1 Introduction

With the continuous development of quantum informatics, quantum cryptography [1,2,3,4,5,6] is constructed based on the basic principles of quantum mechanics, so it has unconditional security in theory. Quantum key agreement (QKA) is an important branch of quantum cryptography. Compared with quantum key distribution (QKD) [7,8,9,10], QKA has great research significance because each participant in QKA contributes equally to the final shared key.

In 2004, Zhou et al. [11] presented the first QKA protocol using quantum teleportation, and after that, many QKA protocols [12,13,14,15] were proposed one after another. However, most of these QKA protocols are based on quantum communication in an ideal environment. In practical applications, particles are usually affected by noise, and under the cover of the noise, a malicious attacker can steal information. Therefore, it is necessary to consider the effect of noise on the channel when designing QKA protocols. In 2014, Huang et al. [16] first proposed a QKA protocol to resist collective decoherence. Based on the logical χ states and logical Bell states, He et al. [17] designed two QKA protocols immune to collective noise using measurement correlation and delay measurement techniques for multi-particle entangled states. In 2018, based on four-particle logical GHZ states, Gao et al. [18] presented an improved two-party QKA protocol to resist collective noise with an efficiency of 26.67%. In the same year, Cai et al. [19] proposed two multi-party QKA protocols that are immune to collective noise. In 2019, Yang et al. [20] put forward a two-party QKA protocol based on logical Bell states to resist collective noise with a qubit efficiency of 20%. In the same year, Wang et al. [21] designed two QKA protocols with an efficiency of 25% immune to collective noise, improving the qubit efficiency. In 2020, Tang et al. [22] used logical Bell states to greatly improve the qubit efficiency of the protocol, reaching 27.27%.

To address the efficiency problems in the above QKA protocols immune to collective noise, we propose two-party QKA protocols capable of resisting collective dephasing noise and collective rotational noise, respectively, using the logical GHZ state and its measurement correlation. The safety analysis proves that the protocols are resistant to external attacks as well as participant attacks. Also, the efficiency of our protocols improves by 1.3% over the efficiency of the currently proposed QKA protocols immune to collective noise.

The rest of the article is structured as follows. In Section 2, some basics are presented. Section 3 describes two QKA protocols that are immune to collective noise separately. In Section 4, the security of the protocol is analyzed. The efficiency of qubits in the protocol is calculated in Section 5. Finally, a brief conclusion will be given in Section 6.

2 The Unitary Operations and the Collective Noise

First, the four unitary operations are defined as:

$$ \begin{array}{@{}rcl@{}} &&U_{00}=I=|0\rangle\langle0|+|1\rangle\langle1|,\\ &&U_{01}=X=|0\rangle\langle1|+|1\rangle\langle0|,\\ &&U_{10}=Z=|0\rangle\langle0|-|1\rangle\langle1|,\\ &&U_{11}=iY=|0\rangle\langle1|-|1\rangle\langle0|. \end{array} $$
(1)

The four Bell states can be denoted as:

$$ \begin{array}{@{}rcl@{}} &&|\phi^{\pm}\rangle=\frac{1}{\sqrt{2}}(|00\rangle\pm|11\rangle),\\ &&|\varphi^{\pm}\rangle=\frac{1}{\sqrt{2}}(|01\rangle\pm|10\rangle). \end{array} $$
(2)

When a unitary operation \(U_{i_{1}i_{2}}\)(i1i2 = 0,1) is performed on the second particle of the Bell state, the Bell state will be transformed into another Bell state. The relationship between the four Bell states and unitary transformation is shown in Table 1.

Table 1 Relationship between the unitary operations and the transformed Bell states
Full size table

Second, collective noise is divided into collective dephasing noise and collective rotation noise. The influence of collective dephasing noise (Udp) on normal orthogonal basis |0〉 and |1〉 can be described as:

$$ U_{dp}|0\rangle=|0\rangle, U_{dp}|1\rangle=e^{i\varphi}|1\rangle, $$
(3)

where φ is the phase noise parameter that vary with time. In order to eliminate the influence of collective dephasing noise, logical qubits |0dp〉 = |01〉 and |1dp〉 = |10〉 are proposed. Their superposition states can be denoted as:

$$ \begin{array}{@{}rcl@{}} &&|+_{dp}\rangle=\frac{1}{\sqrt{2}}(|0_{dp}\rangle+|1_{dp}\rangle),\\ &&|-_{dp}\rangle=\frac{1}{\sqrt{2}}(|0_{dp}\rangle-|1_{dp}\rangle). \end{array} $$
(4)

