Two-party quantum key agreement over a collective noisy channel

Abstract

Quantum key agreement (QKA) allows participants to establish a shared key over a quantum channel, and no one of the participants can determine the shared key alone. Actually, particles are usually affected by noise during transmission in the quantum channel, and an aggressor can launch a baleful attack under the cover of noise. In this paper, based on logical Bell states, we propose two robust two-party QKA protocols immune to collective-dephasing noise and collective-rotation noise, respectively. The measurement correlation of quantum entanglement is utilized to establish a shared key. The proposed protocols are globally better in terms of quantum resource cost and qubit efficiency than existing two-party QKA protocols against collective noise. The security analysis demonstrates that they can resist common insider and outsider attacks.

1 Introduction

As a combination of classical cryptography and quantum mechanics, quantum cryptography can achieve unconditional security, where the security is provided by quantum physics laws rather than the difficulty of mathematical computation. Quantum cryptography includes many important branches such as quantum key distribution [1,2,3], quantum secure direct communication [4, 5], quantum secret sharing [6, 7], quantum authentication [8], quantum private comparison [9,10,11], quantum signature [12,13,14,15], quantum private query [16,17,18,19,20,21,22,23,24] and so on.

Recently, key agreement has been introduced into quantum cryptography and pursued. It is aimed to establish shared keys among two or more parties where each party contributes its part to the shared key, and the shared key should not be determined fully by any party alone [25]. Since Zhou et al. proposed the first QKA protocol [26], lots of QKA schemes were proposed [27,28,29,30,31,32,33,34,35,36,37,38,39,40,41].

Most of QKA protocols were presented in the ideal environment [26–41]; that is, it is assumed that there is no noise in the channel. Actually, particles are usually affected by noise during transmission in the quantum channel and an aggressor can launch a baleful attack under the cover of noise. Thus, it is necessary to consider channel noise in the design of QKA protocols. Decoherence-free subspace (DFS) can help to realize reliable particle transmission under collective noise channel [42]. At present, there have been some relevant studies on robust QKA by constructing DF states [43,44,45,46,47,48]. For example, Cai et al. [43] proposed a multiparty QKA protocol against collective noise. Huang et al. [44] gave a QKA protocol and introduced two corresponding variations against collective noise. Later, they also proposed a robust QKA protocol with DF states [45]. In 2016, based on logical χ states, He et al. [46] presented two QKA protocols immune to collective noise. Using logical five-particle states, He et al. [47] proposed two robust QKA protocols. In 2018, based on four-particle logical GHZ states and logical qubits, Gao et al. [48] presented two QKA protocols under collective noise channel.

In existing schemes against collective noise, we found that these protocols usually have some drawbacks like high quantum resource cost or low efficiency. In this paper, based on logical Bell states, we propose two robust two-party QKA protocols over two kinds of collective noise channels, respectively. Our proposed QKA protocols are globally better in terms of quantum resource cost and qubit efficiency than existing two-party QKA protocols against collective noise.

The rest of this paper is organized as follows. The next section introduces relevant theoretical knowledge. In Sect. 3, we give the description of our QKA protocols in detail. Sections 4 and 5 involve the security analysis and the comparison between ours and other QKA protocols against collective noise in terms of quantum resource cost and qubit efficiency, respectively. Finally, a conclusion is given in Sect. 6.

2 Preliminaries

In this article, we discuss two types of collective noises: the collective-dephasing noise and the collective-rotation noise [42]. The collective-dephasing noise can be depicted as follows:

$$ \varpi^{\theta } :\left| 0 \right\rangle \to \left| 0 \right\rangle ,\quad \varpi^{\theta } :\left| 1 \right\rangle \to e^{i\theta } \left| 1 \right\rangle . $$

(1)

Then, the collective-rotation noise can be formalized by

$$ \varpi^{\sigma } :\left| 0 \right\rangle \to \cos \sigma \left| 0 \right\rangle + \sin \sigma \left| 1 \right\rangle ,\varpi^{\sigma } :\left| 1 \right\rangle \to - \sin \sigma \left| 0 \right\rangle + \cos \sigma \left| 1 \right\rangle . $$

(2)

where $\theta$ and $\sigma$ are the fluctuation factors of the noise with time.

There are two nonorthogonal bases $\left\{ {\left| 0 \right\rangle ,\left| 1 \right\rangle } \right\}$ (Z-basis) and $\left\{ {\left| + \right\rangle ,\left| - \right\rangle } \right\}$ (X-basis), where $\left| + \right\rangle = \frac{1}{\sqrt 2 }\left( {\left| 0 \right\rangle + \left| 1 \right\rangle } \right)$ and $\left| - \right\rangle = \frac{1}{\sqrt 2 }\left( {\left| 0 \right\rangle - \left| 1 \right\rangle } \right)$. Four Bell states are defined as $\left| {\varphi^{ \pm } } \right\rangle = \frac{1}{\sqrt 2 }\left( {\left| {00} \right\rangle \pm \left| {11} \right\rangle } \right)$ and $\left| {\psi^{ \pm } } \right\rangle = \frac{1}{\sqrt 2 }\left( {\left| {01} \right\rangle \pm \left| {10} \right\rangle } \right)$. The four Pauli operations are defined as

$$ I = \left| 0 \right\rangle \left\langle 0 \right| + \left| 1 \right\rangle \left\langle 1 \right|,\quad X = \left| 1 \right\rangle \left\langle 0 \right| + \left| 0 \right\rangle \left\langle 1 \right|,\quad Z = \left| 0 \right\rangle \left\langle 0 \right| - \left| 1 \right\rangle \left\langle 1 \right|,\quad iY = \left| 0 \right\rangle \left\langle 1 \right| - \left| 1 \right\rangle \left\langle 0 \right|. $$

According to the characteristics of the collective-dephasing noise [42], the subspaces $\left\{ {\left| {0_{dp} } \right\rangle ,\left| {1_{dp} } \right\rangle } \right\}$ and $\left\{ {\left| { +_{dp} } \right\rangle ,\left| { -_{dp} } \right\rangle } \right\}$ can form a DFS against the collective-dephasing noise, where $\left| {0_{dp} } \right\rangle = \left| {01} \right\rangle$, $\left| {1_{dp} } \right\rangle = \left| {10} \right\rangle$, $\left| { \pm_{dp} } \right\rangle = \frac{1}{\sqrt 2 }\left( {\left| {0_{dp} } \right\rangle \pm \left| {1_{dp} } \right\rangle } \right) = \left| {\psi^{ \pm } } \right\rangle$. Similarly, the subspaces $\left\{ {\left| {0_{r} } \right\rangle ,\left| {1_{r} } \right\rangle } \right\}$ and $\left\{ {\left| { +_{r} } \right\rangle ,\left| { -_{r} } \right\rangle } \right\}$ can form a DFS against the collective-rotation noise, where $\left| {0_{r} } \right\rangle = \left| {\varphi^{ + } } \right\rangle$, $\left| {1_{r} } \right\rangle = \left| {\psi^{ - } } \right\rangle$, $\left| { \pm_{r} } \right\rangle = \frac{1}{\sqrt 2 }\left( {\left| {0_{r} } \right\rangle \pm \left| {1_{r} } \right\rangle } \right) = \frac{1}{\sqrt 2 }\left( {\left| {\varphi^{ + } } \right\rangle \pm \left| {\psi^{ - } } \right\rangle } \right)$.

