1 Introduction
With the continuous development of quantum computers, the classic key agreement scheme has faced the challenge of security. The quantum cryptography, which is guaranteed by the Heisenberg uncertainty principle and the quantum non-cloning theorem,[1] is attached great importance by scholars at home and abroad. According to different carriers carrying quantum information, it can be divided into discrete variable quantum cryptography and continuous variable quantum cryptography. The discrete variable cryptographic protocol refers to the finite dimensionality of the Hilbert space in which the quantum states used for encoding are distributed throughout the key distribution process. The continuous variable cryptographic protocol means that the Hilbert space in which the quantum states used for encoding are infinitely dimensional, and the carrier of the information is the regular component of the optical field. Through research, it is found that there are some shortcomings in the quantum key agreement protocol based on discrete variables. For example, the ideal single photon source is difficult to prepare, the detector efficiency is low, and it is easy to be interfered in channel transmission. In the continuous variable protocol, the quantum state is simple to prepare, has strong immunity to noise, and has high detection efficiency, which can make up for the deficiency of the discrete variable protocol.
In recent years, quantum key distribution protocols based on continuous variables and quantum key agreement protocol based on discrete variables have made great progress both theoretically and experimentally, and gradually began to move toward practical use. In 2010, Chong and Hwang[2] proposed the QKA scheme using the BB84 protocol, and the shared key was established with the technique of unitary operation and the delay measurement.
In 2011, Zhang {\it et al}.[3-4] designed a quantum cryptographic protocol based on continuous variables to realize the secret sharing between multiple parties and multiple parties, and analyzed it with information theory to prove its security. In 2013, Yin {\it et al}.[5] proposed a three-party quantum key agreement of two-particle entangled states on an ideal quantum channel. In 2014,Xu et al.[6] proposed a new multi-party quantum key agreement protocol based on GHZ states, and the protocol can be extended to multiple parties. Li et al.[7] proposed a continuous variable measurement device-independent quantum key distribution, which is measured by an untrusted third party, which protects the detector side channel and improves quantum efficiency. In 2017, Zhou et al.[8-9] proposed a quantum dialogue protocol based on continuous variable two-mode squeezed vacuum state and GHZ state, and the quantum dialogue efficiency was significantly improved. In the same year, Gu Jun et al.[10] pointed out that Xu's agreement had participants attacking and did not meet the fairness requirement, so an improved plan was proposed. In 2018, Gong et al.[11] proposed a quantum network dialog protocol based on the continuous variable GHZ states, which allows multiple communicating parties to conduct network conversations; They also propose a quantum network dialog protocol based on continuous variable single-mode squeezed states,[12] which is easier to implement than discrete variable quantum dialog protocols. So far, the multi-party quantum key agreement protocol based on continuous variables has not received extensive attention and lacks corresponding experimental results. Therefore, the design and analysis of multi-party quantum key agreement protocol for studying continuous variables has very important significance both theoretical and practical.
In this paper, the three-party quantum key agreement protocol based on continuous variable single-mode squeezed state is proposed. It is not only suitable for three parties, but also for multi-party quantum key negotiation. The remaining parts of the paper are arranged as follows: the second part introduces the single-mode squeezed state; the third part details the proposed protocol; the fourth part analyzes the security of the proposed protocol; the fifth part summarizes the proposed protocol.
2 Preliminaries
In quantum optics, a squeezed beam can be expressed as[13]
$$ | {\alpha ,r} \rangle = x + i p = {e^r}x( 0 ) + i {e^{ - {r}}}p\,( 0 )\,, $$
where $r$ represents the compression factor, and if the compression factor $r$ is negative, it means that the amplitude of the beam is squeezed; if $r$ is positive, it means the phase of the beam is squeezed. When an orthogonal component is infinitely squeezed, the compressed state becomes a straight line, which can be accurately measured, and the other component will diverge exponentially and become uncertain.[14] Amplitude $x( 0 )$ and phase $p\, 0 )$ obey the following distribution $x( 0 ) \sim N( {0,{1}/{4}} )$,
$ p\,( 0 ) \sim N( {0,{1}/{4}} )$, $[ {x( 0 ),p\, 0 )} ] = {i }/{2}$,
$$ \Delta x = \frac{1}{2}{e^{ - {r}}}\,, $$
$$ \Delta p = \frac{1}{2}{e^{ - {r}}}\,, $$
$$ \Delta x\cdot\Delta p > \frac{1}{4}\,. $$
The relationship between amplitude and phase satisfies the Heisenberg uncertainty theorem. The single mode squeezed state can be prepared by degenerate optical parametric amplification (DOPA) of two beams.[15]
$$ | {\alpha ,r} \rangle = \hat D( \alpha )\hat S( r )| 0 \rangle\,. $$
The real and imaginary parts of the single-mode squeezed state can be expressed as
$$ {X_{|{\varphi _{Θ A}}{\rangle _{11}}}} = {X_{|{\varphi _{Θ A}}{\rangle _{01}}}}\cosh\,r + {X_{|{\varphi _{Θ A}}{\rangle _{02}}}}{e^{i \Delta \theta }}\sinh\,r $$
$$ {P_{|{\varphi _{Θ A}}{\rangle _{11}}}} = {P_{|{\varphi _{Θ A}}{\rangle _{01}}}}\cosh\,r - {P_{|{\varphi _{Θ A}}{\rangle _{02}}}}{e^{i \Delta {\rm{\theta }}}}\sinh\,r\, $$
$|{\varphi _{Θ A}}{\rangle _{01}}$ and $|{\varphi _{Θ A}}{\rangle _{02}}$ are two vacuum states, $|{\varphi _{Θ A}}{\rangle _{11}}$ is the prepared single mode squeezed state, and $\Delta {\theta }$ is the relative phase difference between the generated pump light field and the input signal light field.
