Secure Anonymous Conferencing in Quantum Networks
Extracted source text · arXiv 2111.05363
% Use only LaTeX2e, calling the article.cls class and 12-point type.
\documentclass[12pt]{article}
\usepackage{scicite}
% Our Comments
\usepackage{xcolor}
%\usepackage{ulem}
\newcommand{\gm}[1]{\textcolor{magenta}{#1}}
\newcommand{\gmc}[1]{\textcolor{magenta}{gm: #1}}
\newcommand{\fg}[1]{\textcolor{blue}{fg: #1}}
\newcommand{\jj}[1]{\textcolor{green}{js: #1}}
\newcommand{\fh}[1]{\textcolor{orange}{#1}}
\newcommand{\fhcomment}[1]{\textcolor{orange}{fh: #1}}
\newcommand{\anna}[1]{\textcolor{violet}{ap: #1}}
\newcommand{\db}[1]{\textcolor{purple}{db: #1}}
%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%
% Our own packages
\usepackage{braket}
\usepackage{amsmath}
\usepackage{amssymb}
\usepackage{mathrsfs}
\usepackage{amsthm}
\usepackage{mathtools}
\usepackage{comment}
\usepackage{stackrel}
\usepackage{enumitem}
\setlist[enumerate]{label*=\arabic*.}
%to include the Suppl Materials as a pdf
\usepackage{pdfpages}
% checkmark and crosses
\usepackage{pifont}
\newcommand{\cmark}{{\mbox{\ding{51}}}}
\newcommand{\xmark}{{\mbox{\ding{55}}}}
% Our commands
\def\diracspacing{0.7pt}
\newcommand{\ketbra}[2]{| \hspace{\diracspacing} #1 \rangle \langle #2 \hspace{\diracspacing} |} % ketbra with different vectors
\newcommand{\norm}[1]{\left\|#1\right\|_{\mathrm{tr}}}
\newcommand{\abs}[1]{\left|#1\right|}
\DeclareMathOperator{\Tr}{Tr}
\newcommand{\id}{\mathbbm{1}}
\newcommand{\proj}[1]{\ketbra{#1}{#1}}
%min and max entropies
\newcommand{\hmin}{\mathrm{min}}
\newcommand{\hmax}{\mathrm{max}}
%for Definition and Theorem environments
\theoremstyle{definition}
\newtheorem{Thm}{Theorem}
\theoremstyle{definition}
\newtheorem{Def}{Definition}
\newtheorem{Ption}{Proposition}
\newtheorem{Lmm}{Lemma}
\usepackage{algorithm}
\makeatletter
\newenvironment{protocol}
{% \begin{protocol}
\renewcommand{\ALG@name}{Protocol}% Update algorithm name
%\begin{center}
\refstepcounter{algorithm}% New algorithm
\hrule height.8pt depth0pt \kern2pt% \@fs@pre for \@fs@ruled
\renewcommand{\caption}[2][\relax]{% Make a new \caption
{\raggedright\textbf{\fname@algorithm~\thealgorithm} ##2\par}%
\ifx\relax##1\relax % #1 is \relax
\addcontentsline{loa}{algorithm}{\protect\numberline{\thealgorithm}##2}%
\else % #1 is not \relax
\addcontentsline{loa}{algorithm}{\protect\numberline{\thealgorithm}##1}%
\fi
\kern2pt\hrule\kern2pt
}
}{% \end{protocol}
\kern2pt\hrule\relax% \@fs@post for \@fs@ruled
%\end{center}
}
\makeatother
%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%
\usepackage{times}
% The preamble here sets up a lot of new/revised commands and
% environments. It's annoying, but please do *not* try to strip these
% out into a separate .sty file (which could lead to the loss of some
% information when we convert the file to other formats). Instead, keep
% them in the preamble of your main LaTeX source file.
% The following parameters seem to provide a reasonable page setup.
\topmargin 0.0cm
\oddsidemargin 0.2cm
\textwidth 16cm
\textheight 21cm
\footskip 1.0cm
\newenvironment{sciabstract}{%
\begin{quote} \bf}
{\end{quote}}
% Include your paper's title here
\title{Robust Anonymous Conference Key Agreement enhanced by Multipartite Entanglement}
\author{Federico Grasselli$^{1\dagger\ast}$, Gl\'{a}ucia Murta$^{1\dagger\ast}$, Jarn de Jong$^{2}$, Frederik Hahn$^{3}$,\\ Dagmar Bru\ss$^{1}$, Hermann Kampermann$^{1}$, Anna Pappa$^{2,4}$.
\\
\normalsize{$^{1}$Institut f\"ur Theoretische Physik III, Heinrich-Heine-Universit\"at D\"usseldorf,}\\ \normalsize{40225 D\"usseldorf, Germany}\\
\normalsize{$^{2}$Electrical Engineering and Computer Science Department, Technische Universit\"at Berlin,}\\ \normalsize{10587 Berlin, Germany}\\
\normalsize{$^{3}$Dahlem Center for Complex Quantum Systems, Freie Universit\"at Berlin,}\\ \normalsize{14195 Berlin, Germany}\\
\normalsize{$^{4}$Fraunhofer Institut for Open Communication Systems - FOKUS, 10589 Berlin, Germany}\\
\\
\normalsize{$^{\dagger}$These authors contributed equally to this work.} \\
\normalsize{$^\ast$ Corresponding authors: federico.grasselli@hhu.de; glaucia.murta@hhu.de.}
}
% Include the date command, but leave its argument blank.
\date{}
%%%%%%%%%%%%%%%%% END OF PREAMBLE %%%%%%%%%%%%%%%%
\begin{document}
%\baselineskip24pt
\maketitle
\begin{sciabstract}
Users of quantum networks can securely communicate via so-called quantum conference key agreement --- making their identities publicly known. In certain cases, however, users may seek anonymity. Here, exploiting multipartite Greenberger–Horne–Zeilinger (GHZ) states, we design efficient and noise-tolerant protocols for anonymous conference key agreement.
Inspired by the composable security of quantum key distribution, we introduce security definitions encompassing various levels of \textit{anonymity} and prove the security of our protocols. We analyze the performance of our protocols in noisy and lossy quantum networks and compare with protocols that only use bipartite entanglement to achieve the same functionalities. Our simulations show that GHZ-based protocols can outperform protocols based on bipartite entanglement in the finite-key regime and that the advantage increases for protocols with higher anonymity requirements. Our results strongly advocate the use of multipartite entanglement for cryptographic tasks involving several users.
\end{sciabstract}
%%% ONE-SENTENCE SUMMARY %%%
% One-Sentence Summary: A brief teaser statement highlighting main result of the paper, understandable by a scientist not in your field, without jargon or abbreviations. This will appear online adjacent to the title and should not repeat phrases already present there. Please keep to under 125 characters and spaces.
%\begin{sciabstract}
% Exploiting multipartite entanglement to outperform anonymous cryptographic protocols based on Bell pairs.
%\end{sciabstract}
% OLD summary: Using multi-partite entanglement to outperform traditional anonymous quantum key distribution.
%%% MAIN TEXT %%%
\section*{Introduction}\label{sec:intro}
Building on the ``second quantum revolution'' \cite{second-quantum-rev1,second-quantum-rev2,QTEU}, quantum-cryptography technologies have recently seen a rapid development both in academia and industry, with quantum key distribution (QKD) \cite{BB84,Diamanti2016,pir2019advances} being a prominent example \cite{QKDmarkets}. The task of QKD has been generalized to multiple users with quantum conference key agreement (CKA) \cite{Epping,Grasselli_2018,WstateProtocol,FirstCVMDI,ZSG18,OLLP19,CKAreview}, where $n$ parties establish a common secret key when linked by an insecure quantum network. The key, called conference key, can subsequently be used for group-wise encryption among the $n$ parties \cite{CKAexperiment}.
Besides achieving secure communication with encryption keys, another important cryptographic necessity that arises in a network with multiple parties, is anonymity. Indeed, there are scenarios where the communicating parties want to share a secret message and, at the same time, remain anonymous. That is, they want to keep their identities hidden from the other parties in the network and from the network manager. Examples include voting, anonymous informants, and secret agents deployed in enemy territory.
So far, however, few protocols have been proposed which achieve some form of anonymous secure communication through quantum resources; moreover, they lack a general security framework and are often unpractical.
Here, we formalize this cryptographic task by considering an $n$-party quantum network where, prior to the execution of the protocol, each party could potentially be a participant, i.e. the anonymous sender or one of the anonymous receivers. The goal of the protocol is to establish a secret conference key between a sender and $m$ receivers ($m<n$), chosen by the sender, such that they remain anonymous at least with respect to the other $n-m-1$ parties. The established conference key then enables anonymous secure communication among the participants.
We define protocols with different anonymity requirements. In particular, an anonymous conference key agreement (ACKA) protocol reveals the participants' identities to each participant and provides them with the same conference key. Beyond that, in a fully-anonymous conference key agreement (fully-ACKA) protocol we require that only the sender knows the number and identities of the receivers, while each receiver is only aware of their role. In both ACKA and fully-ACKA protocols the participants' identities (and the conference key) are unknown to the remaining parties in the network and to a potential eavesdropper controlling the network.
A fully-ACKA protocol could be used by a whistle-blower (the sender) within a company or institution, who wants to expose some illicit activity to some of the company's board members (the receivers). The fully-ACKA protocol would ensure the anonymity of sender and receivers, thus protecting them from potential reprisals. Alternatively, an ACKA protocol could be employed by an intelligence agency to send secret messages to undercover agents (the receivers) in an hostile environment.
We distinguish three features characterizing the security of ACKA and fully-ACKA protocols. Specifically, the protocol must be \emph{CKA-secure}, which means that the established conference key is identical for all participants, uniformly distributed and unknown to anybody else (as in standard CKA \cite{CKAreview,CKAbook}). The protocol must also be \emph{anonymous}, in the sense that the identity of each participant must be kept secret from a subset of parties, depending on the required level of anonymity. Finally, the protocol must be \emph{integrous}, that is, the identities of the sender and of the chosen receivers are correctly assigned and communicated.
In this work, we introduce rigorous security definitions for ACKA and fully-ACKA, which encompass the above-mentioned security notions and are inspired by the composable security framework of QKD. Moreover, we design ACKA and fully-ACKA protocols based on multipartite entangled states distributed by an untrusted source --which could be operated by the eavesdropper-- and prove their security according to our definitions.
In contrast to previously-proposed anonymous protocols based on multipartite entanglement \cite{Wehner2005,lipinska_anonymous_2018,Brassard2007,unnikrishnan_anonymity_2019,yang_examining_2020,acka_old,ACKA}, ours are notably more practical and implementable with present-day technology. In fact, our protocols are robust against noise affecting the distributed states, as they incorporate the classical post-processing steps typical of quantum key distribution (QKD) while maintaining anonymity. Hence, they are the first anonymous communication protocols that guarantee security and anonymity in the presence of a noisy untrusted source. At the same time, the verification of the entangled states prepared by the source is efficient and technologically less demanding than in previous anonymous communication schemes \cite{Brassard2007,unnikrishnan_anonymity_2019,yang_examining_2020,acka_old,ACKA}. Indeed, in our protocols the source verification consumes only a small fraction of entangled states and only requires local measurements, whereas in previous schemes it must be performed in the vast majority of the protocol rounds and additionally requires quantum memories.
Both our ACKA and fully-ACKA protocols exploit the multipartite entanglement of Greenberger–Horne–Zeilinger (GHZ) states shared by the $n$ parties in the network. To assess the protocols' performance and the usefulness of multipartite entanglement, we introduce two multiparty generalizations of the Anonymous Message Transmission protocol \cite{Broadbent2007}. The generalized protocols achieve the same functionalities of ACKA and fully-ACKA, respectively, while exclusively relying on bipartite entanglement --in the form of Bell pairs-- shared between every pair of parties.
Our network simulations show that the ACKA and fully-ACKA protocols based on GHZ states outperform the corresponding protocols based on Bell pairs even in the finite-key regime. Moreover, the advantage provided by GHZ states over Bell pairs increases with the anonymity requirements of the protocol and, for the case of fully-ACKA, multipartite entanglement increases the conference key rate by more than one order of magnitude. Our results clearly demonstrate the benefit of multipartite entanglement for cryptographic tasks involving more than two parties and strengthen previous results in support of this claim.
\paragraph*{Security assumptions}
\label{sec:security-assumptions}
From a security perspective, the eavesdropper --called Eve-- can completely control the entanglement source and the quantum network. Eve may also listen to the public communication generated during the protocol and corrupt any subset of parties. Any party who misbehaves and willingly does not follow the prescriptions of the protocol is considered to be a corrupt party and is called \emph{dishonest}. Eve can collaborate with the dishonest parties, having access to their private classical inputs and outputs, but is not allowed to impersonate them (e.g. store their quantum systems). Analogously to QKD, Eve has unbounded quantum power and holds a perfect quantum memory. Conversely, the $n$ parties are assumed to be either equipped with short-lived quantum memories or without a quantum memory (noisy storage model \cite{bounded_storage}).
\paragraph*{Previous work}
\label{sec:previous-work}
The anonymous transmission of a (classical and quantum) message between two parties in a quantum network supplied with multipartite entanglement was first addressed in~\cite{Wehner2005}, with a protocol that requires a trusted source of perfect GHZ states. On the same lines, a protocol based on a trusted source of $W$ states was introduced in \cite{lipinska_anonymous_2018}. However, such protocols do not tolerate dishonest parties and the security analysis does not address the secrecy of the message. Attempts to overcome these drawbacks and the assumption of the trusted source led to the proposal of further protocols for anonymous message transmission.
In particular, the protocols in \cite{Brassard2007,unnikrishnan_anonymity_2019,yang_examining_2020} enable two parties to transmit a quantum message in a network with potentially dishonest parties employing an untrusted source of entangled states. The trust in the source is removed by introducing a procedure which verifies that the source is distributing states close to the ideal state. However, the verification procedures in \cite{Brassard2007,unnikrishnan_anonymity_2019,yang_examining_2020} cannot tolerate noise and are rather demanding in terms of quantum resources, as they require: single-qubit \cite{unnikrishnan_anonymity_2019,yang_examining_2020} or multi-qubit \cite{Brassard2007} operations, quantum memories and local measurements. Moreover, the verification in \cite{unnikrishnan_anonymity_2019,yang_examining_2020} is very inefficient since it consumes all of the distributed entangled states except for one, which is used to transmit the quantum message. In this regard, we point out that when several bits/qubits need to be transmitted, the fraction of states used for verification in \cite{unnikrishnan_anonymity_2019,yang_examining_2020} increases with the size of the message, resulting in a zero asymptotic rate of anonymous message transmission even in a noiseless scenario\footnote{As a matter of fact, the fraction of entangled states used for verification tends to 1 as the size of the message goes to infinity. This happens, in particular, if one iterates the protocol in \cite{unnikrishnan_anonymity_2019} while fixing the claimed level of anonymity, which is quantified in \cite{unnikrishnan_anonymity_2019} by the parameters $\delta$ and $\varepsilon$.}. This is in stark contrast with QKD protocols, in which the fraction of verification rounds goes asymptotically to zero, resulting in a positive key rate.
Regarding the anonymous transmission of a classical message between two parties in a network with an arbitrary number of dishonest parties, a solution is presented in~\cite{broadbent_information-theoretic_2007}, with a protocol that requires pair-wise private channels and a broadcast channel.
Recently, the task of fully-ACKA was addressed in \cite{acka_old} and further explored in \cite{ACKA}. The protocols in \cite{acka_old,ACKA}, while requiring some level of trust in the source preparing the multipartite entangled states, also build on the verification scheme of \cite{unnikrishnan_anonymity_2019, yang_examining_2020} and present the same drawbacks of: inefficiency (which leads to an asymptotically zero key rate even in a noiseless scenario), need for quantum memories and poor noise tolerance.
\paragraph*{Use of the anonymous conference key} \label{sec:use-of-key}
Contrary to standard CKA schemes, the secret conference key established by ACKA and fully-ACKA protocols must be used in a non-trivial encryption scheme in order to protect the participants' identities. Indeed, if the sender would simply encrypt a secret message with the conference key and broadcast it publicly, every party in the network would understand who the sender is after realizing who performed the broadcast.
In the ACKA scenario, the solution is straightforward. Every party in the network is forced to broadcast a random string, while the sender broadcasts their message encrypted with the conference key. Only the receivers will be able to decrypt the sender's broadcast by using the conference key.
In the fully-ACKA scenario the receivers do not know the sender's identity and the previous solution could reveal it. In this case, a possibility would be to employ classical anonymous broadcasting protocols. In \cite{anonymous-broadcast} the authors introduce a protocol that requires $\log_2 n$ bipartite private channel uses for every bit to be broadcast, which works against at most $n/6$ colluding parties.
\section*{Results}
\paragraph{Security definitions}
Our approach to define the security of ACKA and fully-ACKA protocols starts from the identification of three properties that an ideal protocol is expected to satisfy.
The first property that we require is integrity. At the beginning of an ACKA (fully-ACKA) protocol, the participants are not yet determined. Therefore, the first step of such protocols consists in running an identity designation (ID) sub-protocol. The ID sub-protocol determines the sender, notifies the receivers of their roles and, in the case of ACKA, notifies the receivers of the other participants' roles. A (fully-)ACKA protocol is integrous if its ID sub-protocol works perfectly, i.e., if either it correctly communicates the roles of sender and receivers, or it aborts for every party in the network\footnote{In a real protocol the ID sub-protocol might be faulty. For instance, two parties could be simultaneously designated as senders, or the designated receivers do not coincide with the ones intended by the sender or, in the case of ACKA, the receivers are not correctly informed about the other participants.}.
