Secure dynamic multiparty quantum private comparison.

We propose a feasible and efficient dynamic multiparty quantum private comparison protocol that is fully secure against participant attacks. In the proposed scheme, two almost-dishonest third parties generate two random keys and send them to all participants. Every participant independently encrypts their private information with the encryption keys and sends it to the third parties. The third parties can analyze the equality of all or some participants' secrets without gaining access to the secret information. New participants can dynamically join the protocol without the need for any additional conditions in the protocol. We provide detailed correctness and security analysis of the proposed protocol. Our security analysis of the proposed protocol against both inside and outside attacks proves that attackers cannot extract any secret information.

Introduction

The pioneering work of Bennett and Brassard[1] laid the groundwork for the rapidly growing field of quantum cryptography and quantum communication. Subsequently, various quantum protocols have been proposed including Shor’s algorithm for factoring[2-4], quantum teleportation[5-9], superdense coding[10-13], quantum secure direct communication[14-16], quantum secret sharing[17-21], quantum dialogue[22,23] and quantum key agreement[24,25]. In 1982, the millionaires’ problem was proposed as a possible application of secure multiparty computing[26], the goal is for two parties to compare their wealth and learn who is wealthier without revealing any extra data about the other’s wealth. In 2001, an efficient and fair solution to the socialist millionaires’ problem was proposed[27]. Furthermore, a solution for the socialist millionaires’ problem based on homomorphic encryption in a semi-honest environment was discussed[28]. Lo[29] proved that the task of secure two-party computation is unachievable even with quantum cryptography[29]. Therefore, a quantum private comparison (QPC) protocol for comparing the equality of information with the help of a third party (TP) was proposed[30]. Furthermore, Hung et al.[31] proposed a secure QPC protocol with two almost-dishonest TPs. In general, there are four common levels of TP’s trustworthiness[32,33]: (1) TP is fully honest. In this circumstance, the participants only send their encrypted secrets to the TP. The TP then compares the private information of the participants and announces the final result. This situation is surely ideal, but finding a fully honest TP in the real world could be challenging. (2) TP is dishonest such that all participants cannot trust the TP. This assumption is equivalent to the standard two-party QPC protocols without a TP, whose insecurity was proved by Lo[29]. (3) TP is semi-honest. Under this circumstance, the participants can partially trust the TP. The TP honestly executes the required processes and may eavesdrop on participants’ private information using passive attacks[31]. (4) TP is almost-dishonest. This situation, which is more reasonable, assumes that the participants can partially trust the TP, and the TP may perform any active attack while executing the protocol, except conspiring with dishonest participants[31]. In general, QPC protocols can be used for novel and existing applications, including quantum voting[34,35], quantum bidding[36], and quantum auctions[37-39].

Chang et al. proposed the first multiparty quantum private comparison (MQPC) protocol for comparing the equality of secrets of any two parties among M participants[40]. The protocol used GHZ states as a quantum resource. Subsequently, a novel QPC protocol that included the support of a semi-honest TP and used d-dimensional entangled photons was proposed[41]. An MQPC protocol based on entanglement swapping of Bell states was subsequently presented[42]. This scheme used the one-way hash function to address information leakage issue and to encrypt secret information between the communicating parties. A pioneering M-participant QPC protocol that addressed the possibility of a dishonest TP collaborating with participants was discussed[43]. Furthermore, a novel MQPC protocol with a semi-honest TP that used entanglement swapping of d-level states and a unitary operation to encrypt the participants’ secrets was proposed[44]. Then, Hung et al.[31] presented a QPC protocol consisting of two third-parties in which one is malicious and the other is almost dishonest was presented. A multi-user QPC protocol that employs both scattered preparation operation and one-way convergent transmission operation of quantum states was also proposed[45], where two participants can compare their secrets with the support of the remaining participants using the polarization and spatial-mode degrees of freedom of photons to transmit information. Liu et al.[46] proposed a QPC protocol in which any participant can join dynamically to participate in the comparison of M participants.

These quantum private comparison protocols still suffer from low efficiency and an inadequate level of security. Therefore, this work proposes a feasible, efficient, and secure dynamic multiparty quantum private comparison protocol (DMQPC) that uses single-photons to encode and send encrypted information. Our proposed scheme has several important features. First, dishonest participants cannot individually or jointly attack the scheme to gain any private or secret information since every participant independently encrypts and transmits secret information to two TPs without the involvement or assistance of other participants. Second, our protocol is dynamic and flexible such that multiple participants can join or leave the protocol and the two TPs can successfully compare the encrypted information of any subset of M participants. Third, the participants only generate and transmit single photons, and the two TPs generate single photons and perform single-photon measurements. Hence, the cost of the deployed quantum devices and the employed quantum operations is reduced, and the efficiency of the proposed protocol is increased. Finally, the communication cost is significantly reduced since the proposed protocol can be executed in a variable number of rounds. We describe our scheme and provide proofs and illustrative examples in the following sections. Section 2 introduces the proposed DMQPC protocol. Section 3 verifies the correctness of the proposed scheme. The security analysis is presented in Section 4. Section 5 discussed the efficiency of the scheme and comparisons to some previous protocols. We show that our scheme is more feasible, efficient, secure and flexible compared to other protocols. Section 6 introduces comparisons to some existing QPC protocols. A summary and conclusion is presented in Section 7.

