Single-state semiquantum private comparison based on Bell states

Abstract

In this paper, a novel semiquantum private comparison (SQPC) protocol based on single kind of Bell states is proposed, which allows two classical parties to judge the equality of their private inputs securely and correctly under the help of a semi-honest third party (TP) who possesses complete quantum capabilities. TP is allowed to misbehave on her own but cannot conspire with anyone else. Our protocol needs none of unitary operations, quantum entanglement swapping or the reordering operations. Moreover, our protocol only needs to prepare single kind of Bell states as initial quantum resource. Detailed security analysis turns out that our protocol is secure against various outside and participant attacks. Compared with most of the existing SQPC protocols based on Bell states, our protocol is more feasible in practice.

1 Introduction

Relying on the physical laws such as the quantum no-cloning theorem, the uncertainty principle etc., quantum cryptography possesses unconditional security in theory. In 1984, Bennett and Brassard [1] proposed the world’s first quantum key distribution (QKD) protocol by using the polarization of single photons, which is always named as the BB84 protocol later. Starting with the BB84 protocol, quantum cryptography has gained considerable developments in recent years. Researchers have proposed different kinds of quantum cryptography protocols suitable for different application scenarios, such as quantum key distribution (QKD) [2–6], quantum secret sharing (QSS) [7–10], quantum secure direct communication (QSDC) [11–16], quantum identity authentication (QIA) [17, 18], and so on. QKD protocols can be used to establish a private sequence of key bits between two remote communicants through the transmission of quantum signals. QSS permits different participants to share a secret privately in the way that only all of them cooperate together can they reconstruct it. QSDC protocols can be used to directly transmit a secret message from one party to the other party. QIA protocols can be used for authenticating whether the user’s identity is legal or not. In 2009, Yang and Wen [19] proposed the first quantum private comparison (QPC) protocol, which can compare the equality of private inputs from two different users under the condition that none of their private inputs will be leaked out. Since then, scholars have designed abundant QPC protocols with different quantum states, such as the ones with single particles [20, 21], Bell states [22–24], GHZ states [25, 26], cluster states [27], χ-type entangled states [28], etc. The above QPC protocols require all users to have complete quantum capabilities, which may incur high costs in practice.

In 2007, Boyer et al. [29] proposed the first measure-resend semiquantum key distribution (SQKD) protocol by using the famous BB84 protocol, where it is not necessary for all users to have complete quantum capabilities. Subsequently, in 2009, Boyer et al. [30] further put forward the randomization-based SQKD protocol with single photons. At present, in the field of semiquantum cryptography, according to the two representative works in Refs. [29, 30], classical users are widely considered to be limited within the following operations: (a) sending or reflecting the qubits without interference; (b) measuring qubits in the Z basis (i.e., $\{ \vert 0 \rangle , \vert 1 \rangle \}$); (c) preparing the fresh qubits in the Z basis; and (d) reordering the qubits through different delay lines. Based on these settings, compared with the traditional quantum cryptography, semiquantum cryptography may effectively save quantum resource and quantum operations. The idea of semiquantumness has been applied into various branches of quantum cryptography so that the corresponding semiquantum cryptography branches have been established, such as SQKD [29–33], semiquantum secret sharing (SQSS) [34–37], semiquantum key agreement (SQKA) [38–41], semiquantum controlled secure direct communication (SQCSDC) [41] and semiquantum dialogue (SQD) [41, 42], etc.

In 2016, Chou et al. [43] introduced the concept of semiquantumness into QPC and put forward the first semiquantum private comparison (SQPC) protocol by using Bell states and quantum entanglement swapping. In 2018, Thapliyal et al. [44] proposed a SQPC protocol based on Bell states, which needs to share a secret key in advance among different participants by using SQKD and SQKA; Ye et al. [45] designed a SQPC protocol with the measure-resend characteristics based on two-particle product states. In 2019, Yan et al. [39] constructed a randomization-based SQPC protocol based on Bell states without pre-shared keys; Lin et al. [46] proposed a SQPC protocol with single photons, which allows two classical participants to safely compare the equality of their private inputs under the help of an almost dishonest third party (TP); Yan et al. [47] put forward a SQPC scheme based on Greenberger-Horne-Zeilinger (GHZ) class states. In 2020, Jiang [48] put forward two SQPC protocols with Bell states, where the first protocol requires the classical users to measure the received particles but the second protocol doesn’t have this requirement. In 2021, Tsai et al. [49] and Xie et al. [50] pointed out that the first SQPC protocol in Ref. [48] has security loopholes. In order to solve these problems, Ref. [49] makes TP share a secret key with each classical user in advance through SQKD, while Ref. [50] increases the quantum measurement capability for two classical users. In the same year, Yan et al. [51] put forward a SQPC protocol with three-particle GHZ-like states; Ye et al. [52] proposed an efficient circular SQPC protocol based on single-particle states without using a pre-shared key; Sun et al. [53] suggested a novel measure-resend SQPC scheme with pre-shared keys by using Bell states. Note that each of the SQPC protocols in Refs. [43, 44, 48–50, 53] needs to employ four kinds of Bell states as initial quantum resource.

According to the above analysis, in this paper, in order to cut down the usage of initial quantum resource and quantum operations for SQPC based on Bell states, we propose a novel SQPC protocol based on single kind of Bell states, which utilizes the entanglement correlation of Bell states to skillfully compare the equality of two classical users’ private inputs. Compared with most of the existing SQPC protocols with Bell states, our protocol is much easier to implement in practice, due to the following advantages: firstly, it only adopts one kind of Bell states as initial quantum resource; secondly, it doesn’t need to employ quantum entanglement swapping or the reordering operations.

2 Protocol description

Suppose that both Alice and Bob only possess limited quantum capabilities; Alice has a private message $M_{A}$, while Bob has a private message $M_{B}$. Here, $M_{A} = \{ M_{A}^{1},M_{A}^{2}, \ldots ,M_{A}^{n} \}$, $M_{B} = \{ M_{B}^{1},M_{B}^{2}, \ldots ,M_{B}^{n} \}$, $M_{A}^{i} \in \{ 0,1 \}$, $M_{B}^{i} \in \{ 0,1 \}$, and $i = 0,1, \ldots ,n$. Alice and Bob want to know whether $M_{A}$ and $M_{B}$ are equal or not under the help of TP who possesses full quantum capabilities. According to Ref. [54], here, TP is assumed to be semi-honest, which means that she is allowed to misbehave on her own but cannot conspire with anyone else. In order to securely compare the equality of $M_{A}$ and $M_{B}$ without disclosing their genuine contents to TP, Alice and Bob share a secret key $K_{AB} = \{ K_{AB}^{1},K_{AB}^{2}, \ldots ,K_{AB}^{n} \}$ through a secure mediated SQKD protocol [31] in advance, where $K_{AB}^{i} \in \{ 0,1 \}$ and $i = 0,1, \ldots ,n$. The proposed SQPC protocol based on Bell states can be depicted as follows, whose flow chart is shown in Fig. 1 for clarity.

Figure 1

The flowchart of the proposed single-state SQPC protocol

Step 1: TP prepared $N = 16n$ Bell states all in the state of $\vert \psi ^{ +} \rangle = \frac{1}{\sqrt{2}} ( \vert 01 \rangle + \vert 10 \rangle )$. Then, she divides the first particles and the second particles of the first 4n Bell states into sequences $T_{1}$ and $T_{2}$, respectively. Similarly, she makes the first particles and the second particles of the second 4n Bell states to form sequences $T_{3}$ and $T_{4}$, respectively, and lets the first particles and the second particles of the last 8n Bell states to compose sequences $T_{5}$ and $T_{6}$, respectively. Afterward, TP transmits the particles of sequence $T_{1}$ to Alice one by one. Note that after TP sends the first particle to Alice, she sends a particle only after receiving the previous one. In the meanwhile, TP transmits the particles of sequence $T_{3}$ to Bob one by one. Likewise, after TP sends the first particle to Bob, she sends a particle only after receiving the previous one.

Step 2: After receiving each particle from TP, Alice randomly selects one of the following two operations: measuring the received particle with the Z basis and resending a fresh one to TP in the same state to the measurement result (this is called as the MEASURE mode); and returning the received particle to TP directly (this is called as the REFLECT mode). Alice records the measurement results of corresponding particles in $T_{1}$ which she chose to MEASURE.

Similarly, after receiving each particle from TP, Bob randomly selects one of the following two operations, MEASURE and REFLECT. Bob also records the measurement results of corresponding particles in $T_{3}$ which he chose to MEASURE.

Step 3: TP and Alice cooperate together to check the transmission security of $T_{1}$. Alice tells TP the positions where she chose to REFLECT. TP performs different operations on the received particles according to Alice’s choices, as illustrated in Table 1.

Table 1 Alice’s actions on the particles in $T_{1}$ and TP’s corresponding actions

For checking the error rate on the 2n REFLECT particles in $T_{1}$, TP compares her Bell basis measurement results with her initial prepared states. Apparently, if there exists no Eve, TP’s measurement results should always be $\vert \psi ^{ +} \rangle$.

For checking the error rate on the 2n MEASURE particles in $T_{1}$, TP randomly chooses n ones among them, tells Alice the chosen positions and requires Alice to inform her of the corresponding measurement results on these n chosen MEASURE particles in $T_{1}$. TP calculates the error rate by comparing her measurement results on these n chosen MEASURE particles in $T_{1}$, her measurement results on the corresponding n particles in $T_{2}$ and Alice’s measurement results on these n chosen MEASURE particles in $T_{1}$. Apparently, if there exists no Eve, these three kinds of measurement results should be perfectly correlated. For example, assuming that there exists no Eve, when Alice’s measurement result on one chosen MEASURE particle in $T_{1}$ is $\vert 0 \rangle$ ($\vert 1 \rangle$), TP’s measurement result on this chosen MEASURE particle in $T_{1}$ should also be $\vert 0 \rangle$ ($\vert 1 \rangle$); and TP’s measurement result on the corresponding particle in $T_{2}$ should be $\vert 1 \rangle$ ($\vert 0 \rangle$), since the corresponding initial Bell state prepared by TP is $\vert \psi ^{ +} \rangle$.

If either the error rate on the REFLECT particles or the error rate on the MEASURE particles in $T_{1}$ is unreasonably high, the protocol will be halted; otherwise, the protocol will be continued.

In the meanwhile, TP and Bob cooperate together to check the transmission security of $T_{3}$. Bob tells TP the positions where he chose to REFLECT. TP performs different operations on the received particles according to Bob’s choices, as illustrated in Table 2.

Table 2 Bob’s actions on the particles in $T_{3}$ and TP’s corresponding actions

For checking the error rate on the 2n REFLECT particles in $T_{3}$, TP compares her Bell basis measurement results with her initial prepared states.

For checking the error rate on the 2n MEASURE particles in $T_{3}$, TP randomly chooses n ones among them, tells Bob the chosen positions and requires Bob to inform her of the corresponding measurement results on these n chosen MEASURE particles in $T_{3}$. TP calculates the error rate by comparing her measurement results on these n chosen MEASURE particles in $T_{3}$, her measurement results on the corresponding n particles in $T_{4}$ and Bob’s measurement results on these n chosen MEASURE particles in $T_{3}$.

