Response to “Comment on ‘Controlled mutual quantum entity authentication with an untrusted third party’”

Abstract

Recently, Wang et al. (Quantum Inf Process, QINP-D-18-00478R1, 2019) commented that a third party can obtain an authentication key from communicating parties by performing an entanglement swapping attack on the controlled mutual quantum entity authentication (CMQEA) protocol. In this response, we apply this attack to the CMQEA protocol and analyze whether this claim is actually valid. From the analysis, we provide a confirmation that this attack can be prevented using existing countermeasures. In addition, we propose an improved protocol that is fundamentally robust to entanglement swapping attack.

1 Introduction

Controlled mutual quantum entity authentication (CMQEA) is a protocol in which communicating parties Alice and Bob confirm each other’s identities under the control of a third party, Charlie, in a quantum network composed of Greenberger–Horne–Zeilinger (GHZ)-like states [1, 2]. However, an internal attack by an untrusted Charlie was not considered when the CMQEA protocol was first proposed in 2015 [3]. In 2018, Kang et al. proposed an entanglement-checking method and a random number method to address this security loophole [1]. Recently, Wang et al. proposed that an untrusted Charlie could obtain an authentication key through an entanglement swapping attack on the CMQEA [4]. We have identified errors in this claim. In this study, we modified their claim and re-applied the entanglement swapping attack to the original CMQEA protocol. In addition, we confirmed that an eavesdropper Eve has a probability of $1 /2^{N}$ to obtain the authentication keys in the N GHZ-like state sequences with this attack. Finally, we summarize the countermeasures proposed in previous papers to prevent such attacks. We confirm that these existing countermeasures can prevent this attack and explain the features of these countermeasures. In addition, we propose an improved protocol that is fundamentally robust to entanglement swapping attack.

2 Brief review of controlled mutual quantum entity authentication protocol

Before describing the entanglement swapping attacks presented by Wang et al., we briefly introduce the CMQEA protocol. In the CMQEA protocol [1, 2], through the preparation and security-checking phases, Charlie shares the GHZ-like states

$$ \begin{aligned} \left|\varvec{\xi}\right\rangle_{{\left( {{\mathbf{2}}\varvec{i} - {\mathbf{1}}} \right)\varvec{ABC}}} \otimes \left|\varvec{\xi}\right\rangle_{{\left( {{\mathbf{2}}\varvec{i}} \right)\varvec{ABC}}} & = \frac{{\mathbf{1}}}{{\sqrt {\mathbf{2}} }}\left( {\left| {{\varvec{\Psi}}^{ + } } \right\rangle_{{\left( {{\mathbf{2}}\varvec{i} - {\mathbf{1}}} \right)\varvec{AB}}} \left| {\mathbf{0}} \right\rangle_{{\left( {{\mathbf{2}}\varvec{i} - {\mathbf{1}}} \right)\varvec{C}}} + \left| {{\varvec{\Phi}}^{ + } } \right\rangle_{{\left( {{\mathbf{2}}\varvec{i} - {\mathbf{1}}} \right)\varvec{AB}}} \left| {\mathbf{1}} \right\rangle_{{\left( {{\mathbf{2}}\varvec{i} - {\mathbf{1}}} \right)\varvec{C}}} } \right) \\ & \quad \varvec{ } \otimes \frac{{\mathbf{1}}}{{\sqrt {\mathbf{2}} }}\left( {\left| {{\varvec{\Phi}}^{ - } } \right\rangle_{{\left( {{\mathbf{2}}\varvec{i}} \right)\varvec{AB}}} \left| {\mathbf{0}} \right\rangle_{{\left( {{\mathbf{2}}\varvec{i}} \right)\varvec{C}}} - \left| {{\varvec{\Psi}}^{ + } } \right\rangle_{{\left( {{\mathbf{2}}\varvec{i}} \right)\varvec{AB}}} \left| {\mathbf{1}} \right\rangle_{{\left( {{\mathbf{2}}\varvec{i}} \right)\varvec{C}}} } \right) \\ \end{aligned} $$

(1)

with Alice and Bob. The subscripts $\left( {2i - 1} \right)$ and $\left( {2i} \right)$ refer to the odd-numbered and even-numbered qubits, respectively, in the qubit sequence. In addition, the subscripts $A$, $B$, and $C$ represent the owner of a particular qubit. Then, in the entity authentication phase, Alice and Bob authenticate each other under the control of Charlie as follows:

