Pith. sign in

REVIEW 3 major objections 4 minor 101 references

A multiparty quantum Byzantine agreement protocol with O(N^2) communication, N star-topology quantum channels, and fault tolerance requiring only two honest players.

Reviewed by Pith at T0; open to challenge. T0 means a machine referee read the full paper against a public rubric. the ladder, T0–T4 →

Challenge this review Re-run · record.json Download PDF Read on arXiv ↗

T0 review · deepseek-v4-flash

2026-08-03 00:06 UTC pith:27V73B24

load-bearing objection New circular-gathering architecture with quadratic complexity, but the claimed N>=f+2 fault tolerance fails because a single Byzantine lieutenant can silently block every gathering indefinitely. the 3 major comments →

arxiv 2602.11592 v2 pith:27V73B24 submitted 2026-02-12 quant-ph

Scalable and Highly Fault-Tolerant Circular Quantum Byzantine Agreement

Chen-Xun Weng , Ming-Yang Li , Shi-Gen Li , Mengya Zhu , Xiao-Ran Sun , Hua-Lei Yin , Zeng-Bing Chen This is my paper
classification quant-ph MSC 81P9468M14 PACS 03.67.Dd03.67.Hk
keywords quantum Byzantine agreementquantum digital signaturesone-time universal hashingcircular message gatheringfault tolerancecommunication complexitysatellite QKD networkconsensus protocol
verification ladder T0 review T1 audit T2 compute T3 formal T4 reserved

The pith

A machine-rendered reading of the paper's core claim, the machinery that carries it, and where it could break.

The paper sets out to show that multiparty quantum Byzantine agreement can be made practical by replacing recursive broadcast with a circular gathering of signed messages. It claims this cuts communication from exponential to quadratic — C(N) = N^2 − N quantum-digital-signature steps — and reduces the quantum network from a fully connected mesh to a star with only N channels. The protocol is said to be information-theoretically secure, to tolerate up to f malicious players whenever N ≥ f + 2, and to run with weak coherent states, making it compatible with satellite-to-ground QKD networks. If these claims hold, consensus for quantum blockchains moves from theoretical toy systems to deployable networks.

Core claim

The paper's central claim is that Byzantine agreement among N players can be reached by having each lieutenant circulate one signed package clockwise around the ring, appending its own order and signature at each hop, with a certificate authority (CA) verifying every signature against stored records. Because each of N−1 lieutenants runs N−1 signing steps, communication is N^2−N quantum-digital-signature operations, and because the CA is the sole verifier, all keys can be distributed over N star links. The authors bound the failure probability by ε_QBA = max{ f[ε_for(m,n)+(N−f−1)ε_for(L_{N−1},n)], (f−1)(N−f)ε_for(L_{N−1},n) }, derived from the underlying one-time universal hashing quantum dig

What carries the argument

The machinery is OTUH-QDS (one-time universal hashing quantum digital signatures), a three-party primitive (signer, forwarder, verifier) in which correlated keys define an LFSR-based Toeplitz hash; the signer sends an encrypted digest and the forwarder and verifier reconstruct the signer's keys by XOR and check it. The protocol makes the certificate authority (CA) the verifier in every transaction, so every order and every accumulated package is signed and independently checked. Circular gathering is the second mechanism: each lieutenant starts a clockwise tour, carries the growing list of orders and signatures, signs the whole package at each hop, and the CA compares each signature with its

Load-bearing premise

The protocol assumes every circular-gathering step completes unless a signature check fails; a Byzantine lieutenant can silently refuse to forward the accumulating package, and the protocol's remedy (restart the same step, Algorithm 1 lines 24–31) retries the same blocked path with no timeout, alternate route, or exclusion, so live termination for N≥f+2 is not established.

What would settle it

Run Algorithm 1 with N=3, f=1, and the single malicious lieutenant acting as a silent Byzantine node: it receives the signed package but never sends it to the next lieutenant. The protocol's response is to restart the same delivery step (Algorithm 1, lines 24–31), so the honest lieutenants loop forever and never reach consensus output. Observing this non-termination would settle that the N≥f+2 guarantee holds only for forgery-type faults, not for Byzantine omission.

Watch this falsifier — get emailed when new claim-graph text bears on it.

If this is right

  • Consensus requires only N^2−N QDS operations instead of the exponential rounds of recursive or QKD-based QBA, so large N becomes feasible.
  • The quantum layer reduces from N(N−1)/2 point-to-point channels to N star links, so existing satellite-to-ground QKD networks can serve as the key distribution backbone.
  • With N≥f+2, the protocol tolerates up to N−2 malicious players in the security model considered by the paper, exceeding the classical 1/3 fault-tolerance bound.
  • Because only weak coherent states and standard QKD primitives are used, the protocol is within reach of current photonic technology, and the paper's simulations indicate consensus rates above 10^2–10^5 per second in low-Earth-orbit settings.

