Scalable Quantum Key Distribution via GHZ Entanglement and Qubit Reuse

arXiv:2608.21667v1 [quant-ph] 21 Aug 2026

Scalable Quantum Key Distribution via GHZ Entanglement and Qubit Reuse Tasdiqul Islam

Rasman Mubtasim Swargo

txi7184@mavs.uta.edu University of Texas at Arlington Arlington, TX, USA

rs75c@mst.edu Missouri University of Science and Technology Rolla, MO, USA

Engin Arslan

Md Arifuzzaman

enginarslan@meta.com Meta Platforms, Inc. Menlo Park, CA, USA

marifuzzaman@mst.edu Missouri University of Science and Technology Rolla, Missouri, USA

Abstract

QKD is one of the practical use cases for quantum communication that offers a highly secure exchange of encryption keys between end users [2, 4, 11]. The most fundamental QKD algorithms such as BB84 [4], B92 [2], and E91 [11] require the number of transferred qubits to be equal or larger than the size of the secret key. This, in turn, requires high-capacity quantum channels and quantum repeaters to accommodate qubit transmissions of all users in the network. However, the advancement of qubit transmission and repeater designs is still in its early stages, implying that the development of high-capacity quantum networks will likely require time. To overcome potential bandwidth limitations of quantum networks while still offering the critical QKD service, we introduce a QKD scheme with minimum qubit transmission with the help of a multi-qubit Greenberger-Horne-Zeilinger (GHZ) state. In the proposed algorithm, if Alice wants to share a key in 𝐿 length with Bob, she generates 𝐿 + 1 GHZ state entangled qubits and sends one of them to Bob. Alice then encodes an ancillary bit based on the value of the first bit in the key and teleports it to Bob by conducting Bell State Measurements (BSM) with the ancillary bit and the first qubit of remaining 𝐿 bit GHZ state entangled qubits in Alice. Upon receiving the BSM results, Bob performs the corresponding gate operations before conducting Quantum Non-Demolition (QND) measurement [28, 30]. The QND returns the probability distribution of the ancillary qubit which is used to infer the value of the first bit of the key. Next, Alice and Bob execute a series of gates to reverse the impact of the BSM conducted to transmit the first classical bit. Finally, they repeat the process for the next bit in the key until the key is fully transmitted. The encoding of the ancillary bit is important to ensure that the impact of BSM can be reversed which is critical to reset the values of qubits in the GHZ state. Specifically, if the value of the classical bit in the key is 0, then Alice chooses 𝛼 > 𝛽 when encoding the ancillary bit in state 𝛼 1 |0⟩ + 𝛽 1 |1⟩. If the classical bit is 1, then the values of 𝛼 and 𝛽 are chosen to ensure that 𝛼 < 𝛽. Such encoding helps Bob to learn the value of the classical bit in the key without measuring its qubit. The proposed model can transmit 𝐿 length key by transmitting only one qubit (or as small as possible transmissions in the case of channel noise), significantly minimizing the number of qubit transmissions thereby reducing the load on quantum networks. It is worth noting that this scheme necessitates multi-qubit entanglement on Alice’s side and classical

Conventional Quantum Key Distribution (QKD) requires the transmission of qubits proportional to or exceeding the length of the key, as protocols such as BB84 transmit more qubits than the final key size due to basis sifting and privacy amplification. Since quantum networks are still in their infancy and have limited capacity, this overhead puts significant pressure on network resources. To address this issue, we propose a Multi-Qubit Greenberger–Horne–Zeilinger (GHZ) State-based QKD scheme that reduces the number of qubits transmitted over the quantum channel. The proposed method transmits one GHZ qubit between endpoints and reuses the resulting entanglement to convey multiple classical key bits with the help of Quantum Non-Demolition (QND) measurements. Under the stated assumptions on authenticated classical communication, local reset verification, and bounded-error QND discrimination, one can transfer 𝐿 classical bits by generating an (𝐿+1)-qubit GHZ state and transferring one qubit to the remote party. We verify correctness using the NetSquid quantum network simulator: the protocol achieves 100% raw-key fidelity for keys of length up to 12 bits under both ideal conditions and depolarizing noise up to 𝑝 = 0.005 per round. We further show that the proposed QKD algorithm can be extended to multi-party QKD and server-client deployment. The proposed scheme offers a transmitted-qubit-efficient, noise-tolerant alternative for bandwidth-limited quantum networks. ACM Reference Format: Tasdiqul Islam, Rasman Mubtasim Swargo, Engin Arslan, and Md Arifuzzaman. 2026. Scalable Quantum Key Distribution via GHZ Entanglement and Qubit Reuse. In Proceedings of (Preprint). ACM, New York, NY, USA, 7 pages.

1

Introduction

The urgency of quantum-secure communication has grown significantly with the release of NIST’s post-quantum cryptography (PQC) standards in August 2024 [23]. While PQC secures classical infrastructure against quantum adversaries through computational hardness assumptions, Quantum Key Distribution (QKD) provides information-theoretic security unconditional on computational assumptions, making the two approaches complementary rather than competing. As QKD deployment scales to meet this need, the quantum channel bandwidth consumed by QKD becomes a critical bottleneck. 1

Preprint, 2026

Tasdiqul Islam, Rasman Mubtasim Swargo, Engin Arslan, and Md Arifuzzaman

communication to transfer the BSM results. In addition to offering a strong key exchange mechanism for two-party, we also show that the proposed solution can be extended to multiparty quantum key distribution. It also can be extended as server-client architecture where two clients with small capacity can share large keys with the help of a trusted server with high qubit generation capacity. Our contributions can be summarized as follows: • We propose a QKD scheme that reuses a single transmitted qubit across all 𝐿 key bits via GHZ entanglement and QND measurement, achieving efficiency 𝜂 = 𝐿 that grows without bound. • We provide a security analysis covering four attack surfaces: entanglement measure, intercept-and-resend, QND-based eavesdropping, and reset stage leakage. We show that all attacks are detectable via CHSH inequality tests and that the reset stage introduces no new information leakage channel. • We validate the protocol using NetSquid [9], achieving 100% key fidelity for keys up to 𝐿 = 12 bits under both ideal conditions and depolarizing noise up to 𝑝 = 0.005 per round, confirming that the binary discrimination design provides inherent noise resilience. • We show that our solution extends naturally to multi-party QKD and to a server-client architecture in which low-capacity nodes share keys through a high-capacity GHZ server.

