A Quantum Detectable Byzantine Agreement Protocol using only EPR pairs

In this paper, we introduce a new quantum protocol for Detectable Byzantine Agreement. What distinguishes the proposed protocol among similar quantum protocols, is the fact that it uses only EPR pairs, and, in particular, $\Psi^{ + }$ pairs. There are many sophisticated quantum protocols that guarantee Detectable Byzantine Agreement, but they do not easily lend themselves to practical implementations, due to present-day technological limitations. For a large number $n$ of players, GHZ $n$-tuples, or other more exotic entangled states, are not easy to produce, a fact which might complicate the scalability of such protocols. In contrast, Bell states are, undoubtedly, the easiest to generate among maximally entangled states. This will, hopefully, facilitate the scalability of the proposed protocol, as only EPR pairs are required, irrespective of the number $n$ of players. Finally, we mention that, even for arbitrary many players $n$, our protocol always completes in a constant number of rounds, namely $4$.


Introduction
The term "Byzantine Agreement" has its origins in the landmark paper [1]. The paper studied the problem of using a playful terminology, involving Byzantium, a commanding general and many lieutenant generals, some loyal and some traitors. In another seminal work [2] the same authors had previously tackled the same problem but in a more formal way. The approach in [2] was perfectly distributed and symmetrical, whereas the approach in [1] has an slight asymmetry because the commanding general assumes the role of coordinating the lieutenant generals.
Currently, probably the most important application of Byzantine Agreement protocols would be in facilitating the implementation of a distributed consensus mechanism that enforces the consistency of data. Byzantine Agreement protocols are critical for successfully tackling distributed fault scenarios in the presence of adversaries (traitors) and enhancing the security of blockchain networks.
Today, it is clear that we have entered the quantum era. This is much more than a buzzword, as it promises to bring fundamental changes in our capabilities, indicated by the impressive progress in the construction of new, more powerful than before, quantum computers, such as IBM's 127 qubit processor Eagle [3] and the more recent 433 qubit Osprey [4] quantum processor. At the same time, caution is warranted because these new powerful quantum computers bring us closer to the practical implementation of the quantum algorithms developed by Peter Shor and Lov Grover [5,6], that can compromise the security of the classical world.
It is fitting that the quantum paradigm can also be employed to provide us with novel quantum algorithms that adequately protect our critical information and achieve uncompromised security. The of composite systems must be described as a linear combination of two or more product states of their subsystems, as a single product state will not suffice. The famous Bell states are special quantum states of two qubits, also called EPR pairs, that represent the simplest form of maximal entanglement. These states are succinctly described by the next formula from [33].
where |¯⟩ is the negation of | ⟩.
There are four Bell states and their specific mathematical expression is given below. The subscripts and are used to emphasize the subsystem to which the corresponding qubit belongs, that is, qubits |·⟩ belong to Alice and qubits |·⟩ belong to Bob.
For existing quantum computers that use the circuit model, it is quite easy to generate Bell states. The proposed protocol relies on |Ψ + ⟩ = |0⟩ |1⟩ +|1⟩ |0⟩ √ 2 pairs. Apart from |Ψ + ⟩ pairs, we shall make use of qubits in another well-known state, namely |+⟩. For convenience, we recall the definition of |+⟩ which can be immediately produced by applying the Hadamard transform on |0⟩. Let us also clarify that all quantum registers are measured with respect to the computational basis = {|0⟩ , |1⟩}.

Detectable Byzantine Agreement
In the landmark paper [1], the authors used the term the "Byzantine Generals Problem" to formulate the problem we study in this paper. A little later, two other influential works [34,35] changed the terminology a bit and refereed to the same problem as the "Byzantine Agreement Problem," a term that has been consistently used in the literature ever since. The problem itself involves generals of the Byzantine empire, one of them being the commanding general and the rest −1 being lieutenant generals. The commanding general must communicate his order to the lieutenant generals who are in different geographical locations. The overall situation is further complicated by the existence of traitors among the generals (possibly including even the commanding general). The notion of Byzantine Agreement was defined in [1] as follows. (BA 1 ) All loyal lieutenant generals follow the same order.
(BA 2 ) When the commanding general is loyal, all loyal lieutenant generals follow the commanding general's order.
The authors in [1] not only presented an algorithm that, under certain assumptions, achieves BA, but also obtained the significant result that, under the assumption of pairwise authenticated channels among the generals, BA can be attained if and only if < 3 , where is the number of generals and is the number of traitors. Later it was established that this bound can't be improved even if additional resources are assumed (see [36]). An important special illustration of this fact, is the case of = 3 generals, exactly one of which is a traitor because it is impossible to achieve BA in such a case, by any classical protocol.
In the seminal paper [21] a variant of BA called Detectable Byzantine Agreement (DBA from now on) was introduced. By slightly relaxing the requirements of the BA protocol, and, in particular, allowing the loyal generals to abort the protocol, an action that is not permitted in the original protocol, the authors were able to give the first quantum protocol for DBA. Their protocol relied on Aharonov states and improved the previous bound by achieving agreement in the special case of one traitor among three generals. Although [21] considered only the case of 3 generals, later works introduced DBA protocols for parties. In this work we use the Definition 2.2 for DBA.
Definition 2.2 (Detectable Byzantine Agreement). A protocol achieves Detectable Byzantine Agreement (DBA) if it satisfies the following conditions.
(DBA 1 ) If all generals are loyal, the protocol achieves Byzantine Agreement.
(DBA 2 ) Consistency. All loyal generals either follow the same order or abort the protocol.
(DBA 3 ) Validity. If the commanding general is loyal, then either all loyal lieutenant generals follow the commanding general's order or abort the protocol.
A comparison of Definition 2.1 with Definition 2.2 shows that the critical difference between BA and DBA lies in the extra capability of the generals to abort the protocol in the DBA case. As is common practice, we shall assume that the commanding general's orders are either 0 or 1, and we shall use the symbol ⊥ to signify that the decision to abort.