Conditioned on the fact that the ID sub-protocol does not abort and correctly assigns the identities, we require the (fully-)ACKA protocol to be CKA-secure. That is, either it outputs the same random conference key for every participant, uncorrelated from any information held by the non-participants and Eve, or it aborts from the point of view of the participants.
Finally, an ACKA (fully-ACKA) protocol should be anonymous, i.e., the identity of each participant must be kept secret from the non-participants and Eve --as well as from the other receivers in the case of fully-ACKA.
We remark that dishonest participants may broadcast their identity --or the identity of all the participants in the case of ACKA. Hence, in the presence of dishonest participants we cannot impose the same anonymity requirements. Similarly, no CKA-security is required if some participants are dishonest, as they may publicly reveal the secret conference key.
Inspired by the composable security framework of QKD \cite{PortmannRenner2014,Portmann2021}, we define the security of ACKA and fully-ACKA protocols from the output state of the protocol --i.e., the state of the classical and quantum registers of each party, including the eavesdropper, at the end of the protocol. More specifically, we introduce a security definition which quantifies, for every property, how close the output state is to a state with the required property. Informally, our security definition can be stated as following (the rigorous definition, Definition~\ref{def:suff-cond-security}, is given in the Methods section.
\begin{Def}[Security (informal)]\label{def:security-informal}
A (fully-)ACKA protocol is $\varepsilon$-secure, with $\varepsilon=\varepsilon_{\rm IN}+\varepsilon_{\rm CKA}+\varepsilon_{\rm AN}$, if it satisfies the following three conditions:
\begin{itemize}
\item $\varepsilon_{\rm IN}$-integrity: The ID sub-protocol correctly assigns the roles of sender and receivers or aborts for every party in the network, except for a probability smaller than $\varepsilon_{\rm IN}$.
\item $\varepsilon_{\rm CKA}$-CKA-security:
In the case of honest participants, conditioned on the ID sub-protocol correctly assigning the participants' identities, the output state is $\varepsilon_{\rm CKA}$-close to the output state of a protocol that either delivers the same secret conference key to every participant, or aborts for every participant.
\item $\varepsilon_{\rm AN}$-anonymity for ACKA:
the output state of any subset of non-participants and Eve is $\varepsilon_{\rm AN}$-close to a state which is independent of the identity of the remaining parties.
\item $\varepsilon_{\rm AN}$-anonymity for fully-ACKA:
the output state of any subset of parties (except for the sender) and Eve is $\varepsilon_{\rm AN}$-close to a state which is independent of the identities of the other parties.
\end{itemize}
\end{Def}
In the following we introduce ACKA and fully-ACKA protocols that rely on the distribution of multipartite entangled states, namely GHZ states, to the $n$ parties in the network. Motivated by the fact that our fully-ACKA protocol does not satisfy the (strong) anonymity condition of Definition~\ref{def:security-informal} but still retains important anonymity features, we provide a weaker anonymity definition satisfied by our fully-ACKA protocol.
The reason for which the fully-ACKA protocol cannot satisfy the strong anonymity condition is that the receivers, by executing the protocol, gain access to information (e.g., whether the protocol aborts or not) that can depend on the identities of the other participants. Such dependence can occur if the untrusted source distributes asymmetric states which are noisier for some parties than for others, instead of the permutationally-symmetric GHZ states. Similar problems affecting anonymity were already mentioned in \cite{Brassard2007} regarding the protocol proposed in \cite{Bouda07}.
However, we emphasize that honest-but-curious receivers may be able to deduce the identity of other participants only if they combine the identity-dependent information obtained from the protocol with a detailed knowledge of the asymmetric states distributed by the source --or with any other asymmetric specification of the protocol causing identity-dependent events. Therefore, the anonymity of the parties can be preserved if honest-but-curious receivers do not have access to the asymmetric specifications of the protocol's implementation (e.g. if they are secret or if the publicly available specifications are symmetric), even if the source actually distributes asymmetric states. Note, however, that we cannot prevent dishonest parties or Eve from broadcasting the actual, asymmetric, specifications of the protocol's implementation at any point in time, thus jeopardizing anonymity with respect to honest receivers.
This weaker version of anonymity is captured by the following definition, where $\rm w$ abbreviates ``weak'' and $\rm (n)p$ abbreviates ``(non-)participant''. The definition is satisfied by our fully-ACKA protocol with GHZ states (the formal definition is given in Methods).
\begin{Def}[Weak-anonymity for fully-ACKA (informal)] \label{def:sweak-anonym}
A fully-ACKA protocol is $\varepsilon_{\rm w AN}$-weak-anonymous, with $\varepsilon_{\rm wAN}=\varepsilon_{\rm npAN} + \varepsilon_{\rm pAN}$, if the following two conditions are satisfied:
\begin{enumerate}
\item (Anonymity with respect to non-participants and Eve) The output state of the protocol satisfies the $\varepsilon$-anonymity condition for ACKA protocols with $\varepsilon=\varepsilon_{\rm npAN}$.
\item (Anonymity with respect to honest-but-curious receivers) When the protocol's specifications known to the parties are symmetric --i.e., invariant under permutations of parties--, any subset of honest-but-curious receivers cannot guess the identity of other participants with a higher probability than the trivial guess, except for a small deviation $\varepsilon_{\rm pAN}$.
\end{enumerate}
\end{Def}
\paragraph{ACKA and fully-ACKA protocols}
Here we present an ACKA and a fully-ACKA protocol which rely on the distribution of GHZ states to all the parties in the network. For convenience, we will identify the sender as Alice and the intended receivers as Bob$_l$, for $l\in\{1,\dots,m\}$, where the number of receivers $m$ is not predetermined and can be chosen by Alice during the protocol.
Both our protocols require:
\begin{enumerate}
\item A shielded laboratory for each party, equipped with a trusted measurement device, a trusted post-processing unit and a private source of randomness.
\item A bipartite private authenticated channel for each pair of the $n$ parties, implemented with a shared secret key previously established by a QKD protocol (e.g. by sharing Bell pairs between the two parties).
\item An authenticated broadcast channel.
\item A public source of randomness that is not hacked by the adversary\footnote{Note that this requirement could be dropped and replaced, for instance, by taking the XOR of random bits that are simultaneously broadcast by each of the $n$ parties.}.
\end{enumerate}
The ACKA protocol also requires previously-shared conference keys among every subset of parties in the network. Part of these keys are consumed during the execution of the ACKA protocol, which is thus a key-growing algorithm.
For simplicity, we prove the protocols' security under the assumption that every bipartite private channel is perfectly secure. Nevertheless, the security proofs could be straightforwardly extended to the case where such channels are generated by $\varepsilon$-secure QKD protocols, with $\varepsilon>0$.
In the following, we provide a high-level description of the steps of our ACKA and fully-ACKA protocols, whose core consists in distributing and measuring GHZ states to anonymously generate a shared conference key. The additional steps required to ensure integrity and CKA-security (namely the ID sub-protocol, error correction and privacy amplification) are summarized here and further detailed in the Methods section, together with more exhaustive protocol descriptions. In order to ensure that the communication taking place in these steps is anonymous, we make use of classical sub-routines introduced in \cite{Broadbent2007} --specifically Parity, Veto and Collision Detection-- which rely on bipartite private channels and do not require multipartite entanglement. As the name suggests, the Parity protocol computes the parity of the input bits while preserving the anonymity of the parties.\vspace{1cm}
\begin{protocol} \label{prot:sACKA}
\caption{Anonymous Conference Key Agreement (\textbf{ACKA})}
\begin{enumerate}[label=\arabic*., ref=\arabic*]
\item\label{sACKA:step1} The parties run the ACKA-ID sub-protocol (Protocol~\ref{prot:ID}), after which Alice is established to be the sender and Bob$_l$, for $l\in\{1,\dots,m\}$, the receivers.
\item\label{sACKA:step2} Alice and the Bobs recover a pre-established conference key.
\item\label{sACKA:step3} Alice generates a random bitstring, called testing key, where 1 corresponds to a test round and 0 to a key generation round (each bit equals 1 with probability $p$). Alice broadcasts a compressed version of the testing key, encrypted\footnote{The encryption of a bitstring with another bitstring is always intended with one-time pad.} with a portion of the pre-established conference key of step~\ref{sACKA:step2}, while the other parties broadcast a random string of the same length. Each Bob recovers the testing key from Alice's broadcast.
\item\label{sACKA:step4} Repeat for $L$ rounds:
\begin{enumerate}
\item An $n$-party GHZ state is distributed to the $n$ parties.
\item Alice and the Bobs measure their qubits according to the testing key. They measure in the (Pauli) $Z$ basis if the round is a key generation round, or in the (Pauli) $X$ basis if the round is a test round. All the other parties measure $X$. The $Z$ outcomes\footnote{The outcomes of a Pauli $Z$ ($X$) measurement are $+1$ and $-1$ and are mapped to the binary values $0$ and $1$, respectively.} of each participant form their raw conference key.
\end{enumerate}
\item\label{sACKA:step5} Once the quantum measurements are over\footnote{Here we employ the bounded storage assumption. That is, we wait for a time longer than the coherence time of the qubits owned by the parties. We do not need to wait in case the parties have no quantum memory.}, the testing key is anonymously revealed to all parties by iterating the Parity protocol (Protocol~\ref{prot:parity}).
\item\label{sACKA:step6} For every round that is labelled as a test round, the $n$ parties perform the Parity protocol with the following inputs: Every party, except for Alice, inputs the outcome of their $X$ measurement while Alice inputs a random bit. By combining the outputs of Parity with her test-round outputs, Alice computes $Q^{\mathrm{obs}}_X$, which is the fraction of test rounds where the $X$ outcomes of the $n$ parties have parity 1.
%the observed frequency that the $X$ outcomes of the $n$ parties multiply to $-1$ in the test rounds.
\item\label{sACKA:step7} Verification of secrecy: Alice compares $Q^{\mathrm{obs}}_X$ with the predefined value $Q_X$. If $Q_X^{\mathrm{obs}}+ \gamma(Q_X^{\mathrm{obs}}) >Q_X + \gamma(Q_X)$, where $\gamma(Q_X)$ is the statistical fluctuation, Alice concludes that the verification failed.
\item\label{sACKA:step8} Error correction (ACKA-EC, Protocol \ref{prot:err-corr-acka}): Alice anonymously broadcasts error correction information based on a predefined value $Q_Z$ for the pairwise error rate between the $Z$ outcomes of Alice and of each Bob. The Bobs use the information to correct their raw keys and verify that they match Alice's raw key. Alice's broadcast is encrypted with the pre-established conference key and only the Bobs can decrypt it. If the error correction or the verification of secrecy (step~\ref{sACKA:step7}) failed, the participants abort the protocol, but this information is encrypted and only available to them.
\item\label{sACKA:step9} Privacy amplification (PA): The public randomness outputs a two-universal hash function.
Alice and each Bob apply the two-universal hash function on their error-corrected keys and obtain the secret conference keys of length $\ell$.
\end{enumerate}
\end{protocol}\vspace{1cm}
\begin{protocol}\label{prot:sf-ACKA}
\caption{Fully Anonymous Conference Key Agreement (\textbf{fully-ACKA})}
\begin{enumerate}[label=\arabic*., ref=\arabic*]
\item\label{sf-ACKA:step1} The parties perform the fully-ACKA-ID sub-protocol (Protocol~\ref{prot:f-ID}), after which Alice is established to be the sender and Bob$_l$, for $l\in\{1,\dots,m\}$, the receivers.
\item\label{sf-ACKA:step2} Alice generates a random bitstring, called testing key, where 1 corresponds to a test round and 0 to a key generation round (each bit equals 1 with probability $p$). Additionally, Alice generates the bitstrings $\vec{r}_l$ (for $l\in\{1,\dots,m\}$), which are later used to encrypt some communication between Alice and each Bob.
\item\label{sf-ACKA:step3} The parties perform the TKD protocol (Protocol~\ref{prot:TKD}) in order for Alice to distribute the testing key and the string $\vec{r}_l$ to the corresponding Bob$_l$.
\item\label{sf-ACKA:step4} Repeat for $L$ rounds:
\begin{enumerate}
\item An $n$-party GHZ state is distributed to the $n$ parties.
\item Alice and the Bobs measure their qubits according to the testing key. They measure in the $Z$ basis if the round is a key generation round, or in the $X$ basis if the round is a test round. All the other parties measure $X$. The $Z$ outcomes of each participant form their raw conference key.
\end{enumerate}
\item\label{sf-ACKA:step5} Once the quantum measurements are over, the testing key is anonymously revealed by iterating the Parity protocol (Protocol~\ref{prot:parity}).
\item\label{sf-ACKA:step6} For every round that is labelled as a test round, the $n$ parties perform the Parity protocol with the following inputs: Every party, except for Alice, inputs the outcome of their $X$ measurement while Alice inputs a random bit. By combining the outputs of Parity with her test-round outputs, Alice computes $Q^{\mathrm{obs}}_X$, which is which is the fraction of test rounds where the $X$ outcomes of the $n$ parties have parity 1.
\item\label{sf-ACKA:step7} Verification of secrecy: Alice compares $Q^{\mathrm{obs}}_X$ with the predefined value $Q_X$. If $Q_X^{\mathrm{obs}}+ \gamma(Q_X^{\mathrm{obs}}) >Q_X + \gamma(Q_X)$, where $\gamma(Q_X)$ is the statistical fluctuation, Alice concludes that the verification failed. If the verification of secrecy failed, or if a party detected any malfunctioning in the TKD protocol (step~\ref{sf-ACKA:step3}), the protocol aborts for every party.
\item\label{sf-ACKA:step8} Error correction (fully-ACKA-EC, Protocol \ref{prot:err-corr}): Alice anonymously broadcasts error correction information based on a predefined value $Q_Z$ for the pairwise error rate between the $Z$ outcomes of Alice and of each Bob. The Bobs use the information to correct their raw keys and verify that they match Alice's raw key. If the error correction fails, the protocol aborts but this information is encrypted with the strings $\vec{r}_l$ and thus only available to Alice and the Bobs.
\item\label{sf-ACKA:step9} Privacy amplification (PA): The public randomness outputs a two-universal hash function.
Alice and each Bob apply the two-universal hash function on their error-corrected keys and obtain the secret conference keys of length $\ell$.
\end{enumerate}
\end{protocol}\vspace{1em}
In the Supplementary Materials we prove the security of Protocols \ref{prot:sACKA} and \ref{prot:sf-ACKA} according to the formal statement of Definition~\ref{def:security-informal}, provided in Methods (Definition~\ref{def:suff-cond-security}). The security claims of the protocols are reported in the following theorem.
\begin{Thm}[Security]\label{thm:security-acka-and-f-acka}
The ACKA protocol based on GHZ states (Protocol~\ref{prot:sACKA}) yields a secret conference key of net length\footnote{The length $\ell_{\rm net}$ is obtained by subtracting the number of consumed bits of pre-established conference keys from the length $\ell$ of the outputted conference key. Conversely, the fully-ACKA protocol does not consume pre-established conference keys, therefore $\ell_{\rm net}=\ell$.}
\begin{equation}
\ell_{\rm net} = L (1-p) \left[1-h\left(Q_X + \gamma(Q_X) \right)-h(Q_Z)\right] -\log_2 \frac{2(n-1)}{\varepsilon_{\rm EC}}-2\log_2 \frac{1}{2\varepsilon_{\mathrm{PA}}} - Lh(p) -n \label{skeylength-acka},
\end{equation}
and is $\varepsilon_{\rm tot}$-secure according to Definition~\ref{def:security-informal}, with $\varepsilon_{\mathrm{tot}}=2^{-r_V}+(n-1)\,\varepsilon_{\rm enc} + 2\varepsilon_x + \varepsilon_{\rm EC} + \varepsilon_{\rm PA}$ and where $h(x)=-x\log_2 x -(1-x)\log_2 (1-x)$ is the binary entropy function.
The fully-ACKA protocol based on GHZ states (Protocol~\ref{prot:sf-ACKA}) yields a secret conference key of length
\begin{equation}
\ell = L (1-p) \left[1-h\left(Q_X + \gamma(Q_X) \right) -h(Q_Z)\right] -\log_2 \frac{2(n-1)}{\varepsilon_{\mathrm{EC}}}-2\log_2 \frac{1}{2\varepsilon_{\mathrm{PA}}} \label{skeylength},
\end{equation}
and is $\varepsilon_{\rm tot}$-secure according to Definition~\ref{def:security-informal} but with the anonymity condition replaced by Definition~\ref{def:sweak-anonym}, with $\varepsilon_{\mathrm{tot}}=2^{-(r_V-2)}+(n-1)(6\varepsilon_{\rm enc} + 2^{-(r_N-1)})+\varepsilon_{\mathrm{EC}} +6\varepsilon_x+3\varepsilon_{\mathrm{PA}}$.
The protocols' parameters appearing in the conference key length and in the security parameter $\varepsilon_{\rm tot}$ are specified in Table \ref{tab:parameters} of Methods.
\end{Thm}
\paragraph{Performance comparison}
In order to assess the performance of Protocols~\ref{prot:sACKA} and \ref{prot:sf-ACKA} and the benefit of GHZ states in anonymously establishing a conference key, we design protocols achieving the same tasks without resorting to multipartite entanglement. The protocols, which only use bipartite private channels hence named bACKA and bifully-ACKA, are generalizations of the Anonymous Message Transmission protocol \cite{Broadbent2007} to more than two parties. In Methods we provide a detailed description of bACKA (Protocol~\ref{prot:bACKA}) and bifully-ACKA (Protocol~\ref{prot:bif-ACKA}) along with their security claims according to Definition~\ref{def:security-informal}.