2

Quantum Non-Demolition (QND) Measurement: Experimental QND and nondestructive photonic measurements have been demonstrated in linear-optical and cavity-QED platforms [24, 28, 31], and Ralph et al. characterize QND measurements for quantum information [30]. Crucially, QND in our protocol is used for binary amplitude discrimination, determining whether 𝛼 > 𝛽 or 𝛼 < 𝛽, rather than full state tomography. Similarly, we rely on Bob having a quantum memory with long enough storage time to execute QND measurements to the same qubit for consecutive bit transmissions. Ma et al. showed that quantum memories could store qubits for up to an hour [20]; thus, we believe our approach is feasible. High-Dimensional QKD: High-dimensional QKD protocols encode multiple classical bits per transmitted quantum state by using 𝑑-dimensional quantum systems (qudits). For a 𝑑-dimensional qudit, the theoretical efficiency is 𝜂 = log2 (𝑑), exceeding the 𝜂 ≤ 1 of qubit-based BB84 and E91 [10, 32]. However, these approaches still require quantum transmissions proportional to the key length. Our scheme differs by leveraging GHZ entanglement and QND-based qubit reuse so the number of transmitted qubits is fixed at one per GHZ block, yielding 𝜂 = 𝐿 under the transmitted-qubit metric. Greenberger–Horne–Zeilinger (GHZ) State: As our proposed QKD approach requires a multi-qubit GHZ state, we next look into previous work in this area. Several previous studies described the ways to create multi-qubit GHZ states. In [34], Zhao et al. proposed an entanglement-creation scheme to create 2, 000-atom GHZ states with more than 80% fidelity. In [21], Mooney described the creation of a 27-qubit GHZ state, and in [22], a GHZ state with 65 qubits. More recently, Bao et al. demonstrated a 60-qubit GHZ state in a superconducting processor with single- and two-qubit gate fidelities of 99.9% and 99.5% respectively [1]. In 2025, a 120-qubit GHZ state was demonstrated in a superconducting quantum processor [15], representing the largest GHZ state reported to date. These advances significantly expand the feasibility of our approach and raise the theoretical efficiency ceiling to 𝜂 ≈ 120. As a result, we believe that our proposed mechanism is feasible and can significantly reduce the need for qubit transmissions for QKD.

Related Work

Quantum Key Distribution (QKD): QKD is one of the most popular applications of quantum networking. Bennett and Brassard proposed a QKD scheme known as BB84 in 1984 based on a single polarized photon [4]. Then, in 1991, Ekert developed a QKD solution that uses Bell state measurements [11]. Entanglement-based QKD was introduced in 1992 by Bennett to strengthen further the robustness of quantum key distribution algorithms[2]. Since then, many researchers proposed alternative QKD methods. For example, Koashi et al. proposed a QKD solution to reduce the number of qubit transmissions [16]. Cabello et al. proposed a scheme achieving 𝜂 = 1 by transmitting two qubits for two key bits using EPR pairs and BSM [6]. This work shares the objective of reducing qubit transmissions with [6, 16], but uses a different approach: quantum teleportation of a custom-encoded ancillary qubit combined with QND measurement for key bit recovery, enabling transmitted-qubit efficiency 𝜂 = 𝐿 under the same metric. Multi-party QKD is an important extension of the two-party case. Li et al. used GHZ states to minimize quantum resources for multi-party secret sharing [18]. Qin et al. proposed a dynamic GHZbased scheme supporting participant addition and removal [29]. Cardoso-Isidoro proposed a QKD scheme based on asymmetric double quantum teleportation [7], and Proietti et al. demonstrated multi-party QKD experimentally with GHZ qubits [27]. All of these schemes require at least one qubit transmission per key bit, as none employ QND measurement for qubit reuse. Our work targets this bottleneck by combining GHZ entanglement with QND-based qubit reuse to reduce quantum channel usage to a single transmission regardless of key length.

3

The System Model

Alice generates 𝐿 + 1 GHZ-entangled qubits, retains 𝐿 of them in quantum memory, and sends the remaining one to Bob (Step 2) before any key encoding begins. She then generates one ancillary qubit per round and encodes it based on the next bit value in the key. Alice requires quantum memory for 𝐿 + 1 qubits (for the GHZ state) plus one ancillary qubit at a time, for a total of 𝐿 + 2 qubits of simultaneous quantum memory. Alice performs BSM between the first GHZ qubit and the ancillary qubit and sends the result to Bob over an authenticated classical channel. Based on the BSM results, Bob applies the appropriate gates on his qubit and measures it using Quantum Non-Demolition (QND) measurement. Bob then reverts the gate operations so that his qubit remains entangled with Alice’s remaining qubits. Initially Alice retains 𝐿 qubits; after each successive BSM round, one of Alice’s GHZ qubits is consumed, leaving 𝐿 − 𝑘 qubits with Alice after 𝑘 rounds. Alice resets and verifies the remaining entangled resource after each BSM; if the reset check fails, the current GHZ block is discarded and a new