Assumptions and setting
In this section we begin the presentation of our EPR-based protocol for Detectable Byzantine Agreement, or EPRQDBA for short. For the sake of completeness, we explicitly state the assumptions that underlie the execution of the EPRQDBA protocol.
(A 1 ) There is a "quantum source" responsible for generating single qubits in the |+⟩ state and EPR pairs entangled in the |Ψ + ⟩ state. The source distributes these qubits to each general through a quantum channel.
(A 2 ) A complete network of pairwise authenticated classical channels connects all generals.
(A 3 ) The classical network is synchronous coordinated by a global clock.
(A 4 ) The protocol unfolds in rounds. In every round each general may receive messages, perform computations, and send messages. The messages sent during the current round are guaranteed to have arrived to their intended recipients by the beginning of the next round.
We follow the tradition and describe the EPRQDBA protocol as a game. The players in this game are the spatially distributed generals. It will be convenient to divide them into two groups. The commanding general alone comprises the first group. From now on the famous Alice will play the role of the commanding general. The − 1 lieutenant generals make up the second group. In the special case of = 3 that we shall examine shortly, the venerable Bob and Charlie will play the 2 lieutenant generals. In the general case, where > 3, we will mostly employ generic names such LT 0 , . . . , LT −2 , LT standing of course for "lieutenant general." Occasionally, to emphasize some point, we may use again Bob or Charlie. To make the presentation easier to follow, we shall first show how the EPRQDBA protocol works in the special case of only 3 players, namely Alice, Bod and Charlie.

Entanglement distribution phase
The EPRQDBA protocol can be conceptually organized into 3 distinct phases. The first is the entanglement distribution phase, which refers to the generation and distribution of qubits and entangled EPR pairs. As we have briefly explained in assumption (A 1 ), we assume the existence of a trusted quantum source that undertakes this role. It is a relatively easy task, in view of the capabilities of modern quantum apparatus. Hence, the quantum source will have no difficulty in producing • 2 qubits in the |+⟩ state by simply applying the Hadamard transform on |0⟩, and • 2 EPR pairs in the |Ψ + ⟩ state, which can be easily generated by contemporary quantum computers.
In the above scheme, the parameter is a properly chosen positive integer. Further suggestions regarding appropriate values of are provided in the mathematical analysis of the protocol.
Afterwards, the source transmits the qubits to the intended recipients through the quantum channels following the pattern outlined below. Figure 1: Qubits belonging to the same EPR pair are drawn in the same color. Red is used to indicate the EPR pairs shared between Alice and Bob, which occupy the odd-numbered positions in their quantum registers. Green is used for the EPR pairs shared between Alice and Charlie that occupy the even-numbered positions in their quantum registers. The gray qubits represent those in the |+⟩ state that occupy the remaining positions.
The end result is that the quantum registers of Alice, Bob and Charlie are populated as shown in Figure 1. Qubits of the same EPR pair are shown in the same color. Red is used to indicate the EPR pairs shared between Alice and Bob, which occupy the odd-numbered positions in their quantum registers. Analogously, green is used for the EPR pairs shared between Alice and Charlie that occupy the even-numbered positions in their quantum registers. The gray qubits represent those in the |+⟩ state that occupy the remaining positions in Bob and Charlie's registers.

Entanglement verification phase
This phase is crucial because the entire protocol is based on entanglement. If entanglement is not guaranteed, then agreement cannot not be guaranteed either. Obviously, the verification process can lead to two dramatically different outcomes. If entanglement verification is successfully established, then the EPRQDBA protocol is certain to achieve agreement. Failure of verification implies absence of the necessary entanglement. This could be attributed either to noisy quantum channels or insidious sabotage by an active adversary. Whatever the true reason is, the only viable solution is to abort the current execution of the protocol, and initiate the whole procedure again from scratch, after taking some corrective measures.
This phase is very important because if entanglement is broken, then agreement can't be guaranteed. For this reason, the entanglement verification phase has been extensively analyzed in the relative literature. The EPRQDBA protocol adheres to the previously established methods that have been introduced in previous works, such as [21,22,23,24,20]. In order to avoid repeating well-known techniques, we refer the reader to the these papers that describe in detail the implementation of this phase.