The influence of collective rotation noise (Ur) on normal orthogonal basis |0〉 and |1〉 can be described as:

$$ U_{r}|0\rangle=cos\theta|0\rangle+sin\theta|1\rangle, U_{r}|1\rangle=-sin\theta|0\rangle+cos\theta|1\rangle, $$
(5)

where 𝜃 is the rotation noise parameter that vary with time. In order to eliminate the influence of collective rotation noise, logical qubits \(|0_{r}\rangle =|\phi ^{+}\rangle =\frac {1}{\sqrt {2}}(|00\rangle +|11\rangle )\) and \(|1_{r}\rangle =|\psi ^{-}\rangle =\frac {1}{\sqrt {2}}(|01\rangle +|10\rangle )\) are proposed. Their superposition states are described as follows:

$$ \begin{array}{@{}rcl@{}} &&|+_{r}\rangle=\frac{1}{\sqrt{2}}(|0_{r}\rangle+|1_{r}\rangle)=\frac{1}{\sqrt{2}}(|\phi^{+}\rangle+|\psi^{-}\rangle),\\ &&|-_{r}\rangle=\frac{1}{\sqrt{2}}(|0_{r}\rangle-|1_{r}\rangle)=\frac{1}{\sqrt{2}}(|\phi^{+}\rangle-|\psi^{-}\rangle). \end{array} $$
(6)

3 Description of the QKA Protocols Under Collective Noise Channels

3.1 The QKA Protocol Under Collective-dephasing Noise

In both protocols, the following three-particle GHZ states [23] is used as the quantum source, that is

$$ \begin{array}{@{}rcl@{}} |\eta\rangle_{123} &=&\frac{1}{\sqrt{2}}(|000\rangle+|111\rangle)_{123}\\ &=&\frac{1}{\sqrt{2}}(|\phi^{+}\rangle_{12}|+\rangle_{3}+|\phi^{-}\rangle_{12}|-\rangle_{3}). \end{array} $$
(7)

According to (7), when performing Bell measurements on particles 1 and 2 in |η〉123 state and peforming X basis measurement on particle 3 respectively, the state |η〉123 will collapse to states |ϕ+〉12|+〉3 and |ϕ−〉12|−〉3 with the probability of \(\frac {1}{2}\).

Suppose Alice and Bob want to negotiate a common key \(K=({K_{A}^{1}}\|{K_{B}^{1}})\|({K_{A}^{2}}\|{K_{B}^{2}})\|\) \(\ldots \|({K_{A}^{n}}\|{K_{B}^{n}})\). First, Alice and Bob randomly generate their own 2n bit keys:

$$ K_{A}={K_{A}^{1}}\|{K_{A}^{2}}\|\ldots\|{K_{A}^{n}}, $$
$$ K_{B}={K_{B}^{1}}\|{K_{B}^{2}}\|\ldots\|{K_{B}^{n}}, $$

where \({K_{A}^{i}}, {K_{B}^{i}} \in \{00,01,10,11\}\) and i = 1,2,…,n. The steps of the protocol are given below.

  • Step 1 Alice prepares n logical GHZ states |ηdp〉ABC:

    $$ \begin{array}{@{}rcl@{}} |\eta_{dp}\rangle_{ABC} &=&\frac{1}{\sqrt{2}}(|0\rangle|0\rangle|0_{dp}\rangle+|1\rangle|1\rangle|1_{dp}\rangle)_{ABC}\\ &=&\frac{1}{\sqrt{2}}(|0\rangle_{A}|0\rangle_{B}|01\rangle_{C_{1}C_{2}}+|1\rangle_{A}|1\rangle_{B}|10\rangle_{C_{1}C_{2}}), \end{array} $$
    (8)

    and divides all particles into three sequences S1, S2 and S3, where sequence Si is composed of the i-th particle of all |ηdp〉ABC states. In S3, the logical qubit C is composed of two physical qubits C1 and C2. Alice randomly selects enough decoy particles from set {|0dp〉,|1dp〉,| +dp〉,|−dp〉} and inserts them into sequences S3 to obtain new sequences \(S_{3}^{*}\). Alice sends \(S_{3}^{*}\) to Bob and retains sequences S1 and S2.

