1 Introduction

With the advent of fast quantum algorithms [1, 2], quantum computations and quantum communications have received extensive attention and gained lots of promising achievements, such as quantum cryptography [3], quantum teleportation [4] and quantum secret sharing [5]. However, in 1997, Lo [6] pointed unconditional secure one-sided two-party computation is impossible. Later in 2007, Colbeck [7] further showed that unconditional secure two-sided two-party computation is impossible yet. Recently, Buhrman et al. [8] systematically proved that unconditional secure classical two-party computation is impossible.

Furthermore, the research results show that quantum protocols still can provide a higher security than the corresponding classical protocols, e.g., quantum protocols for Oblivious Set-member Decision [9] and Private Set Intersection Cardinality [10]. Therefore, how to construct and implement quantum protocols for special two-party classical computations has always been the research focus in recent years.

Secure scalar product is an important primitive of secure multi-party computation, which can usually be used as a building block for many complicated cryptographic protocols, such as private comparison, secret sharing, secure function evaluation, privacy-preserving computational geometry, etc. Let Alice has a vector X = (x1, x2, …, xm) and Bob has a vector Y = (y1, y2, …, ym), where all components belong to the set ZN. The scalar product protocol is to securely compute the scalar (dot) product of X and Y, given by \( \boldsymbol{X}\cdotp \boldsymbol{Y}={\sum}_{i=1}^m{x}_i{y}_i\mathit{\operatorname{mod}}\ N \).

He et al. [11] proposed the first quantum protocol for the secure scalar product via quantum entanglements and quantum measurements. Their protocol needs a non-colluding third party. Recently, Wang et al. [12] presented a new quantum approach to compute secure scalar product between two parties with continuous-variable clusters. Wang’s protocol does not need any third party. However, both He’s protocol and Wang’s protocol need to cost too many redundant qubits and perform lots of measurements to ensure the security. In this paper, we present a novel quantum protocol for secure two-party scalar product without the help of any third party. Compared with the previously proposed quantum protocols, our protocol obtains the lower communication complexity and the lower measurement complexity.

In addition, since unconditionally secure (or perfect) two-party quantum computations are impossible in theory, some researchers further consider the honest-but-curious model in two-party quantum computations [13,14,15], which is similar to the semi-honesty model in the classical settings. That is, the parties honestly execute the protocol, but they try to find out as much as possible about the other inputs despite following the protocol. In this paper, we consider a stronger model than the honest-but-curious model, that is, we only assume that the parties do not change their private inputs during the whole protocol execution, but they can perform any other malicious actions, including dishonestly executing the protocol, in order to steal the other’s private information.

2 Quantum scalar product protocol

Under the assumption that two parties do not change their respective private inputs during the whole protocol execution, we give a definition of a one-sided two-party scalar product protocol with strong (not perfect) privacy protections, later called strong privacy-preserving two-party scalar product protocol.

Definition 1

Strong privacy-preserving two-party scalar product (SP2P-SP) protocol - There are two parties, usually called Alice and Bob. Alice inputs a private vector X = (x1, x2, …, xm) and Bob inputs a private vector Y = (y1, y2, …, ym). After running a SP2P-SP protocol, Bob outputs the scalar product of X and Y, i.e., \( {\sum}_{i=1}^m{x}_i{y}_i\mathit{\operatorname{mod}}\ N \), but Alice gets nothing. In addition, SP2P-SP protocol should meet the following strong privacy requirements:

  • Alice’s Privacy. The information about Alice’s private vector X obtained by a dishonest Bob is less than or equal to the possible information inferred from his private vector Y and the final scalar product, \( {\sum}_{i=1}^m{x}_i{y}_i\mathit{\operatorname{mod}}\ N \) (strong privacy).

  • Bob’s Privacy. Alice cannot get any secret information about Bob’s private vector Y (perfect privacy).

In the following protocol, suppose that two parties’ private vectors are X = (x0, x1, …, xN − 1) and =(y0, y1, …, yN − 1) , respectively, and all components belong to the set ZN, where N = 2n. This assumption is reasonable, because we can let xm = xm + 1… = xN − 1 = 0 and ym = ym + 1… = yN − 1 = 0, if m < N. In addition, we further assume that two private vectors cannot be altered during the whole protocol execution.