All the protocols are run on the same quantum network (c.f. Fig.~\ref{fig:network}). We model the network of $n$ parties as a star-shaped network where every party is linked to a central quantum server --which can be untrusted and operated by Eve-- by a lossy quantum channel. For simplicity we assume that the parties are equally distanced from the server, so that the transmittance of each lossy channel is equal to $\eta$.
The quantum server is programmed to distribute either the $n$-party GHZ state
$\ket{\mathrm{GHZ}_n} = (\ket{0}^{\otimes n} + \ket{1}^{\otimes n})/\sqrt{2}$ to all parties, which is used to extract the conference key in ACKA and fully-ACKA, or the Bell state $\ket{\mathrm{GHZ}_2}$ to every pair of parties in order to implement the bipartite private channels by running BB84 protocols \cite{BB84}. We assume that both states are encoded in some binary degree of freedom of single photons, such that the probability of receiving a (potentially noisy) Bell pair and GHZ state is $\eta^2$ and $\eta^n$, respectively (we assume the parties hold ideal detectors). We allow for noisy states due to a faulty state preparation by the quantum server, which prepares the states by applying CNOT gates with failure probability $f_G$. This leads to non-zero error rates $Q_X$ and $Q_Z$ of the GHZ state and $Q_{Xb}$ and $Q_{Zb}$ of the Bell pairs ($Q_{Xb}$ and $Q_{Zb}$ are the pairwise error rates in the $X$ and $Z$ basis used in the BB84 protocol). We refer to the Supplementary Materials for the exact relation between the error rates and $f_G$.
\begin{figure}[hbt]
\centering
\includegraphics[width=0.6\linewidth,keepaspectratio]{network.pdf}
\caption{Our anonymous protocols are implemented on a quantum network consisting of $n$ parties ($n=8$ in the picture) linked to a central quantum server. The roles of the parties are not predetermined and are instead assigned during the protocol's execution. The party designated as sender selects the desired receivers to anonymously establish a shared conference key. The quantum server provides the necessary entangled resources by distributing --in each network use-- either Bell pairs between distinct pairs of parties (e.g. four pairs when $n=8$) or one GHZ state shared between all parties. Note that the bACKA and bifully-ACKA protocols only require Bell pairs. The figure of merit to compare the performance of our protocols is the number of secret conference key bits generated per network use.}
\label{fig:network}
\end{figure}
We compare the four protocols --ACKA vs bACKA and fully-ACKA vs bifully-ACKA-- in terms of their conference key rate, that is, the number of fresh secret bits shared by Alice and the intended Bobs per network use. We define one network use to be the preparation and distribution of photons from the quantum server to the parties, regardless of whether the photons are lost or not. We assume that each channel can transmit one photon per network use. However, multiple photons can be transmitted in parallel from the server to the parties in a single network use, namely entangled in a GHZ state shared between all parties or in multiple Bell pairs shared between distinct pairs of parties (see Fig.~\ref{fig:network}). For instance, the conference key rate of the ACKA protocol (Protocol~\ref{prot:sACKA}) reads: $r=\ell_{\rm net}/L_{\rm tot}$, where $\ell_{\rm net}$ is given in \eqref{skeylength-acka} and $L_{\rm tot}$ is the total number of network uses, comprising distributions of GHZ states and Bell pairs. Conversely, all the network uses in bACKA and bifully-ACKA are devoted to the distribution of Bell pairs to implement the bipartite private channels. We provide a detailed calculation of the conference key rates of our protocols in the Supplementary Materials.
In Fig.~\ref{fig:finite-key} we plot the conference key rates of the four protocols in the finite-key regime. The key rates are numerically optimized over the protocols' parameters for each value of $L_{\rm tot}$, having fixed the security parameter (Definition~\ref{def:security-informal}) to $\varepsilon_{\mathrm{tot}}= 10^{-8}$. In the optimizations, we set the CNOT gate failure probability to $f_G=0.02$ and to $f_G=0.01$ \cite{gate-fidelity}, while the transmittance is given by $\eta=10^{-\gamma d/10}$, where $d$ is the length of the channel party-server and $\gamma=0.17$~dB/km (each channel is assumed to be an ultra-low-loss fiber). We set the distance to $d=2$~km and $d=10$~km to simulate common metropolitan communication scenarios. More details on the optimization are given in the Supplementary Materials.
\begin{figure}[ht]
\centering
\begin{minipage}{0.495\textwidth}
\centering
\textbf{ACKA vs bACKA}\par\medskip
\includegraphics[width=1\linewidth,keepaspectratio]{ACKA-vs-bACKA-finite-key-d2.pdf}
\includegraphics[width=1\linewidth,keepaspectratio]{ACKA-vs-bACKA-finite-key-d10.pdf}
\end{minipage}\hfill\vline\hfill
\begin{minipage}{0.495\textwidth}
\centering
\textbf{fully-ACKA vs bifully-ACKA}\par\medskip
\includegraphics[width=1\linewidth,keepaspectratio]{fully-ACKA-vs-bifully-ACKA-finite-key-d2.pdf}
\includegraphics[width=1\linewidth,keepaspectratio]{fully-ACKA-vs-bifully-ACKA-finite-key-d10.pdf}
\end{minipage}
\caption{Conference key rates of our anonymous protocols as a function of the total number of network uses ($L_{\rm tot}$), for different numbers of parties in the network ($n$). The security parameter is fixed to $\varepsilon_{\mathrm{tot}}=10^{-8}$. The protocols based on GHZ states (ACKA and fully-ACKA) outperform the ones based on Bell pairs (bACKA and bifully-ACKA) already for a relatively low number of network uses. In our network model a quantum server prepares either GHZ states or Bell pairs by repeatedly applying a faulty CNOT gate with failure probability $f_G$. The qubits are encoded on single photons and distributed to the equally-distanced parties via ultra-low-loss fiber. The gate failure probability is either fixed to $f_G=0.02$ or $f_G=0.01$ (the difference in the rates of bACKA and bifully-ACKA is negligible, hence we only reported the $f_G=0.02$ case) and the distance party-server is fixed to $d=2$ km (top) and $d=10$ (bottom).} \label{fig:finite-key}
\end{figure}
From Fig.~\ref{fig:finite-key} we deduce that the ACKA and fully-ACKA protocols, based on GHZ states, can yield higher conference key rates than the protocols exclusively based on Bell pairs (bACKA and fully-ACKA), especially in the high-$L_{\rm tot}$ regime, where finite-key effects can be neglected. In order to understand the intrinsic reason behind this, we compute the asymptotic conference key rates of our anonymous protocols. Indeed, the asymptotic key rates are devoid of statistical corrections and are independent of the sub-protocols requiring a fixed number of network uses regardless of the key length (e.g. Veto or ID). Hence, they reveal the bare scaling of the protocols' performance with respect to the number of parties and the quality of the source states.
The asymptotic conference key rates of the ACKA and bACKA protocol are given by:
\begin{align}
r^{\infty} &= \lim_{L_{\rm tot} \to \infty} r=\eta^n \left[1-h(Q_X) -h(Q_Z)\right] \label{asymp-rate-acka} \\
r^{\infty}_b &= \lim_{L_{b\rm tot} \to \infty} r_b=\frac{ \left\lfloor \frac{n}{2} \right\rfloor \eta^2\left[1-h(Q_{Xb}) -h(Q_{Zb})\right]}{n(n-1)} \label{asymp-rate-backa}
\end{align}
respectively, while the asymptotic conference key rates of the fully-ACKA and bifully-ACKA protocol read:
\begin{align}
r^{\infty}_f &= \lim_{L_{f\rm tot} \to \infty} r_f=\frac{\eta^n \left[1-h(Q_X) -h(Q_Z)\right]}{1+\frac{n(n-1)\eta^{n-2}h(Q_Z)}{\left\lfloor \frac{n}{2} \right\rfloor \left[1-h(Q_{Xb}) -h(Q_{Zb})\right]}} \label{asymp-rate-f-acka} \\
r^{\infty}_{bf} &= \lim_{L_{bf\rm tot} \to \infty} r_{bf}=\frac{ \left\lfloor \frac{n}{2} \right\rfloor \eta^2\left[1-h(Q_{Xb}) -h(Q_{Zb})\right]}{n(n-1)^2}. \label{asymp-rate-bif-acka}
\end{align}
For completeness, we also report the asymptotic conference key rate of a standard CKA protocol (namely, the multipartite BB84 protocol introduced in \cite{Grasselli_2018}), which distils a secret conference key for the $n$ parties in the network by distributing single photons entangled in GHZ states:
\begin{equation}
r^{\infty}_{\rm cka} = \eta^n \left[1-h(Q_X) -h(Q_Z)\right] \label{asymp-rate-cka}.
\end{equation}
Interestingly, we note that the above rate is identical to the asymptotic rate of the ACKA protocol \eqref{asymp-rate-acka}, even though the latter protocol is more involved as it guarantees anonymity for the participants.
Even in the case of standard CKA, we can devise an alternative protocol which only uses Bell pairs to establish the conference key. Note that such a protocol would require at least two network uses for every shared conference key bit, regardless of the number of parties. For instance, in the case of four parties --Alice and three Bobs-- the first network use distributes Bell states to Alice-Bob$_1$ and Bob$_2$-Bob$_3$, while the second network use distributes a Bell pair to Bob$_1$-Bob$_2$. By employing a one-time pad the $n$ parties can establish a shared conference key from their pairwise secret keys. If we then consider that the Bell pairs distributed by the source can be noisy or lost, the asymptotic key rate of a CKA protocol exclusively based on Bell pairs is independent of $n$ and reads:
\begin{equation}
r^{\infty}_{b\rm cka} = \frac{1}{2}\eta^2 \left[1-h(Q_{Xb}) -h(Q_{Zb})\right] \label{asymp-rate-bcka}.
\end{equation}
\begin{figure}[htb]
\centering
\includegraphics[width=0.7\linewidth,keepaspectratio]{./asymptotic_rates.pdf}
\caption{Ratios between the asymptotic ($L_{\rm tot}\to\infty$) conference key rates of the fully-ACKA (squares), ACKA (triangles) and CKA (circles) protocols with GHZ states and the rates of the corresponding protocols with Bell pairs, as a function of the number of parties in the network ($n$). The ratios of ACKA and fully-ACKA are well into the green region (i.e., greater than one), indicating that the use of GHZ states is advantageous compared to only using Bell pairs, when anonymity requirements are added to a standard CKA scheme. The error rates of the GHZ ($Q_Z,Q_X$) and Bell states ($Q_{Zb},Q_{Xb}$) are fixed to $2\%$, the distance party-server to $d=5$~km and $d=8$~km. The blue lines are given by Eq.~\eqref{scaling} with $d=8$~km.}
\label{fig:asymptotic-rates}
\end{figure}
In Fig.~\ref{fig:asymptotic-rates} we plot the ratios $r^{\infty}/r^{\infty}_b$, $r^{\infty}_f/r^{\infty}_{bf}$ and $r^{\infty}_{\rm cka}/r^{\infty}_{b\rm cka}$ as a function of the number of parties $n$, for a distance party-server of $d=5$~km and $d=8$~km. We fixed the error rates of the GHZ state and Bell state to the same value ($2\%$), rather than modelling the state preparation with CNOT gates, to highlight implementation-independent behaviors. The ratios for the task of ACKA and fully-ACKA are well above 1 and can comfortably exceed one order of magnitude, indicating the advantage of using GHZ states over Bell pairs to anonymously establish conference keys. Conversely, the use of GHZ states barely brings any benefit for standard CKA, at least in our network model where the server can simultaneously distribute several Bell pairs\footnote{This conclusion is not necessarily true when considering different network topologies \cite{Epping}.}.
\section*{Discussion}
We introduced a security definition that reflects all the desired properties of an anonymous conference key agreement protocol and encompasses different levels of anonymity. Even though our security definition is inspired by the composable security paradigm, it remains an open point whether the three conditions given in Definition~\ref{def:security-informal} imply composability for an ACKA (fully-ACKA) protocol.
We designed efficient and noise-robust protocols exploiting the multipartite entanglement of GHZ states, proved their security according to our security definition, and benchmarked their performance with counterpart protocols exclusively relying on the bipartite entanglement of Bell pairs.
Our security proofs rely on the assumption that the $n$ parties either hold a short-lived quantum memory or have no quantum memory at all (bounded storage model \cite{bounded_storage}). The eavesdropper, instead, holds a perfect quantum memory and can perform coherent attacks as in standard QKD. While the bounded storage assumption is crucial for the security of ACKA and fully-ACKA, it is irrelevant for the bACKA and bifully-ACKA protocols, which would still remain secure even if this assumption is dropped. Potentially, there might exist protocols based on multipartite entanglement that are secure without the bounded storage assumption for the $n$ parties, and at the same time retain the valuable properties of efficiency, noise-robustness (untrusted source) and anonymity featured by our ACKA and fully-ACKA protocols. However, we think that there could be a fundamental reason forbidding the existence of such protocols, which is yet to be explored.
From the plots of Fig.~\ref{fig:finite-key}, we observe that the protocols based on GHZ states (ACKA and fully-ACKA) outperform the protocols exclusively based on Bell pairs (bACKA and bifully-ACKA) for an experimentally feasible \cite{CKAexperiment} number of network uses, starting from values as low as $L_{\mathrm{tot}}=10^5$. However, increasing the distance between the parties and the source of entanglement is more detrimental for the protocols based on GHZ states (bottom plots), due to the higher probability of losing at least a photon in a GHZ state compared to a Bell state. This effect can be partially mitigated if the preparation quality of the entangled states is improved (dotted lines in Fig.~\ref{fig:finite-key}). Indeed, reducing the gate failure probability from $2\%$ to $1\%$ significantly impacts the rates of the protocols based on GHZ states, while leaving the rates of the Bell-state protocols almost unchanged --hence in Fig.~\ref{fig:finite-key} we only reported the $f_G=2\%$ case for the protocols based on Bell pairs.
Moreover, we observe that the protocols based on GHZ states require a higher number of network uses to yield a non-zero key rate, compared to the protocols based on Bell states. This is partially explained by the fact that we did not include finite-key effects in the rate at which the bipartite private channels distribute secret bits, while we performed a full finite-key analysis for the conference key rate with GHZ states. Since the bACKA and bifully-ACKA protocols rely on the bipartite private channels much more prominently than ACKA and fully-ACKA, the former protocols are advantaged compared to the latter for low numbers of network uses. Even if we performed a full finite-key analysis for the bACKA and bifully-ACKA rates, they would still outperform the rates of ACKA and fully-ACKA in the low-$L_{\mathrm{tot}}$ regime (see Supplementary Materials for a detailed discussion).
Finite-key effects aside, Fig.~\ref{fig:asymptotic-rates} clearly displays the benefit of employing multipartite entanglement, in the form of GHZ states, over Bell pairs, for the cryptographic tasks of ACKA and fully-ACKA. Interestingly, the superiority of GHZ-based protocols does not increase monotonically with $n$ and instead displays an optimal value of $n$ for which GHZ states are most beneficial. This is due to the interplay between two effects. On the one hand, establishing one conference key bit while maintaining \textit{anonymity} requires only 1 GHZ state in both ACKA and fully-ACKA, while it requires $n(n-1)$ Bell pairs in the case of bACKA and $n(n-1)^2$ Bell pairs in bifully-ACKA (due to the iteration of Parity protocols). This is only partially mitigated by the parallel distribution of Bell pairs from the source in each network use, which compensates by a factor $\lfloor n/2\rfloor^{-1}$. This effect dominates at low $n$ and causes the ratios of ACKA and fully-ACKA to increase with $n$. On the other hand, when the number of parties --and hence the number of simultaneously transmitted photons in a GHZ state-- increases, the rate of the GHZ-based protocols exponentially decreases due to photon loss with a factor $\eta^n$, while the rates of bACKA and bifully-ACKA present a constant factor $\eta^2$. Overall, the ratios exponentially decrease at high $n$.
The interplay between a polynomial increase due to the efficiency of GHZ states and an exponential suppression due to photon loss becomes clear when computing the ratios, having set the error rates to zero and ignoring the floor functions:
\begin{align}
\frac{r^{\infty}_{\rm cka}}{r^{\infty}_{b\rm cka}} &\sim 2 \eta^{n-2} \nonumber\\
\frac{r^{\infty}}{r^{\infty}_b} &\sim 2(n-1) \eta^{n-2} \nonumber \\
\frac{r^{\infty}_f}{r^{\infty}_{bf}} &\sim 2(n-1)^2 \eta^{n-2} \label{scaling}.
\end{align}
The above functions are plotted as solid lines in Fig.~\ref{fig:asymptotic-rates} for $d=8$~km and reproduce the scaling of the plot points well. From \eqref{scaling} we conclude that, starting from a standard CKA scenario, if we require the participants to be anonymous with respect to the other parties and to Eve (ACKA scenario), the conference key rate of a GHZ-based protocol gains a factor of $n-1$ over the rate of a protocol based on Bell pairs. If we additionally require anonymity among the participants (fully-ACKA scenario), the key rate of a GHZ-based protocol gains a factor of \mbox{$(n-1)^2$} compared to just using Bell pairs. This holds despite allowing the source to simultaneously distribute multiple Bell pairs in one network use. Overall, this suggests that adding anonymity requirements significantly increases the advantage of multipartite entanglement over bipartite entanglement.
