1. Introduction
Since Bennett and Brassard proposed the first quantum key distribution (QKD) protocol [1] in 1984, quantum cryptography has attracted the attention of more and more researchers. Many directions of quantum cryptography, such as QKD [1–3], quantum secret sharing [4–6], and quantum authentication [7, 8], etc, have been developed. Quantum key agreement (QKA) [9] is an important branch of quantum cryptography which tries to generate a shared key by two or more players. Unlike QKD, QKA emphasizes fairness, i.e. the shared key of QKA is determined by all players rather than any subset of them. The first QKA protocol was proposed by Zhou et al [9] in 2004. However, their protocol was unfair since one player could fully determine the shared key [10]. In 2010, Chong and Huang proposed a QKA protocol using the delayed measurement technique [11]. In 2013, Shi and Zhong used the entanglement swapping technique to extend the QKA protocol of two players to multi-players, and proposed the first multiparty QKA protocol [12]. But Liu et al [13] pointed out that Shi and Zhong’s QKA protocol was not secure and they proposed a multiparty QKA protocol using single-photons. Subsequently, various two-party and multiparty QKA protocols were proposed [14–21].
Implementations of quantum cryptographic protocols require players to equip quantum devices for preparing, manipulating or measuring quantum states. To simplify the implementation of the conventional QKD, in 2007, Boyer et al proposed the idea of semiquantum key distribution (SQKD) [22] where one player has full quantum capabilities, while the other player Bob is restricted to measure or prepare qubits only in the classical basis (the Z basis). They further proposed two SQKD protocols based on techniques of measurement-resend and randomization [23]. Since then, various SQKD protocols have been proposed based on different quantum resources and techniques [24–32]. Several multiparty SQKD protocols can also be found in [24, 28, 33]. Security proofs of SQKD protocols have been developed in the asymptotic scenario in [28, 31, 34–36]. Besides SQKD, other semiquantum cryptographic protocols, such as semiquantum secret sharing [37–40], semiquantum information splitting [41], and semiquantum secure direct communication [42, 43] have also been studied.
To reduce the requirements of the players for quantum devices, semi-QKA (SQKA) has also been developed. In 2017, Shukla et al proposed a two-party SQKA protocol [44] based on Bell states. Unfortunately, additional quantum devices are required for the classical player Bob since he needs to permutate or reorder his qubits in the SQKA protocol. As is introduced in [45], a possible way for reordering qubits is to use optical delay lines. However, since the storage time of an optical delay line is fixed by the delay length [46], Bob has to set an on-demand delay-time for each line. While a multiparty QKA protocol [47] was proposed based on delegating quantum computation. However, players in the QKA protocol need to prepare four BB84 qubits and store them during the protocol, which means the protocol is not a semiquantum one since classical players have to prepare qubits in two different bases rather than only the classical basis.
We study multiparty SQKA in the paper and propose the first real multiparty SQKA protocols based on single-photons. Our protocols include only one quantum player, while the other players are classical ones who only need to perform states preparations and measurements in the classical basis. Compared with the existing two-party SQKA protocol based on Bell states [44], our protocols cost fewer quantum resources, require no quantum memory for classical players, and are easier to implement using current technologies. Our protocols are real semiquantum ones since classical players only need to measure and prepare classical states, while no reordering or preparing of the other states is required.
The rest of the paper is organized as follows. Our multiparty SQKA protocols are described in section 2 . The symmetric three-party SQKA protocol based on BB84 qubits is described firstly. And the asymmetric three-party SQKA protocol is presented to improve efficiency. We further extend them to the asymmetric multiparty SQKA protocol including one quantum player and an arbitrary number of classical players. The security and fairness of our protocols are analyzed in section 3 . This paper is further discussed and concluded in section 4 .