If either the error rate on the REFLECT particles or the error rate on the MEASURE particles in $T_{3}$ is unreasonably high, the protocol will be halted; otherwise, the protocol will be continued.

Step 4: TP drops out the 3n particles in $T_{2}$ used for security check in Step 3. TP’s measurement results on the remaining n particles in $T_{2}$ are represented as $S_{2} = \{ S_{2}^{1},S_{2}^{2}, \ldots ,S_{2}^{n} \}$. Alice’s measurement results on these n particles in $T_{1}$ are represented as $S_{1} = \{ S_{1}^{1},S_{1}^{2}, \ldots ,S_{1}^{n} \}$.

In the meanwhile, TP drops out the 3n particles in $T_{4}$ used for security check in Step 3. TP’s measurement results on the remaining n particles in $T_{4}$ are represented as $S_{4} = \{ S_{4}^{1},S_{4}^{2}, \ldots ,S_{4}^{n} \}$. Bob’s measurement results on these n particles in $T_{3}$ are represented as $S_{3} = \{ S_{3}^{1},S_{3}^{2}, \ldots ,S_{3}^{n} \}$.

Step 5: TP transmits the particles of sequence $T_{5}$ to Alice one by one. Note that after TP sends the first particle to Alice, she sends a particle only after receiving the previous one. After receiving each particle from TP, Alice randomly selects one of the two operations, MEASURE and REFLECT. Then, Alice tells TP the positions where she chose to REFLECT.

In the meanwhile, TP transmits the particles of sequence $T_{6}$ to Bob one by one. Note that after TP sends the first particle to Bob, she sends a particle only after receiving the previous one. After receiving each particle from TP, Bob randomly selects one of the two operations, MEASURE and REFLECT. Then, Bob tells TP the positions where he chose to REFLECT.

According to the choices of Alice and Bob, TP performs different operations on the received particles, as illustrated in Table 3. Case , Case and Case are used for checking whether the transmissions of $T_{5}$ and $T_{6}$ are secure or not; and Case is used for not only the security check of the transmissions of $T_{5}$ and $T_{6}$ but also privacy comparison.

Table 3 Alice’s actions on the particles in $T_{5}$, Bob’s actions on the particles in $T_{6}$ and TP’s corresponding actions

For the 2n positions where Case happens, TP compares her Bell basis measurement results with her initial prepared states. Apparently, if there exists no Eve, TP’s measurement results should always be $\vert \psi ^{ +} \rangle$.

For the 2n positions where Case happens, TP compares her Z basis measurement results with Alice’s Z basis measurement results. Apparently, if there exists no Eve, TP’s Z basis measurement results should always be opposite to Alice’s Z basis measurement results.

For the 2n positions where Case happens, TP compares her Z basis measurement results with Bob’s Z basis measurement results. Apparently, if there exists no Eve, TP’s Z basis measurement results should always be opposite to Bob’s Z basis measurement results.

For the 2n positions where Case happens, TP randomly chooses n ones among them, and tells Alice and Bob the chosen positions. TP calculates the error rate by comparing her measurement results for the chosen positions with Alice and Bob’s measurement results on them, respectively. Apparently, if there exists no Eve, TP’s measurement results should be identical to Alice and Bob’s measurement results, respectively.

If either of the error rates of Case , Case , Case and Case is unreasonably high, the protocol will be halted; otherwise, the protocol will be continued.

Step 6: Alice drops out the 7n particles in $T_{5}$ used for security check in Step 5. In Case , Alice’s measurement results on the remaining n particles in $T_{5}$, which are not used for security check, are represented as $S_{5} = \{ S_{5}^{1},S_{5}^{2}, \ldots ,S_{5}^{n} \}$. Alice calculates $R_{A}^{j} = M_{A}^{j} \oplus K_{AB}^{j} \oplus S_{1}^{j} \oplus S_{5}^{j}$, where ⊕ is the bitwise XOR operation and $j = 1,2, \ldots ,n$. Then, Alice sends $R_{A}$ to TP, where $R_{A} = \{ R_{A}^{1},R_{A}^{2}, \ldots ,R_{A}^{n} \}$.

In the meanwhile, Bob drops out the 7n particles in $T_{6}$ used for security check in Step 5. In Case , Bob’s measurement results on the remaining n particles in $T_{6}$, which are not used for security check, are represented as $S_{6} = \{ S_{6}^{1},S_{6}^{2}, \ldots ,S_{6}^{n} \}$. Bob calculates $R_{B}^{j} = M_{B}^{j} \oplus K_{AB}^{j} \oplus S_{3}^{j} \oplus S_{6}^{j}$, where $j = 1,2, \ldots ,n$. Then, Bob sends $R_{B}$ to TP, where $R_{B} = \{ R_{B}^{1},R_{B}^{2}, \ldots ,R_{B}^{n} \}$.

Step 7: After receiving $R_{A}$ and $R_{B}$, TP computes $R_{T}^{j} = R_{A}^{j} \oplus R_{B}^{j} \oplus S_{2}^{j} \oplus S_{4}^{j}$, where $j = 1,2, \ldots ,n$. Once $R_{T}^{j} = 0$ is found, TP terminates the protocol, and tells Alice and Bob that $M_{A}$ is not identical to $M_{B}$. Otherwise, TP tells Alice and Bob that $M_{A}$ is same to $M_{B}$.

3 Correctness analysis

In the proposed SQPC protocol, Alice and Bob’s secret messages are $M_{A} = \{ M_{A}^{1},M_{A}^{2}, \ldots , M_{A}^{n} \}$ and $M_{B} = \{ M_{B}^{1},M_{B}^{2}, \ldots ,M_{B}^{n} \}$, respectively; Alice and Bob intent to judge the equality of $M_{A}$ and $M_{B}$ with the help of a semi-honest TP. Apparently, as the initial states prepared by TP are always in the state of $\vert \psi ^{ +} \rangle$, we have $S_{1}^{j} \oplus S_{2}^{j} = 1$, $S_{3}^{j} \oplus S_{4}^{j} = 1$ and $S_{5}^{j} \oplus S_{6}^{j} = 1$, where $j = 1,2, \ldots ,n$. Because $R_{A}^{j} = M_{A}^{j} \oplus K_{AB}^{j} \oplus S_{1}^{j} \oplus S_{5}^{j}$ and $R_{B}^{j} = M_{B}^{j} \oplus K_{AB}^{j} \oplus S_{3}^{j} \oplus S_{6}^{j}$, it can be obtained that

$$\begin{aligned} R_{T}^{j} &= R_{A}^{j} \oplus R_{B}^{j} \oplus S_{2}^{j} \oplus S_{4}^{j} \\ &= \bigl( M_{A}^{j} \oplus K_{AB}^{j} \oplus S_{1}^{j} \oplus S_{5}^{j} \bigr) \oplus \bigl( M_{B}^{j} \oplus K_{AB}^{j} \oplus S_{3}^{j} \oplus S_{6}^{j} \bigr) \oplus S_{2}^{j} \oplus S_{4}^{j} \\ &= M_{A}^{j} \oplus M_{B}^{j} \oplus 1. \end{aligned}$$

(1)

According to Eq. (1), $R_{T}^{j} = 0$ indicates that $M_{A}^{j} \ne M_{B}^{j}$. Therefore, only when $R_{T}^{j} = 1$ stands for $j = 1,2, \ldots ,n$ can we have $M_{A} = M_{B}$.

4 Security analysis

4.1 Outside attack

In the proposed SQPC protocol, TP sends $T_{1}$ to Alice and $T_{3}$ to Bob firstly, and then transmits $T_{5}$ and $T_{6}$ to Alice and Bob, respectively. For clarity, we firstly analyze the security of transmission of $T_{1}$ or $T_{3}$, and then validate the security of transmissions of $T_{5}$ and $T_{6}$.

Case 1: Eve attacks $T_{1}$ when it goes from TP to Alice or $T_{3}$ when it goes from TP to Bob

In the proposed SQPC protocol, $T_{1}$, which is independent from $T_{3}$, essentially plays the same role to $T_{3}$. Thus, for simplicity, we only analyze the transmission security of $T_{1}$ from TP to Alice and back to TP.

(1) The intercept-resend attack

During the transmission of $T_{1}$ from TP to Alice and back to TP, Eve may try her best to obtain $S_{1}$ by launching the following attack: Eve may intercept the particles of $T_{1}$ from TP to Alice and send the fake particles she generated in the Z basis beforehand to Alice. However, Eve will be inevitably detected due to the following two reasons: on one hand, the fake particles she prepared beforehand may be different from the genuine ones in $T_{1}$; and on the other hand, she doesn’t know Alice’s operations, which are random in fact. Concretely speaking, when TP sends one particle of $T_{1}$ to Alice, Eve intercepts it and sends the prepared fake one to Alice. Without loss of generality, assume that the fake one prepared by herself is in the state of $\vert 0 \rangle$. As a result, if Alice chooses to MEASURE, her measurement result will be $\vert 0 \rangle$. After Alice tells TP her operation, TP uses the Z basis to measure the corresponding particle in $T_{2}$ and obtains the measurement result randomly in one of the two states $\vert 0 \rangle$ and $\vert 1 \rangle$. Hence, if Alice chooses to MEASURE, Eve will be detected with the probability of $\frac{1}{2}$. If Alice chooses to REFLECT, TP will receive the fake particle. After Alice tells TP her operation, TP measures the fake particle and the corresponding particle in $T_{2}$ with the Bell basis, and obtains the measurement result randomly in one of the four states $\vert \psi ^{ +} \rangle$, $\vert \psi ^{ -} \rangle$, $\vert \phi ^{ +} \rangle$ and $\vert \phi ^{ -} \rangle$, where $\vert \psi ^{ -} \rangle = \frac{1}{\sqrt{2}} ( \vert 01 \rangle - \vert 10 \rangle )$ and $\vert \phi ^{ \pm} \rangle = \frac{1}{\sqrt{2}} ( \vert 00 \rangle \pm \vert 11 \rangle )$. Hence, if Alice chooses to REFLECT, Eve will be detected with the probability of $\frac{3}{4}$. To sum up, when Eve launches this kind of attack on one particle of $T_{1}$, the probability that she will be discovered is $\frac{1}{2} \times \frac{1}{2} + \frac{1}{2} \times \frac{3}{4} = \frac{5}{8}$.

(2) The measure-resend attack

In order to obtain $S_{1}$, Eve may intercept the particles of $T_{1}$ sent from TP to Alice, measure them with the Z basis and send the resulted states to Alice. However, this kind of attack from Eve will be inevitably discovered, since Alice’s operations are random. Concretely speaking, after Eve’s measurement, the particle Eve sends to Alice is randomly in one of the two states $\vert 0 \rangle$ and $\vert 1 \rangle$. Without loss of generality, assume that the particle after Eve’s measurement is in the state of $\vert 0 \rangle$. If Alice chooses to MEASURE, after she tells TP her operation, TP uses the Z basis to measure the corresponding particle in $T_{2}$ and obtains the measurement result $\vert 1 \rangle$. Hence, if Alice chooses to MEASURE, Eve will be detected with the probability of 0. If Alice chooses to REFLECT, after she tells TP her operation, TP measures the received particle from Alice and the corresponding particle in $T_{2}$ with the Bell basis, and obtains the measurement result randomly in one of the two states $\vert \psi ^{ +} \rangle$ and $\vert \psi ^{ -} \rangle$. Hence, if Alice chooses to REFLECT, Eve will be detected with the probability of $\frac{1}{2}$. To sum up, when Eve launches this kind of attack on one particle of $T_{1}$, the probability that she will be discovered is $\frac{1}{2} \times 0 + \frac{1}{2} \times \frac{1}{2} = \frac{1}{4}$.

