$, respectively, of the pairs consisting of the bits $x,y$. In view of (26) and (27), we derive that

$$\begin{array}{ll}•\hspace{1em}{\mathbb{P}}_{0,0}\left({\mathbb{0}}_B\right)=\{2,4,5,9\}\hspace{1em}\hspace{1em}\hspace{1em}& •\hspace{1em}{\mathbb{P}}_{0,0}\left({\mathbb{0}}_C\right)=\{2,4,5,9\}\\ •\hspace{1em}{\mathbb{P}}_{0,1}\left({\mathbb{0}}_B\right)=\{0,7\}& •\hspace{1em}{\mathbb{P}}_{1,0}\left({\mathbb{0}}_C\right)=\{1,8,11\}\end{array}$$

Let us now suppose that Alice sends the order 1. In this case, Alice must prove her order by sending the command vectors ${\mathbb{1}}_B$ and ${\mathbb{1}}_C$ to Bob and Charlie, respectively. The command vector ${\mathbb{1}}_B$ is constructed by including the pairs in $\mathbf{a}$ with most significant bit 1 (irrespective of what the least significant bit is) and filling the gaps with the uncertain pair. Symmetrically, ${\mathbb{1}}_C$ is constructed by including the pairs in $\mathbf{a}$ with least significant bit 1 (irrespective of what the most significant bit is) and filling the gaps with the uncertain pair. The resulting ${\mathbb{1}}_B$ and ${\mathbb{1}}_C$ are shown below (again, we have also repeated $\mathbf{a}$ to facilitate the comparison).

$$\begin{array}{cc}\hfill \mathbf{a}& =\underset{pair11}{\underbrace{10}}\underset{pair10}{\underbrace{11}}\underset{pair9}{\underbrace{00}}\underset{pair8}{\underbrace{10}}\underset{pair7}{\underbrace{01}}\underset{pair6}{\underbrace{11}}\underset{pair5}{\underbrace{00}}\underset{pair4}{\underbrace{00}}\underset{pair3}{\underbrace{11}}\underset{pair2}{\underbrace{00}}\underset{pair1}{\underbrace{10}}\underset{pair0}{\underbrace{01}},\hfill \end{array}$$

(28)

$$\begin{array}{cc}\hfill {\mathbb{1}}_B& =\underset{pair11}{\underbrace{10}}\underset{pair10}{\underbrace{11}}\underset{pair9}{\underbrace{\bigsqcup \bigsqcup }}\underset{pair8}{\underbrace{10}}\underset{pair7}{\underbrace{\bigsqcup \bigsqcup }}\underset{pair6}{\underbrace{11}}\underset{pair5}{\underbrace{\bigsqcup \bigsqcup }}\underset{pair4}{\underbrace{\bigsqcup \bigsqcup }}\underset{pair3}{\underbrace{11}}\underset{pair2}{\underbrace{\bigsqcup \bigsqcup }}\underset{pair1}{\underbrace{10}}\underset{pair0}{\underbrace{\bigsqcup \bigsqcup }},\hfill \end{array}$$

(29)

$$\begin{array}{cc}\hfill {\mathbb{1}}_C& =\underset{\mathrm{pair}11}{\underbrace{\bigsqcup \bigsqcup }}\underset{\mathrm{pair}10}{\underbrace{11}}\underset{\mathrm{pair}9}{\underbrace{\bigsqcup \bigsqcup }}\underset{\mathrm{pair}8}{\underbrace{\bigsqcup \bigsqcup }}\underset{\mathrm{pair}7}{\underbrace{01}}\underset{\mathrm{pair}6}{\underbrace{11}}\underset{\mathrm{pair}5}{\underbrace{\bigsqcup \bigsqcup }}\underset{\mathrm{pair}4}{\underbrace{\bigsqcup \bigsqcup }}\underset{\mathrm{pair}3}{\underbrace{11}}\underset{\mathrm{pair}2}{\underbrace{\bigsqcup \bigsqcup }}\underset{\mathrm{pair}1}{\underbrace{\bigsqcup \bigsqcup }}\underset{\mathrm{pair}0}{\underbrace{01}}.\hfill \end{array}$$

(30)

The sets ${\mathbb{P}}_{x,y}\left({\mathbb{1}}_B\right)$ and ${\mathbb{P}}_{x,y}\left({\mathbb{1}}_C\right)$ contain the positions in ${\mathbb{1}}_B$ and ${\mathbb{1}}_C$, respectively, of the $x,y$ pairs. Taking into account (29) and (30), we see that

$$\begin{array}{ll}•\hspace{1em}{\mathbb{P}}_{1,0}\left({\mathbb{1}}_B\right)=\{1,8,11\}\hspace{1em}\hspace{1em}\hspace{1em}& •\hspace{1em}{\mathbb{P}}_{0,1}\left({\mathbb{1}}_C\right)=\{0,7\}\\ •\hspace{1em}{\mathbb{P}}_{1,1}\left({\mathbb{1}}_B\right)=\{3,6,10\}& •\hspace{1em}{\mathbb{P}}_{1,1}\left({\mathbb{1}}_C\right)=\{3,6,10\}\end{array}$$

In the present example, the value of the parameter m is 12, which implies that $\frac{m}{4}=3$. The cardinality of all the sets ${\mathbb{P}}_{0,0}\left({\mathbb{0}}_B\right)$, ${\mathbb{P}}_{0,1}\left({\mathbb{0}}_B\right)$, ${\mathbb{P}}_{0,0}\left({\mathbb{0}}_C\right)$, ${\mathbb{P}}_{1,0}\left({\mathbb{0}}_C\right)$, ${\mathbb{P}}_{1,0}\left({\mathbb{1}}_B\right)$, ${\mathbb{P}}_{1,1}\left({\mathbb{1}}_B\right)$, ${\mathbb{P}}_{0,1}\left({\mathbb{1}}_C\right)$, and ${\mathbb{P}}_{1,1}\left({\mathbb{1}}_C\right)$ is $\approx 3=\frac{m}{4}$, which verifies the next Lemma 2. Of course, the exact cardinality of some of these sets deviates slightly from the expected value 3, but this is not unexpected. As m increases, the ratio of the deviation to m will tend to 0. ◃

Based on Definition 5, it is trivial to see that the next Lemma 2 holds. The notation $\left|S\right|$ is employed to designate the cardinality, i.e., the number of elements, of an arbitrary set S.