2. Multiparty SQKA protocols without entanglement
We firstly present two SQKA protocols including three players, i.e. a quantum player Alice who is capable of generating and measuring quantum states in two different bases, and two classical players Bob and Charlie who are restricted to do operations only in the classical basis. Three players can fairly negotiate a secret key. Then we extend these three-party protocols to multiparty one that includes one quantum player and an arbitrary number of classical players.
2.1. Protocol 1: the symmetric three-party SQKA protocol without entanglement
In the symmetric protocol, half of the quantum states are used for security detection, and the others are used for generating and transmitting secret information. The symmetric three-party SQKA protocol runs as follows.
(1) Alice prepares a set of $16N(1+\delta )$ polarized BB84 single-photons, which are chosen randomly from $\{\left|0\right\rangle ,\left|1\right\rangle ,\left|+\right\rangle =\tfrac{1}{\sqrt{2}}(\left|0\right\rangle +\left|1\right\rangle ),\left|-\right\rangle =\tfrac{1}{\sqrt{2}}(\left|0\right\rangle -\left|1\right\rangle )\}\}$, with N is the length of each player’s secret key and δ > 0 is a fixed parameter similar to the original SQKD protocol [22]. She sends half of the qubits to Bob, and the other half to Charlie.
(2) For each of the qubits from Alice, Bob performs the following three actions.
| – REFLECT: with half of the probability, Bob reflects the qubit back to Alice without any change. | |
| – MEASURE-RESEND: with a probability of $\tfrac{3}{8}$, Bob measures the coming qubit in the classical basis and resends the same state back to Alice. His measurement results are denoted as K1, R1, and R2, with the length of the bits strings $| {K}_{1}| \geqslant N$, $| {R}_{1}| \geqslant N$, and $| {R}_{2}| \geqslant N$. | |
| – DISCARD-PREPARE-RESEND: with a probability of $\tfrac{1}{8}$, Bob discards the coming qubit. He prepares a new state in $\{\left|0\right\rangle ,\left|1\right\rangle \}$ according to his secret key KB in the first N position and sends it back to Alice. |
(3) Charlie performs the same three actions as Bob does. Her MEASURE-RESEND action gets measurement results K2 and R3, and R4 with their lengths $| {K}_{2}| ,| {R}_{3}| ,| {R}_{4}| \geqslant N$. Her DISCARD-PREPARE-RESEND action prepares new states in $\{\left|0\right\rangle ,\left|1\right\rangle \}$ according to his secret key KC and sends them back to Alice.
(4) Alice stores all the returning qubits from Bob. Bob publishes his actions on each qubit. Alice performs the following actions according to Bob’s actions.
| – She measures REFLECT qubits in the bases she prepared to check the security of their quantum channel. She compares her measurement results with the initial states. They abort the protocol if the error rate is larger than a pre-defined threshold. | |
| – She measures MEASURE-RESEND qubits in the classical basis. She takes the first N bits of her measurement results as K1 and the following 2N bits as R1 and R2, where K1 will be used by Alice to encrypt KA for Bob, and R1 and R2 by classical players Bob and Charlie to encrypt their KB and KC for each other. | |
| – She measures DISCARD-PREPARE-RESEND qubits in the classical basis. She will get Bob’s secret key KB from the first N bits. |
(5) Similarly, Charlie and Alice check the security of their quantum channel by measuring their REFLECT qubits. If the test passes, Alice measures DISCARD-PREPARE-RESEND qubits to get KC, and measures MEASURE-RESEND qubits to get K2, R3, and R4, where K2 will be used by Alice to encrypt KA for Charlie, and R3 and R4 by Bob and Charlie to encrypt KB and KC.
(6) Alice sends to Bob the value of $({K}_{1}\oplus {K}_{A})| | {h}_{1}({K}_{A})$, where ${h}_{1}(\cdot )$ is a hash function chosen by Bob uniformly from a family of hash functions and announced to Alice over a classical channel. Besides, Alice sends to Charlie the value of $({K}_{2}\oplus {K}_{A})| | {h}_{2}({K}_{A})$, where h2 (·) is chosen by Charlie. Bob and Charlie decode them by using K1 and K2 to get KA, respectively. They also verify whether the hash value is correct or not. They abort if an error occurs.