The Proposed DMQPC Protocol

Here, we will discuss the DMQPC protocol for three different scenarios, namely two-party QPC with two rounds, DMQPC with two rounds and DMQPC with B-block. Before the comparison of data, there are two main processes: (1) validation check process; (2) the initial preparation and encryption process. The two processes are similar in the three scenarios. So, they will be described in detail only for two-party QPC with two rounds.

Two-party QPC with two rounds

Suppose that Alice and Bob intend to compare the equality of their secrets X and Y, respectively, with the help of two almost-dishonest TPs. The binary representation of X in F2 is (x0, x1, ..., x), and the binary representation of Y in F2 is (y0, y1, ..., y) where X, Y ∈ {0, 1} and n ≥ 2 is the number of secret bits. In general, a protocol with two TPs has many advantages such as: (1) improving load balance performance since we can distribute the workload to two TPs (servers) instead of only one; (2) increasing availability that ensures continuity of communication; (3) ensuring security since one TP can monitor the performance of the other one[31]. The idea of adopting two TPs to execute the comparison task in QPC was first suggested by Hung et al.[31]. In our work, the advantage of using two TPs is that one can generate two independent random keys by two different TPs. More specifically, the first third-party (TP1) computes the comparison result of the first round. The second third-party (TP2) computes the comparison result of the second-round. Both TP1 and TP2 prepare a random secret key and send it to both Alice and Bob.

Validation check process

Firstly, X and Y must have the same length. Secondly, to correctly execute the proposed QPC protocol, secret data must be checked as follows; If the length of X(Y) is odd, then Alice (Bob) must replace the last bit with two bits;

Initial Preparation and Encryption Process

TP1 and TP2 prepare two random secret keys and , respectively, and send them through quantum channels to both Alice and Bob[16,47]. Alice and Bob compute , where . Then Alice and Bob split K into two equal parts and , where K ∈ {0, 1} and . To reduce the communication cost, Alice also divides X into two equal parts X and X. Alice then computes

The encrypted parts X1 and X2 can be represented as follows.

where X1 and X2 are the first and second parts of X encrypted with and , respectively. Similarly, Bob computes Y1 and Y2 just as Alice does.where Y1 and Y2 are the first and second parts of Y encrypted with and , respectively. Also, we have X12 = X1 ⊕ X2 and Y12 = Y1 ⊕ Y2. Here, ⊕ is the exclusive-OR operation.

As shown in Table 1, Alice generates new encoded parts and from X1, X2, and X12 according to the following rule: If the bit value of X1 = X12 = 0(X1 = X12 = 1) then . Otherwise, and , where and are updated parts of X1 and X12. The purpose of this process is to relate the secret message parts to each other so that we can reduce the communication cost. That is to say, it is possible to only compare one part of the secret messages in some situations to get the final result.

Table 1

Illustration of the proposed technique for preparing and .

X1		X2		X12 = X1 ⊕ X2		X1'		X12'
x1,0	0	x_2,n2	0	x_n2	0	x1,0'	1	xn2'	1
x1,1	0	x_2,(n2+1)	1	x_(n2+1)	1	x1,1'	0	x(n2+1)'	1
x1,2	1	x_2,(n2+2)	0	x_(n2+2)	1	x1,2'	0	x(n2+2)'	0
…	…	…	…	…	…	…	…	…	…
x_1,(n2−1)	1	x2,(n−1)	1	x(n−1)	0	x1,(n2−1)'	1	x(n−1)'	0

From Table 1, we can get the sequences , X12, and , with length :

Alice uses the XOR function to encrypt X1 with getting C,

Similarly, Bob performs the same processes as Alice does,

Alice computes X12 = X1 ⊕ X2:

Bob also computes Y12 = Y1 ⊕ Y2:

In our protocol, we have three options to compute and announce the comparison result. The first option would be for TP1 to compute and announce (in the first and second rounds) the comparison result. The second option would be for TP2 to compute and announce the comparison result. These two options can be used when availability of at least one TP is the most important requirement. The third option would be for the two TPs to collaborate to compute and announce the final result. The steps for executing the two rounds to compare the equality of parties’ secrets are similar in the three options. The choice of which of the three options to use depends on whether the priority is availability, workload or security. The two rounds are described as follows.

The first-round

. TP1 asks Alice and Bob to prepare Ca1 = X1 ⊕  and Cb1 = Y1 ⊕ , respectively.

. Alice prepares a sequence of single photons, called S, corresponding to C in the Z-basis {|0〉, |1〉} or the X-basis .