The four logical Bell states are shown as follows:

$$ \left| {\varPhi_{dp}^{ + } } \right\rangle_{1234} = \frac{1}{\sqrt 2 }\left( {\left| {0_{dp} } \right\rangle \left| {0_{dp} } \right\rangle + \left| {1_{dp} } \right\rangle \left| {1_{dp} } \right\rangle } \right)_{1234} = \frac{1}{\sqrt 2 }\left( {\left| {\varphi^{ + } } \right\rangle \left| {\varphi^{ + } } \right\rangle - \left| {\varphi^{ - } } \right\rangle \left| {\varphi^{ - } } \right\rangle } \right)_{1324} , $$

(3)

$$ \left| {\varPhi_{dp}^{ - } } \right\rangle_{1234} = \frac{1}{\sqrt 2 }\left( {\left| {0_{dp} } \right\rangle \left| {0_{dp} } \right\rangle - \left| {1_{dp} } \right\rangle \left| {1_{dp} } \right\rangle } \right)_{1234} = \frac{1}{\sqrt 2 }\left( {\left| {\varphi^{ - } } \right\rangle \left| {\varphi^{ + } } \right\rangle - \left| {\varphi^{ + } } \right\rangle \left| {\varphi^{ - } } \right\rangle } \right)_{1324} , $$

(4)

$$ \left| {\varPsi_{dp}^{ + } } \right\rangle_{1234} = \frac{1}{\sqrt 2 }\left( {\left| {0_{dp} } \right\rangle \left| {1_{dp} } \right\rangle + \left| {1_{dp} } \right\rangle \left| {0_{dp} } \right\rangle } \right)_{1234} = \frac{1}{\sqrt 2 }\left( {\left| {\psi^{ + } } \right\rangle \left| {\psi^{ + } } \right\rangle - \left| {\psi^{ - } } \right\rangle \left| {\psi^{ - } } \right\rangle } \right)_{1324} , $$

(5)

$$ \left| {\varPsi_{dp}^{ - } } \right\rangle_{1234} = \frac{1}{\sqrt 2 }\left( {\left| {0_{dp} } \right\rangle \left| {1_{dp} } \right\rangle - \left| {1_{dp} } \right\rangle \left| {0_{dp} } \right\rangle } \right)_{1234} = \frac{1}{\sqrt 2 }\left( {\left| {\psi^{ - } } \right\rangle \left| {\psi^{ + } } \right\rangle - \left| {\psi^{ + } } \right\rangle \left| {\psi^{ - } } \right\rangle } \right)_{1324} , $$

(6)

Obviously, these four logical Bell states are immune to the collective-dephasing noise. Similarly, the following four logical Bell states are resistant to the collective-rotation noise:

$$ \left| {\varPhi_{r}^{ + } } \right\rangle_{1234} = \frac{1}{\sqrt 2 }\left( {\left| {0_{r} } \right\rangle \left| {0_{r} } \right\rangle + \left| {1_{r} } \right\rangle \left| {1_{r} } \right\rangle } \right)_{1234} = \frac{1}{\sqrt 2 }\left( {\left| {\varphi^{ + } } \right\rangle \left| {\varphi^{ + } } \right\rangle + \left| {\psi^{ - } } \right\rangle \left| {\psi^{ - } } \right\rangle } \right)_{1324} , $$

(7)

$$ \left| {\varPhi_{r}^{ - } } \right\rangle_{1234} = \frac{1}{\sqrt 2 }\left( {\left| {0_{r} } \right\rangle \left| {0_{r} } \right\rangle - \left| {1_{r} } \right\rangle \left| {1_{r} } \right\rangle } \right)_{1234} = \frac{1}{\sqrt 2 }\left( {\left| {\varphi^{ - } } \right\rangle \left| {\varphi^{ - } } \right\rangle + \left| {\psi^{ + } } \right\rangle \left| {\psi^{ + } } \right\rangle } \right)_{1324} , $$

(8)

$$ \left| {\varPsi_{r}^{ + } } \right\rangle_{1234} = \frac{1}{\sqrt 2 }\left( {\left| {0_{r} } \right\rangle \left| {1_{r} } \right\rangle + \left| {1_{r} } \right\rangle \left| {0_{r} } \right\rangle } \right)_{1234} = \frac{1}{\sqrt 2 }\left( {\left| {\varphi^{ - } } \right\rangle \left| {\psi^{ + } } \right\rangle - \left| {\psi^{ + } } \right\rangle \left| {\varphi^{ - } } \right\rangle } \right)_{1324} , $$

(9)

$$ \left| {\varPsi_{r}^{ - } } \right\rangle_{1234} = \frac{1}{\sqrt 2 }\left( {\left| {0_{r} } \right\rangle \left| {1_{r} } \right\rangle - \left| {1_{dp} } \right\rangle \left| {0_{r} } \right\rangle } \right)_{1234} = \frac{1}{\sqrt 2 }\left( {\left| {\varphi^{ + } } \right\rangle \left| {\psi^{ - } } \right\rangle - \left| {\psi^{ - } } \right\rangle \left| {\varphi^{ + } } \right\rangle } \right)_{1324} . $$

(10)

Let us define the four unitary operations under the collective-dephasing noise as

$$ U_{00}^{dp} = I \otimes I,\quad U_{01}^{dp} = Z \otimes I,\quad U_{10}^{dp} = X \otimes X,\quad U_{11}^{dp} = iY \otimes X, $$

(11)

and the four unitary operations under the collective-rotation noise as:

$$ U_{00}^{r} = I \otimes I,\quad U_{01}^{r} = Z \otimes Z,\quad U_{10}^{r} = Z \otimes X,\quad U_{11}^{r} = I \otimes iY. $$

