Single-state semiquantum private comparison based on Bell states

In this paper, a novel semiquantum private comparison (SQPC) protocol based on single kind of Bell states is proposed, which allows two classical parties to judge the equality of their private inputs securely and correctly under the help of a semi-honest third party (TP) who possesses complete quantum capabilities. TP is allowed to misbehave on her own but cannot conspire with anyone else. Our protocol needs none of unitary operations, quantum entanglement swapping or the reordering operations. Moreover, our protocol only needs to prepare single kind of Bell states as initial quantum resource. Detailed security analysis turns out that our protocol is secure against various outside and participant attacks. Compared with most of the existing SQPC protocols based on Bell states, our protocol is more feasible in practice.


Introduction
Relying on the physical laws such as the quantum no-cloning theorem, the uncertainty principle etc., quantum cryptography possesses unconditional security in theory. In 1984, Bennett and Brassard [1] proposed the world's first quantum key distribution (QKD) protocol by using the polarization of single photons, which is always named as the BB84 protocol later. Starting with the BB84 protocol, quantum cryptography has gained considerable developments in recent years.
Researchers have proposed different kinds of quantum cryptography protocols suitable for different application scenarios, such as quantum key distribution (QKD) [2][3][4][5][6], quantum secret sharing (QSS) [7][8][9][10], quantum secure direct communication (QSDC) [11][12][13][14][15][16], quantum identity authentication (QIA) [17,18], and so on. QKD protocols can be used to establish a private sequence of key bits between two remote communicants through the transmission of quantum signals. QSS permits different participants to share a secret privately in the way that only all of them cooperate together can they reconstruct it. QSDC protocols can be used to directly transmit a secret message from one party to the other party. QIA protocols can be used for authenticating whether the user's identity is legal or not. In 2009, Yang and Wen [19] proposed the first quantum private comparison (QPC) protocol, which can compare the equality of private inputs from two different users under the condition that none of their private inputs will be leaked out. Since then, scholars have designed abundant QPC protocols with different quantum states, such as the ones 2 with single particles [20,21], Bell states [22][23][24], GHZ states [25,26], cluster states [27],  -type entangled states [28], etc. The above QPC protocols require all users to have complete quantum capabilities, which may incur high costs in practice.
In 2007, Boyer et al. [29] proposed the first measure-resend semiquantum key distribution (SQKD) protocol by using the famous BB84 protocol, where it is not necessary for all users to have complete quantum capabilities. Subsequently, in 2009, Boyer et al. [30] further put forward the randomization-based SQKD protocol with single photons. At present, in the field of semiquantum cryptography, according to the two representative works in Refs. [29,30], classical users are widely considered to be limited within the following operations: (a) sending or reflecting the qubits without interference; (b) measuring qubits in the Z basis (i.e.,   1 , 0 ); (c) preparing the fresh qubits in the Z basis; and (d) reordering the qubits through different delay lines. Based on these settings, compared with the traditional quantum cryptography, semiquantum cryptography may effectively save quantum resource and quantum operations. The idea of semiquantumness has been applied into various branches of quantum cryptography so that the corresponding semiquantum cryptography branches have been established, such as SQKD [29][30][31][32][33], semiquantum secret sharing (SQSS) [34][35][36][37], semiquantum key agreement (SQKA) [38][39][40][41], semiquantum controlled secure direct communication (SQCSDC) [41] and semiquantum dialogue (SQD) [41,42], etc.
