Skip to main content

Single-state semiquantum private comparison based on Bell states

Abstract

In this paper, a novel semiquantum private comparison (SQPC) protocol based on single kind of Bell states is proposed, which allows two classical parties to judge the equality of their private inputs securely and correctly under the help of a semi-honest third party (TP) who possesses complete quantum capabilities. TP is allowed to misbehave on her own but cannot conspire with anyone else. Our protocol needs none of unitary operations, quantum entanglement swapping or the reordering operations. Moreover, our protocol only needs to prepare single kind of Bell states as initial quantum resource. Detailed security analysis turns out that our protocol is secure against various outside and participant attacks. Compared with most of the existing SQPC protocols based on Bell states, our protocol is more feasible in practice.

1 Introduction

Relying on the physical laws such as the quantum no-cloning theorem, the uncertainty principle etc., quantum cryptography possesses unconditional security in theory. In 1984, Bennett and Brassard [1] proposed the world’s first quantum key distribution (QKD) protocol by using the polarization of single photons, which is always named as the BB84 protocol later. Starting with the BB84 protocol, quantum cryptography has gained considerable developments in recent years. Researchers have proposed different kinds of quantum cryptography protocols suitable for different application scenarios, such as quantum key distribution (QKD) [26], quantum secret sharing (QSS) [710], quantum secure direct communication (QSDC) [1116], quantum identity authentication (QIA) [17, 18], and so on. QKD protocols can be used to establish a private sequence of key bits between two remote communicants through the transmission of quantum signals. QSS permits different participants to share a secret privately in the way that only all of them cooperate together can they reconstruct it. QSDC protocols can be used to directly transmit a secret message from one party to the other party. QIA protocols can be used for authenticating whether the user’s identity is legal or not. In 2009, Yang and Wen [19] proposed the first quantum private comparison (QPC) protocol, which can compare the equality of private inputs from two different users under the condition that none of their private inputs will be leaked out. Since then, scholars have designed abundant QPC protocols with different quantum states, such as the ones with single particles [20, 21], Bell states [2224], GHZ states [25, 26], cluster states [27], χ-type entangled states [28], etc. The above QPC protocols require all users to have complete quantum capabilities, which may incur high costs in practice.

In 2007, Boyer et al. [29] proposed the first measure-resend semiquantum key distribution (SQKD) protocol by using the famous BB84 protocol, where it is not necessary for all users to have complete quantum capabilities. Subsequently, in 2009, Boyer et al. [30] further put forward the randomization-based SQKD protocol with single photons. At present, in the field of semiquantum cryptography, according to the two representative works in Refs. [29, 30], classical users are widely considered to be limited within the following operations: (a) sending or reflecting the qubits without interference; (b) measuring qubits in the Z basis (i.e., \(\{ \vert 0 \rangle , \vert 1 \rangle \}\)); (c) preparing the fresh qubits in the Z basis; and (d) reordering the qubits through different delay lines. Based on these settings, compared with the traditional quantum cryptography, semiquantum cryptography may effectively save quantum resource and quantum operations. The idea of semiquantumness has been applied into various branches of quantum cryptography so that the corresponding semiquantum cryptography branches have been established, such as SQKD [2933], semiquantum secret sharing (SQSS) [3437], semiquantum key agreement (SQKA) [3841], semiquantum controlled secure direct communication (SQCSDC) [41] and semiquantum dialogue (SQD) [41, 42], etc.

In 2016, Chou et al. [43] introduced the concept of semiquantumness into QPC and put forward the first semiquantum private comparison (SQPC) protocol by using Bell states and quantum entanglement swapping. In 2018, Thapliyal et al. [44] proposed a SQPC protocol based on Bell states, which needs to share a secret key in advance among different participants by using SQKD and SQKA; Ye et al. [45] designed a SQPC protocol with the measure-resend characteristics based on two-particle product states. In 2019, Yan et al. [39] constructed a randomization-based SQPC protocol based on Bell states without pre-shared keys; Lin et al. [46] proposed a SQPC protocol with single photons, which allows two classical participants to safely compare the equality of their private inputs under the help of an almost dishonest third party (TP); Yan et al. [47] put forward a SQPC scheme based on Greenberger-Horne-Zeilinger (GHZ) class states. In 2020, Jiang [48] put forward two SQPC protocols with Bell states, where the first protocol requires the classical users to measure the received particles but the second protocol doesn’t have this requirement. In 2021, Tsai et al. [49] and Xie et al. [50] pointed out that the first SQPC protocol in Ref. [48] has security loopholes. In order to solve these problems, Ref. [49] makes TP share a secret key with each classical user in advance through SQKD, while Ref. [50] increases the quantum measurement capability for two classical users. In the same year, Yan et al. [51] put forward a SQPC protocol with three-particle GHZ-like states; Ye et al. [52] proposed an efficient circular SQPC protocol based on single-particle states without using a pre-shared key; Sun et al. [53] suggested a novel measure-resend SQPC scheme with pre-shared keys by using Bell states. Note that each of the SQPC protocols in Refs. [43, 44, 4850, 53] needs to employ four kinds of Bell states as initial quantum resource.

According to the above analysis, in this paper, in order to cut down the usage of initial quantum resource and quantum operations for SQPC based on Bell states, we propose a novel SQPC protocol based on single kind of Bell states, which utilizes the entanglement correlation of Bell states to skillfully compare the equality of two classical users’ private inputs. Compared with most of the existing SQPC protocols with Bell states, our protocol is much easier to implement in practice, due to the following advantages: firstly, it only adopts one kind of Bell states as initial quantum resource; secondly, it doesn’t need to employ quantum entanglement swapping or the reordering operations.

2 Protocol description

Suppose that both Alice and Bob only possess limited quantum capabilities; Alice has a private message \(M_{A}\), while Bob has a private message \(M_{B}\). Here, \(M_{A} = \{ M_{A}^{1},M_{A}^{2}, \ldots ,M_{A}^{n} \}\), \(M_{B} = \{ M_{B}^{1},M_{B}^{2}, \ldots ,M_{B}^{n} \}\), \(M_{A}^{i} \in \{ 0,1 \}\), \(M_{B}^{i} \in \{ 0,1 \}\), and \(i = 0,1, \ldots ,n\). Alice and Bob want to know whether \(M_{A}\) and \(M_{B}\) are equal or not under the help of TP who possesses full quantum capabilities. According to Ref. [54], here, TP is assumed to be semi-honest, which means that she is allowed to misbehave on her own but cannot conspire with anyone else. In order to securely compare the equality of \(M_{A}\) and \(M_{B}\) without disclosing their genuine contents to TP, Alice and Bob share a secret key \(K_{AB} = \{ K_{AB}^{1},K_{AB}^{2}, \ldots ,K_{AB}^{n} \}\) through a secure mediated SQKD protocol [31] in advance, where \(K_{AB}^{i} \in \{ 0,1 \}\) and \(i = 0,1, \ldots ,n\). The proposed SQPC protocol based on Bell states can be depicted as follows, whose flow chart is shown in Fig. 1 for clarity.

Figure 1
figure 1

The flowchart of the proposed single-state SQPC protocol

Step 1: TP prepared \(N = 16n\) Bell states all in the state of \(\vert \psi ^{ +} \rangle = \frac{1}{\sqrt{2}} ( \vert 01 \rangle + \vert 10 \rangle )\). Then, she divides the first particles and the second particles of the first 4n Bell states into sequences \(T_{1}\) and \(T_{2}\), respectively. Similarly, she makes the first particles and the second particles of the second 4n Bell states to form sequences \(T_{3}\) and \(T_{4}\), respectively, and lets the first particles and the second particles of the last 8n Bell states to compose sequences \(T_{5}\) and \(T_{6}\), respectively. Afterward, TP transmits the particles of sequence \(T_{1}\) to Alice one by one. Note that after TP sends the first particle to Alice, she sends a particle only after receiving the previous one. In the meanwhile, TP transmits the particles of sequence \(T_{3}\) to Bob one by one. Likewise, after TP sends the first particle to Bob, she sends a particle only after receiving the previous one.

Step 2: After receiving each particle from TP, Alice randomly selects one of the following two operations: measuring the received particle with the Z basis and resending a fresh one to TP in the same state to the measurement result (this is called as the MEASURE mode); and returning the received particle to TP directly (this is called as the REFLECT mode). Alice records the measurement results of corresponding particles in \(T_{1}\) which she chose to MEASURE.

Similarly, after receiving each particle from TP, Bob randomly selects one of the following two operations, MEASURE and REFLECT. Bob also records the measurement results of corresponding particles in \(T_{3}\) which he chose to MEASURE.

Step 3: TP and Alice cooperate together to check the transmission security of \(T_{1}\). Alice tells TP the positions where she chose to REFLECT. TP performs different operations on the received particles according to Alice’s choices, as illustrated in Table 1.

Table 1 Alice’s actions on the particles in \(T_{1}\) and TP’s corresponding actions

For checking the error rate on the 2n REFLECT particles in \(T_{1}\), TP compares her Bell basis measurement results with her initial prepared states. Apparently, if there exists no Eve, TP’s measurement results should always be \(\vert \psi ^{ +} \rangle \).

For checking the error rate on the 2n MEASURE particles in \(T_{1}\), TP randomly chooses n ones among them, tells Alice the chosen positions and requires Alice to inform her of the corresponding measurement results on these n chosen MEASURE particles in \(T_{1}\). TP calculates the error rate by comparing her measurement results on these n chosen MEASURE particles in \(T_{1}\), her measurement results on the corresponding n particles in \(T_{2}\) and Alice’s measurement results on these n chosen MEASURE particles in \(T_{1}\). Apparently, if there exists no Eve, these three kinds of measurement results should be perfectly correlated. For example, assuming that there exists no Eve, when Alice’s measurement result on one chosen MEASURE particle in \(T_{1}\) is \(\vert 0 \rangle \) (\(\vert 1 \rangle \)), TP’s measurement result on this chosen MEASURE particle in \(T_{1}\) should also be \(\vert 0 \rangle \) (\(\vert 1 \rangle \)); and TP’s measurement result on the corresponding particle in \(T_{2}\) should be \(\vert 1 \rangle \) (\(\vert 0 \rangle \)), since the corresponding initial Bell state prepared by TP is \(\vert \psi ^{ +} \rangle \).

If either the error rate on the REFLECT particles or the error rate on the MEASURE particles in \(T_{1}\) is unreasonably high, the protocol will be halted; otherwise, the protocol will be continued.

In the meanwhile, TP and Bob cooperate together to check the transmission security of \(T_{3}\). Bob tells TP the positions where he chose to REFLECT. TP performs different operations on the received particles according to Bob’s choices, as illustrated in Table 2.

Table 2 Bob’s actions on the particles in \(T_{3}\) and TP’s corresponding actions

For checking the error rate on the 2n REFLECT particles in \(T_{3}\), TP compares her Bell basis measurement results with her initial prepared states.

For checking the error rate on the 2n MEASURE particles in \(T_{3}\), TP randomly chooses n ones among them, tells Bob the chosen positions and requires Bob to inform her of the corresponding measurement results on these n chosen MEASURE particles in \(T_{3}\). TP calculates the error rate by comparing her measurement results on these n chosen MEASURE particles in \(T_{3}\), her measurement results on the corresponding n particles in \(T_{4}\) and Bob’s measurement results on these n chosen MEASURE particles in \(T_{3}\).

If either the error rate on the REFLECT particles or the error rate on the MEASURE particles in \(T_{3}\) is unreasonably high, the protocol will be halted; otherwise, the protocol will be continued.

Step 4: TP drops out the 3n particles in \(T_{2}\) used for security check in Step 3. TP’s measurement results on the remaining n particles in \(T_{2}\) are represented as \(S_{2} = \{ S_{2}^{1},S_{2}^{2}, \ldots ,S_{2}^{n} \}\). Alice’s measurement results on these n particles in \(T_{1}\) are represented as \(S_{1} = \{ S_{1}^{1},S_{1}^{2}, \ldots ,S_{1}^{n} \}\).

In the meanwhile, TP drops out the 3n particles in \(T_{4}\) used for security check in Step 3. TP’s measurement results on the remaining n particles in \(T_{4}\) are represented as \(S_{4} = \{ S_{4}^{1},S_{4}^{2}, \ldots ,S_{4}^{n} \}\). Bob’s measurement results on these n particles in \(T_{3}\) are represented as \(S_{3} = \{ S_{3}^{1},S_{3}^{2}, \ldots ,S_{3}^{n} \}\).

Step 5: TP transmits the particles of sequence \(T_{5}\) to Alice one by one. Note that after TP sends the first particle to Alice, she sends a particle only after receiving the previous one. After receiving each particle from TP, Alice randomly selects one of the two operations, MEASURE and REFLECT. Then, Alice tells TP the positions where she chose to REFLECT.

In the meanwhile, TP transmits the particles of sequence \(T_{6}\) to Bob one by one. Note that after TP sends the first particle to Bob, she sends a particle only after receiving the previous one. After receiving each particle from TP, Bob randomly selects one of the two operations, MEASURE and REFLECT. Then, Bob tells TP the positions where he chose to REFLECT.