Furthermore, we point out that the undermining effect of photon loss on the advantage given by GHZ states could be avoided by resorting to a different class of multipartite entanglement, namely W states \cite{Wstate}. Indeed, it has been shown that CKA can also be achieved when the parties share a W state post-selected after single-photon interference \cite{WstateProtocol}. This means that only one out of $n$ photons needs to be successfully transmitted, yielding a conference key rate that scales with $\eta$ (instead of $\eta^n$ when using GHZ states).
The performance advantage provided by GHZ states in the fully-ACKA scenario, however, comes at the expense of a slightly weaker anonymity claim with respect to honest-but-curious receivers (the fully-ACKA protocol is anonymous according to Definition~\ref{def:sweak-anonym} while the bifully-ACKA protocol satisfies Definition~\ref{def:security-informal}). This is the result of a trade-off with the robustness to noise and efficiency featured by the fully-ACKA protocol. Indeed, the fact that our protocol efficiently verifies the source state only in a small fraction of rounds and is robust against noisy state preparations, allows it to succeed even when asymmetries affect the multipartite states distributed to the parties. On one hand, this makes our protocol very efficient, noise-robust and practical, as opposed to previous anonymous protocols based on multipartite entanglement \cite{Wehner2005,lipinska_anonymous_2018,acka_old,ACKA,Brassard2007,unnikrishnan_anonymity_2019,yang_examining_2020}. On the other hand, it prevents the protocol from satisfying the strong anonymity condition when asymmetric multipartite states are distributed by the source.
In conclusion, our work demonstrates that the multipartite quantum correlations offered by GHZ states can increase the rate at which conference keys are anonymously generated within a quantum network, compared to solely relying on bipartite entanglement. The gain in the rate increases as anonymity requirements are added to the protocol, it can comfortably exceed one order of magnitude, and scales with the square of the number of parties in the network ($\sim n^2$) in the case of a fully-ACKA protocol. This is a striking result when compared to previously-known scaling improvements due to multipartite entanglement \cite{Epping,CKAexperiment}, which expected at most a linear gain in the rate scaling ($\sim n$). Moreover, previous results apply in the case of particularly favourable network structures (e.g. networks with bottlenecks), whereas in this work we consider a network which is symmetric and does not privilege any party. Additionally, we obtain such a scaling advantage despite the fact that the simultaneous distribution of multiple Bell pairs and of a single GHZ state contribute equally to the count of network uses, differently from previous works.
We believe that our results provide an important contribution towards claiming the superiority of multipartite entanglement over bipartite entanglement for cryptographic tasks involving several parties.
\section*{Methods}
\paragraph{Notation}
Here we describe the formalism and notation used in the Methods section and the Supplementary Materials.
\begin{itemize}
\item Strings of numbers and bitstrings are denoted with the vector sign $\vec{\phantom{a}}$, while symbols that are in boldface denote the tensor product of multiple subsystems, e.g. $\ketbra{\boldsymbol{\emptyset}}{\boldsymbol{\emptyset}}_{K_1 K_2 \dots K_n}=\bigotimes_{t=1}^n\ketbra{{\emptyset}}{{\emptyset}}_{K_t}$.
\item If $\Delta$ indicates an event, then $\Delta^c$ indicates the complementary event and $\Pr[\Delta]$ denotes the probability that event $\Delta$ occurs.
\item We use the running indices $i$ and $\vec{j}$ to indicate the sender and the set of receivers, respectively, for different protocol instances. Both indices run in the set of all parties: $\{i,\vec{j}\}\subset\{1,\dots,n\}$. We refer to the sender and receivers ($\{i,\vec{j}\}$) as the \emph{participants} of the protocol, while the remaining parties ($\{1,\dots,n\} \setminus \{i,\vec{j}\}$) are called \emph{non-participants}. In the case of multiple candidate senders, we indicate them with $\vec{i}$. Note that the size of the vectors $\vec{i}$ and $\vec{j}$ is not fixed.
\item With $\mathcal{D}\subset \{1,\ldots,n\}$ we indicate the set of dishonest parties that may collaborate with the eavesdropper Eve.
\item We denote by Identity Designation (ID) the sub-protocol of any ACKA and fully-ACKA protocol that either unambiguously assigns the identities of sender and receivers to the parties in the network or aborts. In the case of ACKA, every receiver is also informed about the identity of the other participants when ID does not abort.
\item For the ID protocol, let $p(\vec{i},\vec{j})$ be the probability that the parties in the set $\vec{i}$ apply to become the sender and select their receivers in $\vec{j}$ (for instance, $\vec{j}=\{\vec{j}_{i_1},\vec{j}_{i_2},\dots,\vec{j}_{i_{|\vec{i}|}}\}$, where $\vec{j}_{i_k}$ are the receivers selected by party $i_k$ if they become the sender). If there is only one party applying to become the sender ($|\vec{i}|=1$), then $\vec{j}$ is the set of receivers selected by the candidate sender $i$. The probability of this instance is indicated by $p(i,\vec{j})$.
\item We define the following events.
\begin{itemize}
\item $\Gamma$: The ID sub-protocol aborts from the point of view of every party in the network.
\item $\Phi$: The ID sub-protocol does not abort from the point of view of any party in the network and correctly designates the identity of the participants. That is, if party $i$ is the only one applying to become the sender with intended receivers $\vec{j}$, then the protocol designates party $i$ as the sender and $\vec{j}$ as the receivers. In the case of ACKA, the receivers are correctly informed about the identities of the other participants.
\item $\Omega_{\mathcal{P}}$: The ACKA (fully-ACKA) protocol ends without aborting from the point of view of every participant.
\item $\Gamma_{\mathcal{P}}$: The ACKA (fully-ACKA) protocol aborts from the point of view of every participant.
\end{itemize}
\item Every party $t \in \{1,\dots,n\}$ holds three personal classical registers: $P_t$, $K_t$ and $C_t$.
\begin{itemize}
\item The register $P_t$ stores information about the identity of party $t$ and eventual information on the identity of the other participants, as assigned by the ID sub-protocol. More specifically, $P_t=r$ if $t$ is a receiver of a fully-ACKA protocol, $P_t=r,i,\vec{j}$ if $t$ is a receiver of an ACKA protocol, $P_t=s,\vec{j}$ if $t$ is the sender with intended receivers in $\vec{j}$, and $P_t=\perp$ if $t$ is a non-participant. We emphasize that $r$, $s$ and $\perp$ are just symbols used to discriminate the identity of the parties. Finally, $P_t=\emptyset$ if the protocol aborts during ID.
\item The register $K_{t}$ stores either the conference key if $t$ is a participant, or any information that the party might use to compute a guess of the conference key once the protocol is over if $t$ is not a participant (a dishonest or honest-but-curious non-participant might want to learn the conference key). If the protocol aborts for party $t$, we set $K_t=\emptyset$.
\item The register $C_t$ stores all the classical side information held by party $t$ at any point in the protocol, which includes their private inputs and outputs to classical protocols and the public outputs.
\end{itemize}
\item We indicate with $K$ the set of registers $K_t$ of every party, i.e. $K=K_1 K_2 \dots K_n$, and similarly for $C$ and $P$. When we insert subscripts, it means that we restrict to the registers of the parties in the subscript. For instance, if $\mathcal{G}\subset\{1,\dots,n\}$ is a subset of parties, $K_{\mathcal{G}}$ is the set of conference key registers of the parties in $\mathcal{G}$. {Similarly, $(PKC)_{\mathcal{G}}$ indicates the content of the registers $P_t$, $K_t$ and $C_t$ for every party $t\in\mathcal{G}$.} Finally, with the superscript $^c$ in $K_{\mathcal{G}}^c$, we denote the registers of the complement of $\mathcal{G}$.
\item $E$ is the quantum register of Eve.
\item If the state of some registers depends on the value of a random variable $X$, we can express it as \mbox{$\rho=\sum_x \Pr[X=x] \rho_{|x}$}, where $\rho_{|x}$ is the state of the registers when $X=x$.\\
Let $\Delta$ be an event for the variable $X$, i.e. $\Pr[\Delta]=\sum_{x\in\Delta}\Pr[X=x]$. With $\rho_{|\Delta}$ we indicate the \emph{normalized} state of the registers conditioned on the event $\Delta$, $\rho_{|\Delta}:= (1/\Pr[\Delta])\sum_{x\in\Delta}\Pr[X=x] \rho_{|x}$. With $\rho_{\wedge\Delta}$ we indicate the \emph{sub-normalized} state conditioned on $\Delta$ whose trace corresponds to the probability of event $\Delta$ occurring: $\rho_{\wedge\Delta}:= \sum_{x\in\Delta}\Pr[X=x] \rho_{|x}$.
\item With $\rho_{PKCE|i,\vec{j}}$ ($\rho_{PKCE|\vec{i},\vec{j}}$) we indicate the state of registers $P$, $K$, $C$ and $E$ conditioned on the event where party(ies) $i$ ($\vec{i}$) applied to be the sender with the corresponding intended receivers in $\vec{j}$.
\item If Alice is the sender and Bob$_1$, Bob$_2$, \dots, Bob$_m$ are the $m$ receivers, we replace the indices $i$ and $\vec{j}$ pointing to their registers with $A$ and $\vec{B}$, respectively. Thus, for instance, $K_A$ is Alice's key register containing her conference key $k_A$ and $K_{B_l}$ is Bob$_l$'s key register containing his conference key $\vec{k}_{B_l}$ (for $l \in \{1,\dots,m\}$).
\item Let $\abs{\vec{x}}$ be the number of entries of the string $\vec{x}$. Let $\omega_r(\vec{x})$ be the relative Hamming weight of the bitstring $\vec{x}$, i.e. $\omega_r(\vec{x}):=\abs{\{k:x_k=1\}}/\abs{\vec{x}}$.
\item The trace distance between two states $\rho$ and $\sigma$ is given by $\norm{\rho -\sigma}=\frac{1}{2}\Tr[\sqrt{(\rho -
\sigma)^2}]$ and is proportional to the trace norm of the operator $\rho-\sigma$.
\item $\rho^{f}_{PKCE}$ is the output state, or final state, of an ACKA (fully-ACKA) protocol. We also simply indicate it as $\rho^f$.
\end{itemize}
\paragraph{Security definitions}
As discussed in the Results section, we identify three properties that an ideal ACKA (fully-ACKA) protocol is expected to satisfy, namely: integrity, CKA-security and anonymity. Here we introduce a formal security definition which quantifies, for every property, how close the output state of the real protocol is from a state with the required property. Note that the output state $\rho^f$ of a generic ACKA (fully-ACKA) protocol can always be decomposed as the following:
\begin{align}
\rho^f&=\sum_{i,\vec{j}} p(i,\vec{j}) \rho^f_{PKCE|i,\vec{j}} + \sum_{\vec{i},\vec{j}} p(\vec{i},\vec{j}) \rho^f_{PKCE|\vec{i},\vec{j}} \label{rhof}.
\end{align}
The output state of an integrous protocol is of the form:
\begin{align}\label{idealstateIN}
\sigma^{\rm IN} &=\sum_{i,\vec{j}} p(i,\vec{j}) \left(\Pr[\Phi|i,\vec{j}]\,\xi^{(i,\vec{j})}_P \otimes \rho^{f}_{KCE|i,\vec{j},\Phi} + \Pr[\Phi^c|i,\vec{j}]\,\proj{\boldsymbol{\emptyset}}_P \otimes \rho^{f}_{KCE|i,\vec{j},\Phi^c}\right) \nonumber\\
&+ \sum_{\vec{i},\vec{j}} p(\vec{i},\vec{j}) \proj{\boldsymbol{\emptyset}}_P \otimes \rho^{f}_{KCE|\vec{i},\vec{j}},
\end{align}
where $\xi^{(i,\vec{j})}_P$ is the ideal state of registers $P$, provided that party $i$ applied to become sender with receivers in $\vec{j}$ and the identities were correctly assigned:
\begin{align}
\xi^{(i,\vec{j})}_P &:= \ketbra{s,\vec{j}}{s,\vec{j}}_{P_i} \otimes \ketbra{r,i,\vec{j}}{r,i,\vec{j}}_{P_{\vec{j}}} \otimes \ketbra{\pmb{\bot}}{\pmb{\bot}}_{P^c_{i,\vec{j}}} \quad\quad\mbox{(ACKA)} \nonumber\\
\xi^{(i,\vec{j})}_P &:= \ketbra{s,\vec{j}}{s,\vec{j}}_{P_i} \otimes \ketbra{r}{r}_{P_{\vec{j}}} \otimes \ketbra{\pmb{\bot}}{\pmb{\bot}}_{P^c_{i,\vec{j}}} \quad\quad\mbox{(fully-ACKA)}. \label{xi}
\end{align}
The distinction between the two states in \eqref{xi} is always clear from the context of the protocol being addressed (either an ACKA or a fully-ACKA protocol).
We remark that the integrous state \eqref{idealstateIN} is only constrained by the states of its $P$ registers. As such, it is obtained from the output state of the real protocol \eqref{rhof} by replacing the $P$ register of every party with the abort symbol $\emptyset$, whenever event $\Phi^c$ occurs or when there are multiple candidate senders or no sender ($|\vec{i}|\neq 1$).
The output state of a CKA-secure protocol, conditioned on having honest participants ($\{i,\vec{j}\}\cap\mathcal{D}=\emptyset$) and on $\Phi$, is of the form:
\begin{align}
\sigma_{KC_{i,\vec{j}}^cE|i,\vec{j},\Phi}^{{\rm CKA}}&= \Pr[\Omega_{\mathcal{P}}|i,\vec{j},\Phi]\tau_{K_{i,\vec{j}}}\otimes \rho^{f}_{(KC)_{i,\vec{j}}^c E|i,\vec{j},\Phi,\Omega_{\mathcal{P}}} \nonumber\\
&+\Pr[\Omega^c_{\mathcal{P}}|i,\vec{j},\Phi]\proj{\boldsymbol{\emptyset}}_{{K}_{i,\vec{j}}}\otimes \rho^{f}_{(KC)_{i,\vec{j}}^c E|i,\vec{j},\Phi,\Omega^c_{\mathcal{P}}} \label{idealstateCKA},
\end{align}
where the key registers $K_{i,\vec{j}}$ of the participants, for a key of $\ell$ bits, are perfectly correlated and random:
\begin{equation}
\tau_{{K}_{i,\vec{j}}}:=\frac{1}{|\mathcal{K}|}\sum_{\vec{k}\in\mathcal{K}}\ketbra{\vec{k}}{\vec{k}}_{K_i} \otimes \ketbra{\vec{\pmb{k}}}{\vec{\pmb{k}}}_{K_{\vec{j}}}\quad,\quad\mathcal{K}=\{0,1\}^\ell. \label{tau}
\end{equation}
Note that, similarly to \eqref{idealstateIN}, the output state of a CKA-secure protocol \eqref{idealstateCKA} is obtained by replacing the $K_{i,\vec{j}}$ registers in the state of the real protocol with the ideal outputs.
Finally, an ideal ACKA (fully-ACKA) protocol must be anonymous, i.e., the identity of each participant must be kept secret from the non-participants and Eve --and from the other receivers in the case of fully-ACKA. In this case we cannot simply replace the real output registers by their ideal counterparts, as in \eqref{idealstateIN} and \eqref{idealstateCKA}, since anonymity is a property of the global quantum state accounting for different instances of sender and receivers. For example, if a protocol is anonymous with respect to a non-participant $t$, its output state satisfies: $\rho^f_{P_t K_t C_t|i,\vec{j}}=\rho^f_{P_t K_t C_t|i',\vec{j}'}$ for $i\neq i'$ and $\vec{j} \neq \vec{j}'$, i.e. it is independent of the choice of sender and receivers. We remark that dishonest participants may broadcast their identity, or the identity of all the participants in the case of ACKA. Hence, in these scenarios we cannot require the output state to be independent of the identities that could be revealed.
We now introduce the formal definitions of anonymity for an ACKA and a fully-ACKA protocol. We denote the output state of an anonymous ACKA (fully-ACKA) protocol by $\sigma^{\mathcal{D}}$. This emphasizes the fact that the anonymity requirements on $\sigma^{\mathcal{D}}$ crucially depend on the set of dishonest parties $\mathcal{D}$. For instance, no anonymity requirement is imposed on the output state of an ACKA protocol for the instances in which some participant is dishonest.
\begin{Def}[ACKA anonymity]\label{def:anonym-acka}
Let $\mathcal{D}$ be the set of dishonest parties taking part in an ACKA protocol, with output state $\sigma^{\mathcal{D}}$ of the form \eqref{rhof}. Then the ACKA protocol is anonymous if for any subset of parties $\mathcal{G}\subseteq \{1, \ldots, n\}$ it holds that:
\begin{align}
\sigma^{\mathcal{D}}_{P_{\mathcal{G}} K_{\mathcal{G}} C_{\mathcal{G}}E|i,\vec{j}}&=\sigma^{\mathcal{D}}_{P_{\mathcal{G}} K_{\mathcal{G}} C_{\mathcal{G}}E|i',\vec{j'}} \quad\forall\,i,i',\vec{j},\vec{j}':\,i,i',\vec{j},\vec{j}'\notin \mathcal{G} \cup {\mathcal{D}} \label{state:anony-dishonest} \\
\sigma^{\mathcal{D}}_{P_{\mathcal{G}} K_{\mathcal{G}} C_{\mathcal{G}}E|\vec{i},\vec{j}}&=\sigma^{\mathcal{D}}_{P_{\mathcal{G}} K_{\mathcal{G}} C_{\mathcal{G}}E|\vec{i'},\vec{j'}} \quad\forall\,\vec{i},\vec{i'},\vec{j},\vec{j}':\,\vec{i},\vec{i'},\vec{j},\vec{j}'\notin \mathcal{G}\cup {\mathcal{D}} \label{state:anony-dishonest-multiple-senders},
\end{align}
where $\sigma^{\mathcal{D}}_{P_{\mathcal{G}}K_{\mathcal{G}}C_{\mathcal{G}}E|i,\vec{j}}=\Tr_{P_{\mathcal{G}}^c K_{\mathcal{G}}^cC_{\mathcal{G}}^c}[\sigma^{\mathcal{D}}_{PKCE|i,\vec{j}}]$.