3 Design of Quantum Key Agreement Pro-tocol Based on Continuous Variable Single Mode Squeezed State
3.1 Three-Party Quantum Key Agreement Protocol
The three-party quantum key agreement protocol model based on continuous variable single-mode squeezed states is shown in Fig. 1.
Fig. 1 Detailed diagram of three-party QKA. |
When Alice, Bob, and Charlie want to perform quantum key agreement, the three parties select the compression coefficients that are both positive or negative and operate at the same time. The specific steps are as follows.
S1 Alice's Operation
(i) Alice performs degenerate parametric amplification on the vacuum quantum states $|{\varphi _{Θ A}}{\rangle _{01}}$ and $|{\varphi _{Θ A}}{\rangle _{02}}$ to obtain single-mode squeezed state $|{\varphi _{Θ A}}{\rangle _{11}}$. Alice randomly selects the time slot $t_{1}$ to perform balanced homodyne detection on the amplitude or phase of the quantum state according to the value of $r$. If $r>0$, the quadrature phase component is measured; if $r<0$, the quadrature amplitude component is measured. And have a record of the result. Alice selects the random variables ${x_{Θ A}}$ and ${p_{Θ A}}$ and time slot $t_{2}$ to perform a translation operation ${D_{Θ A}}$(${a_{Θ A}} = {x_{Θ A}} + i {p_{Θ A}}$) on $|{\varphi _{Θ A}}{\rangle _{11}}$ to generate $|{\varphi _{Θ A}}{\rangle _{21}}$, where ${x_{Θ A}}$ and ${p_{Θ A}}$ obey the Gaussian distribution ${X_{Θ A}}\sim N( {0,{N_{{x_{Θ A}}}}{V_0}} )$ and ${P_{Θ A}}\sim N( {0,{N_{{p_{Θ A}}}}{V_0}} )$ respectively. ${V_0}$ is the noise variance of the vacuum state, which is used as the unit of signal variance and noise. Alice selects a random translation operation at time slot $t_{3}$ to perform a decoy operation ${D_{QA1}}({a_{Θ QA1}} = {x_{Θ QA1}} + i {p_{Θ QA1}}$) on $|{\varphi _{Θ A}}{\rangle _{21}}$ to generate $|{\varphi _{Θ A}}\rangle _{21}^*$. Alice sends $|{\varphi _{Θ A}}\rangle _{21}^*$ to Bob[16] through the quantum channel.
$$ |{\varphi _{Θ A}}{\rangle _{21}} = D_{Θ A}^† ( a )|{\varphi _{Θ A}}{\rangle _{11}}{D_{Θ A}}( a ) = |{\varphi _{Θ A}}{\rangle _{11}} + M\,,$$
$$ {X_{|{\varphi _{Θ A}}{\rangle _{21}}}} = {X_{|{\varphi _{Θ A}}{\rangle _{11}}}} + Re( M ) = {X_{|{\varphi _{Θ A}}{\rangle _{11}}}} + {x_{Θ A}}\,, $$
$${P_{|{\varphi _{Θ A}}{\rangle _{21}}}} = {P_{|{\varphi _{Θ A}}{\rangle _{11}}}} + Im( M ) = {P_{|{\varphi _{Θ A}}{\rangle _{11}}}} + {p_{Θ A}}\,. $$
After Bob tells Alice to receive $|{\varphi _{Θ A}}\rangle _{31}^*$, Alice announces the decoy time slot $t_{3}$. Bob measures the amplitude or phase of $|{\varphi _{Θ A}}\rangle _{31}^*$ at time slot $t_{3}$ and publishes the measurement results. Alice can determine whether there is eavesdropping on the channel based on the measurement published by Bob. If there is eavesdropping, the communication will be abandoned, otherwise the deception operation ${D_{QA1}}$ will be announced.