2.1 Quantum SP2P-SP protocol

  • Step 1. Alice first hides her private vector X = (x0, x1, …, xN − 1) by secret splitting ideas as follows: Alice generates two auxiliary vectors X1 = (x1, 0, xj,i, …, x1, N − 1) and X2 = (x2, 0, x2, 1, …, x2, N − 1) over ZN randomly, such that X = (X1+ X2)modN, i.e., xi = (xj,i + x2, i)modN for any i. Then Alice prepares two quantum states, which are initially in \( \frac{1}{\sqrt{N}}\sum \limits_{i=0}^{N-1}\mid i\Big\rangle \). Furthermore, Alice applies two oracle operators \( {U}_{X_1} \) and \( {U}_{X_2} \) to two initial states, respectively, where the oracle operator \( {U}_{X_j} \) (j = 1, 2) is defined by

$$ {U}_{X_j}:\frac{1}{\sqrt{N}}{\sum}_{i=0}^{N-1}\mid i\left\rangle \bigotimes \mid 0\right\rangle \to \frac{1}{\sqrt{N}}{\sum}_{i=0}^{N-1}\left|i\right\rangle \mid 0\bigotimes {x}_{j,i}\Big\rangle $$
(1)

Let \( \mid {\psi}_{A_j}\left\rangle =\frac{1}{\sqrt{N}}{\sum}_{i=0}^{N-1}\left|i\right\rangle \mid {x}_{j,i}\right\rangle \) for j = 1, 2. Finally Alice sends \( \mid {\psi}_{A_1}\Big\rangle \) and \( \mid {\psi}_{A_2}\Big\rangle \) to Bob though the quantum channel.

  • Step 2. After receiving two quantum states sent by Alice, Bob first applies a similar oracle operator UY to each quantum state \( \mid {\psi}_{A_j}\Big\rangle \) (j = 1, 2), where UY is defined by,

$$ {U}_Y:\frac{1}{\sqrt{N}}{\sum}_{i=0}^{N-1}\left|i\right\rangle \mid {x}_{j,i}\left\rangle \bigotimes \left|0\right\rangle \kern0.5em \to \kern0.75em \frac{1}{\sqrt{N}}{\sum}_{i=0}^{N-1}\left|i\right\rangle \left|{x}_{j,i}\right\rangle \mid 0\bigotimes {y}_i\right\rangle . $$
(2)

Let \( \mid {\psi}_{B_j}\left\rangle =\frac{1}{\sqrt{N}}{\sum}_{i=0}^{N-1}\left|i\right\rangle \left|{x}_{j,i}\right\rangle \mid {y}_i\right\rangle \) for j = 1, 2. Then Bob performs another oracle operator Uf to each quantum state \( \mid {\psi}_{B_j}\Big\rangle \) (j = 1, 2), where Uf is defined by,

$$ {U}_f:\kern0.5em \frac{1}{\sqrt{N}}{\sum}_{i=0}^{N-1}\left|i\right\rangle \left|{x}_{j,i}\right\rangle \mid {y}_i\left\rangle \bigotimes \left|0\right\rangle \kern0.75em \to \kern0.75em \frac{1}{\sqrt{N}}{\sum}_{i=0}^{N-1}\left|i\right\rangle \left|{x}_{j,i}\right\rangle \mid {y}_i\right\rangle \mid 0\bigotimes f\left({x}_{j,i},{y}_i\right)\Big\rangle, $$
(3)

with f(xj, i, yi) = xj,i · yi. That is,

$$ {U}_f\mid {\psi}_{B_j}\left\rangle \bigotimes \mid 0\right\rangle =\frac{1}{\sqrt{N}}{\sum}_{i=0}^{N-1}\left|i\right\rangle \left|{x}_{j,i}\right\rangle \mid {y}_i\left\rangle \mid {x}_{j,i}.{y}_i\right\rangle . $$
(4)

Let \( \mid {\phi}_{B_j}\left\rangle =\frac{1}{\sqrt{N}}{\sum}_{i=0}^{N-1}\left|i\right\rangle \left|{x}_{j,i}\right\rangle \mid {y}_i\right\rangle \mid {x}_{j,i}.{y}_i\Big\rangle \) for j = 1, 2.