(7) Alice publishes the value of $({R}_{2}\oplus {R}_{4})| | {h}_{3}({R}_{2}\oplus {R}_{4})$ to Bob, where ${h}_{3}(\cdot )$ a hash function chosen by the Bob. Similarly, Alice publishes $({R}_{1}\oplus {R}_{3})| | {h}_{4}({R}_{1}\oplus {R}_{3})$ to Charlie, where ${h}_{4}(\cdot )$ is chosen by Charlie. Besides, Bob sends ${R}_{1}\oplus {K}_{B}| | {h}_{5}({K}_{B})$ to Charlie, while Charlie sends ${R}_{4}\oplus {K}_{C}| | {h}_{6}({K}_{C})$ to Bob, respectively, where these hash functions are chosen by the receivers.
(8) Bob decodes ${R}_{4}\oplus {K}_{C}$ by using R2 and ${R}_{2}\oplus {R}_{4}$ to get KC, while Charlie decodes ${R}_{1}\oplus {K}_{B}$ by using R3 and ${R}_{1}\oplus {R}_{3}$ to get KB, respectively. They also check whether the key they received is consistent with the corresponding hash value. They continue if there is no error. Since all players have got KA, KB and KC, they calculate the negotiated key as
$\begin{eqnarray}K={K}_{A}\oplus {K}_{B}\oplus {K}_{C}.\end{eqnarray}$
(9) Any two players can cooperatively verify whether the secret key they received is the same or not. For example, suppose Bob has received ${K}_{A}^{{\prime} }$ and Charlie ${K}_{A}^{{\prime\prime} }$, they randomly select a hash function ${h}_{{BC}}(\cdot )$ to verify whether ${h}_{{BC}}({K}_{A}^{{\prime} })\mathop{=}\limits^{?}{h}_{{BC}}({K}_{A}^{{\prime\prime} })$, and they confirm Alice is honest if the answer is positive.
2.2. Protocol 2: the asymmetric three-party SQKA protocol without entanglement
To achieve high efficiency, we simplify our SQKA protocol to an asymmetric one following the idea in [48]. Our asymmetric SQKA protocol is performed as follows.
(1) Alice prepares a set of $(8N+2\tau )(1+\delta )$ polarized BB84 single-photons, where N is the length of the key and τ is the length of the REFLECT qubits used for security detection of two quantum channels. She sends half of the states to Bob, the other half of the states to Charlie.
(2) Bob performs three actions with different probabilities after receiving qubits from Alice.
| – REFLECT: with a probability of $\tfrac{\tau }{4N+\tau }$. | |
| – MEASURE-RESEND: with a probability of $\tfrac{3N}{4N+\tau }$. | |
| – DISCARD-PREPARE-RESEND: with a probability of $\tfrac{N}{4N+\tau }$. |
Steps (3)–(9) are the same as our SQKA Protocol 1.
2.3. Protocol 3: the asymmetric multiparty SQKA protocol without entanglement
We further extend our SQKA to the most general (M + 1)-party SQKA protocol that includes one quantum player Alice and M classical players Bob1, Bob2, ⋯, BobM who want to negotiate a secret key with the length of N. Our multiparty SQKA protocol runs as follows.
(1) Alice prepares a set of $M[2N(M-1)\,+2N+\tau ](1+\delta )$ BB84 single-photons, where N is the length of the key and τ is the length of the REFLECT qubits used for security detection. She sends $[2N(M-1)+2N\,+\tau ](1+\delta )$ of these states to Bobi for i = 1 to M.