Lemma 2

(Loyal Command Vector Properties). If Alice is loyal, her command vectors ${\mathbb{0}}_B$, ${\mathbb{0}}_C$, ${\mathbb{1}}_B$ and ${\mathbb{1}}_C$ satisfy the following properties.

$$\begin{array}{ll}•\hspace{1em}|{\mathbb{P}}_{0,0}\left({\mathbb{0}}_B\right)|\approx \frac{m}{4}& •\hspace{1em}|{\mathbb{P}}_{0,0}\left({\mathbb{0}}_C\right)|\approx \frac{m}{4}\\ •\hspace{1em}|{\mathbb{P}}_{0,1}\left({\mathbb{0}}_B\right)|\approx \frac{m}{4}\hspace{1em}\hspace{1em}\hspace{1em}& •\hspace{1em}|{\mathbb{P}}_{1,0}\left({\mathbb{0}}_C\right)|\approx \frac{m}{4}\\ •\hspace{1em}|{\mathbb{P}}_{1,0}\left({\mathbb{1}}_B\right)|\approx \frac{m}{4}\hspace{1em}\hspace{1em}\hspace{1em}& •\hspace{1em}|{\mathbb{P}}_{0,1}\left({\mathbb{1}}_C\right)|\approx \frac{m}{4}\\ •\hspace{1em}|{\mathbb{P}}_{1,1}\left({\mathbb{1}}_B\right)|\approx \frac{m}{4}\hspace{1em}\hspace{1em}\hspace{1em}& •\hspace{1em}|{\mathbb{P}}_{1,1}\left({\mathbb{1}}_C\right)|\approx \frac{m}{4}\end{array}$$

The agreement phase of the EPRQDBA protocol evolves in rounds. The actions taken by the Alice, Bob and Charlie in each round are described below.

Algorithms 1–3 apply Lemmata 1 and 2 to determine whether a command vector is consistent, in which case they return TRUE. If they determine inconsistencies, they terminate and return FALSE. The names of Algorithms 2 and 3 are mnemonic abbreviations for “Check with Command Vector” and “Check with Bit Vector.” It is important to explain their difference.

Without loss of generality, let us suppose that Bob received the order 0 and a consistent command vector ${\mathbf{v}}_A$ from Alice, while Charlie claims that he received the order 1. Charlie must convince Bob by sending Bob the command vector $\mathbf{v}$ he claims he received from Alice. Bob checks $\mathbf{v}$ for inconsistencies against his own ${\mathbf{v}}_A$ by invoking the Algorithm 2. Now, imagine that Bob received an inconsistent command vector ${\mathbf{v}}_A$ from Alice and his initial decision is to abort, while Charlie claims that he received the order 1. Charlie must convince Bob by sending Bob the command vector $\mathbf{v}$ he claims he received from Alice. In this situation, Bob does not have a consistent command vector ${\mathbf{v}}_A$ that he could use, so Bob must check $\mathbf{v}$ for inconsistencies against his own bit vector $\mathbf{b}$ by invoking the Algorithm 3.

In Algorithms 1–3, we employ the following notation.

• $i,j\in \{0,1\}$ are the indices of Bob (1) and Charlie (0).
• c, where $c=0$ or $c=1$, is the command being checked for consistency.
• ${\mathbf{v}}_A=v_{2m-1}{v}_{2m-2}\dots v_1{v}_0$ is the command vector sent by Alice.
• $\mathbf{v}$, is the command vector sent by Bod to Charlie (or vice versa).
• $\mathbf{l}=l_{2m-1}{l}_{2m-2}\dots l_1{l}_0$ is the bit vector of Bod (Charlie) who does the consistency checking.
• △ is the symmetric difference of two sets, i.e., $S△S^{\prime }=\left(S\setminus S^{\prime }\right)\bigcup \left(S^{\prime }\setminus S\right)$, for given sets S and $S^{\prime }$.

Algorithm 1 CheckAlice (i, c, ${\mathbf{v}}_A$, $\mathbf{l}$)

Algorithm 2 CheckWCV (i, j, c, $\mathbf{v}$, ${\mathbf{v}}_A$)

Algorithm 3 CheckWBV (i, j, c, $\mathbf{v}$, $\mathbf{l}$)

In order to streamline the exposition of the text, all lengthy proofs are relocated in the Appendix A.

In the literature, all works focusing on the 3 player setting, assume that there is exactly one traitor among the 3, who can either be the commanding general or one of the lieutenant generals. If we assume that there is precisely one traitor among the 3, we can prove the following Propositions 1 and 2.

Proposition 1

(Loyal Alice). If Alice is loyal, the 3 player EPRQDBA protocol will enable the loyal lieutenant general to agree with Alice. Specifically, if Alice and Bob are loyal and Charlie is a traitor, Bob will follow Alice’s order. Symmetrically, if Alice and Charlie are loyal and Bob is a traitor, Charlie will follow Alice’s order.

Proposition 2

(Traitor Alice). If Bob and Charlie are loyal and Alice is a traitor, the 3 player EPRQDBA protocol will enable Bob and Charlie to reach agreement, in the sense of both following the same order or both aborting.

Example 2

(Illustrating the 3 player protocol). This second example is a continuation of the first. It aims to illustrate the operation of the 3 Player EPRQDBA Protocol and give an intuitive explanation of why Propositions 1 and 2 are true.

Let us continue Example 1, and examine first the scenario where a loyal Alice sends order 0 to both Bob and Charlie accompanied by the command vectors ${\mathbb{0}}_B$ and ${\mathbb{0}}_C$ as given by (26) and (27), respectively. We may distinguish the following cases.

• Both Bob and Charlie are loyal. Then, according to Rule${}_{3,1}$ of the 3 player EPRQDBA Protocol 1, all 3 players agree to execute order 0.
• There is one traitor among Bob and Charlie. Without loss of generality we may assume that Charlie is the traitor, who tries to sabotage the agreement. What can he do?

  ⋄

  Charlie may claim that he decided to abort because Alice sent him an inconsistent command vector. Then, according to Rule${}_{3,2}$ of the 3 player EPRQDBA Protocol 1, Bob will stick to his initial decision, and, together with Alice, will agree to execute order 0. In this way, assumption (DBA${}_3$) of the detectable Byzantine Agreement protocol, stipulating that commanding general is loyal, then either all loyal lieutenant generals follow the commanding general’s order or abort the protocol (recall Definition 2), is satisfied. The rationale behind this rule is that Bob, having already received a consistent command vector from Alice, is suspicious of Charlie’s decision to abort, and decides to cling to his preliminary decision.