According to the choices of Alice and Bob, TP performs different operations on the received particles, as illustrated in Table 3. Case , Case and Case are used for checking whether the transmissions of \(T_{5}\) and \(T_{6}\) are secure or not; and Case is used for not only the security check of the transmissions of \(T_{5}\) and \(T_{6}\) but also privacy comparison.

Table 3 Alice’s actions on the particles in \(T_{5}\), Bob’s actions on the particles in \(T_{6}\) and TP’s corresponding actions

For the 2n positions where Case happens, TP compares her Bell basis measurement results with her initial prepared states. Apparently, if there exists no Eve, TP’s measurement results should always be \(\vert \psi ^{ +} \rangle \).

For the 2n positions where Case happens, TP compares her Z basis measurement results with Alice’s Z basis measurement results. Apparently, if there exists no Eve, TP’s Z basis measurement results should always be opposite to Alice’s Z basis measurement results.

For the 2n positions where Case happens, TP compares her Z basis measurement results with Bob’s Z basis measurement results. Apparently, if there exists no Eve, TP’s Z basis measurement results should always be opposite to Bob’s Z basis measurement results.

For the 2n positions where Case happens, TP randomly chooses n ones among them, and tells Alice and Bob the chosen positions. TP calculates the error rate by comparing her measurement results for the chosen positions with Alice and Bob’s measurement results on them, respectively. Apparently, if there exists no Eve, TP’s measurement results should be identical to Alice and Bob’s measurement results, respectively.

If either of the error rates of Case , Case , Case and Case is unreasonably high, the protocol will be halted; otherwise, the protocol will be continued.

Step 6: Alice drops out the 7n particles in \(T_{5}\) used for security check in Step 5. In Case , Alice’s measurement results on the remaining n particles in \(T_{5}\), which are not used for security check, are represented as \(S_{5} = \{ S_{5}^{1},S_{5}^{2}, \ldots ,S_{5}^{n} \}\). Alice calculates \(R_{A}^{j} = M_{A}^{j} \oplus K_{AB}^{j} \oplus S_{1}^{j} \oplus S_{5}^{j}\), where is the bitwise XOR operation and \(j = 1,2, \ldots ,n\). Then, Alice sends \(R_{A}\) to TP, where \(R_{A} = \{ R_{A}^{1},R_{A}^{2}, \ldots ,R_{A}^{n} \}\).

In the meanwhile, Bob drops out the 7n particles in \(T_{6}\) used for security check in Step 5. In Case , Bob’s measurement results on the remaining n particles in \(T_{6}\), which are not used for security check, are represented as \(S_{6} = \{ S_{6}^{1},S_{6}^{2}, \ldots ,S_{6}^{n} \}\). Bob calculates \(R_{B}^{j} = M_{B}^{j} \oplus K_{AB}^{j} \oplus S_{3}^{j} \oplus S_{6}^{j}\), where \(j = 1,2, \ldots ,n\). Then, Bob sends \(R_{B}\) to TP, where \(R_{B} = \{ R_{B}^{1},R_{B}^{2}, \ldots ,R_{B}^{n} \}\).

Step 7: After receiving \(R_{A}\) and \(R_{B}\), TP computes \(R_{T}^{j} = R_{A}^{j} \oplus R_{B}^{j} \oplus S_{2}^{j} \oplus S_{4}^{j}\), where \(j = 1,2, \ldots ,n\). Once \(R_{T}^{j} = 0\) is found, TP terminates the protocol, and tells Alice and Bob that \(M_{A}\) is not identical to \(M_{B}\). Otherwise, TP tells Alice and Bob that \(M_{A}\) is same to \(M_{B}\).

3 Correctness analysis

In the proposed SQPC protocol, Alice and Bob’s secret messages are \(M_{A} = \{ M_{A}^{1},M_{A}^{2}, \ldots , M_{A}^{n} \}\) and \(M_{B} = \{ M_{B}^{1},M_{B}^{2}, \ldots ,M_{B}^{n} \}\), respectively; Alice and Bob intent to judge the equality of \(M_{A}\) and \(M_{B}\) with the help of a semi-honest TP. Apparently, as the initial states prepared by TP are always in the state of \(\vert \psi ^{ +} \rangle \), we have \(S_{1}^{j} \oplus S_{2}^{j} = 1\), \(S_{3}^{j} \oplus S_{4}^{j} = 1\) and \(S_{5}^{j} \oplus S_{6}^{j} = 1\), where \(j = 1,2, \ldots ,n\). Because \(R_{A}^{j} = M_{A}^{j} \oplus K_{AB}^{j} \oplus S_{1}^{j} \oplus S_{5}^{j}\) and \(R_{B}^{j} = M_{B}^{j} \oplus K_{AB}^{j} \oplus S_{3}^{j} \oplus S_{6}^{j}\), it can be obtained that

$$\begin{aligned} R_{T}^{j} &= R_{A}^{j} \oplus R_{B}^{j} \oplus S_{2}^{j} \oplus S_{4}^{j} \\ &= \bigl( M_{A}^{j} \oplus K_{AB}^{j} \oplus S_{1}^{j} \oplus S_{5}^{j} \bigr) \oplus \bigl( M_{B}^{j} \oplus K_{AB}^{j} \oplus S_{3}^{j} \oplus S_{6}^{j} \bigr) \oplus S_{2}^{j} \oplus S_{4}^{j} \\ &= M_{A}^{j} \oplus M_{B}^{j} \oplus 1. \end{aligned}$$
(1)

According to Eq. (1), \(R_{T}^{j} = 0\) indicates that \(M_{A}^{j} \ne M_{B}^{j}\). Therefore, only when \(R_{T}^{j} = 1\) stands for \(j = 1,2, \ldots ,n\) can we have \(M_{A} = M_{B}\).

4 Security analysis

4.1 Outside attack

In the proposed SQPC protocol, TP sends \(T_{1}\) to Alice and \(T_{3}\) to Bob firstly, and then transmits \(T_{5}\) and \(T_{6}\) to Alice and Bob, respectively. For clarity, we firstly analyze the security of transmission of \(T_{1}\) or \(T_{3}\), and then validate the security of transmissions of \(T_{5}\) and \(T_{6}\).

Case 1: Eve attacks \(T_{1}\) when it goes from TP to Alice or \(T_{3}\) when it goes from TP to Bob

In the proposed SQPC protocol, \(T_{1}\), which is independent from \(T_{3}\), essentially plays the same role to \(T_{3}\). Thus, for simplicity, we only analyze the transmission security of \(T_{1}\) from TP to Alice and back to TP.

(1) The intercept-resend attack

During the transmission of \(T_{1}\) from TP to Alice and back to TP, Eve may try her best to obtain \(S_{1}\) by launching the following attack: Eve may intercept the particles of \(T_{1}\) from TP to Alice and send the fake particles she generated in the Z basis beforehand to Alice. However, Eve will be inevitably detected due to the following two reasons: on one hand, the fake particles she prepared beforehand may be different from the genuine ones in \(T_{1}\); and on the other hand, she doesn’t know Alice’s operations, which are random in fact. Concretely speaking, when TP sends one particle of \(T_{1}\) to Alice, Eve intercepts it and sends the prepared fake one to Alice. Without loss of generality, assume that the fake one prepared by herself is in the state of \(\vert 0 \rangle \). As a result, if Alice chooses to MEASURE, her measurement result will be \(\vert 0 \rangle \). After Alice tells TP her operation, TP uses the Z basis to measure the corresponding particle in \(T_{2}\) and obtains the measurement result randomly in one of the two states \(\vert 0 \rangle \) and \(\vert 1 \rangle \). Hence, if Alice chooses to MEASURE, Eve will be detected with the probability of \(\frac{1}{2}\). If Alice chooses to REFLECT, TP will receive the fake particle. After Alice tells TP her operation, TP measures the fake particle and the corresponding particle in \(T_{2}\) with the Bell basis, and obtains the measurement result randomly in one of the four states \(\vert \psi ^{ +} \rangle \), \(\vert \psi ^{ -} \rangle \), \(\vert \phi ^{ +} \rangle \) and \(\vert \phi ^{ -} \rangle \), where \(\vert \psi ^{ -} \rangle = \frac{1}{\sqrt{2}} ( \vert 01 \rangle - \vert 10 \rangle )\) and \(\vert \phi ^{ \pm} \rangle = \frac{1}{\sqrt{2}} ( \vert 00 \rangle \pm \vert 11 \rangle )\). Hence, if Alice chooses to REFLECT, Eve will be detected with the probability of \(\frac{3}{4}\). To sum up, when Eve launches this kind of attack on one particle of \(T_{1}\), the probability that she will be discovered is \(\frac{1}{2} \times \frac{1}{2} + \frac{1}{2} \times \frac{3}{4} = \frac{5}{8}\).

(2) The measure-resend attack

In order to obtain \(S_{1}\), Eve may intercept the particles of \(T_{1}\) sent from TP to Alice, measure them with the Z basis and send the resulted states to Alice. However, this kind of attack from Eve will be inevitably discovered, since Alice’s operations are random. Concretely speaking, after Eve’s measurement, the particle Eve sends to Alice is randomly in one of the two states \(\vert 0 \rangle \) and \(\vert 1 \rangle \). Without loss of generality, assume that the particle after Eve’s measurement is in the state of \(\vert 0 \rangle \). If Alice chooses to MEASURE, after she tells TP her operation, TP uses the Z basis to measure the corresponding particle in \(T_{2}\) and obtains the measurement result \(\vert 1 \rangle \). Hence, if Alice chooses to MEASURE, Eve will be detected with the probability of 0. If Alice chooses to REFLECT, after she tells TP her operation, TP measures the received particle from Alice and the corresponding particle in \(T_{2}\) with the Bell basis, and obtains the measurement result randomly in one of the two states \(\vert \psi ^{ +} \rangle \) and \(\vert \psi ^{ -} \rangle \). Hence, if Alice chooses to REFLECT, Eve will be detected with the probability of \(\frac{1}{2}\). To sum up, when Eve launches this kind of attack on one particle of \(T_{1}\), the probability that she will be discovered is \(\frac{1}{2} \times 0 + \frac{1}{2} \times \frac{1}{2} = \frac{1}{4}\).

(3) The entangle-measure attack

Eve may try to obtain something useful by entangling her auxiliary qubit with the transmitted qubit. Eve’s entangle-measure attack on the particles of \(T_{1}\), depicted as Fig. 2, can be modeled with two unitary operations Ê and . Here, Ê attacks the qubit sent from TP to Alice, while attacks the qubit returned from Alice to TP. Moreover, Ê and share a common probe space with the initial state \(\vert \varepsilon \rangle _{E}\). According to Refs. [29, 30], the shared probe permits Eve to attack the returned particles depending on the knowledge obtained from Ê; and any attack where Eve would make depend on a measurement after performing Ê can be realized by Ê and with controlled gates.

Figure 2
figure 2

Eve’s entangle-measure attack on the particles of \(T_{1}\) with two unitaries Ê and

Theorem 1

Suppose that Eve performs attack \(( \hat{E},\hat{F} )\) on the particle from TP to Alice and back to TP. For this attack inducing no error in Step 3, the final state of Eve’s probe should be independent of not only Alice’s operation but also TP and Alice’s measurement results. As a result, Eve gets no information on the bits of \(S_{1}\) and \(S_{2}\).

Proof

The effect of Ê on the qubits \(\vert 0 \rangle \) and \(\vert 1 \rangle \) can be expressed as

$$\begin{aligned}& \hat{E} \bigl( \vert 0 \rangle \vert \varepsilon \rangle _{E} \bigr) = \alpha _{00} \vert 0 \rangle \vert \varepsilon _{00} \rangle + \alpha _{01} \vert 1 \rangle \vert \varepsilon _{01} \rangle , \end{aligned}$$
(2)
$$\begin{aligned}& \hat{E} \bigl( \vert 1 \rangle \vert \varepsilon \rangle _{E} \bigr) = \alpha _{10} \vert 0 \rangle \vert \varepsilon _{10} \rangle + \alpha _{11} \vert 1 \rangle \vert \varepsilon _{11} \rangle , \end{aligned}$$
(3)

where \(\vert \varepsilon _{00} \rangle \), \(\vert \varepsilon _{01} \rangle \), \(\vert \varepsilon _{10} \rangle \) and \(\vert \varepsilon _{11} \rangle \) are Eve’s probe states determined by Ê, \(\vert \alpha _{00} \vert ^{2} + \vert \alpha _{01} \vert ^{2} = 1\) and \(\vert \alpha _{10} \vert ^{2} + \vert \alpha _{11} \vert ^{2} = 1\).