  • Step 2 When Bob receives sequence \(S_{3}^{*}\), Alice announces the position of the decoy photons and the corresponding measurement basis {|0dp〉,|1dp〉} or {| +dp〉,|−dp〉}. Then, Bob uses the correct measurement basis to measure the corresponding decoy logical particles and tells Alice the measurement results. Alice compares the measurement results with the initial states of the decoy photons and calculates the error rate. If the error rate less than a predetermined threshold, the protocol continues. If the error rate exceeds the threshold, Alice and Bob terminate the agreement and restart.

  • Step 3 After security detection, Bob discards the decoy particles and returns to sequence S3. A CNOT operation uses C1 as the control qubit and C2 as the target qubit. After CNOT operation, each logic GHZ state |ηdp〉ABC is converted to

    $$ \begin{array}{@{}rcl@{}} |\eta_{dp}^{*}\rangle_{ABC} &=&CNOT(C_{1},C_{2})|\eta_{dp}\rangle_{ABC}\\ &=&\frac{1}{\sqrt{2}}(|0001\rangle+|1111\rangle)_{ABC_{1}C_{2}}\\ &=&\frac{1}{\sqrt{2}}(|\eta\rangle_{ABC_{1}})\otimes|1\rangle_{C_{2}}. \end{array} $$
    (9)

    Alice, Bob share n \(|\eta _{dp}^{*}\rangle \) states. Alice performs Bell measurement on the corresponding particles in sequences S1 and S2, while Bob performs X basis measurement on the particles C1 in sequence S3, Alice and Bob negotiate coding rules, \(|+\rangle \rightarrow 00\), \(|-\rangle \rightarrow 11\). Bob records the measurement results as \(H_{B}={H_{B}^{1}}\|{H_{B}^{2}}\|\ldots \|{H_{B}^{n}}\), where \({H_{B}^{i}}\) is Bob’s i-th measurement result, and \({H_{B}^{i}} \in \{00, 11\}\). Due to the measurement correlation of η state, Alice and Bob can infer each other’s measurement results. Alice knows Bob’s measured value HB, Bob knows the initial Bell states of the corresponding particles in sequences S1, S2.

  • Step 4 Alice performs unitary transformation \(U_{i_{1}i_{2}}\) on the ith particle in the sequence S2 according to her own key \({K_{A}^{i}}(i=1, 2, \ldots , n)\) to obtain a new sequence \(S_{2}^{*}\). The subscripts i1i2 corresponds to the values of \({K_{A}^{i}}(i=1, 2, \ldots , n)\). Then, S1, \(S_{2}^{*}\) form new Bell states. According to the new Bell states, Alice prepares their corresponding logical Bell states S1(1), \(S_{2(1)}^{*}\) as follows. Logical Bell states S1(1), \(S_{2(1)}^{*}\) are composed of logical qubits A(two physical qubits A1 and A2) and logical qubits B(two physical qubits B1 and B2). Alice performs a permutation operation \({\prod }_{n}\) on S1(1) to obtain a randomized sequence \(S_{1(1)}^{*}\). Then, Alice randomly selects enough decoy photons from set {|0dp〉,|1dp〉} or {| +dp〉,|−dp〉} and inserts sequences \(S_{1(1)}^{*}\) and \(S_{2(1)}^{*}\) to obtain two new sequences \(S_{1(1)}^{**}\) and \(S_{2(1)}^{**}\). Finally, she sends the two new sequences to Bob.