  ⋄

  Charlie may claim that Alice gave the order 1, along with a consistent command vector ${\mathbb{1}}_C$. Bob will then use the CheckWCV Algorithm 2 to check Charlie’s command vector against his own command vector ${\mathbb{0}}_B$ for inconsistencies. If Bob finds no inconsistencies, then, according to Rule${}_{3,3}$ of the 3 player EPRQDBA Protocol 1, he will abort. Obviously, in such a case, Charlie will have won in sabotaging the agreement. Let’s analyze the probability of this event. First, let’s recall from (27) what Charlie knows with certainty.

  $$\begin{array}{cc}\hfill {\mathbb{0}}_C& =\underset{pair11}{\underbrace{10}}\underset{pair10}{\underbrace{\bigsqcup \bigsqcup }}\underset{pair9}{\underbrace{00}}\underset{pair8}{\underbrace{10}}\underset{pair7}{\underbrace{\bigsqcup \bigsqcup }}\underset{pair6}{\underbrace{\bigsqcup \bigsqcup }}\underset{pair5}{\underbrace{00}}\underset{pair4}{\underbrace{00}}\underset{pair3}{\underbrace{\bigsqcup \bigsqcup }}\underset{pair2}{\underbrace{00}}\underset{pair1}{\underbrace{10}}\underset{pair0}{\underbrace{\bigsqcup \bigsqcup }}.\hfill \end{array}$$

  (31)

  He partially knows ${\mathbb{0}}_B$ given by (26), and in particular only the pairs consisting of 00,

  $$\begin{array}{cc}\hfill {\mathbb{0}}_B& =\underset{pair11}{\underbrace{\bigsqcup \bigsqcup }}\underset{pair10}{\underbrace{\bigsqcup \bigsqcup }}\underset{pair9}{\underbrace{00}}\underset{pair8}{\underbrace{\bigsqcup \bigsqcup }}\underset{pair7}{\underbrace{01}}\underset{pair6}{\underbrace{\bigsqcup \bigsqcup }}\underset{pair5}{\underbrace{00}}\underset{pair4}{\underbrace{00}}\underset{pair3}{\underbrace{\bigsqcup \bigsqcup }}\underset{pair2}{\underbrace{00}}\underset{pair1}{\underbrace{\bigsqcup \bigsqcup }}\underset{pair0}{\underbrace{01}},\hfill \end{array}$$

  (32)

  and his problem is to construct something resembling the real ${\mathbb{1}}_C$, as given from (30).

  $$\begin{array}{cc}\hfill {\mathbb{1}}_C& =\underset{pair11}{\underbrace{\bigsqcup \bigsqcup }}\underset{pair10}{\underbrace{11}}\underset{pair9}{\underbrace{\bigsqcup \bigsqcup }}\underset{pair8}{\underbrace{\bigsqcup \bigsqcup }}\underset{pair7}{\underbrace{01}}\underset{pair6}{\underbrace{11}}\underset{pair5}{\underbrace{\bigsqcup \bigsqcup }}\underset{pair4}{\underbrace{\bigsqcup \bigsqcup }}\underset{pair3}{\underbrace{11}}\underset{pair2}{\underbrace{\bigsqcup \bigsqcup }}\underset{pair1}{\underbrace{\bigsqcup \bigsqcup }}\underset{pair0}{\underbrace{01}}.\hfill \end{array}$$

  (33)

  Charlie knows that the least significant bit of the uncertain pairs in ${\mathbb{0}}_C$ is 1 and the most significant bit is 0 or 1, with equal probability $0.5$. However, Charlie cannot know with certainty if the most significant bit of a specific uncertain pair is 0 or 1. Therefore, when guessing ${\mathbb{1}}_C$, Charlie can make two detectable mistakes: (i) place a 0 in a wrong pair that is not actually contained in ${\mathbb{P}}_{0,1}\left({\mathbb{0}}_B\right)$, e.g., set the pair 10 as 01, or (ii) place a 1 in a wrong pair that appears in ${\mathbb{P}}_{0,1}\left({\mathbb{0}}_B\right)$, e.g., set pair 7 as 11. The situation from a probabilistic point of view resembles the probability of picking the one correct configuration out of many. The total number of configurations is equal to the number of ways to place 2 or 3 identical objects (0) into 5 distinguishable boxes. The probability that Charlie places all the 0s correctly is

  $$\begin{array}{c}\hfill P\left(\mathit{Charlie}\mathit{places}\mathit{all}0\mathit{correctly}\right)=\frac{1}{\left(\genfrac{}{}{0pt}{}{5}{3}\right)}=0.1.\end{array}$$

  (34)

  Thus, the probability that Charlie cheats successfully is just $0.1$, even in this toy scale example with $m=12$. Consequently, Bob is bound to detect inconsistencies, which will lead him to apply Rule${}_{3,4}$ of the 3 player EPRQDBA Protocol 1, cling to his initial decision, and, ultimately, achieve agreement with Alice.

The situation where a loyal Alice sends order 1 to both Bob and Charlie is identical.

Let us now examine the second major scenario where a traitor Alice intends to prevent the loyal Bob and Charlie from recanting agreement. In view of Definition 2, this precludes the cases where Alice sends to both of them inconsistent command vectors, or the same order, accompanied by appropriate consistent command vectors. In reviewing her remaining options, we distinguish the following cases.

• Alice sends an order, say 0, along with a consistent command vector to Bob and an inconsistent one to Charlie. In this case, Bob will stick to his initial decision, but Charlie will use the CheckWBV Algorithm 3 to verify Bob’s command vector. In doing so, Charlie will crosscheck ${\mathbb{0}}_B$, given by (26), with his own bit vector $\mathbf{c}$ from (24).

  $$\begin{array}{cc}\hfill {\mathbb{0}}_B& =\underset{pair11}{\underbrace{\bigsqcup \bigsqcup }}\underset{pair10}{\underbrace{\bigsqcup \bigsqcup }}\underset{pair9}{\underbrace{00}}\underset{pair8}{\underbrace{\bigsqcup \bigsqcup }}\underset{pair7}{\underbrace{01}}\underset{pair6}{\underbrace{\bigsqcup \bigsqcup }}\underset{pair5}{\underbrace{00}}\underset{pair4}{\underbrace{00}}\underset{pair3}{\underbrace{\bigsqcup \bigsqcup }}\underset{pair2}{\underbrace{00}}\underset{pair1}{\underbrace{\bigsqcup \bigsqcup }}\underset{pair0}{\underbrace{01}},\hfill \end{array}$$

  (35)

  $$\begin{array}{cc}\hfill \mathbf{c}& =\underset{pair11}{\underbrace{01}}\underset{pair10}{\underbrace{00}}\underset{pair9}{\underbrace{11}}\underset{pair8}{\underbrace{11}}\underset{pair7}{\underbrace{00}}\underset{pair6}{\underbrace{10}}\underset{pair5}{\underbrace{01}}\underset{pair4}{\underbrace{11}}\underset{pair3}{\underbrace{00}}\underset{pair2}{\underbrace{11}}\underset{pair1}{\underbrace{01}}\underset{pair0}{\underbrace{10}}.\hfill \end{array}$$