2

Scalable Quantum Key Distribution via GHZ Entanglement and Qubit Reuse

Alice

Preprint, 2026

Alice

Bob

Alice

Bob

Bob

BSM

BSM result

Ancillary qubit Apply X or/and Z gate Key = 1 0 1 1 0

(a) Step 1: GHZ State Preparation

Key = 1 0 1 1 0

Apply X or/and Z gate

Key = 1 0 1 1 0

(b) Step 2:Qubit Transmission to Bob

(c) Step 3: Ancillary Qubit Teleportation

Figure 1: Illustration of first three steps to send a classical bit from Alice to Bob using the proposed quantum key distribution method. block is generated. Alice and Bob repeat the process until all 𝐿 bits have been transmitted. Encoding the ancillary qubit directly as |0⟩ for bit 0 and |1⟩ for bit 1 is not suitable here because it would leave the remaining resource in a basis state after the first BSM. Hence, Alice encodes the classical bit in 𝛼 1 |0⟩ + 𝛽 1 |1⟩ where 0 < 𝛼 < 1 and 0 < 𝛽 < 1. The relationship of 𝛼 and 𝛽 is used to distinguish classical bits: 𝛼 > 𝛽 transmits bit 0, and 𝛼 < 𝛽 transmits bit 1. We next describe the steps in more detail. Why Multi-Qubit GHZ is Necessary. A natural question is whether the multi-qubit GHZ state is necessary, or whether a simpler 2-qubit Bell pair would suffice. A Bell pair supports only a single BSM round: after Alice performs BSM with her ancillary qubit, the entanglement between Alice and Bob is fully consumed, and any subsequent key bit would require transmitting a new qubit to Bob, giving a total of 𝑞𝑡 = 𝐿 transmissions for an 𝐿-bit key and eliminating the efficiency advantage. By contrast, the (𝐿 + 1)-qubit GHZ state ensures that after each BSM+reset cycle, the remaining 𝐿 − 𝑘 Alice qubits and Bob’s single qubit stay entangled (Equation 3), allowing Bob to reuse his qubit across all 𝐿 rounds of key transmission from a single initial qubit transmission (𝑞𝑡 = 1). This is the essential role of the multi-qubit GHZ structure: genuine 𝐿-partite entanglement makes the state resilient to partial measurement, so the remaining subsystem stays entangled after each sequential BSM, providing a sequentially consumable entangled resource across all 𝐿 rounds.

q0

H

q1 q2

qL

Figure 2: Preparation of GHZ state with 𝐿 + 1 qubits

Step 2: Qubit Transmission to Bob Alice keeps the 𝐿 qubits (in a quantum memory) and sends the last one to Bob. This requires Alice to have quantum memory with at least 𝐿 + 1 qubits capacity; 𝐿 for GHZ state qubits and 1 for the ancillary qubit that is used to encode the key. Qubit transmission to Bob can be a direct transmission of the qubit from Alice to Bob if the distance between them is short (typically in the order of 130km or around 80 miles). Otherwise, quantum repeaters can be used to teleport a qubit with the help of entanglement swapping [25]. If qubit transmission to Bob fails, Alice will regenerate another qubit, entangle it with her 𝐿 qubits, and then send it to Bob. In Figure 1(b), Alice sends one of the six qubits to Bob through a quantum channel.

Step 1: 𝐿 + 1 Qubit GHZ State Preparation

Step 3: Ancillary Qubit Teleportation

Alice first prepares 𝐿 + 1 qubits in the GHZ state as shown in Figure 1(a). To do so, she produces 𝐿 + 1 qubits in |0⟩ state. Then, Hadamard and CNOT gates are applied to the qubits to create a GHZ state, as illustrated in Figure 2. The state of the 𝐿 + 1 qubits can be written as:
1 |𝜓 ⟩ = √ |01 02 03 · · · 0𝐿 0𝐿+1 ⟩ + |11 12 13 · · · 1𝐿 1𝐿+1 ⟩ (1) 2 In Figure 1(a), Alice wants to send a key that is 5-bit long (i.e., 𝐿 = 5). Thus, she creates a 6-qubit GHZ state.

Alice next creates an ancillary qubit in 𝜃 1 = 𝛼 1 |0⟩ + 𝛽 1 |1⟩. The values of 𝛼 1 and 𝛽 1 are chosen based on the value of the classical bit in the key. Specifically, if the next bit in the key is 0, then 𝛼 1 > 𝛽 1 , otherwise (i.e., the classical bit is 1) 𝛼 1 < 𝛽 1 . The specific values depend on the channel noise, depolarization rate, and QND discrimination accuracy. In our simulations we use (𝛼 2, 𝛽 2 ) = (0.6, 0.4) or (0.4, 0.6), giving a gap that remains above the tested discrimination threshold under the evaluated noise levels. Alice next performs a Bell State Measurement using the ancillary qubit and the first qubit of the 𝐿-qubit she has. This will transform the GHZ state to

3

Preprint, 2026

Tasdiqul Islam, Rasman Mubtasim Swargo, Engin Arslan, and Md Arifuzzaman

Alice

Alice

Bob

Bob

CNOT and Measure

QND Measurement

Key = 1 0 1 1 0

Alice

Bob

Ancillary qubit 1 1 |0 > + ! |1 > 𝛼! 𝛽

Key = 1

K1 = 1 0 1 1 0

(a) Step 4: QND Measurement

K1 = 1

(b) Step 5: GHZ State Reset

K1 = 1 0 1 1 0

K1 = 1

(c) Final State

Figure 3: Illustration of Steps 4-5 and final state to send a classical bit from Alice to Bob using the proposed quantum key distribution method.