(2) Each Bobi performs three actions with different probabilities after receiving qubits from Alice.
| – REFLECT: with a probability of $\tfrac{\tau }{2N(M-1)+2N+\tau }$, Bobi reflects the qubit back to Alice. | |
| – MEASURE-RESEND: with a probability of $\tfrac{2N(M-1)+N}{2N(M-1)+2N+\tau }$, Bobi measures the coming qubit in the classical basis and resends the same state back to Alice. Their measurement results are denoted as Ki with $| {K}_{i}| \geqslant N$, and a set of (M − 1) bits strings ${R}_{1}^{(i)},{R}_{2}^{(i)},\cdots ,{R}_{j}^{(i)},\cdots ,{R}_{M}^{(i)}$ with $j\in [1,M]$, $j\ne i$ and $| {R}_{j}^{(i)}| \geqslant 2N$. Similar to Protocol 1, Ki will be used by Alice to encrypt KA to Bobi, while ${R}_{j}^{(i)}$ will be used by classical players to securely exchange their keys with other classical players. | |
| – DISCARD-PREPARE-RESEND: with a probability of $\tfrac{N}{2N(M-1)+2N+\tau }$, Bobi discards the coming qubit and prepares a new state in $\{\left|0\right\rangle ,\left|1\right\rangle \}$ according to his secret key ${K}_{{B}_{i}}$ and sends it back to Alice. |
(3) Alice stores all the returning qubits from Bobi. Bobi publishes his actions on each qubit. For each qubit from Bobi, Alice performs the following actions.
| – She measures REFLECT qubits to check the security of their quantum channel. | |
| – She measures MEASURE-RESEND qubits in the classical basis. Alice takes the first N bits as Ki. She takes following 2N bits as ${R}_{j}^{(i)}$ for j = 1 to M and $j\ne i$. | |
| – She measures DISCARD-PREPARE-RESEND qubits in the classical basis and gets Bobi's secret key ${K}_{{B}_{i}}$ from the first N bits. |
(4) Alice sends to each Bobi the value of ${K}_{i}\oplus {K}_{A}| | {h}_{i}({K}_{A})$ where ${h}_{i}(\cdot )$ is chosen by Bobi. Bobi decodes it by using Ki to get KA. He continues if the hash value is correct.
(5) Let the first N bits of ${R}_{j}^{(i)}$ be $R{1}_{j}^{(i)}$, and the last N bits be $R{2}_{j}^{(i)}$, i.e., ${R}_{j}^{(i)}=R{1}_{j}^{(i)}| | R{2}_{j}^{(i)}$ with $| R{1}_{j}^{(i)}| =| R{2}_{j}^{(i)}| =N$. Alice publishes the value of ${R}_{j}^{(i)}\oplus {R}_{i}^{(j)}| | {h}_{{ij}}({R}_{j}^{(i)}\oplus {R}_{i}^{(j)})$ for all $i,j\in [1,N]$ and $i\ne j$, where ${h}_{{ij}}(\cdot )$ is chosen by Bobi. Each Bobi encodes his private key as ${K}_{{B}_{i}}\oplus R{1}_{j}^{(i)}$ if i < j, as ${K}_{{B}_{i}}\oplus R{2}_{j}^{(i)}$ if i > j. He sends the encoded information and the hash value ${h}_{j}^{{\prime} }(\cdot )$ to Bobj, where ${h}_{j}^{{\prime} }(\cdot )$ is chosen by Bobj.