(3) The entangle-measure attack

Eve may try to obtain something useful by entangling her auxiliary qubit with the transmitted qubit. Eve’s entangle-measure attack on the particles of $T_{1}$, depicted as Fig. 2, can be modeled with two unitary operations Ê and F̂. Here, Ê attacks the qubit sent from TP to Alice, while F̂ attacks the qubit returned from Alice to TP. Moreover, Ê and F̂ share a common probe space with the initial state $\vert \varepsilon \rangle _{E}$. According to Refs. [29, 30], the shared probe permits Eve to attack the returned particles depending on the knowledge obtained from Ê; and any attack where Eve would make F̂ depend on a measurement after performing Ê can be realized by Ê and F̂ with controlled gates.

Figure 2

Eve’s entangle-measure attack on the particles of $T_{1}$ with two unitaries Ê and F̂

Theorem 1

Suppose that Eve performs attack $( \hat{E},\hat{F} )$ on the particle from TP to Alice and back to TP. For this attack inducing no error in Step 3, the final state of Eve’s probe should be independent of not only Alice’s operation but also TP and Alice’s measurement results. As a result, Eve gets no information on the bits of $S_{1}$ and $S_{2}$.

Proof

The effect of Ê on the qubits $\vert 0 \rangle$ and $\vert 1 \rangle$ can be expressed as

$$\begin{aligned}& \hat{E} \bigl( \vert 0 \rangle \vert \varepsilon \rangle _{E} \bigr) = \alpha _{00} \vert 0 \rangle \vert \varepsilon _{00} \rangle + \alpha _{01} \vert 1 \rangle \vert \varepsilon _{01} \rangle , \end{aligned}$$

(2)

$$\begin{aligned}& \hat{E} \bigl( \vert 1 \rangle \vert \varepsilon \rangle _{E} \bigr) = \alpha _{10} \vert 0 \rangle \vert \varepsilon _{10} \rangle + \alpha _{11} \vert 1 \rangle \vert \varepsilon _{11} \rangle , \end{aligned}$$

(3)

where $\vert \varepsilon _{00} \rangle$, $\vert \varepsilon _{01} \rangle$, $\vert \varepsilon _{10} \rangle$ and $\vert \varepsilon _{11} \rangle$ are Eve’s probe states determined by Ê, $\vert \alpha _{00} \vert ^{2} + \vert \alpha _{01} \vert ^{2} = 1$ and $\vert \alpha _{10} \vert ^{2} + \vert \alpha _{11} \vert ^{2} = 1$.

According to Stinespring dilation theorem, the global state of the composite system before Alice’ s operation is

$$\begin{aligned} &\hat{E} \bigl( \vert \psi ^{ +} \rangle _{12} \vert \varepsilon \rangle _{E} \bigr)\\ &\quad = \hat{E} \biggl[ \frac{1}{\sqrt{2}} \bigl( \vert 01 \rangle + \vert 10 \rangle \bigr)_{12} \vert \varepsilon \rangle _{E} \biggr] \\ &\quad= \frac{1}{\sqrt{2}} \bigl[ \bigl( \alpha _{00} \vert 0 \rangle _{1} \vert \varepsilon _{00} \rangle + \alpha _{01} \vert 1 \rangle _{1} \vert \varepsilon _{01} \rangle \bigr) \vert 1 \rangle _{2} + \bigl( \alpha _{10} \vert 0 \rangle _{1} \vert \varepsilon _{10} \rangle + \alpha _{11} \vert 1 \rangle _{1} \vert \varepsilon _{11} \rangle \bigr) \vert 0 \rangle _{2} \bigr] \\ &\quad= \frac{1}{\sqrt{2}} \bigl[ \vert 0 \rangle _{1} \bigl( \alpha _{00} \vert 1 \rangle _{2} \vert \varepsilon _{00} \rangle + \alpha _{10} \vert 0 \rangle _{2} \vert \varepsilon _{10} \rangle \bigr) + \vert 1 \rangle _{1} \bigl( \alpha _{01} \vert 1 \rangle _{2} \vert \varepsilon _{01} \rangle + \alpha _{11} \vert 0 \rangle _{2} \vert \varepsilon _{11} \rangle \bigr) \bigr], \end{aligned}$$

(4)

where the subscripts 1 and 2 represent the particles from $T_{1}$ and $T_{2}$, respectively.

(i) Firstly, consider the case that Alice chooses to MEASURE. As a result, the state of the composite system is collapsed into $\vert 0 \rangle _{1} ( \alpha _{00} \vert 1 \rangle _{2} \vert \varepsilon _{00} \rangle + \alpha _{10} \vert 0 \rangle _{2} \vert \varepsilon _{10} \rangle )$ when Alice’s measurement result is $\vert 0 \rangle _{1}$ or $\vert 1 \rangle _{1} ( \alpha _{01} \vert 1 \rangle _{2} \vert \varepsilon _{01} \rangle + \alpha _{11} \vert 0 \rangle _{2} \vert \varepsilon _{11} \rangle )$ when Alice’s measurement result is $\vert 1 \rangle _{1}$.

Eve imposes F̂ on the particle sent back to TP. In order that Eve’s attacks on the MEASURE particle will not be discovered by TP and Alice in Step 3, the global state of the composite system should be

$$ \hat{F} \bigl[ \vert 0 \rangle _{1} \bigl( \alpha _{00} \vert 1 \rangle _{2} \vert \varepsilon _{00} \rangle + \alpha _{10} \vert 0 \rangle _{2} \vert \varepsilon _{10} \rangle \bigr) \bigr] = \vert 0 \rangle _{1} \vert 1 \rangle _{2} \vert \varepsilon _{0} \rangle , $$

(5)

when Alice’s measurement result is $\vert 0 \rangle _{1}$; or

$$ \hat{F} \bigl[ \vert 1 \rangle _{1} \bigl( \alpha _{01} \vert 1 \rangle _{2} \vert \varepsilon _{01} \rangle + \alpha _{11} \vert 0 \rangle _{2} \vert \varepsilon _{11} \rangle \bigr) \bigr] = \vert 1 \rangle _{1} \vert 0 \rangle _{2} \vert \varepsilon _{1} \rangle , $$

(6)

when Alice’s measurement result is $\vert 1 \rangle _{1}$.

(ii) Secondly, consider the case that Alice chooses to REFLECT. As a result, the state of the composite system is $\frac{1}{\sqrt{2}} [ \vert 0 \rangle _{1} ( \alpha _{00} \vert 1 \rangle _{2} \vert \varepsilon _{00} \rangle + \alpha _{10} \vert 0 \rangle _{2} \vert \varepsilon _{10} \rangle ) + \vert 1 \rangle _{1} ( \alpha _{01} \vert 1 \rangle _{2} \vert \varepsilon _{01} \rangle + \alpha _{11} \vert 0 \rangle _{2} \vert \varepsilon _{11} \rangle ) ]$.

Eve imposes F̂ on the particle sent back to TP. According to Eq. (5) and Eq. (6), it has

$$\begin{aligned}& \hat{F} \bigl[ \hat{E} \bigl( \vert \psi ^{ +} \rangle _{12} \vert \varepsilon \rangle _{E} \bigr) \bigr] \\& \quad = \frac{1}{\sqrt{2}} \hat{F} \bigl[ \vert 0 \rangle _{1} \bigl( \alpha _{00} \vert 1 \rangle _{2} \vert \varepsilon _{00} \rangle + \alpha _{10} \vert 0 \rangle _{2} \vert \varepsilon _{10} \rangle \bigr) + \vert 1 \rangle _{1} \bigl( \alpha _{01} \vert 1 \rangle _{2} \vert \varepsilon _{01} \rangle + \alpha _{11} \vert 0 \rangle _{2} \vert \varepsilon _{11} \rangle \bigr) \bigr] \\& \quad = \frac{1}{\sqrt{2}} \bigl( \vert 0 \rangle _{1} \vert 1 \rangle _{2} \vert \varepsilon _{0} \rangle + \vert 1 \rangle _{1} \vert 0 \rangle _{2} \vert \varepsilon _{1} \rangle \bigr) \\& \quad = \frac{1}{2} \bigl[ \bigl( \vert \psi ^{ +} \rangle _{12} + \vert \psi ^{ -} \rangle _{12} \bigr) \vert \varepsilon _{0} \rangle + \bigl( \vert \psi ^{ +} \rangle _{12} - \vert \psi ^{ -} \rangle _{12} \bigr) \vert \varepsilon _{1} \rangle \bigr] \\& \quad = \frac{1}{2} \bigl[ \vert \psi ^{ +} \rangle _{12} \bigl( \vert \varepsilon _{0} \rangle + \vert \varepsilon _{1} \rangle \bigr) + \vert \psi ^{ -} \rangle _{12} \bigl( \vert \varepsilon _{0} \rangle - \vert \varepsilon _{1} \rangle \bigr) \bigr]. \end{aligned}$$

(7)

In order that Eve’s attacks on the REFLECT particle will not be discovered by TP and Alice in Step 3, the probability that TP’s measurement result on a pair of particles in $T_{1}$ and $T_{2}$ is $\vert \psi ^{ +} \rangle _{12}$ should be 1. Thus, it should establish

$$ \vert \varepsilon _{0} \rangle = \vert \varepsilon _{1} \rangle = \vert \varepsilon \rangle . $$

(8)

Inserting Eq. (8) into Eq. (7) produces

$$ \hat{F} \bigl[ \hat{E} \bigl( \vert \psi ^{ +} \rangle _{12} \vert \varepsilon \rangle _{E} \bigr) \bigr] = \vert \psi ^{ +} \rangle _{12} \vert \varepsilon \rangle . $$

(9)

(iii) Inserting Eq. (8) into Eq. (5) and Eq. (6) produces

$$ \hat{F} \bigl[ \vert 0 \rangle _{1} \bigl( \alpha _{00} \vert 1 \rangle _{2} \vert \varepsilon _{00} \rangle + \alpha _{10} \vert 0 \rangle _{2} \vert \varepsilon _{10} \rangle \bigr) \bigr] = \vert 0 \rangle _{1} \vert 1 \rangle _{2} \vert \varepsilon \rangle , $$

(10)

and

$$ \hat{F} \bigl[ \vert 1 \rangle _{1} \bigl( \alpha _{01} \vert 1 \rangle _{2} \vert \varepsilon _{01} \rangle + \alpha _{11} \vert 0 \rangle _{2} \vert \varepsilon _{11} \rangle \bigr) \bigr] = \vert 1 \rangle _{1} \vert 0 \rangle _{2} \vert \varepsilon \rangle , $$

(11)

respectively.

According to Eq. (9), Eq. (10) and Eq. (11), in order not to be detected by TP and Alice, the final state of Eve’s probe should be independent from not only Alice’s operation but also the TP and Alice’s measurement results. As a result, Eve gets no information on the bits of $S_{1}$ and $S_{2}$.