Step 5: GHZ State Reset |0𝜃 1 01 ⟩ 𝛼 1 |02 03 · · · 0𝐿 0𝐿+1 ⟩ + 𝛽 1 |12 13 · · · 1𝐿 1𝐿+1 ⟩

Since Alice applies the same 𝑋 or 𝑍 gates as Bob did to the remaining GHZ state qubits, the state of the remaining 𝐿 qubits (𝐿 − 1 in Alice and one in Bob) can be represented as

+ |0𝜃 1 11 ⟩ 𝛽 1 |02 03 · · · 0𝐿 0𝐿+1 ⟩ + 𝛼 1 |12 13 · · · 1𝐿 1𝐿+1 ⟩

+ |1𝜃 1 01 ⟩ 𝛼 1 |02 03 · · · 0𝐿 0𝐿+1 ⟩ − 𝛽 1 |12 13 · · · 1𝐿 1𝐿+1 ⟩

+ |1𝜃 1 11 ⟩ 𝛼 1 |12 13 · · · 1𝐿 1𝐿+1 ⟩ − 𝛽 1 |02 03 · · · 0𝐿 0𝐿+1 ⟩

|𝜓 ⟩ = 𝛼 1 |02 03 · · · 0𝐿 0𝐿+1 ⟩ + 𝛽 1 |12 13 · · · 1𝐿 1𝐿+1 ⟩ (3) To send the second classical bit in the key, Alice encodes another ancillary qubit |𝜃 2 ⟩ = 𝛼 2 |0⟩ + 𝛽 2 |1⟩ and teleports it to Bob. After the teleportation, the state of qubits will be

(2) Please note that qubits 0 − 𝐿 are located in Alice, whereas qubit 𝐿 + 1 is located in Bob. After conducting the BSM using the first qubit of GHZ state and ancillary bit 𝜃 1 , Alice sends the result to Bob using classical communication. Upon receiving the output of BSM, Bob selects which of 𝑋 and 𝑍 gates to apply to the qubit he has. In Figure 1(c), Alice prepares an ancillary qubit based on the first bit of the key (which is 1), performs BSM, and sends the result to Bob through a classical channel. Bob Applies 𝑋 or/and 𝑍 gate based on the received BSM results. Alice also applies the 𝑋 or/and 𝑍 gate to her qubits to keep her qubits in the same state as Bob’s qubit.

|0𝜃 2 02 ⟩ 𝛼 1 𝛼 2 |03 04 · · · 0𝐿 0𝐿+1 ⟩ + 𝛽 1 𝛽 2 |13 14 · · · 1𝐿 1𝐿+1 ⟩

+ |0𝜃 2 12 ⟩ 𝛼 1 𝛽 2 |03 04 · · · 0𝐿 0𝐿+1 ⟩ + 𝛽 1 𝛼 2 |13 14 · · · 1𝐿 1𝐿+1 ⟩

+ |1𝜃 2 02 ⟩ 𝛼 1 𝛼 2 |03 04 · · · 0𝐿 0𝐿+1 ⟩ − 𝛽 1 𝛽 2 |13 14 · · · 1𝐿 1𝐿+1 ⟩

+ |1𝜃 2 12 ⟩ 𝛽 1 𝛼 2 |13 14 · · · 1𝐿 1𝐿+1 ⟩ − 𝛼 1 𝛽 2 |03 04 · · · 0𝐿 0𝐿+1 ⟩

(4)

This is a complex state in the sense that Bob cannot extract the value of 𝛼 2 and 𝛽 2 by only applying 𝑋 and 𝑍 gates. It would be possible to do so if the state were restored to the standard GHZ state in Equation 1, where the probabilities of the all-zero and allone branches are equal. Thus, we need a reset stage after every teleportation. In Figure 3(b), Alice resets her qubit and prepares the remaining qubits in standard GHZ form before sending the next classical bit. The reset operation can be viewed as a heralded entanglementconcentration or local-filtering step, where a partially entangled GHZ-like state 𝛼 |00 · · · 0⟩ + 𝛽 |11 · · · 1⟩ is restored to the balanced GHZ form only when the local measurement returns the accepted branch. Entanglement concentration for partially entangled states was first studied by Bennett et al. [3], and related reset operations using an ancillary qubit and measurement have been used in oneclassical-bit teleportation [26]. This success-conditioned reset is also consistent with experimentally demonstrated local filtering and Procrustean entanglement concentration [17, 19]. Following this idea, Alice locally applies an ancillary-qubit-assisted CNOT and measurement operation to reset the remaining entangled qubits before transmitting the next key bit. To show the general structure, consider a pure-state ancilla |𝑏⟩ = 𝑝 |0⟩ + 𝑞 |1⟩ applied as a CNOT

Step 4: QND Measurement After applying the appropriate gates, Bob performs QND measurement on his qubit to determine whether 𝛼 1 > 𝛽 1 or 𝛼 1 < 𝛽 1 , as shown in Figure 3(a). This is a binary discrimination task: Bob does not need full state tomography, only the relative magnitude of the two amplitudes. We assume a bounded-error QND measurement whose back-action remains below the reset threshold, consistent with weak QND measurements that preserve the measured qubit for subsequent operations [14, 28]. Since Alice encoded the key bit as 𝛼 1 > 𝛽 1 (bit 0) or 𝛼 1 < 𝛽 1 (bit 1), Bob’s binary discrimination directly recovers the key bit. By choosing 𝛼 and 𝛽 with sufficient separation (i.e., |𝛼 2 − 𝛽 2 | > 𝛿 for a chosen threshold 𝛿), the error probability can be kept below the protocol target at the cost of additional QND repetitions. Unlike direct qubit measurement as done in E91, QND does not destroy the qubit Bob holds, allowing him to reuse it across all 𝐿 rounds. Note that QND enables qubit reuse, not key distribution itself; standard teleportation without QND would require 𝑞𝑡 = 𝐿 transmissions, yielding 𝜂 = 1 rather than 𝜂 = 𝐿. In Figure 3(a), Bob determines 𝛼 < 𝛽 and correctly infers that the first bit of the key is 1. 4