(6) Each Bobj decodes the other classical players ${K}_{{B}_{i}}$ by calculating
$\begin{eqnarray}\begin{array}{l}{K}_{{B}_{i}}\oplus R{1}_{j}^{(i)}\oplus {\rm{substring}}({R}_{j}^{(i)}\oplus {R}_{i}^{(j)}\\ \quad \oplus \,{R}_{i}^{(j)},1,N)={K}_{{B}_{i}},\,\,\mathrm{if}\,i\lt j,\\ {K}_{{B}_{i}}\oplus R{2}_{j}^{(i)}\oplus {\rm{substring}}({R}_{j}^{(i)}\oplus {R}_{i}^{(j)}\\ \quad \oplus \,{R}_{i}^{(j)},N+1,2N)={K}_{{B}_{i}},\,\,\mathrm{if}\,i\gt j,\end{array}\end{eqnarray}$
where substring(target, start, end) returns the substring of the ‘target’ between the ‘start’ and ‘end’ indexes. They also check whether each hash value they received is correct or not. They abort is one of ${h}_{{ij}}(\cdot )$ or ${h}_{j}^{{\prime} }(\cdot )$ is not consistent with the message they received.(7) Since all players have got KA and all ${K}_{{B}_{i}}$, they calculate the negotiated key as
$\begin{eqnarray}K={K}_{A}\oplus \underset{i=1}{\overset{M}{\displaystyle \bigoplus }}{K}_{{B}_{i}}.\end{eqnarray}$
(8) Similar to our three-party SQKA protocols, a majority of players can cooperatively verify the honesty of the other players by performing a public discussion on the integrity of ${K}_{{B}_{i}}$ they have got, and they should select a different hash function for each ${K}_{{B}_{i}}$.
3. Security
3.1. Security of quantum channels
There are two-way quantum channels between the quantum player and each of the classical players in our SQKA protocols. Similar to previous results of SQKD [22], the quantum bit error rate (QBER) on REFLECT qubits has been tested to detect the attack on these two-way quantum channels. According to the security proof works in [28, 31, 34–36], the security of our two-way quantum channels can be guaranteed if the QBER obtained by Alice is below a pre-defined threshold. For the Trojan horse attack [49] on quantum channels, wavelength filters can be placed on classical players’ sides before qubits reach their laboratory to effectively resist the Trojan horse attack.
3.2. Security of player’s private keys
In our three-party protocols, K1 and K2 are used to encode Alice’s private key KA before sending them to Bob and Charlie, respectively. Besides, Bob’s KB is encrypted by R1 and Charlie’s KC is encrypted by R4. While Bob decrypts KC by using R3, and Charlie decrypts KB by using R2. Since K1, K2, R1, R2, R3, and R4 are randomly generated session keys and have been used just once, they can keep the secrecy of players’ private keys. And publications of ${R}_{1}\oplus {R}_{2}$ and ${R}_{3}\oplus {R}_{4}$ will not leak information of session keys.
For our multiparty SQKA protocol, each Bobi uses a set of M − 1 session keys $\{{R}_{j}^{(i)}\}$ for encryption of his private key ${K}_{{B}_{i}}$ that will be sent to Bobj. Bobi uses the first N bits if i < j, while he uses the last N bits if i > j. That is, the bidirectional communications between Bobi and Bobj consume two different session keys for encryption of ${K}_{{B}_{i}}$ to Bobj and ${K}_{{B}_{j}}$ to Bobi. The session keys used among classical players can be represented in a matrix form as follows
$\begin{eqnarray}\left(\begin{array}{ccccc}- & {R}_{2}^{(1)} & {R}_{3}^{(1)} & \cdots & {R}_{M}^{(1)}\\ {R}_{1}^{(2)} & - & {R}_{3}^{(2)} & \cdots & {R}_{M}^{(2)}\\ {R}_{1}^{(3)} & {R}_{2}^{(3)} & - & \cdots & {R}_{M}^{(3)}\\ \vdots & \vdots & \vdots & \ddots & \vdots \\ {R}_{1}^{(M)} & {R}_{2}^{(M)} & {R}_{3}^{(M)} & \cdots & -\end{array}\right),\end{eqnarray}$
where two symmetrical elements ${R}_{j}^{(i)}$ and ${R}_{i}^{(j)}$ are used for encryption of ${K}_{{B}_{i}}$ to Bobj and ${K}_{{B}_{j}}$ to Bobi, similar to the usage of ${R}_{1}| | {R}_{2}$ and ${R}_{3}| | {R}_{4}$ in our three-party protocols.3.3. Fairness against dishonest players
To prevent dishonest players from announcing wrong keys to undermine the fairness, a set of universal hash functions are used to guarantee the integrity of the secret keys from each players, i.e. each secret key (KA or KB) or session key (R) can not be modified intentionally after it has been sent to others. A multiparty SQKA protocol assumes that the number of honest players should be the majority, i.e. at least half of the players are honest in our protocols. Otherwise, they can not negotiate an agreed key among them.