. For the eavesdropping check, Alice randomly prepares a sequence of decoy photons l in one of the states {|0〉, |1〉, |+〉, |−〉}. At random positions, she inserts l into S producing a new sequence . Then, Alice transmits to the TP1.

4. Alice announces the random positions and the measurement bases of l to TP1 for performing single photon measurements. TP1 then reveals the measurement outcomes. Hence, TP1 and Alice analyze the error rate. If the rate is higher than a predetermined threshold, then they terminate the protocol and restart the process again. Otherwise, TP1 discards l from and extracts S. Then TP1 can restore C, where S represents C.

. Bob and TP1 perform the same Steps 2–4 as Alice and TP1 to send C to TP1.

. TP1 performs a comparison between the first part of Alice’s and Bob’s secrets by computing R1 = C ⊕ C. If R1 = 0, this indicates that X and Y may be equal. In this case, they move to the next round to check whether Alice’s and Bob’s secrets are equal or not. Otherwise, X and Y are not equal, so there is no need to continue to the second-round to check the equality of the second parts.

The second-round

. TP1 informs TP2 that the first-round comparison result may be equal. Then TP2 asks Alice and Bob to prepare X12 and Y12, respectively.

. Alice and Bob perform the same processes described in Steps 2–4 to send X12 and Y12 to TP2.

. TP2 computes R2 = X12 ⊕ Y12. If R = R1 + R2 = 0 then X and Y are equal. Otherwise, X and Y are not equal. A detailed example to check the equality of X = {001100110010} and Y = {011100110010} is shown in Tables 2 and 3.

Table 2

Illustration of preparation of encrypted secrets for two participants.

The private information		X = {001100110010}	Y = {011100110010}
Random keys		KrandTP1={010110010110}, KrandTP2={111111010010}
		K_rand=KrandTP1⊕KrandTP2={101001000100}, Krand1={101001}, Krand2={000100}
Validity check	Length check for equality	X_length = Y_length = 12
	Length check for 2 blocks	122=6
Initial preparation		Xpart_1 = {001100}, Xpart_2 = {110010}, Krand1={101001}, Krand2={000100}.	Ypart_1 = {011100}, Ypart_2 = {110010}, Krand1={101001}, Krand2={000100}.
Encryption		X_1=Krand1⊕X_part_1, X_2=Krand2⊕X_part_2, X1 = {100101}, X2 = {110110}	Y_1=Krand1⊕Y_part_1, Y_2=Krand2⊕Y_part_2, Y1 = {110101}, Y2 = {110110}.
Encoding If X_1=X_12=0(X_1=X_12=1) then X1'=X12'=1(X1'=X12'=0). Else, X1'=X_1 & X12'=X_12 The same process for Y
		X_1=100101, X1'=101100, X_12=010011.	Y_1=110101, Y1'=111100, Y_12=000011.
Compute C_a1=X_1⊕X1', X_12=X_1⊕X_2, & C_b1=Y_1⊕Y1', Y_12=Y_1⊕Y_2.		C_a1={001001}, X_12={010011}.	C_b1={001001}, Y_12={000011}.

Table 3

Illustration of the equality check of X and Y.

Round 1	Alice	TP1	Bob
Step 1: Preparation 〈Alice〉	Prepares C_a1={001001} in Z-basis or X-basis
Steps 2&4: Eavesdropping check 〈Alice, TP1〉	errorrate<specifiedThreshold, TP1 obtains C_a1. Else, the communication process is terminated.
Step 5: Preparation 〈Bob〉			Prepares C_b1={001001}, in Z-basis or X-basis
Step 5: Eavesdropping check 〈Bob, TP1〉		errorrate<specifiedThreshold, TP1 obtains C_b1. Else, the communication process is terminated.
Step 6: Check the equality		If R_1=C_a1⊕C_b1≠0; X_1≠Y_1, X≠Y. The protocol will terminate and no need for a second-round. Otherwise, they continue to Round 2.
Round 2	Alice	TP2	Bob
Step 7: Preparation 〈Alice〉	Prepares X_12={010011} in Z-basis or X-basis
Step 8: Eavesdropping check 〈Alice, TP2〉	error rate < specified Threshold, TP2 obtains X12. Otherwise, the communication process is terminated.
Step 7: Preparation 〈Bob〉			Prepares Y_12={000011} in Z-basis or X-basis
Step 8: Eavesdropping check 〈Bob, TP2〉		error rate < specified Threshold, TP2 obtains Y12. Otherwise, the communication process is terminated.
Step 9: Check the equality		If R_2=X_12⊕Y_12=0; X = Y. Otherwise, X ≠ Y.

If then . Else, &

, TP1 obtains .

, in Z-basis or X-basis

, TP1 obtains .

If ; , .

in Z-basis or X-basis

Adding new participants

One of the main features of this protocol is the ease of joining of one or more participants. Without loss of generality, suppose a new participant called Charlie want to joint the old participants (Alice and Bob). The steps for adding a new participant are described as follows.