Agreement phase
The EPRQDBA protocol achieves detectable agreement during its third and last phase, aptly named agreement phase. Alice, Bob and Charlie initiate the agreement phase by measuring their quantum registers. The distribution scheme, as analyzed in Subsection 3.1, leads to some crucial correlations among the contents of Alice, Bob and Charlie's registers.
Definition 3.1. Let the bit vectors a, b, and c denote the contents of Alice, Bob and Charlie's registers after the measurement, and assume that their explicit form is as given below: The ℎ pair of a, 0 ≤ ≤ − 1, is the pair of bits 2 +1 2 , and is designated by a . Similarly, the ℎ pairs of b and c are designated by b and c . Hence, a, b, and c can be written succinctly as: We also define a special type of pair, termed the uncertain pair, that is denoted by u = ⊔⊔, where ⊔ is a new symbol, different from 0 and 1. In contrast, pairs consisting of bits 0 and/or 1 are called definite pairs.
When we want refer to either Bob's or Charlie's bit vector, but without specifying precisely which one, we will designate it by (3.7) According to the distribution scheme, Alice and Bob share the odd-numbered |Ψ + ⟩ = |0⟩ |1⟩ +|1⟩ |0⟩ √ 2 pairs, and Alice and Charlie share the even-numbered |Ψ + ⟩ = |0⟩ |1⟩ +|1⟩ |0⟩ √ 2 pairs. Therefore, the next Lemma 3.1 holds. Its proof is trivial and is omitted.   a ≠ b and a ≠ c , for every , 0 ≤ ≤ − 1 . (3.10) In the above relations (3.8) and (3.9), is the negation of . Visually, the situation regarding the correlations among corresponding bits is shown in Figure 2. Again bits resulting from the same EPR pair are shown in the same color.  . Alice sends to Bob and Charlie either the command 0 or the command 1. Besides her command, as a "proof ", she also sends an appropriate command vector. The idea is that the command vector for Bob is always different from the command vector for Charlie, even when the command is the same. For the command 0, the command vectors for Bob and Charlie are and , respectively, whereas for the command 1 the corresponding command vectors are 1 and 1 . The explicit form of the command vectors is the following. (3.14) A command vector, besides pairs containing 0 and 1 bits, also contains an approximately equal number of pairs consisting of ⊔ characters. When we want refer to a command vector, but without providing further details, we will designate it by   In a real implementation should certainly be greater (see Table 1). Let us assume that the contents of Alice, Bob and Charlie's registers are those shown in Figure  where the bit vectors a, b, and c denote the contents of Alice, Bob and Charlie's registers after the measurement. In this figure, the correlated pairs of bits are drawn with the same color. Specifically, as in all previous figures, red is used to indicate the pairs of bits that originated from the measurement of the EPR pairs shared between Alice and Bob, and which occupy the odd-numbered positions in their registers. Analogously, green depicts the pairs of bits that originated from the measurement of the EPR pairs shared between Alice and Charlie, which occupy the even-numbered positions in their registers. The remaining gray bits that appear in Bob and Charlie's registers come from qubits that were initially in the |+⟩ state.
By a simple observation of the red and green pairs of bits, we immediately see that Lemma 3.1 is verified. In every red pair, the two bits are complementary, i.e., the second bit is the negation of the first. This is due to the fact that their values are the result of the measurement of a |Ψ + ⟩ pair. The red pairs correlate Alice and Bob's registers. Exactly the same holds for the green pairs, which correlate Alice and Charlie's registers. The initial presence of the |Ψ + ⟩ pairs in the entanglement distribution phase, has manifested into classical correlation among the contents of Alice, Bob, and Charlie's registers during the agreement phase.
There are 12 pairs in a, b, and c. In each of them, the ℎ pair, 0 ≤ ≤ 11, contains the bits that occupy positions 2 + 1 and 2 , as shown in Figure 3. The bit in position 2 + 1 is the most significant bit of the ℎ pair and the bit in position 2 is the least significant bit.
Let us suppose that Alice sends the order 0. According to Definition 3.2, Alice must prove her order by sending the command vectors and to Bob and Charlie, respectively. The command vector is constructed by including the pairs in a with most significant bit 0 (irrespective of what the least significant bit is) and filling the gaps with the uncertain pair. Symmetrically, is constructed by including the pairs in a with least significant bit 0 (irrespective of what the most significant bit is) and filling the gaps with the uncertain pair. Thus, and are as given below (we have also repeated a to facilitate the comparison). Recalling Definition 3.3, we see that the sets P , ( ) and P , ( ) contain the positions in and , respectively, of the pairs consisting of the bits , . In view of (3.20) and (3.21), we derive that Let us now suppose that Alice sends the order 1. In this case, Alice must prove her order by sending the command vectors 1 and 1 to Bob and Charlie, respectively. The command vector 1 is constructed by including the pairs in a with most significant bit 1 (irrespective of what the least significant bit is) and filling the gaps with the uncertain pair. Symmetrically, 1 is constructed by including the pairs in a with least significant bit 1 (irrespective of what the most significant bit is) and filling the gaps with the uncertain pair. The resulting 1 and 1 are shown below (again, we have also repeated a to facilitate the comparison). The sets P , (1 ) and P , (1 ) contain the positions in 1 and 1 , respectively, of the , pairs. Taking into account (3.23) and (3.24), we see that In the present example, the value of the parameter is 12, which implies that 4 = 3. The cardinality of all the sets P 0,0 ( ), P 0,1 ( ), P 0,0 ( ), P 1,0 ( ), P 1,0 (1 ), P 1,1 (1 ), P 0,1 (1 ), and P 1,1 (1 ) is ≈ 3 = 4 , which verifies the next Lemma 3.2. Of course, the exact cardinality of some of these sets deviates slightly from the expected value 3, but this is not unexpected. As increases, the ratio of the deviation to will tend to 0. ⊳ Based on Definition 3.3, it is trivial to see that the next Lemma 3.2 holds. The notation | | is employed to designate the cardinality, i.e., the number of elements, of an arbitrary set .

Lemma 3.2 (Loyal Command Vector Properties). If Alice is loyal, her command vectors
, , 1 and 1 satisfy the following properties.
The agreement phase of the EPRQDBA protocol evolves in rounds. The actions taken by the Alice, Bob and Charlie in each round are described below. ★ If no inconsistencies are found, Bob preliminary accepts the received order.
Upon completion of the verification procedure, Bob sends to Charlie his preliminary decision together with the received command vector.
Symmetrically and in parallel, Charlie performs the same actions.
(Round 3 ) Bob compares his own initial decision with that of Charlie's.
★ Rule 3,1 : If Charlie's decisions coincides with Bob's preliminary decision, then Bob accepts as final his preliminary decision and terminates the protocol on his end.
★ In case Charlie's initial decision is different, then the following cases are considered.
□ Rule 3,2 : If Bob's decision is 0 (1) and Charlie's decision is to abort, then Bob sticks to his initial decision and terminates the protocol.
□ If Bob's decision is 0 (1) and Charlie's decision is 1, then Bob uses the Check-WCV Algorithm 2 to check Charlie's command vector against his own command vector for inconsistencies. ⋄ Rule 3,3 : If no inconsistencies are detected, then Bob aborts and terminates the protocol. ⋄ Rule 3,4 : Otherwise, Bob sticks to his preliminary decision and terminates the protocol.
□ If Bob's decision is to abort and Charlie's decision is 0 (or 1), then Bob uses the CheckWBV Algorithm 3 to check Charlie's command vector against his own bit vector for inconsistencies. ⋄ Rule 3,5 : If no inconsistencies are found, then Bob changes his final decision to 0 (1) and terminates the protocol.
⋄ Rule 3,6 : Otherwise, Bob sticks to his initial decision to abort and terminates the protocol.
Algorithms 1 -3 apply Lemmata 3.1 and 3.2 to determine whether a command vector is consistent, in which case they return TRUE. If they determine inconsistencies, they terminate and return FALSE. The names of Algorithms 2 and 3 are mnemonic abbreviations for "Check with Command Vector" and "Check with Bit Vector." It is important to explain their difference.
Without loss of generality, let us suppose that Bob received the order 0 and a consistent command vector v from Alice, while Charlie claims that he received the order 1. Charlie must convince Bob by sending Bob the command vector v he claims he received from Alice. Bob checks v for inconsistencies against his own v by invoking the Algorithm 2. Now, imagine that Bob received an inconsistent command vector v from Alice and his initial decision is to abort, while Charlie claims that he received the order 1. Charlie must convince Bob by sending Bob the command vector v he claims he received from Alice. In this situation, Bob does not have a consistent command vector v that he could use, so Bob must check v for inconsistencies against his own bit vector b by invoking the Algorithm 3.
In Algorithms 1, 2, and 3, we employ the following notation.
• , where = 0 or = 1, is the command being checked for consistency.
• v, is the command vector sent by Bod to Charlie (or vice versa).
In order to streamline the exposition of the text, all lengthy proofs are relocated in the Appendix A.
In the literature, all works focusing on the 3 player setting, assume that there is exactly one traitor among the 3, who can either be the commanding general or one of the lieutenant generals. If we assume that there is precisely one traitor among the 3, we can prove the following Propositions 3.3 and 3.4.