\end{Def}
The anonymity conditions \eqref{state:anony-dishonest} and \eqref{state:anony-dishonest-multiple-senders} establish that the final state of any subset of non-participants and Eve is independent of the identity of the remaining parties. In other words, the reduced output states $\sigma^{\mathcal{D}}_{(PKC)^c_{i,\vec{j}}E|i,\vec{j}}$ and $\sigma^{\mathcal{D}}_{(PKC)^c_{\vec{i},\vec{j}}E|\vec{i},\vec{j}}$ do not contain any information about the identities of the participants. Note that if a participant would be contained in ${\mathcal{G}}$, the register $P_{\mathcal{G}}$ would also carry information about the identities of all the other participants (recall that an ACKA protocol reveals the participants' identities to each participant) and therefore there would be no condition to be satisfied. Moreover, note that \eqref{state:anony-dishonest} and \eqref{state:anony-dishonest-multiple-senders} do not impose any condition if the sender(s) or receivers are dishonest, since nothing prevents them from broadcasting the identities of all the participants.
\begin{Def}[Fully-ACKA anonymity]\label{def:anonym-f-acka}
Let $\mathcal{D}$ be the set of dishonest parties taking part in a fully-ACKA protocol, with output state $\sigma^{\mathcal{D}}$ of the form \eqref{rhof}. Then the fully-ACKA protocol is anonymous if for any subset of parties $\mathcal{G}\subseteq \{1, \ldots, n\}$ it holds that:
\begin{align}
\sigma^{\mathcal{D}}_{P_{\mathcal{G}} K_{\mathcal{G}} C_{\mathcal{G} E}|i,\vec{j}}&=\sigma^{\mathcal{D}}_{P_{\mathcal{G}} K_{\mathcal{G}} C_{\mathcal{G} E}|i',\vec{j'}} \quad\forall\,i,i',\vec{j},\vec{j}':\,i,i'\notin \mathcal{G}\cup \mathcal{D}\,,\,\vec{j}\cap {\mathcal{G}} =\vec{j'}\cap {\mathcal{G}}\,,\,\vec{j}\cap \mathcal{D}=\vec{j'}\cap \mathcal{D} \label{state:f-anony-dishonest}\\
\sigma^{\mathcal{D}}_{P_{\mathcal{G}} K_{\mathcal{G}} C_{\mathcal{G}}E|\vec{i},\vec{j}}&=\sigma^{\mathcal{D}}_{P_{\mathcal{G}} K_{\mathcal{G}} C_{\mathcal{G}}E|\vec{i'},\vec{j'}} \quad\forall\,\vec{i},\vec{i}',\vec{j},\vec{j}':\,\vec{i},\vec{i}'\notin \mathcal{G}\cup {\mathcal{D}}\,,\,\vec{j}\cap {\mathcal{G}} =\vec{j'}\cap {\mathcal{G}}\,,\,\vec{j}\cap \mathcal{D}=\vec{j'}\cap \mathcal{D}. \label{state:f-anony-dishonest-multiple-senders}
\end{align}
\end{Def}
The anonymity conditions \eqref{state:f-anony-dishonest} and \eqref{state:f-anony-dishonest-multiple-senders} extend the requirements of \eqref{state:anony-dishonest} and \eqref{state:anony-dishonest-multiple-senders} due to the fact that in a fully-ACKA protocol the receiver is unaware of the identity of the other participants. Indeed, conditions \eqref{state:f-anony-dishonest} and \eqref{state:f-anony-dishonest-multiple-senders} establish that in all the instances of the protocol in which the parties in subsets ${\mathcal{G}}$ and ${\mathcal{D}}$ have a fixed role (except for the role of sender), their reduced state is independent of the identities of the other parties.
Definition~\ref{def:suff-cond-security}, which is a formal re-statement of Definition~\ref{def:security-informal}, defines the security of an ACKA (fully-ACKA) protocol through the trace distances of the output state of the protocol from an integrous state \eqref{idealstateIN}, a CKA-secure state \eqref{idealstateCKA}, and an anonymous state satisfying Definition~\ref{def:anonym-acka} (Definition~\ref{def:anonym-f-acka}), respectively.
\begin{Def}[Security (rigorous)] \label{def:suff-cond-security}
An ACKA (fully-ACKA) protocol with dishonest parties in $\mathcal{D}$ is $\varepsilon$-secure, with $\varepsilon=\varepsilon_{\rm IN}+\varepsilon_{\rm CKA}+\varepsilon_{\rm AN}$, if it satisfies the following three conditions.\\
$\varepsilon_{\rm IN}$-integrity:
\begin{align}
\max_{i,\vec{j}} \Pr[\Gamma^c \cap \Phi^c|i,\vec{j}]\leq \varepsilon_{\rm IN} \quad \wedge\quad
\max_{\vec{i},\vec{j}} \Pr[\Gamma^c|\vec{i},\vec{j}] \leq \varepsilon_{\rm IN},
\label{integrity}
\end{align}
$\varepsilon_{\rm CKA}$-CKA-security:
\begin{align}\label{CKA-sec}
\max_{\{i,\vec{j}\} \cap\mathcal{D} =\emptyset} &\Pr[\Omega_{\mathcal{P}}|{i,\vec{j}},\Phi]\,\norm{\rho^f_{KC_{i,\vec{j}}^cE|i,\vec{j},\Phi,\Omega_{\mathcal{P}}}- \tau_{{K}_{i,\vec{j}}}\otimes \rho^f_{(KC)_{i,\vec{j}}^c E|i,\vec{j},\Phi,\Omega_{\mathcal{P}}}} \nonumber\\
&+ \Pr[\Omega^c_{\mathcal{P}} \cap \Gamma^c_{\mathcal{P}}|{i,\vec{j}},\Phi]\leq \varepsilon_{\rm CKA},
\end{align}
$\varepsilon_{\rm AN}$-anonymity:
\begin{align}
&\max_{i,\vec{j}} \norm{\rho^{f}_{(PKC)^c_{i,\vec{j}} E|i,\vec{j}}-\sigma^{\mathcal{D}}_{(PKC)^c_{i,\vec{j}} E|i,\vec{j}}} \leq \varepsilon_{\rm AN} \,\wedge\, \max_{\vec{i},\vec{j}} \norm{\rho^{f}_{(PKC)^c_{\vec{i},\vec{j}}E|\vec{i},\vec{j}}-\sigma^{\mathcal{D}}_{(PKC)^c_{\vec{i},\vec{j}} E|\vec{i},\vec{j}}}\,\leq \varepsilon_{\rm AN} \nonumber\\
&\hspace{13cm}\mbox{(ACKA)}\label{anonymity-acka} \\
&\max_{i,\vec{j}} \norm{\rho^{f}_{(PKC)_i^c E|i,\vec{j}}-\sigma^{\mathcal{D}}_{(PKC)_i^c E|i,\vec{j}}} \leq \varepsilon_{\rm AN} \quad\wedge\quad \max_{\vec{i},\vec{j}} \norm{\rho^{f}_{(PKC)_{\vec{i}}^c E|\vec{i},\vec{j}}-\sigma^{\mathcal{D}}_{(PKC)_{\vec{i}}^cE|\vec{i},\vec{j}}}\,\leq \varepsilon_{\rm AN} \nonumber\\
&\hspace{12cm}\mbox{(fully-ACKA)}\label{anonymity-f-acka}
\end{align}
where $\rho^f$ is the output state of the ACKA (fully-ACKA) protocol, $\sigma^{\mathcal{D}}$ is the output state of any ACKA (fully-ACKA) protocol which satisfies Definition~\ref{def:anonym-acka} (Definition~\ref{def:anonym-f-acka}), and $\tau_{K_{i,\vec{j}}}$ is given in \eqref{tau}.
\end{Def}
We remark that to simplify the integrity condition, we replaced the trace distance from the integrous state \eqref{idealstateIN} with a sufficient condition on the probabilities of unwanted events.
The CKA-security condition \eqref{CKA-sec} establishes that the final state of the protocol, conditioned on honest parties $i$ and $\vec{j}$ correctly designated as sender and receivers, is close to a state in which an ideal key \eqref{tau} is distributed to the participants or where the protocol aborts for every participant. Indeed, in the anonymous conference key agreement scenario, it could happen that the protocol aborts for some participants but not for others (event $\Omega^c_{\mathcal{P}}\cap \Gamma^c_{\mathcal{P}}$). This would spoil the CKA-security of the protocol, since not all the participants would end up with the same conference key\footnote{Recall that if the protocol aborts for party $t$, then $K_t=\emptyset$.}. We remark that in the standard QKD and CKA scenarios there is no need to account for such instances, since the identities of the participants are public and they can communicate over the authenticated classical channel, thus agreeing on when the protocol aborts.
Finally, the anonymity conditions \eqref{anonymity-acka} and \eqref{anonymity-f-acka} account for deviations of the real protocol from an anonymous protocol, as defined by Definitions~\ref{def:anonym-acka} and \ref{def:anonym-f-acka}, respectively. Nevertheless, since the property of anonymity is intertwined with integrity and CKA-security, any issue of the real protocol with regards to the latter may at the same time increase its deviation from a perfectly anonymous protocol.
We observe that the conditions \eqref{integrity}-\eqref{anonymity-f-acka} are independent of the distribution $\{p(i,\vec{j}), p(\vec{i},\vec{j})\}$, which describes the probability that certain parties apply to become senders with specified receivers. This is a desirable feature since the distribution may not be accessible to a party who wants to prove the protocol's security.\vspace{1em}
As discussed in Results, our fully-ACKA protocol (Protocol~\ref{prot:sf-ACKA}) does not satisfy the anonymity condition \eqref{anonymity-f-acka} of Definition~\ref{def:suff-cond-security}, but rather a weaker anonymity condition provided in Definition~\ref{def:sweak-anonym} and formally stated here.
\begin{Def}[Weak-anonymity for fully-ACKA (rigorous)] \label{def:weak-anonym}
Let $\mathcal{D}$ be the set of dishonest parties taking part in a fully-ACKA protocol, with output state $\rho^{f}$. The fully-ACKA protocol is $\varepsilon_{\rm w AN}$-weak-anonymous, with $\varepsilon_{\rm wAN}=\varepsilon_{\rm npAN} + \varepsilon_{\rm pAN}$, if the following two conditions are satisfied:
\begin{enumerate}
\item (Anonymity with respect to non-participants and Eve) The output state of the protocol satisfies the anonymity condition \eqref{anonymity-acka} for ACKA protocols:
\begin{align}
&\max_{i,\vec{j}} \norm{\rho^{f}_{(PKC)^c_{i,\vec{j}} E|i,\vec{j}}-\sigma^{\mathcal{D}}_{(PKC)^c_{i,\vec{j}} E|i,\vec{j}}} \leq \varepsilon_{\rm npAN} \quad \wedge \nonumber\\
&\max_{\vec{i},\vec{j}} \norm{\rho^{f}_{(PKC)^c_{\vec{i},\vec{j}} E|\vec{i},\vec{j}}-\sigma^{\mathcal{D}}_{(PKC)^c_{\vec{i},\vec{j}} E}}\,\leq \varepsilon_{\rm npAN},\label{anonymity-weak}
\end{align}
where $\sigma^{\mathcal{D}}$ satisfies Definition~\ref{def:anonym-acka}.
\item (Anonymity with respect to honest-but-curious receivers) When the protocol's specifications are invariant under permutations of parties, any subset of honest-but-curious receivers $\mathcal{R}\subseteq\vec{j}$ cannot guess the identity of other participants with a higher probability than the trivial guess, except for a small deviation $\varepsilon_{\rm pAN}$. In formulas, the probability of correctly guessing the set of participants is bounded as follows:
\begin{align}
p_{guess} &\leq \max_{i,\vec{j}\supseteq \mathcal{R}} p_{\mathcal{R}}(i,\vec{j}) + \varepsilon_{\rm pAN} \label{weak-pguess1}\\
p_{guess} &\leq \max_{\vec{i},\vec{j}\supseteq \mathcal{R}} p_{\mathcal{R}}(\vec{i},\vec{j}) + \varepsilon_{\rm pAN}, \label{weak-pguess2}
\end{align}
where $p_{\mathcal{R}}(i,\vec{j})$ ($p_{\mathcal{R}}(\vec{i},\vec{j})$) is defined as: $p_{\mathcal{R}}(i,\vec{j}):= p(i,\vec{j})/(\sum_{i,\vec{j}\supseteq\mathcal{R}} p(i,\vec{j}))$ ($p_{\mathcal{R}}(\vec{i},\vec{j}):= p(\vec{i},\vec{j})/(\sum_{\vec{i},\vec{j}\supseteq\mathcal{R}} p(\vec{i},\vec{j}))$).
\end{enumerate}
\end{Def}
\paragraph{Sub-protocols} Before presenting the ACKA and fully-ACKA protocols, we introduce the sub-protocols on which they built upon. Such protocols involve many different bitstrings, whose length in many cases is not defined to be an integer number, unless a ceiling or floor function is applied. In order not to increase the complexity of the notation, we omit the ceiling and floor functions. Note that, from the point of view of the plots, this omission is irrelevant since few bits of difference do not sensibly modify the key rates (consider that all plots start from $L_{\rm tot}=10^5)$.
To start with, we make use of the classical Parity, Veto and Collision Detection protocols from \cite{Broadbent2007}. The first two protocols compute the parity and the logical OR of their inputs, respectively, while Collision Detection detects the presence of multiple parties applying to become the sender. Importantly, in our version of the Parity protocol we do not require simultaneous broadcast, contrary to Ref.~\cite{Broadbent2007}.\vspace{1.2cm}
\begin{protocol}\label{prot:parity}
\caption{Parity \cite{Broadbent2007}}
\noindent Let $x_t \in \{0,1\}$ be the input of party $t$ and $y_t$ the output of the protocol for party $t$. Then $y_t=x_1 \oplus x_2 \oplus \dots \oplus x_n$ for every $t$.\\
Every party $t\in \{1,\ldots, n\}$ does the following.
\begin{enumerate}
\item Select uniformly at random an $n$-bit string $\vec{r}_t=r_t^1 r_t^2 \dots r_t^n$ such that $x_t=\oplus_{j=1}^n r^j_t$.
\item Send $r^j_t$ to party $j$ and keep $r^t_t$.
\item Compute $z_t=\oplus_{j=1}^n r^t_j$, i.e. the parity of the bits received (including $r^t_t$).
\item Broadcast $z_t$.
\item Compute $y_t=\oplus_{k=1}^n z_k$ to obtain the parity of the inputs $\{x_t\}_t$.
\end{enumerate}
\end{protocol}\vspace{1cm}
\begin{protocol}\label{prot:Veto}
\caption{Veto \cite{Broadbent2007}}
\noindent Let $x_t \in \{0,1\}$ be the input of party $t$ and $y_t$ the output of the protocol for party $t$. Then $y_t=x_1\lor x_2 \lor \dots \lor x_n$ for every $t\in \{1,\ldots, n\}$.
\begin{enumerate}
\item Initialize $y_t=0$ $\forall \,t$.
\item For every party $t$, repeat the following ${r_V}$ times:
\begin{enumerate}
\item Each party $j$ sets the value of $q_j$ according to the following\footnote{By $z \in_R \mathcal{S}$ we denote that $z$ is picked uniformly at random in the set $\mathcal{S}$.}
\begin{align}
\left\lbrace\begin{array}{ll}
q_j =0 &\mbox{if } x_j=0 \\
q_j \in_R \{0,1\} &\mbox{if } x_j=1
\end{array}\right.
\end{align}
\item The parties execute the Parity protocol (Protocol~\ref{prot:parity}) with inputs $q_1, q_2 ,\ldots, q_n$, such that party $t$ is the last to broadcast. If the outcome of the Parity protocol is 1 or any party refuses to broadcast, then set $y_t=1$ $\forall\, t \in \{1,\ldots, n\}$.
\end{enumerate}
\end{enumerate}
\end{protocol}\vspace{1cm}
\begin{protocol}\label{prot:Collision}
\caption{Collision Detection \cite{Broadbent2007}}
\noindent This protocol is used to detect the presence of multiple candidate senders, or no senders at all. Let $x_t \in \{0,1,2\}$ be the input of party $t$ and $y_t$ the output of the protocol for party $t$. Then the output of every party $t\in \{1,\ldots, n\}$ is interpreted as follows:
\begin{align}
\left\lbrace\begin{array}{ll}
y_t =0 &\mbox{no sender applies and the protocol aborts} \\
y_t =1 &\mbox{one sender applied and the protocol proceeds}\\
y_t =2 &\mbox{a collision is detected (multiple senders) and the protocol aborts}
\end{array}\right.
\end{align}
The protocol steps are given in the following.
\begin{enumerate}
\item Veto A:
\begin{enumerate}
\item Each party $j$ sets $a_j=\min \{x_j,1\}$.