According to Stinespring dilation theorem, the global state of the composite system before Alice’ s operation is

$$\begin{aligned} &\hat{E} \bigl( \vert \psi ^{ +} \rangle _{12} \vert \varepsilon \rangle _{E} \bigr)\\ &\quad = \hat{E} \biggl[ \frac{1}{\sqrt{2}} \bigl( \vert 01 \rangle + \vert 10 \rangle \bigr)_{12} \vert \varepsilon \rangle _{E} \biggr] \\ &\quad= \frac{1}{\sqrt{2}} \bigl[ \bigl( \alpha _{00} \vert 0 \rangle _{1} \vert \varepsilon _{00} \rangle + \alpha _{01} \vert 1 \rangle _{1} \vert \varepsilon _{01} \rangle \bigr) \vert 1 \rangle _{2} + \bigl( \alpha _{10} \vert 0 \rangle _{1} \vert \varepsilon _{10} \rangle + \alpha _{11} \vert 1 \rangle _{1} \vert \varepsilon _{11} \rangle \bigr) \vert 0 \rangle _{2} \bigr] \\ &\quad= \frac{1}{\sqrt{2}} \bigl[ \vert 0 \rangle _{1} \bigl( \alpha _{00} \vert 1 \rangle _{2} \vert \varepsilon _{00} \rangle + \alpha _{10} \vert 0 \rangle _{2} \vert \varepsilon _{10} \rangle \bigr) + \vert 1 \rangle _{1} \bigl( \alpha _{01} \vert 1 \rangle _{2} \vert \varepsilon _{01} \rangle + \alpha _{11} \vert 0 \rangle _{2} \vert \varepsilon _{11} \rangle \bigr) \bigr], \end{aligned}$$
(4)

where the subscripts 1 and 2 represent the particles from \(T_{1}\) and \(T_{2}\), respectively.

(i) Firstly, consider the case that Alice chooses to MEASURE. As a result, the state of the composite system is collapsed into \(\vert 0 \rangle _{1} ( \alpha _{00} \vert 1 \rangle _{2} \vert \varepsilon _{00} \rangle + \alpha _{10} \vert 0 \rangle _{2} \vert \varepsilon _{10} \rangle )\) when Alice’s measurement result is \(\vert 0 \rangle _{1}\) or \(\vert 1 \rangle _{1} ( \alpha _{01} \vert 1 \rangle _{2} \vert \varepsilon _{01} \rangle + \alpha _{11} \vert 0 \rangle _{2} \vert \varepsilon _{11} \rangle )\) when Alice’s measurement result is \(\vert 1 \rangle _{1}\).

Eve imposes on the particle sent back to TP. In order that Eve’s attacks on the MEASURE particle will not be discovered by TP and Alice in Step 3, the global state of the composite system should be

$$ \hat{F} \bigl[ \vert 0 \rangle _{1} \bigl( \alpha _{00} \vert 1 \rangle _{2} \vert \varepsilon _{00} \rangle + \alpha _{10} \vert 0 \rangle _{2} \vert \varepsilon _{10} \rangle \bigr) \bigr] = \vert 0 \rangle _{1} \vert 1 \rangle _{2} \vert \varepsilon _{0} \rangle , $$
(5)

when Alice’s measurement result is \(\vert 0 \rangle _{1}\); or

$$ \hat{F} \bigl[ \vert 1 \rangle _{1} \bigl( \alpha _{01} \vert 1 \rangle _{2} \vert \varepsilon _{01} \rangle + \alpha _{11} \vert 0 \rangle _{2} \vert \varepsilon _{11} \rangle \bigr) \bigr] = \vert 1 \rangle _{1} \vert 0 \rangle _{2} \vert \varepsilon _{1} \rangle , $$
(6)

when Alice’s measurement result is \(\vert 1 \rangle _{1}\).

(ii) Secondly, consider the case that Alice chooses to REFLECT. As a result, the state of the composite system is \(\frac{1}{\sqrt{2}} [ \vert 0 \rangle _{1} ( \alpha _{00} \vert 1 \rangle _{2} \vert \varepsilon _{00} \rangle + \alpha _{10} \vert 0 \rangle _{2} \vert \varepsilon _{10} \rangle ) + \vert 1 \rangle _{1} ( \alpha _{01} \vert 1 \rangle _{2} \vert \varepsilon _{01} \rangle + \alpha _{11} \vert 0 \rangle _{2} \vert \varepsilon _{11} \rangle ) ]\).

Eve imposes on the particle sent back to TP. According to Eq. (5) and Eq. (6), it has

$$\begin{aligned}& \hat{F} \bigl[ \hat{E} \bigl( \vert \psi ^{ +} \rangle _{12} \vert \varepsilon \rangle _{E} \bigr) \bigr] \\& \quad = \frac{1}{\sqrt{2}} \hat{F} \bigl[ \vert 0 \rangle _{1} \bigl( \alpha _{00} \vert 1 \rangle _{2} \vert \varepsilon _{00} \rangle + \alpha _{10} \vert 0 \rangle _{2} \vert \varepsilon _{10} \rangle \bigr) + \vert 1 \rangle _{1} \bigl( \alpha _{01} \vert 1 \rangle _{2} \vert \varepsilon _{01} \rangle + \alpha _{11} \vert 0 \rangle _{2} \vert \varepsilon _{11} \rangle \bigr) \bigr] \\& \quad = \frac{1}{\sqrt{2}} \bigl( \vert 0 \rangle _{1} \vert 1 \rangle _{2} \vert \varepsilon _{0} \rangle + \vert 1 \rangle _{1} \vert 0 \rangle _{2} \vert \varepsilon _{1} \rangle \bigr) \\& \quad = \frac{1}{2} \bigl[ \bigl( \vert \psi ^{ +} \rangle _{12} + \vert \psi ^{ -} \rangle _{12} \bigr) \vert \varepsilon _{0} \rangle + \bigl( \vert \psi ^{ +} \rangle _{12} - \vert \psi ^{ -} \rangle _{12} \bigr) \vert \varepsilon _{1} \rangle \bigr] \\& \quad = \frac{1}{2} \bigl[ \vert \psi ^{ +} \rangle _{12} \bigl( \vert \varepsilon _{0} \rangle + \vert \varepsilon _{1} \rangle \bigr) + \vert \psi ^{ -} \rangle _{12} \bigl( \vert \varepsilon _{0} \rangle - \vert \varepsilon _{1} \rangle \bigr) \bigr]. \end{aligned}$$
(7)

In order that Eve’s attacks on the REFLECT particle will not be discovered by TP and Alice in Step 3, the probability that TP’s measurement result on a pair of particles in \(T_{1}\) and \(T_{2}\) is \(\vert \psi ^{ +} \rangle _{12}\) should be 1. Thus, it should establish

$$ \vert \varepsilon _{0} \rangle = \vert \varepsilon _{1} \rangle = \vert \varepsilon \rangle . $$
(8)

Inserting Eq. (8) into Eq. (7) produces

$$ \hat{F} \bigl[ \hat{E} \bigl( \vert \psi ^{ +} \rangle _{12} \vert \varepsilon \rangle _{E} \bigr) \bigr] = \vert \psi ^{ +} \rangle _{12} \vert \varepsilon \rangle . $$
(9)

(iii) Inserting Eq. (8) into Eq. (5) and Eq. (6) produces

$$ \hat{F} \bigl[ \vert 0 \rangle _{1} \bigl( \alpha _{00} \vert 1 \rangle _{2} \vert \varepsilon _{00} \rangle + \alpha _{10} \vert 0 \rangle _{2} \vert \varepsilon _{10} \rangle \bigr) \bigr] = \vert 0 \rangle _{1} \vert 1 \rangle _{2} \vert \varepsilon \rangle , $$
(10)

and

$$ \hat{F} \bigl[ \vert 1 \rangle _{1} \bigl( \alpha _{01} \vert 1 \rangle _{2} \vert \varepsilon _{01} \rangle + \alpha _{11} \vert 0 \rangle _{2} \vert \varepsilon _{11} \rangle \bigr) \bigr] = \vert 1 \rangle _{1} \vert 0 \rangle _{2} \vert \varepsilon \rangle , $$
(11)

respectively.

According to Eq. (9), Eq. (10) and Eq. (11), in order not to be detected by TP and Alice, the final state of Eve’s probe should be independent from not only Alice’s operation but also the TP and Alice’s measurement results. As a result, Eve gets no information on the bits of \(S_{1}\) and \(S_{2}\).

(4)The Trojan horse attack

Because the particles of \(T_{1}\) are transmitted forth and back between TP and Alice, two types of Trojan horse attack from Eve, i.e., the invisible photon eavesdropping attack [55] and the delay-photon Trojan horse attack [56, 57], should be taken into account. In the light of Refs. [57, 58], Alice can use a wavelength filter and a photon number splitter to resist these two types of Trojan horse attack from Eve, respectively. □

Case 2: Eve attacks \(T_{5}\) and \(T_{6}\) when they go from TP to Alice and Bob

(1) The intercept-resend attack

In Step 5, TP transmits \(T_{5}\) and \(T_{6}\) to Alice and Bob, respectively. During these transmissions, Eve may try her best to obtain \(S_{5}\) and \(S_{6}\) by launching the following attack: Eve intercepts the two particles sent from TP to Alice and Bob, and sends two fake ones she prepared in the Z basis beforehand to Alice and Bob, respectively. However, Eve will be undoubtedly discovered for two facts: firstly, the fake particles she prepared beforehand may be different from the genuine ones in \(T_{5}\) and \(T_{6}\); and secondly, Alice and Bob’s operations are random. Concretely speaking, when TP sends one particle of \(T_{5}\) to Alice and one particle of \(T_{6}\) to Bob, Eve intercepts them and sends the prepared fake ones to Alice and Bob, respectively. Firstly, assume that the two fake particles prepared by Eve are in the state of \(\vert 0 \rangle \vert 0 \rangle \). As a result, if both Alice and Bob choose to REFLECT, TP will receive the two fake particles \(\vert 0 \rangle \vert 0 \rangle \). After Alice and Bob tell TP their operations, TP measures the two fake particles \(\vert 0 \rangle \vert 0 \rangle \) with the Bell basis, and obtains the measurement result randomly in one of the two states \(\vert \phi ^{ +} \rangle \) and \(\vert \phi ^{ -} \rangle \). Hence, if both Alice and Bob choose to REFLECT, Eve will be detected with the probability of 1. If Alice chooses to MEASURE and Bob chooses to REFLECT, after Alice and Bob tell TP their operations, TP will measure the fake particle \(\vert 0 \rangle \) reflected by Bob with the Z basis and require Alice to announce her measurement result. Hence, if Alice chooses to MEASURE and Bob chooses to REFLECT, Eve will be detected with the probability of 1. Similarly, if Alice chooses to REFLECT and Bob chooses to MEASURE, Eve will be also detected with the probability of 1. If both Alice and Bob choose to MEASURE, after Alice and Bob tell TP their operations, TP will measure the received particles with the Z basis and obtain the measurement result \(\vert 0 \rangle \vert 0 \rangle \). So, if both Alice and Bob choose to MEASURE, Eve will be detected with the probability of 1. To sum up, when the two fake particles prepared by Eve are in the state of \(\vert 0 \rangle \vert 0 \rangle \), Eve is detected with the probability of \(\frac{1}{4} \times 1 + \frac{1}{4} \times 1 + \frac{1}{4} \times 1 + \frac{1}{4} \times 1 = 1\). Secondly, assume that the two fake particles prepared by Eve are in the state of \(\vert 1 \rangle \vert 1 \rangle \). In this case, Eve is also detected with the probability of 1. Thirdly, assume that the two fake particles prepared by Eve are in the state of \(\vert 0 \rangle \vert 1 \rangle \). As a result, if both Alice and Bob choose to REFLECT, TP will receive the two fake particles \(\vert 0 \rangle \vert 1 \rangle \). After Alice and Bob tell TP their operations, TP measures the two fake particles \(\vert 0 \rangle \vert 1 \rangle \) with the Bell basis, and obtains the measurement result randomly in one of the two states \(\vert \psi ^{ +} \rangle \) and \(\vert \psi ^{ -} \rangle \). Hence, if both Alice and Bob choose to REFLECT, Eve will be detected with the probability of \(\frac{1}{2}\). If Alice chooses to MEASURE and Bob chooses to REFLECT, after Alice and Bob tell TP their operations, TP will measure the fake particle \(\vert 1 \rangle \) reflected by Bob with the Z basis and require Alice to announce her measurement result. Hence, if Alice chooses to MEASURE and Bob chooses to REFLECT, Eve will be detected with the probability of 0. Similarly, if Alice chooses to REFLECT and Bob chooses to MEASURE, Eve will be also detected with the probability of 0. If both Alice and Bob choose to MEASURE, after Alice and Bob tell TP their operations, TP will measure the received particles with the Z basis and obtain the result \(\vert 0 \rangle \vert 1 \rangle \). In this case, Eve will be detected with the probability of 0. To sum up, when the two fake particles prepared by TP are in the state of \(\vert 0 \rangle \vert 1 \rangle \), Eve is detected with the probability of \(\frac{1}{4} \times \frac{1}{2} + \frac{1}{4} \times 0 + \frac{1}{4} \times 0 + \frac{1}{4} \times 0 = \frac{1}{8}\). Fourthly, assume that the two fake particles prepared by Eve are in the state of \(\vert 1 \rangle \vert 0 \rangle \). In this case, Eve is also detected with the probability of \(\frac{1}{8}\).