(12)

A logical quantum state against the collective-dephasing noise can be constructed as

$$ \begin{aligned} \left| {\varLambda_{dp} } \right\rangle & = \left| {\varPhi_{dp}^{ + } } \right\rangle_{{A_{1} A_{2} B_{1} B_{2} }} \otimes \left| {\varPhi_{dp}^{ + } } \right\rangle_{{A_{3} A_{4} B_{3} B_{4} }} \\ & = \frac{1}{\sqrt 2 }\left( {\left| {0_{dp} } \right\rangle \left| {0_{dp} } \right\rangle + \left| {1_{dp} } \right\rangle \left| {1_{dp} } \right\rangle } \right)_{{A_{1} A_{2} B_{1} B_{2} }} \otimes \frac{1}{\sqrt 2 }\left( {\left| {0_{dp} } \right\rangle \left| {0_{dp} } \right\rangle + \left| {1_{dp} } \right\rangle \left| {1_{dp} } \right\rangle } \right)_{{A_{3} A_{4} B_{3} B_{4} }} \\ & = \frac{1}{4}\left( {\left| {\varphi^{ + } } \right\rangle \left| {\varphi^{ + } } \right\rangle \left| {\varphi^{ + } } \right\rangle \left| {\varphi^{ + } } \right\rangle - \left| {\varphi^{ + } } \right\rangle \left| {\varphi^{ + } } \right\rangle \left| {\varphi^{ - } } \right\rangle \left| {\varphi^{ - } } \right\rangle + \left| {\varphi^{ + } } \right\rangle \left| {\varphi^{ - } } \right\rangle \left| {\varphi^{ + } } \right\rangle \left| {\varphi^{ - } } \right\rangle } \right. \\ & \quad - \left| {\varphi^{ + } } \right\rangle \left| {\varphi^{ - } } \right\rangle \left| {\varphi^{ - } } \right\rangle \left| {\varphi^{ + } } \right\rangle - \left| {\varphi^{ - } } \right\rangle \left| {\varphi^{ + } } \right\rangle \left| {\varphi^{ + } } \right\rangle \left| {\varphi^{ - } } \right\rangle + \left| {\varphi^{ - } } \right\rangle \left| {\varphi^{ + } } \right\rangle \left| {\varphi^{ - } } \right\rangle \left| {\varphi^{ + } } \right\rangle \\ & \quad - \left| {\varphi^{ - } } \right\rangle \left| {\varphi^{ - } } \right\rangle \left| {\varphi^{ + } } \right\rangle \left| {\varphi^{ + } } \right\rangle + \left| {\varphi^{ - } } \right\rangle \left| {\varphi^{ - } } \right\rangle \left| {\varphi^{ - } } \right\rangle \left| {\varphi^{ - } } \right\rangle + \left| {\psi^{ + } } \right\rangle \left| {\psi^{ + } } \right\rangle \left| {\psi^{ + } } \right\rangle \left| {\psi^{ + } } \right\rangle \\ & \quad - \left| {\psi^{ + } } \right\rangle \left| {\psi^{ + } } \right\rangle \left| {\psi^{ - } } \right\rangle \left| {\psi^{ - } } \right\rangle + \left| {\psi^{ + } } \right\rangle \left| {\psi^{ - } } \right\rangle \left| {\psi^{ + } } \right\rangle \left| {\psi^{ - } } \right\rangle - \left| {\psi^{ + } } \right\rangle \left| {\psi^{ - } } \right\rangle \left| {\psi^{ - } } \right\rangle \left| {\psi^{ + } } \right\rangle \\ & \quad - \left| {\psi^{ - } } \right\rangle \left| {\psi^{ + } } \right\rangle \left| {\psi^{ + } } \right\rangle \left| {\psi^{ - } } \right\rangle + \left| {\psi^{ - } } \right\rangle \left| {\psi^{ + } } \right\rangle \left| {\psi^{ - } } \right\rangle \left| {\psi^{ + } } \right\rangle - \left| {\psi^{ - } } \right\rangle \left| {\psi^{ - } } \right\rangle \left| {\psi^{ + } } \right\rangle \left| {\psi^{ + } } \right\rangle \\ & \quad \left. { + \left| {\psi^{ - } } \right\rangle \left| {\psi^{ - } } \right\rangle \left| {\psi^{ - } } \right\rangle \left| {\psi^{ - } } \right\rangle } \right)_{{A_{1} A_{3} A_{2} A_{4} B_{1} B_{3} B_{2} B_{4} }} \\ & = \frac{1}{2}\left( {\left| {\varPhi_{dp}^{ + } } \right\rangle \left| {\varPhi_{dp}^{ + } } \right\rangle + \left| {\varPhi_{dp}^{ - } } \right\rangle \left| {\varPhi_{dp}^{ - } } \right\rangle + \left| {\varPsi_{dp}^{ + } } \right\rangle \left| {\varPsi_{dp}^{ + } } \right\rangle + \left| {\varPsi_{dp}^{ - } } \right\rangle \left| {\varPsi_{dp}^{ - } } \right\rangle } \right)_{{A_{1} A_{3} A_{2} A_{4} B_{1} B_{3} B_{2} B_{4} }} \\ \end{aligned} , $$

(13)

and the logical quantum state against the collective-rotation noise is given by:

$$ \begin{aligned} \left| {\varLambda_{r} } \right\rangle & = \left| {\varPhi_{r}^{ + } } \right\rangle_{{A_{1} A_{2} B_{1} B_{2} }} \otimes \left| {\varPhi_{r}^{ + } } \right\rangle_{{A_{3} A_{4} B_{3} B_{4} }} \\ & = \frac{1}{\sqrt 2 }\left( {\left| {\varphi^{ + } } \right\rangle \left| {\varphi^{ + } } \right\rangle + \left| {\psi^{ - } } \right\rangle \left| {\psi^{ - } } \right\rangle } \right)_{{A_{1} A_{2} B_{1} B_{2} }} \otimes \frac{1}{\sqrt 2 }\left( {\left| {\varphi^{ + } } \right\rangle \left| {\varphi^{ + } } \right\rangle + \left| {\psi^{ - } } \right\rangle \left| {\psi^{ - } } \right\rangle } \right)_{{A_{3} A_{4} B_{3} B_{4} }} \\ & = \frac{1}{2}\left( {\left| {\varPhi_{r}^{ + } } \right\rangle \left| {\varPhi_{r}^{ + } } \right\rangle + \left| {\varPhi_{r}^{ - } } \right\rangle \left| {\varPhi_{r}^{ - } } \right\rangle + \left| {\varPsi_{r}^{ + } } \right\rangle \left| {\varPsi_{r}^{ + } } \right\rangle + \left| {\varPsi_{r}^{ - } } \right\rangle \left| {\varPsi_{r}^{ - } } \right\rangle } \right)_{{A_{1} A_{3} A_{2} A_{4} B_{1} B_{3} B_{2} B_{4} }} , \\ \end{aligned} $$

(14)

where the subscripts $A_{i}$ and $B_{i}$ $\left( {i = 1,2,3,4} \right)$ represent physical qubits. So $\left| {\varLambda_{dp} } \right\rangle$ and $\left| {\varLambda_{r} } \right\rangle$ are composed of eight physical qubits, respectively.

