### 4.1 Outside attack

In the proposed SQPC protocol, TP sends \(T_{1}\) to Alice and \(T_{3}\) to Bob firstly, and then transmits \(T_{5}\) and \(T_{6}\) to Alice and Bob, respectively. For clarity, we firstly analyze the security of transmission of \(T_{1}\) or \(T_{3}\), and then validate the security of transmissions of \(T_{5}\) and \(T_{6}\).

*Case 1: Eve attacks*
\(T_{1}\)
*when it goes from TP to Alice or*
\(T_{3}\)
*when it goes from TP to Bob*

In the proposed SQPC protocol, \(T_{1}\), which is independent from \(T_{3}\), essentially plays the same role to \(T_{3}\). Thus, for simplicity, we only analyze the transmission security of \(T_{1}\) from TP to Alice and back to TP.

(1) The intercept-resend attack

During the transmission of \(T_{1}\) from TP to Alice and back to TP, Eve may try her best to obtain \(S_{1}\) by launching the following attack: Eve may intercept the particles of \(T_{1}\) from TP to Alice and send the fake particles she generated in the *Z* basis beforehand to Alice. However, Eve will be inevitably detected due to the following two reasons: on one hand, the fake particles she prepared beforehand may be different from the genuine ones in \(T_{1}\); and on the other hand, she doesn’t know Alice’s operations, which are random in fact. Concretely speaking, when TP sends one particle of \(T_{1}\) to Alice, Eve intercepts it and sends the prepared fake one to Alice. Without loss of generality, assume that the fake one prepared by herself is in the state of \(\vert 0 \rangle \). As a result, if Alice chooses to MEASURE, her measurement result will be \(\vert 0 \rangle \). After Alice tells TP her operation, TP uses the *Z* basis to measure the corresponding particle in \(T_{2}\) and obtains the measurement result randomly in one of the two states \(\vert 0 \rangle \) and \(\vert 1 \rangle \). Hence, if Alice chooses to MEASURE, Eve will be detected with the probability of \(\frac{1}{2}\). If Alice chooses to REFLECT, TP will receive the fake particle. After Alice tells TP her operation, TP measures the fake particle and the corresponding particle in \(T_{2}\) with the Bell basis, and obtains the measurement result randomly in one of the four states \(\vert \psi ^{ +} \rangle \), \(\vert \psi ^{ -} \rangle \), \(\vert \phi ^{ +} \rangle \) and \(\vert \phi ^{ -} \rangle \), where \(\vert \psi ^{ -} \rangle = \frac{1}{\sqrt{2}} ( \vert 01 \rangle - \vert 10 \rangle )\) and \(\vert \phi ^{ \pm} \rangle = \frac{1}{\sqrt{2}} ( \vert 00 \rangle \pm \vert 11 \rangle )\). Hence, if Alice chooses to REFLECT, Eve will be detected with the probability of \(\frac{3}{4}\). To sum up, when Eve launches this kind of attack on one particle of \(T_{1}\), the probability that she will be discovered is \(\frac{1}{2} \times \frac{1}{2} + \frac{1}{2} \times \frac{3}{4} = \frac{5}{8}\).

(2) The measure-resend attack

In order to obtain \(S_{1}\), Eve may intercept the particles of \(T_{1}\) sent from TP to Alice, measure them with the *Z* basis and send the resulted states to Alice. However, this kind of attack from Eve will be inevitably discovered, since Alice’s operations are random. Concretely speaking, after Eve’s measurement, the particle Eve sends to Alice is randomly in one of the two states \(\vert 0 \rangle \) and \(\vert 1 \rangle \). Without loss of generality, assume that the particle after Eve’s measurement is in the state of \(\vert 0 \rangle \). If Alice chooses to MEASURE, after she tells TP her operation, TP uses the *Z* basis to measure the corresponding particle in \(T_{2}\) and obtains the measurement result \(\vert 1 \rangle \). Hence, if Alice chooses to MEASURE, Eve will be detected with the probability of 0. If Alice chooses to REFLECT, after she tells TP her operation, TP measures the received particle from Alice and the corresponding particle in \(T_{2}\) with the Bell basis, and obtains the measurement result randomly in one of the two states \(\vert \psi ^{ +} \rangle \) and \(\vert \psi ^{ -} \rangle \). Hence, if Alice chooses to REFLECT, Eve will be detected with the probability of \(\frac{1}{2}\). To sum up, when Eve launches this kind of attack on one particle of \(T_{1}\), the probability that she will be discovered is \(\frac{1}{2} \times 0 + \frac{1}{2} \times \frac{1}{2} = \frac{1}{4}\).

(3) The entangle-measure attack

Eve may try to obtain something useful by entangling her auxiliary qubit with the transmitted qubit. Eve’s entangle-measure attack on the particles of \(T_{1}\), depicted as Fig. 2, can be modeled with two unitary operations *Ê* and *F̂*. Here, *Ê* attacks the qubit sent from TP to Alice, while *F̂* attacks the qubit returned from Alice to TP. Moreover, *Ê* and *F̂* share a common probe space with the initial state \(\vert \varepsilon \rangle _{E}\). According to Refs. [29, 30], the shared probe permits Eve to attack the returned particles depending on the knowledge obtained from *Ê*; and any attack where Eve would make *F̂* depend on a measurement after performing *Ê* can be realized by *Ê* and *F̂* with controlled gates.

### Theorem 1

*Suppose that Eve performs attack* \(( \hat{E},\hat{F} )\) *on the particle from TP to Alice and back to TP*. *For this attack inducing no error in Step *3, *the final state of Eve’s probe should be independent of not only Alice’s operation but also TP and Alice’s measurement results*. *As a result*, *Eve gets no information on the bits of* \(S_{1}\) *and* \(S_{2}\).

### Proof

The effect of *Ê* on the qubits \(\vert 0 \rangle \) and \(\vert 1 \rangle \) can be expressed as

$$\begin{aligned}& \hat{E} \bigl( \vert 0 \rangle \vert \varepsilon \rangle _{E} \bigr) = \alpha _{00} \vert 0 \rangle \vert \varepsilon _{00} \rangle + \alpha _{01} \vert 1 \rangle \vert \varepsilon _{01} \rangle , \end{aligned}$$

(2)

$$\begin{aligned}& \hat{E} \bigl( \vert 1 \rangle \vert \varepsilon \rangle _{E} \bigr) = \alpha _{10} \vert 0 \rangle \vert \varepsilon _{10} \rangle + \alpha _{11} \vert 1 \rangle \vert \varepsilon _{11} \rangle , \end{aligned}$$

(3)

where \(\vert \varepsilon _{00} \rangle \), \(\vert \varepsilon _{01} \rangle \), \(\vert \varepsilon _{10} \rangle \) and \(\vert \varepsilon _{11} \rangle \) are Eve’s probe states determined by *Ê*, \(\vert \alpha _{00} \vert ^{2} + \vert \alpha _{01} \vert ^{2} = 1\) and \(\vert \alpha _{10} \vert ^{2} + \vert \alpha _{11} \vert ^{2} = 1\).