(2) The measure-resend attack

In order to obtain \(S_{5}\), Eve may intercept the particles of \(T_{5}\) sent from TP to Alice, measure them with the Z basis and send the resulted states to Alice. In the meanwhile, in order to obtain \(S_{6}\), Eve may intercept the particles of \(T_{6}\) sent from TP to Bob, measure them with the Z basis and send the resulted states to Bob. However, this kind of attack from Eve will be detected undoubtedly as Alice and Bob’s operations are random. Concretely speaking, after Eve’s measurement, the Bell state prepared by TP is collapsed randomly into one of the two states \(\vert 01 \rangle \) and \(\vert 10 \rangle \). Without loss of generality, assume that the Bell state from TP after Eve’s measurement is collapsed into \(\vert 01 \rangle \). If both Alice and Bob choose to REFLECT, after Alice and Bob tell TP their operations, TP will measure the received particles \(\vert 01 \rangle \) with the Bell basis and obtain \(\vert \psi ^{ +} \rangle \) or \(\vert \psi ^{ -} \rangle \) with equal probability. As a result, if both Alice and Bob choose to REFLECT, Eve will be detected with the probability of \(\frac{1}{2}\). If Alice chooses to MEASURE and Bob chooses to REFLECT, after Alice and Bob tell TP their operations, TP will measure the particle \(\vert 1 \rangle \) reflected by Bob with the Z basis and require Alice to announce her measurement result. Hence, if Alice chooses to MEASURE and Bob chooses to REFLECT, Eve will be detected with the probability of 0. Similarly, if Alice chooses to REFLECT and Bob chooses to MEASURE, Eve will be also discovered with the probability of 0. If both Alice and Bob choose to MEASURE, after Alice and Bob tell TP their operations, TP will measure the received particles with the Z basis. Therefore, if both Alice and Bob choose to MEASURE, Eve will be detected with the probability of 0. To sum up, when Eve launches this kind of attack on one particle of \(T_{5}\) and one particle of \(T_{6}\), the probability that she will be discovered is \(\frac{1}{4} \times \frac{1}{2} + \frac{1}{4} \times 0 + \frac{1}{4} \times 0 + \frac{1}{4} \times 0 = \frac{1}{8}\).

(3) The entangle-measure attack

Eve’s entangle-measure attack on the particles of \(T_{5}\) and \(T_{6}\), described as Fig. 3, can be modeled as two unitaries: \(U_{E}\) attacking particles from TP to Alice and Bob and \(U_{F}\) attacking particles back from Alice and Bob to TP, where \(U_{E}\) and \(U_{F}\) share a common probe space with initial state \(\vert \xi \rangle _{E}\).

Figure 3
figure 3

Eve’s entangle-measure attack on the particles of \(T_{5}\) and \(T_{6}\) with two unitaries \(U_{E}\) and \(U_{F}\)

Theorem 2

Suppose that Eve performs attack \(( U_{E},U_{F} )\) on the particles from TP to Alice and Bob and back to TP. For this attack inducing no error in Step 5, the final state of Eve’s probe should be independent of not only Alice and Bob’s operations but also their measurement results. As a result, Eve gets no information on the bits of \(S_{5}\) and \(S_{6}\).

Proof

The effect of \(U_{E}\) on the qubits \(\vert 0 \rangle \) and \(\vert 1 \rangle \) can be expressed as

$$\begin{aligned}& U_{E} \bigl( \vert 0 \rangle \vert \xi \rangle _{E} \bigr) = \beta _{00} \vert 0 \rangle \vert \xi _{00} \rangle + \beta _{01} \vert 1 \rangle \vert \xi _{01} \rangle , \end{aligned}$$
(12)
$$\begin{aligned}& U_{E} \bigl( \vert 1 \rangle \vert \xi \rangle _{E} \bigr) = \beta _{10} \vert 0 \rangle \vert \xi _{10} \rangle + \beta _{11} \vert 1 \rangle \vert \xi _{11} \rangle , \end{aligned}$$
(13)

where \(\vert \xi _{00} \rangle \), \(\vert \xi _{01} \rangle \), \(\vert \xi _{10} \rangle \) and \(\vert \xi _{11} \rangle \) are Eve’s probe states determined by \(U_{E}\), \(\vert \beta _{00} \vert ^{2} + \vert \beta _{01} \vert ^{2} = 1\) and \(\vert \beta _{10} \vert ^{2} + \vert \beta _{11} \vert ^{2} = 1\).

According to Stinespring dilation theorem, the global state of the composite system before Alice and Bob’s operations is

$$\begin{aligned}& U_{E} \bigl( \vert \psi ^{ +} \rangle _{56} \vert \xi \rangle _{E} \bigr) \\& \quad = U_{E} \biggl[ \frac{1}{\sqrt{2}} \bigl( \vert 01 \rangle + \vert 10 \rangle \bigr)_{56} \vert \xi \rangle _{E} \biggr] \\& \quad = \frac{1}{\sqrt{2}} \bigl[ \bigl( \beta _{00} \vert 0 \rangle _{5} \vert \xi _{00} \rangle + \beta _{01} \vert 1 \rangle _{5} \vert \xi _{01} \rangle \bigr) \bigl( \beta _{10} \vert 0 \rangle _{6} \vert \xi _{10} \rangle + \beta _{11} \vert 1 \rangle _{6} \vert \xi _{11} \rangle \bigr) \\& \qquad {}+ \bigl( \beta _{10} \vert 0 \rangle _{5} \vert \xi _{10} \rangle + \beta _{11} \vert 1 \rangle _{5} \vert \xi _{11} \rangle \bigr) \bigl( \beta _{00} \vert 0 \rangle _{6} \vert \xi _{00} \rangle + \beta _{01} \vert 1 \rangle _{6} \vert \xi _{01} \rangle \bigr) \bigr] \\& \quad = \frac{1}{\sqrt{2}} \bigl[ \vert 0 \rangle _{5} \vert 0 \rangle _{6} \bigl( \beta _{00}\beta _{10} \vert \xi _{00} \rangle \vert \xi _{10} \rangle + \beta _{10}\beta _{00} \vert \xi _{10} \rangle \vert \xi _{00} \rangle \bigr) \\& \qquad {}+ \vert 0 \rangle _{5} \vert 1 \rangle _{6} \bigl( \beta _{00}\beta _{11} \vert \xi _{00} \rangle \vert \xi _{11} \rangle + \beta _{10}\beta _{01} \vert \xi _{10} \rangle \vert \xi _{01} \rangle \bigr) \\& \qquad {}+ \vert 1 \rangle _{5} \vert 0 \rangle _{6} \bigl( \beta _{01}\beta _{10} \vert \xi _{01} \rangle \vert \xi _{10} \rangle + \beta _{11}\beta _{00} \vert \xi _{11} \rangle \vert \xi _{00} \rangle \bigr) \\& \qquad {}+ \vert 1 \rangle _{5} \vert 1 \rangle _{6} \bigl( \beta _{01}\beta _{11} \vert \xi _{01} \rangle \vert \xi _{11} \rangle + \beta _{11}\beta _{01} \vert \xi _{11} \rangle \vert \xi _{01} \rangle \bigr) \bigr] \\& \quad = \vert 0 \rangle _{5} \vert 0 \rangle _{6} \vert \vartheta _{00} \rangle + \vert 0 \rangle _{5} \vert 1 \rangle _{6} \vert \vartheta _{01} \rangle + \vert 1 \rangle _{5} \vert 0 \rangle _{6} \vert \vartheta _{10} \rangle + \vert 1 \rangle _{5} \vert 1 \rangle _{6} \vert \vartheta _{11} \rangle , \end{aligned}$$
(14)

where the subscripts 5 and 6 represent the particles from \(T_{5}\) and \(T_{6}\), respectively, and

$$\begin{aligned}& \vert \vartheta _{00} \rangle = \frac{1}{\sqrt{2}} \bigl( \beta _{00}\beta _{10} \vert \xi _{00} \rangle \vert \xi _{10} \rangle + \beta _{10}\beta _{00} \vert \xi _{10} \rangle \vert \xi _{00} \rangle \bigr), \end{aligned}$$
(15)
$$\begin{aligned}& \vert \vartheta _{01} \rangle = \frac{1}{\sqrt{2}} \bigl( \beta _{00}\beta _{11} \vert \xi _{00} \rangle \vert \xi _{11} \rangle + \beta _{10}\beta _{01} \vert \xi _{10} \rangle \vert \xi _{01} \rangle \bigr), \end{aligned}$$
(16)
$$\begin{aligned}& \vert \vartheta _{10} \rangle = \frac{1}{\sqrt{2}} \bigl( \beta _{01}\beta _{10} \vert \xi _{01} \rangle \vert \xi _{10} \rangle + \beta _{11}\beta _{00} \vert \xi _{11} \rangle \vert \xi _{00} \rangle \bigr), \end{aligned}$$
(17)
$$\begin{aligned}& \vert \vartheta _{11} \rangle = \frac{1}{\sqrt{2}} \bigl( \beta _{01}\beta _{11} \vert \xi _{01} \rangle \vert \xi _{11} \rangle + \beta _{11}\beta _{01} \vert \xi _{11} \rangle \vert \xi _{01} \rangle \bigr) . \end{aligned}$$
(18)

When Alice and Bob receive the particles from TP, they choose either to MEASURE or to REFLECT. After that, Eve performs \(U_{F}\) on the particles sent back to TP.

(i) Consider the case that both Alice and Bob choose to MEASURE. As a result, the state of the composite system is collapsed into \(\vert x \rangle _{5} \vert y \rangle _{6} \vert \vartheta _{xy} \rangle \), where \(x,y \in \{ 0,1 \}\). For Eve not being detectable in Step 5, \(U_{F}\) should satisfy

$$ U_{F} \bigl( \vert x \rangle _{5} \vert y \rangle _{6} \vert \vartheta _{xy} \rangle \bigr) = \vert x \rangle _{5} \vert y \rangle _{6} \vert \gamma _{xy} \rangle , $$
(19)

which means that \(U_{F}\) cannot alter the state of particles from Alice and Bob. Otherwise, Eve is discovered with a non-zero probability.

(ii) Consider the case that Alice chooses to MEASURE and Bob chooses to REFLECT. As a result, the state of the composite system is collapsed into \(\vert 0 \rangle _{5} \vert 0 \rangle _{6} \vert \vartheta _{00} \rangle + \vert 0 \rangle _{5} \vert 1 \rangle _{6} \vert \vartheta _{01} \rangle \) when Alice’s measurement result is \(\vert 0 \rangle _{5}\) or \(\vert 1 \rangle _{5} \vert 0 \rangle _{6} \vert \vartheta _{10} \rangle + \vert 1 \rangle _{5} \vert 1 \rangle _{6} \vert \vartheta _{11} \rangle \) when Alice’s measurement result is \(\vert 1 \rangle _{5}\).

Assume that Alice’s measurement result is \(\vert 0 \rangle _{5}\). After Eve imposes \(U_{F}\) on the particles sent back to TP, due to Eq. (19), the state of the composite system is evolved into

$$ U_{F} \bigl( \vert 0 \rangle _{5} \vert 0 \rangle _{6} \vert \vartheta _{00} \rangle + \vert 0 \rangle _{5} \vert 1 \rangle _{6} \vert \vartheta _{01} \rangle \bigr) = \vert 0 \rangle _{5} \vert 0 \rangle _{6} \vert \gamma _{00} \rangle + \vert 0 \rangle _{5} \vert 1 \rangle _{6} \vert \gamma _{01} \rangle . $$
(20)

For Eve not being detectable in Step 5, the probability that TP’s measurement result on the particle reflected by Bob is \(\vert 0 \rangle _{6}\) should be 0. Hence, it has

$$ \vert \gamma _{00} \rangle = 0. $$
(21)

On the other hand, assume that Alice’s measurement result is \(\vert 1 \rangle _{5}\). After Eve imposes \(U_{F}\) on the particles sent back to TP, due to Eq. (19), the state of the composite system is evolved into

$$ U_{F} \bigl( \vert 1 \rangle _{5} \vert 0 \rangle _{6} \vert \vartheta _{10} \rangle + \vert 1 \rangle _{5} \vert 1 \rangle _{6} \vert \vartheta _{11} \rangle \bigr) = \vert 1 \rangle _{5} \vert 0 \rangle _{6} \vert \gamma _{10} \rangle + \vert 1 \rangle _{5} \vert 1 \rangle _{6} \vert \gamma _{11} \rangle . $$
(22)

For Eve not being detectable in Step 5, the probability that TP’s measurement result on the particle reflected by Bob is \(\vert 1 \rangle _{6}\) should be 0. Hence, it has

$$ \vert \gamma _{11} \rangle = 0. $$
(23)

(iii) Consider the case that Alice chooses to REFLECT and Bob chooses to MEASURE. As a result, the state of the composite system is collapsed into \(\vert 0 \rangle _{5} \vert 0 \rangle _{6} \vert \vartheta _{00} \rangle + \vert 1 \rangle _{5} \vert 0 \rangle _{6} \vert \vartheta _{10} \rangle \) when Bob’s measurement result is \(\vert 0 \rangle _{6}\) or \(\vert 0 \rangle _{5} \vert 1 \rangle _{6} \vert \vartheta _{01} \rangle + \vert 1 \rangle _{5} \vert 1 \rangle _{6} \vert \vartheta _{11} \rangle \) when Bob’s measurement result is \(\vert 1 \rangle _{6}\).