Scalable Quantum Key Distribution via GHZ Entanglement and Qubit Reuse

Preprint, 2026

4.2

control; this transforms |𝜉⟩ to

𝑝 |0⟩ + 𝑞 |1⟩ 𝛼 |01 02 · · · 0𝑛 ⟩ + 𝛽 |11 12 · · · 1𝑛 ⟩ = 𝑝𝛼 |001 02 · · · 0𝑛 ⟩ + 𝑝𝛽 |011 12 · · · 1𝑛 ⟩ + 𝑞𝛼 |101 02 · · · 0𝑛 ⟩ + 𝑞𝛽 |111 12 · · · 1𝑛 ⟩

(5)

After measuring the first qubit of |𝜉⟩, the accepted branch has the form
|01 ⟩ 𝑝𝛼 |002 · · · 0𝑛 ⟩ + 𝑞𝛽 |112 · · · 1𝑛 ⟩
|11 ⟩ 𝑝𝛽 |012 · · · 1𝑛 ⟩ + 𝑞𝛽 |102 · · · 0𝑛 ⟩ (6)

4.3

While [26] uses 𝑝 = 𝛽 and 𝑞 = 𝛼, we prepare the ancillary qubit from the mixed-state filter in Equation 7 to bias the procedure toward the accepted branch for the amplitude gaps used in our protocol.  2  𝛽 0 𝜌= (7) 0 𝛼2 The reset is therefore treated as a success-conditioned operation: Alice locally verifies whether the accepted branch was obtained. If verification succeeds, the remaining qubits are restored to the standard GHZ state as shown in Figure 3(c), making it possible to generate another ancillary qubit and repeat Steps 1-5 for the next key bit. If verification fails, Alice and Bob discard the current GHZ block and restart with a newly generated block rather than treating the failed reset as a valid key round. Security note: The reset operation is performed entirely locally by Alice. Neither the reset ancilla nor the reset measurement outcome is transmitted over any channel, ensuring that the reset stage introduces no new information leakage accessible to an eavesdropper. A full security analysis of the reset stage is provided in Section 4.

4

QND-Based Eavesdropping

One might ask whether an eavesdropper Eve could exploit QND measurements to extract key information without disturbing the state. We consider two windows of opportunity. Window A: Eve applies QND to the qubit in transit (Step 2). The transmitted qubit is part of the GHZ state and carries no key information at this point; encoding occurs only in Step 3 via BSM on Alice’s side. The reduced state of the transmitted qubit is maximally mixed (𝜌 = 𝐼 /2), so Eve’s QND yields no key-relevant outcome. Any nontrivial QND interaction, however, couples Eve’s apparatus to the GHZ system and is treated as an entangling disturbance detectable by the sampled integrity check. Window B: Eve applies QND after key encoding (Steps 3–5). After Step 3, Bob’s qubit encodes the key bit via the 𝛼/𝛽 relationship. However, Bob’s qubit is local to Bob and physically inaccessible to Eve under our threat model. The authenticated classical BSM results do not allow Eve to reconstruct the encoded state without Bob’s qubit. Thus, Eve’s QND capability does not create a new attack surface beyond attacks on the transmitted qubit.

4.4

Security Analysis

Intercept, Entangle and Resend Attack

Eve may intercept Bob’s qubit, substitute her own 𝐿+1-qubit system, and forward one qubit of her system to Bob. She can then monitor Alice’s BSM results and apply QND measurement to her retained qubit, attempting the same binary discrimination (𝛼 > 𝛽 or 𝛼 < 𝛽) that Bob performs. The substitute qubit is not the genuine GHZ qubit entangled with Alice’s system, so Bob’s observed correlations with Alice deviate from the expected GHZ correlations and are exposed by sampled integrity checks.

In this section, we analyze the main attack surfaces of the protocol. We assume an authenticated classical channel: Eve may observe BSM messages and may attack qubits in transit, but she cannot modify authenticated messages undetected and cannot access Alice’s or Bob’s private laboratories. We also assume Alice and Bob periodically reserve sampled GHZ blocks for CHSH-style entanglement-integrity checks; these checks provide attack detection with a sampling-dependent probability rather than a composable security proof.

4.1

Intercept and Resend Attack

Eve may intercept Bob’s qubit, measure it, and relay a replacement qubit. Measuring the transmitted GHZ qubit collapses its correlation with Alice’s subsystem into a basis state, so later BSM correction and QND discrimination no longer match the expected GHZ correlations. Since key encoding occurs after Bob has received his qubit, the intercepted qubit alone also carries no key bit. The attack is detected either through failed protocol checks during the affected block or through the sampled entanglement-integrity test.

4.5

Security of the Reset Stage

The reset stage (Step 5) modifies the entangled state using a locally generated ancillary qubit and a local measurement on Alice’s qubits. We analyze whether this operation leaks key information. The reset ancillary qubit with density matrix 𝜌 (Equation 7) is constructed and consumed locally by Alice; it is never transmitted over any channel. The measurement outcome of Alice’s qubit during the reset is also local and not communicated to any party. Therefore, Eve has no access to either the ancillary state or the reset measurement outcome. The post-reset state retains information only in the private joint state of Alice’s and Bob’s qubits. Since Bob’s qubit is local to Bob (Section 4.3) and reset outcomes are not transmitted, the reset stage does not expose a new public leakage channel. If Alice’s local reset verification fails, the block is discarded rather than reused, preventing a failed reset from silently contaminating later key bits.