Where Pith is reading between the lines

These are editorial extensions of the paper, not claims the author makes directly.

  • The paper's security analysis covers forgery and repudiation but not Byzantine omission: a malicious lieutenant who simply stops forwarding (or forwards to the wrong node) is a valid Byzantine fault, and the protocol's restart of the same step does not provide liveness; a timeout, alternate route, or exclusion mechanism would be needed to actually guarantee N≥f+2.
  • Adding such a liveness mechanism would likely change the communication count — for example, rerouting around f silent nodes could multiply rounds by a factor related to f — so the O(N^2) figure should be read as the happy-path cost, not the worst-case adversarial cost.
  • The semi-decentralized design places the CA as a permanent verifier for every signature; the paper explicitly relaxes full decentralization, which means a dishonest or compromised CA (or a CA that goes offline) becomes a single point of failure for liveness, even though it does not learn message contents or votes.
  • A natural next test is to run the protocol on a small satellite-to-ground testbed with one node programmed to stay silent; if honest parties cannot terminate without manual intervention, the claimed fault tolerance needs an additional liveness layer.

Editorial analysis

A structured set of objections, weighed in public.

Desk editor's note, referee report, simulated authors' rebuttal, and a circularity audit.

Referee Report

3 major / 4 minor

Summary. This paper proposes a semi-decentralized multiparty quantum Byzantine agreement (QBA) protocol built from one-time universal-hashing quantum digital signatures (OTUH-QDS). A certificate authority (CA) acts as the verifier for every QDS transaction and records signatures; the commanding general signs an order to each lieutenant; each lieutenant then initiates a fixed clockwise circular gathering in which every lieutenant appends its own signed order to the accumulated package, signs the whole package, and the CA verifies all signatures. Each honest lieutenant is supposed to receive an identical message list and apply a deterministic function to produce its output. The paper claims quadratic communication complexity O(N^2), fault tolerance N≥f+2, only N quantum channels in a star topology, and practical satellite-to-ground consensus rates, supported by simulations with DM-CV and BB84 key generation protocols.

Significance. If the claimed properties held, this would be a substantial advance: it would replace the exponential communication of recursive QBA with quadratic scaling while keeping information-theoretic security, and would fit existing star-shaped quantum networks. The manuscript has real strengths: Appendix B gives a self-contained derivation of the OTUH-QDS forgery bound, Appendix C builds a conservative union bound over QDS steps, and the satellite channel simulation is detailed and realistic. However, the central liveness failure described below means the protocol is not Byzantine agreement in the standard sense. The claimed fault tolerance N≥f+2 collapses under a single Byzantine omission, so the significance of the paper as written is conditional on a fundamental redesign rather than on local fixes.

major comments (3)
  1. [Section III, Phase 2; Algorithm 1, lines 18–32]
  2. [Section III, Phase 1; Algorithm 1, lines 4–14]
  3. [Appendix C; Eq. (C13); Section IV(a)]
minor comments (4)
  1. [Throughout; Eq. (1), Appendix B]
  2. [Algorithm 1, line 32]
  3. [Fig. 3 and Section V(b)]
  4. [Figs. 4–5 and Eq. (6)]

Circularity Check

0 steps flagged

No circular derivation: the QBA security bound is a conservative union bound over QDS forgery events, the communication complexity count is structural, and the simulation rates are KGP key rates rather than fitted QBA predictions. The serious liveness gap is a correctness issue, not circularity.

full rationale

The central derivation chain is not circular. Eq. (2) for epsilon_QBA is an explicit union bound over independent OTUH-QDS forgery events, with a worst-case message length L_{N-1}; it is not a fitted quantity and does not re-enter as an input to the thing it predicts. The underlying forgery bound epsilon_for(M,n)=M*2^{1-n} is re-derived in Appendix B from LFSR/Toeplitz hashing and an irreducible-polynomial counting argument; the residual citation to Ref. [22] for the M/N guess-count property is a primitive-level security statement whose assumptions do not include the present circular-QBA claim, so it is independent support rather than a self-referential definition. Communication complexity C(N)=(N-1)+(N-1)^2 is a direct count of protocol QDS steps, not a prediction obtained by fitting. The fault-tolerance claim N>=f+2 is argued conditionally from unforgeability and CA records; its real weakness is termination: a Byzantine lieutenant can omit forwarding the package, and the 'Restart current step' loop (Algorithm 1, lines 24-32) retries the same blocked path forever, with no timeout, alternate route, or exclusion mechanism. That is a missing liveness proof and therefore a correctness/fault-tolerance risk, but it is not circularity. Satellite simulations use KGP key rates through CR=min(SR)/(N^2-N); parameters such as alpha=0.72, Delta_c=0.42, Delta_a=0.52 are QKD optimization parameters, not fitted to the QBA consensus output. Accordingly, no circular step is exhibited; the score reflects only the minor, non-load-bearing self-citation of the authors' earlier OTUH-QDS work.