• E1 Charlie randomly selects one communication member, Alice or Bob, to apply the Pauli operation $\sigma_{{k_{i} }} \in \left\{ {\sigma_{00} = I, \sigma_{01} = \sigma_{x} , \sigma_{10} = i\sigma_{y} , \sigma_{11} = \sigma_{z} } \right\}$, which corresponds to the pre-shared authentication key $k_{i} \in \left\{ {00, 01, 10, 11} \right\}$, for the qubit $\left( {2i - 1} \right)A$ or $\left( {2i} \right)B$ in Eq. (1). If Charlie selects Alice, Alice applies the Pauli operator $\sigma_{{k_{i} }}$ to the qubit $\left( {2i - 1} \right)A$. If Charlie selects Bob, Bob applies the Pauli operator $\sigma_{{k_{i} }}$ to the qubit $\left( {2i} \right)B$.

• E2 Charlie executes the $\sigma_{z}$-basis measurement on the qubits $\left\{ {\left( {2i - 1} \right)C, \left( {2i} \right)C} \right\}$ in Eq. (1), and his measurement outcomes are $c_{2i - 1} c_{2i} \in \left\{ {00, 01, 10, 11} \right\}$. After Charlie’s measurement, the GHZ-like state of Eq. (1) collapses into $\left| {\Phi^{ - } } \right\rangle_{{\left( {2i - 1} \right)AB}} \left| {\Phi^{ - } } \right\rangle_{{\left( {2i} \right)AB}}$, $\left| {\Phi^{ - } } \right\rangle_{{\left( {2i - 1} \right)AB}} \left| {\Psi^{ + } } \right\rangle_{{\left( {2i} \right)AB}}$, $\left| {\Psi^{ - } } \right\rangle_{{\left( {2i - 1} \right)AB}} \left| {\Phi^{ - } } \right\rangle_{{\left( {2i} \right)AB}}$, or $\left| {\Psi^{ - } } \right\rangle_{{\left( {2i - 1} \right)AB}} \left| {\Psi^{ + } } \right\rangle_{{\left( {2i} \right)AB}}$ with a 25% probability, and Alice and Bob share one of the pairs of the entangled states.

• E3 Alice and Bob perform Bell-basis measurements on the qubits, $\left\{ {\left( {2i - 1} \right)A, \left( {2i} \right)A} \right\}$ and $\left\{ {\left( {2i - 1} \right)B, \left( {2i} \right)B} \right\}$, respectively; this is called entanglement swapping. Then, they exchange their measurement outcomes, $a_{2i - 1} a_{2i}$ and $b_{2i - 1} b_{2i}$ ($a_{j} \;\& \;b_{j} \in \left\{ {0, 1} \right\}$, $j = 2i - 1$, or $2i$).

• E4 Charlie reveals the measurement outcomes of the classical bit $c_{2i - 1} c_{2i}$ acquired in the E2 phase. Then, both Alice and Bob confirm whether their classical bits, $a_{2i - 1} a_{2i}$ and $b_{2i - 1} b_{2i}$, correctly correspond to the revealed classical bit, $c_{2i - 1} c_{2i}$, as shown in Table 4 in Ref. [2].

3 Analysis of Wang et al.’s entanglement swapping attack

Wang et al. claimed that an untrusted third party could obtain an authentication key that was pre-shared by Alice and Bob by performing entanglement swapping in the CMQEA protocol [4]. In their paper, Wang et al. explained that, unlike the E2 and E3 phase of Sect. 2, a third party can learn what operator was applied by Alice or Bob if they perform a Bell measurement on the $\left( {2i} \right)C$ and $\left( {2i - 1} \right)C$ qubits of GHZ-like states. Here, the operator corresponds to the authentication key. Therefore, if Charlie knows the specific operator $\sigma_{{k_{i} }} \in \left\{ {\sigma_{00} = I, \sigma_{01} = \sigma_{x} , \sigma_{10} = i\sigma_{y} , \sigma_{11} = \sigma_{z} } \right\}$, he can naturally know what the authentication key $k_{i} \in \left\{ {00, 01, 10, 11} \right\}$ is. For example, in the P2 phase, with an untrusted Charlie and Eve, GHZ-like states