Entanglement Measure Attack

Eve may intercept the transmitted qubit and attempt to entangle an additional qubit with the (𝐿 + 1) GHZ system. Subsequently, Eve can observe the Bell State Measurement (BSM) result and try to carry out Step 3 from her own standpoint. This interaction takes place within an expanded Hilbert space [33]; by entanglement monogamy and the CKW inequality [8], Eve cannot become maximally entangled with Bob while Bob remains maximally entangled with Alice’s GHZ subsystem. Alice and Bob can therefore detect such disturbance on sampled test blocks by checking the expected CHSH violation for GHZ states [12].

5

Preprint, 2026

5

Tasdiqul Islam, Rasman Mubtasim Swargo, Engin Arslan, and Md Arifuzzaman

Table 2: Transmitted-qubit efficiency, 𝜂, of different QKD schemes. 𝑞𝑡 refers to the total quantity of qubits transferred through the quantum channel and 𝑏𝑠 represents the total number of classical bits in the secret key. High-dimensional QKD transmits one qudit per key bit group; our scheme transmits one qubit total for a key of length 𝐿.

Performance Analysis

We verified the correctness of the proposed scheme using the quantum network simulator NetSquid [9] on an Apple M4 Max machine with 16 CPU cores and 64 GB of unified memory. We ran the full protocol for key lengths 𝐿 ∈ {5, 8, 10, 12} under both ideal conditions and depolarizing noise on Bob’s qubit storage, with five independent runs per configuration. Table 1 summarises the results. A depolarizing channel with rate 𝑝 applies 𝜌 → (1 − 𝑝)𝜌 + 𝑝 I/2 to Bob’s qubit after each BSM round.

Scheme 𝑏 𝑠 𝑞𝑡 𝜂 Bennett, 1992 [2] < 0.5 1 < 0.5 Bennett and Brassard, 1984 [4] 0.5 1 0.5 Goldenberg and Vaidman, 1995 [13] 1 2 0.5 Ekert, 1991 [11] 1 1 1 Koashi and Imoto, 1997 [16] 1 2 0.5 Cabello, 2000 [6] 2 2 1 High-dim QKD (𝑑-level qudit) log2 𝑑 1 log2 𝑑 Our scheme L 1 𝐿, (𝐿 > 1)

Table 1: NetSquid simulation results (5 runs per cell). Key accuracy was 100% in all cases. 𝑝 is the depolarizing rate per BSM round. Sim. times are approximate, reflecting classical full-state overhead rather than protocol cost. 𝐿 5 8 10 12

GHZ 6 9 11 13

𝑝 =0 100% 100% 100% 100%

𝑝 = 0.001 100% 100% 100% 100%

𝑝 = 0.005 100% 100% 100% 100%

Sim. time < 0.01 s ∼ 0.1 s ∼ 1s ∼ 30 s

but still requires one qudit per key bit group. Recent experiments have demonstrated GHZ states of up to 120 qubits in superconducting processors [1, 15] and up to 2,000 atoms in atomic systems [34], suggesting a practical ceiling determined by available GHZ size. Practical operating considerations. The key length 𝐿 is an implementation parameter bounded by GHZ fidelity, memory lifetime, QND back-action, reset success probability, and the sampling rate used for integrity checks. These factors do not change the transmitted-qubit count of one qubit per accepted GHZ block, but they determine effective key throughput. Since reset is successconditioned, failed blocks are discarded before contributing raw key bits; in practice, shorter blocks reduce device pressure, while longer blocks amortize the same quantum transmission over more key bits. The two-party protocol generalizes in two directions. Multi-Party QKD. To broadcast a shared key to 𝑛 parties, Alice prepares an (𝐿 + 𝑛)-qubit GHZ state and distributes one qubit to each party. In each BSM round, she broadcasts the two-bit BSM result to all parties; each applies 𝑋 /𝑍 corrections and performs QND independently, recovering the same binary discrimination outcome simultaneously. The total quantum channel cost is 𝑛 qubits, giving 𝜂 = 𝐿/𝑛, which exceeds 𝜂 = 1 of E91 whenever 𝐿 > 𝑛. Server–Client Architecture. For resource-constrained endpoints, a trusted server generates the GHZ state and distributes one qubit to each of two clients 𝐶 1 and 𝐶 2 . Each client receives BSM results and performs QND locally; no entanglement generation is required on the client side. This is the 𝑛 = 2 case of the multi-party extension and is well-suited to near-term networks where end-device qubit capacity is limited.