Axiom & Free-Parameter Ledger

3 free parameters · 5 axioms · 0 invented entities

The protocol introduces no new physical entities. Its load-bearing assumptions are the trusted CA, the OTUH-QDS primitive, authenticated classical channels, and the unstated assumption that Byzantine nodes cannot block message delivery. Simulation parameters are QKD optimizations from prior work and do not affect the protocol's correctness.

free parameters (3)
  • coherent-state amplitude alpha = 0.72
    Optimized value used in the DM-CV QKD simulation (Section VI); affects consensus-rate figures, not the protocol's correctness or fault-tolerance claim.
  • post-selection thresholds Delta_c, Delta_a, Delta_p = 0.42, 0.52, 0
    Optimization choices for homodyne and heterodyne key-rate runs in Figure 4, taken from prior QKD work; not used to fit any QBA claim.
  • BB84 simulation constants = detector efficiency 70%, dark count 1e-8, misalignment 0.02, error-correction efficiency 1.1
    Standard decoy-state BB84 parameters from prior literature used for Figure 5; not free parameters of the protocol itself.
axioms (5)
  • domain assumption OTUH-QDS is unforgeable and non-repudiable with forgery bound M*2^{1-N}
    Invoked in Section IV and derived in Appendix B from Refs. [21,22]; the entire QBA security argument depends on this cryptographic primitive.
  • domain assumption The CA is honest and keeps a permanent record of every signature and associated quantum key
    Section III and Figure 6 rely on CA records to prevent message substitution. A malicious CA breaks the protocol; this is the semi-decentralized trust assumption.
  • domain assumption Authenticated classical channels exist among all players and the CA
    QDS messaging and circular gathering require authenticated classical communication; the paper assumes such channels without stating how they are established.
  • ad hoc to paper Honest players' messages are eventually delivered; malicious omission is not modeled
    No liveness or termination analysis covers a Byzantine node that simply stops forwarding. The single-path ring cannot be completed if a node silently refuses, so the fault-tolerance claim implicitly assumes omissions are not adversarial.
  • standard math Standard properties of LFSR-based Toeplitz hashing and irreducible polynomials over GF(2)
    Used in Appendix B for the QDS hash construction and forgery probability derivation.

pith-pipeline@v1.3.0-alltime-deepseek · 27776 in / 20823 out tokens · 317231 ms · 2026-08-03T00:06:03.795396+00:00 · methodology

0 comments
read the original abstract

Quantum Byzantine agreement (QBA), a cornerstone of quantum blockchain, offers inherent advantages in security and fault tolerance over classical protocols, guaranteed by the laws of quantum mechanics. However, existing multiparty QBA protocols face challenges for large-scale deployment due to exponential communication complexity or reliance on complex multi-particle entanglement. To address this, we propose a multiparty circular QBA protocol that adopts a semi-decentralized architecture, leveraging circular message gathering and quantum digital signatures to achieve quadratic communication complexity and enhanced fault tolerance. Our protocol is experimentally feasible, requiring only weak coherent states, and is compatible with existing star-shaped quantum networks. Simulations conducted on a global satellite-to-ground network demonstrate that the protocol sustains high consensus rates among multiple users, even when employing different key generation protocols under realistic conditions. This work presents a scalable framework for large-scale QBA networks, establishing the foundation for a practical quantum blockchain that enables secure and fault-tolerant decentralized services.

Figures

Figures reproduced from arXiv: 2602.11592 by Chen-Xun Weng, Hua-Lei Yin, Mengya Zhu, Ming-Yang Li, Shi-Gen Li, Xiao-Ran Sun, Zeng-Bing Chen.

Figure 1
Figure 1. Figure 1: FIG. 1. Schematic of our circular QBA protocol. (a) Order distribution. The commanding general [PITH_FULL_IMAGE:figures/full_fig_p003_1.png] view at source ↗
Figure 2
Figure 2. Figure 2: FIG. 2. Comparison of lower bounds on communication com [PITH_FULL_IMAGE:figures/full_fig_p005_2.png] view at source ↗
Figure 4
Figure 4. Figure 4: FIG. 4. Simulation of the consensus rate of circular QBA using satellite-to-ground DM-CV KGP scheme [ [PITH_FULL_IMAGE:figures/full_fig_p006_4.png] view at source ↗
Figure 5
Figure 5. Figure 5: FIG. 5. Performance of the QBA protocol using BB84 KGP adapted from asymmetric coding BB84 QKD [ [PITH_FULL_IMAGE:figures/full_fig_p007_5.png] view at source ↗
Figure 6
Figure 6. Figure 6: FIG. 6. (a) The information delivery step between [PITH_FULL_IMAGE:figures/full_fig_p012_6.png] view at source ↗
Figure 7
Figure 7. Figure 7: FIG. 7. The order distribution phases of two cases. (a) Case I: Loyal commanding general. In this case, the same message is [PITH_FULL_IMAGE:figures/full_fig_p014_7.png] view at source ↗

discussion (0)

Sign in with ORCID, Apple, or X to comment. Anyone can read and Pith papers without signing in.