(4)The Trojan horse attack

Because the particles of $T_{1}$ are transmitted forth and back between TP and Alice, two types of Trojan horse attack from Eve, i.e., the invisible photon eavesdropping attack [55] and the delay-photon Trojan horse attack [56, 57], should be taken into account. In the light of Refs. [57, 58], Alice can use a wavelength filter and a photon number splitter to resist these two types of Trojan horse attack from Eve, respectively. □

Case 2: Eve attacks $T_{5}$ and $T_{6}$ when they go from TP to Alice and Bob

(1) The intercept-resend attack

In Step 5, TP transmits $T_{5}$ and $T_{6}$ to Alice and Bob, respectively. During these transmissions, Eve may try her best to obtain $S_{5}$ and $S_{6}$ by launching the following attack: Eve intercepts the two particles sent from TP to Alice and Bob, and sends two fake ones she prepared in the Z basis beforehand to Alice and Bob, respectively. However, Eve will be undoubtedly discovered for two facts: firstly, the fake particles she prepared beforehand may be different from the genuine ones in $T_{5}$ and $T_{6}$; and secondly, Alice and Bob’s operations are random. Concretely speaking, when TP sends one particle of $T_{5}$ to Alice and one particle of $T_{6}$ to Bob, Eve intercepts them and sends the prepared fake ones to Alice and Bob, respectively. Firstly, assume that the two fake particles prepared by Eve are in the state of $\vert 0 \rangle \vert 0 \rangle$. As a result, if both Alice and Bob choose to REFLECT, TP will receive the two fake particles $\vert 0 \rangle \vert 0 \rangle$. After Alice and Bob tell TP their operations, TP measures the two fake particles $\vert 0 \rangle \vert 0 \rangle$ with the Bell basis, and obtains the measurement result randomly in one of the two states $\vert \phi ^{ +} \rangle$ and $\vert \phi ^{ -} \rangle$. Hence, if both Alice and Bob choose to REFLECT, Eve will be detected with the probability of 1. If Alice chooses to MEASURE and Bob chooses to REFLECT, after Alice and Bob tell TP their operations, TP will measure the fake particle $\vert 0 \rangle$ reflected by Bob with the Z basis and require Alice to announce her measurement result. Hence, if Alice chooses to MEASURE and Bob chooses to REFLECT, Eve will be detected with the probability of 1. Similarly, if Alice chooses to REFLECT and Bob chooses to MEASURE, Eve will be also detected with the probability of 1. If both Alice and Bob choose to MEASURE, after Alice and Bob tell TP their operations, TP will measure the received particles with the Z basis and obtain the measurement result $\vert 0 \rangle \vert 0 \rangle$. So, if both Alice and Bob choose to MEASURE, Eve will be detected with the probability of 1. To sum up, when the two fake particles prepared by Eve are in the state of $\vert 0 \rangle \vert 0 \rangle$, Eve is detected with the probability of $\frac{1}{4} \times 1 + \frac{1}{4} \times 1 + \frac{1}{4} \times 1 + \frac{1}{4} \times 1 = 1$. Secondly, assume that the two fake particles prepared by Eve are in the state of $\vert 1 \rangle \vert 1 \rangle$. In this case, Eve is also detected with the probability of 1. Thirdly, assume that the two fake particles prepared by Eve are in the state of $\vert 0 \rangle \vert 1 \rangle$. As a result, if both Alice and Bob choose to REFLECT, TP will receive the two fake particles $\vert 0 \rangle \vert 1 \rangle$. After Alice and Bob tell TP their operations, TP measures the two fake particles $\vert 0 \rangle \vert 1 \rangle$ with the Bell basis, and obtains the measurement result randomly in one of the two states $\vert \psi ^{ +} \rangle$ and $\vert \psi ^{ -} \rangle$. Hence, if both Alice and Bob choose to REFLECT, Eve will be detected with the probability of $\frac{1}{2}$. If Alice chooses to MEASURE and Bob chooses to REFLECT, after Alice and Bob tell TP their operations, TP will measure the fake particle $\vert 1 \rangle$ reflected by Bob with the Z basis and require Alice to announce her measurement result. Hence, if Alice chooses to MEASURE and Bob chooses to REFLECT, Eve will be detected with the probability of 0. Similarly, if Alice chooses to REFLECT and Bob chooses to MEASURE, Eve will be also detected with the probability of 0. If both Alice and Bob choose to MEASURE, after Alice and Bob tell TP their operations, TP will measure the received particles with the Z basis and obtain the result $\vert 0 \rangle \vert 1 \rangle$. In this case, Eve will be detected with the probability of 0. To sum up, when the two fake particles prepared by TP are in the state of $\vert 0 \rangle \vert 1 \rangle$, Eve is detected with the probability of $\frac{1}{4} \times \frac{1}{2} + \frac{1}{4} \times 0 + \frac{1}{4} \times 0 + \frac{1}{4} \times 0 = \frac{1}{8}$. Fourthly, assume that the two fake particles prepared by Eve are in the state of $\vert 1 \rangle \vert 0 \rangle$. In this case, Eve is also detected with the probability of $\frac{1}{8}$.

(2) The measure-resend attack

In order to obtain $S_{5}$, Eve may intercept the particles of $T_{5}$ sent from TP to Alice, measure them with the Z basis and send the resulted states to Alice. In the meanwhile, in order to obtain $S_{6}$, Eve may intercept the particles of $T_{6}$ sent from TP to Bob, measure them with the Z basis and send the resulted states to Bob. However, this kind of attack from Eve will be detected undoubtedly as Alice and Bob’s operations are random. Concretely speaking, after Eve’s measurement, the Bell state prepared by TP is collapsed randomly into one of the two states $\vert 01 \rangle$ and $\vert 10 \rangle$. Without loss of generality, assume that the Bell state from TP after Eve’s measurement is collapsed into $\vert 01 \rangle$. If both Alice and Bob choose to REFLECT, after Alice and Bob tell TP their operations, TP will measure the received particles $\vert 01 \rangle$ with the Bell basis and obtain $\vert \psi ^{ +} \rangle$ or $\vert \psi ^{ -} \rangle$ with equal probability. As a result, if both Alice and Bob choose to REFLECT, Eve will be detected with the probability of $\frac{1}{2}$. If Alice chooses to MEASURE and Bob chooses to REFLECT, after Alice and Bob tell TP their operations, TP will measure the particle $\vert 1 \rangle$ reflected by Bob with the Z basis and require Alice to announce her measurement result. Hence, if Alice chooses to MEASURE and Bob chooses to REFLECT, Eve will be detected with the probability of 0. Similarly, if Alice chooses to REFLECT and Bob chooses to MEASURE, Eve will be also discovered with the probability of 0. If both Alice and Bob choose to MEASURE, after Alice and Bob tell TP their operations, TP will measure the received particles with the Z basis. Therefore, if both Alice and Bob choose to MEASURE, Eve will be detected with the probability of 0. To sum up, when Eve launches this kind of attack on one particle of $T_{5}$ and one particle of $T_{6}$, the probability that she will be discovered is $\frac{1}{4} \times \frac{1}{2} + \frac{1}{4} \times 0 + \frac{1}{4} \times 0 + \frac{1}{4} \times 0 = \frac{1}{8}$.

(3) The entangle-measure attack

Eve’s entangle-measure attack on the particles of $T_{5}$ and $T_{6}$, described as Fig. 3, can be modeled as two unitaries: $U_{E}$ attacking particles from TP to Alice and Bob and $U_{F}$ attacking particles back from Alice and Bob to TP, where $U_{E}$ and $U_{F}$ share a common probe space with initial state $\vert \xi \rangle _{E}$.

Figure 3

Eve’s entangle-measure attack on the particles of $T_{5}$ and $T_{6}$ with two unitaries $U_{E}$ and $U_{F}$

Theorem 2

Suppose that Eve performs attack $( U_{E},U_{F} )$ on the particles from TP to Alice and Bob and back to TP. For this attack inducing no error in Step 5, the final state of Eve’s probe should be independent of not only Alice and Bob’s operations but also their measurement results. As a result, Eve gets no information on the bits of $S_{5}$ and $S_{6}$.

Proof

The effect of $U_{E}$ on the qubits $\vert 0 \rangle$ and $\vert 1 \rangle$ can be expressed as

$$\begin{aligned}& U_{E} \bigl( \vert 0 \rangle \vert \xi \rangle _{E} \bigr) = \beta _{00} \vert 0 \rangle \vert \xi _{00} \rangle + \beta _{01} \vert 1 \rangle \vert \xi _{01} \rangle , \end{aligned}$$

(12)

$$\begin{aligned}& U_{E} \bigl( \vert 1 \rangle \vert \xi \rangle _{E} \bigr) = \beta _{10} \vert 0 \rangle \vert \xi _{10} \rangle + \beta _{11} \vert 1 \rangle \vert \xi _{11} \rangle , \end{aligned}$$

(13)

where $\vert \xi _{00} \rangle$, $\vert \xi _{01} \rangle$, $\vert \xi _{10} \rangle$ and $\vert \xi _{11} \rangle$ are Eve’s probe states determined by $U_{E}$, $\vert \beta _{00} \vert ^{2} + \vert \beta _{01} \vert ^{2} = 1$ and $\vert \beta _{10} \vert ^{2} + \vert \beta _{11} \vert ^{2} = 1$.

According to Stinespring dilation theorem, the global state of the composite system before Alice and Bob’s operations is

$$\begin{aligned}& U_{E} \bigl( \vert \psi ^{ +} \rangle _{56} \vert \xi \rangle _{E} \bigr) \\& \quad = U_{E} \biggl[ \frac{1}{\sqrt{2}} \bigl( \vert 01 \rangle + \vert 10 \rangle \bigr)_{56} \vert \xi \rangle _{E} \biggr] \\& \quad = \frac{1}{\sqrt{2}} \bigl[ \bigl( \beta _{00} \vert 0 \rangle _{5} \vert \xi _{00} \rangle + \beta _{01} \vert 1 \rangle _{5} \vert \xi _{01} \rangle \bigr) \bigl( \beta _{10} \vert 0 \rangle _{6} \vert \xi _{10} \rangle + \beta _{11} \vert 1 \rangle _{6} \vert \xi _{11} \rangle \bigr) \\& \qquad {}+ \bigl( \beta _{10} \vert 0 \rangle _{5} \vert \xi _{10} \rangle + \beta _{11} \vert 1 \rangle _{5} \vert \xi _{11} \rangle \bigr) \bigl( \beta _{00} \vert 0 \rangle _{6} \vert \xi _{00} \rangle + \beta _{01} \vert 1 \rangle _{6} \vert \xi _{01} \rangle \bigr) \bigr] \\& \quad = \frac{1}{\sqrt{2}} \bigl[ \vert 0 \rangle _{5} \vert 0 \rangle _{6} \bigl( \beta _{00}\beta _{10} \vert \xi _{00} \rangle \vert \xi _{10} \rangle + \beta _{10}\beta _{00} \vert \xi _{10} \rangle \vert \xi _{00} \rangle \bigr) \\& \qquad {}+ \vert 0 \rangle _{5} \vert 1 \rangle _{6} \bigl( \beta _{00}\beta _{11} \vert \xi _{00} \rangle \vert \xi _{11} \rangle + \beta _{10}\beta _{01} \vert \xi _{10} \rangle \vert \xi _{01} \rangle \bigr) \\& \qquad {}+ \vert 1 \rangle _{5} \vert 0 \rangle _{6} \bigl( \beta _{01}\beta _{10} \vert \xi _{01} \rangle \vert \xi _{10} \rangle + \beta _{11}\beta _{00} \vert \xi _{11} \rangle \vert \xi _{00} \rangle \bigr) \\& \qquad {}+ \vert 1 \rangle _{5} \vert 1 \rangle _{6} \bigl( \beta _{01}\beta _{11} \vert \xi _{01} \rangle \vert \xi _{11} \rangle + \beta _{11}\beta _{01} \vert \xi _{11} \rangle \vert \xi _{01} \rangle \bigr) \bigr] \\& \quad = \vert 0 \rangle _{5} \vert 0 \rangle _{6} \vert \vartheta _{00} \rangle + \vert 0 \rangle _{5} \vert 1 \rangle _{6} \vert \vartheta _{01} \rangle + \vert 1 \rangle _{5} \vert 0 \rangle _{6} \vert \vartheta _{10} \rangle + \vert 1 \rangle _{5} \vert 1 \rangle _{6} \vert \vartheta _{11} \rangle , \end{aligned}$$