Key accuracy remained at 100% across all key lengths and tested noise levels. This noise tolerance follows from the binary discrimination design: Alice encodes key bits using (𝛼 2, 𝛽 2 ) = (0.6, 0.4) or (0.4, 0.6), giving a discrimination gap |𝛼 2 − 𝛽 2 | = 0.20. Each depolarizing event shrinks the effective gap by (1 − 𝑝) per round; at 𝑝 = 0.005 over 12 rounds the gap reduces to 0.20× (0.995) 12 ≈ 0.189, above the threshold used in our simulations. The protocol requires only that 𝛼 > 𝛽 or 𝛼 < 𝛽 can be reliably decided, making it robust in the evaluated decoherence regime. The simulation wall-clock time grows with 𝐿 because Alice’s mixed-state ancillary qubit forces NetSquid into density matrix formalism for the joint system. The peak entangled system during the reset step comprises 𝐿 + 2 qubits, requiring a 4𝐿+2 -entry density matrix, approximately 4.3 GB at 𝐿 = 12 and ∼275 GB at 𝐿 = 15, which exceeds the 64 GB available on our machine. This memory cost is a limitation of classically simulating quantum states, not the transmitted-qubit cost of the protocol. For keys longer than the practical GHZ or simulation limit, multiple smaller GHZ states can be used in sequence; for example, a 30-bit key via three 10-qubit GHZ states. Classical overhead. A deliberate design choice in our scheme is to trade quantum bandwidth for classical bandwidth. For a key of length 𝐿, the protocol transmits one qubit over the quantum channel and 2𝐿 classical bits (two bits per BSM outcome across 𝐿 rounds). In contrast, BB84 requires 𝑂 (𝐿) qubits plus 𝑂 (𝐿) classical bits for sifting and reconciliation. Since classical channel capacity is orders of magnitude cheaper and more abundant than quantum channel capacity, this tradeoff is favourable for practical deployment. To measure transmitted-qubit efficiency, we adopt the formula 𝜂 = 𝑏𝑠 /𝑞𝑡 introduced by Cabello [5], where 𝑞𝑡 is the total number of qubits transmitted over the quantum channel and 𝑏𝑠 is the secret key length. Table 2 compares schemes under this transmittedquantum-symbol metric; it does not account for local memory, GHZ preparation, reset attempts, or classical communication. Our scheme achieves 𝜂 = 𝐿/1 = 𝐿, which grows with key length under this metric. In comparison, BB84, E91, and B92 all achieve 𝜂 ≤ 1. High-dimensional QKD achieves 𝜂 = log2 𝑑 per transmitted qudit,

6

Conclusion

We presented a GHZ State-based QKD scheme that reduces transmitted quantum-channel usage to a single qubit per GHZ block, achieving transmitted-qubit efficiency 𝜂 = 𝐿 under the adopted metric. NetSquid simulations confirm 100% raw-key fidelity for 𝐿 ≤ 12 under both ideal conditions and depolarizing noise up to 𝑝 = 0.005 per round, with noise resilience following from the binary discrimination design in the tested regime. Our security analysis identifies four attack surfaces: entanglement measure, intercept-and-resend, QND-based eavesdropping, and reset leakage, and explains how 6

Scalable Quantum Key Distribution via GHZ Entanglement and Qubit Reuse

Preprint, 2026

authenticated classical communication, sampled CHSH-style integrity checks, and local reset verification mitigate them. Future work will validate the protocol on real quantum hardware, quantify reset success probability under device noise, and explore reducing the 2𝐿 classical bit overhead.

Computer. Advanced Quantum Technologies 4, 10 (2021), 2100061. [23] National Institute of Standards and Technology. 2024. Post-Quantum Cryptography Standards. Technical Report. NIST. FIPS 203, 204, 205. https: //csrc.nist.gov/pqc-standardization. [24] Dominik Niemietz, Pau Farrera, Stefan Langenfeld, and Gerhard Rempe. 2021. Nondestructive detection of photonic qubits. Nature 591 (2021), 570–574. https: //doi.org/10.1038/s41586-021-03290-z [25] Jian-Wei Pan, Dik Bouwmeester, Harald Weinfurter, and Anton Zeilinger. 1998. Experimental entanglement swapping: entangling photons that never interacted. Physical review letters 80, 18 (1998), 3891. [26] Abhishek Parakh. 2022. Quantum teleportation with one classical bit. Scientific reports 12, 1 (2022), 3392. [27] Massimiliano Proietti, Joseph Ho, Federico Grasselli, Peter Barrow, Mehul Malik, and Alessandro Fedrizzi. 2021. Experimental quantum conference key agreement. Science Advances 7, 23 (2021), eabe0395. [28] GJ Pryde, JL O’Brien, AG White, SD Bartlett, and TC Ralph. 2004. Measuring a photonic qubit without destroying it. Physical review letters 92, 19 (2004), 190402. [29] Huawang Qin and Yuewei Dai. 2017. Dynamic quantum secret sharing by using d-dimensional GHZ state. Quantum information processing 16 (2017), 1–13. [30] T. C. Ralph, S. D. Bartlett, J. L. O’Brien, G. J. Pryde, and H. M. Wiseman. 2006. Quantum nondemolition measurements for quantum information. Phys. Rev. A 73 (Jan 2006), 012113. Issue 1. https://doi.org/10.1103/PhysRevA.73.012113 [31] Andreas Reiserer, Stephan Ritter, and Gerhard Rempe. 2013. Nondestructive Detection of an Optical Photon. Science 342, 6164 (2013), 1349–1351. https: //doi.org/10.1126/science.1246164 [32] Lana Sheridan and Valerio Scarani. 2010. Security proof for quantum key distribution using qudit systems. Phys. Rev. A 82 (Sep 2010), 030301(R). Issue 3. https://doi.org/10.1103/PhysRevA.82.030301 [33] W Forrest Stinespring. 1955. Positive functions on C*-algebras. Proc. Amer. Math. Soc. 6, 2 (1955), 211–216. [34] Yajuan Zhao, Rui Zhang, Wenlan Chen, Xiang-Bin Wang, and Jiazhong Hu. 2021. Creation of Greenberger-Horne-Zeilinger states with thousands of atoms by entanglement amplification. NPJ Quantum Information 7, 1 (2021), 24.