We firstly discuss the fairness of our three-party SQKA protocols. Note that the quantum Alice is more powerful than the other classical players since she controls session keys among classical players. Dishonest Alice might try to fully control the negotiated key without the participation of classical Bob and Charlie. For example, suppose Alice sets $({R}_{1}\oplus {R}_{3})^{\prime} \,={R}_{1}\oplus {R}_{3}\oplus {K}_{C}$, Charlie will decode Bob’s secret key as ${K}_{B}^{{\prime} }\,={K}_{B}\oplus {K}_{C}$. If Alice publishes $({K}_{1}\oplus {K}_{A})^{\prime} ={K}_{1}\oplus {K}_{A}\oplus {K}_{B}$, Charlie will decode Alice’s secret key ${K}_{A}^{{\prime} }={K}_{A}\oplus {K}_{B}$, which implies that Charlie’s agreed key becomes $K^{\prime} \,={K}_{A}^{{\prime} }\oplus {K}_{B}^{{\prime} }\oplus {K}_{C}={K}_{A}\oplus {K}_{B}\oplus {K}_{B}\oplus {K}_{C}\oplus {K}_{C}={K}_{A}$. Similarly, if Alice sets $({R}_{2}\oplus {R}_{4})^{\prime\prime} ={R}_{2}\oplus {R}_{4}\oplus {K}_{B}$ and $({K}_{2}\oplus {K}_{A})^{\prime\prime} ={K}_{2}\oplus {K}_{A}\oplus {K}_{C}$, Bob will decode Charlie’s secret key as ${K}_{C}^{{\prime\prime} }={K}_{B}\oplus {K}_{C}$, and Alice’s as ${K}_{A}^{{\prime\prime} }={K}_{A}\oplus {K}_{C}$. Subsequently, Bob’s agreed key becomes $K^{\prime\prime} \,={K}_{A}^{{\prime\prime} }\oplus {K}_{B}\oplus {K}_{C}^{{\prime\prime} }={K}_{A}\oplus {K}_{C}\oplus {K}_{B}\oplus {K}_{B}\oplus {K}_{C}={K}_{A}$. In this case, the agreed key is fully decided by Alice.
To prevent Alice from sending wrong information (KA, ${R}_{1}\oplus {R}_{3}$, and ${R}_{2}\oplus {R}_{4}$) to classical players, Bob and Charlie can perform the verification as follows. Bob and Charlie first check the integrity of KA. They calculate the key he (she) received as ${K}_{A}^{{\prime} }$ (${K}_{A}^{{\prime\prime} }$), then they check whether their hash values are the same by comparing ${h}_{1}({K}_{A})\mathop{=}\limits^{?}{h}_{1}({K}_{A}^{{\prime} })$ and ${h}_{2}({K}_{A})\mathop{=}\limits^{?}{h}_{2}({K}_{A}^{{\prime\prime} })$, respectively. Secondly, Bob calculates ${R}_{4}^{{\prime} }=({R}_{2}\oplus {R}_{4})^{\prime} \oplus {R}_{2}$, and checks whether ${h}_{3}({R}_{2}\oplus {R}_{4})\,\mathop{=}\limits^{?}{h}_{3}({R}_{2}\oplus {R}_{4}^{{\prime} })$. Similarly, Charlie calculates ${R}_{1}^{{\prime} }=({R}_{1}\,\oplus {R}_{3})^{\prime} \oplus {R}_{3}$, and checks whether ${h}_{4}({R}_{1}\oplus {R}_{3})\mathop{=}\limits^{?}{h}_{4}({R}_{1}^{{\prime} }\oplus {R}_{3})$. On the other hand, a dishonest classical player might send different players with different keys. To defeat this kind of attack, the other two players can work together to compare their keys by using a family of universal hash functions, as is shown in step (9) of Protocol 1.