. Charlie asks TP1 and TP2 to join the protocol.

. TP1 asks Charlie to prepare using the same protocol as Alice and Bob to prepare C and C, respectively.

. Charlie prepares a sequence of single photons, called S, corresponding to C in the Z-basis {|0〉, |1〉} or the X-basis .

. For eavesdropping check, Charlie randomly prepares a sequence of decoy photons l in one of the states {|0〉, |1〉, |+〉, |−〉}. At random positions, he inserts l into S producing a new sequence . Then, Charlie transmits to the TP1.

. Upon receiving , Charlie announces the random positions and the measurement bases of l to TP1 for performing single photon measurements. TP1 then reveals the measurement outcomes. Hence, TP1 and Charlie analyze the error rate. If the rate is higher than a predetermined threshold, then they terminate the protocol and restart the process again. Otherwise, TP1 discards l from and extracts S. Then TP1 can restore C.

. TP1 performs a comparison between the first part of Alice’s, Bob’s, and Charlie’s secrets by computing R1 = (C ⊕ C) + (C ⊕ C). If R1 = 0, this indicates that X, Y, and Z may be equal. In this case, they move to the next round to check whether Alice’s, Bob’s, and Charlie’s secrets are equal or not. Otherwise, X, Y, and Z are not equal, so there is no need to continue to the second-round to check the equality of the second parts.

. TP1 informs TP2 that the first-round comparison result may be equal. Then TP2 asks Charlie to prepare Z12 using the same protocol as Alice and Bob to prepare X12 and Y12, respectively.

. Charlie performs the same processes described in Steps 3–4 to send Z12 to TP2.

. TP2 computes R2 = (X12 ⊕ Y12) + (Y12 ⊕ Z12). If R = R1 + R2 = 0, TP2 announces to Alice, Bob, and Charlie that X, Y, and Z are equal. Otherwise, X, Y, and Z are not equal.

Deleting old participants

Without loss of generality, suppose we have three participants Alice, Bob, and Charlie. TP1 and TP2 are allowed to delete one or more participants (e.g., Charlie) for several reasons. For example, they may want to compare just Bob’s and Alice’s private information. The detailed steps for deleting Charlie are as follows.

. TP1 and TP2 agree to delete Charlie. TP1 then discards C.

. TP1 updates the comparison process, to be only between Alice and Bob, TP1 then recomputes R1. In that case, TP1 computes and considers the result of R1 = C ⊕ C instead of R1 = (C ⊕ C) + (C ⊕ C). If the result of R1 = 0, this indicates that X and Y may be equal. In this case, they move to the next round to check whether Alice’s and Bob’s secrets are equal or not. Otherwise, X and Y are not equal and the final result is announced.

. TP1 informs TP2 that the first-round comparison result of Alice’s and Bob’s secrets may be equal.. TP2 discards the encrypted information of Charlie (Z12) and only considers the private information of Alice and Bob, that is, X12 and Y12, respectively.

. TP2 computes and considers R2 = X12 ⊕ Y12 instead of R2 = (X12 ⊕ Y12) + (Y12 ⊕ Z12). If R = R1 + R2 = 0 then X and Y are equal. Otherwise, X and Y are not equal.

Multi-party QPC with two rounds

The proposed two-party QPC protocol is easy to extend to M participants (see Fig. 1). In this scenario, there are M participants P (i = 1, 2, ..., M), and each of them has secret information with length n. Firstly, participants check the validity of their secrets according to the validation check process. After they make sure that their secrets are valid for applying the proposed protocol, TP1 and TP2 send two random secret keys ( and ) with length n to all participants. P then perform the initial preparation and encryption process as shown in Eqs. (2–5) for producing and . From Table 1, each participant gets the sequences and , with length for each sequence. Also, each participant computes C =  ⊕ . Now each participant has completed preparing encrypted secrets, and they are ready for checking the equality of their secrets using the QPC protocol.

Figure 1

The proposed DMQPC protocol for M participants.

. TP1 asks each participant to prepare C.

. P prepares a quantum sequence containing single photons corresponding to C (i.e. S) in the Z-basis {|0〉, |1〉} or X-basis .

. For the eavesdropping check, P randomly prepares a sequence of decoy photons l in one of the states {|0〉, |1〉, |+〉, |−〉}. At random positions, P inserts l into S producing a new sequence . Then, P sends to the TP1.

. Upon receiving , P announces the random positions and the measurement bases of l to TP1 for performing single photon measurements. TP1 then announces the measurement outcomes. TP1 and P analyze the error rate. If the rate is higher than a predetermined threshold, they terminate the communication and restart the process again. Otherwise, TP1 discards l from and extracts S. Then the TP1 can restore C, where S represents C.

. TP1 performs a comparison of the first part of P’s secret, where for M = 3For M > 3If R1 = 0, may be equal. Hence, they move to the next round to compute the comparison check of X. Otherwise, are not equal. Then it is not necessary to execute the second-round to check the equality of X.