    $$ \begin{array}{@{}rcl@{}} |\phi_{dp}^{+}\rangle_{A_{1}A_{2}B_{1}B_{2}} &=&\frac{1}{\sqrt{2}}(|0_{dp}\rangle|0_{dp}\rangle+|1_{dp}\rangle|1_{dp}\rangle)_{A_{1}A_{2}B_{1}B_{2}}\\ &=&\frac{1}{\sqrt{2}}(|\phi^{+}\rangle|\phi^{+}\rangle-|\phi^{-}\rangle|\phi^{-}\rangle)_{A_{1}B_{1}A_{2}B_{2}}\\ |\phi_{dp}^{-}\rangle_{A_{1}A_{2}B_{1}B_{2}} &=&\frac{1}{\sqrt{2}}(|0_{dp}\rangle|0_{dp}\rangle-|1_{dp}\rangle|1_{dp}\rangle)_{A_{1}A_{2}B_{1}B_{2}}\\ &=&\frac{1}{\sqrt{2}}(|\phi^{-}\rangle|\phi^{+}\rangle-|\phi^{+}\rangle|\phi^{-}\rangle)_{A_{1}B_{1}A_{2}B_{2}} \end{array} $$
    (10)
    $$ \begin{array}{@{}rcl@{}} |\psi_{dp}^{+}\rangle_{A_{1}A_{2}B_{1}B_{2}} &=&\frac{1}{\sqrt{2}}(|0_{dp}\rangle|1_{dp}\rangle+|1_{dp}\rangle|0_{dp}\rangle)_{A_{1}A_{2}B_{1}B_{2}}\\ &=&\frac{1}{\sqrt{2}}(|\psi^{+}\rangle|\psi^{+}\rangle-|\psi^{-}\rangle|\psi^{-}\rangle)_{A_{1}B_{1}A_{2}B_{2}}\\ |\psi_{dp}^{-}\rangle_{A_{1}A_{2}B_{1}B_{2}} &=&\frac{1}{\sqrt{2}}(|0_{dp}\rangle|1_{dp}\rangle-|1_{dp}\rangle|0_{dp}\rangle)_{A_{1}A_{2}B_{1}B_{2}}\\ &=&\frac{1}{\sqrt{2}}(|\psi^{-}\rangle|\psi^{+}\rangle-|\psi^{+}\rangle|\psi^{-}\rangle)_{A_{1}B_{1}A_{2}B_{2}}. \end{array} $$
    (11)

  • Step 5 After Bob receives sequences \(S_{1(1)}^{**}\) and \(S_{2(1)}^{**}\), Alice and Bob perform the second eavesdropping detection. The second eavesdropping detection is the same as the first eavesdropping detection. If the error rate is lower than the predetermined threshold, both parties continue the following steps. Otherwise, they will terminate the agreement and start again.

  • Step 6 Bob publicly announces the value of \(K_{B}^{*}\), where \(K_{B}^{*}=K_{B}\oplus H_{B}=({K_{B}^{1}}\oplus {H_{B}^{1}})\|({K_{B}^{2}}\oplus {H_{B}^{2}})\|\ldots \|({K_{B}^{n}}\oplus {H_{B}^{n}})\), through the classical channel. According to the value of HB, Alice can calculate KB and get the shared key K.

  • Step 7 Alice publicly announces the permutation operation \({\prod }_{n}\), and Bob performs the corresponding inverse permutation on the sequence \(S_{1(1)}^{*}\) to obtain the original sequence S1(1). Next, Bob performs Bell measurements on the particles A1,B1 and A2,B2 in sequences S1(1) and \(S_{2(1)}^{*}\). Based on the measurement results, Bob can know the logical Bell states constituted by S1(1) and \(S_{2(1)}^{*}\), thus know the Bell states constituted by S1, \(S_{2}^{*}\). According to the initial Bell states, Bob can calculate KA and generate the shared key K.

3.2 The QKA Protocol Under Collective-Rotation Noise

As the first QKA protocol, Alice and Bob want to negotiate a common key K. The negotiation steps are as follows.

  • Step 1 Alice prepares n logical GHZ states |ηr〉ABC:

    $$ \begin{array}{@{}rcl@{}} |\eta_{r}\rangle_{ABC} &=&\frac{1}{\sqrt{2}}(|0\rangle|0\rangle|0_{r}\rangle+|1\rangle|1\rangle|1_{r}\rangle)_{ABC}\\ &=&\frac{1}{2}(|0\rangle_{A}|0\rangle_{B}|\phi^{+}\rangle_{C_{1}C_{2}}+|1\rangle_{A}|1\rangle_{B}|\varphi^{-}\rangle_{C_{1}C_{2}}), \end{array} $$
    (12)

    and divides all particles into three sequences S1, S2 and S3, where sequence Si is composed of the i-th particle of all |ηr〉ABC states. In S3, the logical qubit C is composed of two physical qubits C1 and C2. Meanwhile, all the physical qubits C1 form the sequence S31 and C2 form S32. Alice randomly selects enough decoy particles from set {|0r〉,|1r〉,| +r〉,|−r〉} and inserts them into sequences S3 to obtain new sequences \(S_{3}^{*}\). Alice sends \(S_{3}^{*}\) to Bob and retains sequences S1 and S2.