In 2016, Chou et al. [43] introduced the concept of semiquantumness into QPC and put forward the first semiquantum private comparison (SQPC) protocol by using Bell states and quantum entanglement swapping. In 2018, Thapliyal et al. [44] proposed a SQPC protocol based on Bell states, which needs to share a secret key in advance among different participants by using SQKD and SQKA; Ye et al. [45] designed a SQPC protocol with the measure-resend characteristics based on two-particle product states. In 2019, Yan et al. [39] constructed a randomization-based SQPC protocol based on Bell states without pre-shared keys; Lin et al. [46] proposed a SQPC protocol with single photons, which allows two classical participants to safely compare the equality of their private inputs under the help of an almost dishonest third party (TP); Yan et al. [47] put forward a SQPC scheme based on Greenberger-Horne-Zeilinger (GHZ) class states. In 2020, Jiang [48] put forward two SQPC protocols with Bell states, where the first protocol requires the classical users to measure the received particles but the second protocol doesn't have this requirement. In 2021, Tsai et al. [49] and Xie et al. [50] pointed out that the first SQPC protocol in Ref. [48] has security loopholes. In order to solve these problems, Ref. [49] makes TP share a secret key with each classical user in advance through SQKD, while Ref. [50] increases the quantum measurement capability for two classical users. In the same year, Yan et al. [51] put forward a SQPC protocol with three-particle GHZ-like states; Ye et al. [52] proposed an 3 efficient circular SQPC protocol based on single-particle states without using a pre-shared key; Sun et al. [53] suggested a novel measure-resend SQPC scheme with pre-shared keys by using Bell states. Note that each of the SQPC protocols in Refs. [43,44,[48][49][50]53] needs to employ four kinds of Bell states as initial quantum resource.
According to the above analysis, in this paper, in order to cut down the usage of initial quantum resource and quantum operations for SQPC based on Bell states, we propose a novel SQPC protocol based on single kind of Bell states, which utilizes the entanglement correlation of Bell states to skillfully compare the equality of two classical users' private inputs. Compared with most of the existing SQPC protocols with Bell states, our protocol is much easier to implement in practice, due to the following advantages: firstly, it only adopts one kind of Bell states as initial quantum resource; secondly, it doesn't need to employ quantum entanglement swapping or the reordering operations.  . The proposed SQPC protocol based on Bell states can be depicted as follows, whose flow chart is shown in Fig.1 for clarity.

Protocol description
Step 1: TP prepared 16 Nn = Bell states all in the state of ( ) . Then, she divides the first particles and the second particles of the first n 4 Bell states into sequences 1 T and 2 T , respectively. Similarly, she makes the first particles and the second particles of the second n 4 Bell states to form sequences 3 T and 4 T , respectively, and lets the first particles and the second particles of the last 8n Bell states to compose sequences 5 T and 6 T , respectively. Afterward, TP transmits the particles of sequence 1 T to Alice one by one. Note that after TP sends the first particle to Alice, she sends a particle only after receiving the previous one. In the meanwhile, TP transmits the particles of sequence 3 T to Bob one by one. Likewise, after TP sends the first particle to Bob, she sends a Step 2: After receiving each particle from TP, Alice randomly selects one of the following two operations: measuring the received particle with the Z basis and resending a fresh one to TP in the same state to the measurement result (this is called as the MEASURE mode); and returning the received particle to TP directly (this is called as the REFLECT mode). Alice records the measurement results of corresponding particles in 1 T which she chose to MEASURE. Similarly, after receiving each particle from TP, Bob randomly selects one of the following two operations, MEASURE and REFLECT. Bob also records the measurement results of corresponding particles in 3 T which he chose to MEASURE. Step 3: TP and Alice cooperate together to check the transmission security of 1 T . Alice tells TP the positions where she chose to REFLECT. TP performs different operations on the received particles according to Alice's choices, as illustrated in Table 1.
For checking the error rate on the n 2 REFLECT particles in 1 T , TP compares her Bell basis measurement results with her initial prepared states. Apparently, if there exists no Eve, TP's measurement results should always be +  .
For checking the error rate on the n 2 MEASURE particles in 1 T , TP randomly chooses n ones among them, tells Alice the chosen positions and requires Alice to inform her of the corresponding measurement results on these n chosen MEASURE particles in 1 T . TP calculates the error rate by comparing her measurement results on these n chosen MEASURE particles in 1 T , her measurement results on the corresponding n particles in 2 T and Alice's measurement results on these n chosen MEASURE particles in 1 T . Apparently, if there exists no Eve, these three kinds of measurement results should be perfectly correlated. For example, assuming that there exists no Eve, when Alice's measurement result on one chosen MEASURE particle in 1 T is 0 ( 1 ), 5 TP's measurement result on this chosen MEASURE particle in 1 T should also be 0 ( 1 ); and TP's measurement result on the corresponding particle in 2 T should be 1 ( 0 ), since the corresponding initial Bell state prepared by TP is  + .
If either the error rate on the REFLECT particles or the error rate on the MEASURE particles in 1 T is unreasonably high, the protocol will be halted; otherwise, the protocol will be continued.
