1 Introduction

After the first quantum cryptography protocol was proposed by Bennett and Brassard [1] in 1984, quantum cryptography quickly aroused the interests of researchers due to its unconditional security and has already obtained a considerable development. Up to now, various kinds of quantum cryptography protocols have been constructed, such as quantum key distribution (QKD) [1,2,3], quantum secret sharing (QSS) [4,5,6], quantum secure direct communication (QSDC) [7,8,9] and so on.

In 2009, Yang and Wen [10] put forward a novel concept for quantum cryptography named quantum private comparison (QPC), which can be used to determine whether two parties’ private inputs are equal or not on the basis that their genuine contents are not leaked out. Since the first two-party QPC protocol was proposed by Yang et al. [10], quantum private comparison has been intensively studied so that numerous two-party QPC protocols have been suggested, such as those with single particles [11], product states [12, 13], Bell states [10, 14,15,16,17,18], GHZ states [19,20,21], W states [22, 23], cluster states [24, 25], χ-type entangled states [26,27,28], five-particle entangled states [29], six-particle entangled states [30]. Besides the two-party QPC, multi-party QPC has also aroused researchers’ interests so that several good multi-party QPC protocols [31,32,33,34,35,36,37] have been constructed.

In 1997, Lo [38] found out that it is impossible to evaluate the equality function securely in a two-party scenario. Therefore, all the above QPC protocols [10, 37] need to employ a third party (TP). As the role of TP, there are three different definitions. Zhang et al. [18] explained these roles as follows: (1) TP is honest. In this situation, the users only need to send their encrypted private information to TP, then TP compares the decrypted private information and announces the comparison result. However, this situation is too perfect to be impractical. (2) TP is dishonest. In this situation, the users cannot trust TP any more. This situation is useless. (3) TP is semi-honest. There are two kinds of definition here. The first one is first introduced by Chen et al. [19], which means that TP executes the protocol loyally and keeps a record of all its intermediate computations and might try to steal the users’ private information from the record, but cannot be corrupted by the adversary. The second one is introduced by Yang et al. [17], which means that TP is allowed to misbehave on his own but cannot conspire with the adversary. Up to now, the second kind definition of semi-honest TP is thought to be the most reasonable.

Based on the above analysis, similar to the QPC protocols of Refs. [26,27,28], in this paper, we suggest a novel QPC protocol with a semi-honest TP also using χ-type entangled states as the quantum resource. The proposed protocol adopts Yang et al. ’s [17] definition for semi-honest TP, who can only know the comparison result of the private information from two parties.

The rest of this paper is organized as follows: in Section 2, a novel QPC protocol with χ-type entangled states is suggested; in Section 3, its correctness and security are investigated; finally, discussion and conclusion are given in Section 4.

2 The Proposed QPC Protocol

Assume that one user named Alice has a secret X and the other user named Bob has a secret Y, where \(X=\sum \limits _{j=0}^{N-1} {x_{j}} 2^{j}\), \(Y=\sum \limits _{j=0}^{N-1} {y_{j}} 2^{j}\) and \(x_{j}, y_{j} \in \left \{ {0,1} \right \}\). They want to determine whether X and Y are equal or not with the help of a semi-honest TP, who is allowed to misbehave on his own but cannot conspire with the adversary. Similar to the QPC protocols of Refs. [26,27,28], the proposed protocol also uses the χ-type entangled states as the quantum resource, which are defined as