  • Step 3. For each \( \mid {\phi}_{B_j}\Big\rangle \), Bob further prepares two auxiliary quantum states, which are initially in \( \frac{1}{\sqrt{N^{\prime }}}{\sum}_{k=0}^{N^{\prime }-1}\mid k\Big\rangle \) and ∣0〉. Here, we assume that N′ > N2, n′ = log N′ and n = log N. Furthermore, Bob performs an oracle quantum operator \( {U}_{f^{\ast }} \) on each quantum system \( \mid {\phi}_{B_j}\left\rangle \bigotimes \frac{1}{\sqrt{N^{\prime }}}{\sum}_{k=0}^{N^{\prime }-1}\mid k\right\rangle \bigotimes \mid 0\Big\rangle \) (j = 1, 2), where \( {U}_{f^{\ast }} \) is defined by,

$$ {U}_{f^{\ast }}\left|{\phi}_{B_j}\right\rangle \bigotimes \frac{1}{\sqrt{N^{\prime }}}\sum \limits_{k=0}^{N^{\prime }-1}\left|k\right\rangle \bigotimes \left|0\right\rangle ={U}_{f^{\ast }}\frac{1}{\sqrt{N}}\sum \limits_{i=0}^{N-1}\left|i\right\rangle \left|{x}_{j,i}\right\rangle \mid {y}_i\left\rangle \mid {x}_{j,i}.{y}_i\right\rangle \bigotimes \frac{1}{\sqrt{N^{\prime }}}\sum \limits_{k=0}^{N^{\prime }-1}\left|k\right\rangle \bigotimes \left|0\right\rangle =\frac{1}{\sqrt{N{N}^{\prime }}}\sum \limits_{i=0}^{N-1}\left|i\right\rangle \left|{x}_{j,i}\right\rangle \mid {y}_i\left\rangle \mid {x}_{j,i}.{y}_i\right\rangle \sum \limits_{k=0}^{N^{\prime }-1}\left|k\right\rangle \mid 0\bigotimes {f}^{\ast}\left(i,{x}_{j,i}.{y}_i,k\right)\Big\rangle =\frac{1}{\sqrt{N{N}^{\prime }}}{\sum}_{i=0}^{N-1}{\sum}_{k=0}^{N^{\prime }-1}\left\{\left|i\right\rangle \left|{x}_{j,i}\right\rangle |{y}_i\Big\rangle |{x}_{j,i}.{y}_i\Big\rangle \left|k\right\rangle |{f}^{\ast}\left(i,{x}_{j,i}.{y}_i,k\right)\Big\rangle \right\}, $$
(5)

with

$$ {f}^{\ast}\left(i,{x}_{j,i}\cdotp {y}_i,k\right)=\left\{\begin{array}{c}1\kern1.25em if\kern0.5em {x}_{j,i}\cdotp {y}_i>k\\ {}0\kern2em otherwise\kern1em \end{array}\right.. $$
(6)

  • Step 4. For j = 1, 2, by using quantum counting algorithm [16,17,18], Bob counts the number tj of the components satisfying f∗(i, xj, i · yi, k) = 1 of the quantum state in Eq. 5, respectively. That is, Bob executing the following procedures:

For j = 1 to 2

{ Prepare two registers in the initial state \( \mid {\mathrm{R}}_0\left\rangle =\frac{1}{\sqrt{\mathrm{M}}}{\sum}_{t=0}^{\mathrm{M}-1}\mid t\right\rangle \bigotimes \mid {\varphi}_j\Big\rangle \), where the state ∣φj〉 is in,

$$ \mid {\varphi}_j\left\rangle =\frac{1}{\sqrt{N{N}^{\prime }}}{\sum}_{i=0}^{N-1}{\sum}_{k=0}^{N^{\prime }-1}\left|i\right\rangle \left|{x}_{j,i}\right\rangle \mid {y}_i\right\rangle \mid {x}_{j,i}.{y}_i\left\rangle \left|k\right\rangle \mid {f}^{\ast}\left(i,{x}_{j,i}.{y}_i,k\right)\right\rangle . $$
(7)

