1 Introduction

Quantum secret sharing is a basic primitive in quantum cryptography, which was firstly introduced by Hillery, Buzěk and Berthiaume [1]. In contrast to classical secret sharing [2], the security of quantum secret sharing is based on the fundamental principles of quantum physics such as no-cloning of unknown quantum states, and hence quantum secret sharing allows a dealer to securely distribute a secret among agents in the presence of opponents even if they have infinite computing resources. Contributing to the superiority of information-theoretic security, quantum secret sharing has attracted much attention, and numerous proposals for quantum secret sharing have been reported including both theoretical and experimental aspects [3,4,5,6,7,8,9,10,11,12,13,14].

Secret sharing has many practical applications in the field of information security and distributed computing, and it is inevitable to add a new agent or delete one due to various reasons in some special cases. For example, in a large company, there are a lot of persons who may join in it, while some employees quit from it every week. A simple way is to restart the secret distribution algorithm and then renew the shared secret while distributing a new share for each agent. However, this way is generally costly and will limit the practical application of secret sharing. Accordingly, the concept of dynamic secret sharing protocols was introduced, in which the number of the agents can be increased or decreased without re-executing the secret distribution algorithm, and thus, it gives an economical and convenient way to solve this problem. So far, a lot of dynamic secret sharing schemes have been presented [15], especially in the field of quantum secret sharing; Yang et al. firstly gave a dynamic quantum secret sharing scheme in 2011, which was the beginning of the research of dynamic quantum secret sharing [16]. After that, both the design and cryptanalysis of dynamic quantum secret sharing schemes attracted much attention [17,18,19,20,21,22,23,24,25,26,27,28,29].

Recently, an efficient and secure dynamic quantum secret sharing protocol based on Bell states was reported (for the sake of simplicity, we will call it YT-protocol hereafter) [30]. Furthermore, as mentioned in [30], the YT-protocol has the following merits over the existing protocols. Firstly, it is immune to eavesdropping attack, collusion attack, and the dishonest revoked agent attack. Secondly, it is secure against Trojan horse attack because one-step photon transmission is adopted. Thirdly, it is simple and efficient because the agents only perform a single-particle measurement. Finally, when adding or revoking an agent in the YT-protocol, the remaining agents need not perform any local unitary operation, transmit classical messages, or be online.

In this paper, we give an analysis of the YT-protocol, and find that there is a neglected problem that it does not satisfy the requirement for dynamic secret sharing in the sense that if the access structure has been completed, then both adding an agent and revoking one become impossible by the way in this protocol; otherwise, if adding a new agent or revoking one is realized, then the previous access structure has not been really implemented, i.e., the agents cannot recover the shared secret even if they cooperate with each other before the phase of adding a new agent or revoking one. Finally, we discuss how to solve this problem and give a way to improve this protocol.

The rest of this paper is organized as follows. In Sect. 2, a brief description of the YT-protocol is reviewed. In Sect. 3, we analyze the YT-protocol and then show the existing problem in this protocol. In Sect. 4, we study how to deal with this problem and improve this problem. Finally, conclusions are given in Sect. 5.

2 The YT-protocol

In this section, let us give a brief description of YT-protocol [30]. Without loss of generality, we take the four-party dynamic quantum secret sharing as an example. Suppose that the dealer (Alice) wants her master key to be shared among three agents (Bob, Charlie and David) in such a way that her master key can be recovered if and only if all agents cooperate together. The four-party YT-protocol can be described as follows.

2.1 The four-party protocol

The four-party YT-protocol includes the following several steps.