$$ \begin{aligned} \left|\varvec{\xi}\right\rangle_{{\left( {{\mathbf{2}}\varvec{i} - {\mathbf{1}}} \right)\varvec{ABC}}} \otimes \left|\varvec{\xi}\right\rangle_{{\left( {{\mathbf{2}}\varvec{i}} \right)\varvec{ABC}}} & = \frac{{\mathbf{1}}}{{\sqrt {\mathbf{2}} }}\left( {\left| {{\varvec{\Psi}}^{ + } } \right\rangle_{{\left( {{\mathbf{2}}\varvec{i} - {\mathbf{1}}} \right)\varvec{AB}}} \left| {\mathbf{0}} \right\rangle_{{\left( {{\mathbf{2}}\varvec{i} - {\mathbf{1}}} \right)\varvec{C}}} + \left| {{\varvec{\Phi}}^{ + } } \right\rangle_{{\left( {{\mathbf{2}}\varvec{i} - {\mathbf{1}}} \right)\varvec{AB}}} \left| {\mathbf{1}} \right\rangle_{{\left( {{\mathbf{2}}\varvec{i} - {\mathbf{1}}} \right)\varvec{C}}} } \right) \\ & \quad \otimes \frac{{\mathbf{1}}}{{\sqrt {\mathbf{2}} }}\left( {\left| {{\varvec{\Psi}}^{ + } } \right\rangle_{{\left( {{\mathbf{2}}\varvec{i}} \right)\varvec{AB}}} \left| {\mathbf{0}} \right\rangle_{{\left( {{\mathbf{2}}\varvec{i}} \right)\varvec{C}}} + \left| {{\varvec{\Phi}}^{ + } } \right\rangle_{{\left( {{\mathbf{2}}\varvec{i}} \right)\varvec{AB}}} \left| {\mathbf{1}} \right\rangle_{{\left( {{\mathbf{2}}\varvec{i}} \right)\varvec{C}}} } \right) \\ \end{aligned} $$

(2)

of Eq. (2) are prepared in Ref. [4]. Subsequently, Alice applied the operator $\sigma_{x}$, and Charlie attempted the entanglement swapping attack as in Eq. (6) of Ref [3] as follows:

$$ \begin{aligned} \sigma_{x} \left| \xi \right\rangle_{{\left( {2i - 1} \right)ABC}} \otimes \left| \xi \right\rangle_{{\left( {2i} \right)ABC}} & = \frac{1}{2\sqrt 2 }\left( {\left| {\Psi^{ + } } \right\rangle_{{\left( {2i - 1} \right)\left( {2i} \right)A}} \left| {\Phi^{ + } } \right\rangle_{{\left( {2i - 1} \right)\left( {2i} \right)B}} \left| {\Phi^{ + } } \right\rangle_{{\left( {2i - 1} \right)\left( {2i} \right)C}} } \right. \\ & \quad + \,\left| {\Phi^{ + } } \right\rangle_{{\left( {2i - 1} \right)\left( {2i} \right)A}} \left| {\Psi^{ + } } \right\rangle_{{\left( {2i - 1} \right)\left( {2i} \right)B}} \left| {\Phi^{ + } } \right\rangle_{{\left( {2i - 1} \right)\left( {2i} \right)C}} \\ & \quad - \,\left| {\Psi^{ - } } \right\rangle_{{\left( {2i - 1} \right)\left( {2i} \right)A}} \left| {\Phi^{ - } } \right\rangle_{{\left( {2i - 1} \right)\left( {2i} \right)B}} \left| {\Phi^{ - } } \right\rangle_{{\left( {2i - 1} \right)\left( {2i} \right)C}} \\ & \quad + \,\left| {\Phi^{ - } } \right\rangle_{{\left( {2i - 1} \right)\left( {2i} \right)A}} \left| {\Psi^{ - } } \right\rangle_{{\left( {2i - 1} \right)\left( {2i} \right)B}} \left| {\Phi^{ - } } \right\rangle_{{\left( {2i - 1} \right)\left( {2i} \right)C}} \\ & \quad - \,\left| {\Phi^{ + } } \right\rangle_{{\left( {2i - 1} \right)\left( {2i} \right)A}} \left| {\Phi^{ + } } \right\rangle_{{\left( {2i - 1} \right)\left( {2i} \right)B}} \left| {\Psi^{ + } } \right\rangle_{{\left( {2i - 1} \right)\left( {2i} \right)C}} \\ & \quad + \,\left| {\Psi^{ + } } \right\rangle_{{\left( {2i - 1} \right)\left( {2i} \right)A}} \left| {\Psi^{ + } } \right\rangle_{{\left( {2i - 1} \right)\left( {2i} \right)B}} \left| {\Psi^{ + } } \right\rangle_{{\left( {2i - 1} \right)\left( {2i} \right)C}} \\ & \quad - \,\left| {\Phi^{ - } } \right\rangle_{{\left( {2i - 1} \right)\left( {2i} \right)A}} \left| {\Phi^{ - } } \right\rangle_{{\left( {2i - 1} \right)\left( {2i} \right)B}} \left| {\Psi^{ - } } \right\rangle_{{\left( {2i - 1} \right)\left( {2i} \right)C}} \\ & \left. {\quad + \,\left| {\Psi^{ - } } \right\rangle_{{\left( {2i - 1} \right)\left( {2i} \right)A}} \left| {\Psi^{ - } } \right\rangle_{{\left( {2i - 1} \right)\left( {2i} \right)B}} \left| {\Psi^{ - } } \right\rangle_{{\left( {2i - 1} \right)\left( {2i} \right)C}} } \right) \\ \end{aligned} $$