Table 1 shows the transformations of the four logical Bell states $\left| {\varPhi_{L}^{ + } } \right\rangle$, $\left| {\varPhi_{L}^{ - } } \right\rangle$, $\left| {\varPsi_{L}^{ + } } \right\rangle$, $\left| {\varPsi_{L}^{ - } } \right\rangle$ under $U_{00}^{L}$, $U_{01}^{L}$, $U_{10}^{L}$, $U_{11}^{L}$, respectively. Here, L represents ‘dp’ or ‘r.’

Table 1 Transformations between four logical Bell states

3 Description of the QKA protocol

Step (1) Alice and Bob randomly generate their 2n-bit secret keys, respectively:

$$ K_{A} = \{ K_{A}^{1} ,K_{A}^{2} , \ldots ,K_{A}^{n} \} ,\quad K_{B} = \{ K_{B}^{1} ,K_{B}^{2} , \ldots ,K_{B}^{n} \} , $$

where $K_{A}^{i} ,K_{B}^{i} \in \left\{ {00,01,10,11} \right\}$ for $i = 1,2, \ldots ,n$.

Alice and Bob agree on the coding rules: $\left| {\varPhi_{L}^{ + } } \right\rangle$:00, $\left| {\varPhi_{L}^{ - } } \right\rangle$:01, $\left| {\varPsi_{L}^{ + } } \right\rangle$:10, $\left| {\varPsi_{L}^{ - } } \right\rangle$:11.

Step (2) Alice prepares a sequence including n quantum states

$$ \begin{aligned} \left| {\varLambda_{L} } \right\rangle & = \left| {\varPhi_{L}^{ + } } \right\rangle_{{A_{1} A_{2} B_{1} B_{2} }} \otimes \left| {\varPhi_{L}^{ + } } \right\rangle_{{A_{3} A_{4} B_{3} B_{4} }} \\ & = \frac{1}{2}\left( {\left| {\varPhi_{L}^{ + } } \right\rangle \, \left| {\varPhi_{L}^{ + } } \right\rangle + \left| {\varPhi_{L}^{ - } } \right\rangle \left| {\varPhi_{L}^{ - } } \right\rangle + \left| {\varPsi_{L}^{ + } } \right\rangle \left| {\varPsi_{L}^{ + } } \right\rangle + \left| {\varPsi_{L}^{ - } } \right\rangle \left| {\varPsi_{L}^{ - } } \right\rangle } \right)_{{A_{1} A_{3} A_{2} A_{4} B_{1} B_{3} B_{2} B_{4} }} , \\ \end{aligned} $$

where L represents ‘dp’ or ‘r,’ and Alice divides these quantum states into two ordered sequences $S_{A}$ and $S_{B}$, where the sequences $S_{A}$ and $S_{B}$ are composed of qubits $\left[ {\left( {A_{1}^{1} ,A_{2}^{1} ,A_{3}^{1} ,A_{4}^{1} } \right), \ldots ,\left( {A_{1}^{n} ,A_{2}^{n} ,A_{3}^{n} ,A_{4}^{n} } \right)} \right]$ and $\left[ {\left( {B_{1}^{1} ,B_{2}^{1} ,B_{3}^{1} ,B_{4}^{1} } \right), \ldots ,\left( {B_{1}^{n} ,B_{2}^{n} ,B_{3}^{n} ,B_{4}^{n} } \right)} \right]$, respectively. Alice prepares decoy logical qubits each of which is randomly in one of the four nonorthogonal logical states $\left\{ {\left| {0_{L} } \right\rangle ,\left| {1_{L} } \right\rangle ,\left| { +_{L} } \right\rangle ,\left| { -_{L} } \right\rangle } \right\}$, inserts them into $S_{B}$ randomly to obtain $S_{B}^{'}$ and keeps a record of the inserting positions. The number of decoy states can be set to $\delta$ which is enough for eavesdropping check. Then, Alice sends $S_{B}^{'}$ to Bob via the quantum channel and keeps the sequence $S_{A}$ herself.

Step (3) The first security check for checking eavesdropping. After Bob receives the sequence $S_{B}^{'}$, Alice announces the positions and the measurement basis of the decoy logical qubits. By utilizing the announced basis, Bob measures the decoy logical qubits and announces their measurement results. Alice computes the error rate by comparing the measurement results and the initial states of the decoy logical qubits. If the error rate is less than the given threshold value $\varepsilon$, they will perform the next step. Otherwise, Alice and Bob will terminate this protocol and restart it.

Step (4) Alice and Bob perform the measurement on qubits $\left( {A_{1}^{i} ,A_{3}^{i} ,A_{2}^{i} ,A_{4}^{i} } \right)$ and $\left( {B_{1}^{i} ,B_{3}^{i} ,B_{2}^{i} ,B_{4}^{i} } \right)$ with the basis { $\left| {\varPhi_{L}^{ + } } \right\rangle$, $\left| {\varPhi_{L}^{ - } } \right\rangle$, $\left| {\varPsi_{L}^{ + } } \right\rangle$, $\left| {\varPsi_{L}^{ - } } \right\rangle$ } for $i = 1,2, \ldots ,n$, respectively. After the measurement, the quantum states in $S_{A}$ and $S_{B}$ collapse into the new quantum state sequences $S_{A}^{1}$ and $S_{B}^{1}$, respectively. Concretely, after the measurement, the state $\left| {\varLambda_{L} } \right\rangle$ collapses into one of the four states $\left\{ {\left| {\varPhi_{L}^{ + } } \right\rangle \, \left| {\varPhi_{L}^{ + } } \right\rangle ,\left| {\varPhi_{L}^{ - } } \right\rangle \left| {\varPhi_{L}^{ - } } \right\rangle ,\left| {\varPsi_{L}^{ + } } \right\rangle \left| {\varPsi_{L}^{ + } } \right\rangle ,\left| {\varPsi_{L}^{ - } } \right\rangle \left| {\varPsi_{L}^{ - } } \right\rangle } \right\}$. Alice and Bob can deduce the post-measurement states of each other according to the measurement correlation of Eqs. (13) and (14). According to the coding rules: $\left| {\varPhi_{L}^{ + } } \right\rangle$:00, $\left| {\varPhi_{L}^{ - } } \right\rangle$:01, $\left| {\varPsi_{L}^{ + } } \right\rangle$:10, $\left| {\varPsi_{L}^{ - } } \right\rangle$:11, Alice and Bob’s post-measurement states are translated into a classical bit string $M = M_{1} ||M_{2} || \cdots ||M_{n}$, where $M_{i} \in \left\{ {00,01,10,11} \right\}$ $\left( {i = 1,2, \ldots ,n} \right)$. For example, if the post-measurement state of Alice’s and Bob’s qubits is $\left| {\varPhi_{L}^{ + } } \right\rangle$, they can translate it into $M_{i} = 00$. The similar conclusions can be obtained for other post-measurement states.