  (36)
  Charlie will count the 00 and 01 pairs in ${\mathbb{0}}_B$ to find that they are 4 and 2, pretty close to the expected value 3, and in all these pairs the least significant bit is the negation of his corresponding bit, as dictated by the original $|{\mathsf{\Psi }}^{+}\rangle$ entanglement. Hence, Charlie will successfully verify Bob’s command vector, and, according to the Rule${}_{3,5}$ of the 3 player EPRQDBA Protocol 1, he will change his decision to that of Bob, thereby reaching the desired agreement. The rationale behind this rule is that Charlie, having already received an inconsistent command vector from Alice, is suspicious of Alice. His suspicion is confirmed when he verifies Bob’s command vector, considering that it high unlikely for Bob to have forge a consistent command vector. Thus, he decides to change his preliminary decision to that of Bob.
• Alice sends to Bob and Charlie different orders with consistent command vectors. Let us assume, without loss of generality, that Alice sends the order 0 together with a consistent command vector ${\mathbb{0}}_B$ to Bob and the order 1 together with a consistent command vector ${\mathbb{1}}_C$ to Charlie. Bob knows the positions of almost all 00 and 01 pairs in $\mathbf{a}$. If Alice had forged even a single 10 or 11 pair, claiming to be either 00 or 01, then Bob, when using the CheckAlice Algorithm 1, he would have immediately detected the inconsistency. Symmetrically, Charlie knows the positions of almost all 01 and 11 pairs in $\mathbf{a}$. According to the rules of the protocol, Bob will sent to Charlie the command vector ${\mathbb{0}}_B$, and, simultaneously, Charlie will send to Bob the command vector ${\mathbb{1}}_C$. Both will use the CheckWCV Algorithm 2 to verify the consistency of the others’ command vector. Then, according to Rule${}_{3,3}$, both Bob and Charlie will abort, again fulfilling the requirements of DBA. ◃

Let us ponder the question of what will happen if there are 2 traitors and only one loyal general. It might be that the 2 traitors are the 2 lieutenant generals, or the commanding general and one of the lieutenant generals. This case is actually very easy as explained in the next Corollary 1.

Protocol 1: The 3 Player EPRQDBA Protocol.

(Round1) Alice sends to Bob and Charlie her order and the appropriate command vector as proof. (Round2) Bob uses the CheckAlice Algorithm 1 to check the received command vector against his own bit vector $\mathbf{b}$ for inconsistencies. ★ If no inconsistencies are found, Bob preliminary accepts the received order. ★ Otherwise, Bob’s preliminary decision is to abort (⊥). Upon completion of the verification procedure, Bob sends to Charlie his preliminary decision together with the received command vector. Symmetrically and in parallel, Charlie performs the same actions. (Round3) Bob compares his own initial decision with that of Charlie’s. ★ Rule${}_{3,1}$: If Charlie’s decisions coincides with Bob’s preliminary decision, then Bob accepts as final his preliminary decision and terminates the protocol on his end. ★ In case Charlie’s initial decision is different, then the following cases are considered. □ Rule${}_{3,2}$: If Bob’s decision is 0 (1) and Charlie’s decision is to abort, then Bob sticks to his initial decision and terminates the protocol. □ If Bob’s decision is 0 (1) and Charlie’s decision is 1, then Bob uses the CheckWCV Algorithm 2 to check Charlie’s command vector against his own command vector for inconsistencies. ⋄ Rule${}_{3,3}$: If no inconsistencies are detected, then Bob aborts and terminates the protocol. ⋄ Rule${}_{3,4}$: Otherwise, Bob sticks to his preliminary decision and terminates the protocol. □ If Bob’s decision is to abort and Charlie’s decision is 0 (or 1), then Bob uses the CheckWBV Algorithm 3 to check Charlie’s command vector against his own bit vector for inconsistencies. ⋄ Rule${}_{3,5}$: If no inconsistencies are found, then Bob changes his final decision to 0 (1) and terminates the protocol. ⋄ Rule${}_{3,6}$: Otherwise, Bob sticks to his initial decision to abort and terminates the protocol. Charlie’s actions mirror Bob’s actions.

Corollary 1

(The case of 2 traitors). The 3 player EPRQDBA protocol achieves detectable Byzantine Agreement even when there are 2 traitors among the 3 generals.

Proof. 

The fundamental assumption (DBA${}_2$) of any detectable Byzantine Agreement protocol, stipulates that all loyal generals either follow the same order or abort the protocol (recall Definition 2). When there is only one loyal general, no matter whether he is the commanding general or a lieutenant general, whatever he decides is perfectly fine, as there is no other loyal party that he must agree with.    □

The next theorem is an obvious consequence of Propositions 1 and 2, and Corollary 1.

Theorem 1

(3 Player Detectable Byzantine Agreement). The 3 player EPRQDBA protocol achieves detectable Byzantine Agreement in any eventuality.

4. The n Player EPRQDBA Protocol

In this section we present the general form of the EPRQDBA protocol that can handle any number $n>3$ generals who are spatially distributed. To be precise, we assume that Alice is the unique commanding general, who tries to coordinate her $n-1$ lieutenant generals LT${}_0$, …, LT${}_{n-2}$, LT being an abbreviation for “lieutenant general.” As in the 3 player case, the n player form of the EPRQDBA protocol can be conceptually divided into 3 distinct phases, which we describe below.

4.1. The n Player Entanglement Distribution Phase

The first phase is the entanglement distribution phase that involves the generation and distribution of qubits and entangled EPR pairs. As we have already explained in assumption (${\mathbf{A}}_1$), we take for granted the existence of a trusted quantum source that fulfills this task. Taking into account the capabilities of modern quantum apparatus, the quantum source should have no difficulty in producing

• $(n-2)(n-1)m$ qubits in the $|+\rangle$ state by simply applying the Hadamard transform on $|0\rangle$, and
• $(n-1)m$ EPR pairs in the $|{\mathsf{\Psi }}^{+}\rangle$ state, which can be easily generated by modern quantum computers.

The parameter m plays an important role and should be a sufficiently large positive integer. The forthcoming mathematical analysis of the protocol contains additional discussion regarding m. The source distributes the produced qubits according to the next scheme.   

(nD₁)

The $(n-1)m$ EPR pairs are numbered from 0 to $(n-1)m-1$.

(nD₂)

The source sends a sequence $q_0^A$, $q_1^A$, …, $q_{(n-1)m-2}^A$, $q_{(n-1)m-1}^A$ of $(n-1)m$ qubits to Alice and a sequence $q_0^i$, $q_1^i$, …, $q_{(n-1)m-2}^i$, $q_{(n-1)m-1}^i$ of $(n-1)m$ qubits to lieutenant general LT${}_i$, $0\le i\le n-2$.

(nD₃)

Alice’s sequence is constructed by inserting in position k the first qubit of the EPR pair k, $0\le k\le (n-1)m-1$.