(3)

If the Bell measurement results of Alice, Bob, and Charlie are $\left| {\Psi^{ + } } \right\rangle_{{\left( {2i - 1} \right)\left( {2i} \right)A}}$, $\left| {\Phi^{ + } } \right\rangle_{{\left( {2i - 1} \right)\left( {2i} \right)B}}$, and $\left| {\Phi^{ + } } \right\rangle_{{\left( {2i - 1} \right)\left( {2i} \right)C}}$, respectively, the operation of Alice must be $\sigma_{x}$. Consequently, Charlie can guess that the authentication key $k_{i} = 01$.

As described above, according to Wang et al.’s argument, an untrusted Charlie can obtain Alice and Bob’s authentication keys perfectly by performing an entanglement swapping attack on the CMQEA protocol. However, there is a fallacy in their argument. The GHZ state of Eq. (2) that they use to describe the attack differs from the GHZ state of Eq. (1) used by the original protocol. This difference causes the protocol to ultimately fail, resulting in Charlie’s misconduct. In the original CMQEA protocol, as can be seen in Table 4 of Ref. [2], even though Alice’s measurement outcome is 10, Bob’s measurement outcomes are randomly generated as 00, 01, 10, and 11. Therefore, because the original protocol uses $N$ GHZ-like state sequences for authentication, Bob’s measurement outcomes must be uniformly distributed. However, in the example of Wang et al., such as in Eq. (3), if Alice’s measurement outcome $a_{2i - 1} a_{2i}$ is $\left| {\Psi^{ + } } \right\rangle_{{\left( {2i - 1} \right)\left( {2i} \right)A}} :10$, Bob’s measurement outcome $b_{2i - 1} b_{2i}$ is always $\left| {\Phi^{ + } } \right\rangle_{{\left( {2i - 1} \right)\left( {2i} \right)B}} :00$ or $\left| {\Psi^{ + } } \right\rangle_{{\left( {2i - 1} \right)\left( {2i} \right)B}} :10$. In such a situation, when using $N$ GHZ-like state sequences, Bob’s measurement outcomes are not uniformly distributed, and Charlie’s attack eventually becomes apparent. Therefore, we should verify the validity of Charlie’s attempts at an entanglement swapping attack on the GHZ-like states of Eq. (1). The GHZ-like states of Eq. (1) are rearranged as follows:

$$ \begin{aligned} \left| \xi \right\rangle_{(2i - 1)ABC} \otimes \left| \xi \right\rangle_{(2i)ABC} & = \frac{1}{2}\left( {\left| {\Psi^{ + } } \right\rangle_{(2i - 1)AB} \left| {\Phi^{ - } } \right\rangle_{{\left( {2i} \right)AB}} \left| 0 \right\rangle_{{\left( {2i - 1} \right)C}} \left| 0 \right\rangle_{{\left( {2i} \right)C}} } \right. \\ & \quad - \,\left| {\Psi^{ + } } \right\rangle_{{\left( {2i - 1} \right)AB}} \left| {\Psi^{ + } } \right\rangle_{{\left( {2i} \right)AB}} \left| 0 \right\rangle_{{\left( {2i - 1} \right)C}} \left| 1 \right\rangle_{{\left( {2i} \right)C}} \\ & \quad + \,\left| {\Phi^{ + } } \right\rangle_{{\left( {2i - 1} \right)AB}} \left| {\Phi^{ - } } \right\rangle_{{\left( {2i} \right)AB}} \left| 1 \right\rangle_{{\left( {2i - 1} \right)C}} \left| 0 \right\rangle_{{\left( {2i} \right)C}} \\ & \quad \left. { + \,\left| {\Phi^{ + } } \right\rangle_{{\left( {2i - 1} \right)AB}} \left| {\Psi^{ + } } \right\rangle_{{\left( {2i} \right)AB}} \left| 0 \right\rangle_{{\left( {2i - 1} \right)C}} \left| 1 \right\rangle_{{\left( {2i} \right)C}} } \right) \\ \end{aligned} $$

(4)

In the E1 phase of Sect. 2, if Charlie selects Alice and then Alice applies Pauli operators $\sigma_{{k_{i} }} \in \left\{ {\sigma_{00} = I, \sigma_{01} = \sigma_{x} , \sigma_{10} = i\sigma_{y} , \sigma_{11} = \sigma_{z} } \right\}$ to the qubits $\left( {2i - 1} \right)A$ of GHZ-like states in Eq. (4), these states become

$$ \begin{aligned} \left| \xi \right\rangle_{{\left( {2i - 1} \right)ABC}} \otimes \left| \xi \right\rangle_{{\left( {2i} \right)ABC}} = & \frac{1}{2}\left[ {\left( {\left| {{\text{Rev}} + - } \right\rangle_{{\left( {2i - 1} \right)\left( {2i} \right)AB}} + \left| {{\text{Rev}} + + } \right\rangle_{{\left( {2i - 1} \right)\left( {2i} \right)AB}} } \right)\left| {\Phi^{ + } } \right\rangle_{{\left( {2i - 1} \right)\left( {2i} \right)C}} } \right. \\ & \quad + \,\left( {\left| {{\text{Rev}} + - } \right\rangle_{{\left( {2i - 1} \right)\left( {2i} \right)AB}} - \left| {{\text{Rev}} + + } \right\rangle_{{\left( {2i - 1} \right)\left( {2i} \right)AB}} } \right)\left| {\Phi^{ - } } \right\rangle_{{\left( {2i - 1} \right)\left( {2i} \right)C}} \\ & \quad - \,\left( {\left| {{\text{ID}} + + } \right\rangle_{{\left( {2i - 1} \right)\left( {2i} \right)AB}} - \left| {{\text{ID}} + - } \right\rangle_{{\left( {2i - 1} \right)\left( {2i} \right)AB}} } \right)\left| {\Psi^{ + } } \right\rangle_{{\left( {2i - 1} \right)\left( {2i} \right)C}} \\ & \left. {\quad - \,\left( {\left| {{\text{ID}} + + } \right\rangle_{{\left( {2i - 1} \right)\left( {2i} \right)AB}} + \left| {{\text{ID}} + - } \right\rangle_{{\left( {2i - 1} \right)\left( {2i} \right)AB}} } \right)\left| {\Psi^{ - } } \right\rangle_{{\left( {2i - 1} \right)\left( {2i} \right)C}} } \right], \\ \end{aligned} $$

(5)