According to Stinespring dilation theorem, the global state of the composite system before Alice’ s operation is

$$\begin{aligned} &\hat{E} \bigl( \vert \psi ^{ +} \rangle _{12} \vert \varepsilon \rangle _{E} \bigr)\\ &\quad = \hat{E} \biggl[ \frac{1}{\sqrt{2}} \bigl( \vert 01 \rangle + \vert 10 \rangle \bigr)_{12} \vert \varepsilon \rangle _{E} \biggr] \\ &\quad= \frac{1}{\sqrt{2}} \bigl[ \bigl( \alpha _{00} \vert 0 \rangle _{1} \vert \varepsilon _{00} \rangle + \alpha _{01} \vert 1 \rangle _{1} \vert \varepsilon _{01} \rangle \bigr) \vert 1 \rangle _{2} + \bigl( \alpha _{10} \vert 0 \rangle _{1} \vert \varepsilon _{10} \rangle + \alpha _{11} \vert 1 \rangle _{1} \vert \varepsilon _{11} \rangle \bigr) \vert 0 \rangle _{2} \bigr] \\ &\quad= \frac{1}{\sqrt{2}} \bigl[ \vert 0 \rangle _{1} \bigl( \alpha _{00} \vert 1 \rangle _{2} \vert \varepsilon _{00} \rangle + \alpha _{10} \vert 0 \rangle _{2} \vert \varepsilon _{10} \rangle \bigr) + \vert 1 \rangle _{1} \bigl( \alpha _{01} \vert 1 \rangle _{2} \vert \varepsilon _{01} \rangle + \alpha _{11} \vert 0 \rangle _{2} \vert \varepsilon _{11} \rangle \bigr) \bigr], \end{aligned}$$

(4)

where the subscripts 1 and 2 represent the particles from \(T_{1}\) and \(T_{2}\), respectively.

(i) Firstly, consider the case that Alice chooses to MEASURE. As a result, the state of the composite system is collapsed into \(\vert 0 \rangle _{1} ( \alpha _{00} \vert 1 \rangle _{2} \vert \varepsilon _{00} \rangle + \alpha _{10} \vert 0 \rangle _{2} \vert \varepsilon _{10} \rangle )\) when Alice’s measurement result is \(\vert 0 \rangle _{1}\) or \(\vert 1 \rangle _{1} ( \alpha _{01} \vert 1 \rangle _{2} \vert \varepsilon _{01} \rangle + \alpha _{11} \vert 0 \rangle _{2} \vert \varepsilon _{11} \rangle )\) when Alice’s measurement result is \(\vert 1 \rangle _{1}\).

Eve imposes *F̂* on the particle sent back to TP. In order that Eve’s attacks on the MEASURE particle will not be discovered by TP and Alice in Step 3, the global state of the composite system should be

$$ \hat{F} \bigl[ \vert 0 \rangle _{1} \bigl( \alpha _{00} \vert 1 \rangle _{2} \vert \varepsilon _{00} \rangle + \alpha _{10} \vert 0 \rangle _{2} \vert \varepsilon _{10} \rangle \bigr) \bigr] = \vert 0 \rangle _{1} \vert 1 \rangle _{2} \vert \varepsilon _{0} \rangle , $$

(5)

when Alice’s measurement result is \(\vert 0 \rangle _{1}\); or

$$ \hat{F} \bigl[ \vert 1 \rangle _{1} \bigl( \alpha _{01} \vert 1 \rangle _{2} \vert \varepsilon _{01} \rangle + \alpha _{11} \vert 0 \rangle _{2} \vert \varepsilon _{11} \rangle \bigr) \bigr] = \vert 1 \rangle _{1} \vert 0 \rangle _{2} \vert \varepsilon _{1} \rangle , $$

(6)

when Alice’s measurement result is \(\vert 1 \rangle _{1}\).

(ii) Secondly, consider the case that Alice chooses to REFLECT. As a result, the state of the composite system is \(\frac{1}{\sqrt{2}} [ \vert 0 \rangle _{1} ( \alpha _{00} \vert 1 \rangle _{2} \vert \varepsilon _{00} \rangle + \alpha _{10} \vert 0 \rangle _{2} \vert \varepsilon _{10} \rangle ) + \vert 1 \rangle _{1} ( \alpha _{01} \vert 1 \rangle _{2} \vert \varepsilon _{01} \rangle + \alpha _{11} \vert 0 \rangle _{2} \vert \varepsilon _{11} \rangle ) ]\).

Eve imposes *F̂* on the particle sent back to TP. According to Eq. (5) and Eq. (6), it has

$$\begin{aligned}& \hat{F} \bigl[ \hat{E} \bigl( \vert \psi ^{ +} \rangle _{12} \vert \varepsilon \rangle _{E} \bigr) \bigr] \\& \quad = \frac{1}{\sqrt{2}} \hat{F} \bigl[ \vert 0 \rangle _{1} \bigl( \alpha _{00} \vert 1 \rangle _{2} \vert \varepsilon _{00} \rangle + \alpha _{10} \vert 0 \rangle _{2} \vert \varepsilon _{10} \rangle \bigr) + \vert 1 \rangle _{1} \bigl( \alpha _{01} \vert 1 \rangle _{2} \vert \varepsilon _{01} \rangle + \alpha _{11} \vert 0 \rangle _{2} \vert \varepsilon _{11} \rangle \bigr) \bigr] \\& \quad = \frac{1}{\sqrt{2}} \bigl( \vert 0 \rangle _{1} \vert 1 \rangle _{2} \vert \varepsilon _{0} \rangle + \vert 1 \rangle _{1} \vert 0 \rangle _{2} \vert \varepsilon _{1} \rangle \bigr) \\& \quad = \frac{1}{2} \bigl[ \bigl( \vert \psi ^{ +} \rangle _{12} + \vert \psi ^{ -} \rangle _{12} \bigr) \vert \varepsilon _{0} \rangle + \bigl( \vert \psi ^{ +} \rangle _{12} - \vert \psi ^{ -} \rangle _{12} \bigr) \vert \varepsilon _{1} \rangle \bigr] \\& \quad = \frac{1}{2} \bigl[ \vert \psi ^{ +} \rangle _{12} \bigl( \vert \varepsilon _{0} \rangle + \vert \varepsilon _{1} \rangle \bigr) + \vert \psi ^{ -} \rangle _{12} \bigl( \vert \varepsilon _{0} \rangle - \vert \varepsilon _{1} \rangle \bigr) \bigr]. \end{aligned}$$

(7)

In order that Eve’s attacks on the REFLECT particle will not be discovered by TP and Alice in Step 3, the probability that TP’s measurement result on a pair of particles in \(T_{1}\) and \(T_{2}\) is \(\vert \psi ^{ +} \rangle _{12}\) should be 1. Thus, it should establish

$$ \vert \varepsilon _{0} \rangle = \vert \varepsilon _{1} \rangle = \vert \varepsilon \rangle . $$

(8)

Inserting Eq. (8) into Eq. (7) produces

$$ \hat{F} \bigl[ \hat{E} \bigl( \vert \psi ^{ +} \rangle _{12} \vert \varepsilon \rangle _{E} \bigr) \bigr] = \vert \psi ^{ +} \rangle _{12} \vert \varepsilon \rangle . $$

(9)

(iii) Inserting Eq. (8) into Eq. (5) and Eq. (6) produces

$$ \hat{F} \bigl[ \vert 0 \rangle _{1} \bigl( \alpha _{00} \vert 1 \rangle _{2} \vert \varepsilon _{00} \rangle + \alpha _{10} \vert 0 \rangle _{2} \vert \varepsilon _{10} \rangle \bigr) \bigr] = \vert 0 \rangle _{1} \vert 1 \rangle _{2} \vert \varepsilon \rangle , $$

(10)

and

$$ \hat{F} \bigl[ \vert 1 \rangle _{1} \bigl( \alpha _{01} \vert 1 \rangle _{2} \vert \varepsilon _{01} \rangle + \alpha _{11} \vert 0 \rangle _{2} \vert \varepsilon _{11} \rangle \bigr) \bigr] = \vert 1 \rangle _{1} \vert 0 \rangle _{2} \vert \varepsilon \rangle , $$

(11)

respectively.

According to Eq. (9), Eq. (10) and Eq. (11), in order not to be detected by TP and Alice, the final state of Eve’s probe should be independent from not only Alice’s operation but also the TP and Alice’s measurement results. As a result, Eve gets no information on the bits of \(S_{1}\) and \(S_{2}\).