Proposition 3.3 (Loyal Alice).
If Alice is loyal, the 3 player EPRQDBA protocol will enable the loyal lieutenant general to agree with Alice. Specifically, if Alice and Bob are loyal and Charlie is a traitor, Bob will follow Alice's order. Symmetrically, if Alice and Charlie are loyal and Bob is a traitor, Charlie will follow Alice's order.
Proposition 3.4 (Traitor Alice). If Bob and Charlie are loyal and Alice is a traitor, the 3 player EPRQDBA protocol will enable Bob and Charlie to reach agreement, in the sense of both following the same order or both aborting. Let us continue Example 3.1, and examine first the scenario where a loyal Alice sends order 0 to both Bob and Charlie accompanied by the command vectors and as given by (3.20) and (3.21), respectively. We may distinguish the following cases.
• Both Bob and Charlie are loyal. Then, according to Rule 3,1 of the 3 player EPRQDBA Protocol 1, all 3 players agree to execute order 0.
• There is one traitor among Bob and Charlie. Without loss of generality we may assume that Charlie is the traitor, who tries to sabotage the agreement. What can he do?
⋄ Charlie may claim that he decided to abort because Alice sent him an inconsistent command vector. Then, according to Rule 3,2 of the 3 player EPRQDBA Protocol 1, Bob will stick to his initial decision, and, together with Alice, will agree to execute order 0. In this way, assumption (DBA 3 ) of the detectable Byzantine agreement protocol, stipulating that commanding general is loyal, then either all loyal lieutenant generals follow the commanding general's order or abort the protocol (recall Definition 2.2), is satisfied. The rationale behind this rule is that Bob, having already received a consistent command vector from Alice, is suspicious of Charlie's decision to abort, and decides to cling to his preliminary decision.
⋄ Charlie may claim that Alice gave the order 1, along with a consistent command vector 1 . Bob will then use the CheckWCV Algorithm 2 to check Charlie's command vector against his own command vector for inconsistencies. If Bob finds no inconsistencies, then, according to Rule 3,3 of the 3 player EPRQDBA Protocol 1, he will abort. Obviously, in such a case, Charlie will have won in sabotaging the agreement. Let's analyze the probability of this event. First, let's recall from (3.21) what Charlie knows with certainty. and his problem is to construct something resembling the real 1 , as given from (3.24). Charlie knows that the least significant bit of the uncertain pairs in is 1 and the most significant bit is 0 or 1, with equal probability 0.5. However, Charlie cannot know with certainty if the most significant bit of a specific uncertain pair is 0 or 1. Therefore, when guessing 1 , Charlie can make two detectable mistakes: (i) place a 0 in a wrong pair that is not actually contained in P 0,1 ( ), e.g., set the pair 10 as 01, or (ii) place a 1 in a wrong pair that appears in P 0,1 ( ), e.g., set pair 7 as 11. The situation from a probabilistic point of view resembles the probability of picking the one correct configuration out of many. The total number of configurations is equal to the number of ways to place 2 or 3 identical objects (0) into 5 distinguishable boxes. The probability that Charlie places all the 0s correctly is Thus, the probability that Charlie cheats successfully is just 0.1, even in this toy scale example with = 12. Consequently, Bob is bound to detect inconsistencies, which will lead him to apply Rule 3,4 of the 3 player EPRQDBA Protocol 1, cling to his initial decision, and, ultimately, achieve agreement with Alice.
The situation where a loyal Alice sends order 1 to both Bob and Charlie is identical. Let us now examine the second major scenario where a traitor Alice intends to prevent the loyal Bob and Charlie from recanting agreement. In view of Definition 2.2, this precludes the cases where Alice sends to both of them inconsistent command vectors, or the same order, accompanied by appropriate consistent command vectors. In reviewing her remaining options, we distinguish the following cases.
• Alice sends an order, say 0, along with a consistent command vector to Bob and an inconsistent one to Charlie. In this case, Bob will stick to his initial decision, but Charlie will use the CheckWBV Algorithm 3 to verify Bob's command vector. In doing so, Charlie will crosscheck , given by (3.20), with his own bit vector c from (3.18). Charlie will count the 00 and 01 pairs in to find that they are 4 and 2, pretty close to the expected value 3, and in all these pairs the least significant bit is the negation of his corresponding bit, as dictated by the original |Ψ + ⟩ entanglement. Hence, Charlie will successfully verify Bob's command vector, and, according to the Rule 3,5 of the 3 player EPRQDBA Protocol 1, he will change his decision to that of Bob, thereby reaching the desired agreement. The rationale behind this rule is that Charlie, having already received an inconsistent command vector from Alice, is suspicious of Alice. His suspicion is confirmed when he verifies Bob's command vector, considering that it high unlikely for Bob to have forge a consistent command vector. Thus, he decides to change his preliminary decision to that of Bob.
• Alice sends to Bob and Charlie different orders with consistent command vectors. Let us assume, without loss of generality, that Alice sends the order 0 together with a consistent command vector to Bob and the order 1 together with a consistent command vector 1 to Charlie. Bob knows the positions of almost all 00 and 01 pairs in a. If Alice had forged even a single 10 or 11 pair, claiming to be either 00 or 01, then Bob, when using the CheckAlice Algorithm 1, he would have immediately detected the inconsistency. Symmetrically, Charlie knows the positions of almost all 01 and 11 pairs in a. According to the rules of the protocol, Bob will sent to Charlie the command vector , and, simultaneously, Charlie will send to Bob the command vector 1 . Both will use the CheckWCV Algorithm 2 to verify the consistency of the others' command vector. Then, according to Rule 3,3 , both Bob and Charlie will abort, again fulfilling the requirements of DBA.  Proof. The fundamental assumption (DBA 2 ) of any detectable Byzantine agreement protocol, stipulates that all loyal generals either follow the same order or abort the protocol (recall Definition 2.2). When there is only one loyal general, no matter whether he is the commanding general or a lieutenant general, whatever he decides is perfectly fine, as there is no other loyal party that he must agree with. □ The next theorem is an obvious consequence of Propositions 3.3 and 3.4, and Corollary 3.5.