$$ \begin{aligned} & \sigma_{x} \left| \xi \right\rangle_{{\left( {2i - 1} \right)ABC}} \otimes \left| \xi \right\rangle_{{\left( {2i} \right)ABC}} \\ & = \frac{1}{2}\left[ {\left( {\left| {{\text{ID}} + - } \right\rangle_{{\left( {2i - 1} \right)\left( {2i} \right)AB}} + \left| {{\text{ID}} + + } \right\rangle_{{\left( {2i - 1} \right)\left( {2i} \right)AB}} } \right)\left| {\Phi^{ + } } \right\rangle_{{\left( {2i - 1} \right)\left( {2i} \right)C}} } \right. \\ & \quad + \,\left( {\left| {{\text{ID}} + - } \right\rangle_{{\left( {2i - 1} \right)\left( {2i} \right)AB}} - \left| {{\text{ID}} + + } \right\rangle_{{\left( {2i - 1} \right)\left( {2i} \right)AB}} } \right)\left| {\Phi^{ - } } \right\rangle_{{\left( {2i - 1} \right)\left( {2i} \right)C}} \\ & \quad - \,\left( {\left| {{\text{Rev}} + + } \right\rangle_{{\left( {2i - 1} \right)\left( {2i} \right)AB}} - \left| {{\text{Rev}} + - } \right\rangle_{{\left( {2i - 1} \right)\left( {2i} \right)AB}} } \right)\left| {\Psi^{ + } } \right\rangle_{{\left( {2i - 1} \right)\left( {2i} \right)C}} \\ & \left. {\quad - \,\left( {\left| {{\text{Rev}} + + } \right\rangle_{{\left( {2i - 1} \right)\left( {2i} \right)AB}} + \left| {{\text{Rev}} + - } \right\rangle_{{\left( {2i - 1} \right)\left( {2i} \right)AB}} } \right)\left| {\Psi^{ - } } \right\rangle_{{\left( {2i - 1} \right)\left( {2i} \right)C}} } \right], \\ \end{aligned} $$

(6)

$$ \begin{aligned} & i\sigma_{y} \left| \xi \right\rangle_{{\left( {2i - 1} \right)ABC}} \otimes \left| \xi \right\rangle_{{\left( {2i} \right)ABC}} \\ & = \frac{1}{2}\left[ {\left( {\left| {{\text{ID}} + + } \right\rangle_{{\left( {2i - 1} \right)\left( {2i} \right)AB}} + \left| {{\text{ID}} + - } \right\rangle_{{\left( {2i - 1} \right)\left( {2i} \right)AB}} } \right)\left| {\Phi^{ + } } \right\rangle_{{\left( {2i - 1} \right)\left( {2i} \right)C}} } \right. \\ & \quad + \,\left( {\left| {{\text{ID}} + + } \right\rangle_{{\left( {2i - 1} \right)\left( {2i} \right)AB}} - \left| {{\text{ID}} + - } \right\rangle_{{\left( {2i - 1} \right)\left( {2i} \right)AB}} } \right)\left| {\Phi^{ - } } \right\rangle_{{\left( {2i - 1} \right)\left( {2i} \right)C}} \\ & \quad - \,\left( {\left| {{\text{Rev}} + - } \right\rangle_{{\left( {2i - 1} \right)\left( {2i} \right)AB}} - \left| {{\text{Rev}} + + } \right\rangle_{{\left( {2i - 1} \right)\left( {2i} \right)AB}} } \right)\left| {\Psi^{ + } } \right\rangle_{{\left( {2i - 1} \right)\left( {2i} \right)C}} , \\ & \left. {\quad - \,\left( {\left| {{\text{Rev}} + - } \right\rangle_{{\left( {2i - 1} \right)\left( {2i} \right)AB}} + \left| {{\text{Rev}} + + } \right\rangle_{{\left( {2i - 1} \right)\left( {2i} \right)AB}} } \right)\left| {\Psi^{ - } } \right\rangle_{{\left( {2i - 1} \right)\left( {2i} \right)C}} } \right], \\ \end{aligned} $$

(7)

and

$$ \begin{aligned} & \sigma_{z} \left| \xi \right\rangle_{{\left( {2i - 1} \right)ABC}} \otimes \left| \xi \right\rangle_{{\left( {2i} \right)ABC}} \\ & = \frac{1}{2}\left[ {\left( {\left| {{\text{Rev}} + + } \right\rangle_{{\left( {2i - 1} \right)\left( {2i} \right)AB}} + \left| {{\text{Rev}} + - } \right\rangle_{{\left( {2i - 1} \right)\left( {2i} \right)AB}} } \right)\left| {\Phi^{ + } } \right\rangle_{{\left( {2i - 1} \right)\left( {2i} \right)C}} } \right. \\ & \quad + \,\left( {\left| {{\text{Rev}} + + } \right\rangle_{{\left( {2i - 1} \right)\left( {2i} \right)AB}} - \left| {{\text{Rev}} + - } \right\rangle_{{\left( {2i - 1} \right)\left( {2i} \right)AB}} } \right)\left| {\Phi^{ - } } \right\rangle_{{\left( {2i - 1} \right)\left( {2i} \right)C}} \\ & \quad - \,\left( {\left| {{\text{ID}} + - } \right\rangle_{{\left( {2i - 1} \right)\left( {2i} \right)AB}} - \left| {{\text{ID}} + + } \right\rangle_{{\left( {2i - 1} \right)\left( {2i} \right)AB}} } \right)\left| {\Psi^{ + } } \right\rangle_{{\left( {2i - 1} \right)\left( {2i} \right)C}} \\ & \left. {\quad - \,\left( {\left| {{\text{ID}} + - } \right\rangle_{{\left( {2i - 1} \right)\left( {2i} \right)AB}} + \left| {{\text{ID}} + + } \right\rangle_{{\left( {2i - 1} \right)\left( {2i} \right)AB}} } \right)\left| {\Psi^{ - } } \right\rangle_{{\left( {2i - 1} \right)\left( {2i} \right)C}} } \right] \\ \end{aligned} $$