(4)The Trojan horse attack

Because the particles of \(T_{1}\) are transmitted forth and back between TP and Alice, two types of Trojan horse attack from Eve, i.e., the invisible photon eavesdropping attack [55] and the delay-photon Trojan horse attack [56, 57], should be taken into account. In the light of Refs. [57, 58], Alice can use a wavelength filter and a photon number splitter to resist these two types of Trojan horse attack from Eve, respectively. □

*Case 2: Eve attacks*
\(T_{5}\)
*and*
\(T_{6}\)
*when they go from TP to Alice and Bob*

(1) The intercept-resend attack

In Step 5, TP transmits \(T_{5}\) and \(T_{6}\) to Alice and Bob, respectively. During these transmissions, Eve may try her best to obtain \(S_{5}\) and \(S_{6}\) by launching the following attack: Eve intercepts the two particles sent from TP to Alice and Bob, and sends two fake ones she prepared in the *Z* basis beforehand to Alice and Bob, respectively. However, Eve will be undoubtedly discovered for two facts: firstly, the fake particles she prepared beforehand may be different from the genuine ones in \(T_{5}\) and \(T_{6}\); and secondly, Alice and Bob’s operations are random. Concretely speaking, when TP sends one particle of \(T_{5}\) to Alice and one particle of \(T_{6}\) to Bob, Eve intercepts them and sends the prepared fake ones to Alice and Bob, respectively. Firstly, assume that the two fake particles prepared by Eve are in the state of \(\vert 0 \rangle \vert 0 \rangle \). As a result, if both Alice and Bob choose to REFLECT, TP will receive the two fake particles \(\vert 0 \rangle \vert 0 \rangle \). After Alice and Bob tell TP their operations, TP measures the two fake particles \(\vert 0 \rangle \vert 0 \rangle \) with the Bell basis, and obtains the measurement result randomly in one of the two states \(\vert \phi ^{ +} \rangle \) and \(\vert \phi ^{ -} \rangle \). Hence, if both Alice and Bob choose to REFLECT, Eve will be detected with the probability of 1. If Alice chooses to MEASURE and Bob chooses to REFLECT, after Alice and Bob tell TP their operations, TP will measure the fake particle \(\vert 0 \rangle \) reflected by Bob with the *Z* basis and require Alice to announce her measurement result. Hence, if Alice chooses to MEASURE and Bob chooses to REFLECT, Eve will be detected with the probability of 1. Similarly, if Alice chooses to REFLECT and Bob chooses to MEASURE, Eve will be also detected with the probability of 1. If both Alice and Bob choose to MEASURE, after Alice and Bob tell TP their operations, TP will measure the received particles with the *Z* basis and obtain the measurement result \(\vert 0 \rangle \vert 0 \rangle \). So, if both Alice and Bob choose to MEASURE, Eve will be detected with the probability of 1. To sum up, when the two fake particles prepared by Eve are in the state of \(\vert 0 \rangle \vert 0 \rangle \), Eve is detected with the probability of \(\frac{1}{4} \times 1 + \frac{1}{4} \times 1 + \frac{1}{4} \times 1 + \frac{1}{4} \times 1 = 1\). Secondly, assume that the two fake particles prepared by Eve are in the state of \(\vert 1 \rangle \vert 1 \rangle \). In this case, Eve is also detected with the probability of 1. Thirdly, assume that the two fake particles prepared by Eve are in the state of \(\vert 0 \rangle \vert 1 \rangle \). As a result, if both Alice and Bob choose to REFLECT, TP will receive the two fake particles \(\vert 0 \rangle \vert 1 \rangle \). After Alice and Bob tell TP their operations, TP measures the two fake particles \(\vert 0 \rangle \vert 1 \rangle \) with the Bell basis, and obtains the measurement result randomly in one of the two states \(\vert \psi ^{ +} \rangle \) and \(\vert \psi ^{ -} \rangle \). Hence, if both Alice and Bob choose to REFLECT, Eve will be detected with the probability of \(\frac{1}{2}\). If Alice chooses to MEASURE and Bob chooses to REFLECT, after Alice and Bob tell TP their operations, TP will measure the fake particle \(\vert 1 \rangle \) reflected by Bob with the *Z* basis and require Alice to announce her measurement result. Hence, if Alice chooses to MEASURE and Bob chooses to REFLECT, Eve will be detected with the probability of 0. Similarly, if Alice chooses to REFLECT and Bob chooses to MEASURE, Eve will be also detected with the probability of 0. If both Alice and Bob choose to MEASURE, after Alice and Bob tell TP their operations, TP will measure the received particles with the *Z* basis and obtain the result \(\vert 0 \rangle \vert 1 \rangle \). In this case, Eve will be detected with the probability of 0. To sum up, when the two fake particles prepared by TP are in the state of \(\vert 0 \rangle \vert 1 \rangle \), Eve is detected with the probability of \(\frac{1}{4} \times \frac{1}{2} + \frac{1}{4} \times 0 + \frac{1}{4} \times 0 + \frac{1}{4} \times 0 = \frac{1}{8}\). Fourthly, assume that the two fake particles prepared by Eve are in the state of \(\vert 1 \rangle \vert 0 \rangle \). In this case, Eve is also detected with the probability of \(\frac{1}{8}\).

(2) The measure-resend attack

In order to obtain \(S_{5}\), Eve may intercept the particles of \(T_{5}\) sent from TP to Alice, measure them with the *Z* basis and send the resulted states to Alice. In the meanwhile, in order to obtain \(S_{6}\), Eve may intercept the particles of \(T_{6}\) sent from TP to Bob, measure them with the *Z* basis and send the resulted states to Bob. However, this kind of attack from Eve will be detected undoubtedly as Alice and Bob’s operations are random. Concretely speaking, after Eve’s measurement, the Bell state prepared by TP is collapsed randomly into one of the two states \(\vert 01 \rangle \) and \(\vert 10 \rangle \). Without loss of generality, assume that the Bell state from TP after Eve’s measurement is collapsed into \(\vert 01 \rangle \). If both Alice and Bob choose to REFLECT, after Alice and Bob tell TP their operations, TP will measure the received particles \(\vert 01 \rangle \) with the Bell basis and obtain \(\vert \psi ^{ +} \rangle \) or \(\vert \psi ^{ -} \rangle \) with equal probability. As a result, if both Alice and Bob choose to REFLECT, Eve will be detected with the probability of \(\frac{1}{2}\). If Alice chooses to MEASURE and Bob chooses to REFLECT, after Alice and Bob tell TP their operations, TP will measure the particle \(\vert 1 \rangle \) reflected by Bob with the *Z* basis and require Alice to announce her measurement result. Hence, if Alice chooses to MEASURE and Bob chooses to REFLECT, Eve will be detected with the probability of 0. Similarly, if Alice chooses to REFLECT and Bob chooses to MEASURE, Eve will be also discovered with the probability of 0. If both Alice and Bob choose to MEASURE, after Alice and Bob tell TP their operations, TP will measure the received particles with the *Z* basis. Therefore, if both Alice and Bob choose to MEASURE, Eve will be detected with the probability of 0. To sum up, when Eve launches this kind of attack on one particle of \(T_{5}\) and one particle of \(T_{6}\), the probability that she will be discovered is \(\frac{1}{4} \times \frac{1}{2} + \frac{1}{4} \times 0 + \frac{1}{4} \times 0 + \frac{1}{4} \times 0 = \frac{1}{8}\).

(3) The entangle-measure attack

Eve’s entangle-measure attack on the particles of \(T_{5}\) and \(T_{6}\), described as Fig. 3, can be modeled as two unitaries: \(U_{E}\) attacking particles from TP to Alice and Bob and \(U_{F}\) attacking particles back from Alice and Bob to TP, where \(U_{E}\) and \(U_{F}\) share a common probe space with initial state \(\vert \xi \rangle _{E}\).