$$\begin{array}{@{}rcl@{}} \left| \right.\chi \left. \right\rangle_{1234} &=& \frac{\sqrt 2} {4}\left( \left| \right.0000\left. \right\rangle -\left| \right.0101\left. \right\rangle +\left| \right.0011\left. \right\rangle +\left| \right.0110\left. \right\rangle +\left| \right.\left. {1001} \right\rangle +\left| \right.1010\left. \right\rangle\right.\\ &&\left.+\left| \right.1100\left. \right\rangle-\left| \right.1111\left. \right\rangle \right)_{1234}\\ &=&\frac{1}{2}\left( {\left| \right.\varphi^{+}\left. \right\rangle \left| \right.00\left. \right\rangle +\left| \right.\varphi^{-}\left. \right\rangle \left| \right.11\left. \right\rangle -\left| \right.\psi^{-}\left. \right\rangle \left| \right.01\left. \right\rangle +\left| \right.\psi^{+}\left. \right\rangle \left| \right.10\left. \right\rangle} \right)_{1234}\\ &=&\frac{1}{2}\left( {\left| \right.00\left. \right\rangle \left| \right.\varphi^{+}\left. \right\rangle +\left| \right.11\left. \right\rangle \left| \right.\varphi^{-}\left. \right\rangle -\left| \right.01\left. \right\rangle \left| \right.\psi^{-}\left. \right\rangle +\left| \right.10\left. \right\rangle \left| \right.\psi^{+}\left. \right\rangle} \right)_{1234} \end{array} $$
(1)

Here, \(\left | \right .\varphi ^{\pm } \left . \right \rangle =\frac {1}{\sqrt 2} \left ({\left | \right .00\left . \right \rangle \pm \left | \right .11\left . \right \rangle } \right )\) and \(\left | \right .\psi ^{\pm } \left . \right \rangle =\frac {1}{\sqrt 2} \left ({\left | \right .01\left . \right \rangle \pm \left | \right .10\left . \right \rangle } \right )\) are four Bell states. There parties, Alice, Bob and TP, agree that \(\left | \right .\varphi ^{+}\left . \right \rangle \) and \(\left | \right .00\left . \right \rangle \) represent information 00; \(\left | \right .\varphi ^{-}\left . \right \rangle \) and \(\left | \right .11\left . \right \rangle \) represent information 11; \(\left | \right .\psi ^{-}\left . \right \rangle \)and \(\left | \right .01\left . \right \rangle \) represent information 01; and \(\left | \right .\psi ^{+}\left . \right \rangle \) and \(\left | \right .10\left . \right \rangle \) represent information 10.

Suppose that Alice and Bob establish one common binary key sequence K A B with length of \(\left \lceil {N/2} \right \rceil \)between them through one of the good QKD protocols [1,2,3] beforehand. Similarly, Alice and TP (Bob and TP) also share one common binary key sequence K A T (K B T ) with length of \(\left \lceil {N/2} \right \rceil \) between them.

The proposed protocol is consisted of the following steps:

Step 1

Alice (Bob) divides her (his) binary representation of X (Y ) into \(\left \lceil {N/2} \right \rceil \) groups \({G_{A}^{1}} ,{G_{A}^{2}} ,\mathellipsis ,G_{A}^{\left \lceil {N/2} \right \rceil } \) \(\left ({G_{B}^{1}} ,{G_{B}^{2}},\mathellipsis ,G_{B}^{\left \lceil {N/2} \right \rceil } \right )\), where each group contains two binary bits. If N mod 2 = 1, Alice (Bob) adds one 0 to \(G_{A}^{\left \lceil {N/2} \right \rceil } \left (G_{B}^{\left \lceil {N/2} \right \rceil }\right )\) .

Step 2

TP prepares \(\left \lceil {N/2} \right \rceil \chi \)-type entangled states shown in formula (1). Then, he arranges these χ-type entangled states into one sequence

$$ \left[ {P_{a_{1}}^{1} P_{a_{2}}^{1} P_{b_{1}}^{1} P_{b_{2}}^{1} ,P_{a_{1}}^{2} P_{a_{2}}^{2} P_{b_{1}}^{2} P_{b_{2}}^{2} ,\mathellipsis ,P_{a_{1}}^{\left\lceil {N/2} \right\rceil} P_{a_{2}}^{\left\lceil {N/2} \right\rceil} P_{b_{1}}^{\left\lceil {N/2} \right\rceil} P_{b_{2}}^{\left\lceil {N/2} \right\rceil} } \right] $$
(2)

(hereafter called sequence P), where the subscripts a 1,a 2,b 1,b 2 represent four particles in one χ-type entangled state and the superscripts \(1,2,\mathellipsis ,\left \lceil {N/2} \right \rceil \) indicate the χ-type entangled states in the sequence.