For our multiparty SQKA protocol, a majority of players can cooperate to verify the other players’ honesty in a similar way to guarantee the fairness of the protocol.
4. Discussions and conclusions
The qubits efficiencies of our SQKA protocols are presented in table 1, where Protocol 3 is the (M + 1)-party asymmetric SQKA protocol that includes one quantum player and M classical players. The qubits efficiency is defined as $\eta =\tfrac{s}{q+c}$ [50], where s is the length of the agreed key by the legitimate players, q is the number of qubits transmitted, and c is the number of classical bits needed. Note that the qubits efficiencies are calculated in the scenario without considering hash functions. For honest verification, the number of universal hash functions used are 9, 9, and M(M + 2) + 1 for Protocols 1, 2, and 3, respectively. As is shown, the communication efficiencies of our SQKA protocols are around O(M2) where M is the number of the classical players and $O(\cdot )$ is ‘big-O’ notation used in the communication complexity theory.
Table 1. Qubits efficiencies of our SQKA protocols, where M is the number of classical players, N is the length of each player’s secret key, and τ is the length of the REFLECT qubits used for security detection. |
| Protocol 1 | Protocol 2 | Protocol 3 | |
|---|---|---|---|
| Key length: s | N | N | N |
| Qubits costs: q | 32N | 16N + 4τ | $4{M}^{2}N+2M\tau $ |
| Classical costs: c | 22N | 14N + 2τ | $4{M}^{2}N-{MN}+M\tau $ |
| Efficiency: η | $\approx \tfrac{1}{54}$ | $\approx \tfrac{N}{30N+6\tau }$ | $\approx \tfrac{N}{8{M}^{2}N-{MN}+3M\tau }$ |
As is shown in table 2, our protocols have fewer quantum requirements for classical players since they only need the ability to measure or prepare in the classical basis. While the existing SQKA protocol [44] needs the ability of reordering qubits for the classical player. The classical player in [44] needs to perform qubits permutations, which implies he has to delay or store quantum states for the implementation of a permutation. Besides, our SQKA protocols use single-photons as message carriers rather than entanglements in [44]. All of which means our protocols are easier to implement than the previous one.
Table 2. Comparisons of quantum requirements in our SQKA protocols and the SQKA protocol in [44], where M is the number of classical players and ‘RQ’ represents reordering qubits. |
| [44] | Protocol 1 | Protocol 2 | Protocol 3 | |
|---|---|---|---|---|
| Number of players | 2 | 3 | 3 | $M+1\geqslant 3$ |
| Quantum states | Bell states | single-photons | single-photons | single-photons |
| RQ for classical players | Yes | No | No | No |
In conclusion, we have proposed a set of real multiparty SQKA protocols that require fewer quantum resources than the previous one, especially for classical players, while without the requirement of entanglement, all of which make them easier to implement. Our SQKA protocols include only one quantum player, which the others are classical. We first present a symmetric three-party SQKA protocol where qubits used for the quantum channel detection and the message carriage are the same. Then, we modify the protocol to an asymmetric one where fewer qubits are required for quantum channels detections, while security can still hold [48, 51]. And we further extend the asymmetric SQKA protocol to the most general one where an arbitrary number of classical players are included. The analysis shows that our protocols are secure against external eavesdroppers and are fair against a minority of internal dishonest players.