The player EPRQDBA protocol
In this section we present the general form of the EPRQDBA protocol that can handle any number > 3 generals who are spatially distributed. To be precise, we assume that Alice is the unique commanding general, who tries to coordinate her − 1 lieutenant generals LT 0 , . . . , LT −2 , LT being an abbreviation for "lieutenant general." As in the 3 player case, the player form of the EPRQDBA protocol can be conceptually divided into 3 distinct phases, which we describe below.

The player entanglement distribution phase
The first phase is the entanglement distribution phase that involves the generation and distribution of qubits and entangled EPR pairs. As we have mentioned in assumption (A 1 ), we assume the existence of a trusted quantum source that undertakes this role. It is a relatively easy task, in view of the capabilities of modern quantum apparatus. Hence, the quantum source will have no difficulty in producing • ( − 2) ( − 1) qubits in the |+⟩ state by simply applying the Hadamard transform on |0⟩, and • ( − 1) EPR pairs in the |Ψ + ⟩ state, which can be easily generated by modern quantum computers.
The parameter plays an important role and should be a sufficiently large positive integer. The forthcoming mathematical analysis of the protocol contains additional discussion regarding . The source distributes the produced qubits according to the next scheme. The end result is that the quantum registers of Alice and her −1 lieutenant generals LT 0 , . . . , LT −2 , are populated as shown in Figure 4. Qubits of the same EPR pair are shown in the same color. Green is used to indicate the EPR pairs shared between Alice and LT 0 , which occupy those positions that satisfy the relation ≡ 0 mod ( − 1) in their quantum registers. Analogously, red is used for the EPR pairs shared between Alice and LT 1 occupying positions that satisfy the relation ≡ 1 mod ( − 1) in their quantum registers, and blue indicates EPR pairs shared between Alice and LT −2 occupying positions that satisfy the relation ≡ − 2 mod ( − 1). The gray qubits represent those in the |+⟩ state that occupy the remaining positions in the quantum registers of the lieutenant generals.

The player entanglement verification phase
This phase is extremely important because the entire protocol is based on entanglement. If entanglement is not guaranteed, then agreement cannot not be guaranteed either. The verification process can lead to two dramatically different outcomes. If entanglement verification is successfully established, then the EPRQDBA protocol is certain to achieve agreement. Failure of verification implies absence of the necessary entanglement. This may be attributed either to noisy quantum channels or insidious sabotage by an active adversary. Whatever the true reason is, the only viable solution is to abort the current execution of the protocol, and initiate the whole procedure again from scratch, after taking some corrective measures.
One should not underestimate the significance of this phase. Many previous papers have comprehensively and thoroughly studied this phase. The EPRQDBA protocol subscribes to the sophisticated methods that have already been described in the literature, such as [21,22,23,24,20]. The interested reader may consult these works and the references therein for further analysis.

The player agreement phase
The EPRQDBA protocol achieves detectable agreement during its third and last phase, aptly named agreement phase. The agreement phase begins when Alice and her − 1 lieutenant generals LT 0 , . . . , LT −2 measure their quantum registers. By recalling the distribution scheme of Subsection 4.1, we see that certain important correlations among Alice's register and the registers of her lieutenant generals have been established. We also use the notion of the uncertain ( − 1)-tuple, denoted by u = ⊔ · · · ⊔, where ⊔ is a new symbol, different from 0 and 1. In contrast, ( − 1)-tuples consisting of bits 0 and/or 1 are called definite tuples.
a ≠ l , for every , 0 ≤ ≤ − 1 . Besides her order, as a "proof," she also sends an appropriate command vector. The idea is that the command vector for every lieutenant general is always different, even when the command is the same. For the order 0, the command vector sent to every lieutenant general LT , 0 ≤ ≤ − 2, is , whereas for the order 1 the corresponding command vector is 1 . The explicit form of the command vectors is the following.
A command vector besides tuples comprised entirely of 0 and 1 bits, also contains an approximately equal number of tuples consisting of ⊔ characters. When we want refer to a command vector, but without providing further details, we will designate it by Given a command vector or a bit vector, we gather in a set the positions of the ( − 1)-tuples that contain a specific combination of bits. Likewise, the set of the positions of their ( − 1)-tuples that contain bit ∈ {0, 1} in the ℎ place is denoted by T → (v) and T → (l ), respectively.
In view of Definition 4.2, it is trivial to see that the assertions of the next Lemma 4.2 are valid, where the notation | | is employed to designate the cardinality, i.e., the number of elements, of an arbitrary set .
• |T →1 →1 (1 )| ≈ 4 . As expected the protocol evolves in rounds. The actions of the generals in each round are explained below. In the exposition of Protocol 2, we have made a few plausible assumptions regarding the behavior of traitors, which we state below.
(T 1 ) If Alice is loyal, then the traitors do not possess any inside information. This means that for a disloyal lieutenant general it will be probabilistically impossible to forge a consistent command vector. On this fact actually relies the soundness of the protocol when Alice is loyal.
(T 2 ) The disloyal lieutenant general manifest their traitorous behavior at the end of (Round 2 ), either by falsely claiming that their decision is to abort, or by sending contradictory orders accompanied by consistent command vectors to different lieutenant generals. However, their behavior is consistent in the sense that they always send identical information to the same lieutenant general, i.e., at the end of (Round 3 ) they transmit exactly the same decision they sent at the end of (Round 2 ). ★ If no inconsistencies are found, LT 's initial decision is (2) = .
Send ⊲ Upon completion of the verification procedure, LT sends to all other lieutenant generals LT , 0 ≤ ≠ ≤ − 2, his initial decision (2) together with v as proof.
★ If there is at least one (2) such that (2) ≠ (2) , then the following cases are considered. □ If (2) = ⊥ and there exist different (2) , then LT uses the CheckLTwBV Algorithm 6 to check the corresponding v .  □ If LT 's decision is 0 (1) and at least one different decision is 1 (0), then LT uses the CheckLTwCV Algorithm 5 to check the command vectors of all lieutenant generals whose intermediary decision is 1 (0) for inconsistencies.
⋄ Rule 4,5 : If there exists at least one command vector with no inconsistencies, then LT aborts and terminates the protocol. ⋄ Rule 4,6 : Otherwise, LT clings to his intermediary decision.
The following algorithms apply Lemmata 4.1 and 4.2 to determine whether a command vector is consistent, in which case they return TRUE. If they determine inconsistencies, they terminate and return FALSE. The names of Algorithms 5 and 6 are mnemonic abbreviations for "Check LT with Command Vector" and "Check LT with Bit Vector." To clear up things, we explain their difference.
Without loss of generality, let us suppose that LT received the order 0 and a consistent command vector v from Alice, while LT claims that he received the order 1. According to the EPRQDBA protocol, LT must convince LT by sending the command vector v he claims he received from Alice. LT checks v for inconsistencies against his own v by invoking the Algorithm 5. Now, suppose that LT received an inconsistent command vector v from Alice and his initial decision is to abort, while LT claims that he received the order 1. LT must convince LT by sending the command vector v he claims he received from Alice. In this situation, LT does not have a consistent command vector v that he could use, so LT must check v for inconsistencies against his own bit vector b by invoking the Algorithm 6.
In Algorithms 4, 5, and 6, we employ the following notation.
• , 0 ≤ ≤ − 2, is the index of the lieutenant general who does the consistency checking.
• , 0 ≤ ≠ ≤ − 2, is the index of the lieutenant general whose command vector is being checked for consistency.
• , where = 0 or = 1, is the command being checked for consistency.
• v is the command vector sent by the lieutenant general LT . • △ is the symmetric difference of two sets, i.e., △ ′ = ( \ ′ ) ( ′ \ ), for given sets and ′ .
We now proceed to formally prove that the EPRQDBA protocol enables all the loyal generals to reach agreement.   In closing we may ask what will happen if there are − 1 traitors and only one loyal general. It might be that the − 1 traitors are the − 1 lieutenant generals, or Alice and − 2 of her lieutenant generals. Again, this case turns to be very easy. The crucial assumption (DBA 2 ) of any detectable Byzantine agreement protocol, stipulates that all loyal generals either follow the same order or abort the protocol (recall Definition 2.2). When there is only one loyal general, maybe Alice herself, or one of the lieutenant generals, any decision taken would be fine, as there is no other loyal party that to agree with.