Apply CF on ∣R0〉, which implements ∣t〉 ⨂  ∣ φj〉 →  ∣ t〉 ⨂ Gt ∣ φj〉, where G is the Grover iteration [18] defined by (Fig. 1)

$$ G={U}_{\varphi_j}{U}_{f_{\omega }}, $$
(8)
$$ \left|\omega \right\rangle =\left|i\right\rangle \mid {x}_{j,i}\left\rangle \mid {y}_i\right\rangle \mid {x}_{j,i}.{y}_i\Big\rangle \left|k\right\rangle \left|{f}^{\ast}\left(i,{x}_{j,i}\cdotp {y}_i,k\right)\right\rangle $$
(9)
$$ {U}_{f_{\omega }}\left|\omega \right\rangle =\left\{\begin{array}{c}-\mid \omega \Big\rangle \kern0.75em if\kern0.5em {f}^{\ast}\left(i,{x}_{j,i}.{y}_i,k\right)=1\\ {}\kern0.75em \mid \omega \Big\rangle \kern0.75em if\kern0.50em {f}^{\ast}\left(i,{x}_{j,i}.{y}_i,k\right)=0\end{array}\right., $$
(10)
$$ {U}_{\varphi_j}=2\mid {\varphi}_j\left\rangle \right\langle {\varphi}_j\mid -I. $$
(11)

Similarly, call the resultant state ∣R1〉.

Apply QFT−1 on the first register of ∣R1〉. Call the resultant state ∣R2〉.

Measure the first register of ∣R2〉 to obtain ∣Tj〉 and compute \( {t}_j=N{N}^{\prime }{\mathit{\sin}}^2\left(\frac{T_j}{M}\pi \right) \). }

Finally, Bob outputs t = (t1 + t2)modN, i.e., an estimator of the scalar product of X and Y (Fig. 1).

Fig. 1
figure 1

Circuit for the iteration G in Step 4

Full size image

3 Analysis

Correctness

Given from Step 1 of the proposed protocol, X = X1+ X2( i.e., xi = xj,i + x2, i for any i), so \( {\sum}_{i=0}^{N-1}{x}_{1,i}{y}_i\mathit{\operatorname{mod}}\ N+{\sum}_{i=0}^{N-1}{x}_{2,i}{y}_i\mathit{\operatorname{mod}}\ N={\sum}_{i=0}^{N-1}{x}_i{y}_i\mathit{\operatorname{mod}}\ N \), obviously. By Eq.(7) (or Eq.(5)), there are NN′ components in the quantum state ∣φj〉, where xj,iyi < N2 < N′. Furthermore, by the definition of f∗ in Eq.(6), we can see that for each i, there are just xj,iyiks (i.e, k from 0 to xj,iyi − 1) among all N′ks (i.e, k from 0 to N′ − 1) satisfying f∗(i, xj,i · yi, k) = 1. So, there are \( {\sum}_{i=0}^{N-1}{x}_{j,i}{y}_i\mathit{\operatorname{mod}}\ N \) components in the quantum state ∣φj〉 in total, such that f∗(i, xj,i · yi, k) = 1, and further the number of the components satisfying f∗(i, xj,i · yi, k) = 1 will be estimated by Bob using quantum counting algorithm in Step 4. Accordingly, the final output, t (i.e., t1 + t2), is a right estimator of the scalar product of X and Y.

Therefore, two parties honestly executing the protocol can ensure its correctness.

  • Alice’s Privacy. In the proposed quantum SP2P-SP protocol, Alice only sends out two quantum states: \( \mid {\psi}_{A_1}\Big\rangle \) and \( \mid {\psi}_{A_2}\Big\rangle \) without any classical message, where \( \mid {\psi}_{A_j}\left\rangle =\frac{1}{\sqrt{N}}{\sum}_{i=0}^{N-1}\left|i\right\rangle \mid {x}_{j,i}\right\rangle \) for j = 1, 2. Although all classical information about her private vectors is embedded into the two states, no one can extract all this information by the basic principles of quantum mechanics. For a dishonest Bob, he can try to extract Alice’s partial private information from the received states by the following possible attacks.