. TP1 informs TP2 that the first-round comparison result may be equal. Then TP2 asks P to prepare X.

. P performs the same processes as in Steps 2–4 to send X to TP2.

. TP2 computes the comparison check of X,

where for M = 3

for M > 3Now, TP2 can compute R = R1 + R2 to determine whether are equal or not. If are equal. Otherwise, are not equal. Obviously, it is easy to add or remove any subset of participants to the protocol, where participants independently perform the required processes to prepare their secret for the final step of the protocol. Moreover, TP1 and TP2 can easily compare the equality of the secrets of any subset of M participants without any additional conditions.

Multi-Party QPC with B blocks

The secret data can be divided into several blocks (B), which could be useful in comparing the equality of big data. Each block contains bits and is executed in two rounds, where is an even number such that,

Suppose there are M participants P (i = 1, 2, ..., M). Each of them has secret information X with a length of n, and they would like to check the equality of their secrets. Firstly, all participants check the validity of their secrets according to the previously described validation check. After they make sure that their secrets are valid for applying the proposed protocol, TP1 and TP2 send two random secret keys ( and ) with length n to all participants. Based on the length of the secret data (n), TP1 and TP2 agree with participants on the value of B (see Fig. 2). P computes and divides K into B blocks. Each block contains two sub-keys and , where j = 1,2, …, B.

Figure 2

A secret of length 12 can be divided into: (a) 1 block divided into two parts and executed in two rounds; (b) 2 blocks; (c) 3 blocks; (d) 6 blocks with two rounds for each block.

Subsequently, P performs the initial preparations as previously indicated in Eq. (2) and Eq. (3) for generating and , where i = 1, 2, …, M. At this point, using Table 1, participants can easily prepare their encrypted secret information producing C and , and are ready to check the equality of their secrets using the following steps.

. TP1 asks each participant to prepare C.

. P prepares a sequence of single photons for each block, called S, corresponding to C, in the Z-basis {|0,〉 |1〉} or X-basis .

. To prevent eavesdropping, P randomly prepares a sequence of decoy photons l in one of the states {|0〉, |1〉, |+〉, |−〉}. At random positions, P inserts l into S producing a new sequence . P then sends to TP1.

. Upon receiving , P announces the random positions and the measurement bases of l to TP1 for performing single photon measurements. TP1 then announces the measurement outcomes. TP1 and P analyze the error rate. For any error rate above a predetermined threshold, they cancel the communication and restart all over again. Otherwise, TP1 discards l from and extracts S. TP1 then can construct C, where S represents C.

. TP1 computes the comparison check of C, where for M = 3For M > 3If , X1, X2, …, X may be equal, where is the comparison result of the first round of block number B for all participants. Hence, they move to the next round to compute the comparison check of . Otherwise, their secrets are not equal.

. TP1 informs TP2 that the first-round comparison result of the 1st−block (2 nd−block, …, Bth−block) may be equal. Then TP2 asks P to prepare .

. P performs the same processes as in Steps 2–4 to send to TP2.

. TP2 computes the comparison check of , where for M = 3for M > 3If , this means that X1, X2, …, X are equal. Otherwise, X1, X2, …, X are not equal. Note, participants check the result of the first block () and if  = 0 they continue to check the next block and so on until they reach the last block; otherwise, TP2 announces that the secrets are not equal.

Correctness

From Table 4, according to our initial preparation and encryption method, for every two bits we get two different encrypted bits, that is to say, we get C = 1 and X12 = 0 only when X1 = 0 and X2 = 0. So, the bit values of C and X12 together are decisive in determining the bit values of X1 and X2. Assume we have two participants Alice and Bob, and each participant has two bits X = 00 and Y = 10, respectively, and K = 00. Alice computes getting 1, and sends it to TP1. Bob also computes getting 1, and sends it to TP1. When TP1 computes R1 = C ⊕ C he gets R1 = 0, which means that the secrets of Alice and Bob may be equal or unequal (note if R1 = 1, TP1 announces that the secrets of Alice and Bob are not equal). So, they should move to the second-round to compare X12 and Y12.

Table 4

All possible encrypted data from two bits according to the initial preparation and encryption method, where , .