In the meanwhile, TP and Bob cooperate together to check the transmission security of 3 T . Bob tells TP the positions where he chose to REFLECT. TP performs different operations on the received particles according to Bob's choices, as illustrated in Table 2.
For checking the error rate on the n 2 REFLECT particles in 3 T , TP compares her Bell basis measurement results with her initial prepared states.
For checking the error rate on the n 2 MEASURE particles in 3 T , TP randomly chooses n ones among them, tells Bob the chosen positions and requires Bob to inform her of the corresponding measurement results on these n chosen MEASURE particles in 3 T . TP calculates the error rate by comparing her measurement results on these n chosen MEASURE particles in 3 T , her measurement results on the corresponding n particles in 4 T and Bob's measurement results on these n chosen MEASURE particles in 3 T . If either the error rate on the REFLECT particles or the error rate on the MEASURE particles in 3 T is unreasonably high, the protocol will be halted; otherwise, the protocol will be continued.  In the meanwhile, TP drops out the n 3 particles in 4 T used for security check in Step 5: TP transmits the particles of sequence 5 T to Alice one by one. Note that after TP sends the first particle to Alice, she sends a particle only after receiving the previous one. After receiving each particle from TP, Alice randomly selects one of the two operations, MEASURE and REFLECT. Then, Alice tells TP the positions where she chose to REFLECT.
In the meanwhile, TP transmits the particles of sequence 6 T to Bob one by one. Note that after TP sends the first particle to Bob, she sends a particle only after receiving the previous one. After receiving each particle from TP, Bob randomly selects one of the two operations, MEASURE and REFLECT. Then, Bob tells TP the positions where he chose to REFLECT.
According to the choices of Alice and Bob, TP performs different operations on the received particles, as illustrated in Table 3. Case ①, Case ② and Case ③ are used for checking whether the transmissions of 5 T and 6 T are secure or not; and Case ④ is used for not only the security check of the transmissions of 5 T and 6 T but also privacy comparison. If either of the error rates of Case ①, Case ② , Case ③ and Case ④ is unreasonably high, the protocol will be halted; otherwise, the protocol will be continued.
In the meanwhile, Bob drops out the 7n particles in 6 T used for security check in Step 5. In Case ④, Bob's measurement results on the remaining n particles in 6 T , which are not used for security check, are represented as Step 7: After receiving

Correctness analysis
In the proposed SQPC protocol, Alice and Bob's secret messages are   (1) 4 Security analysis

Outside attack
In the proposed SQPC protocol, TP sends 1 T to Alice and 3 T to Bob firstly, and then transmits 5 T and 6 T to Alice and Bob, respectively. For clarity, we firstly analyze the security of transmission of 1 T or 3 T , and then validate the security of transmissions of 5 T and 6 T . Case 1：Eve attacks 1 T when it goes from TP to Alice or 3 T when it goes from TP to Bob In the proposed SQPC protocol, 1 T , which is independent from 3 T , essentially plays the same role to 3 T . Thus, for simplicity, we only analyze the transmission security of 1 T from TP to Alice and back to TP.
(1) The intercept-resend attack During the transmission of 1 T from TP to Alice and back to TP, Eve may try her best to obtain 1 S by launching the following attack: Eve may intercept the particles of 1 T from TP to Alice and send the fake particles she generated in the Z basis beforehand to Alice. However, Eve will be inevitably detected due to the following two reasons: on one hand, the fake particles she prepared beforehand may be different from the genuine ones in 1 T ; and on the other hand, she doesn't know Alice's operations, which are random in fact. Concretely speaking, when TP sends one particle of 1 T to Alice, Eve intercepts it and sends the prepared fake one to Alice. Without loss of generality, assume that the fake one prepared by herself is in the state of 0 . As a result, if Alice chooses to MEASURE, her measurement result will be 0 . After Alice tells TP her operation, TP uses the Z basis to measure the corresponding particle in 2 T and obtains the measurement result randomly in one of the two states 0 and 1 . Hence, if Alice chooses to MEASURE, Eve will be detected with 9 the probability of 2 1 . If Alice chooses to REFLECT, TP will receive the fake particle. After Alice tells TP her operation, TP measures the fake particle and the corresponding particle in 2  REFLECT, Eve will be detected with the probability of 4 3 . To sum up, when Eve launches this kind of attack on one particle of 1 T , the probability that she will be discovered is 8 (2) The measure-resend attack In order to obtain 1 S , Eve may intercept the particles of 1 T sent from TP to Alice, measure them with the Z basis and send the resulted states to Alice. However, this kind of attack from Eve will be inevitably discovered, since Alice's operations are random. Concretely speaking, after Eve's measurement, the particle Eve sends to Alice is randomly in one of the two states 0 and 1 .