(nD₄)

LT${}_i$’s sequence, $0\le i\le n-2$, is constructed as follows. Position k, $0\le k\le (n-1)m-1$, contains the second qubit of the EPR pair k if and only if $k\equiv imod(n-1)$; otherwise position k contains a qubit in the $|+\rangle$ state.

The end result is that the quantum registers of Alice and her $n-1$ lieutenant generals LT${}_0$, …, LT${}_{n-2}$, are populated as shown in Figure 4.

4.2. The n Player Entanglement Verification Phase

This phase is extremely important because the entire protocol is based on entanglement. If entanglement is not guaranteed, then agreement cannot not be guaranteed either. The verification process can lead to two dramatically different outcomes. If entanglement verification is successfully established, then the EPRQDBA protocol is certain to achieve agreement. Failure of verification implies absence of the necessary entanglement. This may be attributed either to noisy quantum channels or insidious sabotage by an active adversary. Whatever the true reason is, the only viable solution is to abort the current execution of the protocol, and initiate the whole procedure again from scratch, after taking some corrective measures.

One should not underestimate the significance of this phase. Many previous papers have comprehensively and thoroughly studied this phase. The EPRQDBA protocol subscribes to the sophisticated methods that have already been described in the literature, such as [20,21,22,23,24]. The interested reader may consult these works and the references therein for further analysis.

4.3. The n Player Agreement Phase

The EPRQDBA protocol achieves detectable agreement during its third and last phase, aptly named agreement phase. The agreement phase begins when Alice and her $n-1$ lieutenant generals LT${}_0$, …, LT${}_{n-2}$ measure their quantum registers. By recalling the distribution scheme of Section 4.1, we see that certain important correlations among Alice’s register and the registers of her lieutenant generals have been established.

Definition 6.

Let the bit vectors $\mathbf{a}$ and ${\mathbf{l}}^i$ denote the contents of Alice and LT${}_i$’s, $0\le i\le n-2$, registers after the measurement, and assume that their explicit form is as given below:

$$\begin{array}{cc}\hfill \mathbf{a}& =\underset{(n-1)\text{-}tuple}{\underbrace{a_{(n-1)m-1}\dots a_{(n-1)m-(n-1)}}}\dots \underset{(n-1)\text{-}tuple}{\underbrace{a_{n-2}\cdots a_0}},\hfill \end{array}$$

(37)

$$\begin{array}{cc}\hfill {\mathbf{l}}^i& =\underset{(n-1)\text{-}tuple}{\underbrace{l_{(n-1)m-1}^i\cdots l_{(n-1)m-(n-1)}^i}}\cdots \underset{(n-1)\text{-}tuple}{\underbrace{l_{n-2}^i\cdots l_0^i}}.\hfill \end{array}$$

(38)

The $k^{th}$$(n-1)$-tuple of $\mathbf{a}$, $0\le k\le m-1$, is the $(n-1)$-tuple of bits $a_{(n-1)k+(n-2)}$ …$a_{(n-1)k}$, and is designated by ${\mathbf{a}}_k$. Similarly, the $k^{th}$$(n-1)$-tuple of ${\mathbf{l}}^i$ is designated by ${\mathbf{l}}_k^i$. Hence, $\mathbf{a}$ and ${\mathbf{l}}^i$ can be written succinctly as:

$$\begin{array}{cc}\hfill \mathbf{a}& ={\mathbf{a}}_{m-1}{\mathbf{a}}_{m-2}\dots {\mathbf{a}}_1{\mathbf{a}}_0,\hfill \end{array}$$

(39)

$$\begin{array}{cc}\hfill {\mathbf{l}}^i& ={\mathbf{l}}_{m-1}^i{\mathbf{l}}_{m-2}^i\dots {\mathbf{l}}_1^i{\mathbf{l}}_0^i.\hfill \end{array}$$

(40)

We also use the notion of the uncertain $(n-1)$-tuple, denoted by $\mathbf{u}=\bigsqcup \cdots \bigsqcup$, where ⊔ is a new symbol, different from 0 and 1. In contrast, $(n-1)$-tuples consisting of bits 0 and/or 1 are called definite tuples.

According to the distribution scheme, each $(n-1)$-tuple in Alice’s bit vector $\mathbf{a}$ shares one $|{\mathsf{\Psi }}^{+}\rangle =\frac{{|0\rangle }_A{|1\rangle }_i+{|1\rangle }_A{|0\rangle }_i}{\sqrt{2}}$ pair with every lieutenant general LT${}_i$, $0\le i\le n-2$. This is captured by the next Lemma 3. Its proof is obvious and is omitted.

Lemma 3

(Tuple Differentiation Property). The next property, termed tuple differentiation property characterizes the corresponding bits and tuples of the bit vectors $\mathbf{a}$ and ${\mathbf{l}}^i$, $0\le i\le n-2$.

$$\begin{array}{cc}\hfill l_k^i& =\overline{a_k},\mathit{iff}k\equiv imod(n-1),k=0,\dots ,(n-1)m-1,0\le i\le n-2.\hfill \end{array}$$

(41)

Consequently, each ${\mathbf{a}}_k$ tuple, where $0\le k\le m-1$, is different from the corresponding tuple of every ${\mathbf{l}}^i$, $0\le i\le n-2$.

$$\begin{array}{cc}\hfill {\mathbf{a}}_k& \ne {\mathbf{l}}_k^i,\mathit{for}\mathit{every}k,0\le k\le m-1.\hfill \end{array}$$

(42)

Definition 7

(n Player Command Vectors). Alice sends to every lieutenant general LT${}_i$, $0\le i\le n-2$, either the command 0 or the command 1. Besides her order, as a “proof,” she also sends an appropriate command vector. The idea is that the command vector for every lieutenant general is always different, even when the command is the same. For the order 0, the command vector sent to every lieutenant general LT${}_i$, $0\le i\le n-2$, is ${\mathbb{0}}_i$, whereas for the order 1 the corresponding command vector is ${\mathbb{1}}_i$. The explicit form of the command vectors is the following.

$$\begin{array}{cc}\hfill {\mathbb{0}}_i& ={\mathbf{v}}_{m-1}\dots {\mathbf{v}}_0,\mathit{where}{\mathbf{v}}_k=\left\{\begin{array}{cc}{\mathbf{a}}_k\hfill & \mathit{if}{a}_{(n-1)k+i}=0\\ \hfill \mathbf{u}=\bigsqcup \cdots \bigsqcup & \mathit{if}{a}_{(n-1)k+i}\ne 0\end{array}\right.,0\le k\le m-1.\hfill \end{array}$$