Reference graph

Works this paper leans on

101 extracted references · 2 linked inside Pith

  1. [1]

    Order distribution.For each lieutenantR i (i∈Z + N−1), the commanding generalSsigns anm-bit ordermi with ann-bit signatureσ i in Fig. 1(a). This pair {mi;σi}is sent toR i via a three-party OTUH-QDS, with S,R i, and the CA as the signer, forwarder, and verifier. Each OTUH-QDS session is shown in Fig. 1(b): first, a KGP whereS,R i, and the CA establish thei...

  2. [2]

    Circular gathering.Each of theN−1 lieu- tenants initiates a clockwise circular gathering ofN−1 steps (Fig. 1(c)). We take the circular gathering started byR i as an example. The gathering follows a clock- wise cycle, denoted by the sequence (i→i+ 1→ ··· →N−1→1→ ··· →i). The first infor- mation package delivered fromR i toR i+1 isR i’s ini- tial message li...

  3. [3]

    Note that a deterministic function is a function that al- ways produces the same output for the same input

    Consensus output.After the circular gather- ing, each lieutenantR i (∀i∈Z + N−1) gets the completely identical message list, namelyFi ={m 1,m 2,...,m N−1}, and puts it into a pre-selected deterministic functionDto produce the final outputm Ri =D(m 1,m 2,...,m N−1). Note that a deterministic function is a function that al- ways produces the same output for...

    2021

  4. [4]

    (a) Homodyne

    DM-CV KGP Here, we introduce the detailed steps of two DM-CV QKD protocols with homodyne detection and heterodyne detection, respectively. (a) Homodyne

  5. [5]

    She then sends the state to the receiver, Bob

    Preparation: In each round, Alice prepares a coher- ent state|αe iϕ⟩, whereϕis uniformly randomly chosen from {π 4, 3π 4 , 5π 4 , 7π 4 } . She then sends the state to the receiver, Bob

  6. [6]

    Measurement: Upon receiving the state, Bob uni- formly randomly chooses a quadrature from{ˆp,ˆq}to measure and records the measurement outcome

  7. [7]

    If the rate is below zero, the protocol is aborted

    Parameter estimation: AfterNrounds, they an- nounce the measurement quadratures through the au- thenticated public channel, and Bob announces a subset of the measurement results in order to evaluate the se- curity, i.e., to compute the secret key rate. If the rate is below zero, the protocol is aborted

  8. [8]

    Alice labels the four choices as {00,10,11,01}

    Key generation: If the protocol is not aborted, suppose Bob obtainsMoutcomes labeled asZ= (z1,...,z k,...,z M). Alice labels the four choices as {00,10,11,01}. If the quadrature that Bob measures in a given round is ˆq, Alice sets her key bita k as the first bit of the corresponding label. Otherwise,a k is set as the second bit. As for Bob, if the measure...

  9. [9]

    (b) Heterodyne

    Error correction and privacy amplification: After performing error correction and privacy amplification, they obtain the final key strings. (b) Heterodyne

  10. [10]

    In each round, Alice prepares a coherent state with random phases and sends the state to the receiver Bob

    Preparation: The preparation process is similar. In each round, Alice prepares a coherent state with random phases and sends the state to the receiver Bob

  11. [11]

    Measurement: Instead of measuring a quadrature, Bob directly performs a POVM described by{E γ = (1/π)|γ⟩⟨γ|:γ∈C}

  12. [12]

    Parameter estimation: AfterNrounds, they use a small subset of the data to compute the secret key rate and decide whether to abort the protocol

  13. [13]

    Alice records her bits directly as{0,1,2,3}according to her choices

    Key generation: Suppose they obtainMmeasure- ment outcomes recorded asZ= (z 1,...,z k,...,z M), where eachz k has the form|z k|eiθk. Alice records her bits directly as{0,1,2,3}according to her choices. Bob uses two sifting parameters, ∆ a and ∆p, separately for the amplitude and phase. The mapping rule from the measurement outcomesZto his key stringBis as...

  14. [14]

    Error correction and privacy amplification: After the process of error correction and privacy amplification, they obtain the final key strings

  15. [15]

    Key generation em- ploys only those instances where both parties select the Xbasis

    BB84 KGP Alice and Bob select theXandZbases with proba- bilitiesq x and 1−q x, respectively. Key generation em- ploys only those instances where both parties select the Xbasis. Phase-randomized laser pulses are transmitted, incorporating a two-decoy setting. Each pulse intensity is randomly chosen from the setK={µ 1,µ 2,µ 3}, with probabilitiesp µ1,p µ2, ...