  • Step 2 When Bob receives sequence \(S_{3}^{*}\), Alice announces the position of the decoy particles and the corresponding measurement basis {|0r〉,|1r〉} or {| +r〉,|−r〉}. Then, Bob uses the correct measurement basis to measure the corresponding decoy logical particles and tells Alice the measurement results. Alice compares the measurement results with the initial states of the decoy particles and calculates the error rate. If the error rate less than a predetermined threshold, the protocol continues. If the error rate exceeds the threshold, Alice and Bob terminate the agreement and restart.

  • Step 3 After security detection, Bob discards the decoy particles and recovers sequence S3. At this point, Alice, Bob share n|ηr〉 states, Alice performs Z basis measurement on the corresponding particles in sequences S1 and S2, while Bob performs Bell measurement on the particles C1 and C2 in S31 and S32, Alice and Bob negotiate coding rules, \(|00\rangle \rightarrow 00\), \(|11\rangle \rightarrow 11\), \(|01\rangle \rightarrow 01\), \(|10\rangle \rightarrow 10\). Alice records the measurement results as \(H_{A}={H_{A}^{1}}\|{H_{A}^{2}}\|\ldots \|{H_{A}^{n}}\), where \({H_{A}^{i}}\) is the i-th measurement of Alice. Due to the measurement correlation of |η〉ABC, Alice and Bob can infer each other’s measurement results. That is to say, Bob knows Alice’s measured value HA. Alice knows the initial Bell states consisting of the corresponding particles in sequence S3.

  • Step 4 Bob performs the \(U_{i_{1}i_{2}}\) operation on the particles C2 of the sequence S32, according to his own key \({K_{B}^{i}}(i=1, 2, \ldots , n)\) to obtain a new sequence \(S_{32}^{*}\). The subscripts i1i2 corresponds to the values of \({K_{B}^{i}}(i=1, 2, \ldots , n)\). Then, S31, \(S_{32}^{*}\) form new Bell states. According to the new Bell states, Bob prepares their corresponding logical Bell states S3(1), \(S_{3(2)}^{*}\) as follows. Logical Bell states S3(1), \(S_{3(2)}^{*}\) are composed of logical qubit C1(two physical qubits C11 and C12) and logical qubit C2(two physical qubits C21 and C22). Then, Bob performs a permutation operation \({\prod }_{n}\) on S3(1) to obtain a randomized sequence \(S_{3(1)}^{*}\) and randomly selects enough decoy photons from set {|0r〉,|1r〉,| +r〉,|−r〉} inserts sequences \(S_{3(1)}^{*}\) and \(S_{3(2)}^{*}\) to obtain two new sequences \(S_{3(1)}^{**}\) and \(S_{3(2)}^{**}\). Finally, he sends the two sequences to Alice.

    $$ \begin{array}{@{}rcl@{}} |\phi_{r}^{+}\rangle_{C_{11}C_{12}C_{21}C_{22}} &=&\frac{1}{\sqrt{2}}(|0_{r}\rangle|0_{r}\rangle+|1_{r}\rangle|1_{r}\rangle)_{C_{11}C_{12}C_{21}C_{22}}\\ &=&\frac{1}{\sqrt{2}}(|\phi^{+}\rangle|\phi^{+}\rangle+|\psi^{-}\rangle|\psi^{-}\rangle)_{C_{11}C_{21}C_{12}C_{22}}\\ |\phi_{r}^{-}\rangle_{C_{11}C_{12}C_{21}C_{22}} &=&\frac{1}{\sqrt{2}}(|0_{r}\rangle|0_{r}\rangle-|1_{r}\rangle|1_{r}\rangle)_{C_{11}C_{12}C_{21}C_{22}}\\ &=&\frac{1}{\sqrt{2}}(|\phi^{-}\rangle|\phi^{-}\rangle+|\psi^{+}\rangle|\psi^{+}\rangle)_{C_{11}C_{21}C_{12}C_{22}}\\ |\psi_{r}^{+}\rangle_{C_{11}C_{12}C_{21}C_{22}} &=&\frac{1}{\sqrt{2}}(|0_{r}\rangle|1_{r}\rangle+|1_{r}\rangle|0_{r}\rangle)_{C_{11}C_{12}C_{21}C_{22}}\\ &=&\frac{1}{\sqrt{2}}(|\phi^{-}\rangle|\psi^{+}\rangle-|\psi^{+}\rangle|\phi^{-}\rangle)_{C_{11}C_{21}C_{12}C_{22}}\\ |\psi_{r}^{-}\rangle_{C_{11}C_{12}C_{21}C_{22}} &=&\frac{1}{\sqrt{2}}(|0_{r}\rangle|1_{r}\rangle-|1_{r}\rangle|0_{r}\rangle)_{C_{11}C_{12}C_{21}C_{22}}\\ &=&\frac{1}{\sqrt{2}}(|\phi^{+}\rangle|\psi^{-}\rangle-|\psi^{-}\rangle|\phi^{+}\rangle)_{C_{11}C_{21}C_{12}C_{22}}. \end{array} $$
    (13)