### Theorem 2

*Suppose that Eve performs attack* \(( U_{E},U_{F} )\) *on the particles from TP to Alice and Bob and back to TP*. *For this attack inducing no error in Step *5, *the final state of Eve’s probe should be independent of not only Alice and Bob’s operations but also their measurement results*. *As a result*, *Eve gets no information on the bits of* \(S_{5}\) *and* \(S_{6}\).

### Proof

The effect of \(U_{E}\) on the qubits \(\vert 0 \rangle \) and \(\vert 1 \rangle \) can be expressed as

$$\begin{aligned}& U_{E} \bigl( \vert 0 \rangle \vert \xi \rangle _{E} \bigr) = \beta _{00} \vert 0 \rangle \vert \xi _{00} \rangle + \beta _{01} \vert 1 \rangle \vert \xi _{01} \rangle , \end{aligned}$$

(12)

$$\begin{aligned}& U_{E} \bigl( \vert 1 \rangle \vert \xi \rangle _{E} \bigr) = \beta _{10} \vert 0 \rangle \vert \xi _{10} \rangle + \beta _{11} \vert 1 \rangle \vert \xi _{11} \rangle , \end{aligned}$$

(13)

where \(\vert \xi _{00} \rangle \), \(\vert \xi _{01} \rangle \), \(\vert \xi _{10} \rangle \) and \(\vert \xi _{11} \rangle \) are Eve’s probe states determined by \(U_{E}\), \(\vert \beta _{00} \vert ^{2} + \vert \beta _{01} \vert ^{2} = 1\) and \(\vert \beta _{10} \vert ^{2} + \vert \beta _{11} \vert ^{2} = 1\).

According to Stinespring dilation theorem, the global state of the composite system before Alice and Bob’s operations is

$$\begin{aligned}& U_{E} \bigl( \vert \psi ^{ +} \rangle _{56} \vert \xi \rangle _{E} \bigr) \\& \quad = U_{E} \biggl[ \frac{1}{\sqrt{2}} \bigl( \vert 01 \rangle + \vert 10 \rangle \bigr)_{56} \vert \xi \rangle _{E} \biggr] \\& \quad = \frac{1}{\sqrt{2}} \bigl[ \bigl( \beta _{00} \vert 0 \rangle _{5} \vert \xi _{00} \rangle + \beta _{01} \vert 1 \rangle _{5} \vert \xi _{01} \rangle \bigr) \bigl( \beta _{10} \vert 0 \rangle _{6} \vert \xi _{10} \rangle + \beta _{11} \vert 1 \rangle _{6} \vert \xi _{11} \rangle \bigr) \\& \qquad {}+ \bigl( \beta _{10} \vert 0 \rangle _{5} \vert \xi _{10} \rangle + \beta _{11} \vert 1 \rangle _{5} \vert \xi _{11} \rangle \bigr) \bigl( \beta _{00} \vert 0 \rangle _{6} \vert \xi _{00} \rangle + \beta _{01} \vert 1 \rangle _{6} \vert \xi _{01} \rangle \bigr) \bigr] \\& \quad = \frac{1}{\sqrt{2}} \bigl[ \vert 0 \rangle _{5} \vert 0 \rangle _{6} \bigl( \beta _{00}\beta _{10} \vert \xi _{00} \rangle \vert \xi _{10} \rangle + \beta _{10}\beta _{00} \vert \xi _{10} \rangle \vert \xi _{00} \rangle \bigr) \\& \qquad {}+ \vert 0 \rangle _{5} \vert 1 \rangle _{6} \bigl( \beta _{00}\beta _{11} \vert \xi _{00} \rangle \vert \xi _{11} \rangle + \beta _{10}\beta _{01} \vert \xi _{10} \rangle \vert \xi _{01} \rangle \bigr) \\& \qquad {}+ \vert 1 \rangle _{5} \vert 0 \rangle _{6} \bigl( \beta _{01}\beta _{10} \vert \xi _{01} \rangle \vert \xi _{10} \rangle + \beta _{11}\beta _{00} \vert \xi _{11} \rangle \vert \xi _{00} \rangle \bigr) \\& \qquad {}+ \vert 1 \rangle _{5} \vert 1 \rangle _{6} \bigl( \beta _{01}\beta _{11} \vert \xi _{01} \rangle \vert \xi _{11} \rangle + \beta _{11}\beta _{01} \vert \xi _{11} \rangle \vert \xi _{01} \rangle \bigr) \bigr] \\& \quad = \vert 0 \rangle _{5} \vert 0 \rangle _{6} \vert \vartheta _{00} \rangle + \vert 0 \rangle _{5} \vert 1 \rangle _{6} \vert \vartheta _{01} \rangle + \vert 1 \rangle _{5} \vert 0 \rangle _{6} \vert \vartheta _{10} \rangle + \vert 1 \rangle _{5} \vert 1 \rangle _{6} \vert \vartheta _{11} \rangle , \end{aligned}$$

(14)

where the subscripts 5 and 6 represent the particles from \(T_{5}\) and \(T_{6}\), respectively, and

$$\begin{aligned}& \vert \vartheta _{00} \rangle = \frac{1}{\sqrt{2}} \bigl( \beta _{00}\beta _{10} \vert \xi _{00} \rangle \vert \xi _{10} \rangle + \beta _{10}\beta _{00} \vert \xi _{10} \rangle \vert \xi _{00} \rangle \bigr), \end{aligned}$$

(15)

$$\begin{aligned}& \vert \vartheta _{01} \rangle = \frac{1}{\sqrt{2}} \bigl( \beta _{00}\beta _{11} \vert \xi _{00} \rangle \vert \xi _{11} \rangle + \beta _{10}\beta _{01} \vert \xi _{10} \rangle \vert \xi _{01} \rangle \bigr), \end{aligned}$$

(16)

$$\begin{aligned}& \vert \vartheta _{10} \rangle = \frac{1}{\sqrt{2}} \bigl( \beta _{01}\beta _{10} \vert \xi _{01} \rangle \vert \xi _{10} \rangle + \beta _{11}\beta _{00} \vert \xi _{11} \rangle \vert \xi _{00} \rangle \bigr), \end{aligned}$$

(17)

$$\begin{aligned}& \vert \vartheta _{11} \rangle = \frac{1}{\sqrt{2}} \bigl( \beta _{01}\beta _{11} \vert \xi _{01} \rangle \vert \xi _{11} \rangle + \beta _{11}\beta _{01} \vert \xi _{11} \rangle \vert \xi _{01} \rangle \bigr) . \end{aligned}$$

(18)

When Alice and Bob receive the particles from TP, they choose either to MEASURE or to REFLECT. After that, Eve performs \(U_{F}\) on the particles sent back to TP.

(i) Consider the case that both Alice and Bob choose to MEASURE. As a result, the state of the composite system is collapsed into \(\vert x \rangle _{5} \vert y \rangle _{6} \vert \vartheta _{xy} \rangle \), where \(x,y \in \{ 0,1 \}\). For Eve not being detectable in Step 5, \(U_{F}\) should satisfy

$$ U_{F} \bigl( \vert x \rangle _{5} \vert y \rangle _{6} \vert \vartheta _{xy} \rangle \bigr) = \vert x \rangle _{5} \vert y \rangle _{6} \vert \gamma _{xy} \rangle , $$

(19)

which means that \(U_{F}\) cannot alter the state of particles from Alice and Bob. Otherwise, Eve is discovered with a non-zero probability.