X1	X2	X12	X1'	X12'	To be sent to TP1	To be sent to TP2
					Ca1 = X1 ⊕ X1'	X12
0	0	0	1	1	1	0
0	1	1	0	1	0	1
1	0	1	0	0	1	1
1	1	0	1	0	0	0

In the second-round, Alice and Bob send and to TP2, respectively. TP2 computes R2 = X12 ⊕ Y12 = 0 ⊕ 1 getting R2 = 1. TP1 then computes R = R1 + R2 getting R = 1, which means that X and Y are not equal. Thus, X and Y are equal if and only if R = R1 = R2 = 0. For example, suppose we have X = 0000 and K = 0000. Then X1 = 00 and X2 = 00. As shown in Table 5, we must get C = X1 ⊕  = 11 and X12 = 00 only when X1 = 00 and X2 = 00. Also, if we have Y = 0000 and K = 0000, then Y1 = 00 and Y2 = 00. Hence, we get C = Y1 ⊕  = 11 and Y12 = 00. Now the two TPs can announce that the two inputs are equal by computing R = (C ⊕ C) + (X12 ⊕ Y12) = 0, which proves the correctness of this protocol. Note that if we proposed that C = X2 ⊕  and C = Y2 ⊕  instead of C = X1 ⊕  and C = Y1 ⊕  respectively, we also get the same correct comparison result.

Table 5

All possible encrypted data when X contains four bits, and both X1 and X2 include two bits, where , .

X1	X2	X12	X1'	X12'	To be sent to TP1	To be sent to TP2
					Ca1 = X1 ⊕ X1'	X12
0	0	0	1	1	1	0
0	0	0	1	1	1	0
0	0	0	1	1	1	0
1	1	0	1	0	0	0
1	1	0	1	0	0	0
0	0	0	1	1	1	0
1	1	0	1	0	0	0
1	1	0	1	0	0	0
0	0	0	1	1	1	0
1	0	1	0	0	1	1
0	0	0	1	1	1	0
0	1	1	0	1	0	1
1	1	0	1	0	0	0
1	0	1	0	0	1	1
1	1	0	1	0	0	0
0	1	1	0	1	0	1
1	0	1	0	0	1	1
0	0	0	1	1	1	0
1	0	1	0	0	1	1
1	1	0	1	0	0	0
0	1	1	0	0	0	1
0	0	0	1	1	1	0
0	1	1	0	1	0	1
1	1	0	1	0	0	0
1	0	1	0	0	1	1
1	0	1	0	0	1	1
1	0	1	0	0	1	1
0	1	1	0	1	0	1
0	1	1	0	1	0	1
0	0	1	1	1	1	1
0	1	1	0	1	0	1
0	1	1	0	1	0	1

Here, we provide the necessary equations to verify the equality check by TP1 and TP2 for the various suggested protocols.

From Eqs. (11) and (12), TP1 computesFrom Eqs. (13) and (14), TP2 computesIn the proposed protocol, computing only R2 is not sufficient for getting the comparison result. For example, if we have X1 = X2 = 0, Y1 = Y2 = 1, and . Then R2 = 0 ⊕ 0 ⊕ 1 ⊕ 1 = 0. This means that X and Y are equal in contrast to the correct comparison result (R = R1 + R2 = 1 + 0 = 1). In such a case, R1 guarantees the correctness of the final result.

MDQPC with two rounds

From Eq. (15), for M = 3, TP1 computesFrom Eq. (16), for M > 3, TP1 computesIn addition, from Eq. (17), for M = 3, TP2 computeswhere and represent the random encryption keys for the first and second parts of the private information. X and X represent the first part and second part of the private information of P.

From Eq. (18), for M > 3, TP2 computesThus, if R1 = 0 and R2 = 0, R = R1 + R2 = 0, hence X1, X2, ..., X are equal. Otherwise, X1, X2, ..., X are not equal.

MDQPC with B-block

From Eq. (20), for M = 3, TP1 computesSo,For M > 3,So,

In addition, from Eq. (22), for M = 3, TP2 computeswhere and are random subkeys for encrypting the first and second part of the jth block, j = 1, 2, …, B.

From Eq. (23) for M > 3, TP2 computesSo, we can getThus, if , X1, X2, …, X are equal. Otherwise, X1, X2, …, X are not equal.

Security analysis

Here, we will show the robustness of the proposed QPC protocol against insider and outsider attacks. If the length of the secrets is odd, it should be modified. This process not only contributes to correctly executing the proposed protocol but also assists in enhancing the security of the protocol by altering the original secret bits without affecting the final comparison result. Moreover, two random keys are generated and distributed between TPs and participants to encrypt the private information of parties. As discussed in[30,48], for improving the efficiency of the proposed DMQPC protocol, the private information of parties can be divided into several blocks of data. If the comparison result of a particular block is not equal, TP1 announces that the outcome of the comparison is not similar; hence there is no need to execute the remaining rounds. The three protocols in subsections 2.1, 2.4, and 2.5 are similar. Also, in the two-party QPC with two rounds, the quantum channel in the first-round is similar to the quantum channel in the second-round, so here we only analyze the quantum communication in the first-round between the participants and TP1.