TP takes particles a 1 and a 2 from each χ-type entangled state in P to form an ordered particle sequence P A , i.e.,

$$ P_{A} =\left[ {P_{a_{1}}^{1} P_{a_{2}}^{1} ,P_{a_{1}}^{2} P_{a_{2}}^{2} ,\mathellipsis ,P_{a_{1}}^{\left\lceil {N/2} \right\rceil} P_{a_{2}}^{\left\lceil {N/2} \right\rceil} } \right]. $$
(3)

TP picks particles b 1 and b 2 from each χ-type entangled state in P to form an ordered particle sequence P B , i.e.,

$$ P_{B} =\left[ {P_{b_{1}}^{1} P_{b_{2}}^{1} ,P_{b_{1}}^{2} P_{b_{2}}^{2} ,\mathellipsis ,P_{b_{1}}^{\left\lceil {N/2} \right\rceil} P_{b_{2}}^{\left\lceil {N/2} \right\rceil}} \right]. $$
(4)

TP prepares two decoy photon sequences randomly in one of the four states \(\left \{ {\left | \right .0\left . \right \rangle ,\left | \right .1\left . \right \rangle ,\left | \right .+\left . \right \rangle ,\left | \right .-\left . \right \rangle } \right \}\), and randomly inserts them into P A and P B , respectively. The two new sequences are represented as P A′ and P B′, respectively. Here, \(\left | \right .\pm \left . \right \rangle =\frac {1}{\sqrt 2} \left ({\left | \right .0\left . \right \rangle \pm \left | \right .1\left . \right \rangle } \right )\). Then, TP sends \(P_{A}^{\prime }\left (P_{B}^{\prime }\right )\) to Alice (Bob).

After receiving \(P_{A}^{\prime } \left (P_{B}^{\prime }\right )\), Alice (Bob) performs the security check with TP. TP informs Alice (Bob) of the inserted positions and the preparation bases of decoy photons in \(P_{A}^{\prime } \left (P_{B}^{\prime }\right )\). Then, Alice (Bob) measures the decoy photons in P A′(P B′) with TP’s preparation base and informs TP of her (his) measurement results. By comparing the prepared states of decoy photons in P A′(P B′) with Alice’s (Bob’s) measurement results, TP can determine whether the transmission of \(P_{A}^{\prime } \left (P_{B}^{\prime } \right )\) was eavesdropped or not. If the error rate is smaller than the threshold, Alice and Bob go on the next step; otherwise, the protocol is terminated.

Step 3

Alice (Bob) discards the decoy photons in \(P_{A}^{\prime } \left (P_{B}^{\prime }\right )\) to get P A (P B ). Alice performs Bell basis measurement on particles P a 1 i and P a 2 i and obtains the measurement result M A i. If P a 1 i P a 2 i is \(\left | \right .\varphi ^{+}\left . \right \rangle \)/\(\left | \right .\varphi ^{-}\left . \right \rangle \)/\(\left | \right .\psi ^{-}\left . \right \rangle \)/ \(\left | \right .\psi ^{+}\left . \right \rangle \), then M A i is 00 /11 /01 /10. Here, \(\left \{ {\left | \right .\varphi ^{\pm } \left . \right \rangle ,\left | \right .\psi ^{\pm } \left . \right \rangle } \right \}\) is the Bell basis and \(i\in \left \{ {1,2,\mathellipsis ,\left \lceil {N/2} \right \rceil } \right \}\).

In the meanwhile, Bob performs Z basis measurement on particles P b 1 i and P b 2 i to obtain the measurement result M B i. If P b 1 i P b 2 i is \(\left | \right .00\left . \right \rangle \)/\(\left | \right .01\left . \right \rangle \)/\(\left | \right .10\left . \right \rangle \)/\(\left | \right .11\left . \right \rangle \), then M B i is 00 /01 /10 /11. Here, \(\left \{ {\left | \right .0\left . \right \rangle ,\left | \right .1\left .\right \rangle } \right \}\) is the Z basis and \(i\in \left \{ {1,2,\mathellipsis ,\left \lceil {N/2} \right \rceil }\right \}\).