(14)

where the subscripts 5 and 6 represent the particles from $T_{5}$ and $T_{6}$, respectively, and

$$\begin{aligned}& \vert \vartheta _{00} \rangle = \frac{1}{\sqrt{2}} \bigl( \beta _{00}\beta _{10} \vert \xi _{00} \rangle \vert \xi _{10} \rangle + \beta _{10}\beta _{00} \vert \xi _{10} \rangle \vert \xi _{00} \rangle \bigr), \end{aligned}$$

(15)

$$\begin{aligned}& \vert \vartheta _{01} \rangle = \frac{1}{\sqrt{2}} \bigl( \beta _{00}\beta _{11} \vert \xi _{00} \rangle \vert \xi _{11} \rangle + \beta _{10}\beta _{01} \vert \xi _{10} \rangle \vert \xi _{01} \rangle \bigr), \end{aligned}$$

(16)

$$\begin{aligned}& \vert \vartheta _{10} \rangle = \frac{1}{\sqrt{2}} \bigl( \beta _{01}\beta _{10} \vert \xi _{01} \rangle \vert \xi _{10} \rangle + \beta _{11}\beta _{00} \vert \xi _{11} \rangle \vert \xi _{00} \rangle \bigr), \end{aligned}$$

(17)

$$\begin{aligned}& \vert \vartheta _{11} \rangle = \frac{1}{\sqrt{2}} \bigl( \beta _{01}\beta _{11} \vert \xi _{01} \rangle \vert \xi _{11} \rangle + \beta _{11}\beta _{01} \vert \xi _{11} \rangle \vert \xi _{01} \rangle \bigr) . \end{aligned}$$

(18)

When Alice and Bob receive the particles from TP, they choose either to MEASURE or to REFLECT. After that, Eve performs $U_{F}$ on the particles sent back to TP.

(i) Consider the case that both Alice and Bob choose to MEASURE. As a result, the state of the composite system is collapsed into $\vert x \rangle _{5} \vert y \rangle _{6} \vert \vartheta _{xy} \rangle$, where $x,y \in \{ 0,1 \}$. For Eve not being detectable in Step 5, $U_{F}$ should satisfy

$$ U_{F} \bigl( \vert x \rangle _{5} \vert y \rangle _{6} \vert \vartheta _{xy} \rangle \bigr) = \vert x \rangle _{5} \vert y \rangle _{6} \vert \gamma _{xy} \rangle , $$

(19)

which means that $U_{F}$ cannot alter the state of particles from Alice and Bob. Otherwise, Eve is discovered with a non-zero probability.

(ii) Consider the case that Alice chooses to MEASURE and Bob chooses to REFLECT. As a result, the state of the composite system is collapsed into $\vert 0 \rangle _{5} \vert 0 \rangle _{6} \vert \vartheta _{00} \rangle + \vert 0 \rangle _{5} \vert 1 \rangle _{6} \vert \vartheta _{01} \rangle$ when Alice’s measurement result is $\vert 0 \rangle _{5}$ or $\vert 1 \rangle _{5} \vert 0 \rangle _{6} \vert \vartheta _{10} \rangle + \vert 1 \rangle _{5} \vert 1 \rangle _{6} \vert \vartheta _{11} \rangle$ when Alice’s measurement result is $\vert 1 \rangle _{5}$.

Assume that Alice’s measurement result is $\vert 0 \rangle _{5}$. After Eve imposes $U_{F}$ on the particles sent back to TP, due to Eq. (19), the state of the composite system is evolved into

$$ U_{F} \bigl( \vert 0 \rangle _{5} \vert 0 \rangle _{6} \vert \vartheta _{00} \rangle + \vert 0 \rangle _{5} \vert 1 \rangle _{6} \vert \vartheta _{01} \rangle \bigr) = \vert 0 \rangle _{5} \vert 0 \rangle _{6} \vert \gamma _{00} \rangle + \vert 0 \rangle _{5} \vert 1 \rangle _{6} \vert \gamma _{01} \rangle . $$

(20)

For Eve not being detectable in Step 5, the probability that TP’s measurement result on the particle reflected by Bob is $\vert 0 \rangle _{6}$ should be 0. Hence, it has

$$ \vert \gamma _{00} \rangle = 0. $$

(21)

On the other hand, assume that Alice’s measurement result is $\vert 1 \rangle _{5}$. After Eve imposes $U_{F}$ on the particles sent back to TP, due to Eq. (19), the state of the composite system is evolved into

$$ U_{F} \bigl( \vert 1 \rangle _{5} \vert 0 \rangle _{6} \vert \vartheta _{10} \rangle + \vert 1 \rangle _{5} \vert 1 \rangle _{6} \vert \vartheta _{11} \rangle \bigr) = \vert 1 \rangle _{5} \vert 0 \rangle _{6} \vert \gamma _{10} \rangle + \vert 1 \rangle _{5} \vert 1 \rangle _{6} \vert \gamma _{11} \rangle . $$

(22)

For Eve not being detectable in Step 5, the probability that TP’s measurement result on the particle reflected by Bob is $\vert 1 \rangle _{6}$ should be 0. Hence, it has

$$ \vert \gamma _{11} \rangle = 0. $$

(23)

(iii) Consider the case that Alice chooses to REFLECT and Bob chooses to MEASURE. As a result, the state of the composite system is collapsed into $\vert 0 \rangle _{5} \vert 0 \rangle _{6} \vert \vartheta _{00} \rangle + \vert 1 \rangle _{5} \vert 0 \rangle _{6} \vert \vartheta _{10} \rangle$ when Bob’s measurement result is $\vert 0 \rangle _{6}$ or $\vert 0 \rangle _{5} \vert 1 \rangle _{6} \vert \vartheta _{01} \rangle + \vert 1 \rangle _{5} \vert 1 \rangle _{6} \vert \vartheta _{11} \rangle$ when Bob’s measurement result is $\vert 1 \rangle _{6}$.

Assume that Bob’s measurement result is $\vert 0 \rangle _{6}$. After Eve imposes $U_{F}$ on the particles sent back to TP, due to Eq. (19), the state of the composite system is evolved into

$$ U_{F} \bigl( \vert 0 \rangle _{5} \vert 0 \rangle _{6} \vert \vartheta _{00} \rangle + \vert 1 \rangle _{5} \vert 0 \rangle _{6} \vert \vartheta _{10} \rangle \bigr) = \vert 0 \rangle _{5} \vert 0 \rangle _{6} \vert \gamma _{00} \rangle + \vert 1 \rangle _{5} \vert 0 \rangle _{6} \vert \gamma _{10} \rangle . $$

(24)

For Eve not being detectable in Step 5, the probability that TP’s measurement result on the particle reflected by Alice is $\vert 0 \rangle _{5}$ should be 0. This automatically stands after Eq. (21) is inserted into Eq. (24).

On the other hand, assume that Bob’s measurement result is $\vert 1 \rangle _{6}$. After Eve imposes $U_{F}$ on the particles sent back to TP, due to Eq. (19), the state of the composite system is evolved into

$$ U_{F} \bigl( \vert 0 \rangle _{5} \vert 1 \rangle _{6} \vert \vartheta _{01} \rangle + \vert 1 \rangle _{5} \vert 1 \rangle _{6} \vert \vartheta _{11} \rangle \bigr) = \vert 0 \rangle _{5} \vert 1 \rangle _{6} \vert \gamma _{01} \rangle + \vert 1 \rangle _{5} \vert 1 \rangle _{6} \vert \gamma _{11} \rangle . $$

(25)

For Eve not being detectable in Step 5, the probability that TP’s measurement result on the particle reflected by Alice is $\vert 1 \rangle _{5}$ should be 0. This automatically stands after Eq. (23) is inserted into Eq. (25).

(iv) Consider the case that both Alice and Bob choose to REFLECT. As a result, the state of the composite system is $\vert 0 \rangle _{5} \vert 0 \rangle _{6} \vert \vartheta _{00} \rangle + \vert 0 \rangle _{5} \vert 1 \rangle _{6} \vert \vartheta _{01} \rangle + \vert 1 \rangle _{5} \vert 0 \rangle _{6} \vert \vartheta _{10} \rangle + \vert 1 \rangle _{5} \vert 1 \rangle _{6} \vert \vartheta _{11} \rangle$. After Eve imposes $U_{F}$ on the particles sent back to TP, due to Eq. (19), the state of the composite system is evolved into

$$ \begin{aligned}[b] &U_{F} \bigl( \vert 0 \rangle _{5} \vert 0 \rangle _{6} \vert \vartheta _{00} \rangle + \vert 0 \rangle _{5} \vert 1 \rangle _{6} \vert \vartheta _{01} \rangle + \vert 1 \rangle _{5} \vert 0 \rangle _{6} \vert \vartheta _{10} \rangle + \vert 1 \rangle _{5} \vert 1 \rangle _{6} \vert \vartheta _{11} \rangle \bigr) \\ &\quad = \vert 0 \rangle _{5} \vert 0 \rangle _{6} \vert \gamma _{00} \rangle + \vert 0 \rangle _{5} \vert 1 \rangle _{6} \vert \gamma _{01} \rangle + \vert 1 \rangle _{5} \vert 0 \rangle _{6} \vert \gamma _{10} \rangle + \vert 1 \rangle _{5} \vert 1 \rangle _{6} \vert \gamma _{11} \rangle . \end{aligned} $$

(26)