Outside attack

In the two-party situation, Alice (Bob) sends () to TP1, protected by single decoy photons l (l). Alice (Bob) then announces the measurement bases and the positions of all inserted decoy particles. Subsequently, the TP1 announces the measurement results of all embedded decoy particles. Alice (Bob) then checks the security of the communication by checking whether the measurement results of the decoy particles are correct. Since the outside attacker does not learn the measurement bases of the decoy particles and their positions ahead of time, the well-known attacks such as entangle-resend attacks[32], correlation-elicitation attacks[49], and intercept-resend attacks[50] can be detected with nonzero probability[51]. For instance, if the eavesdropper, Eve, attempts to measure the decoy photons |0〉 or |1〉 in () with the correct basis (e.g., Z-basis), she successfully passes the public eavesdropping check. But, If Eve attempts to measure the decoy photons |0〉 or |1〉 in () with an incorrect basis (e.g., X-basis), she will be detected with a probability of 50%. The probability of choosing the wrong measuring basis is 50%. Thus, the rate of detecting Eve for each single decoy photon is 25% (i.e., 50% × 50%). Hence, the rate of detecting Eve for l single decoy photon is 1−(3/4), where |l| = |l| = |l|. This rate approaches 1 when l is large enough. Furthermore, a Trojan-horse attack[52] is prevented since photons are transmitted only once from participants to the TP1. So, our two-party QPC protocol is fully secure against outsider attacks. Since the proposed DMQPC protocol uses the same strategy as the two-party process, it is also secure against outsider attacks.

Participant’s attack

A significant advantage of our three different scenarios is that participant attacks such as collusion attack and cheating attack are not possible for the proposed protocols. Each participant receives two random keys from TP1 and TP2 for encrypting her/his secret without the participation or assistance of other parties. Therefore, there is no exchange of information or even communication among participants, and each participant sends the private information directly to the TP1 and TP2 through quantum channels. Thus, to steal confidential information, dishonest participants must adopt Eve’s attack strategies because they act as outside attackers. As discussed above, the protocol is secure against outside attacks.

TP’s attack

TP’s attack is another type of participant’s attack which could threaten the security of the protocol. Here we prove that our scheme is secure against dishonest or malicious TPs. Firstly, with the assumption that the two TPs are not allowed to collude together or with participants, our protocol is secure since the encrypted data is distributed to two independent TPs for computing the final comparison result. To clarify, assume we have a secret a and an encryption key b and c = a ⊕ b. The probability of an attacker to know a is , where n is the length of the secret a[53]. In the proposed protocol, from TP2’s point of view, as shown in Table 4, X12 = X1 ⊕ X2. From Eqs. (2) and (3), and where X is the first part of the secret message (X) and X is the second part of X. The probability of TP2 to know X is , where n is the length of the secret X, and is the length of X12. When n is large enough, the probability of getting the secret data is negligible. In addition, according to Table 4, TP2 can obtain X12 = 1 ⊕ . Hence, if X12 = 0 then TP2 can learn that  = 1, otherwise  = 0. However, the private information of Alice is still secure against TP2’s attack for two reasons: (1) TP2 cannot learn any private information of Alice using ; (2) the private information of Alice (X and X) is protected by two random keys ( and ).

From TP1’s point of view, Alice sends her encrypted secret (i.e., C = X1 ⊕  (C = X2 ⊕ )) to TP1. TP1 cannot reveal any useful information without knowing X1 or (X2 or ). The probability of knowing the original secret is , where n is the length of the secret X, and is the length of C(C). When n is large enough, the probability of TP1 to know the original secret is negligible. Also, when participants’ secret data is divided into B blocks, the probability of TP1(TP2) to identify the original secret is , where B is the number of blocks. In addition, according to Table 4, TP1 can obtain C = 1 ⊕ X2 and X2 = 1 ⊕ C. Hence, if C = 0; then TP1 can learn that X2 = 1, otherwise X2 = 0. However, the private information of Alice (X and X) is still secure against TP1’s attack, since and .

Efficiency Analysis

The used qubit efficiency is defined as  [54-56], where C refers to all classical bits that can be transmitted, and q refers to the total number of used photons. In the two-party case, the proposed protocol is executed in one or two rounds depending on the first-round result. If the proposed protocol is executed in one round, both Alice and Bob prepare single photons. The protocol is completed in one round when the comparison result of the first parts of Alice’s secret and Bob’s secret are not equal. Thus, the qubit efficiency is (i.e., 100%). However, if the first parts of Alice’s secret and Bob’s secret are equal, the proposed protocol is executed in two rounds. Hence, the qubit efficiency is (i.e. 50%). In the multi-party protocol with two rounds, the qubit efficiency of one round is , and the qubit efficiency for the two rounds is . In the multi-party protocol with B blocks, the proposed protocol is executed in one or more blocks depending on the previous block result. Thus, the qubit efficiency is ranging from to , where is the number of bits in each round and B is the number of determined blocks. For example, consider four participants (M = 4) who would like to compare their secrets of length 12 bits (n = 12). In this case, they can divide the secret into 2, 3, or 6 blocks, each part containing 6 bits, 4 bits, or 2 bits, respectively. Assume that they choose to divide the secrets into 2 blocks (i.e., B = 2) and each block contains 6 bits (i.e., ); hence the . Then the qubit efficiency ranges from 25% to 100%. It should be noted that the qubit efficiency increases or decreases depending on the number of participants and selected blocks. For comparison, in Liu and Wang’s protocol[46], the qubit efficiency is , and for n = 12 and M = 4, the qubit efficiency is equal to 40%.