Step 1 Alice prepares 3n Bell states \(|\varPhi ^{+}\rangle =\frac{1}{\sqrt{2}}(|00\rangle +|11\rangle )\) and then equally divides the 3n states \(|\varPhi ^{+}\rangle \) into three segments \(\texttt {BS}_{B}=\{q_{1}^{\texttt {BS}_{B}^{i}},q_{2}^{\texttt {BS}_{B}^{i}}\}\), \(\texttt {BS}_{C}=\{q_{1}^{\texttt {BS}_{C}^{i}},q_{2}^{\texttt {BS}_{C}^{i}}\}\), and \(\texttt {BS}_{D}=\{q_{1}^{\texttt {BS}_{D}^{i}},q_{2}^{\texttt {BS}_{D}^{i}}\}\) for \(i=1,2,\dots ,n\). Then, she takes all the first and second particles from each Bell state in each segment to form the ordered sequences \(S_{1}^{\texttt {BS}_{B}}=\{q_{1}^{\texttt {BS}_{B}^{i}}\}\), \(S_{2}^{\texttt {BS}_{B}}=\{q_{2}^{\texttt {BS}_{B}^{i}}\}\), \(S_{1}^{\texttt {BS}_{C}}=\{q_{1}^{\texttt {BS}_{C}^{i}}\}\), \(S_{2}^{\texttt {BS}_{C}}=\{q_{2}^{\texttt {BS}_{C}^{i}}\}\), \(S_{1}^{\texttt {BS}_{D}}=\{q_{1}^{\texttt {BS}_{D}^{i}}\}\), \(S_{2}^{\texttt {BS}_{D}}=\{q_{2}^{\texttt {BS}_{D}^{i}}\}\). Alice prepares n decoy photons randomly chosen from \(\{|0\rangle ,|1\rangle ,|+\rangle ,|-\rangle \}\) and then inserts them into the sequences \(S_{2}^{\texttt {BS}_{B}}\), \(S_{2}^{\texttt {BS}_{C}}\), \(S_{2}^{\texttt {BS}_{D}}\) to form \(S_{2}^{'{} \texttt {BS}_{B}}\), \(S_{2}^{'{} \texttt {BS}_{C}}\), \(S_{2}^{'{} \texttt {BS}_{D}}\), respectively. Finally, she sends \(S_{2}^{'{} \texttt {BS}_{B}}\), \(S_{2}^{'{} \texttt {BS}_{C}}\), \(S_{2}^{'{} \texttt {BS}_{D}}\) to Bob, Charlie, David, respectively, and keeps \(S_{1}^{\texttt {BS}_{B}}\), \(S_{1}^{\texttt {BS}_{C}}\), \(S_{1}^{\texttt {BS}_{D}}\) for herself.

Step 2 After receiving the sequences \(S_{2}^{'{} \texttt {BS}_{B}}\), \(S_{2}^{'{} \texttt {BS}_{C}}\), \(S_{2}^{'{} \texttt {BS}_{D}}\) from Alice, Bob, Charlie, and David individually send an acknowledgment to her. Then, Alice announces both the bases and the positions of the decoy photons in \(S_{2}^{'{} \texttt {BS}_{B}}\), \(S_{2}^{'{} \texttt {BS}_{C}}\), \(S_{2}^{'{} \texttt {BS}_{D}}\). According to the measurement results of Bob, Charlie and David, Alice checks eavesdropping. If no eavesdropping is detected, she sends an acknowledgment to Bob (Charlie and David) through an authenticated classical channel. Otherwise, Alice asks Bob (Charlie and David) to abort the process and starts a new one.

Step 3 After the eavesdropping check, Alice has three sequences \(S_{1}^{\texttt {BS}_{B}}\), \(S_{1}^{\texttt {BS}_{C}}\), \(S_{1}^{\texttt {BS}_{D}}\), Bob, Charlie and David have \(S_{2}^{\texttt {BS}_{B}}\), \(S_{2}^{\texttt {BS}_{C}}\) and \(S_{2}^{\texttt {BS}_{D}}\), respectively. Then, she gets the measurement results \(\texttt {MR}_{A}=\{\texttt {MR}_{A_{1}},\texttt {MR}_{A_{2}},\dots , \texttt {MR}_{A_{n}}\}\) by performing the GHZ measurement on the ith particles (i.e., \(q_{1}^{\texttt {BS}_{B}^{i}}, q_{1}^{\texttt {BS}_{C}^{i}}, q_{1}^{\texttt {BS}_{D}^{i}}\)) from \(S_{1}^{\texttt {BS}_{B}}\), \(S_{1}^{\texttt {BS}_{C}}\), \(S_{1}^{\texttt {BS}_{D}}\) for \(i=1,2,\dots ,n\). Bob, Charlie, and David get the measurement results \(\texttt {MR}_{B}=\{\texttt {MR}_{B_{1}},\texttt {MR}_{B_{2}},\dots ,\texttt {MR}_{B_{n}}\}\), \(\texttt {MR}_{C}=\{\texttt {MR}_{C_{1}},\texttt {MR}_{C_{2}},\dots ,\texttt {MR}_{C_{n}}\}\), \(\texttt {MR}_{D}=\{\texttt {MR}_{D_{1}},\texttt {MR}_{D_{2}},\dots ,\texttt {MR}_{D_{n}}\}\), respectively, by performing the X-basis measurements on each particle in their sequences.