Without loss of generality, assume that the particle after Eve's measurement is in the state of 0 . If Alice chooses to MEASURE, after she tells TP her operation, TP uses the Z basis to measure the corresponding particle in 2 T and obtains the measurement result 1 . Hence, if Alice chooses to MEASURE, Eve will be detected with the probability of 0. If Alice chooses to REFLECT, after she tells TP her operation, TP measures the received particle from Alice and the corresponding particle in 2 T with the Bell basis, and obtains the measurement result randomly in one of the two states  + and  − . Hence, if Alice chooses to REFLECT, Eve will be detected with the probability of 2 1 . To sum up, when Eve launches this kind of attack on one particle of 1 T , the probability that she will be discovered is 4 ( ) where 00  , 01  , 10  and 11  are Eve's probe states determined by Ê , According to Stinespring dilation theorem, the global state of the composite system before Alice' s operation is where the subscripts 1 and 2 represent the particles from 1 T and 2 T , respectively. (i) Firstly, consider the case that Alice chooses to MEASURE. As a result, the state of the composite system is collapsed into ( ) when Alice's measurement result is 1 1 . 11 Eve imposes F on the particle sent back to TP. In order that Eve's attacks on the MEASURE particle will not be discovered by TP and Alice in Step 3, the global state of the composite system should be ( ) 00 10 00 10 when Alice's measurement result is 1 1 .
(ii) Secondly, consider the case that Alice chooses to REFLECT. As a result, the state of the composite system is ( ) ( ) 00 10 11 00 10 01 01 Eve imposes F on the particle sent back to TP. According to Eq.(5) and Eq. (6) In order that Eve's attacks on the REFLECT particle will not be discovered by TP and Alice in Step 3, the probability that TP's measurement result on a pair of particles in 1 T and 2 respectively.
According to Eq.(9), Eq.(10) and Eq. (11), in order not to be detected by TP and Alice, the final state of Eve's probe should be independent from not only Alice's operation but also the TP 12 and Alice's measurement results. As a result, Eve gets no information on the bits of 1 S and 2 S .

(4)The Trojan horse attack
Because the particles of 1 T are transmitted forth and back between TP and Alice, two types of Trojan horse attack from Eve, i.e., the invisible photon eavesdropping attack [55] and the delay-photon Trojan horse attack [56,57], should be taken into account. In the light of Refs. [57,58], Alice can use a wavelength filter and a photon number splitter to resist these two types of Trojan horse attack from Eve, respectively.
Case 2：Eve attacks 5 T and 6 T when they go from TP to Alice and Bob (1) The intercept-resend attack In Step 5, TP transmits 5 T and 6 T to Alice and Bob, respectively. During these transmissions, Eve may try her best to obtain 5 S and 6 S by launching the following attack: Eve intercepts the two particles sent from TP to Alice and Bob, and sends two fake ones she prepared in the Z basis beforehand to Alice and Bob, respectively. However, Eve will be undoubtedly discovered for two facts: firstly, the fake particles she prepared beforehand may be different from the genuine ones in 5 T and 6 T ; and secondly, Alice and Bob's operations are random. Concretely speaking, when TP sends one particle of 5 T to Alice and one particle of 6 T to Bob, Eve intercepts them and sends the prepared fake ones to Alice and Bob, respectively. Firstly, assume that the two fake particles . Fourthly, assume that the two fake particles prepared by Eve are in the state of 0 1 . In this case, Eve is also detected with the probability of 1 8 .
(2) The measure-resend attack In order to obtain 5 S , Eve may intercept the particles of 5 T sent from TP to Alice, measure them with the Z basis and send the resulted states to Alice. In the meanwhile, in order to obtain 6 S , Eve may intercept the particles of 6 T sent from TP to Bob, measure them with the Z basis and send the resulted states to Bob. However, this kind of attack from Eve will be detected undoubtedly as Alice and Bob's operations are random. Concretely speaking, after Eve's measurement, the Bell state prepared by TP is collapsed randomly into one of the two states 01 and 10  REFLECT and Bob chooses to MEASURE, Eve will be also discovered with the probability of 0.