\item All participants perform the Veto protocol (Protocol~\ref{prot:Veto}) with input $a_1,a_2, \ldots, a_n$.
\end{enumerate}
\item Veto B:
\begin{enumerate}
\item If the outcome of Veto A is 0, skip this step.
\item Otherwise, if the outcome of Veto A is 1, each party $j$ sets
\begin{align}
\left\lbrace\begin{array}{ll}
b_j =1 &\mbox{if } x_j=1 \wedge \mbox{detected collision in Veto A}, \mbox{or if } x_j=2 \\
b_j =0 &\mbox{otherwise}
\end{array}\right.
\end{align}
\item All participants perform the Veto protocol (Protocol~\ref{prot:Veto}) with input $b_1,b_2, \ldots, b_n$.
\end{enumerate}
\item Every party $t\in \{1,\ldots, n\}$ sets their output to:
\begin{align}
\left\lbrace\begin{array}{ll}
y_t =0 &\mbox{if the output of Veto A is 0} \\
y_t =1 &\mbox{if the output of Veto A is 1 } \wedge \mbox{ the output of Veto B is 0}\\
y_t =2 &\mbox{if the output of Veto A is 1 } \wedge \mbox{ the output of Veto B is 1}
\end{array}\right.
\end{align}
\end{enumerate}
\end{protocol}\vspace{1cm}
In the Collision Detection protocol (Protocol~\ref{prot:Collision}), the input $x_t=2$ can describe the action of a dishonest party that wants to force the protocol to detect a collision and output $y_t=2$.
\vspace{1em}
In the ACKA protocol, Alice must disclose her identity and the identities of the other Bobs to every Bob. This is achieved by transmitting a bitstring containing the positions of the sender and the chosen receivers in the network. In particular, let $\vec{d}_t$ be an $(n-1+\log_2 n)$-bit long string that Alice transmits to every other party $t$. If Alice is transmitting $d_t$ to a Bob, then the first bit of $d_t$ is 1, the following $\log_2 n$ bits contain the position of Alice with respect to some predefined ordering of the $n$ parties, and the remaining $n-2$ bits indicate the identities of the other parties (bit 1 for receiver and bit 0 for a non-participant), except for Alice and the Bob receiving $d_t$. If instead Alice is transmitting $d_t$ to a non-participant, then the first bit is 0 and the remaining bits are random.
In order to ensure that the transmission of $\vec{d}_t$ is error-free, Alice encodes the bitstring with a public encoding algorithm $(F,G)$ composed of an encoding function $F$ and a decoding function $G$, denoted Algebraic Manipulation Detection (AMD) code \cite{AMD,Broadbent2007}. An AMD code has the important property of detecting, with high probability, any tampering with the encrypted message, as stated in the following lemma.
\begin{Lmm}[AMD code \cite{AMD,Broadbent2007}] \label{lmm:AMD}
Let $\vec{x}$ be a bitstring. There exists an AMD code $(F,G)$, whose encoded string $F(\vec{x})$ has length:
\begin{align}
|F(\vec{x})|=|\vec{x}|+2\left(\log_2 |\vec{x}| + \log_2 \frac{1}{\varepsilon_{\mathrm{enc}}}\right),
\end{align}
such that $G(F(\vec{x}))=\vec{x}$ for every $\vec{x}$ and, for every bitstring $\vec{b}\neq \vec{0}$ chosen without prior knowledge of the encoded bitstring $F(\vec{x})$, it holds that
$\Pr[G(F(\vec{x})\oplus\vec{b})\neq \perp]\leq \varepsilon_{\mathrm{enc}}$.
\end{Lmm}
For the use in ACKA, the encoded string $F(\vec{d}_t)$ has length:
\begin{align}
|F(\vec{d}_t)|&=n-1+\log_2 n+2\left(\log_2 (n-1+{\log_2 n}) + \log_2 \frac{1}{\varepsilon_{\mathrm{enc}}}\right) \label{F(d)-length},
\end{align}
and it is then used by Alice as her input in a sequence of Parity protocols in order to anonymously transmit it to party $t$. This is the core of the identity designation sub-protocol used by the ACKA protocol, named ACKA-ID.\vspace{1cm}
\begin{protocol}\label{prot:ID}
\caption{Identity Designation for ACKA (\textbf{ACKA-ID})}
\noindent Before the protocol starts, the $n$ parties set $v_t=0\; \forall t$.
\begin{enumerate}[label=\arabic*., ref=\arabic*]
\item\label{ID:step1} The $n$ parties perform the Collision Detection protocol (Protocol~\ref{prot:Collision}), where party $t$ inputs 1 if they want to be the sender or 0 otherwise. If the Collision Detection outputs 0 or 2 then the ACKA protocol aborts for all the $n$ parties. Else, they proceed with the next steps.
\item\label{ID:step2} If the protocol does not abort in step~\ref{ID:step1}, then there is a single sender, whom we identify as Alice, except for a small probability.
\item\label{ID:step3} For every party $t \in \{1,\dots,n\}$, do the following.
\begin{enumerate}
\item The $n$ parties perform the Parity protocol for $|F(\vec{d}_t)|$ times with the following inputs. If $t \neq A$, Alice uses $F(\vec{d}_t)$, party $t$ uses a random bitstring $\vec{r}_t$ and the other parties input $\vec{0}$. If $t=A$, then Alice uses $F(\vec{0}) \oplus \vec{r}$, where $\vec{r}$ is a random bitstring, and the other parties input $\vec{0}$. Let $\vec{o}$ be the output of the Parity protocols.
\item Party $t$ computes $G(\vec{r}_t\oplus \vec{o})$. If $G$ returns $\perp$, party $t$ sets $v_t=1$, otherwise party $t$ recovers their identity as assigned by Alice (and eventually the identity of the other participants if they are a receiver). If $t=A$, then Alice computes $G(\vec{r}\oplus \vec{o})$. If $G$ returns $\perp$, Alice sets $v_t=1$.
\end{enumerate}
\item\label{ID:step4} The $n$ parties perform the Veto protocol (Protocol~\ref{prot:Veto}) with inputs $v_t$. If the Veto outputs 1, the ACKA protocol aborts for all the $n$ parties.
\end{enumerate}
\end{protocol}\vspace{1cm}
The total number of bipartite channel uses required by the ACKA-ID protocol is: $n^2(n-1)(3 r_V \,+ |F(\vec{d}_t)|)$, where $|F(\vec{d}_t)|$ is given by \eqref{F(d)-length}.
Recall that, differently from ACKA, in a fully-ACKA protocol Alice only needs to communicate to each party whether they are a Bob or a non-participant. Thus, we present the fully-ACKA-ID protocol, where we denote $d_t$ the bit that Alice sends to every other party $t$ to communicate their identity. In particular, $d_t=1$ ($d_t=0$) means that party $t$ is a receiver (non-participant). In order to detect bit-flips in the transmission of $d_t$, Alice encodes $d_t$ with an AMD code \cite{Broadbent2007,AMD} $(F,G)$ which satisfies the statement of Lemma~\ref{lmm:AMD} and is such that:
\begin{align}
|F(d_t)| = 1+2\log_2 \frac{1}{\varepsilon_{\rm enc}} \label{F(dt)}.
\end{align}
\begin{protocol}\label{prot:f-ID}
\caption{Identity Designation for fully-ACKA (\textbf{fully-ACKA-ID})}
\noindent Before the protocol starts, the $n$ parties set $v_t=0\; \forall t$.
\begin{enumerate}[label=\arabic*., ref=\arabic*]
\item\label{f-ID:step1} The $n$ parties perform the Collision Detection protocol (Protocol~\ref{prot:Collision}), where party $t$ inputs 1 if they want to be the sender or 0 otherwise. If the Collision Detection outputs 0 or 2 then the fully-ACKA protocol aborts for all the $n$ parties. Else, they proceed with the next steps.
\item\label{f-ID:step2} If the protocol does not abort in step~\ref{ID:step1}, then there is a single sender, whom we identify as Alice, except for a small probability.
\item\label{f-ID:step3} For every party $t \in \{1,\dots,n\}$, do the following.
\begin{enumerate}
\item The $n$ parties perform the Parity protocol for $|F(d_t)|$ times with the following inputs. If $t \neq A$, Alice uses $F(d_t)$, party $t$ uses a random bitstring $\vec{r}_t$ and the other parties input $\vec{0}$. If $t=A$, then Alice uses $F(0) \oplus \vec{r}$, where $\vec{r}$ is a random bitstring, and the other parties input $\vec{0}$. Let $\vec{o}$ be the output of the Parity protocols.
\item Party $t$ computes $G(\vec{r}_t\oplus \vec{o})$. If $G$ returns $\perp$, party $t$ sets $v_t=1$, otherwise party $t$ recovers their identity as assigned by Alice. If $t=A$, then Alice computes $G(\vec{r}\oplus \vec{o})$ and if $G$ returns $\perp$, Alice sets $v_t=1$.
\end{enumerate}
\item\label{f-ID:step4} The $n$ parties perform the Veto protocol (Protocol~\ref{prot:Veto}) with inputs $v_t$. If the Veto outputs 1, the fully-ACKA protocol aborts for all the $n$ parties.
\end{enumerate}
\end{protocol}\vspace{1cm}
The total number of bipartite channel uses required by the fully-ACKA-ID protocol is: $n^2(n-1)(3 r_V \,+ |F(d_t)|)$, where $|F(d_t)|$ is given by \eqref{F(dt)}.\vspace{1em}
Another aspect that differentiates the ACKA protocol from the fully-ACKA protocol is the fact that the participants, in the latter protocol, cannot recover a pre-established conference key since they do not know each other's identities (apart from Alice). This means, in particular, that they cannot use a pre-established key to secretly share a testing key as happens in the ACKA protocol.
Therefore, in the fully-ACKA protocol we introduce another sub-protocol called Testing Key Distribution (TKD) protocol. With this protocol, Alice anonymously provides each Bob$_l$ (for $l\in\{1,\dots,m\}$) with a key $\vec{k}_l$ that is given by the concatenation of two independent bitstrings: $\vec{k}_l=(\vec{k}_{T},\vec{r}_l)$, where $\vec{k}_T$ ($|\vec{k}_T|=Lh(p)$) is the testing key and $\vec{r}_l$ is additional randomness used in the error correction phase of fully-ACKA. The string $\vec{r}_l$ is obtained by encoding the concatenated random string $(b_l,\vec{r}_\emptyset)$ with an AMD code $(F,G)$: $\vec{r}_l=F(b_l,\vec{r}_\emptyset)$. In principle, Bob$_l$ can recover the concatenated string by computing $G(\vec{r}_l)=(b_l,\vec{r}_\emptyset)$ and use it in error correction. In particular, the random bit $b_l$ and the random string $\vec{r}_\emptyset$, with $|\vec{r}_\emptyset|=1+2\log_2 1/ \varepsilon_{\mathrm{enc}}$, are employed in two separate steps of error correction. By adding the lengths of the two bitstrings composing $\vec{k}_l$, we obtain the total length of $\vec{k}_l$:
\begin{equation}
|\vec{k}_l|= Lh(p) + 2\left(1+2\log_2 \frac{1}{\varepsilon_{\mathrm{enc}}}\right)+2\log_2 \left(2+2\log_2 \frac{1}{\varepsilon_{\mathrm{enc}}}\right) \label{testing-key-length}.
\end{equation}
In order not to reveal the number $m$ of Bobs chosen by Alice, the distribution of the key $\vec{k}_l$ is repeated for $n-1$ times. In each iteration, Alice first notifies one party, say party $s$, to be the recipient of the key $\vec{k}_s=(\vec{k}_T,\vec{r}_s)$ and then runs a sequence of Parity protocols to transmit the bits of the key, with $s\neq A$. In case the recipient is not a Bob, Alice sums modulo two the bits of the key with random bits before transmitting them.\vspace{1cm}
\begin{protocol}\label{prot:TKD}
\caption{Testing Key Distribution (\textbf{TKD})}
\noindent Let $y_t \in\{0,1\}$ be the output of the Notification sub-protocol for party $t$: If $y_t=1$, party $t$ has been notified as the recipient.
Before the TKD protocol starts, we set the verification bits of Alice and Bob$_l$ to $v_A=v_{B_l}=0$ for every $l\in\{1,\dots,m\}$.
The following sequence of steps is repeated $n-1$ times.
\begin{enumerate}[label=\arabic*., ref=\arabic*]
\item Alice randomly picks a party $s \in\{1,\dots,n\}$ that has not been notified in previous iterations.
\item\label{TKD:step2} \textbf{Notification:} The $n$ parties repeat the following steps for every party $t \in\{1,\dots,n\}$.
\begin{enumerate}
\item Initialize $y_t=0$.
\item Repeat $r_N$ times:
\begin{enumerate}
\item For every party $j \neq A$ set $p_j=0$. Alice sets
\begin{align}
\left\lbrace\begin{array}{ll}
p_j =0 &\mbox{if } t\neq s \\
p_j \in_R \{0,1\} &\mbox{if } t=s.
\end{array}\right.
\end{align}
\item The $n$ parties perform Parity (Protocol~\ref{prot:parity}) with inputs $p_1,p_2,\dots,p_n$ but party $t$ does not broadcast. In this way party $t$ is the only who can compute the outcome of the Parity protocol. If the Parity outcome is 1, party $t$ sets $y_t=1$.
\end{enumerate}
\end{enumerate}
\item The party $s$ is notified ($y_s=1$) with high probability\footnote{This approach is inspired by the Notification protocol in \cite{Broadbent2007} and it successfully notifies party $s$ with probability at least $1-2^{-r_N}$, thanks to the iteration of $r_N$ rounds.}.
\item\label{TKD:step4}\textbf{Distribution:} The $n$ parties perform the Parity protocol for $|\vec{k}_l|$ times with the following inputs. If party $s$ corresponds to Bob$_l$ (for $l \in\{1,\dots,m\}$), Alice inputs $\vec{k}_l$, Bob$_l$ inputs a random bitstring $\vec{r}$, and the other parties input $\vec{0}$. Otherwise, if $s$ is a non-participant, Alice inputs $\vec{k}_s \oplus\vec{r}$, where $\vec{r}$ is a random string, and the other parties input $\vec{0}$. Let $\vec{o}$ be the output of the Parity protocols.
\item If $s$ corresponds to Bob$_l$, he computes $\vec{o}\oplus \vec{r}$ and recovers the testing key $\vec{k}_T$. Moreover, Bob$_l$ applies the decoding function $G$ on the last $|\vec{r}_l|$ bits of $\vec{o} \oplus \vec{r}$. If $G$ returns $\perp$, then Bob$_l$ sets $v_{B_l}=1$. Otherwise, Bob$_l$ recovers the bit $b_l$ and the string $\vec{r}_\emptyset$ to be used in error correction.\\
If $s$ is a non-participant, Alice computes $\vec{o}\oplus \vec{r}$ and applies the decoding function $G$ on the last $|\vec{r}_s|$ bits of $\vec{o} \oplus \vec{r}$. If $G$ returns $\perp$, then Alice sets $v_A=1$.
\end{enumerate}
If Bob$_l$ (for $l \in\{1,\dots,m\}$) has not been notified in none of the $n-1$ Notification rounds, he sets $v_{B_l}=1$.
\end{protocol}\vspace{1cm}
The total number of bipartite channel uses required for the TKD protocol is: $n^2(n-1)^2r_N \,+ \, n(n-1)^2 |\vec{k}_l|$, where $|\vec{k}_l|$ is given in \eqref{testing-key-length}.
The verification bits $v_A$ and $v_{B_l}$ are used to abort the fully-ACKA protocol in step~\ref{f-ACKA:step7} (c.f. Protocol~\ref{prot:sf-ACKA}) if a dishonest party attempts to modify the random bit $b_l$ or the random string $\vec{r}_\emptyset$ destined to Bob$_l$. The fact that Alice and the Bobs verify this fact in the exact same way, prevents non-participants and Eve from learning the identity of the participant who causes fully-ACKA to abort.
Additionally, the bits $v_{B_l}$ are used to abort the fully-ACKA protocol in step~\ref{f-ACKA:step7} if some Bob has not been notified and has not received $\vec{k}_l$. Note that, in order not to reveal the number of Bobs from the outcome of step~\ref{f-ACKA:step7}, we will require the non-participants to behave like a Bob if they have not been notified in TKD.\vspace{1em}
Finally, we illustrate the one-way error correction protocols adopted in ACKA (Protocol~\ref{prot:err-corr-acka}) and fully-ACKA (Protocol~\ref{prot:err-corr}), where Alice provides the Bobs with a syndrome that allows them to correct their faulty raw keys and match Alice's. Together with the syndrome, Alice distributes a hash of her raw key so that each Bob can verify the success of his error correction procedure.\vspace{1cm}
\begin{protocol}\label{prot:err-corr-acka}
\caption{Error Correction for ACKA (\textbf{ACKA-EC})}
\begin{enumerate}[label=\arabic*., ref=\arabic*]
\item Alice computes the syndrome $\vec{y}$, with $|\vec{y}|= L(1-p)h(Q_Z)$, from her raw key, i.e. from the string of measurement outcomes corresponding to key generation rounds in $\vec{k}'_T$.
\item All the parties broadcast a random string of $|\vec{y}|$ bits, while Alice broadcasts $\vec{y}\oplus\vec{k}_2$, where $\vec{k}_2$ is extracted from a previously-established conference key.
\item From the knowledge of $\vec{k}_2$, each Bob recovers $\vec{y}$ from Alice's broadcast and uses it to correct his raw key.