  16. [16]

    A corresponding laser pulse is then prepared and sent to Bob

    Preparation.Alice randomly selects a bit value (yi), a basis (a i ∈{X,Z}), and an intensity (k i ∈K). A corresponding laser pulse is then prepared and sent to Bob

  17. [17]

    The four possible outcomes are{0,1,∅,⊥}, where 0 and 1 repre- sent bit values,∅denotes no detection, and⊥indicates a double-click event

    Measurement.Bob independently selects a basis (bi∈{X,Z}) and measures the received pulse. The four possible outcomes are{0,1,∅,⊥}, where 0 and 1 repre- sent bit values,∅denotes no detection, and⊥indicates a double-click event. Bob records the outcome asy ′ i, as- signing a random bit toy ′ i in the case of a double-click event

  18. [18]

    The protocol continues only if|X k|≥n X,k and|Z k|≥n Z,k for allk

    Basis reconciliation.Alice and Bob exchange their basis and intensity choices through an authenticated pub- lic channel, identifying the setsXk andZk for each inten- sityk∈K. The protocol continues only if|X k|≥n X,k and|Z k|≥n Z,k for allk. Otherwise, they repeat steps 1 and 2. The total number of pulses sent by Alice is denoted asN

  19. [19]

    Generation of raw key and error estimation.A raw key pair (X A,XB) is generated by samplingn X =∑ k∈KnX,k elements fromX=∪ k∈KXk. The number of bit errors (m Z,k) in theZ k sets are then determined, along with the number of vacuum (s X,0) and single- photon (sX,1) events in (X A,XB), and the number of phase errors (c X,1) in the single-photon events is al...

  20. [20]

    Post-processing.This phase involves error correc- tion (revealingλ EC bits), error verification using two- universal hash functions, and final privacy amplification to generate the secret key pair. Appendix B: OTUH-QDS Achieving information-theoretic security in long mes- sage signing, the OTUH-QDS framework [21] utilizes one-time pads for encryption and ...

  21. [21]

    Even a minor change in the input re- sults in a significantly different hash value

    LFSR-based T oeplitz hashing A hash function acts like a digital fingerprint for a doc- ument or message. Even a minor change in the input re- sults in a significantly different hash value. Moreover, it is computationally infeasible to recover the original mes- sage from its hash value, meaning there are no known efficient algorithms to do so. This makes ...

  22. [22]

    Detailed steps and signature rate of OTUH-QDS

  23. [23]

    Distribution phase.The initial step involves the es- tablishment of shared secret keys among the signer (S), forwarder (F), and verifier (V) through a KGP. This is achieved through a QKD or quantum secret sharing protocol, resulting in correlated bit strings where the signer’s key is the bitwise XOR of the forwarder’s and verifier’s keys. Specifically, ea...

  24. [24]

    The message to be signed is denoted as Mes with lengthM

    Messaging phase.This process begins with the signer generating an LFSR-based Toeplitz hash func- tion [58]H XS,pS, which is determined by the secret key XS and a local random stringp S which corresponds to the coefficients of a irreducible polynomial. The message to be signed is denoted as Mes with lengthM. The signer calculates theN-bit digest value Dig ...

  25. [25]

    This Section exam- ines the security foundations of the OTUH-QDS proto- col, demonstrating its security against both classical and quantum attacks

    Security of OTUH-QDS The security of QDS relies on two essential properties: unforgeability and non-repudiation. This Section exam- ines the security foundations of the OTUH-QDS proto- col, demonstrating its security against both classical and quantum attacks. In a KGP process, successful privacy amplification eliminates information leakage during key gen...

  26. [26]

    Security of circular gathering phase with malicious lieutenants The rounds of circular gathering started by disloyal lieutenant need not to be considered since what disloyal lieutenants obtain and how they generate the output is ir- relevant to twoICconditions. AssumingR 1 is loyal, the security analysis ofR1’s circular gathering serves as a rep- resentat...

  27. [27]

    In this case, we haveN d =fandN h =N−f−1

    Case I: Loyal commanding general We first analyze the scenario where the commanding generalSis loyal and the number of disloyal lieutenants isf. In this case, we haveN d =fandN h =N−f−1. During the order distribution phase shown in Fig. 7(a), the loyalSsigns the same messagem 0 with signatureσ i (i∈Z + N−1) and transmits them to lieutenants, with CA actin...

  28. [28]

    The order distribution phase is depicted in Fig

    Case II: Disloyal commanding general In this scenario, there areN d =f−1 disloyal lieu- tenants andN h =N−fhonest lieutenants. The order distribution phase is depicted in Fig. 7(b). A disloyal commanding general aims to disrupt the protocol and mislead the honest lieutenants, sendingN−1 different messages during the order distribution phase. In this con- ...

  29. [29]

    Overall security Obviously, the two scenarios where the commanding general is loyal and disloyal are complementary. To pro- vide a stricter bound, the security parameter of our QBA scheme, denoting the failure probability of protocol, is expressed as follows: εQBA = max{εI,ε II} = max { f [ εfor(m,n) + (N−f−1)ε for(LN−1,n) ] , (f−1)(N−f)ε for(LN−1,n) } . ...