Assume that Bob’s measurement result is \(\vert 0 \rangle _{6}\). After Eve imposes \(U_{F}\) on the particles sent back to TP, due to Eq. (19), the state of the composite system is evolved into

$$ U_{F} \bigl( \vert 0 \rangle _{5} \vert 0 \rangle _{6} \vert \vartheta _{00} \rangle + \vert 1 \rangle _{5} \vert 0 \rangle _{6} \vert \vartheta _{10} \rangle \bigr) = \vert 0 \rangle _{5} \vert 0 \rangle _{6} \vert \gamma _{00} \rangle + \vert 1 \rangle _{5} \vert 0 \rangle _{6} \vert \gamma _{10} \rangle . $$
(24)

For Eve not being detectable in Step 5, the probability that TP’s measurement result on the particle reflected by Alice is \(\vert 0 \rangle _{5}\) should be 0. This automatically stands after Eq. (21) is inserted into Eq. (24).

On the other hand, assume that Bob’s measurement result is \(\vert 1 \rangle _{6}\). After Eve imposes \(U_{F}\) on the particles sent back to TP, due to Eq. (19), the state of the composite system is evolved into

$$ U_{F} \bigl( \vert 0 \rangle _{5} \vert 1 \rangle _{6} \vert \vartheta _{01} \rangle + \vert 1 \rangle _{5} \vert 1 \rangle _{6} \vert \vartheta _{11} \rangle \bigr) = \vert 0 \rangle _{5} \vert 1 \rangle _{6} \vert \gamma _{01} \rangle + \vert 1 \rangle _{5} \vert 1 \rangle _{6} \vert \gamma _{11} \rangle . $$
(25)

For Eve not being detectable in Step 5, the probability that TP’s measurement result on the particle reflected by Alice is \(\vert 1 \rangle _{5}\) should be 0. This automatically stands after Eq. (23) is inserted into Eq. (25).

(iv) Consider the case that both Alice and Bob choose to REFLECT. As a result, the state of the composite system is \(\vert 0 \rangle _{5} \vert 0 \rangle _{6} \vert \vartheta _{00} \rangle + \vert 0 \rangle _{5} \vert 1 \rangle _{6} \vert \vartheta _{01} \rangle + \vert 1 \rangle _{5} \vert 0 \rangle _{6} \vert \vartheta _{10} \rangle + \vert 1 \rangle _{5} \vert 1 \rangle _{6} \vert \vartheta _{11} \rangle \). After Eve imposes \(U_{F}\) on the particles sent back to TP, due to Eq. (19), the state of the composite system is evolved into

$$ \begin{aligned}[b] &U_{F} \bigl( \vert 0 \rangle _{5} \vert 0 \rangle _{6} \vert \vartheta _{00} \rangle + \vert 0 \rangle _{5} \vert 1 \rangle _{6} \vert \vartheta _{01} \rangle + \vert 1 \rangle _{5} \vert 0 \rangle _{6} \vert \vartheta _{10} \rangle + \vert 1 \rangle _{5} \vert 1 \rangle _{6} \vert \vartheta _{11} \rangle \bigr) \\ &\quad = \vert 0 \rangle _{5} \vert 0 \rangle _{6} \vert \gamma _{00} \rangle + \vert 0 \rangle _{5} \vert 1 \rangle _{6} \vert \gamma _{01} \rangle + \vert 1 \rangle _{5} \vert 0 \rangle _{6} \vert \gamma _{10} \rangle + \vert 1 \rangle _{5} \vert 1 \rangle _{6} \vert \gamma _{11} \rangle . \end{aligned} $$
(26)

After Eq. (21) and Eq. (23) are inserted into Eq. (26), it can be obtained that

$$\begin{aligned}& U_{F} \bigl( \vert 0 \rangle _{5} \vert 0 \rangle _{6} \vert \vartheta _{00} \rangle + \vert 0 \rangle _{5} \vert 1 \rangle _{6} \vert \vartheta _{01} \rangle + \vert 1 \rangle _{5} \vert 0 \rangle _{6} \vert \vartheta _{10} \rangle + \vert 1 \rangle _{5} \vert 1 \rangle _{6} \vert \vartheta _{11} \rangle \bigr) \\& \quad = \vert 0 \rangle _{5} \vert 1 \rangle _{6} \vert \gamma _{01} \rangle + \vert 1 \rangle _{5} \vert 0 \rangle _{6} \vert \gamma _{10} \rangle \\& \quad = \frac{1}{\sqrt{2}} \bigl( \vert \psi ^{ +} \rangle _{56} + \vert \psi ^{ -} \rangle _{56} \bigr) \vert \gamma _{01} \rangle + \frac{1}{\sqrt{2}} \bigl( \vert \psi ^{ +} \rangle _{56} - \vert \psi ^{ -} \rangle _{56} \bigr) \vert \gamma _{10} \rangle \\& \quad = \frac{1}{\sqrt{2}} \vert \psi ^{ +} \rangle _{56} \bigl( \vert \gamma _{01} \rangle + \vert \gamma _{10} \rangle \bigr) + \frac{1}{\sqrt{2}} \vert \psi ^{ -} \rangle _{56} \bigl( \vert \gamma _{01} \rangle - \vert \gamma _{10} \rangle \bigr). \end{aligned}$$
(27)

For Eve not being detectable in Step 5, the probability that TP’s measurement result on the particles reflected by Alice and Bob is \(\vert \psi ^{ +} \rangle _{56}\) should be 1. Therefore, according to Eq. (27), it has

$$ \vert \gamma _{01} \rangle = \vert \gamma _{10} \rangle = \vert \gamma \rangle . $$
(28)

Inserting Eq. (28) into Eq. (27) produces

$$ U_{F} \bigl( \vert 0 \rangle _{5} \vert 0 \rangle _{6} \vert \vartheta _{00} \rangle + \vert 0 \rangle _{5} \vert 1 \rangle _{6} \vert \vartheta _{01} \rangle + \vert 1 \rangle _{5} \vert 0 \rangle _{6} \vert \vartheta _{10} \rangle + \vert 1 \rangle _{5} \vert 1 \rangle _{6} \vert \vartheta _{11} \rangle \bigr) = \sqrt{2} \vert \psi ^{ +} \rangle _{56} \vert \gamma \rangle . $$
(29)

(v) Applying Eq. (28) into Eq. (19) produces

$$\begin{aligned}& U_{F} \bigl( \vert 0 \rangle _{5} \vert 1 \rangle _{6} \vert \vartheta _{01} \rangle \bigr) = \vert 0 \rangle _{5} \vert 1 \rangle _{6} \vert \gamma \rangle , \end{aligned}$$
(30)
$$\begin{aligned}& U_{F} \bigl( \vert 1 \rangle _{5} \vert 0 \rangle _{6} \vert \vartheta _{10} \rangle \bigr) = \vert 1 \rangle _{5} \vert 0 \rangle _{6} \vert \gamma \rangle . \end{aligned}$$
(31)

Applying Eq. (21) and Eq. (28) into Eq. (20) produces

$$ U_{F} \bigl( \vert 0 \rangle _{5} \vert 0 \rangle _{6} \vert \vartheta _{00} \rangle + \vert 0 \rangle _{5} \vert 1 \rangle _{6} \vert \vartheta _{01} \rangle \bigr) = \vert 0 \rangle _{5} \vert 1 \rangle _{6} \vert \gamma \rangle . $$
(32)

Applying Eq. (23) and Eq. (28) into Eq. (22) produces

$$ U_{F} \bigl( \vert 1 \rangle _{5} \vert 0 \rangle _{6} \vert \vartheta _{10} \rangle + \vert 1 \rangle _{5} \vert 1 \rangle _{6} \vert \vartheta _{11} \rangle \bigr) = \vert 1 \rangle _{5} \vert 0 \rangle _{6} \vert \gamma \rangle . $$
(33)

Applying Eq. (21) and Eq. (28) into Eq. (24) produces

$$ U_{F} \bigl( \vert 0 \rangle _{5} \vert 0 \rangle _{6} \vert \vartheta _{00} \rangle + \vert 1 \rangle _{5} \vert 0 \rangle _{6} \vert \vartheta _{10} \rangle \bigr) = \vert 1 \rangle _{5} \vert 0 \rangle _{6} \vert \gamma \rangle . $$
(34)

Applying Eq. (23) and Eq. (28) into Eq. (25) produces

$$ U_{F} \bigl( \vert 0 \rangle _{5} \vert 1 \rangle _{6} \vert \vartheta _{01} \rangle + \vert 1 \rangle _{5} \vert 1 \rangle _{6} \vert \vartheta _{11} \rangle \bigr) = \vert 0 \rangle _{5} \vert 1 \rangle _{6} \vert \gamma \rangle . $$
(35)

According to Eqs. (29)–(35), it can be concluded that for Eve not inducing an error in Step 5, the final state of Eve’s probe should be independent of not only Alice and Bob’s operations but also their measurement results. As a result, Eve gets no information on the bits of \(S_{5}\) and \(S_{6}\).

Secondly, we consider the entangle-measure attack from Eve that she only performs \(U_{E}\) on the particles of \(T_{5}\) and \(T_{6}\) sent out from TP. □

Lemma 1

Suppose that Eve only performs \(U_{E}\) on the particles of \(T_{5}\) and \(T_{6}\) sent out from TP. For this attack inducing no error in Step 5, the final state of Eve’s probe should be independent of not only Alice and Bob’s operations but also their measurement results. As a result, Eve gets no information on the bits of \(S_{5}\) and \(S_{6}\).

Proof

The global state of the composite system before Alice and Bob’s operations can be depicted as Eq. (14). When Alice and Bob receive the particles from TP, they choose either to MEASURE or to REFLECT.

(i) Consider the case that both Alice and Bob choose to MEASURE. As a result, the state of the composite system is collapsed into \(\vert x \rangle _{5} \vert y \rangle _{6} \vert \vartheta _{xy} \rangle \), where \(x,y \in \{ 0,1 \}\). After that, Eve does nothing on the particles sent back to TP. Hence, Eve cannot be detected in Step 5.

(ii) Consider the case that Alice chooses to MEASURE and Bob chooses to REFLECT. As a result, the state of the composite system is collapsed into \(\vert 0 \rangle _{5} \vert 0 \rangle _{6} \vert \vartheta _{00} \rangle + \vert 0 \rangle _{5} \vert 1 \rangle _{6} \vert \vartheta _{01} \rangle \) when Alice’s measurement result is \(\vert 0 \rangle _{5}\) or \(\vert 1 \rangle _{5} \vert 0 \rangle _{6} \vert \vartheta _{10} \rangle + \vert 1 \rangle _{5} \vert 1 \rangle _{6} \vert \vartheta _{11} \rangle \) when Alice’s measurement result is \(\vert 1 \rangle _{5}\).

Assume that Alice’s measurement result is \(\vert 0 \rangle _{5}\). Eve does nothing on the particles sent back to TP. For Eve not being detectable in Step 5, the probability that TP’s measurement result on the particle reflected by Bob is \(\vert 0 \rangle _{6}\) should be 0. Hence, it has

$$ \vert \vartheta _{00} \rangle = 0. $$
(36)

On the other hand, assume that Alice’s measurement result is \(\vert 1 \rangle _{5}\). Eve does nothing on the particles sent back to TP. For Eve not being detectable in Step 5, the probability that TP’s measurement result on the particle reflected by Bob is \(\vert 1 \rangle _{6}\) should be 0. Hence, it has

$$ \vert \vartheta _{11} \rangle = 0. $$
(37)

(iii) Consider the case that Alice chooses to REFLECT and Bob chooses to MEASURE. As a result, the state of the composite system is collapsed into \(\vert 0 \rangle _{5} \vert 0 \rangle _{6} \vert \vartheta _{00} \rangle + \vert 1 \rangle _{5} \vert 0 \rangle _{6} \vert \vartheta _{10} \rangle \) when Bob’s measurement result is \(\vert 0 \rangle _{6}\) or \(\vert 0 \rangle _{5} \vert 1 \rangle _{6} \vert \vartheta _{01} \rangle + \vert 1 \rangle _{5} \vert 1 \rangle _{6} \vert \vartheta _{11} \rangle \) when Bob’s measurement result is \(\vert 1 \rangle _{6}\).

Assume that Bob’s measurement result is \(\vert 0 \rangle _{6}\). Eve does nothing on the particles sent back to TP. For Eve not being detectable in Step 5, the probability that TP’s measurement result on the particle reflected by Alice is \(\vert 0 \rangle _{5}\) should be 0. This is automatically satisfied, since Eq. (36) stands.

On the other hand, assume that Bob’s measurement result is \(\vert 1 \rangle _{6}\). Eve does nothing on the particles sent back to TP. For Eve not being detectable in Step 5, the probability that TP’s measurement result on the particle reflected by Alice is \(\vert 1 \rangle _{5}\) should be 0. This is automatically satisfied, since Eq. (37) stands.