The first attack is to directly make a projective measurement on the received states |\( {\psi}_{A_j}\Big\rangle \)s to steal Alice’s private information.

On the one hand, if the dishonest Bob makes a projective measurement on one of the received states, e.g., \( \mid {\psi}_{A_1}\Big\rangle \), where \( \mid {\psi}_{A_1}\left\rangle =\frac{1}{\sqrt{N}}{\sum}_{i=0}^{N-1}\left|i\right\rangle \mid {x}_{\mathrm{j},i}\right\rangle \). Accordingly, he will get |i〉 ∣ x1, i〉 for any i with the probability of \( \frac{1}{N} \). Then the system A sent by Alice can be characterized by the quantum ensemble, ℇ ≡ {pi, ρA(i)}, where pi (i.e., \( {p}_i=\frac{1}{N} \)) is the probability of getting the measured result (i, x1, i), and

$$ {\rho}_A(i)=\mid i,{x}_{1,i}\left\rangle \right\langle i,{x}_{1,i}\mid . $$
(12)

Holevo’s theorem [19] tells us that the accessible information available to the outsider by any measurement on ρA is bounded by the entropy

$$ {\displaystyle \begin{array}{c}I\le \mathcal{X}\left(\upvarepsilon \right)=S\left({\rho}_A\right)-\frac{1}{N}\sum \limits_{i=0}^{N-1}S\left({\rho}_A(i)\right)\\ {}\le \frac{1}{N}\sum \limits_{i=0}^{N-1}S\left({\rho}_A(i)\right)+H(P)\\ {}=H(P),\end{array}} $$
(13)

where \( {\rho}_A={\sum}_{i=0}^{N-1}{\rho}_A(i)/N \) is the average state of A. So I ≤ n. That is, Bob can extract at most n bits classical information from the received state by any possible local measurement.

On the other hand, if Bob makes a projective measurement on the state |\( {\psi}_{A_j}\Big\rangle \) (i.e., \( \frac{1}{\sqrt{N}}{\sum}_{i=0}^{N-1}\left|i\right\rangle \mid {x}_{j,i}\Big\rangle \)). Accordingly, he will get xj, i (n bits) for any i with the probability of \( \frac{1}{N} \). However, he cannot get the ith component of Alice’s private vector (i.e., xi), only from a single measured result x1, i or x2, i, not x1, i and x2, i, due to xi = x1, i + x2, i. Even if Bob measures both two received states \( \mid {\psi}_{A_1}\Big\rangle \) and \( \mid {\psi}_{A_2}\Big\rangle \), he will randomly get x1, i and \( {x}_{2,{i}^{\ast }} \), respectively. By the randomness of the measurements, i and i∗ are two random numbers, where the probability of satisfying i = i∗ is only \( \frac{1}{N} \). Accordingly, the probability that Bob successfully gets a right component xi by this attack is also \( \frac{1}{N} \), which is equal to that of randomly guessing it. In addition, if Bob performs this attack, he will lose the chance to further compute the final scalar product, due to No-cloning Theorem which forbids the creation of identical copies of an arbitrary unknown quantum state.

The second attack is to count the number of xj, i ∈ (xj, 0, xj,i, …, xj, N − 1) on \( \mid {\psi}_{A_j}\Big\rangle \) by quantum counting algorithm, such that xj, i satisfies certain feature, e.g., it is equal to a specific number. That is, it is to analyze certain statistics feature of Alice’s auxiliary private vector. However, Bob cannot further get any secret information about Alice’s original private vector from these statistics features because two auxiliary vectors are randomly generated by Alice.