  30. [30]

    This model is also employed in Ref

    Satellite-to-Ground Channel Here, we first present the numerical analysis for the satellite-to-ground link, focusing on the factors affecting laser signal transmission, namely attenuation, beam dis- tortion, and deflection. This model is also employed in Ref. [52]. Within this framework, the receiver detects incoming photons, considering both the channel’...

  31. [31]

    Chan- nel noise fluctuates based on environmental conditions and can be approximated by stray light power

    DM-CV KGP Additionally, excess noise in DM-CV type KGP is due to channel noise (scintillation, ambient light) and detec- tion noise (device imperfections, electronic noise). Chan- nel noise fluctuates based on environmental conditions and can be approximated by stray light power. Detection noise arises from inherent device flaws. Total excess noise is giv...

  32. [32]

    BB84 KGP Following [56], the number of vacuum and single- photon events in theX-basis are estimated as: sX,0≥τ 0 µ2n− X,µ3−µ 3n+ X,µ2 µ2−µ 3 ,(D30) sX,1≥ τ1µ1 [ n− X,µ2−n + X,µ3− µ2 2−µ2 3 µ2 1 (n+ X,µ1− sX,0 τ0 ) ] µ1(µ2−µ 3)−µ 2 2 +µ 2 3 . (D31) whereτ n :=∑ k∈Ke−kknpk/n! (K={µ 1,µ 2,µ 3}) is the probability of transmitting ann-photon state, and n± X,k ...

  33. [33]

    Lamport, R

    L. Lamport, R. Shostak, and M. Pease, The Byzantine generals problem, ACM Transactions on Programming Languages and Systems4, 382 (1982)

    1982

  34. [34]

    Castro, B

    M. Castro, B. Liskov,et al., Practical Byzantine fault tolerance, inOSDI, Vol. 99 (1999) pp. 173–186

    1999

  35. [35]

    Aublin, S

    P.-L. Aublin, S. B. Mokhtar, and V. Qu´ ema, RBFT: Re- dundant Byzantine fault tolerance, in2013 IEEE 33rd International Conference on Distributed Computing Sys- tems(2013) pp. 297–306

    2013

  36. [36]

    B. Guo, Z. Lu, Q. Tang, J. Xu, and Z. Zhang, Dumbo: Faster asynchronous BFT protocols, inProceedings of the 2020 ACM SIGSAC Conference on Computer and Com- munications Security, CCS ’20 (Association for Comput- ing Machinery, 2020) pp. 803–818

    2020

  37. [37]

    Bodkhe, S

    U. Bodkhe, S. Tanwar, K. Parekh, P. Khanpara, S. Tyagi, N. Kumar, and M. Alazab, Blockchain for industry 4.0: A comprehensive review, IEEE Access8, 79764 (2020)

    2020

  38. [38]

    Jiang, C

    C. Jiang, C. Xu, J. Chen, and K. Chen, Blockchain-based immunization against kleptographic attacks, Sci. China Inf. Sci.67, 172102 (2024)

    2024

  39. [39]

    Y. Miao, K. Gai, and L. Zhu, Blockchain-assisted multi- keyword searchable provable data possession for cloud storage, Sci. China Inf. Sci.69, 132101 (2026)

    2026

  40. [40]

    P. W. Shor, Polynomial-time algorithms for prime factor- ization and discrete logarithms on a quantum computer, SIAM Review41, 303 (1999)

    1999

  41. [41]

    L. K. Grover, Quantum mechanics helps in searching for a needle in a haystack, Phys. Rev. Lett.79, 325 (1997)

    1997

  42. [42]

    A. K. Fedorov, E. O. Kiktenko, and A. I. Lvovsky, Quan- tum computers put blockchain security at risk, Nature 563, 465 (2018)

    2018

  43. [43]

    Zhou, X.-Y

    M.-G. Zhou, X.-Y. Cao, Y.-S. Lu, Y. Wang, Y. Bao, Z.- Y. Jia, Y. Fu, H.-L. Yin, and Z.-B. Chen, Experimental quantum advantage with quantum coupon collector, Re- search2022, 9798679 (2022)

    2022

  44. [44]

    Dolev, J

    D. Dolev, J. Y. Halpern, and H. R. Strong, On the pos- sibility and impossibility of achieving clock synchroniza- tion, Journal of Computer and System Sciences32, 230 (1986)

    1986

  45. [45]

    M. J. Fischer, N. A. Lynch, and M. Merritt, Easy impos- sibility proofs for distributed consensus problems, Dis- tributed Computing1, 26 (1986)

    1986

  46. [46]

    L. Feng, X. Fu, H. Wang, K. Wang, P. Shi, F. Jiang, and M. Lin, From PBFT to the present: a thorough overview of blockchain consensus protocols, Sci. China Inf. Sci.69, 111102 (2026)

    2026

  47. [47]