(8)

respectively. Here, $\left| {{\text{Rev}} + - } \right\rangle_{{\left( {2i - 1} \right)\left( {2i} \right)AB}} = \left| {\Psi^{ + } } \right\rangle_{{\left( {2i - 1} \right)AB}} \left| {\Phi^{ - } } \right\rangle_{{\left( {2i} \right)AB}}$, $\left| {{\text{ID}} + + } \right\rangle_{{\left( {2i - 1} \right)\left( {2i} \right)AB}} = \left| {\Psi^{ + } } \right\rangle_{{\left( {2i - 1} \right)AB}} \left| {\Psi^{ + } } \right\rangle_{{\left( {2i} \right)AB}}$, $\left| {{\text{ID}} + - } \right\rangle_{{\left( {2i - 1} \right)\left( {2i} \right)AB}} = \left| {\Phi^{ + } } \right\rangle_{{\left( {2i - 1} \right)AB}} \left| {\Phi^{ - } } \right\rangle_{{\left( {2i} \right)AB}}$, and $\left| {{\text{Rev}} + + } \right\rangle_{{\left( {2i - 1} \right)\left( {2i} \right)AB}} = \left| {\Phi^{ + } } \right\rangle_{{\left( {2i - 1} \right)AB}} \left| {\Psi^{ + } } \right\rangle_{{\left( {2i} \right)AB}}$. Note that Bell states $\left| {\Phi^{ + } } \right\rangle$, $\left| {\Phi^{ - } } \right\rangle$, $\left| {\Psi^{ + } } \right\rangle$, and $\left| {\Psi^{ - } } \right\rangle$ are representative of two entangled states and are unitarily transformed by local operations, as shown in Fig. 1. Therefore, the symbols ${\text{ID}} + +$, ${\text{ID}} + -$, ${\text{Rev}} + +$, and ${\text{Rev}} + -$ indicate the relationship between the two states. For example, in Fig. 1, applying a local operator $I \otimes \sigma_{x}$ or $\sigma_{x} \otimes I$ to $\left| {\Phi^{ + } } \right\rangle$ results in $\left| {\Psi^{ + } } \right\rangle$:

$$ \left| {{\varvec{\Phi}}^{ + } } \right\rangle \to \left| {{\varvec{\Psi}}^{ + } } \right\rangle = \left( {\varvec{I} \otimes\varvec{\sigma}_{\varvec{x}} } \right)\left| {{\varvec{\Phi}}^{ + } } \right\rangle = \left( {\varvec{I} \otimes\varvec{\sigma}_{\varvec{x}} } \right)\frac{{\mathbf{1}}}{{\sqrt {\mathbf{2}} }}\left( {\left| {{\mathbf{00}}} \right\rangle + \left| {{\mathbf{11}}} \right\rangle } \right) = \frac{{\mathbf{1}}}{{\sqrt {\mathbf{2}} }}\left( {\left| {{\mathbf{01}}} \right\rangle + \left| {{\mathbf{10}}} \right\rangle } \right) $$