If both Alice and Bob choose to MEASURE, after Alice and Bob tell TP their operations, TP will measure the received particles with the Z basis. Therefore, if both Alice and Bob choose to MEASURE, Eve will be detected with the probability of 0. To sum up, when Eve launches this kind of attack on one particle of 5 T and one particle of 6 T , the probability that she will be discovered is 8 where the subscripts 5 and 6 represent the particles from 5 T and 6 T , respectively, and ( ) 00 00 10 00 10 10 00 10 00 For Eve not being detectable in Step 5, the probability that TP's measurement result on the particle reflected by Bob is 6 0 should be 0. Hence, it has 00 0  = .
On the other hand, assume that Alice's measurement result is 5 1 . After Eve imposes F U on the particles sent back to TP, due to Eq. (19), the state of the composite system is evolved into ( ) For Eve not being detectable in Step 5, the probability that TP's measurement result on the particle reflected by Bob is 6 1 should be 0. Hence, it has 11 0  = .  According to Eqs. (29)(30)(31)(32)(33)(34)(35), it can be concluded that for Eve not inducing an error in Step 5, the final state of Eve's probe should be independent of not only Alice and Bob's operations but also their measurement results. As a result, Eve gets no information on the bits of 5 S and 6 S . Secondly, we consider the entangle-measure attack from Eve that she only performs E U on the particles of 5 T and 6 T sent out from TP. Assume that Bob's measurement result is 6 0 . Eve does nothing on the particles sent back to TP. For Eve not being detectable in Step 5, the probability that TP's measurement result on the particle reflected by Alice is 5 0 should be 0. This is automatically satisfied, since Eq.(36) stands.
On the other hand, assume that Bob's measurement result is 6 1 . Eve does nothing on the particles sent back to TP. For Eve not being detectable in Step 5, the probability that TP's measurement result on the particle reflected by Alice is 5 1 should be 0. This is automatically satisfied, since Eq.(37) stands.
(iv) Consider the case that both Alice and Bob choose to REFLECT. As a result, the state of the composite system is It can be concluded from the above analysis: considering the entangle-measure attack from Eve that she only performs E U on the particles of 5 T and 6 T sent out from TP, for Eve not inducing an error in Step 5, the final state of Eve's probe should be independent of not only Alice and Bob's operations but also their measurement results. As a result, Eve gets no information on the bits of 5 S and 6 S . Thirdly, we consider the entangle-measure attack from Eve that she only performs F U on the particles of 5 T and 6 T sent back to TP.
For Eve not being detectable in Step 5, the probability that TP's measurement result on the particle reflected by Bob is 6 0 should be 0. Apparently, this point is automatically satisfied.
On the other hand, assume that Alice's measurement result is 5

. After Eve imposes
For Eve not being detectable in Step 5, the probability that TP's measurement result on the particle reflected by Bob is 6 1 should be 0. Apparently, this point is automatically satisfied.
It can be concluded from the above analysis: considering the entangle-measure attack from Eve that she only performs F U on the particles of 5 T and 6 T sent back to TP, for Eve not inducing an error in Step 5, the final state of Eve's probe should be independent of not only Alice and Bob's operations but also their measurement results. As a result, Eve gets no information on the bits of 5 S and 6 S . (4) The Trojan horse attack 22 In accordance with Refs. [57,58], the invisible photon eavesdropping attack and the delay-photon Trojan horse attack from Eve on the particles of 5 T during the round trip between TP and Alice can be overcome by Alice with a wavelength filter and a photon number splitter, respectively. The same methods can be used to prevent the invisible photon eavesdropping attack and the delay-photon Trojan horse attack from Eve on the particles of 6 T during the round trip between TP and Bob.

Participant attack
With respect to the participant attack suggested by Gao et al. [59], we need to consider the participant attack from Alice or Bob and that from the semi-honest TP.
(1) The participant attack from Alice or Bob In the proposed protocol, Alice plays the same role to Bob. Without loss of generality, we only consider the case that Bob, who is supposed to have complete quantum abilities, is dishonest.