    Fitzi, N

    M. Fitzi, N. Gisin, and U. Maurer, Quantum solution to the Byzantine agreement problem, Phys. Rev. Lett.87, 217901 (2001)

    2001

  48. [48]

    Gaertner, M

    S. Gaertner, M. Bourennane, C. Kurtsiefer, A. Cabello, and H. Weinfurter, Experimental demonstration of a quantum protocol for Byzantine agreement and liar de- tection, Phys. Rev. Lett.100, 070504 (2008)

    2008

  49. [49]

    Iblisdir and N

    S. Iblisdir and N. Gisin, Byzantine agreement with two quantum-key-distribution setups, Phys. Rev. A70, 034306 (2004)

    2004

  50. [50]

    Neigovzen, C

    R. Neigovzen, C. Rod´ o, G. Adesso, and A. Sanpera, Mul- tipartite continuous-variable solution for the Byzantine agreement problem, Phys. Rev. A77, 062307 (2008)

    2008

  51. [51]

    Rahaman, M

    R. Rahaman, M. Wie´ sniak, and M. ˙Zukowski, Quantum Byzantine agreement via Hardy correlations and entan- glement swapping, Phys. Rev. A92, 042302 (2015)

    2015

  52. [52]

    Weng, R.-Q

    C.-X. Weng, R.-Q. Gao, Y. Bao, B.-H. Li, W.-B. Liu, Y.-M. Xie, Y.-S. Lu, H.-L. Yin, and Z.-B. Chen, Beat- ing the fault-tolerance bound and security loopholes for Byzantine agreement with a quantum solution, Research 6, 0272 (2023)

    2023

  53. [53]

    H.-L. Yin, Y. Fu, C.-L. Li, C.-X. Weng, B.-H. Li, J. Gu, Y.-S. Lu, S. Huang, and Z.-B. Chen, Experimental quan- tum secure network with digital signatures and encryp- tion, Natl. Sci. Rev.10, nwac228 (2023)

    2023

  54. [54]

    Li, Y.-M

    B.-H. Li, Y.-M. Xie, X.-Y. Cao, C.-L. Li, Y. Fu, H.-L. Yin, and Z.-B. Chen, One-time universal hashing quan- tum digital signatures without perfect keys, Phys. Rev. Appl.20, 044011 (2023)

    2023

  55. [55]

    Xiong, B

    S. Xiong, B. Tang, H. Han, J. Huang, M. Bai, F. Li, W. Yu, Z. Mo, and B. Liu, Efficient arbitrated quantum digital signature with multi-receiver verification, Adv. Quantum Technol.7, 2400110 (2024)

    2024

  56. [56]

    Bian, B.-H

    J.-W. Bian, B.-H. Li, Y.-M. Xie, H.-L. Yin, and Z.-B. Chen, Asynchronous measurement-device-independent quantum digital signatures, Phys. Rev. A110, 012609 (2024)

    2024

  57. [57]

    Qin, Z.-W

    J.-Q. Qin, Z.-W. Yu, and X.-B. Wang, Efficient quan- tum digital signatures over long distances with likely bit strings, Phys. Rev. Applied21, 024012 (2024)

    2024

  58. [58]

    Du, B.-H

    Y. Du, B.-H. Li, X. Hua, X.-Y. Cao, Z. Zhao, F. Xie, Z. Zhang, H.-L. Yin, X. Xiao, and K. Wei, Chip- integrated quantum signature network over 200 km, Light-Sci. Appl.14, 108 (2025)

    2025

  59. [59]

    Gottesman and I

    D. Gottesman and I. Chuang, Quantum digital signa- tures, arXiv preprint quant-ph/0105032 (2001)

    Pith/arXiv arXiv 2001

  60. [60]

    Dunjko, P

    V. Dunjko, P. Wallden, and E. Andersson, Quantum digital signatures without quantum memory, Phys. Rev. Lett.112, 040502 (2014)

    2014

  61. [61]

    H.-L. Yin, Y. Fu, and Z.-B. Chen, Practical quantum digital signature, Phys. Rev. A93, 032316 (2016)

    2016

  62. [62]

    Amiri, P

    R. Amiri, P. Wallden, A. Kent, and E. Andersson, Se- cure quantum signatures using insecure quantum chan- nels, Phys. Rev. A93, 032325 (2016)

    2016

  63. [63]

    Roberts, M

    G. Roberts, M. Lucamarini, Z. Yuan, J. Dynes, L. Co- mandar, A. Sharpe, A. Shields, M. Curty, I. Puthoor, and E. Andersson, Experimental measurement-device- independent quantum digital signatures, Nat. Commun. 8, 1098 (2017)

    2017

  64. [64]

    Richter, M

    S. Richter, M. Thornton, I. Khan, H. Scott, K. Jaksch, U. Vogl, B. Stiller, G. Leuchs, C. Marquardt, and N. Ko- rolkova, Agile and versatile quantum communication: Signatures and secrets, Phys. Rev. X11, 011038 (2021)