In addition, the dishonest Bob still can perform a more complicated attack that he tries to compute the summation of both received quantum states by the help of a powerful oracle operator, since he knows that Alice uses the classical secret splitting technology to hide her private vector. Suppose that there is an oracle operator O, which is defined by,

$$ O:\mid {l}_1\left\rangle \bigotimes \mid {l}_2\right\rangle \bigotimes \mid 0\left\rangle \to \mid {l}_1\right\rangle \bigotimes \mid {l}_2\left\rangle \bigotimes \mid {l}_1+{l}_2\right\rangle, $$
(14)

for any lj ∈ ZN. Then, after applying the oracle operator O on both received quantum states, the dishonest Bob will get,

$$ O\ \left[\frac{1}{\sqrt{N}}\sum \limits_{i=0}^{N-1}\left|i\right\rangle \left|{x}_{1,i}\right\rangle \bigotimes \frac{1}{\sqrt{N}}\sum \limits_{i=0}^{N-1}\left|i\right\rangle \left|{x}_{2,i}\right\rangle \bigotimes |0\Big\rangle \right]=\frac{1}{N}{\sum}_{i_1,{i}_2}\left|{i}_1\right\rangle \left|{i}_2\right\rangle \left|{x}_{1,{i}_1}\right\rangle \mid {x}_{2,{i}_2}\left\rangle \mid {x}_{1,{i}_1}+{x}_{2,{i}_2}\right\rangle . $$
(15)

In Eq. 14, if i1 = i2 = i, then \( {x}_{1,{i}_1}+{x}_{2,{i}_2}={x}_i \). However, due to the randomness of the measurement, the probability of extracting a private component of Alice’s private vector (i.e., xi) from the final quantum state in Eq.14 is also \( \frac{1}{N} \).

What’s more, suppose that the dishonest Bob can perform the following more stronger attack:

$$ {\displaystyle \begin{array}{c}O^{\prime}\left[\frac{1}{\sqrt{N}}\sum \limits_{i=0}^{N-1}\left|i\right\rangle \left|{x}_{1,i}\right\rangle \bigotimes \frac{1}{\sqrt{N}}\sum \limits_{i=0}^{N-1}\left|i\right\rangle \left|{x}_{2,i}\right\rangle \bigotimes |0\Big\rangle \right]=\frac{1}{N}\sum \limits_{i_1,{i}_2}\left|{i}_1\right\rangle \left|{i}_2\right\rangle \left|{x}_{1,{i}_1}\right\rangle \left|{x}_{2,{i}_2}\right\rangle \left|f\left({i}_1,{i}_2\right)\left({x}_{1,{i}_1}+{x}_{2,{i}_2}\right)\right\rangle, \\ {}\\ {}\end{array}} $$
(16)

with

$$ f\left({i}_1,{i}_2\right)=\left\{\begin{array}{c}1\kern2em if\kern0.5em {i}_1={i}_2\\ {}0\kern1.5em otherwise\end{array}\right.. $$
(17)

Furthermore, if Bob measures the final register (i.e., \( \mid f\left({i}_1,{i}_2\right)\left({x}_{1,{i}_1}+{x}_{2,{i}_2}\right)\Big\rangle \)) on the computational basis, then he will get one component xi of Alice’s private vector with the same probability of 1/N (i.e., i = i1 = i2 and accordingly xi = x1, i + x2, i) and get nothing with the probability of 1 − 1/N.

In fact, if let yi = 1 and yj = 0 for all other js (j ≠ i), then the dishonest Bob can always get the component xi from the final computation result, since \( {\sum}_{i=1}^m{x}_i{y}_i\mathit{\operatorname{mod}}\ N={x}_i \). Therefore, the information about Alice’s private vector X obtained by a dishonest Bob is less than or equal to the possible information inferred from his private vector Y and the final scalar product, \( {\sum}_{i=1}^m{x}_i{y}_i\mathit{\operatorname{mod}}\ N \) (strong privacy).

In a word, Bob or an outside attacker can get at most one component (e.g., xi) of Alice’s private vector at the probability of 1/N. If Alice splits her private vector X into m vectors, instead of two vectors, such that X = X1 + X2 + …Xm, the probability of getting one component by Bob or any attacker will be reduced to 1/Nm − 1.That is, secret splitting (or sharing) can ensure Alice’s privacy well.