Step 4 According to the correlation of particles held by Alice, Bob, Charlie and David, their measurement results satisfy \(\texttt {MR}_{A}\)=\(\texttt {MR}_{B}\oplus \texttt {MR}_{C}\oplus \texttt {MR}_{D}\); hereafter, the notation \(\oplus \) denotes the addition of modulo 2. Therefore, if Bob, Charlie and David collaborate with each other, they can recover Alice’s master key as \(K_{A}=\texttt {MR}_{A}=\texttt {MR}_{B}\oplus \texttt {MR}_{C}\oplus \texttt {MR}_{D}=K_{B}\oplus K_{C}\oplus K_{D}\).

2.2 Adding a new agent

Assume that a new agent (Frank) wants to join the four-party protocol. Then, he can perform the following steps with Alice to complete this task.

Step A1 Alice prepares n Bell states \(|\varPhi ^{+}\rangle =\frac{1}{\sqrt{2}}(|00\rangle +|11\rangle )\) and divides them into two sequences \(S_{1}^{\texttt {BS}_{F}}=\{q_{1}^{\texttt {BS}_{F}^{i}}\}\), \(S_{2}^{\texttt {BS}_{F}}=\{q_{2}^{\texttt {BS}_{F}^{i}}\}\). Then, she randomly inserts n decoy photons (i.e., \(\{|0\rangle ,|1\rangle ,|+\rangle ,|-\rangle \}\)) into the sequence \(S_{2}^{\texttt {BS}_{F}}\) to form \(S_{2}^{'{} \texttt {BS}_{F}}\), and sends \(S_{2}^{'{} \texttt {BS}_{F}}\) to Frank.

Step A2 After confirming Frank has received \(S_{2}^{'{} \texttt {BS}_{F}}\), Alice performs a similar eavesdropping check with Frank to confirm the security of \(S_{2}^{\texttt {BS}_{F}}\).

Step A3 Alice performs the GHZ measurement on the ith particles (i.e., \(q_{1}^{\texttt {BS}_{B}^{i}}, q_{1}^{\texttt {BS}_{C}^{i}}, q_{1}^{\texttt {BS}_{D}^{i}}, q_{1}^{\texttt {BS}_{F}^{i}}\)) from \(S_{1}^{\texttt {BS}_{B}}\), \(S_{1}^{\texttt {BS}_{C}}\), \(S_{1}^{\texttt {BS}_{D}}\), \(S_{1}^{\texttt {BS}_{F}}\) for \(i=1,2,\dots ,n\), to obtain the measurement results \(\texttt {MR}_{A'}=\{\texttt {MR}_{A^{'}_{1}},\texttt {MR}_{A^{'}_{2}},\dots ,\texttt {MR}_{A^{'}_{n}}\}\). Bob, Charlie, David and Frank get the measurement results \(\texttt {MR}_{B'}=\{\texttt {MR}_{B'_{1}},\texttt {MR}_{B'_{2}},\dots ,\texttt {MR}_{B'_{n}}\}\), \(\texttt {MR}_{C'}=\{\texttt {MR}_{C'_{1}},\texttt {MR}_{C'_{2}},\dots ,\texttt {MR}_{C'_{n}}\}\), \(\texttt {MR}_{D'}=\{\texttt {MR}_{D'_{1}},\texttt {MR}_{D'_{2}},\dots ,\texttt {MR}_{D'_{n}}\}\), and \(\texttt {MR}_{F'}=\{\texttt {MR}_{F'_{1}},\texttt {MR}_{F'_{2}},\dots ,\texttt {MR}_{F'_{n}}\}\), respectively, by performing the X-basis measurement on each particle in their sequences.