Discussion and conclusions
This paper introduced the quantum protocol EPRQDBA that achieves Detectable Byzantine Agreement for an arbitrary number of players.
The EPRQDBA protocol has a number of advantages to offer.
• It is completely general because it can handle any number of players.
• It takes only a constant number of rounds, namely 3, to complete, no matter how many players there are.
• It requires only EPR (specifically |Ψ + ⟩) pairs, irrespective of the number of players. This is probably the most important quality of the protocol. Without a doubt, EPR pairs are the easiest to produce among all maximally entangled states. In comparison, even | ⟩ states, would not be able to scale well as increases, not to mention other more difficult to create entangled states.
All the above qualities advocate for its scalability and its potential applicability in practice. To drive further this point, we present the numerical characteristics of the EPRQDBA protocol in the following Table 1.
Parameter is independent of the number of players , which is another plus for the scalability of the protocol. Obviously, a proper value for must be selected in order to ensure that the probability that a traitor can forge a command vector is negligible. The reason why does not scale with is that the protocol always uses EPR pairs, that is, bipartite entanglement. The rules of the protocol dictate that every consistency check takes place between two command vectors, or between a command vector and a bit vector. Therefore, in every case the comparison involves just 2 strings of bits, irrespective of the number of generals. Moreover, this comparison, even in the most general case, involves just 2 bits, say and , in every − 1 tuple. Thus, the situation from a probabilistic point of view is always identical with the 3 player case. In a final analysis, the probability that a traitor deceives a loyal general, is the probability of picking the one correct configuration out of many. The total number of configurations is equal to the number of ways to place ≈ 4 identical objects (either 0 or 1, depending on the order) into ≈ 2 distinguishable boxes (the uncertain tuples). The probability that a traitor places all the ≈ 4 bits correctly in the ≈ 2 uncertain tuples is which tends to zero as increases. Table 1: This table summarizes the numerical characteristics of the EPRQDBA protocol. The abbreviations "bpm" and "tb" stand for "bits per message" and "total bits," respectively.

Bits & Messages
Round # of messages # bits per message Total # of bits

Appendices A Proofs of the Main Results
In this Appendix we formally prove the main results of this paper.
Proposition A.1 (Loyal Alice). If Alice is loyal, the 3 player EPRQDBA protocol will enable the loyal lieutenant general to agree with Alice. Specifically, if Alice and Bob are loyal and Charlie is a traitor, Bob will follow Alice's order. Symmetrically, if Alice and Charlie are loyal and Bob is a traitor, Charlie will follow Alice's order.
Proof of Proposition A.1.
We assume that Alice is loyal and, without loss of generality, that Alice conveys the command 0 to both Bob and Charlie, along with the appropriate command vectors as proof. These command vectors satisfy the properties asserted in Lemma 3.2.
Let us also assume that Bob is loyal. Consequently, Bob will use the Algorithm 1 to verify the validity of the received command vector .
According to the rules of the 3 player EPRQDBA Protocol 1, the only way for Bob to change his initial decision and abort is if Charlie sends to Bob a valid command vector 1 . In such a case Charlie would be a traitor that has in reality received the command vector during (Round 1 ). Can Charlie construct a convincing 1 ?
Bob, having received the command vector , knows the positions of all the pairs in a of the form 2 +1 2 , such that 2 +1 = 0 and 2 = 1, 0 ≤ ≤ − 1.
Having , Charlie knows that the least significant bit of the ≈ 2 uncertain pairs in is 1 and the most significant bit is 0 or 1, with equal probability 0.5. However, Charlie cannot know with certainty if the most significant bit of a specific uncertain pair is 0 or 1. Therefore, when constructing 1 , Charlie can make two detectable mistakes.
(M 1 ) Place a 0 in a wrong pair that is not actually contained in P 0,1 ( ).
(M 2 ) Place a 1 in a wrong pair that appears in P 0,1 ( ).
The situation from a probabilistic point of view resembles the probability of picking the one correct configuration out of many. The total number of configurations is equal to the number of ways to place ≈ 4 identical objects (0) into ≈ 2 distinguishable boxes. The probability that Charlie places all the ≈ 4 bits 0 correctly in the ≈ 2 uncertain pairs is ( Charlie places all 0 correctly ) ≈ 1 which tends to zero as increases. Put it another way, the cardinality of the symmetric difference P 0,1 ( ) △ P 0,1 (1 ) will be significantly greater than 0 from a statistical point of view.
Hence, when Bob uses the Algorithm 2 during (Round 3 ) to verify the validity of the command vector 1 sent by Charlie, he will detect inconsistencies and stick to his preliminary decision. Ergo, Bob follows Alice's order.
The case where Alice conveys the command 1 is virtually identical. Finally, the situation where Alice and Charlie are loyal and Bob is a traitor, is completely symmetrical. □ Proposition A.2 (Traitor Alice). If Bob and Charlie are loyal and Alice is a traitor, the 3 player EPRQDBA protocol will enable Bob and Charlie to reach agreement, in the sense that they will either follow the same order or abort.