(43)

$$\begin{array}{cc}\hfill {\mathbb{1}}_i& ={\mathbf{v}}_{m-1}\dots {\mathbf{v}}_0,\mathit{where}{\mathbf{v}}_k=\left\{\begin{array}{cc}{\mathbf{a}}_k\hfill & \mathit{if}{a}_{(n-1)k+i}=1\\ \hfill \mathbf{u}=\bigsqcup \cdots \bigsqcup & \mathit{if}{a}_{(n-1)k+i}\ne 1\end{array}\right.,0\le k\le m-1.\hfill \end{array}$$

(44)

A command vector besides tuples comprised entirely of 0 and 1 bits, also contains an approximately equal number of tuples consisting of ⊔ characters. When we want refer to a command vector, but without providing further details, we will designate it by

$$\begin{array}{c}\hfill \mathbf{v}={\mathbf{v}}_{m-1}\cdots {\mathbf{v}}_0=\underset{(n-1)\text{-}\mathit{tuple}}{\underbrace{v_{(n-1)m-1}\cdots v_{(n-1)m-(n-1)}}}\cdots \underset{(n-1)\text{-}\mathit{tuple}}{\underbrace{v_{n-2}\cdots v_0}}.\end{array}$$

(45)

Given a command vector or a bit vector, we gather in a set the positions of the $(n-1)$-tuples that contain a specific combination of bits.

Definition 8

(Tuple Designation). Given a command vector $\mathbf{v}$ or a bit vector ${\mathbf{l}}^i$, $0\le i\le n-2$, we define the set ${\mathbb{T}}_{j\to y}^{i\to x}\left(\mathbf{v}\right)$ and ${\mathbb{T}}_{j\to y}^{i\to x}\left({\mathbf{l}}^i\right)$, respectively, of the positions of the $(n-1)$-tuples that contain bit $x\in \{0,1\}$ in the $i^{th}$ place and bit $y\in \{0,1\}$ in the $j^{th}$ place, $0\le i\ne j\le n-2$.

Likewise, the set of the positions of their $(n-1)$-tuples that contain bit $x\in \{0,1\}$ in the $i^{th}$ place is denoted by ${\mathbb{T}}^{i\to x}\left(\mathbf{v}\right)$ and ${\mathbb{T}}^{i\to x}\left({\mathbf{l}}^i\right)$, respectively.

In view of Definition 7, it is trivial to see that the assertions of the next Lemma 4 are valid, where the notation $\left|S\right|$ is employed to designate the cardinality, i.e., the number of elements, of an arbitrary set S.

Lemma 4

(n Player Loyal Command Vector Properties). If Alice is loyal, her command vectors ${\mathbb{0}}_i$ and ${\mathbb{1}}_i$, $0\le i\le n-2$, satisfy the following properties.

$$\begin{array}{ll}•\hspace{1em}|{\mathbb{T}}^{i\to 0}\left({\mathbb{0}}_i\right)|\approx \frac{m}{2}\hspace{1em}\hspace{1em}\hspace{1em}& •\hspace{1em}|{\mathbb{T}}^{i\to 1}\left({\mathbb{1}}_i\right)|\approx \frac{m}{2}\\ •\hspace{1em}|{\mathbb{T}}_{j\to 0}^{i\to 0}\left({\mathbb{0}}_i\right)|\approx \frac{m}{4}\hspace{1em}\hspace{1em}\hspace{1em}& •\hspace{1em}|{\mathbb{T}}_{j\to 0}^{i\to 1}\left({\mathbb{1}}_i\right)|\approx \frac{m}{4}\\ •\hspace{1em}|{\mathbb{T}}_{j\to 1}^{i\to 0}\left({\mathbb{0}}_i\right)|\approx \frac{m}{4}\hspace{1em}\hspace{1em}\hspace{1em}& •\hspace{1em}|{\mathbb{T}}_{j\to 1}^{i\to 1}\left({\mathbb{1}}_i\right)|\approx \frac{m}{4}\end{array}$$

As expected the protocol evolves in rounds. The actions of the n generals in each round are explained below. In the exposition of Protocol 2, we have made a few plausible assumptions regarding the behavior of traitors, which we state below.

Protocol 2: The n Player EPRQDBA Protocol.