Step (5) Alice can encode the key $K_{A}^{i}$ by performing the unitary operation $U_{{K_{A}^{i} }}^{L}$ on her ith post-measurement state in $S_{A}^{1}$ to obtain the encoded quantum state sequence $S_{A}^{2}$. Later, Alice selects a permutation operator $\varPi_{n}$ randomly and performs the permutation operator $\varPi_{n}$ on $S_{A}^{2}$ to obtain the new quantum state sequence $S_{A}^{3}$. Then, Alice randomly selects $\delta$ decoy states from $\left\{ {\left| {0_{L} } \right\rangle ,\left| {1_{L} } \right\rangle ,\left| { +_{L} } \right\rangle ,\left| { -_{L} } \right\rangle } \right\}$, inserts them into $S_{A}^{3}$ randomly to obtain the new quantum state sequence $S_{A}^{{3{\prime }}}$ and keeps a record of the inserting positions. Alice sends $S_{A}^{{3{\prime }}}$ to Bob via the quantum channel.

Step (6) Similar to the first security check, two parties perform the second eavesdropping check after Bob receives the sequence $S_{A}^{{3{\prime }}}$.

Step (7) Bob informs Alice the value $K_{B}^{'} = \left\{ {K_{B}^{1} \oplus M_{1} ,K_{B}^{2} \oplus M_{2} , \ldots ,K_{B}^{n} \oplus M_{n} } \right\}$. So according to the value $M$, Alice can derive the key $K_{B}$.

Step (8) Alice publishes the permutation operator $\varPi_{n}$ so that Bob applies its inverse permutation on the sequence $S_{A}^{3}$ to obtain $S_{A}^{2}$ and then measures these states. By comparing his measurement results and his post-measurement states obtained in step (4), Bob can deduce $K_{A}$ according to Table 1. For example, if his post-measurement state in step (4) is $\left| {\varPhi_{L}^{ + } } \right\rangle$ and his post-measurement state in step (8) is $\left| {\varPhi_{L}^{ - } } \right\rangle$, Bob can infer Alice’s operation $U_{{K_{A}^{i} }}^{L}$ is $U_{01}^{L}$ and obtain Alice’s key bits $K_{A}^{i} = 01$.

Step (9) Alice and Bob compute the shared key $K_{AB} = \left( {K_{A} \oplus K_{B} } \right)||\left( {K_{A} \oplus K_{B} \oplus M} \right)$.

4 Security analysis

In this section, we will discuss the security of the protocol. The security analysis shows that the proposed QKA protocol can resist common attacks from the internal and external attackers. For the outsider eavesdropper Eve, she maybe tries to obtain Alice and Bob’s agreement key $K_{AB}$ by taking various attacks including the passive attack and the active attack.

4.1 Outsider attack

4.1.1 Active attack from the outside eavesdropper

Assume Eve wants to get the shared key. She has to eavesdrop the information of $M$ and $K_{A}$. The possible attacks are Trojan horse attacks, the intercept-resend attack and the entangle-measure attack.

• Trojan horse attacks

Trojan horse attack is a common attack in classical cryptography. Trojan horse attack may be generated from the drawback of construction of the system (e.g., device, computer program, algorithm or protocol). When a Trojan horse is hidden without easy detection in a system, the attacker can break the system and obtain useful information by employing Trojan horses.

Unfortunately, this attack is also available in quantum cryptography [49,50,51,52,53]. Trojan horse attacks are major threats for two-way quantum communication protocols [49,50,51,52,53]. There are several kinds of common Trojan horse attacks such as the general Trojan horse attack [49], the invisible-photon Trojan horse attack [50], the large pulse attack [51] and the delay-photon Trojan horse attack [52, 53]. The first one is the general Trojan horse attack [49], in which Eve sends a light pulse to Alice, same as Bob. The second one is the invisible-photon Trojan horse attack [50]. Its main idea is that Eve inserts an invisible photon in each signal prepared by Bob and sends it to Alice. As Alice’s detector cannot click this photon and performs a unitary operation on each signal, Eve can steal the information about Alice’s operation by means that she intercepts the signal operated and separates the invisible photon from each signal. With the measurement on the invisible photon, Eve can read out Alice’s information. The third one is the so-called large pulse Trojan horse attack [51], in which Eve probes the properties of a component inside Alice or Bob by sending in a bright pulse and analyzing a suitable back-reflected pulse. The last one is the delay-photon Trojan horse attack [52, 53]. Concretely, Eve intercepts the signal transmitted from Bob to Alice and then inserts a fake photon in the signal with a delay time, shorter than the time windows [49]. In this way, Alice cannot detect this fake photon as it does not click Alice’s detector. After the operation done by Alice, Eve intercepts the signal again and separates the fake photon. She can get the full information about Alice’s operation with measurement. To prevent those attacks, a photon number splitter (PNS:50/50) and a wavelength filter can be used. In practice, PNS is not easy to be implemented with current technology [49], and a photon beam splitter (PBS:50/50) can be used to replace the PNS. In this way, a PBS and a wavelength filter can be used to protect the two-way quantum communication protocols against these types of Trojan horse attacks.

In the proposed QKA protocol, since each particle is transmitted only once via the quantum channel. Thus, the proposed QKA protocol can resist Trojan horse attacks.