Step A4 Let Alice’s master key be \(K_{A'}=\texttt {MR}_{A'}\). Bob, Charlie, David and Frank can recover Alice’s master key as \(\texttt {MR}_{A'}=\texttt {MR}_{B'}\oplus \texttt {MR}_{C'}\oplus \texttt {MR}_{D'}\oplus \texttt {MR}_{F'}\) by cooperation.

2.3 Revoking an agent

Here, we consider a five-party case, i.e., one dealer (Alice) and four agents (Bob, Charlie, David and Frank). Alice has four sequences \(S_{1}^{\texttt {BS}_{B}}\), \(S_{1}^{\texttt {BS}_{C}}\), \(S_{1}^{\texttt {BS}_{D}}\), \(S_{1}^{\texttt {BS}_{F}}\), and Bob, Charlie, David and Frank have the sequences \(S_{2}^{\texttt {BS}_{B}}\), \(S_{2}^{\texttt {BS}_{C}}\), \(S_{2}^{\texttt {BS}_{D}}\), \(S_{2}^{\texttt {BS}_{F}}\), respectively. If Alice wants to revoke Bob, then she performs the GHZ measurement only on the ith particles from \(S_{1}^{\texttt {BS}_{C}}\), \(S_{1}^{\texttt {BS}_{D}}\), \(S_{1}^{\texttt {BS}_{F}}\), for \(i=1,2,...,n\), to obtain the measurement results \(\texttt {MR}_{A''}=\{\texttt {MR}_{A^{''}_{1}},\texttt {MR}_{A^{''}_{2}},\dots ,\texttt {MR}_{A^{''}_{n}}\}\). Then \(S_{2}^{\texttt {BS}_{C}}\), \(S_{2}^{\texttt {BS}_{D}}\) and \(S_{2}^{\texttt {BS}_{F}}\) evolve into n GHZ states, similar to \(\texttt {MR}_{A''}\). Consequently, Alice’s master key becomes \(K_{A''}=\texttt {MR}_{A''}=\texttt {MR}_{C}\oplus \texttt {MR}_{D}\oplus \texttt {MR}_{F}\) by this way.

3 The analysis of YT-protocol

From Sect. 2, it can be seen that after the secure distributing of particles, the dealer Alice holds all the first particles \(S_{1}^{\texttt {BS}_{B}}\), \(S_{1}^{\texttt {BS}_{C}}\), \(S_{1}^{\texttt {BS}_{D}}\) of 3n Bell states \(|\varPhi ^{+}\rangle =\frac{1}{\sqrt{2}}(|00\rangle +|11\rangle )\), and the three agents Bob, Charlie and David have the n second particles \(S_{2}^{\texttt {BS}_{B}}\), \(S_{2}^{\texttt {BS}_{C}}\) and \(S_{2}^{\texttt {BS}_{D}}\) of these 3n Bell states. Furthermore, if Alice performs the GHZ measurement on the ith particles (i.e., \(q_{1}^{\texttt {BS}_{B}^{i}}, q_{1}^{\texttt {BS}_{C}^{i}}, q_{1}^{\texttt {BS}_{D}^{i}}\)) from \(S_{1}^{\texttt {BS}_{B}}\), \(S_{1}^{\texttt {BS}_{C}}\), \(S_{1}^{\texttt {BS}_{D}}\) for \(i=1,2, \dots ,n\), then the ith particles (i.e., \(q_{2}^{\texttt {BS}_{B}^{i}}, q_{2}^{\texttt {BS}_{C}^{i}}, q_{2}^{\texttt {BS}_{D}^{i}}\)) from \(S_{2}^{\texttt {BS}_{B}}\), \(S_{2}^{\texttt {BS}_{C}}\), \(S_{2}^{\texttt {BS}_{D}}\) collapse to one of the eight three-particle GHZ states