(Round1) Send ▹ Alice sends to all of her $n-1$ lieutenant generals LT${}_0$, …, LT${}_{n-2}$ her order $c_i$ (which is either 0 or 1) and the appropriate command vector ${\mathbf{v}}_i$ as proof. (Round2) Receive ▹ All LT${}_i$, $0\le i\le n-2$, receive Alice’s order and command vector ${\mathbf{v}}_i$. Subsequently, each LT${}_i$, calls the CheckAlice Algorithm 4 to check ${\mathbf{v}}_i$ against his bit vector for inconsistencies. ★ If no inconsistencies are found, LT${}_i$’s initial decision is $d_i^{\left(2\right)}$ is Alice’s order. ★ If LT${}_i$ detects inconsistencies, his initial decision is $d_i^{\left(2\right)}=\perp$. Send ▹ Upon completion of the verification procedure, LT${}_i$ sends to all other LT${}_j$, $0\le i\ne j\le n-2$, his initial decision $d_i^{\left(2\right)}$ together with ${\mathbf{v}}_i$ as proof. (Round3) Receive ▹ Every LT${}_i$, $0\le i\le n-2$, receives from every other LT${}_j$, $0\le i\ne j\le n-2$, LT${}_j$’s initial decision $d_j^{\left(2\right)}$ together with ${\mathbf{v}}_j$ as proof. Afterwards, each LT${}_i$, compares his $d_i^{\left(2\right)}$ to all other $d_j^{\left(2\right)}$, $0\le i\ne j\le n-2$. ★ Rule${}_{3,1}$: If all $d_j^{\left(2\right)}$ coincide with $d_i^{\left(2\right)}$, then LT${}_i$’s intermediary decision is $d_i^{\left(3\right)}=d_i^{\left(2\right)}$. ★ If there is at least one $d_j^{\left(2\right)}$ such that $d_i^{\left(2\right)}\ne d_j^{\left(2\right)}$, then the following cases are considered. □ Rule${}_{3,2}$: If $d_i^{\left(2\right)}=0\left(1\right)$ and all different decisions are ⊥, then LT${}_i$’s intermediary decision is $d_i^{\left(3\right)}=d_i^{\left(2\right)}$. □ If $d_i^{\left(2\right)}=0\left(1\right)$ and there exist $d_j^{\left(2\right)}=1\left(0\right)$, then LT${}_i$ uses the CheckLTwCV Algorithm 5 to check the corresponding ${\mathbf{v}}_j$. ⋄ Rule${}_{3,3}$: If there is at least one consistent ${\mathbf{v}}_j$, then LT${}_i$’s intermediary decision is $d_i^{\left(3\right)}=\perp$. ⋄ Rule${}_{3,4}$: Otherwise, LT${}_i$’s intermediary decision is $d_i^{\left(3\right)}=d_i^{\left(2\right)}$. □ If $d_i^{\left(2\right)}=\perp$ and there exist different $d_j^{\left(2\right)}$, then LT${}_i$ uses the CheckLTwBV Algorithm 6 to check the corresponding ${\mathbf{v}}_j$. ⋄ Rule${}_{3,5}$: If all the consistent ${\mathbf{v}}_j$ correspond to the same $d_j^{\left(2\right)}$, then LT${}_i$’s intermediary decision is $d_i^{\left(3\right)}=d_j^{\left(2\right)}$. ⋄ Rule${}_{3,6}$: Otherwise, LT${}_i$’s intermediary decision is $d_i^{\left(3\right)}=d_i^{\left(2\right)}$. Send ▹ Upon completion of the above comparison, LT${}_i$ sends to all other lieutenant generals LT${}_j$, $0\le i\ne j\le n-2$, his intermediary decision $d_i^{\left(3\right)}$ with proof those ${\mathbf{v}}_k,{\mathbf{v}}_l$ that enabled him to arrive at his decision. Note. The number of sent ${\mathbf{v}}_j$(s) can be 0 (Rule${}_{3,1}$, Rule${}_{3,2}$, Rule${}_{3,4}$), 1 (Rule${}_{3,3}$, Rule${}_{3,5}$), or even 2, in case there are two opposite orders, but with consistent command vectors (Rule${}_{3,6}$). It should be clear that this time LT${}_i$ transmits his own intermediary decision, together with command vectors sent to him from other lieutenant generals. (Round4) Receive ▹ Every LT${}_i$, $0\le i\le n-2$, receives from every other LT${}_j$, $0\le i\ne j\le n-2$, LT${}_j$’s intermediary decision $d_j^{\left(3\right)}$ together with a list of $0,1$ or 2 command vectors ${\mathbf{v}}_k,{\mathbf{v}}_l$ as proof. Subsequently, each LT${}_i$, compares his $d_i^{\left(3\right)}$ to all other $d_j^{\left(3\right)}$, $0\le i\ne j\le n-2$. ★ Rule${}_{4,1}$: If $d_i^{\left(3\right)}=\perp$ because LT${}_i$ has been sent two consistent but contradictory command vectors, then LT${}_i$’s final decision is $d_i^{\left(4\right)}=d_i^{\left(3\right)}$. ★ Rule${}_{4,2}$: If $d_i^{\left(3\right)}=d_j^{\left(3\right)}$, for every $j,0\le i\ne j\le n-2$, then $d_i^{\left(4\right)}=d_i^{\left(3\right)}$. ★ If If $d_i^{\left(3\right)}=0\left(1\right)$ and there is at least one $d_j^{\left(3\right)}$ such that $d_i^{\left(3\right)}\ne d_j^{\left(3\right)}$, then the following cases are considered. □ If there exist $d_j^{\left(3\right)}=\perp \ne d_j^{\left(2\right)}$ (meaning that LT${}_j$ has revised his intermediary decision from 0 or 1 to ⊥), then, for every such j, LT${}_i$ uses the CheckLTwCV Algorithm 5 to check the command vectors supplied as proof. ⋄ Rule${}_{4,3}$: If they are consistent for at least one j, then $d_i^{\left(4\right)}=\perp$. ⋄ Rule${}_{4,4}$: Otherwise, LT${}_i$’s final decision is $d_i^{\left(4\right)}=d_i^{\left(3\right)}$. □ If LT${}_i$’s decision is 0 (1) and at least one different decision is 1 (0), then LT${}_i$ uses the CheckLTwCV Algorithm 5 to check the command vectors of all lieutenant generals whose intermediary decision is 1 (0) for inconsistencies. ⋄ Rule${}_{4,5}$: If there exists at least one command vector with no inconsistencies, then LT${}_i$ aborts and terminates the protocol. ⋄ Rule${}_{4,6}$: Otherwise, LT${}_i$ clings to his intermediary decision.

(T₁)

If Alice is loyal, then the traitors do not possess any inside information. This means that for a disloyal lieutenant general it will be probabilistically impossible to forge a consistent command vector. Actually, the soundness of the protocol when Alice is loyal relies on this fact.

(T₂)

The disloyal lieutenant generals manifest their traitorous behavior at the end of (${\mathbf{Round}}_2$), either by falsely claiming that their decision is to abort, or by sending contradictory orders accompanied by consistent command vectors to different lieutenant generals.Their behavior is consistent in the sense that they always send identical information to the same lieutenant general, i.e., at the end of (${\mathbf{Round}}_3$) they transmit the same decision they sent at the end of (${\mathbf{Round}}_2$).

In terms of notation, to enhance the readability of the n Player EPRQDBA Protocol, we denote by $d_i^{\left(2\right)}$, $d_i^{\left(3\right)}$, and $d_i^{\left(4\right)}$ the initial, intermediary, and final decision of lieutenant general LT${}_i$ at the end of (${\mathbf{Round}}_2$), (${\mathbf{Round}}_3$), and (${\mathbf{Round}}_4$).

The following algorithms apply Lemmas 3 and 4 to determine whether a command vector is consistent, in which case they return TRUE. If they determine inconsistencies, they terminate and return FALSE. The names of Algorithms 5 and 6 are mnemonic abbreviations for “Check LT with Command Vector” and “Check LT with Bit Vector.” To clear up things, we explain their difference.

Without loss of generality, let us suppose that LT${}_i$ received the order 0 and a consistent command vector ${\mathbf{v}}_A$ from Alice, while LT${}_j$ claims that he received the order 1. According to the EPRQDBA protocol, LT${}_j$ must convince LT${}_i$ by sending the command vector $\mathbf{v}$ he claims he received from Alice. LT${}_i$ checks $\mathbf{v}$ for inconsistencies against his own ${\mathbf{v}}_A$ by invoking the Algorithm 5. Now, suppose that LT${}_i$ received an inconsistent command vector ${\mathbf{v}}_A$ from Alice and his initial decision is to abort, while LT${}_j$ claims that he received the order 1. LT${}_j$ must convince LT${}_i$ by sending the command vector $\mathbf{v}$ he claims he received from Alice. In this situation, LT${}_i$ does not have a consistent command vector ${\mathbf{v}}_A$ that he could use, so LT${}_i$ must check $\mathbf{v}$ for inconsistencies against his own bit vector $\mathbf{b}$ by invoking the Algorithm 6.

In Algorithms 4–6, we employ the following notation.