• Intercept-resend attack

In this paper, the decoy particles are chosen randomly from four nonorthogonal logical quantum states $\left\{ {\left| {0_{L} } \right\rangle ,\left| {1_{L} } \right\rangle ,\left| { +_{L} } \right\rangle ,\left| { -_{L} } \right\rangle } \right\}$ and then randomly inserted into the transmitted sequences. Eve does not know the positions and the states of the decoy logical qubits before the eavesdropping check. If Eve performs the intercept-resend attack and measures it randomly with the basis $\left\{ {\left| {0_{L} } \right\rangle ,\left| {1_{L} } \right\rangle } \right\}$ or $\left\{ {\left| { +_{L} } \right\rangle ,\left| { -_{L} } \right\rangle } \right\}$, similar to the BB84 protocol [1], her attack will be discovered with the probability of $1 - \left( {\frac{3}{4}} \right)^{\delta }$. Here, $\delta$ denotes the number of decoy logical qubits.

• Entangle-measure attack

In this attack, Eve uses an auxiliary particle to interact with the travel particles and measures the auxiliary particle to get some useful information. Later, it will be shown that Eve cannot achieve any information about the message in the condition that no errors are to occur. In the eavesdropping process, Eve adds the ancilla $\left| E \right\rangle$ and performs the unitary operation $U$ on the transmitted logical qubits and her ancillary qubits $\left| E \right\rangle$. Here, we take the collective-dephasing noise as an example. The similar conclusion can be obtained for the collective-rotation noise. The most general operation $U$ Eve can do can be written as:

$$ U\left( {\left| {0_{dp} } \right\rangle \left| E \right\rangle } \right) = a_{00} \left| {00} \right\rangle \left| {e_{0} e_{0} } \right\rangle + a_{01} \left| {01} \right\rangle \left| {e_{0} e_{1} } \right\rangle + a_{10} \left| {10} \right\rangle \left| {e_{1} e_{0} } \right\rangle + a_{11} \left| {11} \right\rangle \left| {e_{1} e_{1} } \right\rangle , $$

(15)

$$ U\left( {\left| {1_{dp} } \right\rangle \left| E \right\rangle } \right) = b_{00} \left| {00} \right\rangle \left| {e_{0}^{'} e_{0}^{'} } \right\rangle + b_{01} \left| {01} \right\rangle \left| {e_{0}^{'} e_{1}^{'} } \right\rangle + b_{10} \left| {10} \right\rangle \left| {e_{1}^{'} e_{0}^{'} } \right\rangle + b_{11} \left| {11} \right\rangle \left| {e_{1}^{'} e_{1}^{'} } \right\rangle , $$

(16)

$$ \begin{aligned} U\left( {\left| { +_{dp} } \right\rangle \left| E \right\rangle } \right) & = \frac{1}{\sqrt 2 }\left( {U\left( {\left| {0_{dp} } \right\rangle \left| E \right\rangle } \right) + U\left( {\left| {1_{dp} } \right\rangle \left| E \right\rangle } \right)} \right) \\ & = \frac{1}{2}\left[ {\left| {\varphi^{ + } } \right\rangle \left( {a_{00} \left| {e_{0} e_{0} } \right\rangle + a_{11} \left| {e_{1} e_{1} } \right\rangle + b_{00} \left| {e_{0}^{'} e_{0}^{'} } \right\rangle + b_{11} \left| {e_{1}^{'} e_{1}^{'} } \right\rangle } \right)} \right. \\ & \quad + \left| {\varphi^{ - } } \right\rangle \left( {a_{00} \left| {e_{0} e_{0} } \right\rangle - a_{11} \left| {e_{1} e_{1} } \right\rangle + b_{00} \left| {e_{0}^{'} e_{0}^{'} } \right\rangle - b_{11} \left| {e_{1}^{'} e_{1}^{'} } \right\rangle } \right) \\ & \quad + \left| {\psi^{ + } } \right\rangle \left( {a_{01} \left| {e_{0} e_{1} } \right\rangle + a_{10} \left| {e_{1} e_{0} } \right\rangle + b_{01} \left| {e_{0}^{'} e_{1}^{'} } \right\rangle + b_{10} \left| {e_{1}^{'} e_{0}^{'} } \right\rangle } \right) \\ & \quad \left. { + \left| {\psi^{ - } } \right\rangle \left( {a_{01} \left| {e_{0} e_{1} } \right\rangle - a_{10} \left| {e_{1} e_{0} } \right\rangle + b_{01} \left| {e_{0}^{'} e_{1}^{'} } \right\rangle - b_{10} \left| {e_{1}^{'} e_{0}^{'} } \right\rangle } \right)} \right], \\ \end{aligned} $$

(17)

$$ \begin{aligned} U\left( {\left| { -_{dp} } \right\rangle \left| E \right\rangle } \right) & = \frac{1}{\sqrt 2 }\left( {U\left( {\left| {0_{dp} } \right\rangle \left| E \right\rangle } \right) - U\left( {\left| {1_{dp} } \right\rangle \left| E \right\rangle } \right)} \right) \\ & = \frac{1}{2}\left[ {\left| {\varphi^{ + } } \right\rangle \left( {a_{00} \left| {e_{0} e_{0} } \right\rangle + a_{11} \left| {e_{1} e_{1} } \right\rangle - b_{00} \left| {e_{0}^{'} e_{0}^{'} } \right\rangle + b_{11} \left| {e_{1}^{'} e_{1}^{'} } \right\rangle } \right)} \right. \\ & \quad + \left| {\varphi^{ - } } \right\rangle \left( {a_{00} \left| {e_{0} e_{0} } \right\rangle - a_{11} \left| {e_{1} e_{1} } \right\rangle - b_{00} \left| {e_{0}^{'} e_{0}^{'} } \right\rangle - b_{11} \left| {e_{1}^{'} e_{1}^{'} } \right\rangle } \right) \\ & \quad + \left| {\psi^{ + } } \right\rangle \left( {a_{01} \left| {e_{0} e_{1} } \right\rangle + a_{10} \left| {e_{1} e_{0} } \right\rangle - b_{01} \left| {e_{0}^{'} e_{1}^{'} } \right\rangle + b_{10} \left| {e_{1}^{'} e_{0}^{'} } \right\rangle } \right) \\ & \quad \left. { + \left| {\psi^{ - } } \right\rangle \left( {a_{01} \left| {e_{0} e_{1} } \right\rangle - a_{10} \left| {e_{1} e_{0} } \right\rangle - b_{01} \left| {e_{0}^{'} e_{1}^{'} } \right\rangle - b_{10} \left| {e_{1}^{'} e_{0}^{'} } \right\rangle } \right)} \right], \\ \end{aligned} $$