Proof of Proposition A.2.
Let us now consider the case where the commanding general Alice is a traitor, but both Bob and Charlie are loyal. We distinguish the following cases.
• Alice sends a consistent command vector to Bob (Charlie) and an inconsistent command vector to Charlie (Bob). In this case, Bob (Charlie) will stick to his initial decision, but Charlie (Bob) will use the CheckWBV Algorithm 3 to verify Bob's (Charlie's) command vector. Then, according to Rule 3,5 of the 3 player EPRQDBA Protocol 1, Charlie (Bob) will change his decision to that of Bob (Charlie).
• Alice sends to Bob and Charlie different orders with consistent command vectors. Let us assume, without loss of generality, that Alice sends the order 0 together with a consistent command vector to Bob and the order 1 together with a consistent command vector 1 to Charlie.
Bob knows the positions of almost all 00 and 01 pairs in a. If Alice had forged even a single 10 or 11 pair, claiming to be either 00 or 01, then Bob, when using the CheckAlice Algorithm 1, he would have immediately detected the inconsistency. Therefore, Bob knows the sets Symmetrically, Charlie knows the positions of almost all 01 and 11 pairs in a: , and ( PA.2.iii) According to the rules of the protocol, Bob will sent to Charlie the command vector , and, simultaneously, Charlie will send to Bob the command vector 1 . Both will use the CheckWCV Algorithm 2 to verify the consistency of the others' command vector. Then, according to Rule 3,3 , both Bob and Charlie will abort.
• Alice sends to both Bob and Charlie inconsistent command vectors. Then, according to Rule 3,1 of the protocol, both Bob and Charlie agree to abort.
Ergo, both Bob and Charlie will either follow the same order or abort. □ Proposition A.3 ( Player Loyal Alice). If Alice is loyal, then the player EPRQDBA protocol will enable all loyal lieutenant generals to follow Alice's order.
Proof of Proposition A.3.
We assume that Alice is loyal and, without loss of generality, we suppose that Alice conveys the command 0 to all her lieutenant generals, along with the appropriate command vectors as proof. These command vectors satisfy the properties asserted in Lemma 4.2.
Let us consider an arbitrary loyal lieutenant general LT , 0 ≤ ≤ − 2. LT will use the Algorithm 4 to verify the validity of the received command vector . Hence, LT will have accepted order 0 at the end of (Round 2 ).
According to the rules of the player EPRQDBA Protocol 2, the only way for LT to change his initial decision and abort is if another LT , 0 ≤ ≠ ≤ − 2, sends to LT his decision 1 accompanied by a valid command vector 1 . Such an LT would, of course, be a traitor that has in reality received the command vector during (Round 1 ). Can such an LT construct a convincing 1 ? LT , having received the command vector , knows the positions of all the ( − 1)-tuples in a that contain 0 in the ℎ position and 1 in the ℎ position. (M 2 ) Place a 1 in the ℎ place of a wrong ( − 1)-tuple that appears in T →0 →1 ( ). The situation from a probabilistic point of view resembles the probability of picking the one correct configuration out of many. The total number of configurations is equal to the number of ways to place ≈ 4 identical objects into ≈ 2 distinguishable boxes. Hence, the probability that LT places all the ≈ 4 bits 0 correctly in the ≈ 2 uncertain ( − 1)-tuples is ( LT places all 0 correctly ) ≈ 1 which is practically zero for sufficiently large . Thus, the cardinality of the symmetric difference will be significantly greater than 0 from a statistical point of view. Hence, when LT uses the Algorithm 5 during (Round 3 ) to verify the validity of the command vector 1 sent by LT , he will detect inconsistencies and stick to his preliminary decision. Ergo, LT and all loyal lieutenant generals will be included in 0 at the end of the protocol.
The case where Alice conveys the command 1 is identical. □ Then, during (Round 3 ), LT will set his intermediary decision to (3) = 0, and, at the end of (Round 3 ), will communicate to every other lieutenant general his intermediary decision (3) = 0, together with his intermediary proof (3) = .
In this scenario, all loyal lieutenant generals to set their final decision to 0 during (Round 4 ), thereby agreeing to follow order 0 at the end of the protocol.
According to assumption (T 2 ), at the end of (Round 3 ), each disloyal LT will transmit the same decision he sent at the end of (Round 2 ) to each other lieutenant general, i.e., ⊥ or 0. As a result, the decisions of the loyal lieutenant generals, will not be affected.
□ At least one disloyal LT sends to at least one loyal LT his initial decision (2) → = 0 and proof (2) → = , and at least one disloyal LT sends to at least one loyal LT (conceivably = ) his initial decision (2) → = 1 and proof (2) → = 1 . In this subcase, it does not matter what the remaining disloyal lieutenant generals do at the end of (Round 2 ).
The important point here is that the contradictory orders 0 and 1, both accompanied by consistent proofs, are sent to at least one loyal lieutenant general at the end of (Round 2 ).
Then, during (Round 3 ), LT will set his intermediary decision to (3) = 0, and, at the end of (Round 3 ), will communicate to every other lieutenant general his intermediary decision □ Every disloyal LT conveys to all loyal LT that his initial decision is (2) → = ⊥ with initial proof (2) → = . Then, during (Round 3 ), every loyal LT will cling to his decision to abort, and, at the end of (Round 3 ), will communicate to every other lieutenant general his intermediary decision (3) = ⊥, together with his proof (3) = . This will cause all other loyal lieutenant generals to set their final decision to ⊥ during (Round 4 ), thereby achieving agreement by aborting at the end of the protocol. This will cause all loyal lieutenant generals to finalize their decision to abort during (Round 4 ), thereby achieving agreement by aborting at the end of the protocol.
According to assumption (T 2 ), at the end of (Round 3 ), each disloyal LT will transmit the same decision ⊥ he sent at the end of (Round 2 ) to each other lieutenant general. As a result, the decisions of the loyal lieutenant generals, will not be affected.
• During (Round 2 ) all loyal lieutenant generals receive and verify the same order from Alice. Without loss of generality, we may suppose that the order in question is 0.
Accordingly, at the end of (Round 2 ), each loyal lieutenant general LT communicates to every other lieutenant general his initial decision (2) = 0 and his initial proof (2) = .
Let us consider the possible actions of the disloyal lieutenant generals at the end of (Round 2 ).
□ At least one disloyal LT transmits to at least one loyal LT his initial decision (2) → = 1 with a consistent initial proof (2) → = 1 . Then, during (Round 3 ), LT will set his intermediary decision to (3) = ⊥, and, at the end of (Round 3 ), will communicate to every other lieutenant general his intermediary decision (3) = ⊥, together with his intermediary proof (3) = 1 . This will cause all other loyal lieutenant generals to set their final decision to ⊥ during (Round 4 ), thereby achieving agreement by aborting at the end of the protocol.
We emphasize that each disloyal LT does not necessarily send the same decision to every loyal lieutenant general; he may send different decisions to different loyal lieutenant generals.
Then, during (Round 3 ), every LT will cling to his initial decision and set his intermediary decision to (3) = 0, and, at the end of (Round 3 ), will communicate to every other lieutenant general his intermediary decision (3) = 0, together with his intermediary proof (3) = .
In this scenario, all loyal lieutenant generals to set their final decision to 0 during (Round 4 ), thereby agreeing to follow order 0 at the end of the protocol.
According to assumption (T 2 ), at the end of (Round 3 ), each disloyal LT will transmit the same decision he sent at the end of (Round 2 ) to each other lieutenant general, i.e., ⊥ or 0. As a result, the decisions of the loyal lieutenant generals, will not be affected.
• During (Round 2 ) at least one loyal lieutenant general LT receives the order 0 and the consistent command vector from Alice, and at least one loyal lieutenant general LT receives the order 1 and the consistent command vector 1 from Alice. In this scenario, it does not matter what the remaining disloyal lieutenant generals do at the end of (Round 2 ).
The important point here is that the contradictory orders 0 and 1, both accompanied by consistent proofs, are sent to two loyal lieutenant generals at the end of (Round 2 ). Accordingly, at the end of (Round 2 ), LT communicates to every other lieutenant general his initial decision (2) = 0 and his initial proof (2) = , and LT communicates to every other lieutenant general his initial decision (2) = 1 and his initial proof (2) = 1 .
Then, during (Round 3 ), all loyal lieutenant generals set their intermediary decision to ⊥, and, during (Round 4 ), all loyal lieutenant generals set their final decision to ⊥, thereby achieving agreement by aborting at the end of the protocol.
• During (Round 2 ) some loyal lieutenant generals receive and verify the same order from Alice, which, without loss of generality, we may suppose that is 0, and the remaining loyal lieutenant generals receive inconsistent command vectors from Alice.
Let us consider the possible actions of the disloyal lieutenant generals at the end of (Round 2 ).