• i, $0\le i\le n-2$, is the index of the lieutenant general who does the consistency checking.
• j, $0\le i\ne j\le n-2$, is the index of the lieutenant general whose command vector is being checked for consistency.
• c, where $c=0$ or $c=1$, is the command being checked for consistency.
• ${\mathbf{v}}_A=v_{(n-1)m-1}\dots v_{(n-1)m-(n-1)}\dots v_{n-2}\dots v_0$, is the command vector sent by Alice.
• $\mathbf{v}$ is the command vector sent by the lieutenant general LT${}_j$.
• $\mathbf{l}=l_{(n-1)m-1}\dots l_{(n-1)m-(n-1)}\dots l_{n-2}\dots l_0$ is the bit vector of the lieutenant general LT${}_i$ who does the consistency checking.
• △ is the symmetric difference of two sets, i.e., $S△S^{\prime }=\left(S\setminus S^{\prime }\right)\bigcup \left(S^{\prime }\setminus S\right)$, for given sets S and $S^{\prime }$.

We now proceed to formally prove that the EPRQDBA protocol enables all the loyal generals to reach agreement.

Proposition 3

(n Player Loyal Alice). If Alice is loyal, then the n player EPRQDBA protocol will enable all loyal lieutenant generals to follow Alice’s order.

Proposition 4

(n Player Traitor Alice). If Alice is a traitor, then the n player EPRQDBA protocol will enable all loyal lieutenant generals to reach agreement, in the sense of all following the same order or all aborting.

The next Theorem 2 is an immediate consequence of Propositions 3 and 4.

Theorem 2

(n Player Detectable Byzantine Agreement). The n player EPRQDBA protocol achieves detectable Byzantine Agreement.

Algorithm 4 CheckAlice ( i, c, ${\mathbf{v}}_A$, $\mathbf{l}$ )

Algorithm 5 CheckLTwCV (i, j, c, $\mathbf{v}$, ${\mathbf{v}}_A$)

Algorithm 6 CheckLTwBV (i, j, c, $\mathbf{v}$, $\mathbf{l}$)

In closing we may ask what will happen if there are $n-1$ traitors and only one loyal general. It might be that the $n-1$ traitors are the $n-1$ lieutenant generals, or Alice and $n-2$ of her lieutenant generals. Again, this case turns to be very easy. The crucial assumption (DBA${}_2$) of any detectable Byzantine Agreement protocol, stipulates that all loyal generals either follow the same order or abort the protocol (recall Definition 2). When there is only one loyal general, maybe Alice herself, or one of the lieutenant generals, any decision taken would be fine, as there is no other loyal party that to agree with.

5. Discussion and Conclusions

This paper introduced the quantum protocol EPRQDBA that achieves Detectable Byzantine Agreement for an arbitrary number n of players.

The EPRQDBA protocol has a number of advantages to offer.

• It is completely general because it can handle any number n of players.
• It takes only a constant number of rounds, namely 3, to complete, no matter how many players there are.
• It requires only EPR (specifically $|{\mathsf{\Psi }}^{+}\rangle$) pairs, irrespective of the number n of players. This is probably the most important quality of the protocol. Without a doubt, EPR pairs are the easiest to produce among all maximally entangled states. In comparison, even $|GH{Z}_n\rangle$ states, would not be able to scale well as n increases, not to mention other more difficult to create entangled states.

All the above qualities advocate for its scalability and its potential applicability in practice. To drive further this point, we present the numerical characteristics of the EPRQDBA protocol in the following Table 1.

Parameter m is independent of the number of players n, which is another plus for the scalability of the protocol. Obviously, a proper value for must be selected in order to ensure that the probability that a traitor can forge a command vector is negligible. The reason why m does not scale with n is that the protocol always uses EPR pairs, that is, bipartite entanglement. The rules of the protocol dictate that every consistency check takes place between two command vectors, or between a command vector and a bit vector. Therefore, in every case the comparison involves just 2 strings of bits, irrespective of the number of generals. Moreover, this comparison, even in the most general case, involves just 2 bits, say i and j, in every $n-1$ tuple. Thus, the situation from a probabilistic point of view is always identical with the 3 player case. In a final analysis, the probability that a traitor deceives a loyal general, is the probability of picking the one correct configuration out of many. The total number of configurations is equal to the number of ways to place $\approx \frac{m}{4}$ identical objects (either 0 or 1, depending on the order) into $\approx \frac{m}{2}$ distinguishable boxes (the uncertain tuples). The probability that a traitor places all the $\approx \frac{m}{4}$ bits correctly in the $\approx \frac{m}{2}$ uncertain tuples is

$$\begin{array}{c}\hfill P\left(\mathrm{traitor}\mathrm{cheats}\right)\approx \frac{1}{\left(\genfrac{}{}{0pt}{}{m/2}{m/4}\right)},\end{array}$$

(46)

which tends to zero as m increases.

Table 1. This table summarizes the numerical characteristics of the EPRQDBA protocol. The abbreviations “bpm” and “tb” stand for “bits per message” and “total bits,” respectively.

Qubits
# of $|{\mathsf{\Psi }}^{+}\rangle$ pairs		# of $|+\rangle$ qubits
$(n-1)$m		$(n-2)(n-1)$m
Bits & Messages
Round	# of messages	# bits per message	Total # of bits
1	$n-1$	$(n-1)$m	${(n-1)}^2$m
2	$(n-2)(n-1)$	$(n-1)$m	$(n-2){(n-1)}^2$m
3	$(n-2)(n-1)$	$0\le \#\mathrm{bpm}\le 2(n-1)m$	$0\le \#\mathrm{tb}\le 2(n-2){(n-1)}^{2}m$
4	0	0	0
m & Probability
m	$\frac{m}{4}$	$\frac{m}{2}$	$P\left(\mathrm{traitor}\mathrm{cheats}\right)$
4	1	2	0.5000000000000000
8	2	4	0.167
16	4	8	0.0145
32	8	16	$7.770·{10}^{-5}$
64	16	32	$1.663·{10}^{-9}$

Table 1. This table summarizes the numerical characteristics of the EPRQDBA protocol. The abbreviations “bpm” and “tb” stand for “bits per message” and “total bits,” respectively.

Qubits
# of $|{\mathsf{\Psi }}^{+}\rangle$ pairs		# of $|+\rangle$ qubits
$(n-1)$m		$(n-2)(n-1)$m
Bits & Messages
Round	# of messages	# bits per message	Total # of bits
1	$n-1$	$(n-1)$m	${(n-1)}^2$m
2	$(n-2)(n-1)$	$(n-1)$m	$(n-2){(n-1)}^2$m
3	$(n-2)(n-1)$	$0\le \#\mathrm{bpm}\le 2(n-1)m$	$0\le \#\mathrm{tb}\le 2(n-2){(n-1)}^{2}m$
4	0	0	0
m & Probability
m	$\frac{m}{4}$	$\frac{m}{2}$	$P\left(\mathrm{traitor}\mathrm{cheats}\right)$
4	1	2	0.5000000000000000
8	2	4	0.167
16	4	8	0.0145
32	8	16	$7.770·{10}^{-5}$
64	16	32	$1.663·{10}^{-9}$