(18)

where $\left| {e_{i} e_{j} } \right\rangle$ and $\left| {e_{i}^{'} e_{j}^{'} } \right\rangle$ $\left( {i,j \in \left\{ {0,1} \right\}} \right)$ are the pure ancilla’s states determined uniquely by the unitary operation $U$. According to the normalization and orthogonality of quantum states, it should be satisfied, i.e.,

$$ \begin{aligned} & \left\langle E \right|\left\langle {0_{dp} } \right|U^{ + } U\left| {1_{dp} } \right\rangle \left| E \right\rangle \\ & \quad = (a_{00} \left| {00} \right\rangle \left| {e_{0} e_{0} } \right\rangle + a_{01} \left| {01} \right\rangle \left| {e_{0} e_{1} } \right\rangle + a_{10} \left| {10} \right\rangle \left| {e_{1} e_{0} } \right\rangle + a_{11} \left| {11} \right\rangle \left| {e_{1} e_{1} } \right\rangle )^{ + } \\ & (b_{00} \left| {00} \right\rangle \left| {e_{0}^{'} e_{0}^{'} } \right\rangle + b_{01} \left| {01} \right\rangle \left| {e_{0}^{'} e_{1}^{'} } \right\rangle + b_{10} \left| {10} \right\rangle \left| {e_{1}^{'} e_{0}^{'} } \right\rangle + b_{11} \left| {11} \right\rangle \left| {e_{1}^{'} e_{1}^{'} } \right\rangle ) = 0. \\ \end{aligned} $$

(19)

According to the unitary property, $UU^{ + } = I$, it should be satisfied, i.e.,

$$ \sum\limits_{i,j = 0,1} {\left| {a_{ij} } \right|^{2} \left\langle {e_{i} e_{j} |e_{i} e_{j} } \right\rangle = 1} ,\quad \sum\limits_{i,j = 0,1} {\left| {b_{ij} } \right|^{2} \left\langle {e_{i}^{'} e_{j}^{'} |e_{i}^{'} e_{j}^{'} } \right\rangle = 1} . $$

(20)

For every transmitted decoy logical quantum state, the action of Eve’s eavesdropping will introduce an error rate

$$ P_{e}^{0} = 1 - \left| {\left\langle E \right|\left\langle {0_{dp} } \right|U\left( {\left| {0_{dp} } \right\rangle \left| E \right\rangle } \right)} \right|^{2} = 1 - \left| {a_{01} } \right|^{2} \left\langle {e_{0} e_{1} |e_{0} e_{1} } \right\rangle , $$

(21)

$$ P_{e}^{1} = 1 - \left| {\left\langle E \right|\left\langle {1_{dp} } \right|U\left( {\left| {1_{dp} } \right\rangle \left| E \right\rangle } \right)} \right|^{2} = 1 - \left| {b_{10} } \right|^{2} \left\langle {e_{1}^{'} e_{0}^{'} |e_{1}^{'} e_{0}^{'} } \right\rangle , $$

(22)

$$ \begin{aligned} P_{e}^{ + } & = 1 - \left| {\left\langle E \right|\left\langle { +_{dp} } \right|U\left( {\left| { +_{dp} } \right\rangle \left| E \right\rangle } \right)} \right|^{2} \\ & = 1 - \frac{1}{4}\left( {a_{01}^{ * } \left\langle {e_{0} e_{1} } \right| + a_{10}^{ * } \left\langle {e_{1} e_{0} } \right| + b_{01}^{ * } \left\langle {e_{0}^{'} e_{1}^{'} } \right| + b_{10}^{ * } \left\langle {e_{1}^{'} e_{0}^{'} } \right|} \right) \\ & \quad \left( {a_{01} \left| {e_{0} e_{1} } \right\rangle + a_{10} \left| {e_{1} e_{0} } \right\rangle + b_{01} \left| {e_{0}^{'} e_{1}^{'} } \right\rangle + b_{10} \left| {e_{1}^{'} e_{0}^{'} } \right\rangle } \right), \\ \end{aligned} $$

(23)

$$ \begin{aligned} P_{e}^{ - } & = 1 - \left| {\left\langle E \right|\left\langle { -_{dp} } \right|U\left( {\left| { -_{dp} } \right\rangle \left| E \right\rangle } \right)} \right|^{2} \\ & = 1 - \frac{1}{4}\left( {a_{01}^{ * } \left\langle {e_{0} e_{1} } \right| - a_{10}^{ * } \left\langle {e_{1} e_{0} } \right| - b_{01}^{ * } \left\langle {e_{0}^{'} e_{1}^{'} } \right| - b_{10}^{ * } \left\langle {e_{1}^{'} e_{0}^{'} } \right|} \right) \\ & \quad \left( {a_{01} \left| {e_{0} e_{1} } \right\rangle - a_{10} \left| {e_{1} e_{0} } \right\rangle - b_{01} \left| {e_{0}^{'} e_{1}^{'} } \right\rangle - b_{10} \left| {e_{1}^{'} e_{0}^{'} } \right\rangle } \right), \\ \end{aligned} $$

(24)

where $P_{e}^{0}$, $P_{e}^{1}$, $P_{e}^{ + }$ and $P_{e}^{ - }$ are the error rate introduced by Eve’s eavesdropping on decoy logical quantum states $\left| {0_{L} } \right\rangle ,\left| {1_{L} } \right\rangle ,\left| { +_{L} } \right\rangle ,\left| { -_{L} } \right\rangle$, respectively. In other words, $P_{e}^{0}$, $P_{e}^{1}$, $P_{e}^{ + }$ and $P_{e}^{ - }$ are the probabilities of the decoy logical quantum states being changed after Eve applies the unitary operation $U$ on the decoy logical quantum states $\left| {0_{L} } \right\rangle ,\left| {1_{L} } \right\rangle ,\left| { +_{L} } \right\rangle ,\left| { -_{L} } \right\rangle$ and her ancillary qubits $\left| E \right\rangle$ in Eqs. (15)–(18), respectively.