(ii) Bob removes the decoy information at time slot $t_{3}$ to get $|{\varphi _{Θ A}}{\rangle _{31}}$. Bob selects random variables ${x_{Θ B}}$ and ${p_{Θ B}}$ at time slot $t_{2}$ to perform a translation operation ${D_{Θ B}}$(${a_{Θ B}} = {x_{Θ B}} + i {p_{Θ B}}$) to generate $|{\varphi _{Θ A}}{\rangle _{41}}$. Bob selects a random translation operation at time slot $t_{4}$ to perform a decoy operation ${D_{QB1}}$ (${a_{Θ QB1}} = {x_{Θ QB1}} + i {p_{Θ QB1}}$) on $|{\varphi _{Θ A}}{\rangle _{41}}$ to generate $|{\varphi _{Θ A}}\rangle _{41}^*$. Bob sends $|{\varphi _{Θ A}}\rangle _{41}^*$ to Charlie via the quantum channel. After Charlie informs Bob that $|{\varphi _{Θ A}}\rangle _{41}^*$ has been received, Bob announces that the decoy time slot $t_{4}$. Charlie measures the amplitude or phase of $|{\varphi _{Θ A}}\rangle _{41}^*$ at time slot $t_{4}$ and announces the measurement results. Bob can determine whether there is eavesdropping on the channel based on the measurements published by Charlie. If there is eavesdropping, the communication is abandoned, otherwise the deception operation ${D_{QB1}}$ is announced.
(iii) Charlie removes the decoy information in time slot $t_{4}$ and obtains $|{\varphi _{Θ A}}{\rangle _{41}}$. Charlie selects random variables ${x_{Θ C}}$ and ${p_{Θ C}}$ in time slot $t_{2}$ to perform a translation operation ${D_{Θ C}}$ $({a_{Θ C}} = {x_{Θ C}} + i {p_{Θ C}})$ on $|{\varphi _{Θ A}}{\rangle _{41}}$ to generate $|{\varphi _{Θ A}}{\rangle _{51}}$. Charlie selects a random translation operation at time slot $t_{5}$ to perform a decoy operation ${D_{QC1}}$ (${a_{Θ QC1}} = {x_{Θ QC1}} + i {p_{Θ QC1}}$) on $|{\varphi _{Θ A}}{\rangle _{51}}$ to generate $|{\varphi _{Θ A}}\rangle _{51}^*$. Charlie sends $|{\varphi _{Θ A}}\rangle _{51}^*$ to Alice via the quantum channel. After Alice informs Charlie that she has received $|{\varphi _{Θ A}}\rangle _{51}^*$, Charlie announced the deception time slot $t_{5}$. Alice measures the amplitude or phase of $|{\varphi _{Θ A}}\rangle _{51}^*$ at time slot $t_{5}$ and announces the measurement. Charlie can determine whether there is eavesdropping on the channel based on the measurements published by Alice. If there is eavesdropping, the communication will be abandoned, otherwise the deception operation ${D_{QC1}}$ will be announced.
(iv) Alice removes the decoy information at time slot $t_{5}$ to get $|{\varphi _{Θ A}}{\rangle _{51}}$. Alice selects the same measurement component at time slot $t_{2}$ to perform balanced homodyne detection on the quantum state $|{\varphi _{Θ A}}{\rangle _{51}}$. The measurement result is
$$ {X_{\mu 1}} = {X_{|{\varphi _{Θ A}}{\rangle _{11}}}} + {x_{Θ A}} + {x_{Θ B}} + {x_{Θ C}}\,, $$
$$ {P_{\mu 1}} = {P_{|{\varphi _{Θ A}}{\rangle _{11}}}} + {p_{Θ A}} + {p_{Θ B}} + {p_{Θ C}}\,. $$
According to the measurement result of $|{\varphi _{Θ A}}{\rangle _{11}}$ and the formula (11), (12), Alice can deduce
$$ {x_{Θ A}} + {x_{Θ B}} + {x_{Θ C}} = {X_{\mu 1}} - {X_{|{\varphi _{Θ A}}{\rangle _{11}}}}\,, $$
$$ {p_{Θ A}} + {p_{Θ B}} + {p_{Θ C}} = {P_{\mu 1}} - {P_{|{\varphi _{Θ A}}{\rangle _{11}}}}\,.$$
S2 Bob's Operation
(i) Bob performs degenerate parametric amplification on the vacuum quantum states $|{\varphi _{Θ B}}{\rangle _{01}}$ and $|{\varphi _{Θ B}}{\rangle _{02}}$ to obtain single-mode squeezed state $|{\varphi _{Θ B}}{\rangle _{11}}$. Bob randomly selects the time slot $t_{1}$ to perform balanced homodyne detection on the amplitude or phase of the quantum state according to the value of $r$. Bob records measurement result. Bob selects the random variables ${x_{Θ B}}$ and ${p_{Θ B}}$ at time slot $t_{2}$ to perform a translation operation ${D_{Θ B}}$ on $|{\varphi _{Θ B}}{\rangle _{11}}$ to generate $|{\varphi _{Θ B}}{\rangle _{21}}$, where ${x_{Θ B}}$ and ${p_{Θ B}}$ obey the Gaussian distribution ${X_{Θ B}}\sim N( {0,{N_{{x_{Θ B}}}}{V_0}} )$ and ${P_{Θ B}}\sim N( {0,{N_{{p_{Θ B}}}}{V_0}} )$ respectively. Bob selects a random translation operation at time slot $t_{3}$ to perform a decoy operation ${D_{QB2}}$ (${a_{Θ QB2}} = {x_{Θ QB2}} + i {p_{Θ QB2}}$) on $|{\varphi _{Θ B}}{\rangle _{21}}$ to generate $|{\varphi _{Θ B}}\rangle _{21}^*$. Bob sends $|{\varphi _{Θ B}}\rangle _{21}^*$ to Charlie through the quantum channel.