  • Step 5 After Alice receives sequences \(S_{3(1)}^{**}\) and \(S_{3(2)}^{**}\), Alice and Bob perform the second eavesdropping detection. The second eavesdropping detection is the same as the first eavesdropping detection. If the error rate is lower than the predetermined threshold, both parties continue the following steps. Otherwise, they will terminate the agreement and start again.

  • Step 6 Alice tells Bob the value of \(K_{A}^{*}\), where \(K_{A}^{*}=K_{A}\oplus H_{A}=({K_{A}^{1}}\oplus {H_{A}^{1}})\|({K_{A}^{2}}\oplus {H_{A}^{2}})\|\ldots \|({K_{A}^{n}}\oplus {H_{A}^{n}})\). According to the value of HA, Bob can infer KA and calculate the shared key K of both parties.

  • Step 7 Bob publicly announces the permutation operation \({\prod }_{n}\), and Alice performs the corresponding inverse permutation operation on the sequence \(S_{3(1)}^{*}\) to obtain the original sequence S3(1). Next, Alice performs Bell measurements on the particles C11,C21 and C12,C22 in sequences S3(1) and \(S_{3(2)}^{*}\). Based on the measurement results, Bob is able to know the logical Bell states constituted by S3(1) and \(S_{3(2)}^{*}\), thus know the Bell states constituted by S31, \(S_{32}^{*}\). According to the initial Bell states, Bob can calculate KA and generate the shared key K.

4 Security Analysis

In the above QKA protocols, the transmitted particles are logical particles that immune to noise interference. Therefore, the two QKA protocols can resist collective dephasing noise and collective rotation noise respectively. In this section, we will discuss the security of the two protocols. The QKA protocol mainly involves two kinds of attacks, including participant attacks and outsider attacks, the outsider attacks include Trojan-horse attack, Intercept-resend attack, Measure-resend attack and Entangle-measure attack. The security analysis will show that the proposed QKA protocols can completely resist these attacks.

Participant attacks :

The delay measurement technique ensures that Bob cannot know the key KA before he announces \(K_{B}^{*}\), so he cannot change his key KB according to KA. Therefore, he cannot successfully execute the participant attack. On the other hand, Alice can only deduce KB after sending the encoded information to Bob, so he can’t change KA according to KB. Thus, Alice can’t execute participant attack either.

Trojan-horse attack :

Trojan attacks mainly include invisible photonic eavesdropping(IPE) and delayed photonic Trojan attacks [24]. Our propose first protocol under collective-dephasing is a one-way QKA protocol. All particles are transmitted only once in the channel, the Trojan-horse attacker has no chance to extract the spy photons from the particle sequences. But in the second protocol under collective-rotation, since the sequence S3 is transmitted twice in the quantum channel, it is possible to receive a Trojan horse attack during the transmission. Fortunately, current technology is well able to defend against such attacks. To be protected from Eve’s IPE attack, a filter is added before all of Bob’s devices so that Eve’s invisible photons will be eavesdropped, and a photon splitter (PNS) is able to split each signal into two parts, thus enabling protection from delayed photon Trojan-horse attacks. In conclusion, in our protocols, an outside eavesdropper Eve is unable to get the agreement key by performing Trojan-horse attack.

Intercept-resend attack :

Take the QKA protocol under collective dephasing noise as an example. If Eve executes the intercept-resend attack, he intercepts \(S_{3}^{*}\) firstly, and then sends the prepared sequence to Bob. However, Eve does not know the position of the decoy particles in sequence \(S_{3}^{*}\) and the measurement basis used, so the sequences forged by Eve cannot pass the first security detection. Similarly, when Eve intercepts \(S_{1}^{**}\) and \(S_{2}^{**}\), its malicious behavior will also be found in the second security detection. When m decoy particles are used to detect this eavesdropping attack, the probability of Eve attack being found is \(1-\frac {1}{2^{m}}\).