(ii) Consider the case that Alice chooses to MEASURE and Bob chooses to REFLECT. As a result, the state of the composite system is collapsed into \(\vert 0 \rangle _{5} \vert 0 \rangle _{6} \vert \vartheta _{00} \rangle + \vert 0 \rangle _{5} \vert 1 \rangle _{6} \vert \vartheta _{01} \rangle \) when Alice’s measurement result is \(\vert 0 \rangle _{5}\) or \(\vert 1 \rangle _{5} \vert 0 \rangle _{6} \vert \vartheta _{10} \rangle + \vert 1 \rangle _{5} \vert 1 \rangle _{6} \vert \vartheta _{11} \rangle \) when Alice’s measurement result is \(\vert 1 \rangle _{5}\).

Assume that Alice’s measurement result is \(\vert 0 \rangle _{5}\). After Eve imposes \(U_{F}\) on the particles sent back to TP, due to Eq. (19), the state of the composite system is evolved into

$$ U_{F} \bigl( \vert 0 \rangle _{5} \vert 0 \rangle _{6} \vert \vartheta _{00} \rangle + \vert 0 \rangle _{5} \vert 1 \rangle _{6} \vert \vartheta _{01} \rangle \bigr) = \vert 0 \rangle _{5} \vert 0 \rangle _{6} \vert \gamma _{00} \rangle + \vert 0 \rangle _{5} \vert 1 \rangle _{6} \vert \gamma _{01} \rangle . $$

(20)

For Eve not being detectable in Step 5, the probability that TP’s measurement result on the particle reflected by Bob is \(\vert 0 \rangle _{6}\) should be 0. Hence, it has

$$ \vert \gamma _{00} \rangle = 0. $$

(21)

On the other hand, assume that Alice’s measurement result is \(\vert 1 \rangle _{5}\). After Eve imposes \(U_{F}\) on the particles sent back to TP, due to Eq. (19), the state of the composite system is evolved into

$$ U_{F} \bigl( \vert 1 \rangle _{5} \vert 0 \rangle _{6} \vert \vartheta _{10} \rangle + \vert 1 \rangle _{5} \vert 1 \rangle _{6} \vert \vartheta _{11} \rangle \bigr) = \vert 1 \rangle _{5} \vert 0 \rangle _{6} \vert \gamma _{10} \rangle + \vert 1 \rangle _{5} \vert 1 \rangle _{6} \vert \gamma _{11} \rangle . $$

(22)

For Eve not being detectable in Step 5, the probability that TP’s measurement result on the particle reflected by Bob is \(\vert 1 \rangle _{6}\) should be 0. Hence, it has

$$ \vert \gamma _{11} \rangle = 0. $$

(23)

(iii) Consider the case that Alice chooses to REFLECT and Bob chooses to MEASURE. As a result, the state of the composite system is collapsed into \(\vert 0 \rangle _{5} \vert 0 \rangle _{6} \vert \vartheta _{00} \rangle + \vert 1 \rangle _{5} \vert 0 \rangle _{6} \vert \vartheta _{10} \rangle \) when Bob’s measurement result is \(\vert 0 \rangle _{6}\) or \(\vert 0 \rangle _{5} \vert 1 \rangle _{6} \vert \vartheta _{01} \rangle + \vert 1 \rangle _{5} \vert 1 \rangle _{6} \vert \vartheta _{11} \rangle \) when Bob’s measurement result is \(\vert 1 \rangle _{6}\).

Assume that Bob’s measurement result is \(\vert 0 \rangle _{6}\). After Eve imposes \(U_{F}\) on the particles sent back to TP, due to Eq. (19), the state of the composite system is evolved into

$$ U_{F} \bigl( \vert 0 \rangle _{5} \vert 0 \rangle _{6} \vert \vartheta _{00} \rangle + \vert 1 \rangle _{5} \vert 0 \rangle _{6} \vert \vartheta _{10} \rangle \bigr) = \vert 0 \rangle _{5} \vert 0 \rangle _{6} \vert \gamma _{00} \rangle + \vert 1 \rangle _{5} \vert 0 \rangle _{6} \vert \gamma _{10} \rangle . $$

(24)

For Eve not being detectable in Step 5, the probability that TP’s measurement result on the particle reflected by Alice is \(\vert 0 \rangle _{5}\) should be 0. This automatically stands after Eq. (21) is inserted into Eq. (24).

On the other hand, assume that Bob’s measurement result is \(\vert 1 \rangle _{6}\). After Eve imposes \(U_{F}\) on the particles sent back to TP, due to Eq. (19), the state of the composite system is evolved into

$$ U_{F} \bigl( \vert 0 \rangle _{5} \vert 1 \rangle _{6} \vert \vartheta _{01} \rangle + \vert 1 \rangle _{5} \vert 1 \rangle _{6} \vert \vartheta _{11} \rangle \bigr) = \vert 0 \rangle _{5} \vert 1 \rangle _{6} \vert \gamma _{01} \rangle + \vert 1 \rangle _{5} \vert 1 \rangle _{6} \vert \gamma _{11} \rangle . $$

(25)

For Eve not being detectable in Step 5, the probability that TP’s measurement result on the particle reflected by Alice is \(\vert 1 \rangle _{5}\) should be 0. This automatically stands after Eq. (23) is inserted into Eq. (25).

(iv) Consider the case that both Alice and Bob choose to REFLECT. As a result, the state of the composite system is \(\vert 0 \rangle _{5} \vert 0 \rangle _{6} \vert \vartheta _{00} \rangle + \vert 0 \rangle _{5} \vert 1 \rangle _{6} \vert \vartheta _{01} \rangle + \vert 1 \rangle _{5} \vert 0 \rangle _{6} \vert \vartheta _{10} \rangle + \vert 1 \rangle _{5} \vert 1 \rangle _{6} \vert \vartheta _{11} \rangle \). After Eve imposes \(U_{F}\) on the particles sent back to TP, due to Eq. (19), the state of the composite system is evolved into

$$ \begin{aligned}[b] &U_{F} \bigl( \vert 0 \rangle _{5} \vert 0 \rangle _{6} \vert \vartheta _{00} \rangle + \vert 0 \rangle _{5} \vert 1 \rangle _{6} \vert \vartheta _{01} \rangle + \vert 1 \rangle _{5} \vert 0 \rangle _{6} \vert \vartheta _{10} \rangle + \vert 1 \rangle _{5} \vert 1 \rangle _{6} \vert \vartheta _{11} \rangle \bigr) \\ &\quad = \vert 0 \rangle _{5} \vert 0 \rangle _{6} \vert \gamma _{00} \rangle + \vert 0 \rangle _{5} \vert 1 \rangle _{6} \vert \gamma _{01} \rangle + \vert 1 \rangle _{5} \vert 0 \rangle _{6} \vert \gamma _{10} \rangle + \vert 1 \rangle _{5} \vert 1 \rangle _{6} \vert \gamma _{11} \rangle . \end{aligned} $$

(26)

After Eq. (21) and Eq. (23) are inserted into Eq. (26), it can be obtained that

$$\begin{aligned}& U_{F} \bigl( \vert 0 \rangle _{5} \vert 0 \rangle _{6} \vert \vartheta _{00} \rangle + \vert 0 \rangle _{5} \vert 1 \rangle _{6} \vert \vartheta _{01} \rangle + \vert 1 \rangle _{5} \vert 0 \rangle _{6} \vert \vartheta _{10} \rangle + \vert 1 \rangle _{5} \vert 1 \rangle _{6} \vert \vartheta _{11} \rangle \bigr) \\& \quad = \vert 0 \rangle _{5} \vert 1 \rangle _{6} \vert \gamma _{01} \rangle + \vert 1 \rangle _{5} \vert 0 \rangle _{6} \vert \gamma _{10} \rangle \\& \quad = \frac{1}{\sqrt{2}} \bigl( \vert \psi ^{ +} \rangle _{56} + \vert \psi ^{ -} \rangle _{56} \bigr) \vert \gamma _{01} \rangle + \frac{1}{\sqrt{2}} \bigl( \vert \psi ^{ +} \rangle _{56} - \vert \psi ^{ -} \rangle _{56} \bigr) \vert \gamma _{10} \rangle \\& \quad = \frac{1}{\sqrt{2}} \vert \psi ^{ +} \rangle _{56} \bigl( \vert \gamma _{01} \rangle + \vert \gamma _{10} \rangle \bigr) + \frac{1}{\sqrt{2}} \vert \psi ^{ -} \rangle _{56} \bigl( \vert \gamma _{01} \rangle - \vert \gamma _{10} \rangle \bigr). \end{aligned}$$