References [1] Zehang Bao, Shibo Xu, Zixuan Song, Ke Wang, Liang Xiang, Zitian Zhu, Jiachen Chen, Feitong Jin, Xuhao Zhu, Yu Gao, Yaozu Wu, Chuanyu Zhang, Ning Wang, Yiren Zou, Ziqi Tan, Aosai Zhang, Zhengyi Cui, Fanhao Shen, Jiarun Zhong, Tingting Li, Jinfeng Deng, Xu Zhang, Hang Dong, Pengfei Zhang, Yang-Ren Liu, Liangtian Zhao, Jie Hao, Hekang Li, Zhen Wang, Chao Song, Qiujiang Guo, Biao Huang, and H. Wang. 2024. Creating and controlling global Greenberger-HorneZeilinger entanglement on quantum processors. Nature Communications 15, 1 (12 Oct 2024), 8823. https://doi.org/10.1038/s41467-024-53140-5 [2] Charles H Bennett. 1992. Quantum cryptography using any two nonorthogonal states. Physical review letters 68, 21 (1992), 3121. [3] Charles H. Bennett, Herbert J. Bernstein, Sandu Popescu, and Benjamin Schumacher. 1996. Concentrating partial entanglement by local operations. Physical Review A 53, 4 (1996), 2046–2052. https://doi.org/10.1103/PhysRevA.53.2046 [4] Charles H. Bennett and Gilles Brassard. 2014. Quantum cryptography: Public key distribution and coin tossing. Theoretical Computer Science 560 (2014), 7– 11. https://doi.org/10.1016/j.tcs.2014.05.025 Theoretical Aspects of Quantum Cryptography – celebrating 30 years of BB84. [5] Adán Cabello. 2000. Quantum key distribution in the Holevo limit. Physical Review Letters 85, 26 (2000), 5635. [6] Adán Cabello. 2000. Quantum key distribution without alternative measurements. Physical Review A 61, 5 (2000), 052312. [7] Carlos Cardoso-Isidoro and Francisco Delgado. 2022. Shared quantum key distribution based on asymmetric double quantum teleportation. Symmetry 14, 4 (2022), 713. [8] Valerie Coffman, Joydip Kundu, and William K Wootters. 2000. Distributed entanglement. Physical Review A 61, 5 (2000), 052306. [9] Tim Coopmans, Robert Knegjens, Axel Dahlberg, David Maier, Loek Nijsten, Julio de Oliveira Filho, Martijn Papendrecht, Julian Rabbie, Filip Rozpędek, Matthew Skrzypczyk, et al. 2021. Netsquid, a network simulator for quantum information using discrete events. Communications Physics 4, 1 (2021), 164. [10] Daniele Cozzolino, Beatrice Da Lio, Davide Bacco, and Leif Katsuo Oxenløwe. 2019. High-Dimensional Quantum Communication: Benefits, Progress, and Future Challenges. Advanced Quantum Technologies 2, 12 (2019), 1900038. https://doi.org/10.1002/qute.201900038 arXiv:https://advanced.onlinelibrary.wiley.com/doi/pdf/10.1002/qute.201900038 [11] Artur K Ekert. 1991. Quantum cryptography based on Bell’s theorem. Physical review letters 67, 6 (1991), 661. [12] Xing-Yan Fan, Jie Zhou, Hui-Xian Meng, Chunfeng Wu, Arun Kumar Pati, and Jing-Ling Chen. 2021. Greenberger–Horne–Zeilinger states: Their identifications and robust violations. Modern Physics Letters A 36, 31 (2021), 2150223. [13] Lior Goldenberg and Lev Vaidman. 1995. Quantum cryptography based on orthogonal states. Physical Review Letters 75, 7 (1995), 1239. [14] Philippe Grangier, Juan Ariel Levenson, and Jean-Philippe Poizat. 1998. Quantum non-demolition measurements in optics. Nature 396, 6711 (1998), 537–542. [15] Ali Javadi-Abhari, Simon Martiel, Alireza Seif, Maika Takita, and Ken X. Wei. 2025. Big cats: entanglement in 120 qubits and beyond. arXiv:2510.09520 [quant-ph] https://arxiv.org/abs/2510.09520 [16] Masato Koashi and Nobuyuki Imoto. 1997. Quantum cryptography based on split transmission of one-bit information in two steps. Physical Review Letters 79, 12 (1997), 2383. [17] Paul G. Kwiat, Salvador Barraza-Lopez, Andre Stefanov, and Nicolas Gisin. 2001. Experimental entanglement distillation and hidden non-locality. Nature 409 (2001), 1014–1017. https://doi.org/10.1038/35059017 [18] Zhihui Li, Xue Jiang, and Lu Liu. 2022. Multi-Party Quantum Secret Sharing Based on GHZ State. Entropy 24, 10 (2022), 1433. [19] Hsuan-Hao Lu, Muneer Alshowkan, Jude Alnas, Joseph M. Lukens, and Nicholas A. Peters. 2024. Procrustean entanglement concentration in quantumclassical networking. Physical Review Applied 21, 4 (2024), 044027. https: //doi.org/10.1103/PhysRevApplied.21.044027 [20] Yu Ma, You-Zhi Ma, Zong-Quan Zhou, Chuan-Feng Li, and Guang-Can Guo. 2021. One-hour coherent optical storage in an atomic frequency comb memory. Nature communications 12, 1 (2021), 2381. [21] Gary J Mooney, Gregory AL White, Charles D Hill, and Lloyd CL Hollenberg. 2021. Generation and verification of 27-qubit Greenberger-Horne-Zeilinger states in a superconducting quantum computer. Journal of Physics Communications 5, 9 (2021), 095004. [22] Gary J Mooney, Gregory AL White, Charles D Hill, and Lloyd CL Hollenberg. 2021. Whole-Device Entanglement in a 65-Qubit Superconducting Quantum 7

Related documents

• Recon?figurable measurement scheme compatible with MDI-QKD and BB84 protocols using single-laser sideband generation#821909
• Entanglement distribution protocols under imperfect fidelity and quantum memory conditions#246487
• Emulation of Entanglement Distribution Networks on a Quantum Computer#373356
• Scalable entanglement distribution using encoded hybrid repeater chains#1014369
• Processing Entangled Links Into Secure Cryptographic Keys#998054