$$ |{\varphi _{Θ B}}{\rangle _{21}} = D_{Θ B}^† ( a )|{\varphi _{Θ B}}{\rangle _{11}}{D_{Θ B}}( a ) = |{\varphi _{Θ B}}{\rangle _{11}} + M\,, $$
${X_{|{\varphi _{Θ B}}{\rangle _{21}}}} = {X_{|{\varphi _{Θ B}}{\rangle _{11}}}} + Re( M ) = {X_{|{\varphi _{Θ B}}{\rangle _{11}}}} + {x_{Θ B}}\,,$
${P_{|{\varphi _{Θ B}}{\rangle _{21}}}} = {P_{|{\varphi _{Θ B}}{\rangle _{11}}}} + Im( M ) = {P_{|{\varphi _{Θ B}}{\rangle _{11}}}} + {p_{Θ B}}\,.$
After Charlie tells Bob to receive $|{\varphi _{Θ B}}\rangle _{31}^*$, Bob announces the decoy time slot $t_{3}$. Charlie measures the amplitude or phase of $|{\varphi _{Θ B}}\rangle _{31}^*$ at time slot $t_{3}$ and publishes the measurement results. Bob can determine whether there is eavesdropping on the channel based on the measurement published by Charlie. If there is eavesdropping, the communication will be abandoned, otherwise the deception operation ${D_{QB2}}$ will be announced.
(ii) Charlie removes the decoy information at time slot $t_{3}$ to get $|{\varphi _{Θ B}}{\rangle _{31}}$. Charlie selects random variables ${x_{Θ C}}$ and ${p_{Θ C}}$ at time slot $t_{2}$ to perform a translation operation ${D_{Θ C}}$ to generate $|{\varphi _{Θ B}}{\rangle _{41}}$. Charlie selects a random translation operation at time slot $t_{4}$ to perform a decoy operation ${D_{QC2}}$(${a_{QC2}} = {x_{QC2}} + i {p_{QC2}}$) on $|{\varphi _{Θ B}}{\rangle _{41}}$ to generate $|{\varphi _{Θ B}}\rangle _{41}^*$. Charlie sends $|{\varphi _{Θ B}}\rangle _{41}^*$ to Alice via the quantum channel. After Alice informs Charlie that $|{\varphi _{Θ B}}\rangle _{41}^*$ has been received, Charlie announces that the decoy time slot $t_{4}$. Alice measures the amplitude or phase of $|{\varphi _{Θ B}}\rangle _{41}^*$ at time slot $t_{4}$ and announces the measurement results. Charlie can determine whether there is eavesdropping on the channel based on the measurements published by Alice. If there is eavesdropping, the communication is abandoned, otherwise the deception operation ${D_{QC2}}$ is announced.
(iii) Alice removes the decoy information in time slot $t_{4}$ and obtains $|{\varphi _{Θ B}}{\rangle _{41}}$. Alice selects random variables ${x_{Θ A}}$ and ${p_{Θ A}}$ in time slot $t_{2}$ to perform a translation operation ${D_{A}}$ on $|{\varphi _{Θ B}}{\rangle _{41}}$ to generate $|{\varphi _{Θ B}}{\rangle _{51}}$. Alice selects a random translation operation at time slot $t_{5}$ to perform a decoy operation ${D_{QA2}}$ (${a_{Θ QA2}} = {x_{Θ QA2}} + i {p_{Θ QA2}}$) on $|{\varphi _{Θ B}}{\rangle _{51}}$ to generate $|{\varphi _{Θ B}}\rangle _{51}^*$. Alice sends $|{\varphi _{Θ B}}\rangle _{51}^*$ to Bob via the quantum channel. After Bob informs Alice that she has received $|{\varphi _{Θ B}}\rangle _{51}^*$, Alice announced the deception time slot $t_{5}$. Bob measures the amplitude or phase of $|{\varphi _{Θ B}}\rangle _{51}^*$ at time slot $t_{5}$ and announces the measurement. Alice can determine whether there is eavesdropping on the channel based on the measurements published by Alice. If there is eavesdropping, the communication will be abandoned, otherwise the deception operation ${D_{QA2}}$ will be announced.