After Eq. (21) and Eq. (23) are inserted into Eq. (26), it can be obtained that

$$\begin{aligned}& U_{F} \bigl( \vert 0 \rangle _{5} \vert 0 \rangle _{6} \vert \vartheta _{00} \rangle + \vert 0 \rangle _{5} \vert 1 \rangle _{6} \vert \vartheta _{01} \rangle + \vert 1 \rangle _{5} \vert 0 \rangle _{6} \vert \vartheta _{10} \rangle + \vert 1 \rangle _{5} \vert 1 \rangle _{6} \vert \vartheta _{11} \rangle \bigr) \\& \quad = \vert 0 \rangle _{5} \vert 1 \rangle _{6} \vert \gamma _{01} \rangle + \vert 1 \rangle _{5} \vert 0 \rangle _{6} \vert \gamma _{10} \rangle \\& \quad = \frac{1}{\sqrt{2}} \bigl( \vert \psi ^{ +} \rangle _{56} + \vert \psi ^{ -} \rangle _{56} \bigr) \vert \gamma _{01} \rangle + \frac{1}{\sqrt{2}} \bigl( \vert \psi ^{ +} \rangle _{56} - \vert \psi ^{ -} \rangle _{56} \bigr) \vert \gamma _{10} \rangle \\& \quad = \frac{1}{\sqrt{2}} \vert \psi ^{ +} \rangle _{56} \bigl( \vert \gamma _{01} \rangle + \vert \gamma _{10} \rangle \bigr) + \frac{1}{\sqrt{2}} \vert \psi ^{ -} \rangle _{56} \bigl( \vert \gamma _{01} \rangle - \vert \gamma _{10} \rangle \bigr). \end{aligned}$$

(27)

For Eve not being detectable in Step 5, the probability that TP’s measurement result on the particles reflected by Alice and Bob is $\vert \psi ^{ +} \rangle _{56}$ should be 1. Therefore, according to Eq. (27), it has

$$ \vert \gamma _{01} \rangle = \vert \gamma _{10} \rangle = \vert \gamma \rangle . $$

(28)

Inserting Eq. (28) into Eq. (27) produces

$$ U_{F} \bigl( \vert 0 \rangle _{5} \vert 0 \rangle _{6} \vert \vartheta _{00} \rangle + \vert 0 \rangle _{5} \vert 1 \rangle _{6} \vert \vartheta _{01} \rangle + \vert 1 \rangle _{5} \vert 0 \rangle _{6} \vert \vartheta _{10} \rangle + \vert 1 \rangle _{5} \vert 1 \rangle _{6} \vert \vartheta _{11} \rangle \bigr) = \sqrt{2} \vert \psi ^{ +} \rangle _{56} \vert \gamma \rangle . $$

(29)

(v) Applying Eq. (28) into Eq. (19) produces

$$\begin{aligned}& U_{F} \bigl( \vert 0 \rangle _{5} \vert 1 \rangle _{6} \vert \vartheta _{01} \rangle \bigr) = \vert 0 \rangle _{5} \vert 1 \rangle _{6} \vert \gamma \rangle , \end{aligned}$$

(30)

$$\begin{aligned}& U_{F} \bigl( \vert 1 \rangle _{5} \vert 0 \rangle _{6} \vert \vartheta _{10} \rangle \bigr) = \vert 1 \rangle _{5} \vert 0 \rangle _{6} \vert \gamma \rangle . \end{aligned}$$

(31)

Applying Eq. (21) and Eq. (28) into Eq. (20) produces

$$ U_{F} \bigl( \vert 0 \rangle _{5} \vert 0 \rangle _{6} \vert \vartheta _{00} \rangle + \vert 0 \rangle _{5} \vert 1 \rangle _{6} \vert \vartheta _{01} \rangle \bigr) = \vert 0 \rangle _{5} \vert 1 \rangle _{6} \vert \gamma \rangle . $$

(32)

Applying Eq. (23) and Eq. (28) into Eq. (22) produces

$$ U_{F} \bigl( \vert 1 \rangle _{5} \vert 0 \rangle _{6} \vert \vartheta _{10} \rangle + \vert 1 \rangle _{5} \vert 1 \rangle _{6} \vert \vartheta _{11} \rangle \bigr) = \vert 1 \rangle _{5} \vert 0 \rangle _{6} \vert \gamma \rangle . $$

(33)

Applying Eq. (21) and Eq. (28) into Eq. (24) produces

$$ U_{F} \bigl( \vert 0 \rangle _{5} \vert 0 \rangle _{6} \vert \vartheta _{00} \rangle + \vert 1 \rangle _{5} \vert 0 \rangle _{6} \vert \vartheta _{10} \rangle \bigr) = \vert 1 \rangle _{5} \vert 0 \rangle _{6} \vert \gamma \rangle . $$

(34)

Applying Eq. (23) and Eq. (28) into Eq. (25) produces

$$ U_{F} \bigl( \vert 0 \rangle _{5} \vert 1 \rangle _{6} \vert \vartheta _{01} \rangle + \vert 1 \rangle _{5} \vert 1 \rangle _{6} \vert \vartheta _{11} \rangle \bigr) = \vert 0 \rangle _{5} \vert 1 \rangle _{6} \vert \gamma \rangle . $$

(35)

According to Eqs. (29)–(35), it can be concluded that for Eve not inducing an error in Step 5, the final state of Eve’s probe should be independent of not only Alice and Bob’s operations but also their measurement results. As a result, Eve gets no information on the bits of $S_{5}$ and $S_{6}$.

Secondly, we consider the entangle-measure attack from Eve that she only performs $U_{E}$ on the particles of $T_{5}$ and $T_{6}$ sent out from TP. □

Lemma 1

Suppose that Eve only performs $U_{E}$ on the particles of $T_{5}$ and $T_{6}$ sent out from TP. For this attack inducing no error in Step 5, the final state of Eve’s probe should be independent of not only Alice and Bob’s operations but also their measurement results. As a result, Eve gets no information on the bits of $S_{5}$ and $S_{6}$.

Proof

The global state of the composite system before Alice and Bob’s operations can be depicted as Eq. (14). When Alice and Bob receive the particles from TP, they choose either to MEASURE or to REFLECT.

(i) Consider the case that both Alice and Bob choose to MEASURE. As a result, the state of the composite system is collapsed into $\vert x \rangle _{5} \vert y \rangle _{6} \vert \vartheta _{xy} \rangle$, where $x,y \in \{ 0,1 \}$. After that, Eve does nothing on the particles sent back to TP. Hence, Eve cannot be detected in Step 5.

(ii) Consider the case that Alice chooses to MEASURE and Bob chooses to REFLECT. As a result, the state of the composite system is collapsed into $\vert 0 \rangle _{5} \vert 0 \rangle _{6} \vert \vartheta _{00} \rangle + \vert 0 \rangle _{5} \vert 1 \rangle _{6} \vert \vartheta _{01} \rangle$ when Alice’s measurement result is $\vert 0 \rangle _{5}$ or $\vert 1 \rangle _{5} \vert 0 \rangle _{6} \vert \vartheta _{10} \rangle + \vert 1 \rangle _{5} \vert 1 \rangle _{6} \vert \vartheta _{11} \rangle$ when Alice’s measurement result is $\vert 1 \rangle _{5}$.

Assume that Alice’s measurement result is $\vert 0 \rangle _{5}$. Eve does nothing on the particles sent back to TP. For Eve not being detectable in Step 5, the probability that TP’s measurement result on the particle reflected by Bob is $\vert 0 \rangle _{6}$ should be 0. Hence, it has

$$ \vert \vartheta _{00} \rangle = 0. $$

(36)

On the other hand, assume that Alice’s measurement result is $\vert 1 \rangle _{5}$. Eve does nothing on the particles sent back to TP. For Eve not being detectable in Step 5, the probability that TP’s measurement result on the particle reflected by Bob is $\vert 1 \rangle _{6}$ should be 0. Hence, it has

$$ \vert \vartheta _{11} \rangle = 0. $$

(37)

(iii) Consider the case that Alice chooses to REFLECT and Bob chooses to MEASURE. As a result, the state of the composite system is collapsed into $\vert 0 \rangle _{5} \vert 0 \rangle _{6} \vert \vartheta _{00} \rangle + \vert 1 \rangle _{5} \vert 0 \rangle _{6} \vert \vartheta _{10} \rangle$ when Bob’s measurement result is $\vert 0 \rangle _{6}$ or $\vert 0 \rangle _{5} \vert 1 \rangle _{6} \vert \vartheta _{01} \rangle + \vert 1 \rangle _{5} \vert 1 \rangle _{6} \vert \vartheta _{11} \rangle$ when Bob’s measurement result is $\vert 1 \rangle _{6}$.

Assume that Bob’s measurement result is $\vert 0 \rangle _{6}$. Eve does nothing on the particles sent back to TP. For Eve not being detectable in Step 5, the probability that TP’s measurement result on the particle reflected by Alice is $\vert 0 \rangle _{5}$ should be 0. This is automatically satisfied, since Eq. (36) stands.

On the other hand, assume that Bob’s measurement result is $\vert 1 \rangle _{6}$. Eve does nothing on the particles sent back to TP. For Eve not being detectable in Step 5, the probability that TP’s measurement result on the particle reflected by Alice is $\vert 1 \rangle _{5}$ should be 0. This is automatically satisfied, since Eq. (37) stands.

(iv) Consider the case that both Alice and Bob choose to REFLECT. As a result, the state of the composite system is $\vert 0 \rangle _{5} \vert 0 \rangle _{6} \vert \vartheta _{00} \rangle + \vert 0 \rangle _{5} \vert 1 \rangle _{6} \vert \vartheta _{01} \rangle + \vert 1 \rangle _{5} \vert 0 \rangle _{6} \vert \vartheta _{10} \rangle + \vert 1 \rangle _{5} \vert 1 \rangle _{6} \vert \vartheta _{11} \rangle$. Because of Eq. (36) and Eq. (37), the state of the composite system can be expressed as

$$\begin{aligned}& \vert 0 \rangle _{5} \vert 0 \rangle _{6} \vert \vartheta _{00} \rangle + \vert 0 \rangle _{5} \vert 1 \rangle _{6} \vert \vartheta _{01} \rangle + \vert 1 \rangle _{5} \vert 0 \rangle _{6} \vert \vartheta _{10} \rangle + \vert 1 \rangle _{5} \vert 1 \rangle _{6} \vert \vartheta _{11} \rangle \\& \quad = \vert 0 \rangle _{5} \vert 1 \rangle _{6} \vert \vartheta _{01} \rangle + \vert 1 \rangle _{5} \vert 0 \rangle _{6} \vert \vartheta _{10} \rangle \\& \quad = \frac{1}{\sqrt{2}} \bigl( \vert \psi ^{ +} \rangle _{56} + \vert \psi ^{ -} \rangle _{56} \bigr) \vert \vartheta _{01} \rangle + \frac{1}{\sqrt{2}} \bigl( \vert \psi ^{ +} \rangle _{56} - \vert \psi ^{ -} \rangle _{56} \bigr) \vert \vartheta _{10} \rangle \\& \quad = \frac{1}{\sqrt{2}} \vert \psi ^{ +} \rangle _{56} \bigl( \vert \vartheta _{01} \rangle + \vert \vartheta _{10} \rangle \bigr) + \frac{1}{\sqrt{2}} \vert \psi ^{ -} \rangle _{56} \bigl( \vert \vartheta _{01} \rangle - \vert \vartheta _{10} \rangle \bigr). \end{aligned}$$

(38)

Eve does nothing on the particles sent back to TP. For Eve not being detectable in Step 5, the probability that TP’s measurement result on the particles reflected by Alice and Bob is $\vert \psi ^{ +} \rangle _{56}$ should be 1. Therefore, it can be derived from Eq. (38) that

$$ \vert \vartheta _{01} \rangle = \vert \vartheta _{10} \rangle = \vert \vartheta \rangle . $$

(39)

Inserting Eq. (39) into Eq. (38) produces

$$ \vert 0 \rangle _{5} \vert 0 \rangle _{6} \vert \vartheta _{00} \rangle + \vert 0 \rangle _{5} \vert 1 \rangle _{6} \vert \vartheta _{01} \rangle + \vert 1 \rangle _{5} \vert 0 \rangle _{6} \vert \vartheta _{10} \rangle + \vert 1 \rangle _{5} \vert 1 \rangle _{6} \vert \vartheta _{11} \rangle = \sqrt{2} \vert \psi ^{ +} \rangle _{56} \vert \vartheta \rangle . $$

(40)

It can be concluded from the above analysis: considering the entangle-measure attack from Eve that she only performs $U_{E}$ on the particles of $T_{5}$ and $T_{6}$ sent out from TP, for Eve not inducing an error in Step 5, the final state of Eve’s probe should be independent of not only Alice and Bob’s operations but also their measurement results. As a result, Eve gets no information on the bits of $S_{5}$ and $S_{6}$.