Eve is supposed to be clever enough to prevent Alice and Bob from detecting her eavesdropping by finding the discrepancy in the error rates of quantum states, i.e.,

$$ P_{e}^{0} = P_{e}^{1} = P_{e}^{ + } = P_{e}^{ - } = p_{e} . $$

(25)

If Eve tries to achieve the eavesdropping without being detected, then the error rate $p_{e}$ has to be zero in the ideal environment. From Eqs. (19) to (25), we obtain the following equations

$$ \begin{aligned} & \left| {a_{01} } \right|^{2} \left\langle {e_{0} e_{1} |e_{0} e_{1} } \right\rangle = 1,\quad \left| {b_{10} } \right|^{2} \left\langle {e_{1}^{'} e_{0}^{'} |e_{1}^{'} e_{0}^{'} } \right\rangle = 1 \\ & \left| {e_{0} e_{0} } \right\rangle = \left| {e_{1} e_{0} } \right\rangle = \left| {e_{1} e_{1} } \right\rangle = {\rm O},\quad \left| {e_{0}^{'} e_{0}^{'} } \right\rangle = \left| {e_{0}^{'} e_{1}^{'} } \right\rangle = \left| {e_{1}^{'} e_{1}^{'} } \right\rangle = {\rm O}. \\ \end{aligned} $$

(26)

As a result, from Eq. (26), we find that the whole system involving the transmitted logical qubits and her ancillary photons $\left| E \right\rangle$ in Eqs. (15)–(18) are in a tensor-product state. This implies that it is impossible for Eve to pass the two security checks by entangling the ancilla with the travel particles and measuring it without introducing any error. Thus, Eve cannot derive the useful information about $M$ and $K_{A}$.

4.1.2 Passive attack from the outside eavesdropper

After the information $K_{\text{B}}^{'}$ is published, Eve may attempt to gain the shared secret key. However, she cannot get any information about the measurement results of $M$ and infer Alice or Bob’s secret key. So it is not possible for Eve to obtain the final shared secret key.

4.2 Participant attack

The participant attack is first proposed by Gao et al. [54,55,56]. The participant attack means that the legal participant instead of the outsider eavesdropper may be dishonest and try to perform an attack for his own purpose. The purpose of the participant is different for different quantum cryptography protocols. For example, for QKA protocols, the dishonest participant may hope to control the shared secret key and determine it fully by himself alone.

Next, we will analyze the security against possible malicious Alice or Bob. Assume Bob is dishonest. In this case, Alice is assumed to be honest. Although Bob can decode $K_{A}$ by measuring the particles once they are received, and then decide the corresponding $K_{B}$ to generate his favorite $K_{AB}$, without the correct permutation operator $\varPi_{n}$ of Alice, he can only decode $K_{A}$ accurately with the probability $\frac{1}{n!}$. Even though Bob uses the wrong permutation operator $\varPi_{n}$, he can also obtain two bits of $K_{A}$ correctly with probability 1/4. Accordingly, to control the 2n-bit shared key $K_{AB}$ as well as to perform the security check (via 2m-bit checking sets $C$), Bob succeeds only with the probability $\left( {\frac{1}{4}} \right)^{n}$, which is negligible.

Next we assume Alice is dishonest. In this case, Bob is assumed to be honest. Upon receiving $K_{B}$ from Bob in step (6), if Alice wants to control $K_{AB}$, she needs to modify her key $K_{A}$ appropriately. However, Alice can only get the key $K_{B}$ after Alice has sent the encoded message qubits.

Therefore, Alice or Bob’s participant attack will not succeed.

5 Comparison with other two-party QKA protocols against collective noise

In this section, we consider the Cabello’s qubit efficiency [57] of our QKA protocols. It is defined as $\eta = \frac{c}{q + b}$, where $c$, $q$ and $b$ are the number of the agreement classical bits, the number of qubits used and the number of classical bits exchanged for decoding, respectively. Let $n$ be the number of eight-particle states and $\delta$ be the number of decoy states in each transmitted quantum sequence, the qubit efficiency of our first QKA protocol is $\eta = \frac{4n}{8n + 4\delta + 4\delta + n + 2n}$. Let $\delta = n$, we have $\eta = \frac{4}{19} = 21.05{\text{\% }}$.

Table 2 gives the comparisons among several kinds of two-party QKA protocols against collective noise. There are so many indicators for evaluating the performance of QKA protocols such as the difficulty of preparing quantum states, quantum resource cost, the difficulty of necessary quantum operations, quantum efficiency, one-way or two-way quantum communication and so on. Therefore, it is rather difficult to evaluate the performance of QKA protocols precisely and quantitatively and it is also very difficult to provide a precise weight to the importance of these indicators. It is more rational to evaluate the performance of QKA protocols in a qualitative way.

Table 2 Comparisons among several kinds of QKA protocols against collective noise

As is shown in Table 2, although the proposed protocol does not have the highest qubit efficiency in existing two-party QKA schemes against collective noise, they are globally better in terms of quantum resource cost and qubit efficiency. We define the meaning of a protocol being ‘globally better in terms of quantum resource cost and qubit efficiency’ in a qualitative way. Concretely, we first rank the QKA protocols in Table 2 in terms of each indicator. For example, we rank the QKA protocols in terms of the size of the qubit efficiency and also rank the QKA protocols in terms of the difficulty of performing measurements and so on. Then, we sum the ranks of all the indicators of each QKA protocol and make a rank. If the value is smallest for some QKA protocol, it shows that this protocol is globally the best. The rest can be done in the same manner. Therefore, in terms of the qubit efficiency, our proposed protocol is runner-up. However, in other aspects such as the preparation of quantum states, the difficulty of performing measurements, it is easier to implement our protocol than other QKA protocols against collective noise. Therefore, our protocol is globally better in terms of quantum resource cost and qubit efficiency.

6 Conclusion

Based on logical Bell states, we propose two QKA protocols against the collective-dephasing noise and the collective-rotation noise, respectively. Compared with existing two-party QKA protocols against collective noise, the proposed protocols are globally better in terms of quantum resource cost and qubit efficiency. The security analysis shows that the proposed protocols are secure enough and can effectively resist common insider and outsider attacks.

For future work, there are several open questions. Firstly, here we only proved the security of the proposed QKA protocol against common inside and outside attacks, and its security has not been studied by strict mathematical proof. It would be interesting to study how to give a mathematical proof of the proposed QKA protocol [58,59,60,61,62,63,64,65,66,67,68,69,70,71,72,73,74,75,76,77,78,79,80,81,82,83,84,85,86,87,88,89,90,91,92,93,94,95,96,97,98,99,100,101,102,103,104,105,106,107,108,109,110,111,112,113,114,115,116,117,118,119,120,121,122,123,124,125,126,127,128,129,130,131]. Therefore, we take it as an open problem and will make the further study in the future. Secondly, we only proposed a two-party QKA protocol, and the generalization to multiparty QKA has not been studied. Therefore, it is also interesting to study how to construct robust multiparty QKA protocols. Finally, in the proposed protocols, the quantum resource cost and qubit efficiency are not optimal. Therefore, the optimization of the proposed protocols should be performed in the future.