Measure-resend attack :

Take the first protocol as an example. Suppose Eve can perform measure-resend attacks on particles in sequences \(S_{3}^{*}\), \(S_{1}^{**}\) and \(S_{2}^{**}\) respectively. However, the measurement of Eve will affect the status of decoy particles in \(S_{3}^{*}\), \(S_{1}^{**}\) and \(S_{2}^{**}\). In the first and second security tests, the probability of Eve attack being found is \(1-(\frac {3}{4})^{m}\) (m refers to the number of decoy particles).

Entangle-measure attack :

In both protocols, assuming that Eve wants to perform an entangle-measure attack on the protocol using his pre-prepared auxiliary particles, he needs to perform the operation \(\widehat {U}\) on the intercepted quantum state. As an example, the process and results of the QKA protocol for immune collective dephasing noise are as follows.

$$ \widehat{U}(|0_{dp}\rangle|E\rangle)=a_{00}|00\rangle|e_{00}\rangle+a_{01}|01\rangle|e_{01}\rangle+a_{10}|10\rangle|e_{10}\rangle+a_{11}|11\rangle|e_{11}\rangle $$
(14)
$$ \widehat{U}(|1_{dp}\rangle|E\rangle)=b_{00}|00\rangle|e_{00}^{*}\rangle+b_{01}|01\rangle|e_{01}^{*}\rangle+b_{10}|10\rangle|e_{10}^{*}\rangle+b_{11}|11\rangle|e_{11}^{*}\rangle $$
(15)
$$ \begin{array}{@{}rcl@{}} \widehat{U}(|+_{dp}\rangle|E\rangle) &=&\frac{1}{\sqrt{2}}(\widehat{U}|0_{dp}\rangle|E\rangle+\widehat{U}|1_{dp}\rangle|E\rangle)\\ &=&\frac{1}{2}[|\phi^{+}\rangle(a_{00}|e_{00}\rangle+a_{11}|e_{11}\rangle+b_{00}|e_{00}^{*}\rangle+b_{11}|e_{11}^{*}\rangle)\\ &&+|\phi^{-}\rangle(a_{00}|e_{00}\rangle-a_{11}|e_{11}\rangle+b_{00}|e_{00}^{*}\rangle-b_{11}|e_{11}^{*}\rangle)\\ &&+|\psi^{+}\rangle(a_{01}|e_{01}\rangle+a_{10}|e_{10}\rangle+b_{01}|e_{01}^{*}\rangle+b_{10}|e_{10}^{*}\rangle)\\ &&+|\psi^{-}\rangle(a_{01}|e_{01}\rangle-a_{10}|e_{10}\rangle+b_{01}|e_{01}^{*}\rangle-b_{10}|e_{10}^{*}\rangle)] \end{array} $$
(16)
$$ \begin{array}{@{}rcl@{}} \widehat{U}(|-_{dp}\rangle|E\rangle) &=&\frac{1}{\sqrt{2}}(\widehat{U}|0_{dp}\rangle|E\rangle-\widehat{U}|1_{dp}\rangle|E\rangle)\\ &=&\frac{1}{2}[|\phi^{+}\rangle(a_{00}|e_{00}\rangle+a_{11}|e_{11}\rangle-b_{00}|e_{00}^{*}\rangle-b_{11}|e_{11}^{*}\rangle)\\ && +|\phi^{-}\rangle(a_{00}|e_{00}\rangle-a_{11}|e_{11}\rangle-b_{00}|e_{00}^{*}\rangle+b_{11}|e_{11}^{*}\rangle)\\ && +|\psi^{+}\rangle(a_{01}|e_{01}\rangle+a_{10}|e_{10}\rangle-b_{01}|e_{01}^{*}\rangle-b_{10}|e_{10}^{*}\rangle)\\ && +|\psi^{-}\rangle(a_{01}|e_{01}\rangle-a_{10}|e_{10}\rangle-b_{01}|e_{01}^{*}\rangle+b_{10}|e_{10}^{*}\rangle)]. \end{array} $$
(17)

Where, |e00〉, |e01〉, |e10〉, |e11〉, \(|e_{00}^{*}\rangle \), \(|e_{01}^{*}\rangle \), \(|e_{10}^{*}\rangle \), \(|e_{11}^{*}\rangle \) are pure states determined by unitary transformation \(\widehat {U}\), and |a00|2 + |a01|2 + |a10|2 + |a11|2 = 1, |b00|2 + |b01|2 + |b10|2 + |b11|2 = 1. If Eve wants to successfully pass the security detection, the following equations must hold.