Thirdly, we consider the entangle-measure attack from Eve that she only performs $U_{F}$ on the particles of $T_{5}$ and $T_{6}$ sent back to TP. □

Lemma 2

Suppose that Eve only performs $U_{F}$ on the particles of $T_{5}$ and $T_{6}$ sent back to TP. For this attack inducing no error in Step 5, the final state of Eve’s probe should be independent of not only Alice and Bob’s operations but also their measurement results. As a result, Eve gets no information on the bits of $S_{5}$ and $S_{6}$.

Proof

Eve does nothing on the particles of $T_{5}$ and $T_{6}$ sent out from TP. As a result, the global state of the composite system before Alice and Bob’s operations can be depicted as $\vert \psi ^{ +} \rangle _{56} \vert \xi \rangle _{E}$. When Alice and Bob receive the particles sent out from TP, they choose either to MEASURE or to REFLECT.

(i) Consider the case that both Alice and Bob choose to MEASURE. As a result, the state of the composite system is randomly collapsed into $\vert t \rangle _{5} \vert r \rangle _{6} \vert \xi \rangle _{E}$, where $t,r \in \{ 0,1 \}$ and $t \oplus r = 1$. After that, Eve performs $U_{F}$ on the particles sent back to TP. For Eve not being detectable in Step 5, $U_{F}$ should satisfy

$$ U_{F} \bigl( \vert t \rangle _{5} \vert r \rangle _{6} \vert \xi \rangle \bigr) = \vert t \rangle _{5} \vert r \rangle _{6} \vert \delta _{tr} \rangle $$

(41)

for $t,r \in \{ 0,1 \}$ and $t \oplus r = 1$, which means that $U_{F}$ cannot alter the state of particles from Alice and Bob. Otherwise, Eve is discovered with a non-zero probability.

(ii) Consider the case that Alice chooses to MEASURE and Bob chooses to REFLECT. As a result, the state of the composite system is collapsed into $\vert 0 \rangle _{5} \vert 1 \rangle _{6} \vert \xi \rangle _{E}$ when Alice’s measurement result is $\vert 0 \rangle _{5}$ or $\vert 1 \rangle _{5} \vert 0 \rangle _{6} \vert \xi \rangle _{E}$ when Alice’s measurement result is $\vert 1 \rangle _{5}$.

Assume that Alice’s measurement result is $\vert 0 \rangle _{5}$. After Eve imposes $U_{F}$ on the particles sent back to TP, due to Eq. (41), the state of the composite system is evolved into

$$ U_{F} \bigl( \vert 0 \rangle _{5} \vert 1 \rangle _{6} \vert \xi \rangle \bigr) = \vert 0 \rangle _{5} \vert 1 \rangle _{6} \vert \delta _{01} \rangle . $$

(42)

For Eve not being detectable in Step 5, the probability that TP’s measurement result on the particle reflected by Bob is $\vert 0 \rangle _{6}$ should be 0. Apparently, this point is automatically satisfied.

On the other hand, assume that Alice’s measurement result is $\vert 1 \rangle _{5}$. After Eve imposes $U_{F}$ on the particles sent back to TP, due to Eq. (41), the state of the composite system is evolved into

$$ U_{F} \bigl( \vert 1 \rangle _{5} \vert 0 \rangle _{6} \vert \xi \rangle \bigr) = \vert 1 \rangle _{5} \vert 0 \rangle _{6} \vert \delta _{10} \rangle . $$

(43)

For Eve not being detectable in Step 5, the probability that TP’s measurement result on the particle reflected by Bob is $\vert 1 \rangle _{6}$ should be 0. Apparently, this point is automatically satisfied.

(iii) Consider the case that Alice chooses to REFLECT and Bob chooses to MEASURE. As a result, the state of the composite system is collapsed into $\vert 1 \rangle _{5} \vert 0 \rangle _{6} \vert \xi \rangle _{E}$ when Bob’s measurement result is $\vert 0 \rangle _{6}$ or $\vert 0 \rangle _{5} \vert 1 \rangle _{6} \vert \xi \rangle _{E}$ when Bob’s measurement result is $\vert 1 \rangle _{6}$.

Assume that Bob’s measurement result is $\vert 0 \rangle _{6}$. After Eve imposes $U_{F}$ on the particles sent back to TP, due to Eq. (41), the state of the composite system is evolved into Eq. (43). For Eve not being detectable in Step 5, the probability that TP’s measurement result on the particle reflected by Alice is $\vert 0 \rangle _{5}$ should be 0. Apparently, this point is automatically satisfied.

On the other hand, assume that Bob’s measurement result is $\vert 1 \rangle _{6}$. After Eve imposes $U_{F}$ on the particles sent back to TP, due to Eq. (41), the state of the composite system is evolved into Eq. (42). For Eve not being detectable in Step 5, the probability that TP’s measurement result on the particle reflected by Alice is $\vert 1 \rangle _{5}$ should be 0. Apparently, this point is automatically satisfied.

(iv) Consider the case that both Alice and Bob choose to REFLECT. As a result, the state of the composite system is $\vert \psi ^{ +} \rangle _{56} \vert \xi \rangle _{E}$. After Eve imposes $U_{F}$ on the particles sent back to TP, due to Eq. (41), the state of the composite system is evolved into

$$\begin{aligned} U_{F} \bigl( \vert \psi ^{ +} \rangle _{56} \vert \xi \rangle \bigr) &= \frac{1}{\sqrt{2}} \bigl( \vert 0 \rangle _{5} \vert 1 \rangle _{6} \vert \delta _{01} \rangle + \vert 1 \rangle _{5} \vert 0 \rangle _{6} \vert \delta _{10} \rangle \bigr) \\ &= \frac{1}{2} \bigl( \vert \psi ^{ +} \rangle _{56} + \vert \psi ^{ -} \rangle _{56} \bigr) \vert \delta _{01} \rangle + \frac{1}{2} \bigl( \vert \psi ^{ +} \rangle _{56} - \vert \psi ^{ -} \rangle _{56} \bigr) \vert \delta _{10} \rangle \\ &= \frac{1}{2} \vert \psi ^{ +} \rangle _{56} \bigl( \vert \delta _{01} \rangle + \vert \delta _{10} \rangle \bigr) + \frac{1}{2} \vert \psi ^{ -} \rangle _{56} \bigl( \vert \delta _{01} \rangle - \vert \delta _{10} \rangle \bigr). \end{aligned}$$

(44)

For Eve not being detectable in Step 5, the probability that TP’s measurement result on the particles reflected by Alice and Bob is $\vert \psi ^{ +} \rangle _{56}$ should be 1. Hence, it can be obtained from Eq. (44) that

$$ \vert \delta _{01} \rangle = \vert \delta _{10} \rangle = \vert \delta \rangle . $$

(45)

Inserting Eq. (45) into Eq. (44) generates

$$ U_{F} \bigl( \vert \psi ^{ +} \rangle _{56} \vert \xi \rangle \bigr) = \bigl\vert \psi ^{ +} \rangle _{56} \bigr\vert \delta \rangle . $$

(46)

It can be concluded from the above analysis: considering the entangle-measure attack from Eve that she only performs $U_{F}$ on the particles of $T_{5}$ and $T_{6}$ sent back to TP, for Eve not inducing an error in Step 5, the final state of Eve’s probe should be independent of not only Alice and Bob’s operations but also their measurement results. As a result, Eve gets no information on the bits of $S_{5}$ and $S_{6}$. □

(4) The Trojan horse attack

In accordance with Refs. [57, 58], the invisible photon eavesdropping attack and the delay-photon Trojan horse attack from Eve on the particles of $T_{5}$ during the round trip between TP and Alice can be overcome by Alice with a wavelength filter and a photon number splitter, respectively. The same methods can be used to prevent the invisible photon eavesdropping attack and the delay-photon Trojan horse attack from Eve on the particles of $T_{6}$ during the round trip between TP and Bob.

4.2 Participant attack

With respect to the participant attack suggested by Gao et al. [59], we need to consider the participant attack from Alice or Bob and that from the semi-honest TP.

(1) The participant attack from Alice or Bob

In the proposed protocol, Alice plays the same role to Bob. Without loss of generality, we only consider the case that Bob, who is supposed to have complete quantum abilities, is dishonest.

In the proposed protocol, Bob naturally knows $S_{3}$ and $S_{6}$. Moreover, according to the entanglement correlation of two qubits within one Bell state, Bob can deduce $S_{4}$ and $S_{5}$ from $S_{3}$ and $S_{6}$, respectively. As $M_{A}$ is encrypted with $S_{1}$, $S_{5}$ and $K_{AB}$, in order to deduce $M_{A}$ from $R_{A}$, Bob should further know $S_{1}$. However, Bob cannot get $S_{1}$ by cooperating with TP who knows $S_{2}$. As a result, Bob has to try his best to get $S_{1}$ by launching some active attacks on the particles of $T_{1}$, such as the intercept-resend attack, the measure-resend attack, the entangle-measure attack, the Trojan horse attack, et al. However, he will be inevitably discovered as an external eavesdropper, since Alice’s operations are random to him, after similar deductions to those of Case 1 in Sect. 4.1. In conclusion, Bob has no chance to obtain $M_{A}$.

(2) The participant attack from TP

TP may try to obtain $M_{A}$ and $M_{B}$ by using passive attacks. In other words, TP may try to reveal $M_{A}$ and $M_{B}$ from the classical information she collected during the implementation of the protocol. In the proposed protocol, TP can know $S_{1}$, $S_{2}$, $S_{3}$, $S_{4}$, $S_{5}$, $S_{6}$, $R_{A}$, $R_{B}$ and the comparison result of $M_{A}$ and $M_{B}$. However, TP still cannot deduce $M_{A}$ from $R_{A}$ and $M_{B}$ from $R_{B}$, because she cannot obtain $K_{AB}$ shared by Alice and Bob beforehand which is used to encrypt $M_{A}$ and $M_{B}$.