    2021

  65. [65]

    J.-Q. Qin, C. Jiang, Y.-L. Yu, and X.-B. Wang, Quan- tum digital signatures with random pairing, Phys. Rev. Applied17, 044047 (2022)

    2022

  66. [66]

    X. Jing, C. Qian, C.-X. Weng, B.-H. Li, Z. Chen, C.-Q. Wang, J. Tang, X.-W. Gu, Y.-C. Kong, T.-S. Chen, H.-L. Yin, D. Jiang, B. Niu, and L.-L. Lu, Experimental quan- tum Byzantine agreement on a three-user quantum net- work with integrated photonics, Sci. Adv.10, eadp2877 (2024)

    2024

  67. [67]

    Lu, Z.-H

    F.-Y. Lu, Z.-H. Wang, Y. Zhou, Y.-X. Fan, S. Wang, Z.- Q. Yin, J. Li, D.-Y. He, F.-X. Wang, W. Chen,et al., Fully heterogeneous prepare-and-measure quantum net- work for the next stage of quantum internet, Nat. Com- 19 mun.16, 11487 (2025)

    2025

  68. [68]

    Wehner, D

    S. Wehner, D. Elkouss, and R. Hanson, Quantum inter- net: A vision for the road ahead, Science362, eaam9288 (2018)

    2018

  69. [69]

    Azuma, S

    K. Azuma, S. E. Economou, D. Elkouss, P. Hilaire, L. Jiang, H.-K. Lo, and I. Tzitrin, Quantum repeaters: From quantum networks to the quantum internet, Rev. Mod. Phys.95, 045006 (2023)

    2023

  70. [70]

    Bozzio, C

    M. Bozzio, C. Cr´ epeau, P. Wallden, and P. Walther, Quantum cryptography beyond key distribution: theory and experiment, Rev. Mod. Phys.97, 045006 (2025)

    2025

  71. [71]

    Liu, Z.-P

    H.-W. Liu, Z.-P. Liu, H.-L. Yin, and Z.-B. Chen, Quantum-enhanced blockchain federated learning via quantum Byzantine agreement, Sci. China Inf. Sci.68, 180503 (2025)

    2025

  72. [72]

    Z. Qu, Z. Zhang, B. Liu, P. Tiwari, X. Ning, and K. Muhammad, Quantum detectable Byzantine agreement for distributed data trust management in blockchain, Information Sciences637, 118909 (2023)

    2023

  73. [73]

    S. Liu, Y. Zhang, S. Ren, S. Qiu, Z. Lu, X. Wang, and Y. Li, Experimental demonstration of complete quantum e-commerce based on an efficient quantum digital pay- ment, Photon. Res.13, 572 (2025)

    2025

  74. [74]

    Z. Zhao, X. Li, B. Luan, W. Jiang, W. Gao, and S. Nee- lakandan, Secure Internet of Things (IoT) using a novel Brooks Iyengar quantum Byzantine agreement-centered blockchain networking (BIQBA-BCN) model in smart healthcare, Information Sciences629, 440 (2023)

    2023

  75. [75]

    X. Sun, P. Kulicki, and M. Sopek, Multi-party quantum Byzantine agreement without entanglement, Entropy22, 1152 (2020)

    2020

  76. [76]

    L. Li, X. Sun, and J. Zhu, Quantum Byzantine agree- ment against full-information adversary, arXiv preprint arXiv:2409.01707 (2024)

    Pith/arXiv arXiv 2024

  77. [77]

    S. N. Paing, J. W. Setiawan, M. A. Ullah, F. Zaman, T. Q. Duong, O. A. Dobre, and H. Shin, Counterfactual quantum Byzantine consensus for human-centric meta- verse, IEEE Journal on Selected Areas in Communica- tions42, 905 (2024)

    2024

  78. [78]

    E. O. Kiktenko, N. O. Pozhar, M. N. Anufriev, A. S. Trushechkin, R. R. Yunusov, Y. V. Kurochkin, A. Lvovsky, and A. K. Fedorov, Quantum-secured blockchain, Quantum Sci. Technol.3, 035004 (2018)

    2018

  79. [79]

    Yin, W.-L

    H.-L. Yin, W.-L. Wang, Y.-L. Tang, Q. Zhao, H. Liu, X.-X. Sun, W.-J. Zhang, H. Li, I. V. Puthoor, L.-X. You, et al., Experimental measurement-device-independent quantum digital signatures over a metropolitan network, Phys. Rev. A95, 042338 (2017)

    2017

  80. [80]

    Korzh, C

    B. Korzh, C. C. W. Lim, R. Houlmann, N. Gisin, M. J. Li, D. Nolan, B. Sanguinetti, R. Thew, and H. Zbinden, Provably secure and practical quantum key distribution over 307 km of optical fibre, Nat. Photonics9, 163 (2015)

    2015

Showing first 80 references.