In the proposed protocol, Bob naturally knows 3 S and 6 S . Moreover, according to the entanglement correlation of two qubits within one Bell state, Bob can deduce 4 S and 5 S from 3 S and 6 S , respectively. As

Discussions and conclusions
In this part, we compare the proposed protocol with the existing SQPC protocols based on Bell states in Refs. [39,43,44,[48][49][50]53]. The detailed comparison results are shown in Table 4.
Here, the qubit efficiency is defined as [60] b qc In the protocol of Ref. [44], Alice and Bob successfully compare their respective n private bits, 24 so it has bn = . TP prepares n 8 initial Bell states and distributes their first and second particles to Alice and Bob, respectively. Then, when Alice and Bob choose to MEASURE the received qubits, they replace the measurement results with the freshly prepared qubits. In addition, the protocol employs the SQKD protocol in Ref. [31] to generate the n -bit pre-shared key AB K , which consumes 24n qubits, and the SQKA protocol in Ref. [41] In the protocol of Ref. [49], Alice and Bob successfully compare their respective n private bits, so it has bn = . TP prepares n 2 initial Bell states and distributes their first and second particles to Alice and Bob, respectively. Then, when Alice and Bob choose to SIFT, they generate fresh qubits and send them to TP. In addition, the protocol uses the SQKD protocol in Ref. [29] to generate two n -bit pre-shared keys, TA K and TB K , which consumes16n qubits in total, and the SQKD protocol in Ref. [31] In the protocol of Ref. [50], Alice and Bob successfully compare their respective n private bits, so it has bn = . TP prepares n 3 initial Bell states and distributes their first and second particles to Alice and Bob, respectively. Then, when Alice and Bob choose to SIFT, they generate fresh qubits and send them to TP. When Alice and Bob choose to DETECT, they generate fresh trap qubits and send them to TP. In addition, the protocol uses the SQKD protocol in Ref. [31] to generate the n -bit pre-shared key K , which consumes 24n qubits. As a result, it has In the protocol of Ref. [53], Alice and Bob successfully compare their respective n private bits, 25 so it has bn = . TP prepares n 2 initial Bell states and distributes their first and second particles to Alice and Bob, respectively. Then, when Alice and Bob choose to MEASURE the received qubits, they generate fresh qubits and send them to TP. In addition, this protocol utilizes the SQKD protocol in Ref. [31] to generate the 2n -bit pre-shared key AB K , which consumes 48n qubits. As a result, it has 2 2 2 48 54 q n n n n =  +  + = . Both Alice and Bob publish In addition, Ref. [43] needs quantum entanglement swapping technology, which may be difficult to implement in practice. Fortunately, our protocol doesn't need quantum entanglement swapping technology. All of the SQPC protocols in Refs. [39,44,48] need to perform the reordering operations via different delay lines which require complicated quantum circuits in practice.
Fortunately, our protocol only needs to generate one kind of Bell states. It is naturally that preparing the same kind of Bell states repeatedly is easier in practice than generating different types of Bell states. To sum up, our protocol is easier to implement in practice than the SQPC protocols in Refs. [39,43,44,[48][49][50]53].
In addition, here we can further take into account that TP may announce the fake comparison result in Step 7, which cannot be detected by Alice and Bob. In order to overcome this cheating behavior from TP, the following extra supplement should be added to the above proposed protocol: (1) in Step  Alice and Bob can judge whether TP and TP2 have announced fake comparison results or not by comparing the consistency of their published comparison results.
In conclusion, in this paper, a novel SQPC protocol based on single kind of Bell states is proposed, which utilizes the entanglement correlation of Bell states to skillfully compare the equality of private inputs from two classical users. Our protocol can resist a variety of outside and participant attacks. Our protocol only employs one kind of Bell states as initial quantum resource.
Moreover, it needs none of unitary operations, quantum entanglement swapping or the reordering 26 operations. Therefore, compared with most of the existing SQPC protocols with Bell states, our protocol has better practical implementation feasibility. Table 4 Comparison results of our SQPC protocol and the previous SQPC protocols with Bell states The protocol of Ref. [39] The protocol of Ref. [43] The protocol of Ref. [44] The second protocol of Ref. [48] The protocol of Ref. [49] The protocol of Ref. [50] The protocol of Ref. [