(iv) Bob removes the decoy information at time slot $t_{5}$ to get $|{\varphi _{Θ B}}{\rangle _{51}}$. Bob selects the same measurement component at time slot $t_{2}$ to perform balanced homodyne detection on the quantum state $|{\varphi _{Θ B}}{\rangle _{51}}$. The measurement result is
$$ {X_{\mu 2}} = {X_{|{\varphi _{Θ B}}{\rangle _{11}}}} + {x_{Θ B}} + {x_{Θ C}} + {x_{Θ A}}\,, $$
$$ {P_{\mu 2}} = {P_{|{\varphi _{Θ B}}{\rangle _{11}}}} + {p_{Θ B}} + {p_{Θ C}} + {p_{Θ A}}\,. $$
According to the measurement result of $|{\varphi _{Θ B}}{\rangle _{11}}$ and the formula (18)(19), Bob can deduce
$$ {x_{Θ A}} + {x_{Θ B}} + {x_{Θ C}} = {X_{\mu 2}} - {X_{|{\varphi _{Θ B}}{\rangle _{11}}}}\,, $$
$$ {p_{Θ A}} + {p_{Θ B}} + {p_{Θ C}} = {P_{\mu 2}} - {P_{|{\varphi _{Θ B}}{\rangle _{11}}}}\,. $$
S3 Charlie's Operation
(i) Charlie performs degenerate parametric amplification on the vacuum quantum states $|{\varphi _{Θ C}}{\rangle _{01}}$ and $|{\varphi _{Θ C}}{\rangle _{02}}$ to obtain single-mode squeezed state $|{\varphi _{Θ C}}{\rangle _{11}}$. Charlie randomly selects the time slot $t_{1}$ to perform balanced homodyne detection on the amplitude or phase of the quantum state according to the value of $r$. Charlie records measurement result. Charlie selects the random variables ${x_{Θ C}}$ and ${p_{Θ C}}$ at time slot $t_{2}$ to perform a translation operation ${D_{Θ C}}$ on $|{\varphi _{Θ C}}{\rangle _{11}}$ to generate $|{\varphi _{Θ C}}{\rangle _{21}}$, where ${x_{Θ C}}$ and ${p_{Θ C}}$ obey the Gaussian distribution ${X_{Θ C}}\sim N( {0,{N_{{x_{Θ C}}}}{V_0}} )$ and ${P_{Θ C}}\sim N( {0,{N_{{p_{Θ C}}}}{V_0}} )$ respectively. Charlie selects a random translation operation at time slot $t_{3}$ to perform a decoy operation ${D_{QC3}}$ (${a_{Θ QC3}} = {x_{Θ QC3}} + i {p_{Θ QC3}}$) on $|{\varphi _{Θ C}}{\rangle _{21}}$ to generate $|{\varphi _{Θ C}}{\rangle}^*_{21}$. Charlie sends $|{\varphi _{Θ C}}{\rangle}^*_{21}$ to Alice through the quantum channel.
$$ |{\varphi _{Θ C}}{\rangle _{21}} = D_{Θ C}^† ( a )|{\varphi _{Θ C}}{\rangle _{11}}{D_{Θ C}}( a ) = |{\varphi _{Θ C}}{\rangle _{11}} + M\,, $$
$$ {X_{|{\varphi _{Θ C}}{\rangle _{21}}}} = {X_{|{\varphi _{Θ C}}{\rangle _{11}}}} + Re( M ) = {X_{|{\varphi _{Θ C}}{\rangle _{11}}}} + {x_{Θ C}}\,,$ $$
$${P_{|{\varphi _{Θ C}}{\rangle _{21}}}} = {P_{|{\varphi _{Θ C}}{\rangle _{11}}}} + Im( M ) = {P_{|{\varphi _{Θ C}}{\rangle _{11}}}} + {p_{Θ C}}\,.$ $$
After Alice tells Charlie to receive $|{\varphi _{Θ C}}{\rangle}^*_{31}$, Charlie announces the decoy time slot $t_{3}$. Alice measures the amplitude or phase of $|{\varphi _{Θ C}}{\rangle}^*_{31}$ at time slot $t_{3}$ and publishes the measurement results. Charlie can determine whether there is eavesdropping on the channel based on the measurement published by Alice. If there is eavesdropping, the communication will be abandoned, otherwise the deception operation ${D_{QC3}}$ will be announced.
(ii) Alice removes the decoy information at time slot $t_{3}$ to get $|{\varphi _{Θ C}}{\rangle _{31}}$. Alice selects random variables ${x_{Θ A}}$ and ${p_{Θ A}}$ at time slot $t_{2}$ to perform a translation operation ${D_{Θ A}}$ to generate $|{\varphi _{Θ C}}{\rangle _{41}}$. Alice selects a random translation operation at time slot $t_{4}$ to perform a decoy operation ${D_{QA3}}$(${a_{Θ QA3}} = {x_{Θ QA3}} + i {p_{Θ QA3}}$) on $|{\varphi _{Θ C}}{\rangle _{41}}$ to generate $|{\varphi _{Θ C}}{\rangle}^*_{41}$. Alice sends $|{\varphi _{Θ C}}{\rangle}^*_{41}$ to Bob via the quantum channel. After Bob informs Alice that $|{\varphi _{Θ C}}{\rangle}^*_{41}$ has been received, Alice announces that the decoy time slot $t_{4}$. Bob measures the amplitude or phase of $|{\varphi _{Θ C}}{\rangle}^*_{41}$ at time slot $t_{4}$ and announces the measurement results. Alice can determine whether there is eavesdropping on the channel based on the measurements published by Bob. If there is eavesdropping, the communication is abandoned, otherwise the deception operation ${D_{QA3}}$ is announced.