$$\begin{aligned} |\psi _{1}\rangle =\frac{1}{\sqrt{2}}(|000\rangle +|111\rangle ),\end{aligned}$$
(1)
$$\begin{aligned} |\psi _{2}\rangle =\frac{1}{\sqrt{2}}(|000\rangle -|111\rangle ),\end{aligned}$$
(2)
$$\begin{aligned} |\psi _{3}\rangle =\frac{1}{\sqrt{2}}(|100\rangle +|011\rangle ),\end{aligned}$$
(3)
$$\begin{aligned} |\psi _{4}\rangle =\frac{1}{\sqrt{2}}(|100\rangle -|011\rangle ),\end{aligned}$$
(4)
$$\begin{aligned} |\psi _{5}\rangle =\frac{1}{\sqrt{2}}(|010\rangle +|101\rangle ),\end{aligned}$$
(5)
$$\begin{aligned} |\psi _{6}\rangle =\frac{1}{\sqrt{2}}(|010\rangle -|101\rangle ),\end{aligned}$$
(6)
$$\begin{aligned} |\psi _{7}\rangle =\frac{1}{\sqrt{2}}(|110\rangle +|011\rangle ),\end{aligned}$$
(7)
$$\begin{aligned} |\psi _{8}\rangle =\frac{1}{\sqrt{2}}(|110\rangle -|011\rangle ). \end{aligned}$$
(8)

More importantly, Alice’s GHZ measurement result \(\texttt {MR}_{A}\), Bob’s measurement result \(\texttt {MR}_{B}\), Charlie’s measurement result \(\texttt {MR}_{C}\) and David’s measurement result \(\texttt {MR}_{D}\) with X-basis satisfy

$$\begin{aligned} \texttt {MR}_{A}=\texttt {MR}_{B}\oplus \texttt {MR}_{C}\oplus \texttt {MR}_{D}. \end{aligned}$$
(9)

Therefore, when Bob, Charlie and David collaborate with each other, they can recover Alice’s master key \(K_{A}\) by computing

$$\begin{aligned} K_{A}=K_{B}\oplus K_{C}\oplus K_{D} \end{aligned}$$
(10)

as \(K_{A}=\texttt {MR}_{A},K_{B}=\texttt {MR}_{B},K_{C}=\texttt {MR}_{C},K_{D}=\texttt {MR}_{D}\).

In a (k, n) threshold secret sharing protocol, a secret s is divided into n shares \(s_{1},s_{2},\dots ,s_{n}\) such that any k of these shares can be used to reconstruct the secret s, but any set of \(k-1\) or fewer shares contains absolutely no information about the secret s [2]. Furthermore, a secret sharing protocol consists of three phases: the phase of initialization, the phase of distributing shares, and the phase of recovering secret. To deal with the problems of adding and deleting agents, a dynamic secret sharing protocol is added the two phases: the phase of adding new agents, and the phase of revoking agents. Generally speaking, whether in a (k, n) threshold secret sharing protocol or in a (k, n) threshold dynamic secret sharing protocol, it is required that k or more than k agents can reconstruct the secret s after the phase of distributing shares, i.e., the access structure must be completed. In addition, when they reconstruct the shared secret s, they should have no further communication with the dealer. However, if the secret distribution has been completed among the agents in the YT-protocol, then both adding an agent and revoking one become impossible by this way. Now we give a detailed analysis as follows.