In the proposed protocol, TP is assumed to be semi-honest. As a result, she may try to perform possible active attacks to get $M_{A}$ and $M_{B}$ but cannot collude with anyone else. For example, TP may prepare fake quantum states, such as product states or nonmaximal entangled states, instead of Bell states in Step 1. The proposed protocol lacks the process of checking whether TP has prepared the genuine Bell states in Step 1 or not, hence, Alice and Bob may be unknown about TP’s cheating behavior. Actually, no matter what kinds of attack TP launches, the best result for TP is that she can obtain $S_{1}$, $S_{2}$, $S_{3}$, $S_{4}$, $S_{5}$, $S_{6}$, $R_{A}$, $R_{B}$ and the comparison result of $M_{A}$ and $M_{B}$. However, TP still has no opportunity to decode out $M_{A}$ from $R_{A}$ and $M_{B}$ from $R_{B}$, due to lack of $K_{AB}$.

5 Discussions and conclusions

In this part, we compare the proposed protocol with the existing SQPC protocols based on Bell states in Refs. [39, 43, 44, 48–50, 53]. The detailed comparison results are shown in Table 4. Here, the qubit efficiency is defined as [60] $\eta = \frac{b}{q + c}$, where b, q and c represent the numbers of compared private bits, consumed qubits and classical bits involved in classical communication, respectively. Note that the classical resources required for eavesdropping detection are not considered here.

Table 4 Comparison results of our SQPC protocol and the previous SQPC protocols with Bell states

In our protocol, Alice and Bob successfully compare their respective n private bits, so it has $b = n$. TP prepares $N = 16n$ initial Bell states and distributes $T_{1}$ and $T_{5}$ to Alice and $T_{3}$ and $T_{6}$ to Bob. Then, when Alice chooses to MEASURE the received qubits in $T_{1}$ and $T_{5}$, she prepares 2n and 4n new qubits, respectively. When Bob chooses to MEASURE the received qubits in $T_{3}$ and $T_{6}$, he also prepares 2n and 4n new qubits, respectively. In addition, this protocol employs the SQKD protocol in Ref. [31] to generate the n-bit pre-shared key $K_{AB}$, which consumes 24n qubits. As a result, it has $q = 16n \times 2 + 2n \times 2 + 4n \times 2 + 24n = 68n$. Alice sends $\mathrm{R}\_\{ \mathrm{A}\} \mathrm{Z}$ to TP, while Bob sends $R_{B}$ to TP. Hence, it has $c = 2n$. Therefore, the qubit efficiency of our protocol is $\eta = \frac{n}{68n + 2n} = \frac{1}{70}$.

In the protocol of Ref. [39], Alice and Bob successfully compare their respective n bits of hash values, so it has $b = n$. Server prepares 4n initial Bell states and distributes their first and second particles to Alice and Bob, respectively. Then, Alice and Bob save the measurement results or reflect the received qubits back after reordering them. As a result, it has $q = 4n \times 2 = 8n$. Alice sends $R_{A}$ to Bob, while Bob sends $R_{B}$ to Alice. Hence, it has $c = 2n$. Therefore, the qubit efficiency of the protocol of Ref. [39] is $\eta = \frac{n}{8n + 2n} = \frac{1}{10}$. Note that after Alice and Bob publish $R_{A}$ and $R_{B}$, respectively, Server can know the comparison result by computing $R_{A} \oplus R_{B}$.

In the protocol of Ref. [43], Alice and Bob successfully compare their respective n private bits, so it has $b = n$. TP prepares two sequences of Bell states, each of whose length is 16n, and distributes the first particles of two sequences to Alice and Bob, respectively. Then, when Alice and Bob choose to measure the received qubits, they replace the measurement results with the freshly prepared qubits. As a result, it has $q = 16n \times 2 \times 2 + 8n \times 2 = 80n$. Alice sends $R_{A}$ to TP, while Bob sends $R_{B}$ to TP. Hence, it has $c = 2n$. Therefore, the qubit efficiency of the protocol of Ref. [43] is $\eta = \frac{n}{80n + 2n} = \frac{1}{82}$.

In the protocol of Ref. [44], Alice and Bob successfully compare their respective n private bits, so it has $b = n$. TP prepares 8n initial Bell states and distributes their first and second particles to Alice and Bob, respectively. Then, when Alice and Bob choose to MEASURE the received qubits, they replace the measurement results with the freshly prepared qubits. In addition, the protocol employs the SQKD protocol in Ref. [31] to generate the n-bit pre-shared key $K_{AB}$, which consumes 24n qubits, and the SQKA protocol in Ref. [41] to generate the n-bit pre-shared keys, $K_{AT}$ and $K_{BT}$, which consumes 10n qubits in total. As a result, it has $q = 8n \times 2 + 4n \times 2 + 24n + 10n = 58n$. Alice sends $C_{A}$ to TP, while Bob sends $C_{B}$ to TP. Hence, it has $c = 2n$. Therefore, the qubit efficiency of the protocol of Ref. [44] is $\eta = \frac{n}{58n + 2n} = \frac{1}{60}$.

In the second protocol of Ref. [48], Alice and Bob successfully compare their respective n private bits, so it has $b = n$. TP prepares 2n initial Bell states and distributes their first and second particles to Alice and Bob, respectively. Then, when Alice and Bob choose to flip the received qubits, they replace the measurement results with the freshly prepared opposite qubits. In addition, the protocol employs the SQKD protocol in Ref. [31] to generate the n-bit pre-shared key K, which consumes 24n qubits. As a result, it has $q = 2n \times 2 + n \times 2 + 24n = 30n$. Alice sends $M_{A}$ to TP, while Bob sends $M_{B}$ to TP. Hence, it has $c = 2n$. Therefore, the qubit efficiency of the second protocol of Ref. [48] is $\eta = \frac{n}{30n + 2n} = \frac{1}{32}$.

In the protocol of Ref. [49], Alice and Bob successfully compare their respective n private bits, so it has $b = n$. TP prepares 2n initial Bell states and distributes their first and second particles to Alice and Bob, respectively. Then, when Alice and Bob choose to SIFT, they generate fresh qubits and send them to TP. In addition, the protocol uses the SQKD protocol in Ref. [29] to generate two n-bit pre-shared keys, $K_{TA}$ and $K_{TB}$, which consumes 16n qubits in total, and the SQKD protocol in Ref. [31] to generate the n-bit pre-shared key K, which consumes 24n qubits. As a result, it has $q = 2n \times 2 + n \times 2 + 16n + 24n = 46n$. Alice publishes $R_{A}$ to TP, while Bob publishes $R_{B}$ to TP. Hence, it has $c = 2n$. Therefore, the qubit efficiency of the protocol of Ref. [49] is $\eta = \frac{n}{46n + 2n} = \frac{1}{48}$.

In the protocol of Ref. [50], Alice and Bob successfully compare their respective n private bits, so it has $b = n$. TP prepares 3n initial Bell states and distributes their first and second particles to Alice and Bob, respectively. Then, when Alice and Bob choose to SIFT, they generate fresh qubits and send them to TP. When Alice and Bob choose to DETECT, they generate fresh trap qubits and send them to TP. In addition, the protocol uses the SQKD protocol in Ref. [31] to generate the n-bit pre-shared key K, which consumes 24n qubits. As a result, it has $q = 3n \times 2 + n \times 2 + n \times 2 + 24n = 34n$. Alice publishes $R_{A} \oplus R_{A}'$ to TP, while Bob publishes $R_{B} \oplus R_{B}'$ to TP. Hence, it has $c = 2n$. Therefore, the qubit efficiency of the protocol of Ref. [50] is $\eta = \frac{n}{34n + 2n} = \frac{1}{36}$.

In the protocol of Ref. [53], Alice and Bob successfully compare their respective n private bits, so it has $b = n$. TP prepares 2n initial Bell states and distributes their first and second particles to Alice and Bob, respectively. Then, when Alice and Bob choose to MEASURE the received qubits, they generate fresh qubits and send them to TP. In addition, this protocol utilizes the SQKD protocol in Ref. [31] to generate the 2n-bit pre-shared key $K_{AB}$, which consumes 48n qubits. As a result, it has $q = 2n \times 2 + n \times 2 + 48n = 54n$. Both Alice and Bob publish $K_{AB}$ to TP. Hence, it has $c = 4n$. Therefore, the qubit efficiency of the protocol of Ref. [53] is $\eta = \frac{n}{54n + 4n} = \frac{1}{58}$.

In addition, Ref. [43] needs quantum entanglement swapping technology, which may be difficult to implement in practice. Fortunately, our protocol doesn’t need quantum entanglement swapping technology. All of the SQPC protocols in Refs. [39, 44, 48] need to perform the reordering operations via different delay lines which require complicated quantum circuits in practice. Fortunately, our protocol doesn’t have this requirement. Moreover, each of the SQPC protocols in Refs. [43, 44, 48–50, 53] needs to prepare four kinds of Bell states as initial quantum resource. Fortunately, our protocol only needs to generate one kind of Bell states. It is naturally that preparing the same kind of Bell states repeatedly is easier in practice than generating different types of Bell states. To sum up, our protocol is easier to implement in practice than the SQPC protocols in Refs. [39, 43, 44, 48–50, 53].

In addition, here we can further take into account that TP may announce the fake comparison result in Step 7, which cannot be detected by Alice and Bob. In order to overcome this cheating behavior from TP, the following extra supplement should be added to the above proposed protocol: (1) in Step 6, while Alice and Bob sends $R_{A}$ and $R_{B}$ to TP, respectively, they also send $R_{A}$ and $R_{B}$ to the second semi-honest third party, TP2; (2) TP2 shares a secret key $K_{T}$ with TP via a secure QKD scheme, where $K_{T} = \{ K_{T}^{1},K_{T}^{2}, \ldots ,K_{T}^{n} \}$; (3) in Step 7, TP computes $R_{TP}^{j} = K_{T}^{j} \oplus S_{2}^{j} \oplus S_{4}^{j}$ and sends $R_{TP}$ to TP2, then TP2 computes $R_{T2}^{j} = R_{A}^{j} \oplus R_{B}^{j} \oplus R_{TP}^{j} \oplus K_{T}^{j}$ after receiving $R_{TP}$, where $R_{TP} = \{ R_{TP}^{1},R_{TP}^{2}, \ldots ,R_{TP}^{n} \}$ and $j = 1,2, \ldots ,n$; once $R_{T2}^{j} = 0$ is found, TP2 tells Alice and Bob that $M_{A}$ is not identical to $M_{B}$, otherwise, TP2 tells Alice and Bob that $M_{A}$ is identical to $M_{B}$. Apparently, because TP and TP2 cannot conspire, their published comparison results are mutually independent. Alice and Bob can judge whether TP and TP2 have announced fake comparison results or not by comparing the consistency of their published comparison results.

In conclusion, in this paper, a novel SQPC protocol based on single kind of Bell states is proposed, which utilizes the entanglement correlation of Bell states to skillfully compare the equality of private inputs from two classical users. Our protocol can resist a variety of outside and participant attacks. Our protocol only employs one kind of Bell states as initial quantum resource. Moreover, it needs none of unitary operations, quantum entanglement swapping or the reordering operations. Therefore, compared with most of the existing SQPC protocols with Bell states, our protocol has better practical implementation feasibility.