Afterward, Alice (Bob) computes R A i = G A i ⊕ M A i ⊕ K A T i ⊕ K A B i \(\left ({R_{B}^{i}} ={G_{B}^{i}} \oplus {M_{B}^{i}} \oplus K_{BT}^{i} \oplus K_{AB}^{i} \right )\), where \(i\in \left \{ {1,2,\mathellipsis ,\left \lceil {N/2} \right \rceil } \right \}\). Finally, Alice (Bob) publishes R A (R B ) to TP, where \(R_{A} =\left [ {{R_{A}^{1}} ,{R_{A}^{2}} ,\mathellipsis ,R_{A}^{\left \lceil {N/2} \right \rceil } } \right ]\left (R_{B} =\left [ {{R_{B}^{1}} ,{R_{B}^{2}} ,\mathellipsis ,R_{B}^{\left \lceil {N/2} \right \rceil } } \right ]\right )\).

Step 4

After receiving R A and R B , TP computes R i = R A i ⊕ R B i ⊕ K A T i ⊕ K B T i. If TP finds out that there is an i where R i≠00, he concludes that X≠Y, and terminates the protocol immediately; otherwise, he concludes that X = Y. Finally, TP informs Alice and Bob of the comparison result.

3 Analysis

3.1 Correctness

In this section, we verify the correctness of the output of the proposed protocol.

In the proposed protocol, Alice and Bob own \(X=\sum \limits _{j=0}^{N-1} {x_{j}} 2^{j}\) and \(Y=\sum \limits _{j=0}^{N-1} {y_{j}} 2^{j}\), respectively. They compare the equality of G A i and G B i with the help of a semi-honest TP. Due to the entanglement correlation of the χ-type entangled state shown in formula (1), it is apparent that M A i ⊕ M B i = 00. Accordingly, we have

$$\begin{array}{@{}rcl@{}} R^{i}&=&{R_{A}^{i}} \oplus {R_{B}^{i}} \oplus K_{AT}^{i} \oplus K_{BT}^{i}\\ &=&\left( {{G_{A}^{i}} \oplus {M_{A}^{i}} \oplus K_{AT}^{i} \oplus K_{AB}^{i}} \right)\\ &&\oplus\left( {{G_{B}^{i}} \oplus {M_{B}^{i}} \oplus K_{BT}^{i} \oplus K_{AB}^{i}} \right)\oplus K_{AT}^{i} \oplus K_{BT}^{i}\\ &=&\left( {{G_{A}^{i}} \oplus {G_{B}^{i}}} \right)\oplus \left( {{M_{A}^{i}} \oplus {M_{B}^{i}}} \right) ={G_{A}^{i}} \oplus {G_{B}^{i}} . \end{array} $$
(5)

According to formula (5), if R i = 00, it can be obtained that G A i = G B i; otherwise, we have G A i≠G B i. Therefore, the output of our protocol is correct.

3.2 Security

In this section, we first consider the outside eavesdropper’s attack, then analyze the participants’ attack.

3.2.1 Outside Attack

We investigate the possibility for an outside eavesdropper to obtain X and Y according to each step of the proposed protocol.

In Step 1, there is not any transmission, so an outside eavesdropper has no opportunity to launch an attack.

In Step 2, TP sends \(P_{A}^{\prime } \left (P_{B}^{\prime }\right )\) to Alice (Bob), so an outside eavesdropper can launch an attack during the transmission of \(P_{A}^{\prime } \left (P_{B}^{\prime }\right )\) . However, the decoy photon technology [39, 40] is used for security check in this step, which can detect some famous attacks, such as the intercept-resend attack, the measure-resend attack, the entangle-measure attack, etc, with non-zero probability, as shown in Refs. [41, 42]. Moreover, since the qubit transmission is in a single-direction way, the Trojan horse attacks including the invisible photon eavesdropping attack [43] and the delay-photon Trojan horse attack [44], are also invalid. It can be concluded that in this step, an outside eavesdropper cannot obtain something useful about X and Y without being discovered.