(iv) Consider the case that both Alice and Bob choose to REFLECT. As a result, the state of the composite system is \(\vert 0 \rangle _{5} \vert 0 \rangle _{6} \vert \vartheta _{00} \rangle + \vert 0 \rangle _{5} \vert 1 \rangle _{6} \vert \vartheta _{01} \rangle + \vert 1 \rangle _{5} \vert 0 \rangle _{6} \vert \vartheta _{10} \rangle + \vert 1 \rangle _{5} \vert 1 \rangle _{6} \vert \vartheta _{11} \rangle \). Because of Eq. (36) and Eq. (37), the state of the composite system can be expressed as

$$\begin{aligned}& \vert 0 \rangle _{5} \vert 0 \rangle _{6} \vert \vartheta _{00} \rangle + \vert 0 \rangle _{5} \vert 1 \rangle _{6} \vert \vartheta _{01} \rangle + \vert 1 \rangle _{5} \vert 0 \rangle _{6} \vert \vartheta _{10} \rangle + \vert 1 \rangle _{5} \vert 1 \rangle _{6} \vert \vartheta _{11} \rangle \\& \quad = \vert 0 \rangle _{5} \vert 1 \rangle _{6} \vert \vartheta _{01} \rangle + \vert 1 \rangle _{5} \vert 0 \rangle _{6} \vert \vartheta _{10} \rangle \\& \quad = \frac{1}{\sqrt{2}} \bigl( \vert \psi ^{ +} \rangle _{56} + \vert \psi ^{ -} \rangle _{56} \bigr) \vert \vartheta _{01} \rangle + \frac{1}{\sqrt{2}} \bigl( \vert \psi ^{ +} \rangle _{56} - \vert \psi ^{ -} \rangle _{56} \bigr) \vert \vartheta _{10} \rangle \\& \quad = \frac{1}{\sqrt{2}} \vert \psi ^{ +} \rangle _{56} \bigl( \vert \vartheta _{01} \rangle + \vert \vartheta _{10} \rangle \bigr) + \frac{1}{\sqrt{2}} \vert \psi ^{ -} \rangle _{56} \bigl( \vert \vartheta _{01} \rangle - \vert \vartheta _{10} \rangle \bigr). \end{aligned}$$
(38)

Eve does nothing on the particles sent back to TP. For Eve not being detectable in Step 5, the probability that TP’s measurement result on the particles reflected by Alice and Bob is \(\vert \psi ^{ +} \rangle _{56}\) should be 1. Therefore, it can be derived from Eq. (38) that

$$ \vert \vartheta _{01} \rangle = \vert \vartheta _{10} \rangle = \vert \vartheta \rangle . $$
(39)

Inserting Eq. (39) into Eq. (38) produces

$$ \vert 0 \rangle _{5} \vert 0 \rangle _{6} \vert \vartheta _{00} \rangle + \vert 0 \rangle _{5} \vert 1 \rangle _{6} \vert \vartheta _{01} \rangle + \vert 1 \rangle _{5} \vert 0 \rangle _{6} \vert \vartheta _{10} \rangle + \vert 1 \rangle _{5} \vert 1 \rangle _{6} \vert \vartheta _{11} \rangle = \sqrt{2} \vert \psi ^{ +} \rangle _{56} \vert \vartheta \rangle . $$
(40)

It can be concluded from the above analysis: considering the entangle-measure attack from Eve that she only performs \(U_{E}\) on the particles of \(T_{5}\) and \(T_{6}\) sent out from TP, for Eve not inducing an error in Step 5, the final state of Eve’s probe should be independent of not only Alice and Bob’s operations but also their measurement results. As a result, Eve gets no information on the bits of \(S_{5}\) and \(S_{6}\).

Thirdly, we consider the entangle-measure attack from Eve that she only performs \(U_{F}\) on the particles of \(T_{5}\) and \(T_{6}\) sent back to TP. □

Lemma 2

Suppose that Eve only performs \(U_{F}\) on the particles of \(T_{5}\) and \(T_{6}\) sent back to TP. For this attack inducing no error in Step 5, the final state of Eve’s probe should be independent of not only Alice and Bob’s operations but also their measurement results. As a result, Eve gets no information on the bits of \(S_{5}\) and \(S_{6}\).

Proof

Eve does nothing on the particles of \(T_{5}\) and \(T_{6}\) sent out from TP. As a result, the global state of the composite system before Alice and Bob’s operations can be depicted as \(\vert \psi ^{ +} \rangle _{56} \vert \xi \rangle _{E}\). When Alice and Bob receive the particles sent out from TP, they choose either to MEASURE or to REFLECT.

(i) Consider the case that both Alice and Bob choose to MEASURE. As a result, the state of the composite system is randomly collapsed into \(\vert t \rangle _{5} \vert r \rangle _{6} \vert \xi \rangle _{E}\), where \(t,r \in \{ 0,1 \}\) and \(t \oplus r = 1\). After that, Eve performs \(U_{F}\) on the particles sent back to TP. For Eve not being detectable in Step 5, \(U_{F}\) should satisfy

$$ U_{F} \bigl( \vert t \rangle _{5} \vert r \rangle _{6} \vert \xi \rangle \bigr) = \vert t \rangle _{5} \vert r \rangle _{6} \vert \delta _{tr} \rangle $$
(41)

for \(t,r \in \{ 0,1 \}\) and \(t \oplus r = 1\), which means that \(U_{F}\) cannot alter the state of particles from Alice and Bob. Otherwise, Eve is discovered with a non-zero probability.

(ii) Consider the case that Alice chooses to MEASURE and Bob chooses to REFLECT. As a result, the state of the composite system is collapsed into \(\vert 0 \rangle _{5} \vert 1 \rangle _{6} \vert \xi \rangle _{E}\) when Alice’s measurement result is \(\vert 0 \rangle _{5}\) or \(\vert 1 \rangle _{5} \vert 0 \rangle _{6} \vert \xi \rangle _{E}\) when Alice’s measurement result is \(\vert 1 \rangle _{5}\).

Assume that Alice’s measurement result is \(\vert 0 \rangle _{5}\). After Eve imposes \(U_{F}\) on the particles sent back to TP, due to Eq. (41), the state of the composite system is evolved into

$$ U_{F} \bigl( \vert 0 \rangle _{5} \vert 1 \rangle _{6} \vert \xi \rangle \bigr) = \vert 0 \rangle _{5} \vert 1 \rangle _{6} \vert \delta _{01} \rangle . $$
(42)

For Eve not being detectable in Step 5, the probability that TP’s measurement result on the particle reflected by Bob is \(\vert 0 \rangle _{6}\) should be 0. Apparently, this point is automatically satisfied.

On the other hand, assume that Alice’s measurement result is \(\vert 1 \rangle _{5}\). After Eve imposes \(U_{F}\) on the particles sent back to TP, due to Eq. (41), the state of the composite system is evolved into

$$ U_{F} \bigl( \vert 1 \rangle _{5} \vert 0 \rangle _{6} \vert \xi \rangle \bigr) = \vert 1 \rangle _{5} \vert 0 \rangle _{6} \vert \delta _{10} \rangle . $$
(43)

For Eve not being detectable in Step 5, the probability that TP’s measurement result on the particle reflected by Bob is \(\vert 1 \rangle _{6}\) should be 0. Apparently, this point is automatically satisfied.

(iii) Consider the case that Alice chooses to REFLECT and Bob chooses to MEASURE. As a result, the state of the composite system is collapsed into \(\vert 1 \rangle _{5} \vert 0 \rangle _{6} \vert \xi \rangle _{E}\) when Bob’s measurement result is \(\vert 0 \rangle _{6}\) or \(\vert 0 \rangle _{5} \vert 1 \rangle _{6} \vert \xi \rangle _{E}\) when Bob’s measurement result is \(\vert 1 \rangle _{6}\).

Assume that Bob’s measurement result is \(\vert 0 \rangle _{6}\). After Eve imposes \(U_{F}\) on the particles sent back to TP, due to Eq. (41), the state of the composite system is evolved into Eq. (43). For Eve not being detectable in Step 5, the probability that TP’s measurement result on the particle reflected by Alice is \(\vert 0 \rangle _{5}\) should be 0. Apparently, this point is automatically satisfied.

On the other hand, assume that Bob’s measurement result is \(\vert 1 \rangle _{6}\). After Eve imposes \(U_{F}\) on the particles sent back to TP, due to Eq. (41), the state of the composite system is evolved into Eq. (42). For Eve not being detectable in Step 5, the probability that TP’s measurement result on the particle reflected by Alice is \(\vert 1 \rangle _{5}\) should be 0. Apparently, this point is automatically satisfied.

(iv) Consider the case that both Alice and Bob choose to REFLECT. As a result, the state of the composite system is \(\vert \psi ^{ +} \rangle _{56} \vert \xi \rangle _{E}\). After Eve imposes \(U_{F}\) on the particles sent back to TP, due to Eq. (41), the state of the composite system is evolved into

$$\begin{aligned} U_{F} \bigl( \vert \psi ^{ +} \rangle _{56} \vert \xi \rangle \bigr) &= \frac{1}{\sqrt{2}} \bigl( \vert 0 \rangle _{5} \vert 1 \rangle _{6} \vert \delta _{01} \rangle + \vert 1 \rangle _{5} \vert 0 \rangle _{6} \vert \delta _{10} \rangle \bigr) \\ &= \frac{1}{2} \bigl( \vert \psi ^{ +} \rangle _{56} + \vert \psi ^{ -} \rangle _{56} \bigr) \vert \delta _{01} \rangle + \frac{1}{2} \bigl( \vert \psi ^{ +} \rangle _{56} - \vert \psi ^{ -} \rangle _{56} \bigr) \vert \delta _{10} \rangle \\ &= \frac{1}{2} \vert \psi ^{ +} \rangle _{56} \bigl( \vert \delta _{01} \rangle + \vert \delta _{10} \rangle \bigr) + \frac{1}{2} \vert \psi ^{ -} \rangle _{56} \bigl( \vert \delta _{01} \rangle - \vert \delta _{10} \rangle \bigr). \end{aligned}$$
(44)

For Eve not being detectable in Step 5, the probability that TP’s measurement result on the particles reflected by Alice and Bob is \(\vert \psi ^{ +} \rangle _{56}\) should be 1. Hence, it can be obtained from Eq. (44) that

$$ \vert \delta _{01} \rangle = \vert \delta _{10} \rangle = \vert \delta \rangle . $$
(45)

Inserting Eq. (45) into Eq. (44) generates

$$ U_{F} \bigl( \vert \psi ^{ +} \rangle _{56} \vert \xi \rangle \bigr) = \bigl\vert \psi ^{ +} \rangle _{56} \bigr\vert \delta \rangle . $$
(46)

It can be concluded from the above analysis: considering the entangle-measure attack from Eve that she only performs \(U_{F}\) on the particles of \(T_{5}\) and \(T_{6}\) sent back to TP, for Eve not inducing an error in Step 5, the final state of Eve’s probe should be independent of not only Alice and Bob’s operations but also their measurement results. As a result, Eve gets no information on the bits of \(S_{5}\) and \(S_{6}\). □

(4) The Trojan horse attack

In accordance with Refs. [57, 58], the invisible photon eavesdropping attack and the delay-photon Trojan horse attack from Eve on the particles of \(T_{5}\) during the round trip between TP and Alice can be overcome by Alice with a wavelength filter and a photon number splitter, respectively. The same methods can be used to prevent the invisible photon eavesdropping attack and the delay-photon Trojan horse attack from Eve on the particles of \(T_{6}\) during the round trip between TP and Bob.

4.2 Participant attack

With respect to the participant attack suggested by Gao et al. [59], we need to consider the participant attack from Alice or Bob and that from the semi-honest TP.

(1) The participant attack from Alice or Bob

In the proposed protocol, Alice plays the same role to Bob. Without loss of generality, we only consider the case that Bob, who is supposed to have complete quantum abilities, is dishonest.

In the proposed protocol, Bob naturally knows \(S_{3}\) and \(S_{6}\). Moreover, according to the entanglement correlation of two qubits within one Bell state, Bob can deduce \(S_{4}\) and \(S_{5}\) from \(S_{3}\) and \(S_{6}\), respectively. As \(M_{A}\) is encrypted with \(S_{1}\), \(S_{5}\) and \(K_{AB}\), in order to deduce \(M_{A}\) from \(R_{A}\), Bob should further know \(S_{1}\). However, Bob cannot get \(S_{1}\) by cooperating with TP who knows \(S_{2}\). As a result, Bob has to try his best to get \(S_{1}\) by launching some active attacks on the particles of \(T_{1}\), such as the intercept-resend attack, the measure-resend attack, the entangle-measure attack, the Trojan horse attack, et al. However, he will be inevitably discovered as an external eavesdropper, since Alice’s operations are random to him, after similar deductions to those of Case 1 in Sect. 4.1. In conclusion, Bob has no chance to obtain \(M_{A}\).

(2) The participant attack from TP

TP may try to obtain \(M_{A}\) and \(M_{B}\) by using passive attacks. In other words, TP may try to reveal \(M_{A}\) and \(M_{B}\) from the classical information she collected during the implementation of the protocol. In the proposed protocol, TP can know \(S_{1}\), \(S_{2}\), \(S_{3}\), \(S_{4}\), \(S_{5}\), \(S_{6}\), \(R_{A}\), \(R_{B}\) and the comparison result of \(M_{A}\) and \(M_{B}\). However, TP still cannot deduce \(M_{A}\) from \(R_{A}\) and \(M_{B}\) from \(R_{B}\), because she cannot obtain \(K_{AB}\) shared by Alice and Bob beforehand which is used to encrypt \(M_{A}\) and \(M_{B}\).