(27)

For Eve not being detectable in Step 5, the probability that TP’s measurement result on the particles reflected by Alice and Bob is \(\vert \psi ^{ +} \rangle _{56}\) should be 1. Therefore, according to Eq. (27), it has

$$ \vert \gamma _{01} \rangle = \vert \gamma _{10} \rangle = \vert \gamma \rangle . $$

(28)

Inserting Eq. (28) into Eq. (27) produces

$$ U_{F} \bigl( \vert 0 \rangle _{5} \vert 0 \rangle _{6} \vert \vartheta _{00} \rangle + \vert 0 \rangle _{5} \vert 1 \rangle _{6} \vert \vartheta _{01} \rangle + \vert 1 \rangle _{5} \vert 0 \rangle _{6} \vert \vartheta _{10} \rangle + \vert 1 \rangle _{5} \vert 1 \rangle _{6} \vert \vartheta _{11} \rangle \bigr) = \sqrt{2} \vert \psi ^{ +} \rangle _{56} \vert \gamma \rangle . $$

(29)

(v) Applying Eq. (28) into Eq. (19) produces

$$\begin{aligned}& U_{F} \bigl( \vert 0 \rangle _{5} \vert 1 \rangle _{6} \vert \vartheta _{01} \rangle \bigr) = \vert 0 \rangle _{5} \vert 1 \rangle _{6} \vert \gamma \rangle , \end{aligned}$$

(30)

$$\begin{aligned}& U_{F} \bigl( \vert 1 \rangle _{5} \vert 0 \rangle _{6} \vert \vartheta _{10} \rangle \bigr) = \vert 1 \rangle _{5} \vert 0 \rangle _{6} \vert \gamma \rangle . \end{aligned}$$

(31)

Applying Eq. (21) and Eq. (28) into Eq. (20) produces

$$ U_{F} \bigl( \vert 0 \rangle _{5} \vert 0 \rangle _{6} \vert \vartheta _{00} \rangle + \vert 0 \rangle _{5} \vert 1 \rangle _{6} \vert \vartheta _{01} \rangle \bigr) = \vert 0 \rangle _{5} \vert 1 \rangle _{6} \vert \gamma \rangle . $$

(32)

Applying Eq. (23) and Eq. (28) into Eq. (22) produces

$$ U_{F} \bigl( \vert 1 \rangle _{5} \vert 0 \rangle _{6} \vert \vartheta _{10} \rangle + \vert 1 \rangle _{5} \vert 1 \rangle _{6} \vert \vartheta _{11} \rangle \bigr) = \vert 1 \rangle _{5} \vert 0 \rangle _{6} \vert \gamma \rangle . $$

(33)

Applying Eq. (21) and Eq. (28) into Eq. (24) produces

$$ U_{F} \bigl( \vert 0 \rangle _{5} \vert 0 \rangle _{6} \vert \vartheta _{00} \rangle + \vert 1 \rangle _{5} \vert 0 \rangle _{6} \vert \vartheta _{10} \rangle \bigr) = \vert 1 \rangle _{5} \vert 0 \rangle _{6} \vert \gamma \rangle . $$

(34)

Applying Eq. (23) and Eq. (28) into Eq. (25) produces

$$ U_{F} \bigl( \vert 0 \rangle _{5} \vert 1 \rangle _{6} \vert \vartheta _{01} \rangle + \vert 1 \rangle _{5} \vert 1 \rangle _{6} \vert \vartheta _{11} \rangle \bigr) = \vert 0 \rangle _{5} \vert 1 \rangle _{6} \vert \gamma \rangle . $$

(35)

According to Eqs. (29)–(35), it can be concluded that for Eve not inducing an error in Step 5, the final state of Eve’s probe should be independent of not only Alice and Bob’s operations but also their measurement results. As a result, Eve gets no information on the bits of \(S_{5}\) and \(S_{6}\).

Secondly, we consider the entangle-measure attack from Eve that she only performs \(U_{E}\) on the particles of \(T_{5}\) and \(T_{6}\) sent out from TP. □

### Lemma 1

*Suppose that Eve only performs* \(U_{E}\) *on the particles of* \(T_{5}\) *and* \(T_{6}\) *sent out from TP*. *For this attack inducing no error in Step *5, *the final state of Eve’s probe should be independent of not only Alice and Bob’s operations but also their measurement results*. *As a result*, *Eve gets no information on the bits of* \(S_{5}\) *and* \(S_{6}\).

### Proof

The global state of the composite system before Alice and Bob’s operations can be depicted as Eq. (14). When Alice and Bob receive the particles from TP, they choose either to MEASURE or to REFLECT.

(i) Consider the case that both Alice and Bob choose to MEASURE. As a result, the state of the composite system is collapsed into \(\vert x \rangle _{5} \vert y \rangle _{6} \vert \vartheta _{xy} \rangle \), where \(x,y \in \{ 0,1 \}\). After that, Eve does nothing on the particles sent back to TP. Hence, Eve cannot be detected in Step 5.

(ii) Consider the case that Alice chooses to MEASURE and Bob chooses to REFLECT. As a result, the state of the composite system is collapsed into \(\vert 0 \rangle _{5} \vert 0 \rangle _{6} \vert \vartheta _{00} \rangle + \vert 0 \rangle _{5} \vert 1 \rangle _{6} \vert \vartheta _{01} \rangle \) when Alice’s measurement result is \(\vert 0 \rangle _{5}\) or \(\vert 1 \rangle _{5} \vert 0 \rangle _{6} \vert \vartheta _{10} \rangle + \vert 1 \rangle _{5} \vert 1 \rangle _{6} \vert \vartheta _{11} \rangle \) when Alice’s measurement result is \(\vert 1 \rangle _{5}\).

Assume that Alice’s measurement result is \(\vert 0 \rangle _{5}\). Eve does nothing on the particles sent back to TP. For Eve not being detectable in Step 5, the probability that TP’s measurement result on the particle reflected by Bob is \(\vert 0 \rangle _{6}\) should be 0. Hence, it has

$$ \vert \vartheta _{00} \rangle = 0. $$

(36)

On the other hand, assume that Alice’s measurement result is \(\vert 1 \rangle _{5}\). Eve does nothing on the particles sent back to TP. For Eve not being detectable in Step 5, the probability that TP’s measurement result on the particle reflected by Bob is \(\vert 1 \rangle _{6}\) should be 0. Hence, it has

$$ \vert \vartheta _{11} \rangle = 0. $$

(37)

(iii) Consider the case that Alice chooses to REFLECT and Bob chooses to MEASURE. As a result, the state of the composite system is collapsed into \(\vert 0 \rangle _{5} \vert 0 \rangle _{6} \vert \vartheta _{00} \rangle + \vert 1 \rangle _{5} \vert 0 \rangle _{6} \vert \vartheta _{10} \rangle \) when Bob’s measurement result is \(\vert 0 \rangle _{6}\) or \(\vert 0 \rangle _{5} \vert 1 \rangle _{6} \vert \vartheta _{01} \rangle + \vert 1 \rangle _{5} \vert 1 \rangle _{6} \vert \vartheta _{11} \rangle \) when Bob’s measurement result is \(\vert 1 \rangle _{6}\).