$$ \left\{ \begin{aligned} & a_{00}|00\rangle|e_{00}\rangle+a_{10}|10\rangle|e_{10}\rangle+a_{11}|11\rangle|e_{11}\rangle=0\\ & b_{00}|00\rangle|e_{00}\rangle+b_{11}|11\rangle|e_{11}\rangle+b_{01}|01\rangle|e_{01}\rangle=0\\ &|\phi^{+}\rangle(a_{00}|e_{00}\rangle+a_{11}|e_{11}\rangle+b_{00}|e_{00}^{*}\rangle+b_{11}|e_{11}^{*}\rangle)+\\ &|\phi^{-}\rangle(a_{00}|e_{00}\rangle-a_{11}|e_{11}\rangle+b_{00}|e_{00}^{*}\rangle-b_{11}|e_{11}^{*}\rangle)+\\ &|\psi^{-}\rangle(a_{01}|e_{01}\rangle-a_{10}|e_{10}\rangle+b_{01}|e_{01}^{*}\rangle-b_{10}|e_{10}^{*}\rangle)]=0\\ &|\phi^{+}\rangle(a_{00}|e_{00}\rangle+a_{11}|e_{11}\rangle-b_{00}|e_{00}^{*}\rangle-b_{11}|e_{11}^{*}\rangle)+\\ &|\phi^{-}\rangle(a_{00}|e_{00}\rangle-a_{11}|e_{11}\rangle-b_{00}|e_{00}^{*}\rangle+b_{11}|e_{11}^{*}\rangle)+\\ &|\psi^{+}\rangle(a_{01}|e_{01}\rangle+a_{10}|e_{10}\rangle-b_{01}|e_{01}^{*}\rangle-b_{10}|e_{10}^{*}\rangle)=0. \end{aligned} \right. $$
(18)

According to (18), |a00| = |a10| = |a11| = |b00| = |b01| = |b11| = 0, \(|e_{01}\rangle =|e_{10}^{*}\rangle \). Obviously, if Eve doesn’t want to be found in the security detection, he won’t get any information about the shared key. Therefore, the protocol can resist entangle-measure attacks.

5 Efficiency Analysis

In QKA protocol, Cabello’s [25] method is used to evaluate qubit efficiency which is defined as

$$ \eta=\frac{c}{q+b}, $$
(19)

where c is the number of classical bits negotiated, q is the number of qubits (including the number of decoy particles) used in the protocol and b is the number of classical bits exchanged for decoding the message. In the proposed QKA protocol, the number of classical bits negotiated is c = 4n, the total number of qubits used in the protocol is q = 6n + 2m + 4m, Bob decodes Alice’s key by U-transformations, so the number of classical bits exchanged for decoding the message is 2n. Therefore, the qubit efficiency of this protocol is as follows: \(\eta =\frac {4n}{6n+2m+4m+2n}\), where m refers to the number of decoy particles, n refers to the number of quantum states. As shown in the Fig. 1. when m < n, on the left side of the line m = n, this case is considered as an unclassified condition and should be excluded. When m > n, the value of the qubit efficiency in this case becomes lower. The value of the qubit efficiency reaches the optimal value only when m = n, i.e. \(\eta =\frac {2}{7}=28.57\%\). The comparison between this protocol and the existing secure QKA protocols that are resistant to collective noise is shown in the Table 2. Obviously, our protocols have higher qubit efficiency.

Fig. 1
figure 1

Effect of changes in the number of decoy particles and quantum states on the qubit efficiency

Full size image
Table 2 Comparison of our protocol and the other QKA protocols
Full size table

6 Conclusion

In this paper, two QKA protocols immune to collective dephasing noise and collective rotation noise are proposed by exploiting the measurement correlation of three-particle GHZ states, respectively. The qubit efficiency reaches 28.57%, which improves the efficiency. Besides, the proposed protocols only use Bell measurements and X basis measurements, which can be easily implemented in the existing technology. Finally, the security analysis also shows that the proposed protocols are resistant to external attacks and internal participants attacks. Using the logical GHZ state, our proposed QKA protocols immune to collective noise is more efficient than previous protocols. But in fact, this efficiency is still extremely low. Therefore, how to improve the efficiency of QKA protocols that are immune to noise may be the next step we should consider.