(iii) Bob removes the decoy information in time slot $t_{4}$ and obtains $|{\varphi _{Θ C}}{\rangle _{41}}$. Bob selects random variables ${x_{Θ B}}$ and ${p_{Θ B}}$ in time slot $t_{2}$ to perform a translation operation ${D_{Θ B}}$ on $|{\varphi _{Θ C}}{\rangle _{41}}$ to generate $|{\varphi _{Θ C}}{\rangle _{51}}$. Bob selects a random translation operation at time slot $t_{5}$ to perform a decoy operation ${D_{QB3}}$(${a_{Θ QB3}} = {x_{Θ QB3}} + i {p_{Θ QB3}}$) on $|{\varphi _{Θ C}}{\rangle _{51}}$ to generate $|{\varphi _{Θ C}}{\rangle}^*_{51}$. Bob sends $|{\varphi _{Θ C}}{\rangle}^*_{51}$ to Charlie via the quantum channel. After Charlie informs Bob that she has received $|{\varphi _{Θ C}}{\rangle}^*_{51}$, Bob announced the deception time slot $t_{5}$. Charlie measures the amplitude or phase of $|{\varphi _{Θ C}}{\rangle}^*_{51}$ at time slot $t_{5}$ and announces the measurement. Bob can determine whether there is eavesdropping on the channel based on the measurements published by Charlie. If there is eavesdropping, the communication will be abandoned, otherwise the deception operation ${D_{QB3}}$ will be announced.
(iv) Charlie removes the decoy information at time slot $t_{5}$ to get $|{\varphi _{Θ C}}{\rangle _{51}}$. Charlie selects the same measurement component at time slot $t_{2}$ to perform balanced homodyne detection on the quantum state $|{\varphi _{Θ C}}{\rangle _{51}}$. The measurement result is
$$ {X_{\mu 3}} = {X_{|{\varphi _{Θ C}}{\rangle _{11}}}} + {x_{Θ C}} + {x_{Θ A}} + {x_{Θ B}}\,, $$
$$ {P_{\mu 3}} = {P_{|{\varphi _{Θ C}}{\rangle _{11}}}} + {p_{Θ C}} + {p_{Θ A}} + {p_{Θ B}}\,.$$
According to the measurement result of $|{\varphi _{Θ C}}{\rangle _{11}}$ and the formula (25) and (26), Charlie can deduce
$$ {x_{Θ A}} + {x_{Θ B}} + {x_{Θ C}} = {X_{\mu 3}} - {X_{|{\varphi _{Θ C}}{\rangle _{11}}}}\,, $$
$$ {p_{Θ A}} + {p_{Θ B}} + {p_{Θ C}} = {P_{\mu 3}} - {P_{|{\varphi _{Θ C}}{\rangle _{11}}}}\,. $$
S4 Alice, Bob, and Charlie simultaneously publish a part of the secret information ${x_{Θ A}} + {x_{Θ B}} + {x_{Θ C}}$ or ${p_{Θ A}} + {p_{Θ B}} + {p_{Θ C}}$ after the quantum state is removed as the test key. If the test keys published by the three parties are the same, then the remaining ${x_{Θ A}} + {x_{Θ B}} + {x_{Θ C}}$ or ${p_{Θ A}} + {p_{Θ B}} + {p_{Θ C}}$ is used as the shared key.
3.2 Multi-Party Quantum Key Agreement Protocol
This protocol extends the three-party quantum key agreement protocol to the multi-party quantum key agreement protocol based on continuous variable single-mode squeezed states. Assume that the n-party of the participation agreement is A$_1$, A$_2$, $\ldots$, A$_n$. A$_x$ is one of the participants.
Step 1 A$_1$ prepares single-mode squeezed state, randomly select time slot $t_{1}$ for balanced homodyne detection and record the measurement results. A$_1$ selects time slot $t_{2}$ to perform a translation operation on the quantum state to encrypt its own information, and selects time slot $t_{3}$ to perform a decoy operation on the quantum state. A$_1$ then sends the quantum state to A$_2$ via the quantum channel. After receiving the quantum state, A$_1$ determines whether there is eavesdropping based on the A$_2$ measurement result. If there is no eavesdropping, A$_2$ continues to select the time slot $t_{2}$ to encrypt the information, performs the spoofing operation and then sends the quantum state to A$_3$. Each remaining participant performs the same operation as A$_2$ until the $n$-th participant A$_n$ completes the operation and sends the quantum state to A$_1$. A$_1$ measures the received quantum state at the time slot $t_{2}$, and compares with the measurement result of the time slot $t_{1}$ to obtain the sum of the n-party encrypted information ${x_{Θ A}} + {x_{Θ B}} + {x_{Θ C}}$ or ${p_{Θ A}} + {p_{Θ B}} + {p_{Θ C}}$.