From the YT-protocol, it can be seen that it also includes the five phases: the phase of initialization, the phase of distributing shares, the phase of recovering secret, the phase of adding new agents, and the phase of revoking agents in fact although the first three phases are not specified in this protocol. Here, we show that there is an unnoticed problem in the YT-protocol which results in the function of adding an agent or revoking one does not work. Specifically, in Step 3, Alice can obtain the measurement results \(\texttt {MR}_{A}=\{\texttt {MR}_{A_{1}},\texttt {MR}_{A_{2}},\dots ,\texttt {MR}_{A_{n}}\}\) only after she performs the GHZ measurement on the ith particles (i.e., \(q_{1}^{\texttt {BS}_{B}^{i}}, q_{1}^{\texttt {BS}_{C}^{i}}, q_{1}^{\texttt {BS}_{D}^{i}}\)) from \(S_{1}^{\texttt {BS}_{B}}\), \(S_{1}^{\texttt {BS}_{C}}\) and \(S_{1}^{\texttt {BS}_{D}}\) for \(i=1,2,\dots ,n\). Moreover, as mentioned above, only after Alice completes her measurement, the ith particles (i.e., \(q_{2}^{\texttt {BS}_{B}^{i}}, q_{2}^{\texttt {BS}_{C}^{i}}, q_{2}^{\texttt {BS}_{D}^{i}}\)) from \(S_{2}^{\texttt {BS}_{B}}\), \(S_{2}^{\texttt {BS}_{C}}\), \(S_{2}^{\texttt {BS}_{D}}\) collapse to one of the eight three-particle GHZ states, and then Bob, Charlie and David can get the measurement results \(\texttt {MR}_{B}=\{\texttt {MR}_{B_{1}},\texttt {MR}_{B_{2}},\dots ,\texttt {MR}_{B_{n}}\}\), \(\texttt {MR}_{C}=\{\texttt {MR}_{C_{1}},\texttt {MR}_{C_{2}},\dots ,\texttt {MR}_{C_{n}}\}\), \(\texttt {MR}_{D}=\{\texttt {MR}_{D_{1}},\texttt {MR}_{D_{2}},\dots ,\texttt {MR}_{D_{n}}\}\), respectively, by performing the X-basis measurements on their sequences. Therefore, after the end of the phase of distributing shares, the three agents Bob, Charlie and David can reconstruct the shared secret \(K_{A}\) distributed by the dealer Alice by computing

$$\begin{aligned} \texttt {MR}_{B}\oplus \texttt {MR}_{C}\oplus \texttt {MR}_{D}=\texttt {MR}_{A}=K_{A}. \end{aligned}$$
(11)

Nevertheless, in Sect. 2.2, adding a new agent is by the way of performing the GHZ measurement on the ith particles (i.e., \(q_{1}^{\texttt {BS}_{B}^{i}}, q_{1}^{\texttt {BS}_{C}^{i}}, q_{1}^{\texttt {BS}_{D}^{i}}, q_{1}^{\texttt {BS}_{F}^{i}}\)) from \(S_{1}^{\texttt {BS}_{B}}\), \(S_{1}^{\texttt {BS}_{C}}\), \(S_{1}^{\texttt {BS}_{D}}\), \(S_{1}^{\texttt {BS}_{F}}\) for \(i=1,2,\dots ,n\), to obtain the measurement results \(\texttt {MR}_{A'}=\{\texttt {MR}_{A^{'}_{1}},\texttt {MR}_{A^{'}_{2}},\dots ,\texttt {MR}_{A^{'}_{n}}\}\). After that, Bob, Charlie, David and Frank can obtain the measurement results \(\texttt {MR}_{B'}=\{\texttt {MR}_{B'_{1}},\texttt {MR}_{B'_{2}},\dots ,\texttt {MR}_{B'_{n}}\}\), \(\texttt {MR}_{C'}=\{\texttt {MR}_{C'_{1}},\texttt {MR}_{C'_{2}},\dots ,\texttt {MR}_{C'_{n}}\}\), \(\texttt {MR}_{D'}=\{\texttt {MR}_{D'_{1}},\texttt {MR}_{D'_{2}},\dots ,\texttt {MR}_{D'_{n}}\}\), and \(\texttt {MR}_{F'}=\{\texttt {MR}_{F'_{1}},\texttt {MR}_{F'_{2}},\dots ,\texttt {MR}_{F'_{n}}\}\), respectively, by performing the X-basis measurement on their sequence. By this way, they can recover Alice’s master key \(K_{A'}\) by computing

$$\begin{aligned} \texttt {MR}_{B'}\oplus \texttt {MR}_{C'}\oplus \texttt {MR}_{D'}\oplus \texttt {MR}_{F'}=\texttt {MR}_{A'}=K_{A'}. \end{aligned}$$
(12)