□ Every other disloyal LT tells each loyal LT either
⋄ that his initial decision is (2) → = ⊥ with initial proof (2) → = , or ⋄ that his initial decision is (2) → = 0, with initial proof (2) → = . Then, during (Round 3 ), every loyal LT will set his intermediary decision to (3) = 0, and, during (Round 4 ), all loyal lieutenant generals set their final decision to 0, thereby agreeing to follow order 0 at the end of the protocol.
According to assumption (T 2 ), at the end of (Round 3 ), each disloyal LT will transmit the same decision he sent at the end of (Round 2 ) to each other lieutenant general, i.e., ⊥ or 0. As a result, the decisions of the loyal lieutenant generals, will not be affected.
□ At least one disloyal LT sends to at least one loyal LT his initial decision (2) → = 1 and proof (2) → = 1 . In this subcase, it does not matter what the remaining disloyal lieutenant generals do at the end of (Round 2 ).
The important point here is that the contradictory order 1, together with consistent proof, is sent to at least one loyal lieutenant general at the end of (Round 2 ).
Then, during (Round 3 ), LT , having received two contradictory orders with consistent proofs, will set his intermediary decision to (3) = ⊥, and, at the end of (Round 3 ), will communicate to every other lieutenant general his intermediary decision (3) = ⊥, together with his proof (3) = , 1 . This will cause all other loyal lieutenant generals to set their final decision to ⊥ during (Round 4 ), thereby achieving agreement by aborting at the end of the protocol.
□ Every disloyal LT conveys to all loyal LT that his initial decision is (2) → = ⊥ with initial proof (2) → = . Then, during (Round 3 ), every loyal LT will set his intermediary decision to 0, and, at the end of (Round 3 ), will communicate to every other lieutenant general his intermediary decision (3) = 0, together with his proof (3) = . This will cause all other loyal lieutenant generals to set their final decision to 0 during (Round 4 ), thereby achieving agreement by aborting at the end of the protocol. This will cause all loyal lieutenant generals to finalize their decision to abort during (Round 4 ), thereby agreeing to follow order 0 at the end of the protocol.
According to assumption (T 2 ), at the end of (Round 3 ), each disloyal LT will transmit the same decision ⊥ he sent at the end of (Round 2 ) to each other lieutenant general. As a result, the decisions of the loyal lieutenant generals, will not be affected.
Ergo, all loyal lieutenant generals will reach agreement. □