Assume that Bob’s measurement result is \(\vert 0 \rangle _{6}\). Eve does nothing on the particles sent back to TP. For Eve not being detectable in Step 5, the probability that TP’s measurement result on the particle reflected by Alice is \(\vert 0 \rangle _{5}\) should be 0. This is automatically satisfied, since Eq. (36) stands.

On the other hand, assume that Bob’s measurement result is \(\vert 1 \rangle _{6}\). Eve does nothing on the particles sent back to TP. For Eve not being detectable in Step 5, the probability that TP’s measurement result on the particle reflected by Alice is \(\vert 1 \rangle _{5}\) should be 0. This is automatically satisfied, since Eq. (37) stands.

(iv) Consider the case that both Alice and Bob choose to REFLECT. As a result, the state of the composite system is \(\vert 0 \rangle _{5} \vert 0 \rangle _{6} \vert \vartheta _{00} \rangle + \vert 0 \rangle _{5} \vert 1 \rangle _{6} \vert \vartheta _{01} \rangle + \vert 1 \rangle _{5} \vert 0 \rangle _{6} \vert \vartheta _{10} \rangle + \vert 1 \rangle _{5} \vert 1 \rangle _{6} \vert \vartheta _{11} \rangle \). Because of Eq. (36) and Eq. (37), the state of the composite system can be expressed as

$$\begin{aligned}& \vert 0 \rangle _{5} \vert 0 \rangle _{6} \vert \vartheta _{00} \rangle + \vert 0 \rangle _{5} \vert 1 \rangle _{6} \vert \vartheta _{01} \rangle + \vert 1 \rangle _{5} \vert 0 \rangle _{6} \vert \vartheta _{10} \rangle + \vert 1 \rangle _{5} \vert 1 \rangle _{6} \vert \vartheta _{11} \rangle \\& \quad = \vert 0 \rangle _{5} \vert 1 \rangle _{6} \vert \vartheta _{01} \rangle + \vert 1 \rangle _{5} \vert 0 \rangle _{6} \vert \vartheta _{10} \rangle \\& \quad = \frac{1}{\sqrt{2}} \bigl( \vert \psi ^{ +} \rangle _{56} + \vert \psi ^{ -} \rangle _{56} \bigr) \vert \vartheta _{01} \rangle + \frac{1}{\sqrt{2}} \bigl( \vert \psi ^{ +} \rangle _{56} - \vert \psi ^{ -} \rangle _{56} \bigr) \vert \vartheta _{10} \rangle \\& \quad = \frac{1}{\sqrt{2}} \vert \psi ^{ +} \rangle _{56} \bigl( \vert \vartheta _{01} \rangle + \vert \vartheta _{10} \rangle \bigr) + \frac{1}{\sqrt{2}} \vert \psi ^{ -} \rangle _{56} \bigl( \vert \vartheta _{01} \rangle - \vert \vartheta _{10} \rangle \bigr). \end{aligned}$$

(38)

Eve does nothing on the particles sent back to TP. For Eve not being detectable in Step 5, the probability that TP’s measurement result on the particles reflected by Alice and Bob is \(\vert \psi ^{ +} \rangle _{56}\) should be 1. Therefore, it can be derived from Eq. (38) that

$$ \vert \vartheta _{01} \rangle = \vert \vartheta _{10} \rangle = \vert \vartheta \rangle . $$

(39)

Inserting Eq. (39) into Eq. (38) produces

$$ \vert 0 \rangle _{5} \vert 0 \rangle _{6} \vert \vartheta _{00} \rangle + \vert 0 \rangle _{5} \vert 1 \rangle _{6} \vert \vartheta _{01} \rangle + \vert 1 \rangle _{5} \vert 0 \rangle _{6} \vert \vartheta _{10} \rangle + \vert 1 \rangle _{5} \vert 1 \rangle _{6} \vert \vartheta _{11} \rangle = \sqrt{2} \vert \psi ^{ +} \rangle _{56} \vert \vartheta \rangle . $$

(40)

It can be concluded from the above analysis: considering the entangle-measure attack from Eve that she only performs \(U_{E}\) on the particles of \(T_{5}\) and \(T_{6}\) sent out from TP, for Eve not inducing an error in Step 5, the final state of Eve’s probe should be independent of not only Alice and Bob’s operations but also their measurement results. As a result, Eve gets no information on the bits of \(S_{5}\) and \(S_{6}\).

Thirdly, we consider the entangle-measure attack from Eve that she only performs \(U_{F}\) on the particles of \(T_{5}\) and \(T_{6}\) sent back to TP. □

### Lemma 2

*Suppose that Eve only performs* \(U_{F}\) *on the particles of* \(T_{5}\) *and* \(T_{6}\) *sent back to TP*. *For this attack inducing no error in Step *5, *the final state of Eve’s probe should be independent of not only Alice and Bob’s operations but also their measurement results*. *As a result*, *Eve gets no information on the bits of* \(S_{5}\) *and* \(S_{6}\).

### Proof

Eve does nothing on the particles of \(T_{5}\) and \(T_{6}\) sent out from TP. As a result, the global state of the composite system before Alice and Bob’s operations can be depicted as \(\vert \psi ^{ +} \rangle _{56} \vert \xi \rangle _{E}\). When Alice and Bob receive the particles sent out from TP, they choose either to MEASURE or to REFLECT.

(i) Consider the case that both Alice and Bob choose to MEASURE. As a result, the state of the composite system is randomly collapsed into \(\vert t \rangle _{5} \vert r \rangle _{6} \vert \xi \rangle _{E}\), where \(t,r \in \{ 0,1 \}\) and \(t \oplus r = 1\). After that, Eve performs \(U_{F}\) on the particles sent back to TP. For Eve not being detectable in Step 5, \(U_{F}\) should satisfy

$$ U_{F} \bigl( \vert t \rangle _{5} \vert r \rangle _{6} \vert \xi \rangle \bigr) = \vert t \rangle _{5} \vert r \rangle _{6} \vert \delta _{tr} \rangle $$

(41)

for \(t,r \in \{ 0,1 \}\) and \(t \oplus r = 1\), which means that \(U_{F}\) cannot alter the state of particles from Alice and Bob. Otherwise, Eve is discovered with a non-zero probability.

(ii) Consider the case that Alice chooses to MEASURE and Bob chooses to REFLECT. As a result, the state of the composite system is collapsed into \(\vert 0 \rangle _{5} \vert 1 \rangle _{6} \vert \xi \rangle _{E}\) when Alice’s measurement result is \(\vert 0 \rangle _{5}\) or \(\vert 1 \rangle _{5} \vert 0 \rangle _{6} \vert \xi \rangle _{E}\) when Alice’s measurement result is \(\vert 1 \rangle _{5}\).

Assume that Alice’s measurement result is \(\vert 0 \rangle _{5}\). After Eve imposes \(U_{F}\) on the particles sent back to TP, due to Eq. (41), the state of the composite system is evolved into

$$ U_{F} \bigl( \vert 0 \rangle _{5} \vert 1 \rangle _{6} \vert \xi \rangle \bigr) = \vert 0 \rangle _{5} \vert 1 \rangle _{6} \vert \delta _{01} \rangle . $$

(42)

For Eve not being detectable in Step 5, the probability that TP’s measurement result on the particle reflected by Bob is \(\vert 0 \rangle _{6}\) should be 0. Apparently, this point is automatically satisfied.

On the other hand, assume that Alice’s measurement result is \(\vert 1 \rangle _{5}\). After Eve imposes \(U_{F}\) on the particles sent back to TP, due to Eq. (41), the state of the composite system is evolved into

$$ U_{F} \bigl( \vert 1 \rangle _{5} \vert 0 \rangle _{6} \vert \xi \rangle \bigr) = \vert 1 \rangle _{5} \vert 0 \rangle _{6} \vert \delta _{10} \rangle . $$

(43)

For Eve not being detectable in Step 5, the probability that TP’s measurement result on the particle reflected by Bob is \(\vert 1 \rangle _{6}\) should be 0. Apparently, this point is automatically satisfied.