This is obviously in conflict with the principles of quantum mechanics because when Alice performs GHZ measurement on the particles \(S_{1}^{\texttt {BS}_{B}}\), \(S_{1}^{\texttt {BS}_{C}}\), \(S_{1}^{\texttt {BS}_{D}}\), the particles in \(S_{2}^{\texttt {BS}_{B}}\), \(S_{2}^{\texttt {BS}_{C}}\), \(S_{2}^{\texttt {BS}_{D}}\) have been collapsed to one of the eight GHZ states \(\{|\psi _{1}\rangle ,|\psi _{2}\rangle ,\dots ,|\psi _{8}\rangle \}\), and Bob, Charlie and David also have measured them with the X-basis. As a result, there is no particles to measure for Alice, Bob, Charlie and David any longer, which means that there is no way to establish the correlations among the particles distributed by Alice in Step 1 and add a new agent by this way. Of course, Alice can store the particles \(S_{1}^{\texttt {BS}_{B}}\), \(S_{1}^{\texttt {BS}_{C}}\), \(S_{1}^{\texttt {BS}_{D}}\) until the new agent Frank wants to join the four-party dynamic quantum secret sharing protocol as that does in the YT-protocol, which can realize the function of adding the new agent Frank. Nevertheless, this way will give rise to a more serious problem that Bob, Charlie and David cannot recover the shared secret even if they cooperate with each other after the phase of distributing shares, i.e., the access structure is not completed, or they contact Alice to perform GHZ measurement on the particles \(S_{1}^{\texttt {BS}_{B}}\), \(S_{1}^{\texttt {BS}_{C}}\), \(S_{1}^{\texttt {BS}_{D}}\) to establish the access structure temporarily, which are also contrary to the requirement for dynamic secret sharing. In essence, this way is equivalent to a continuation of the phase of distributing shares, and all participants must store their particles, which makes it not practical because quantum store is expensive resource and cannot be easily realized with current technology; in other words, it is not efficient and practical compared with the way of restarting to perform Steps 1–4, which loses the meaning of dynamic secret sharing. Clearly, revoking an agent will face the similar problem.

As a result, The YT-protocol does not satisfy the requirement for dynamic secret sharing in the sense that if the secret distribution has been completed among the agents, then both adding an agent and revoking one become impossible by the way in this protocol.

4 The improvement

As we know, the main goal of dynamic secret sharing is to deal with the problem of adding an agent or revoking one in a secret sharing protocol. However, it has been shown that the YT-protocol does not implement this functionality. Now, we study how to improve the YT-protocol.

In classical secret sharing protocols, the agent change can be realized in the following ways [17]. If the ciphertext of the shared secret has not been published, the dealer Alice can add a new agent Frank by sending a random string to him as he is an original one, and she also can delete any agent by discarding the corresponding random string; otherwise, the agent change can be completed by the following manners. For adding a new agent Frank, every original agent updates his share by adding a random bit string of the same length and sending the random string to Frank. By exclusive-OR all the received strings, Frank can obtain his share. If Alice wants to withdraw Frank’s authorization, Alice just needs to publish Frank’s share.

In contrast to classical secret sharing, in which the ciphertext of the shared secret is public for the agents to verify the secret and prevent the possible deception from the dealer, quantum secret sharing is not based on public key cryptosystems, and therefore, the phase of publishing the ciphertext of the shared secret does not exist in dynamic quantum secret sharing in general. Furthermore, the dealer may also do not know the agents’ shares. Therefore, it is more difficult to implement agent change.

A lot of novel proposals [17,18,19,20,21,22,23,24,25,26,27,28,29] for dynamic quantum secret sharing have been presented since this concept was firstly introduced by Yang et al in 2011 [16]. From the current works [16,17,18,19,20,21,22,23,24,25,26,27,28,29], we can find that adding new agents in dynamic quantum secret sharing can be completed by the similar manners as classical secret sharing; specifically, after the completion of access structure (before the completion of access structure, agent change is a continuation of the phase of distributing shares in essence, which can be easily solved, and thus we do not discuss this case any longer here), there are two ways to add an agent: One is that the dealer Alice adds a new agent Frank by securely sending a random string \(K_{F}\) to him as his share, while she renews the shared secret \(K_{A}\) to \({\widetilde{K}}_{A}=K_{A}\oplus K_{F}\), and the other is that the original agents cooperate to generate a new share \(K_{F}\) for the new participant Frank. Clearly, the first way will change the original secret shared by agents, but each original share needs not be updated, and hence, all the original agents will not be involved in the phase of adding a new agent. On the contrary, the second way does not change the original secret shared by agents, and therefore, the dealer needs not be involved but the original agents must participant in the phase of adding a new agent.