Step 2 Similar to step 1, the $N$ parties participating in the protocol perform the same operation as A$_1$ at the same time, that is, A$_x$ prepares a single-mode squeezed state, randomly selects time slot $t_{1}$ for balanced homodyne detection, and records the measurement result. A$_x$ performs a translation operation on the quantum state at time slot $t_{2}$ to encrypt its own information and performs a decoy operation on the quantum state at time slot $t_{x+2}$. A$_x$ then sends the quantum state to A$_{x+1}$ through the quantum channel. After receiving the quantum state, A$_{x+1}$ measures the quantum state of the $t_{x+2}$ time slot to determine whether there is eavesdropping. If there is no eavesdropping, it continues to perform the translation operation of the quantum state in time slot $t_{2}$ to encrypt its own information and performs a spoofing operation to prevent eavesdropping attacks. After the operation, the quantum state is sent to the next party until it is transmitted back to the sender of the quantum state. Since the information encrypted by the round participants in the $t_{2}$ time slot is the same, each participant obtains the sum of the encrypted information of the n-party after the n-round operation.
Step 3 A$_1$, A$_2$, $\ldots$, A$_n$ simultaneously announces the secret information ${x_{Θ A}} + {x_{Θ B}} + {x_{Θ C}}$ or ${p_{Θ A}} + {p_{Θ B}} + {p_{Θ C}}$ after partial elimination of the three-party quantum state as the test key. If the test keys published by the n-party are the same, then the remaining ${x_{Θ A}} + {x_{Θ B}} + {x_{Θ C}}$ or ${p_{Θ A}} + {p_{Θ B}} + {p_{Θ C}}$ is taken as the shared key of the N-party.
4 Security Analyses
Security analysis is a crucial factor for quantum key agreement protocols. In theory, attacker Eve can attack the protocol through any kind of attack. In the analysis below, we usually list the attack mode used by the attacker and then analyze the security of the protocol in various attack modes.
4.1 Individual Attacks
Participants will pretend to be senders or receivers involved in the communication process to complete the man-in-the-middle attack. However, the legitimate communication party can detect the eavesdropper Eve by performing quantum channel eavesdropping detection. Any party involved in the negotiation will terminate the communication as soon as it finds that there is a wiretapping attack. Suppose Eve plays the role of one of the communicating parties Bob and is not detected in the eavesdropping detection. The encoding in the amplitude direction will be described as an example.
(i) \ If Eve encrypts different information in three encoding operations, it also performs decoy operations. After three rounds of communication, participants can negotiate the following key
$$ {K_{ A}} = {x_{Θ A}} + {x_{Θ E1}} + {x_{Θ C}}\,, $$
$$ {K_E} = {x_{Θ A}} + {x_{Θ E2}} + {x_{Θ C}}\,, $$
$$ {K_{C}} = {x_{Θ A}} + {x_{Θ E3}} + {x_{Θ C}}\,. $$
In step S4 of the tripartite protocol, if the above key is selected as the test key, the key is detected to be different and discarded. If the test key is not selected so that the key cannot be detected to be different, Eve cannot independently determine the key in the final key $K$.
(ii) If Eve encrypts the same information in three encoding operations, the participants negotiate the key after three rounds of communication.
$$ K = {x_{Θ A}} + {x_{Θ E}} + {x_{Θ C}}\,. $$
It can also be seen that Eve cannot determine the key independently. At this time, the keys obtained by the participating parties of the agreement are the same, so Eve is not considered to be an attacker. Therefore, the protocol can defend against individual attacks and ensure that information is not eavesdropped.
4.2 Collusion Attacks
Suppose Bob and Charlie conduct a collusion attack that was not detected in the eavesdropping test. After Bob receives the quantum state after Alice encryption, he can only measure the quantum state after adding the translation operation and cannot directly get Alice's secret information. Moreover, the quantum state collapses as soon as it is measured. Eventually Alice discovered the existence of the eavesdropper. Assuming the encoded secret information $x_{Θ B'}$ sent by Bob, Charlie encodes the secret information $x_{Θ C'}$. After three rounds of communication, the participants negotiate
$$ K = x_{Θ A} + x_{Θ B'}+ x_{Θ C'}\,. $$
It can be seen that Bob and Charlie can not conspire to decide the key. Therefore, the agreement can resist collusion attacks and ensure that information is not eavesdropped.
4.3 Intercepting Resend Attacks
Intercepting retransmission attacks refers to the attacker Eve intercepting the quantum state in the channel, re-manufacturing a suitable quantum state according to the information of the measured measurement results and sending it to the next party.[15] However, the quantum non-cloning theorem states that the process of completely identical replication of any unknown quantum state in quantum mechanics is not achievable. Each participant performs a spoofing operation after encoding its own information in the quantum state. Although Eve intercepts the quantum state, the next party receives the quantum state sent by the eavesdropper and measures the amplitude or phase to find the eavesdropper's existence and interrupt the communication. The deceptive information will not be published, so Eve cannot recover the secret information. Therefore, the protocol can resist interception retransmission attacks and ensure that information is not eavesdropped.