Bob’s Privacy. A dishonest Alice may try to learn about Bob’s private vector by an entanglement-type of attack. i.e., she prepares an entangled state \( \frac{1}{\sqrt{N}}{\sum}_{i=0}^{N-1}\left|{\xi}^A(i)\right\rangle \left|i\right\rangle \mid {x}_{j,i}\Big\rangle \) instead of the initial state \( \frac{1}{\sqrt{N}}{\sum}_{i=0}^{N-1}\left|i\right\rangle \mid {x}_{j,i}\Big\rangle \), where she holds the first subsystem |ξA(i)〉 and sends the other subsystems to Bob. After Step 2, the whole quantum system will be in the following state,

$$ \frac{1}{\sqrt{N}}{\sum}_{i=0}^{N-1}\left|{\xi}^A(i)\right\rangle \left|i\right\rangle \mid {x}_{j,i}\Big\rangle \left|{y}_i\right\rangle . $$
(18)

However, for different yis, the reduced density matrixes of the subsystem held by Alice are same. e.g., suppose that the whole quantum system is in the state \( \left|{\psi}_1\right\rangle =\frac{\left|{0}^A000\right\rangle +\left|{1}^A111\right\rangle }{\sqrt{2}} \) or \( \left|{\psi}_2\right\rangle =\frac{\left|{0}^A001\right\rangle +\left|{1}^A110\right\rangle }{\sqrt{2}} \). Accordingly, the reduced density matrix of Alice is \( {\rho}_1^A={Tr}_B\mid {\psi}_1\left\rangle \right\langle {\psi}_1\mid =\frac{1}{2}\left(\mid 0\right\rangle \left\langle \left(0|+|1\right)\right\rangle \left\langle 1\mid \right)=\frac{I}{2} \) or \( {\rho}_2^A={Tr}_B\mid {\psi}_2\left\rangle \right\langle {\psi}_2\mid =\frac{1}{2}\left(\mid 0\right\rangle \left\langle \left(0|+|1\right)\right\rangle \left\langle 1\mid \right)=\frac{I}{2} \). i.e., \( {\rho}_1^A={\rho}_2^A \). Therefore, even if the dishonest Alice performs this attack, she still cannot distinguish or get any Bob’s private information by measuring the subsystem held by herself because the reduced density matrix of the subsystem held by Alice is the completely (or maximally) mixed state.

In addition, Bob does not send out any quantum or classical message to Alice. So Alice cannot get any private information about Bob’s private vector Y by no-signaling principle. That is, Bob’s Privacy is unconditionally secure.

Performance. In our protocol, it only needs Alice to transmit two quantum messages \( \mid {\psi}_{A_1}\left\rangle =\frac{1}{\sqrt{N}}{\sum}_{i=0}^{N-1}\left|i\right\rangle \mid {x}_{1,i}\right\rangle \) and \( \mid {\psi}_{A_2}\left\rangle =\frac{1}{\sqrt{N}}{\sum}_{i=0}^{N-1}\left|i\right\rangle \mid {x}_{2,i}\right\rangle \) to Bob without any classical message. So the communication complexity of our protocol is O(1), which achieves an exponential reduction, compared with corresponding classical protocols. In Step 4 of our protocol, it only needs to perform quantum measurements twice. That is, the measurement complexity of our protocol is also O(1). Therefore, our protocol obtains lower communication and measurement complexities, compared with the related quantum protocols [11, 12].

Finally, to make our protocol work, the key step is to construct the efficient circuits implementing the oracle operators. In our protocol, we define four kinds of oracle operators. Similarly, using the techniques of reversible computation [20], we can construct a classical reversible circuit which takes (x, y) - representing an input register initially set to x and a one bit output register initially set to y - to (x, y ⨂ f(x)), by modifying the usual (irreversible) classical circuit for doing the classical function f(x).

4 Conclusion

In this paper, we present a strong privacy-preserving quantum protocol for secure two-party scalar product. The proposed protocol shows that although unconditionally secure two-party quantum computations are impossible in theory, probabilistic two-party quantum computation with strong privacy protections is possible, which is similar to the probabilistic clone of unknown quantum state. Furthermore, the proposed protocol achieves the communication (measurement) complexity of O(1), and thus it is more suitable for applications with big data. In addition, our approach can be generalized theoretically to compute secure multiparty summation, so we hope that it can provide some new ideas to solve more secure multi-party computations in future.