However, it is more difficult to delete an agent in dynamic quantum secret sharing compared with adding a new agent. From the current works [16,17,18,19,20,21,22,23,24,25,26,27,28,29], we can find that if the dealer Alice knows the share held by the agent Frank, then it is not difficult to delete him because she can discarding Frank’s share by the way of announcing it to agents or updating the original shared secret \(K_{A}\) to \({\widehat{K}}_{A}=K_{A}\oplus K_{F}\); otherwise, if the dealer Alice does not know the share held by Frank, then there is no way for her to delete Frank without his cooperation except that she restarts a new distribution phase with the other agents. Of course, if Frank sends his share \(K_{F}\) to Alice, then Alice can delete him by the same way as above. As noted in [18,19,20,21,22,23,24,25,26,27,28,29], the agent to be deleted must be honest; otherwise, this way is not valid any longer.

Based on the above analysis, we improve the YT-protocol just by modifying the phase of agent change as follows.

4.1 Adding an agent

When a new agent (Frank) needs to be added in the YT-protocol, Alice distributes a new share \(K_{F}\) to Frank by quantum key distribution or quantum secure communication. Then, she renews the master key \(K_{A}\) to \({\widetilde{K}}_{A}=K_{A}\oplus K_{F} = K_{B}\oplus K_{C}\oplus K_{D}\oplus K_{F}\). After that, the four agents Bob, Charlie, David and Frank can recover Alice’s new master key \({\widetilde{K}}_{A}\) if they cooperate with each other. Of course, adding an agent Frank also can be done by the second way, i.e., every original agent (Bob, Charlie and David) updates his share by adding a random bit string of the same length and sending the random string to Frank. By exclusive-OR all the received strings \( R_{B}, R_{C},R_{D}\), Frank can obtain his share \(K_{F}=R_{B}\oplus R_{C}\oplus R_{D}\).

4.2 Revoking an agent

Without loss of generality, we also consider the case of a five-party dynamic quantum secret sharing protocol, i.e., one dealer (Alice) and four agents (Bob, Charlie, David and Frank), and suppose that the agent Frank to be deleted is honest. Specifically, if the dealer Alice wants to take back Frank’s authority, then she requires Frank to send back his share \(K_{F}\) for her. After that, she renews the secret \(K_{A}\) to \({\widehat{K}}_{A}=K_{A}\oplus K_{F} = K_{B}\oplus K_{C}\oplus K_{D}\). By this way, Frank’s share is eliminated and only Bob, Charlie and David can recover Alice’s new secret \({\widetilde{K}}_{A}\) if they cooperate with each other. If the agent (Frank) to be deleted is not honest, then it is rather difficult for Alice to delete him without the interaction with the other agents Bob, Charlie and David. It should be noted that if the dealer Alice is allowed to interact with them, then there is a way to deal with this problem, i.e., Alice distributes new shares \({\widehat{K}}_{B}\), \({\widehat{K}}_{C}\), \({\widehat{K}}_{D}\) for them by quantum key distribution or quantum secure communication, respectively, and then, she renews the secret \(K_{A}\) to \({\widehat{K}}_{A}= {\widehat{K}}_{B}\oplus {\widehat{K}}_{C}\oplus {\widehat{K}}_{D}\).

5 Conclusion

In summary, we give an analysis of the YT-protocol and find a neglected problem that this scheme does not satisfy the requirement for dynamic secret sharing in the sense that if the secret distribution has been completed among the agents, then both adding an agent and revoking one become impossible by the way in this protocol. Furthermore, we also discuss how to deal with this problem and give a possible way to improve this protocol. It should be noted that as far as we are concerned, there is no way to delete a dishonest agent without the other agents’ cooperation under this model at present. We hope this problem is noticed in the following work for dynamic quantum secret sharing.