In the proposed protocol, TP is assumed to be semi-honest. As a result, she may try to perform possible active attacks to get \(M_{A}\) and \(M_{B}\) but cannot collude with anyone else. For example, TP may prepare fake quantum states, such as product states or nonmaximal entangled states, instead of Bell states in Step 1. The proposed protocol lacks the process of checking whether TP has prepared the genuine Bell states in Step 1 or not, hence, Alice and Bob may be unknown about TP’s cheating behavior. Actually, no matter what kinds of attack TP launches, the best result for TP is that she can obtain \(S_{1}\), \(S_{2}\), \(S_{3}\), \(S_{4}\), \(S_{5}\), \(S_{6}\), \(R_{A}\), \(R_{B}\) and the comparison result of \(M_{A}\) and \(M_{B}\). However, TP still has no opportunity to decode out \(M_{A}\) from \(R_{A}\) and \(M_{B}\) from \(R_{B}\), due to lack of \(K_{AB}\).

5 Discussions and conclusions

In this part, we compare the proposed protocol with the existing SQPC protocols based on Bell states in Refs. [39, 43, 44, 4850, 53]. The detailed comparison results are shown in Table 4. Here, the qubit efficiency is defined as [60] \(\eta = \frac{b}{q + c}\), where b, q and c represent the numbers of compared private bits, consumed qubits and classical bits involved in classical communication, respectively. Note that the classical resources required for eavesdropping detection are not considered here.

Table 4 Comparison results of our SQPC protocol and the previous SQPC protocols with Bell states

In our protocol, Alice and Bob successfully compare their respective n private bits, so it has \(b = n\). TP prepares \(N = 16n\) initial Bell states and distributes \(T_{1}\) and \(T_{5}\) to Alice and \(T_{3}\) and \(T_{6}\) to Bob. Then, when Alice chooses to MEASURE the received qubits in \(T_{1}\) and \(T_{5}\), she prepares 2n and 4n new qubits, respectively. When Bob chooses to MEASURE the received qubits in \(T_{3}\) and \(T_{6}\), he also prepares 2n and 4n new qubits, respectively. In addition, this protocol employs the SQKD protocol in Ref. [31] to generate the n-bit pre-shared key \(K_{AB}\), which consumes 24n qubits. As a result, it has \(q = 16n \times 2 + 2n \times 2 + 4n \times 2 + 24n = 68n\). Alice sends \(\mathrm{R}\_\{ \mathrm{A}\} \mathrm{Z}\) to TP, while Bob sends \(R_{B}\) to TP. Hence, it has \(c = 2n\). Therefore, the qubit efficiency of our protocol is \(\eta = \frac{n}{68n + 2n} = \frac{1}{70}\).

In the protocol of Ref. [39], Alice and Bob successfully compare their respective n bits of hash values, so it has \(b = n\). Server prepares 4n initial Bell states and distributes their first and second particles to Alice and Bob, respectively. Then, Alice and Bob save the measurement results or reflect the received qubits back after reordering them. As a result, it has \(q = 4n \times 2 = 8n\). Alice sends \(R_{A}\) to Bob, while Bob sends \(R_{B}\) to Alice. Hence, it has \(c = 2n\). Therefore, the qubit efficiency of the protocol of Ref. [39] is \(\eta = \frac{n}{8n + 2n} = \frac{1}{10}\). Note that after Alice and Bob publish \(R_{A}\) and \(R_{B}\), respectively, Server can know the comparison result by computing \(R_{A} \oplus R_{B}\).

In the protocol of Ref. [43], Alice and Bob successfully compare their respective n private bits, so it has \(b = n\). TP prepares two sequences of Bell states, each of whose length is 16n, and distributes the first particles of two sequences to Alice and Bob, respectively. Then, when Alice and Bob choose to measure the received qubits, they replace the measurement results with the freshly prepared qubits. As a result, it has \(q = 16n \times 2 \times 2 + 8n \times 2 = 80n\). Alice sends \(R_{A}\) to TP, while Bob sends \(R_{B}\) to TP. Hence, it has \(c = 2n\). Therefore, the qubit efficiency of the protocol of Ref. [43] is \(\eta = \frac{n}{80n + 2n} = \frac{1}{82}\).

In the protocol of Ref. [44], Alice and Bob successfully compare their respective n private bits, so it has \(b = n\). TP prepares 8n initial Bell states and distributes their first and second particles to Alice and Bob, respectively. Then, when Alice and Bob choose to MEASURE the received qubits, they replace the measurement results with the freshly prepared qubits. In addition, the protocol employs the SQKD protocol in Ref. [31] to generate the n-bit pre-shared key \(K_{AB}\), which consumes 24n qubits, and the SQKA protocol in Ref. [41] to generate the n-bit pre-shared keys, \(K_{AT}\) and \(K_{BT}\), which consumes 10n qubits in total. As a result, it has \(q = 8n \times 2 + 4n \times 2 + 24n + 10n = 58n\). Alice sends \(C_{A}\) to TP, while Bob sends \(C_{B}\) to TP. Hence, it has \(c = 2n\). Therefore, the qubit efficiency of the protocol of Ref. [44] is \(\eta = \frac{n}{58n + 2n} = \frac{1}{60}\).

In the second protocol of Ref. [48], Alice and Bob successfully compare their respective n private bits, so it has \(b = n\). TP prepares 2n initial Bell states and distributes their first and second particles to Alice and Bob, respectively. Then, when Alice and Bob choose to flip the received qubits, they replace the measurement results with the freshly prepared opposite qubits. In addition, the protocol employs the SQKD protocol in Ref. [31] to generate the n-bit pre-shared key K, which consumes 24n qubits. As a result, it has \(q = 2n \times 2 + n \times 2 + 24n = 30n\). Alice sends \(M_{A}\) to TP, while Bob sends \(M_{B}\) to TP. Hence, it has \(c = 2n\). Therefore, the qubit efficiency of the second protocol of Ref. [48] is \(\eta = \frac{n}{30n + 2n} = \frac{1}{32}\).

In the protocol of Ref. [49], Alice and Bob successfully compare their respective n private bits, so it has \(b = n\). TP prepares 2n initial Bell states and distributes their first and second particles to Alice and Bob, respectively. Then, when Alice and Bob choose to SIFT, they generate fresh qubits and send them to TP. In addition, the protocol uses the SQKD protocol in Ref. [29] to generate two n-bit pre-shared keys, \(K_{TA}\) and \(K_{TB}\), which consumes 16n qubits in total, and the SQKD protocol in Ref. [31] to generate the n-bit pre-shared key K, which consumes 24n qubits. As a result, it has \(q = 2n \times 2 + n \times 2 + 16n + 24n = 46n\). Alice publishes \(R_{A}\) to TP, while Bob publishes \(R_{B}\) to TP. Hence, it has \(c = 2n\). Therefore, the qubit efficiency of the protocol of Ref. [49] is \(\eta = \frac{n}{46n + 2n} = \frac{1}{48}\).

In the protocol of Ref. [50], Alice and Bob successfully compare their respective n private bits, so it has \(b = n\). TP prepares 3n initial Bell states and distributes their first and second particles to Alice and Bob, respectively. Then, when Alice and Bob choose to SIFT, they generate fresh qubits and send them to TP. When Alice and Bob choose to DETECT, they generate fresh trap qubits and send them to TP. In addition, the protocol uses the SQKD protocol in Ref. [31] to generate the n-bit pre-shared key K, which consumes 24n qubits. As a result, it has \(q = 3n \times 2 + n \times 2 + n \times 2 + 24n = 34n\). Alice publishes \(R_{A} \oplus R_{A}'\) to TP, while Bob publishes \(R_{B} \oplus R_{B}'\) to TP. Hence, it has \(c = 2n\). Therefore, the qubit efficiency of the protocol of Ref. [50] is \(\eta = \frac{n}{34n + 2n} = \frac{1}{36}\).

In the protocol of Ref. [53], Alice and Bob successfully compare their respective n private bits, so it has \(b = n\). TP prepares 2n initial Bell states and distributes their first and second particles to Alice and Bob, respectively. Then, when Alice and Bob choose to MEASURE the received qubits, they generate fresh qubits and send them to TP. In addition, this protocol utilizes the SQKD protocol in Ref. [31] to generate the 2n-bit pre-shared key \(K_{AB}\), which consumes 48n qubits. As a result, it has \(q = 2n \times 2 + n \times 2 + 48n = 54n\). Both Alice and Bob publish \(K_{AB}\) to TP. Hence, it has \(c = 4n\). Therefore, the qubit efficiency of the protocol of Ref. [53] is \(\eta = \frac{n}{54n + 4n} = \frac{1}{58}\).

In addition, Ref. [43] needs quantum entanglement swapping technology, which may be difficult to implement in practice. Fortunately, our protocol doesn’t need quantum entanglement swapping technology. All of the SQPC protocols in Refs. [39, 44, 48] need to perform the reordering operations via different delay lines which require complicated quantum circuits in practice. Fortunately, our protocol doesn’t have this requirement. Moreover, each of the SQPC protocols in Refs. [43, 44, 4850, 53] needs to prepare four kinds of Bell states as initial quantum resource. Fortunately, our protocol only needs to generate one kind of Bell states. It is naturally that preparing the same kind of Bell states repeatedly is easier in practice than generating different types of Bell states. To sum up, our protocol is easier to implement in practice than the SQPC protocols in Refs. [39, 43, 44, 4850, 53].

In addition, here we can further take into account that TP may announce the fake comparison result in Step 7, which cannot be detected by Alice and Bob. In order to overcome this cheating behavior from TP, the following extra supplement should be added to the above proposed protocol: (1) in Step 6, while Alice and Bob sends \(R_{A}\) and \(R_{B}\) to TP, respectively, they also send \(R_{A}\) and \(R_{B}\) to the second semi-honest third party, TP2; (2) TP2 shares a secret key \(K_{T}\) with TP via a secure QKD scheme, where \(K_{T} = \{ K_{T}^{1},K_{T}^{2}, \ldots ,K_{T}^{n} \}\); (3) in Step 7, TP computes \(R_{TP}^{j} = K_{T}^{j} \oplus S_{2}^{j} \oplus S_{4}^{j}\) and sends \(R_{TP}\) to TP2, then TP2 computes \(R_{T2}^{j} = R_{A}^{j} \oplus R_{B}^{j} \oplus R_{TP}^{j} \oplus K_{T}^{j}\) after receiving \(R_{TP}\), where \(R_{TP} = \{ R_{TP}^{1},R_{TP}^{2}, \ldots ,R_{TP}^{n} \}\) and \(j = 1,2, \ldots ,n\); once \(R_{T2}^{j} = 0\) is found, TP2 tells Alice and Bob that \(M_{A}\) is not identical to \(M_{B}\), otherwise, TP2 tells Alice and Bob that \(M_{A}\) is identical to \(M_{B}\). Apparently, because TP and TP2 cannot conspire, their published comparison results are mutually independent. Alice and Bob can judge whether TP and TP2 have announced fake comparison results or not by comparing the consistency of their published comparison results.

In conclusion, in this paper, a novel SQPC protocol based on single kind of Bell states is proposed, which utilizes the entanglement correlation of Bell states to skillfully compare the equality of private inputs from two classical users. Our protocol can resist a variety of outside and participant attacks. Our protocol only employs one kind of Bell states as initial quantum resource. Moreover, it needs none of unitary operations, quantum entanglement swapping or the reordering operations. Therefore, compared with most of the existing SQPC protocols with Bell states, our protocol has better practical implementation feasibility.

Availability of data and materials

The datasets used during the current study are available from the corresponding author on reasonable request.

References

  1. Bennett CH, Brassard G. Quantum cryptography: public key distribution and coin tossing. In: IEEE international conference on computers, systems, and signal processing. 1984. p. 175–9.

    Google Scholar 

  2. Ekert AK. Quantum cryptography based on Bell’s theorem. Phys Rev Lett. 1991;67(6):661–3.

    Article  ADS  MathSciNet  MATH  Google Scholar 

  3. Bennett CH, Brassard G, Mermin ND. Quantum cryptography without Bell theorem. Phys Rev Lett. 1992;68:557–9.

    Article  ADS  MathSciNet  MATH  Google Scholar 

  4. Lo HK, Ma XF, Chen K. Decoy state quantum key distribution. Phys Rev Lett. 2005;94(23):230504.

    Article  ADS  Google Scholar 

  5. Hwang T, Hwang CC, Tsai CW. Quantum key distribution protocol using dense coding of three-qubit W state. Eur Phys J D. 2011;61(3):785–90.

    Article  ADS  Google Scholar 

  6. Zhang CM, Song XT, Treeviriyanupab P et al.. Delayed error verification in quantum key distribution. Chin Sci Bull. 2014;59(23):2825–8.

    Article  Google Scholar 

  7. Karlsson A, Koashi M, Imoto N. Quantum entanglement for secret sharing and secret splitting. Phys Rev A. 1999;59:162–8.