(iii) Consider the case that Alice chooses to REFLECT and Bob chooses to MEASURE. As a result, the state of the composite system is collapsed into \(\vert 1 \rangle _{5} \vert 0 \rangle _{6} \vert \xi \rangle _{E}\) when Bob’s measurement result is \(\vert 0 \rangle _{6}\) or \(\vert 0 \rangle _{5} \vert 1 \rangle _{6} \vert \xi \rangle _{E}\) when Bob’s measurement result is \(\vert 1 \rangle _{6}\).

Assume that Bob’s measurement result is \(\vert 0 \rangle _{6}\). After Eve imposes \(U_{F}\) on the particles sent back to TP, due to Eq. (41), the state of the composite system is evolved into Eq. (43). For Eve not being detectable in Step 5, the probability that TP’s measurement result on the particle reflected by Alice is \(\vert 0 \rangle _{5}\) should be 0. Apparently, this point is automatically satisfied.

On the other hand, assume that Bob’s measurement result is \(\vert 1 \rangle _{6}\). After Eve imposes \(U_{F}\) on the particles sent back to TP, due to Eq. (41), the state of the composite system is evolved into Eq. (42). For Eve not being detectable in Step 5, the probability that TP’s measurement result on the particle reflected by Alice is \(\vert 1 \rangle _{5}\) should be 0. Apparently, this point is automatically satisfied.

(iv) Consider the case that both Alice and Bob choose to REFLECT. As a result, the state of the composite system is \(\vert \psi ^{ +} \rangle _{56} \vert \xi \rangle _{E}\). After Eve imposes \(U_{F}\) on the particles sent back to TP, due to Eq. (41), the state of the composite system is evolved into

$$\begin{aligned} U_{F} \bigl( \vert \psi ^{ +} \rangle _{56} \vert \xi \rangle \bigr) &= \frac{1}{\sqrt{2}} \bigl( \vert 0 \rangle _{5} \vert 1 \rangle _{6} \vert \delta _{01} \rangle + \vert 1 \rangle _{5} \vert 0 \rangle _{6} \vert \delta _{10} \rangle \bigr) \\ &= \frac{1}{2} \bigl( \vert \psi ^{ +} \rangle _{56} + \vert \psi ^{ -} \rangle _{56} \bigr) \vert \delta _{01} \rangle + \frac{1}{2} \bigl( \vert \psi ^{ +} \rangle _{56} - \vert \psi ^{ -} \rangle _{56} \bigr) \vert \delta _{10} \rangle \\ &= \frac{1}{2} \vert \psi ^{ +} \rangle _{56} \bigl( \vert \delta _{01} \rangle + \vert \delta _{10} \rangle \bigr) + \frac{1}{2} \vert \psi ^{ -} \rangle _{56} \bigl( \vert \delta _{01} \rangle - \vert \delta _{10} \rangle \bigr). \end{aligned}$$

(44)

For Eve not being detectable in Step 5, the probability that TP’s measurement result on the particles reflected by Alice and Bob is \(\vert \psi ^{ +} \rangle _{56}\) should be 1. Hence, it can be obtained from Eq. (44) that

$$ \vert \delta _{01} \rangle = \vert \delta _{10} \rangle = \vert \delta \rangle . $$

(45)

Inserting Eq. (45) into Eq. (44) generates

$$ U_{F} \bigl( \vert \psi ^{ +} \rangle _{56} \vert \xi \rangle \bigr) = \bigl\vert \psi ^{ +} \rangle _{56} \bigr\vert \delta \rangle . $$

(46)

It can be concluded from the above analysis: considering the entangle-measure attack from Eve that she only performs \(U_{F}\) on the particles of \(T_{5}\) and \(T_{6}\) sent back to TP, for Eve not inducing an error in Step 5, the final state of Eve’s probe should be independent of not only Alice and Bob’s operations but also their measurement results. As a result, Eve gets no information on the bits of \(S_{5}\) and \(S_{6}\). □

(4) The Trojan horse attack

In accordance with Refs. [57, 58], the invisible photon eavesdropping attack and the delay-photon Trojan horse attack from Eve on the particles of \(T_{5}\) during the round trip between TP and Alice can be overcome by Alice with a wavelength filter and a photon number splitter, respectively. The same methods can be used to prevent the invisible photon eavesdropping attack and the delay-photon Trojan horse attack from Eve on the particles of \(T_{6}\) during the round trip between TP and Bob.

### 4.2 Participant attack

With respect to the participant attack suggested by Gao *et al*. [59], we need to consider the participant attack from Alice or Bob and that from the semi-honest TP.

(1) The participant attack from Alice or Bob

In the proposed protocol, Alice plays the same role to Bob. Without loss of generality, we only consider the case that Bob, who is supposed to have complete quantum abilities, is dishonest.

In the proposed protocol, Bob naturally knows \(S_{3}\) and \(S_{6}\). Moreover, according to the entanglement correlation of two qubits within one Bell state, Bob can deduce \(S_{4}\) and \(S_{5}\) from \(S_{3}\) and \(S_{6}\), respectively. As \(M_{A}\) is encrypted with \(S_{1}\), \(S_{5}\) and \(K_{AB}\), in order to deduce \(M_{A}\) from \(R_{A}\), Bob should further know \(S_{1}\). However, Bob cannot get \(S_{1}\) by cooperating with TP who knows \(S_{2}\). As a result, Bob has to try his best to get \(S_{1}\) by launching some active attacks on the particles of \(T_{1}\), such as the intercept-resend attack, the measure-resend attack, the entangle-measure attack, the Trojan horse attack, *et al*. However, he will be inevitably discovered as an external eavesdropper, since Alice’s operations are random to him, after similar deductions to those of Case 1 in Sect. 4.1. In conclusion, Bob has no chance to obtain \(M_{A}\).

(2) The participant attack from TP

TP may try to obtain \(M_{A}\) and \(M_{B}\) by using passive attacks. In other words, TP may try to reveal \(M_{A}\) and \(M_{B}\) from the classical information she collected during the implementation of the protocol. In the proposed protocol, TP can know \(S_{1}\), \(S_{2}\), \(S_{3}\), \(S_{4}\), \(S_{5}\), \(S_{6}\), \(R_{A}\), \(R_{B}\) and the comparison result of \(M_{A}\) and \(M_{B}\). However, TP still cannot deduce \(M_{A}\) from \(R_{A}\) and \(M_{B}\) from \(R_{B}\), because she cannot obtain \(K_{AB}\) shared by Alice and Bob beforehand which is used to encrypt \(M_{A}\) and \(M_{B}\).

In the proposed protocol, TP is assumed to be semi-honest. As a result, she may try to perform possible active attacks to get \(M_{A}\) and \(M_{B}\) but cannot collude with anyone else. For example, TP may prepare fake quantum states, such as product states or nonmaximal entangled states, instead of Bell states in Step 1. The proposed protocol lacks the process of checking whether TP has prepared the genuine Bell states in Step 1 or not, hence, Alice and Bob may be unknown about TP’s cheating behavior. Actually, no matter what kinds of attack TP launches, the best result for TP is that she can obtain \(S_{1}\), \(S_{2}\), \(S_{3}\), \(S_{4}\), \(S_{5}\), \(S_{6}\), \(R_{A}\), \(R_{B}\) and the comparison result of \(M_{A}\) and \(M_{B}\). However, TP still has no opportunity to decode out \(M_{A}\) from \(R_{A}\) and \(M_{B}\) from \(R_{B}\), due to lack of \(K_{AB}\).