In Step 3, Alice encrypts G A i with the one-time-pad keys M A i, K A T i and K A B i, which are unknown to an outside eavesdropper. In the meanwhile, Bob encrypts G B i with the one-time-pad keys M B i, K B T i and K A B i, which are also unknown to an outside eavesdropper. It is apparent that an outside eavesdropper cannot get \({G_{A}^{i}} \left ({G_{B}^{i}} \right )\) when Alice (Bob) publishes R A (R B ) to TP in this step, since she has no knowledge about these one-time-pad keys.

To sum up, the proposed protocol can successfully resist the outside attack.

3.2.2 Participant Attack

The term “participant attack” means the kind of attacks from dishonest participants, which is generally more powerful and should be paid more attention to, as first pointed out by Gao et al. [45] in 2007. In the following, we investigate three cases of participant attack in detail.

Case 1: Alice wants to know Bob’s Private Information Y

In Step 3, Alice can deduce Bob’s measurement result of P b 1 i P b 2 i from her own measurement result of P a 1 i P a 2 i through the entanglement correlation of the χ-type entangled state shown in formula (1). Thus, in this step, Alice can know M B i from M A i. Even though Alice may hear R B when Bob publishes it to TP in this step, she still cannot get G B i, because it is encrypted with the one-time-pad key K B T i. It can be concluded that Alice cannot know Bob’s private information Y.

Case 2: Bob wants to know Alice’s Private Information X

In Step 3, Bob can deduce Alice’s measurement result of P a 1 i P a 2 i from his own measurement result of P b 1 i P b 2 i through the entanglement correlation of the χ-type entangled state shown in formula (1). Thus, in this step, Bob can know M A i from M B i. Even though Bob may hear R A when Alice publishes it to TP in this step, he still cannot get G A i, because it is encrypted with the one-time-pad key K A T i. It can be concluded that Bob cannot know Alice’s private information X.

Case 3: TP wants to know Alice’s Private Information X and Bob’s Private Information Y

The semi-honest TP may try his best to obtain Alice’s private information X and Bob’s private informationY.

In Step 3, TP receives R A (R B ) from Alice (Bob). However, even though TP may launch the malicious attacks similar to the ones suggested in Refs. [16,17,18] to obtain \({M_{A}^{i}} \left ({M_{B}^{i}} \right )\), he still cannot get \({G_{A}^{i}} \left ({G_{B}^{i}}\right )\) from \({R_{A}^{i}} \left ({R_{B}^{i}} \right )\), because it is encrypted with the one-time-pad key K A B i. It can be concluded that TP cannot know X and Y.

It needs to be pointed out that TP knows the comparison result of X and Y.

4 Discussion and Conclusion

As all of the proposed protocol and the QPC protocols in Refs. [26,27,28] are based on χ-type entangled states, we compare them in detail, as shown in Table 1, without considering the security check processes. The qubit efficiency η here is defined as \(\eta =\frac {r_{c}} {r_{q}} \), where r c is the number of the compared classical bits, and n q is the number of consumed qubits [6]. In the proposed protocol, one χ-type entangled state can be used to compare two bit of private information from each party, thus its qubit efficiency is 50%.

Table 1 Comparison among the two-party QPC protocols
Full size table

In addition, it is worth pointing out that there is an alternative choice scheme of measurement basis for Alice and Bob. Concretely, in Step 3, Alice (Bob) chooses Z basis (Bell basis) to measure particle \(P_{a_{1}}^{i} P_{a_{2}}^{i} \left (P_{b_{1}}^{i} P_{b_{2}}^{i}\right )\) and gets the measurement result \({M_{A}^{i}} \left ({M_{B}^{i}}\right )\). According to the entanglement correlation of the χ-type entangled state shown in formula (1), this alternative choice scheme of measurement basis also guarantees the correctness of the output of the proposed protocol.

To sum up, in this paper, we propose a two-party QPC protocol with a semi-honest TP by using χ-type entangled states. The proposed protocol needs to perform Bell basis measurements and single-particle measurements rather than χ-type entangled state measurements, and does not need to employ unitary operation and quantum entanglement swapping technology.