Comparison

Here we compare the performance of our DMQPC proposed scheme with previous MQPC schemes. We first compare our DMQPC protocol with Liu and Wang’s protocol[46] (see Table 6). We then compare our DMQPC protocol with previous MQPC protocols.

Table 6

Comparison to Liu-Wang protocol[46].

Parameters	Liu-Wang protocol[46]	Our protocol
Quantum resource	Single photon states	Single photon states
Number of TPs	One	Two
Secure against participant attack	No	Yes
Quantum measurement (TP)	Single photon measurements	Single photon measurements
Quantum measurement (parties)	Single photon measurements	Single photon measurements
Preparing single photons (TP)	Yes	Yes
Preparing single photons (parties)	Yes	Yes
Dynamic	Yes	Yes
The Flexibility of comparing the private information of parties	TP can compare the secret information of any two parties of M (M ≥ 4) parties with the assistance of other M−2 parties	TPs can compare the secret information of any subset of M parties without any assistance of other parties
Joining and leaving the comparison protocol	Any subset of M parties can join in the protocol before the quantum states are measured	Any subset of M parties can join in or leave the protocol at any time without any extra conditions
The cost of transmission	All private information of parties should be transmitted among parties for deducing the final result of the comparison	In case of executing the protocol in one round, only the first part of the secret bits is transmitted to TP1 for deducing the final result of the comparison

Abulkasim et al.[57] showed that the Liu-Wang protocol suffers from participant attack. In our proposed protocol, participant attack is not possible. Thus, our protocol is safe not only against well-known participant attacks but also against potential participant attacks. Both the Liu-Wang protocol and our protocol use single photon states as a quantum resource and perform single photon measurements. The Liu-Wang protocol uses one TP who performs single photon measurements. In our protocol, two TPs are adopted and they also perform single photon preparation and measurements.

Like the Liu-Wang protocol, in our scheme, both the TP and the participants prepare single photons for deducing the comparison result. Like the Liu-Wang protocol, our protocol is dynamic so that any new subset of M parties can join or leave the protocol at any time. However, in the Liu-Wang protocol, new participants have to participate in the protocol before the quantum states are measured. Unlike the Liu-Wang protocol, in our scheme, the TPs can compare the private information of any subset of M parties without any assistance from other parties. In contrary to the Liu-Wang protocol, our scheme reduces the cost of communication by half, in some situations, where the protocol can be executed in one round to get the final comparison result.

From Table 7, like the protocols in refs. [31,40,42-45,58], our protocol is secure against participant attack. In contrast with the proposed protocols in refs. [31,40-46], which suppose that there is a semi-honest TP who executes the QPC protocol loyally, our proposed protocol allows for almost-dishonest TPs. Unlike the protocols in refs. [31,40-46,58], our protocol is secure against a malicious TP1(TP2). Like the protocols in refs. [31,46], our protocol works in an environment where participants and TPs could be strangers, where there is no need for authenticated channels to prevent secret information from leaking. Compared to previous work, our main contribution is that participant attack is not possible in this work, since there is no exchange of information or even communication among participants. In addition, our scheme reduces the cost of communication.

Table 7

Comparison to some existing QPC protocols.

Features	Ref. [58]	Ref. [40]	Ref. [41]	Ref. [42]	Ref. [43]	Ref. [44]	Ref. [31]	Ref. [45]	Ref. [46]	Our
Multiparty	No	Yes	Yes	Yes	Yes	Yes	Yes	Yes	Yes	Yes
Dynamic	No	No	No	No	No	No	No	No	Yes	Yes
Secure against participant attack	Yes	Yes	No	Yes	Yes	Yes	Yes	Yes	No	Yes
Secure against the malicious TP	No	No	No	No	No	No	No	No	No	Yes
Work in strangers’ environment[31]	No	No	No	No	No	No	Yes	No	Yes	Yes

Conclusion

This work proposes a novel dynamic multiparty quantum private comparison protocol that does not allow participant attack. The proposed protocol divides the private information into equal parts, and every participant independently encrypts her/his secrets using two random keys before sending them to two third parties using quantum channels. The protocol is executed in one or more rounds depending on the result of the previous round. The private information can also be divided into a number of blocks, with each block containing two equal parts of the secret. The dynamic nature of the proposed protocol enables the two TPs to compare the private information of any subset of M parties without any assistance from other parties. Any subset of M parties can join in or leave the protocol at any time without any extra conditions. Our analysis proves that the proposed protocol is correct and fully secure against outside attack. Furthermore, the scheme is not open to participant attacks. Compared to existing schemes, our protocol is more efficient, more secure and more feasible. Thus, our scheme is an ideal choice for comparing private information of M parties.