4.4 Beam Splitting Attack
The schematic diagram of beam splitting attack is shown in Fig. 2. Taking the communication between Alice and Bob as an example, the security situation in the case of $r<0$ is discussed. When $r>0$, the situation is similar. Let the channel transmission efficiency be ${\eta }$, the channel loss is caused by eavesdropping or the attenuation of the channel itself. The additive vacuum noise at Alice end is ${\chi _0} = ({{1 - \eta }})/{\eta }$, and the total additional noise $\chi = {\chi _0} + \varepsilon $. The signal sent by Alice is attenuated by $1-{\eta }$ on the $X$ component, and the total signal variance on the $X$ component of the signal arriving at Bob is[14]
$$ {N_1}{V_0} = \eta ( {{e^{ - 2{r}}}{V_0} + {N_{{x_{Θ A}}}}{V_0} + \chi {V_0} + {V_0}} )\,. $$
The total noise includes additional noise and channel additive vacuum noise. The total noise variance on the $X$ component of the signal arriving at Bob is
$$ N'_1V_0 = \chi {V_0} + {V_0}\,. $$
According to Shannon Information Theory, the mutual information between Alice and Bob is
$$ {I_{AB}} =\frac{1}{2}\log_2\Big(1 + \frac{{{N_1}{V_0}}}{{N'_1{V_0}}}\Big)\\= \frac{1}{2}\log_2\frac{{\eta ({e^{- 2{r}}} + {N_{{x_{Θ A}}}}) + 2(1 + \chi )}}{{1 + \chi }}\,. $$
When the channel attenuation ${\eta }<1$, the best attack mode for the eavesdropper is to intercept only a part of the signal, and at most steal the $1-{\eta }$ of the beam, so that the remaining part of the signal is transmitted to Bob without interference. The existence of an eavesdropper can be undetected.[17]
Fig. 2 Schematic diagram of beam splitting attack. |
Eve sets the splitter's splitting ratio $k$ to ${\eta }$ to achieve a higher attack effect, while replacing the Eve to Bob channel with a non-attenuating channel.[18] The extra noise of Eve is ${\chi ^{ - 1}}$, and the signal variance that he can steal is
$$ {N_E}{V_0} = ( {1 - \eta } )( {{e^{ - 2{r}}}{V_0} + {N_{{x_{Θ A}}}}{V_0}} )\,. $$
The noise variance is
$$ N'_1{V_0} = {\chi ^{ - 1}}{V_0} + {V_0}\,. $$
The secret information Eve can get is
$$ {I_{AE}} = \frac{1}{2}\log_2\Big(1 + \frac{{{N_E}{V_0}}}{{N'_E{V_0}}}\Big)\\\ = \frac{1}{2}\log_2\Big[1 + \frac{{(1 - \eta )({e^{ - 2{r}}} + {N_{{x_{Θ A}}}})}}{{1 + {\chi ^{ - 1}}}}\Big]\,. $$
After the two parties communicated through negotiation and confidentiality, the maximum amount of information that can be consistent with each other is
$$ \Delta I ={I_{AB}} - {I_{AE}}\\\ =\frac{1}{2}\log_2\frac{{2(1 + \chi ) + \eta ({e^{ - 2{r}}} + {N_{{x_{Θ A}}}})}}{{1 + \chi + \chi (1 - \eta )({e^{ - 2{r}}} + {N_{{x_{Θ A}}}})}}\,. $$
For a given parameter $r$, a security key can be obtained as long as ${\eta }$, $\varepsilon $, and ${N_{{x_{Θ A}}}}$ satisfy certain conditions to ensure $\Delta I > 0$. \par
4.5 Trojan Horse Attack
Trojan horse attacks can be caused by defects in the system structure. The attacker gains information by using the Trojan horse hidden in the system to destroy the system. Yu et al.[19] pointed out that because any optical component in the system has reflected light, an attacker can obtain information by analyzing the reflected light of a modulation component (such as a phase modulator or a polarization modulator), thereby obtaining a secret by using a simple interception retransmission attack. Gisin et al.[20] pointed out how eavesdroppers in the QKD system obtain information about shared keys with Trojan horse attacks. The multiparty QKA protocol proposed in this paper may have Trojan horse attacks because the particles are transmitted multiple times in the channel. If each participant installs a wavelength quantum filter and a photon number splitter, the protocol can be guaranteed to resist Trojan horse attacks.[21-22] Among them, the wavelength quantum filter can filter invisible photons,[23] and the photon number splitter can find delayed photons. PNS is usually replaced by photon beam splitter (PBS:50/50) due to the limitations of existing technologies.
5 Summary
This paper designs and analyzes a three-party quantum key agreement protocol based on continuous variable single-mode squeezed states. The shared key is obtained by each party by measuring and comparing the remaining three-party secret coded quantum states and original quantum states. The security of the protocol is guaranteed by a random spoofing translation operation. Security analysis shows that the protocol is resistant to internal participant attacks and external eavesdropper attacks. The single-mode squeezed states used in the scheme is simple to make. The parties to the agreement are simultaneously implemented, with high efficiency and high feasibility. In addition, the protocol can be extended to the n-party for key negotiation, which has practical significance for the development and application of quantum key agreement.