    Article  ADS  Google Scholar 

  8. Deng FG, Zhou HY, Long GL. Circular quantum secret sharing. J Phys A: Gen Phys. 2007;39(45):14089–99.

    Article  ADS  MathSciNet  MATH  Google Scholar 

  9. Sun Y, Wen QY, Gao F, Chen XB, Zhu FC. Multiparty quantum secret sharing based on Bell measurement. Opt Commun. 2009;282(17):3647–51.

    Article  ADS  Google Scholar 

  10. Hao L, Wang C, Long GL. Quantum secret sharing protocol with four state Grover algorithm and its proof-of-principle experimental demonstration. Opt Commun. 2011;284:3639–42.

    Article  ADS  Google Scholar 

  11. Long GL, Liu XS. Theoretically efficient high-capacity quantum-key-distribution scheme. Phys Rev A. 2002;65:032302.

    Article  ADS  Google Scholar 

  12. Chen XB, Wen QY, Guo FZ, Sun Y, Xu G, Zhu FC. Controlled quantum secure direct communication with W state. Int J Quantum Inf. 2008;6(4):899–906.

    Article  MATH  Google Scholar 

  13. Chang Y, Xu CX, Zhang SB et al.. Controlled quantum secure direct communication and authentication protocol based on five-particle cluster state and quantum one-time pad. Chin Sci Bull. 2014;59(21):2541–6.

    Article  Google Scholar 

  14. Zhang W, Ding DS, Sheng YB et al.. Quantum secure direct communication with quantum memory. Phys Rev Lett. 2017;118(22):220501.

    Article  ADS  Google Scholar 

  15. Peng H, Niu ZR et al.. Measurement-device-independent quantum communication without encryption. Sci Bull. 2018;63(20):1345–50.

    Article  Google Scholar 

  16. Qi RY, Long GL, Sun Z et al.. Implementation and security analysis of practical quantum secure direct communication. Light Sci Appl. 2019;8(1):183–90.

    Article  Google Scholar 

  17. Hong CH, Heo J, Jang JG, Kwon D. Quantum identity authentication with single photon. Quantum Inf Process. 2017;16:236.

    Article  ADS  MathSciNet  MATH  Google Scholar 

  18. Liu B, Gao ZF, Xiao D et al.. Quantum identity authentication in the orthogonal-state-encoding QKD system. Quantum Inf Process. 2019;18:137.

    Article  ADS  MathSciNet  MATH  Google Scholar 

  19. Yang YG, Wen QY. An efficient two-party quantum private comparison protocol with decoy photons and two-photon entanglement. J Phys A, Math Theor. 2009;42(5):055305.

    Article  ADS  MathSciNet  MATH  Google Scholar 

  20. Liu B, Gao F, Jia HY, Huang W, Zhang WW, Wen QY. Efficient quantum private comparison employing single photons and collective detection. Quantum Inf Process. 2013;12(2):887–97.

    Article  ADS  MathSciNet  MATH  Google Scholar 

  21. Li YB, Ma YJ, Xu SW et al.. Quantum private comparison based on phase encoding of single photons. Int J Theor Phys. 2014;53:3191–200.

    Article  MATH  Google Scholar 

  22. Liu W, Wang YB, Cui W. Quantum private comparison protocol based on Bell entangled states. Commun Theor Phys. 2012;57(4):583–8.

    Article  ADS  MathSciNet  MATH  Google Scholar 

  23. Tseng HY, Lin J, Hwang T. New quantum private comparison protocol using EPR pairs. Quantum Inf Process. 2012;11:373–84.

    Article  MathSciNet  MATH  Google Scholar 

  24. Lang YF. Quantum private comparison using single Bell state. Int J Theor Phys. 2021. https://doi.org/10.1007/s10773-021-04937-3.

    Article  MathSciNet  MATH  Google Scholar 

  25. Chang YJ, Tsai CW, Hwang T. Multi-user private comparison protocol using GHZ class states. Quantum Inf Process. 2013;12(2):1077–88.

    Article  ADS  MathSciNet  MATH  Google Scholar 

  26. Liu W, Wang YB. Quantum private comparison based on GHZ entangled states. Int J Theor Phys. 2012;51:3596–604.

    Article  MathSciNet  MATH  Google Scholar 

  27. Sun ZW, Long DY. Quantum private comparison protocol based on cluster states. Int J Theor Phys. 2013;52(1):212–8.

    Article  MathSciNet  MATH  Google Scholar 

  28. Lin S, Guo GD, Liu XF. Quantum private comparison of equality with χ-type entangled states. Int J Theor Phys. 2013;52(11):4185–94.

    Article  MathSciNet  MATH  Google Scholar 

  29. Boyer M, Kenigsberg D, Mor T. Quantum key distribution with classical Bob. Phys Rev Lett. 2007;99(14):140501.

    Article  ADS  MathSciNet  MATH  Google Scholar 

  30. Boyer M, Gelles R, Kenigsberg D, Mor T. Semiquantum key distribution. Phys Rev A. 2009;79(3):032341.

    Article  ADS  MathSciNet  MATH  Google Scholar 

  31. Krawec WO. Mediated semiquantum key distribution. Phys Rev A. 2015;91(3):032323.

    Article  ADS  Google Scholar 

  32. Zou XF, Qiu DW, Zhang SY, Mateus P. Semiquantum key distribution without invoking the classical party’s measurement capability. Quantum Inf Process. 2015;14(8):2981–96.

    Article  ADS  MathSciNet  MATH  Google Scholar 

  33. Lu YC, Tsai CW, Hwang T. Collective attack and improvement on “Mediated semi-quantum key distribution using single photons”. Ann Phys. 2020;532:1900493.

    Article  MathSciNet  Google Scholar 

  34. Li Q, Chan WH, Long DY. Semiquantum secret sharing using entangled states. Phys Rev A. 2010;82(2):022303.

    Article  ADS  Google Scholar 

  35. Wang J, Zhang S, Zhang Q, Tang CJ. Semiquantum secret sharing using two-particle entangled state. Int J Quantum Inf. 2012;10(5):1250050.

    Article  MathSciNet  MATH  Google Scholar 

  36. Yang CW, Hwang T. Efficient key construction on semi-quantum secret sharing protocols. Int J Quantum Inf. 2013;11(5):1350052.

    Article  MathSciNet  MATH  Google Scholar 

  37. Xie C, Li LZ, Qiu DW. A novel semi-quantum secret sharing scheme of specific bits. Int J Theor Phys. 2015;54(10):3819–24.

    Article  MathSciNet  MATH  Google Scholar 

  38. Liu WJ, Chen ZY, Ji S et al.. Multi-party semi-quantum key agreement with delegating quantum computation. Int J Theor Phys. 2017;56:3164–74.

    Article  MathSciNet  MATH  Google Scholar 

  39. Yan LL, Zhang SB, Chang Y et al.. Semi-quantum key agreement and private comparison protocols using Bell states. Int J Theor Phys. 2019;58:3852–62.

    Article  MathSciNet  MATH  Google Scholar 

  40. Zhou NR, Zhu KN, Wang YQ. Three-party semi-quantum key agreement protocol. Int J Theor Phys. 2020;59:663–76.

    Article  MathSciNet  MATH  Google Scholar 

  41. Shukla C, Thapliyal K, Pathak A. Semi-quantum communication: protocols for key agreement, controlled secure direct communication and dialogue. Quantum Inf Process. 2017;16:295.

    Article  ADS  MathSciNet  MATH  Google Scholar 

  42. Ye TY, Ye CQ. Semi-quantum dialogue based on single photons. Int J Theor Phys. 2018;57(5):1440–54.

    Article  MathSciNet  MATH  Google Scholar 

  43. Chou WH, Hwang T, Gu J. Semi-quantum private comparison protocol under an almost-dishonest third party. 2016. https://arxiv.org/abs/1607.07961.

  44. Thapliyal K, Sharma RD, Pathak A. Orthogonal-state-based and semi-quantum protocols for quantum private comparison in noisy environment. Int J Quantum Inf. 2018;16(5):1850047.

    Article  MathSciNet  MATH  Google Scholar 

  45. Ye TY, Ye CQ. Measure-resend semi-quantum private comparison without entanglement. Int J Theor Phys. 2018;57(12):3819–34.

    Article  MathSciNet  MATH  Google Scholar 

  46. Lin PH, Hwang T, Tsai CW. Efficient semi-quantum private comparison using single photons. Quantum Inf Process. 2019;18:207.

    Article  ADS  MathSciNet  MATH  Google Scholar 

  47. Yan LL, Chang Y, Zhang SB et al.. Measure-resend semi-quantum private comparison scheme using GHZ class states. Comput Mater Continua. 2019;61(2):877–87.

    Article  Google Scholar 

  48. Jiang LZ. Semi-quantum private comparison based on Bell states. Quantum Inf Process. 2020;19:180.

    Article  ADS  MathSciNet  Google Scholar 

  49. Tsai CW, Lin J, Yang CW. Cryptanalysis and improvement in semi-quantum private comparison based on Bell states. Quantum Inf Process. 2021;20:120.

    Article  ADS  MathSciNet  Google Scholar 

  50. Xie L, Li Q, Yu F, Lou XP, Zhang C. Cryptanalysis and improvement of a semi-quantum private comparison protocol based on Bell states. Quantum Inf Process. 2021;20:244.

    Article  ADS  MathSciNet  Google Scholar 

  51. Yan LL, Zhang SB, Chang Y, Wan GG, Yang F. Semi-quantum private comparison protocol with three-particle G-like states. Quantum Inf Process. 2021;20:17.

    Article  ADS  MathSciNet  Google Scholar 

  52. Ye CQ, Li J, Chen XB, Yuan T. Efficient semi-quantum private comparison without using entanglement resource and pre-shared key. Quantum Inf Process. 2021;20:262.

    Article  ADS  MathSciNet  Google Scholar 

  53. Sun YH, Yan LL, Sun ZB, Zhang SB, Lu JZ. A novel semi-quantum private comparison scheme using bell entangle states. Comput Mater Continua. 2021;66(3):2385–95.

    Article  Google Scholar 

  54. Yang YG, Xia J, Jia X, Zhang H. Comment on quantum private comparison protocols with a semi-honest third party. Quantum Inf Process. 2013;12:877–85.

    Article  ADS  MathSciNet  MATH  Google Scholar 

  55. Cai QY. Eavesdropping on the two-way quantum communication protocols with invisible photons. Phys Lett A. 2006;351(1–2):23–5.

    Article  ADS  MATH  Google Scholar 

  56. Gisin N, Ribordy G, Tittel W, Zbinden H. Quantum cryptography. Rev Mod Phys. 2002;74(1):145–95.

    Article  ADS  MATH  Google Scholar 

  57. Deng FG, Zhou P, Li XH, et al. Robustness of two-way quantum communication protocols against Trojan horse attack. 2005. https://arxiv.org/abs/quant-ph/0508168.

  58. Li XH, Deng FG, Zhou HY. Improving the security of secure direct communication based on the secret transmitting order of particles. Phys Rev A. 2006;74:054302.

    Article  ADS  Google Scholar 

  59. Gao F, Qin SJ, Wen QY, Zhu FC. A simple participant attack on the Bradler-Dusek protocol. Quantum Inf Comput. 2007;7:329.

    MathSciNet  MATH  Google Scholar 

  60. Cabello A. Quantum key distribution in the Holevo limit. Phys Rev Lett. 2000;85:5635.

    Article  ADS  Google Scholar 

Download references

Acknowledgements

The authors would like to thank the anonymous reviewers for their valuable comments that help enhancing the quality of this paper.

Funding

the National Natural Science Foundation of China (Grant No. 62071430 and No. 61871347) and the Fundamental Research Funds for the Provincial Universities of Zhejiang (Grant No. JRK21002).

Author information

Authors and Affiliations

Authors

Contributions

Mao-Jie Geng wrote the manuscript, Ying Chen and Tian-Jie Xu checked the writing, Tian-Yu Ye reviewed the manuscript. All authors read and approved the final manuscript.

Corresponding author

Correspondence to Tian-Yu Ye.

Ethics declarations

Ethics approval and consent to participate

Not applicable.

Consent for publication

Not applicable.

Competing interests

The authors declare no competing interests.

Rights and permissions

Open Access This article is licensed under a Creative Commons Attribution 4.0 International License, which permits use, sharing, adaptation, distribution and reproduction in any medium or format, as long as you give appropriate credit to the original author(s) and the source, provide a link to the Creative Commons licence, and indicate if changes were made. The images or other third party material in this article are included in the article’s Creative Commons licence, unless indicated otherwise in a credit line to the material. If material is not included in the article’s Creative Commons licence and your intended use is not permitted by statutory regulation or exceeds the permitted use, you will need to obtain permission directly from the copyright holder. To view a copy of this licence, visit http://creativecommons.org/licenses/by/4.0/.

Reprints and Permissions

About this article

Verify currency and authenticity via CrossMark

Cite this article

Geng, MJ., Chen, Y., Xu, TJ. et al. Single-state semiquantum private comparison based on Bell states. EPJ Quantum Technol. 9, 36 (2022). https://doi.org/10.1140/epjqt/s40507-022-00156-9

Download citation

  • Received:

  • Accepted:

  • Published:

  • DOI: https://doi.org/10.1140/epjqt/s40507-022-00156-9

Keywords

  • Semiquantum cryptography
  • Semiquantum private comparison
  • Semi-honest third party
  • Bell state