\item In order to verify if the error correction is successful, the public randomness picks a two-universal hash function mapping keys of $L(1-p)$ bits to keys of $b_h:= \log_2 \frac{n-1}{\varepsilon_{\mathrm{EC}}}$ bits. Alice and the Bobs compute the hashes $\vec{h}_A$ and $\vec{h}_{B_l}$ (for $l\in\{1,\dots,m\}$) by applying the hash function on their (error-corrected) raw keys.
\item All the parties broadcast a $b_h$-bit random string, except for Alice who broadcasts $\vec{h}_A\oplus \vec{k}_3$, where $\vec{k}_3$ is extracted from a previously-established conference key.
\item Each Bob recovers $\vec{h}_A$ and compares it with his hash $\vec{h}_{B_l}$. If $\vec{h}_A\neq \vec{h}_{B_l}$, then the error correction procedure failed for Bob$_{l}$ and he sets $v_{B_l}=1$, otherwise he sets $v_{B_l}=0$.
\item\label{EC:step7} All the parties broadcast a bit. Alice (Bob$_{l}$, for $l\in\{1,\dots,m\}$) broadcasts $v_A \oplus b_A$ ($v_{B_l} \oplus b_l$), where $b_A$ ($b_l$) is extracted from a previously-established conference key\footnote{The predefined ordering of the $n$ parties could be used to assign the bits $b_A$ and $b_l$ of a previous key to Alice and Bob$_l$, respectively.}.
\item From the knowledge of the bits $b_A$ and $b_l$, Alice and the Bobs learn if the verification bit $v_A$ or $v_{B_l}$ of any participant is equal to $1$, in which case they consider the protocol aborted and set their conference keys to $\vec{k}_A=\vec{k}_{B_l}=\emptyset$ for $l\in\{1,\dots,m\}$.
\end{enumerate}
\end{protocol}\vspace{1cm}
\begin{protocol}\label{prot:err-corr}
\caption{Error Correction for fully-ACKA (\textbf{fully-ACKA-EC})}
\begin{enumerate}[label=\arabic*., ref=\arabic*]
\item The public source of randomness picks a two-universal hash function. Alice uses it to compute the syndrome $\vec{y}$, an $L(1-p)h(Q_Z)$-bit long string, from her raw key, i.e. from the string of measurement outcomes corresponding to key generation rounds in $\vec{k}'_T$.
\item The $n$ parties repeatedly perform the Parity protocol for $L(1-p)h(Q_Z)$ times. Alice uses as an input the bits of $\vec{y}$, while the other parties input $\vec{0}$. The output string of the Parity protocols is $\vec{o}_1$.
\item Each Bob uses $\vec{o}_1$ as the syndrome to correct his raw key \cite{RennerThesis,ECwithHashFunc}.
\item In order to verify if the error correction is successful, the public randomness picks a two-universal hash function mapping keys of $L(1-p)$ bits to keys of $b_h:= \log_2 \frac{n-1}{\varepsilon_{\mathrm{EC}}}$ bits. Alice and the Bobs compute the hashes $\vec{h}_A$ and $\vec{h}_{B_l}$ (for $l\in\{1,\dots,m\}$) by applying the hash function on their (error-corrected) raw keys.
\item The $n$ parties perform the Parity protocol $b_h$ times, using input $\vec{0}$ except for Alice who uses the bits of $\vec{h}_A$. The output string of the Parity protocols is $\vec{o}_2$.
\item\label{f-EC:step6} Each Bob compares $\vec{o}_2$ with his hash $\vec{h}_{B_l}$. If $\vec{o}_2\neq \vec{h}_{B_l}$ then Bob$_{l}$ sets $v_{B_l}=1$, otherwise he sets $v_{B_l}=0$. Then, all the parties broadcast a random bit, except for Bob$_{l}$ who broadcasts $b_l \oplus v_{B_l}$ (for $l\in\{1,\dots,m\}$).
\item From the knowledge of the bits $b_l$, Alice retrieves the verification bits $v_{B_l}$ from the broadcast.
\item The $n$ parties execute the Parity protocol $|\vec{r}_{\emptyset}|$ times, where every party except for Alice inputs $\vec{0}$. If $v_{B_l}=0$ for every $l$ and if $\vec{o}_2=\vec{h}_A$, Alice inputs $\vec{r}_{\emptyset}\oplus F(0)$, otherwise she inputs $\vec{r}_{\emptyset}\oplus F(1)$. Let $\vec{o}_3$ be the output of the Parity protocols.
\item\label{f-EC:step9} Alice considers the fully-ACKA protocol aborted if $\vec{o}_3$ differs from her input or if she inputs $\vec{r}_{\emptyset}\oplus F(1)$, while every Bob computes $G(\vec{r}_{\emptyset}\oplus\vec{o}_3)$. If $G(\vec{r}_{\emptyset}\oplus\vec{o}_3)\in\{\perp,1\}$, the Bobs consider the fully-ACKA protocol aborted.
\end{enumerate}
\end{protocol}\vspace{1cm}
Note that if a dishonest party flipped some of the bits of $\vec{o}_1$ or $\vec{o}_2$ or $\vec{o}_3$ by inputting $1$ in the Parity protocols, then the fully-ACKA protocol aborts with high probability for Alice and all the Bobs.
\paragraph{Protocols with GHZ states} Here we provide a more detailed description of Protocol~\ref{prot:sACKA} (ACKA) and Protocol~\ref{prot:sf-ACKA} (fully-ACKA), which anonymously extract a conference key thanks to the multipartite entanglement of GHZ states. The protocols' parameters are summarized in Table~\ref{tab:parameters}.\vspace{1cm}
\begin{table}[hb]
\caption{Protocols' parameters}
\centering
\begin{tabular}{|c|l|}
\hline
$L$ & total number of GHZ states distributed and detected (including noisy states) \\
\hline
$p$ & probability of a test round (typically $p \leq 0.01$) \\
\hline
$Q_Z$ & estimation of the largest error rate between the $Z$ outcomes of Alice \\
& and of any Bob \\
\hline
$Q_X$ & threshold value of the test error rate, picked in the interval $ [0,1/2)$ and \\
& defined as the frequency of non-passed test rounds. A test round is passed \\
& if $\oplus_{t=1}^n X_t=0$, where $X_t\in \{0,1\}$ is party $t$'s outcome in the $X$ basis \\
& mapped to a binary value \\
\hline
$v_A$, $v_t$ and $v_{B_l}$ & verification bits of Alice, a generic party $t\in\{1,\dots,n\}$ and Bob$_l$ \\
& (for $l=1,\dots,m$), respectively \\
\hline
$r_V$ & number of iterations in the Veto protocol (Protocol~\ref{prot:Veto}) \\
\hline
$r_N$ & number of iterations in the TKD protocol (Protocol~\ref{prot:TKD}) \\
\hline
$\varepsilon_{\mathrm{EC}}$ & failure probability of the error correction sub-protocol \\
\hline
$\varepsilon_{\mathrm{enc}}$ & failure probability of the AMD code $(F,G)$ \cite{Broadbent2007,AMD} \\
\hline
$\gamma(Q_X)$ & statistical fluctuation, defined as the positive root of the equation \\
& \cite{tail_bound,WstateProtocol}: $\ln \binom{L(1-p)\gamma+L Q_X}{Lp Q_X} + \ln \binom{L(1-Q_X)-L(1-p) \gamma}{Lp(1-Q_X)} = \ln \binom{L }{Lp} + 2\ln \varepsilon_x $ \\
\hline
$\varepsilon^2_x$ & upper bound on the probability that the test error rate affecting the \\
& key-generation rounds is larger than the observed test error rate ($Q_X^{\mathrm{obs}}$) \\
& corrected by the statistical fluctuation $\gamma$ \\
\hline
$\varepsilon_{\mathrm{PA}}$ & probability related to the success of privacy amplification \\
\hline
\end{tabular}
\label{tab:parameters}
\end{table}
\newcounter{copyalgorithm}
\setcounter{copyalgorithm}{\value{algorithm}}
\setcounter{algorithm}{0}
\begin{protocol}
\caption{Anonymous Conference Key Agreement (\textbf{ACKA})}
\begin{enumerate}[label=\arabic*., ref=\arabic*]
\item\label{ACKA:step1} The parties perform the ACKA-ID protocol (Protocol~\ref{prot:ID}). If the ACKA-ID protocol does not abort, Alice is guaranteed to be the only sender and the Bobs learn the identities of Alice and of each other, except for a small probability.
\item Alice and the Bobs recover a shared conference key previously established.
\item\label{ACKA:step3} Alice generates a random bitstring of length $L$ where 1 corresponds to a test round and 0 to a key generation round. Given that $p$ is the probability that a round is identified as a test round, she compresses the string to a testing key $\vec{k}_T$ of length $Lh(p)$ (typically $h(p)< 8\%$). All the parties broadcast a random string of $Lh(p)$ bits, except for Alice who broadcasts $\vec{k}_T \oplus\vec{k}_1$, where $\vec{k}_1$ is extracted from a previously established conference key. Thanks to the knowledge of $\vec{k}_1$, each Bob recovers the testing key $\vec{k}_T$ from Alice's broadcast.
\item\label{ACKA:step4} Repeat the following for $L$ rounds.
\begin{enumerate}
\item An $n$-party GHZ state is distributed to the $n$ parties.
\item Alice and the Bobs measure their qubits according to the testing key $\vec{k}_T$. They measure in the $Z$ basis if the round is a key generation round, or in the $X$ basis if the round is a test round. All the other parties measure $X$.
\end{enumerate}
\item\label{ACKA:step5} Once the quantum measurements are over\footnote{We wait for a time longer than the coherence time of the qubits owned by the parties. We do not need to wait in case the parties have no quantum memory.}, the testing key $\vec{k}_T$ is publicly revealed. This is done anonymously by iterating the Parity protocol (Protocol~\ref{prot:parity}) $Lh(p)$ times. In each instance of the Parity protocol, Alice inputs a bit of $\vec{k}_T$, while the other parties input $0$. The output of the Parity protocols is $\vec{k}'_T$.
\item\label{ACKA:step6} For every round in step~\ref{ACKA:step3} that is labelled as a test round by $\vec{k}'_T$, the $n$ parties perform the Parity protocol with the following inputs. Let $X_t$ (for $t\in\{1,\dots,n\}$) be the outcome of party $t$ if they measured $X$ in that round, otherwise $X_t \in_R \{0,1\}$. Every party except for Alice ($t \neq A$) inputs $X_t$, while Alice inputs $T_A \in_R \{0,1\}$. Let $\vec{o}_T$ be the output of the Parity protocols for all the test rounds in $\vec{k}'_T$. Alice computes $Q^{\mathrm{obs}}_X=\omega_r (\vec{X}_A \oplus \vec{T}_A \oplus \vec{o}_T)$.
\item\label{ACKA:step7} Verification of secrecy: Alice compares $Q^{\mathrm{obs}}_X$ with the predefined value $Q_X$. If $Q_X^{\mathrm{obs}}+ \gamma(Q_X^{\mathrm{obs}}) >Q_X + \gamma(Q_X)$ Alice sets $v_A=1$, otherwise she sets $v_A=0$.
\item\label{ACKA:step8} ACKA-EC (Protocol \ref{prot:err-corr-acka}):
Alice broadcasts $ L(1-p)h(Q_Z)$ bits of error correction (EC) information, in order for the Bobs to correct their raw keys and match Alice's. Additionally, she broadcasts a hash of $\log_2 \frac{n-1}{\varepsilon_{\mathrm{EC}}}$ bits so that each Bob can verify the success of the EC procedure. Alice's broadcasts are encrypted and only the Bobs can decrypt them. If the EC or the verification of secrecy failed, the participants abort the protocol, but this information is encrypted and only available to them.
\item\label{ACKA:step9} PA: The public randomness outputs a two-universal hash function that maps keys of length $L (1-p)$ to keys of length $\ell$, where $\ell$ is given by:
\begin{equation}
\ell = L (1-p) \left[1-h\left(Q_X + \gamma(Q_X) \right)\right] -2\log_2 \frac{1}{2\varepsilon_{\mathrm{PA}}} \label{keylength-acka}.
\end{equation}
Alice and each Bob$_l$ apply the two-universal hash function on their error-corrected keys and obtain the secret conference keys $\vec{k}_A$ and $\vec{k}_{B_l}$. However, if the protocol aborted in the previous step, they do nothing.
\end{enumerate}
\end{protocol}\vspace{1cm}
We remark that, in order to fairly compare the performance of Protocol~\ref{prot:sACKA}, for the plots we consider the net number of generated bits, i.e. the number of conference key bits produced by one execution of the protocol, minus the bits consumed from previously-established conference keys. The latter amounts to $|\vec{k}_1| + |\vec{k}_2| + |\vec{k}_3| +n$ bits, which yield a net conference key length given by \eqref{skeylength-acka}.
Since one of the major novelties of our ACKA protocol is the efficient parameter estimation (or source verification) in step~\ref{ACKA:step6} of Protocol~\ref{prot:sACKA}, we would like to spend few words on its functioning.
First of all, we emphasize that the parameter $Q^{\rm obs}_X$ estimates the phase error rate of the state distributed by the untrusted source. If in a test round a GHZ state is distributed, the parity of the outcomes obtained by measuring every qubit in the $X$ basis is zero: $\oplus_{t=1}^n X_t=0$. Thus these instances do not contribute to the error rate $Q^{\rm obs}_X$. As a matter of fact, one can simplify the error rate expression provided in step~\ref{ACKA:step6} by noting that: $\vec{o}_T=\vec{T}_A\oplus (\oplus_{t \neq A} \vec{X}_t)$, which substituted in the error rate yields: $Q^{\rm obs}_X=\omega_r (\oplus_{t=1}^n \vec{X}_t)$.
The reason for which we require Alice to input a random bit $T_A$ in place of her outcome $X_A$ in the Parity protocol is that, in this way, we prevent any dishonest party from artificially decreasing the error rate ($Q^{\rm obs}_X=\omega_r (\oplus_{t=1}^n \vec{X}_t)$) based on the $X_t$ outcomes of all the other parties. Indeed, if Alice would input $X_A$, a dishonest party who is the last to broadcast in the Parity protocol can arbitrarily set the output of Parity --and thus $\oplus_{t=1}^n X_t$-- to zero.
Finally, we employ the Parity protocol to compute the parity $\vec{o}_T=\vec{T}_A\oplus (\oplus_{t \neq A} \vec{X}_t)$ instead of using a regular broadcast in order to preserve the participants' anonymity. To see why their identities would be under threat, let us suppose that we replace the Parity protocol with a regular broadcast. Then, based on the state that Eve --who controls the source-- distributed in a given test round, she could make predictions on the $X$ outcomes of the parties and compare them with the broadcast bits. Since Alice always broadcasts a random bit instead of her $X$ outcome as the other parties do, Eve could distinguish her broadcast and learn her identity. Similarly, if a Bob did not measure in the $X$ basis for some test round in $\vec{k}'_T$ (due to a mismatch between $\vec{k}'_T$ and his testing key), he must broadcast a random bit and Eve could learn his identity.\vspace{1cm}
\begin{protocol}
\caption{Fully Anonymous Conference Key Agreement (\textbf{fully-ACKA})}
\begin{enumerate}[label=\arabic*., ref=\arabic*]
\item\label{f-ACKA:step1} The parties perform the fully-ACKA-ID protocol (Protocol~\ref{prot:f-ID}). If the fully-ACKA-ID protocol does not abort, Alice is guaranteed to be the only sender and the Bobs are notified to be receivers, except for a small probability.
\item\label{f-ACKA:step2} Alice generates a random bitstring of length $L$ where 1 corresponds to a test round and 0 to a key generation round. Given that $p$ is the probability that a round is identified as a test round, she compresses the string to a testing key $\vec{k}_T$ of length $L h(p)$. Additionally, Alice generates the strings $\vec{r}_l=F(b_l,\vec{r}_\emptyset)$ (for $l\in\{1,\dots,m\}$) where $(F,G)$ is an AMD code and $(b_l,\vec{r}_\emptyset)$ is a concatenated random string.
\item\label{f-ACKA:step3} The parties perform the TKD protocol (Protocol~\ref{prot:TKD}) in order to distribute the key $\vec{k}_l=(\vec{k}_T,\vec{r}_l)$, which includes the testing key $\vec{k}_T$, to every Bob.
\item\label{f-ACKA:step4} Repeat the following for $L$ rounds.
\begin{enumerate}
\item An $n$-party GHZ state is distributed to the $n$ parties.
\item Alice and the Bobs measure their qubits according to the testing key $\vec{k}_T$. They measure in the $Z$ basis if the round is a key generation round, or in the $X$ basis if the round is a test round. All the other parties measure $X$.
\end{enumerate}
\item\label{f-ACKA:step5} Once the quantum measurements are over, the testing key $\vec{k}_T$ is publicly revealed. This is done anonymously by iterating the Parity protocol (Protocol~\ref{prot:parity}) $Lh(p)$ times. In each instance of the Parity protocol, Alice inputs a bit of $\vec{k}_T$, while the other parties input $0$. The output of the Parity protocols is $\vec{k}'_T$.
\item\label{f-ACKA:step6} For every round in step~\ref{f-ACKA:step4} that is labelled as a test round by $\vec{k}'_T$, the $n$ parties perform the Parity protocol with the following inputs. Let $X_t$ (for $t\in\{1,\dots,n\}$) be the outcome of party $t$ if they measured $X$ in that round, otherwise $X_t \in_R \{0,1\}$. Every party except for Alice ($t \neq A$) inputs $X_t$, while Alice inputs $T_A \in_R \{0,1\}$. Let $\vec{o}_T$ be the output of the Parity protocols for all the test rounds in $\vec{k}'_T$. Alice computes $Q^{\mathrm{obs}}_X=\omega_r (\vec{X}_A \oplus \vec{T}_A \oplus \vec{o}_T)$.
\item\label{f-ACKA:step7} Verification of secrecy: Alice compares $Q^{\mathrm{obs}}_X$ with the predefined value $Q_X$ and sets $v_s=1$ if $Q_X^{\mathrm{obs}}+ \gamma(Q_X^{\mathrm{obs}}) >Q_X + \gamma(Q_X)$ and $v_s=0$ otherwise. All the parties perform Veto (Protocol~\ref{prot:Veto}), where Alice inputs $v_s \vee v_A$, Bob$_l$ inputs $v_{B_l}$ and the non-participants input 1 if they have not been notified in TKD, otherwise they input $0$. If Veto outputs $1$, the protocol aborts for every party.
\item\label{f-ACKA:step8} fully-ACKA-EC (Protocol \ref{prot:err-corr}): Alice anonymously broadcasts $L(1-p)h(Q_Z)$ bits of EC information, in order for the Bobs to correct their raw keys and match Alice's. Additionally, she anonymously broadcasts a hash of $\log_2 \frac{n-1}{\varepsilon_{\mathrm{EC}}}$ bits so that each Bob can verify the success of the EC procedure. If the EC fails for at least one Bob, the protocol aborts but this information is only available to Alice and the Bobs.
\item\label{f-ACKA:step9} PA: The public randomness outputs a two-universal hash function that maps keys of length $L (1-p)$ to keys of length $\ell$, where $\ell$ is given by:
\begin{equation}
\ell = L (1-p) \left[1-h\left(Q_X + \gamma(Q_X) \right) -h(Q_Z)\right] -\log_2 \frac{2(n-1)}{\varepsilon_{\mathrm{EC}}}-2\log_2 \frac{1}{2\varepsilon_{\mathrm{PA}}} \label{keylength-f-acka}.
\end{equation}
Alice and each Bob$_l$ apply the two-universal hash function on their error-corrected keys and obtain the secret conference keys $\vec{k}_A$ and $\vec{k}_{B_l}$. However, if the protocol aborted in the previous step, they do nothing.
\end{enumerate}
\end{protocol}\vspace{1cm}
\setcounter{algorithm}{\value{copyalgorithm}}
\paragraph{Protocols without multipartite entanglement} In order to evaluate the benefits of using GHZ states to perform ACKA and fully-ACKA, we develop alternative protocols which only rely on bipartite private channels, implemented with Bell pairs. For this reason, we denote these protocols as bACKA and bifully-ACKA, respectively. We remark that bACKA and bifully-ACKA are not mere extensions of the Anonymous Message Transmission protocol \cite{Broadbent2007} to multiple parties, as they are thoroughly optimized to achieve the tasks under consideration.\vspace{1cm}
\begin{protocol}\label{prot:bACKA}
\caption{ACKA without multiparty entanglement (\textbf{bACKA})}
\begin{enumerate}[label=\arabic*., ref=\arabic*]
\item The parties perform the ACKA-ID protocol (Protocol~\ref{prot:ID}). If the ACKA-ID protocol does not abort, Alice is guaranteed to be the only sender and the Bobs learn the identities of Alice and of each other, except for a small probability.
\item Alice generates uniformly at random an $L_b$-bit conference key, $\vec{k}_A$.
\item\label{bACKA:step3} Every party --except for Alice-- sends a random string of $L_b$ bits to every other party through the bipartite private channels. Alice sends the conference key $\vec{k}_A$ to the Bobs and a random string to the other parties. Bob$_l$ identifies the string $\vec{k}_A$ received from Alice as his conference key: $\vec{k}_{B_l}=\vec{k}_A$, for $l\in\{1,\dots,m\}$.
\end{enumerate}
\end{protocol}\vspace{1cm}
\begin{protocol}\label{prot:bif-ACKA}
\caption{fully-ACKA without multiparty entanglement (\textbf{bifully-ACKA})}
\begin{enumerate}[label=\arabic*., ref=\arabic*]
\item\label{bf-ACKA:step1} The parties perform the fully-ACKA-ID protocol (Protocol~\ref{prot:f-ID}). If the fully-ACKA-ID protocol does not abort, Alice is guaranteed to be the only sender and the Bobs are notified to be receivers, except for a small probability.
\item Alice generates uniformly at random an $L_b$-bit conference key, $\vec{k}_A$, and encodes it as $F(\vec{k}_A)$ with an AMD code $(F,G)$, such that $|F(\vec{k}_A)|=L_b+2(\log_2 L_b + \log_2 1/\varepsilon_{\mathrm{enc}})$. She also sets her verification bit to $v_A=0$.
\item\label{bf-ACKA:step3} Repeat for $n-1$ times.
\begin{enumerate}
\item Alice randomly picks a party $s\in \{1,\dots,n\}$ that has not been notified in previous iterations.
\item\label{bf-ACKA:step3.2} The $n$ parties perform the Notification protocol (step~2 in Protocol~\ref{prot:TKD}), such that party $s$ is notified with high probability.
\item\label{bf-ACKA:step3.3} The $n$ parties execute $|F(\vec{k}_A)|$ rounds of the Parity protocol with the following inputs. If the notified party $s$ corresponds to Bob$_l$ (for $l \in\{1,\dots,m\}$), Alice inputs $F(\vec{k}_A)$, Bob$_l$ inputs a random bitstring $\vec{r}$, and the other parties input $\vec{0}$. Otherwise, if $s$ is a non-participant, Alice inputs $F(\vec{k}_A) \oplus\vec{r}$, where $\vec{r}$ is a random string, and the other parties input $\vec{0}$. Let $\vec{o}$ be the output of the Parity protocols.
\item If $s$ corresponds to Bob$_l$, he retrieves the conference key by computing $\vec{k}_{B_l}= G(\vec{r}\oplus\vec{o})$. If $\vec{k}_{B_l}=\bot$, then he sets $v_{B_l}=1$, otherwise $v_{B_l}=0$. If $s$ is a non-participant, Alice computes $G(\vec{o}\oplus \vec{r})$. If the computation returns $\perp$, then Alice sets $v_A=1$.
\end{enumerate}
\item\label{bf-ACKA:step4} Bob$_l$ (for $l\in\{1,\dots,m\}$) sets $v_{B_l}=1$ if he has not been notified in step~\ref{bf-ACKA:step3}. The $n$ parties perform Veto (Protocol~\ref{prot:Veto}) where Bob$_l$ inputs $v_{B_l}$ (for $l\in\{1,\dots,m\}$), Alice inputs $v_A$ and the other parties input $1$ if they have not been notified in step~\ref{bf-ACKA:step3}, otherwise they input $0$. If Veto outputs $1$, the protocol aborts for every party and the participants set $\vec{k}_A=\vec{k}_{B_l}=\emptyset \,\, \forall\, l$.
\end{enumerate}
\end{protocol}\vspace{1cm}
We emphasize that the bifully-ACKA protocol (Protocol~\ref{prot:bif-ACKA}) satisfies the anonymity condition for fully-ACKA protocols \eqref{anonymity-f-acka} given in Definition~\ref{def:suff-cond-security}, opposed to the fully-ACKA protocol based on GHZ states (Protocol~\ref{prot:sf-ACKA}) which satisfies a weaker anonymity property (Definition~\ref{def:weak-anonym}). More specifically, the bifully-ACKA protocol is $\varepsilon_{\rm AN}$-anonymous with respect to (dishonest) receivers in the sense of conditions \eqref{state:f-anony-dishonest} and \eqref{state:f-anony-dishonest-multiple-senders}, i.e. the reduced state of the receivers is close to a state independent of the identity of the other participants. Conversely, Protocol~\ref{prot:sf-ACKA} satisfies a weaker anonymity condition with respect to the receivers, formalized in terms of their guessing probability by conditions \eqref{weak-pguess1} and \eqref{weak-pguess2}.
\begin{Thm} \label{th:backa-security-proof}
The bACKA protocol (Protocol~\ref{prot:bACKA}), exclusively based on bipartite private channels, yields a secret conference key of length $L_b$ and is $\varepsilon_{\mathrm{tot}}$-secure according to Definition~\ref{def:suff-cond-security}, with $\varepsilon_{\mathrm{tot}}=2^{-r_V}+(n-1)\,\varepsilon_{\rm enc}$.
The bifully-ACKA protocol (Protocol~\ref{prot:bif-ACKA}), exclusively based on bipartite private channels, yields a secret conference key of length $L_b$ and is $\varepsilon_{\mathrm{tot}}$-secure according to Definition~\ref{def:suff-cond-security}, with $\varepsilon_{\mathrm{tot}}= 3\cdot2^{-r_V}+ (n-1)(2^{-(r_N-1)}+3\varepsilon_{\rm enc})$.
\end{Thm}
\bibliography{scibib}
\bibliographystyle{Science}
\section*{Acknowledgments} We thank Lennart Bittel and Nathan Walk for fruitful discussions.
F.G., G.M., D.B. and H.K. acknowledge support
by the Deutsche Forschungsgemeinschaft (DFG, German Research Foundation) under Germany’s Excellence
Strategy - Cluster of Excellence Matter and Light for
Quantum Computing (ML4Q) EXC 2004/1 - 390534769.
D.B. and H.K. acknowledge support by the QuantERA project QuICHE, via the German Ministry for Education and Research (BMBF Grant No.
16KIS1119K).
A.P. and J.d.J. acknowledge
support from the German Research Foundation (DFG,
Emmy Noether grant No. 418294583) and F.H. from the
German Academic Scholarship Foundation.
%Here you should list the contents of your Supplementary Materials -- below is an example.
%You should include a list of Supplementary figures, Tables, and any references that appear only in the SM.
%Note that the reference numbering continues from the main text to the SM.
% In the example below, Refs. 4-10 were cited only in the SM.
% For your review copy (i.e., the file you initially send in for
% evaluation), you can use the {figure} environment and the
% \includegraphics command to stream your figures into the text, placing
% all figures at the end. For the final, revised manuscript for
% acceptance and production, however, PostScript or other graphics
% should not be streamed into your compliled file. Instead, set
% captions as simple paragraphs (with a \noindent tag), setting them
% off from the rest of the text with a \clearpage as shown below, and
% submit figures as separate files according to the Art Department's
% instructions.
\includepdf[pages=-]{Supplementary_Materials.pdf}
\end{document}
\begin{thebibliography}{10}
\bibitem{second-quantum-rev1}
J.~P. Dowling, G.~J. Milburn, Quantum technology: the second quantum revolution
(2003).
\bibitem{second-quantum-rev2}
I.~H. Deutsch, {\it PRX Quantum\/} {\bf 1}, 020101 (2020).
\bibitem{QTEU}
E.~Commission, The quantum flagship, https://qt.eu. [Online].
\bibitem{BB84}
C.~H. Bennett, G.~Brassard, {\it Proceedings of IEEE International Conference
on Computers, Systems and Signal Processing\/} (1984), pp. 175 -- 179.
\bibitem{Diamanti2016}
E.~Diamanti, H.-K. Lo, B.~Qi, Z.~Yuan, {\it npj Quantum Information\/} {\bf 2},
16025 (2016).
\bibitem{pir2019advances}
S.~Pirandola, {\it et~al.\/}, {\it Adv. Opt. Photon.\/} {\bf 12}, 1012 (2020).
\bibitem{QKDmarkets}
I.~Q. Technology, Quantum key distribution (qkd) markets: 2019-2028,
https://www.insidequantumtechnology.com/product/quantum-key-distribution-qkd-markets-2019-2028.
[Online].
\bibitem{Epping}
M.~Epping, H.~Kampermann, C.~Macchiavello, D.~Bru{\ss}, {\it New Journal of
Physics\/} {\bf 19}, 093012 (2017).
\bibitem{Grasselli_2018}
F.~Grasselli, H.~Kampermann, D.~Bru{\ss}, {\it New Journal of Physics\/} {\bf
20}, 113014 (2018).
\bibitem{WstateProtocol}
F.~Grasselli, H.~Kampermann, D.~Bru{\ss}, {\it New Journal of Physics\/} {\bf
21}, 123002 (2019).
\bibitem{FirstCVMDI}
Y.~Wu, {\it et~al.\/}, {\it Phys. Rev. A\/} {\bf 93}, 022325 (2016).
\bibitem{ZSG18}
Z.~Zhang, R.~Shi, Y.~Guo, {\it Applied Sciences\/} {\bf 8} (2018).
\bibitem{OLLP19}
R.~L. C.~{Ottaviani}, C.~{Lupo}, S.~{Pirandola}, {\it Communications Physics\/}
{\bf 2} (2019).
\bibitem{CKAreview}
G.~Murta, F.~Grasselli, H.~Kampermann, D.~Bruß, {\it Advanced Quantum
Technologies\/} {\bf 3}, 2000025 (2020).
\bibitem{CKAexperiment}
M.~Proietti, {\it et~al.\/}, {\it Science Advances\/} {\bf 7} (2021).
\bibitem{CKAbook}
F.~Grasselli, {\it Quantum Cryptography\/} (Springer International Publishing,
2021).
\bibitem{Wehner2005}
M.~Christandl, S.~Wehner, {\it Advances in Cryptology - ASIACRYPT 2005\/},
B.~Roy, ed. (Springer Berlin Heidelberg, Berlin, Heidelberg, 2005), pp.
217--235.
\bibitem{lipinska_anonymous_2018}
V.~Lipinska, G.~Murta, S.~Wehner, {\it Physical Review A\/} {\bf 98}, 052320
(2018).
\bibitem{Brassard2007}
G.~Brassard, A.~Broadbent, J.~Fitzsimons, S.~Gambs, A.~Tapp, {\it Advances in
Cryptology -- ASIACRYPT 2007\/}, K.~Kurosawa, ed. (Springer Berlin
Heidelberg, Berlin, Heidelberg, 2007), pp. 460--473.
\bibitem{unnikrishnan_anonymity_2019}
A.~Unnikrishnan, {\it et~al.\/}, {\it Physical Review Letters\/} {\bf 122},
240501 (2019).
\bibitem{yang_examining_2020}
Y.-G. Yang, Y.-L. Yang, X.-L. Lv, Y.-H. Zhou, W.-M. Shi, {\it Physical Review
A\/} {\bf 101}, 062311 (2020).
\bibitem{acka_old}
F.~Hahn, J.~de~Jong, A.~Pappa, {\it PRX Quantum\/} {\bf 1}, 020325 (2020).
\bibitem{ACKA}
C.~Thalacker, F.~Hahn, J.~de~Jong, A.~Pappa, S.~Barz, {\it New Journal of
Physics\/} {\bf 23}, 083026 (2021).
\bibitem{Broadbent2007}
A.~Broadbent, A.~Tapp, {\it Advances in Cryptology -- ASIACRYPT 2007\/},
K.~Kurosawa, ed. (Springer Berlin Heidelberg, Berlin, Heidelberg, 2007), pp.
410--426.
\bibitem{bounded_storage}
I.~Damgard, S.~Fehr, L.~Salvail, C.~Schaffner, {\it 46th Annual IEEE Symposium
on Foundations of Computer Science (FOCS'05)\/} (2005), pp. 449--458.
\bibitem{broadbent_information-theoretic_2007}
A.~Broadbent, A.~Tapp, {\it Advances in Cryptology – ASIACRYPT 2007. Lecture
Notes in Computer Science\/}, K.~Kurosawa, ed. (Springer, Berlin, Heidelberg,
2007), vol. 4833, pp. 410--426.
\bibitem{anonymous-broadcast}
M.~Movahedi, J.~Saia, M.~Zamani, Secure anonymous broadcast (2014).
ArXiv:1405.5326.
\bibitem{PortmannRenner2014}
C.~Portmann, R.~Renner, Cryptographic security of quantum key distribution
(2014). ArXiv:quant-ph/1409.3525.
\bibitem{Portmann2021}
C.~Portmann, R.~Renner, Security in quantum cryptography (2021).
\bibitem{Bouda07}
J.~Bouda, J.~Sprojcar, {\it 2007 First International Conference on Quantum,
Nano, and Micro Technologies (ICQNM'07)\/} (2007), pp. 12--12.
\bibitem{gate-fidelity}
K.~Wright, {\it et~al.\/}, {\it Nature Communications\/} {\bf 10}, 5464 (2019).
\bibitem{Wstate}
W.~D\"ur, G.~Vidal, J.~I. Cirac, {\it Phys. Rev. A\/} {\bf 62}, 062314 (2000).
\bibitem{AMD}
R.~Cramer, Y.~Dodis, S.~Fehr, C.~Padr{\'o}, D.~Wichs, {\it Advances in
Cryptology -- EUROCRYPT 2008\/}, N.~Smart, ed. (Springer Berlin Heidelberg,
Berlin, Heidelberg, 2008), pp. 471--488.
\bibitem{RennerThesis}
R.~Renner, {\it International Journal of Quantum Information\/} {\bf 06}, 1
(2008).
\bibitem{ECwithHashFunc}
G.~Brassard, L.~Salvail, {\it Advances in Cryptology --- EUROCRYPT '93\/},
T.~Helleseth, ed. (Springer Berlin Heidelberg, Berlin, Heidelberg, 1994), pp.
410--423.
\bibitem{tail_bound}
H.-L. Yin, Z.-B. Chen, {\it Scientific Reports\/} {\bf 9}, 17113 (2019).
\end{thebibliography}