(9)

$$ \left| {{\varvec{\Phi}}^{ + } } \right\rangle \to \left| {{\varvec{\Psi}}^{ + } } \right\rangle = \left( {\varvec{\sigma}_{\varvec{x}} \otimes \varvec{I}} \right)\left| {{\varvec{\Phi}}^{ + } } \right\rangle = \left( {\varvec{\sigma}_{\varvec{x}} \otimes \varvec{I}} \right)\frac{{\mathbf{1}}}{{\sqrt {\mathbf{2}} }}\left( {\left| {{\mathbf{00}}} \right\rangle + \left| {{\mathbf{11}}} \right\rangle } \right) = \frac{{\mathbf{1}}}{{\sqrt {\mathbf{2}} }}\left( {\left| {{\mathbf{01}}} \right\rangle + \left| {{\mathbf{10}}} \right\rangle } \right) $$

(10)

Fig. 1

Unitary transformation of Bell states by local operations

We define ${\text{Rev}} + +$ as the relationship between $\left| {\Phi^{ + } } \right\rangle$ and $\left| {\Psi^{ + } } \right\rangle$ where the bit flips $\sigma_{x}$. Additionally, applying a local operator $I \otimes \sigma_{z}$ or $\sigma_{z} \otimes I$ to $\left| {\Phi^{ + } } \right\rangle$ results in $\left| {\Phi^{ - } } \right\rangle$:

$$ \left| {{\varvec{\Phi}}^{ + } } \right\rangle \to \left| {{\varvec{\Phi}}^{ - } } \right\rangle = \left( {\varvec{I} \otimes\varvec{\sigma}_{\varvec{z}} } \right)\left| {{\varvec{\Phi}}^{{\mathbf{ + }}} } \right\rangle = \left( {\varvec{I} \otimes\varvec{\sigma}_{\varvec{z}} } \right)\frac{{\mathbf{1}}}{{\sqrt {\mathbf{2}} }}\left( {\left| {{\mathbf{00}}} \right\rangle + \left| {{\mathbf{11}}} \right\rangle } \right) = \frac{{\mathbf{1}}}{{\sqrt {\mathbf{2}} }}\left( {\left| {{\mathbf{00}}} \right\rangle - \left| {{\mathbf{11}}} \right\rangle } \right) $$

(11)

$$ \left| {{\varvec{\Phi}}^{ + } } \right\rangle \to \left| {{\varvec{\Phi}}^{ - } } \right\rangle = \left( {\varvec{\sigma}_{\varvec{z}} \otimes \varvec{I}} \right)\left| {{\varvec{\Phi}}^{ + } } \right\rangle = \left( {\varvec{\sigma}_{\varvec{z}} \otimes \varvec{I}} \right)\frac{{\mathbf{1}}}{{\sqrt {\mathbf{2}} }}\left( {\left| {{\mathbf{00}}} \right\rangle + \left| {{\mathbf{11}}} \right\rangle } \right) = \frac{{\mathbf{1}}}{{\sqrt {\mathbf{2}} }}\left( {\left| {{\mathbf{00}}} \right\rangle - \left| {{\mathbf{11}}} \right\rangle } \right) $$

(12)

We define ${\text{ID}} + -$ as the relationship between $\left| {\Phi^{ + } } \right\rangle$ and $\left| {\Phi^{ - } } \right\rangle$ where the phase flips $\sigma_{z}$. Furthermore, applying a local operator $I \otimes i\sigma_{y}$ or $i\sigma_{y} \otimes I$ to $\left| {\Phi^{ + } } \right\rangle$ results in $\left| {\Psi^{ - } } \right\rangle$:

$$ \left| {{\varvec{\Phi}}^{ + } } \right\rangle \to \left| {{\varvec{\Psi}}^{ - } } \right\rangle = \left( {\varvec{I} \otimes\varvec{\sigma}_{\varvec{z}} } \right)\left| {{\varvec{\Phi}}^{ + } } \right\rangle = \left( {\varvec{I} \otimes\varvec{\sigma}_{\varvec{z}} } \right)\frac{{\mathbf{1}}}{{\sqrt {\mathbf{2}} }}\left( {\left| {{\mathbf{00}}} \right\rangle + \left| {{\mathbf{11}}} \right\rangle } \right) = \frac{{\mathbf{1}}}{{\sqrt {\mathbf{2}} }}\left( {\left| {{\mathbf{00}}} \right\rangle - \left| {{\mathbf{11}}} \right\rangle } \right) $$

(13)

$$ \left| {{\varvec{\Phi}}^{ + } } \right\rangle \to \left| {{\varvec{\Psi}}^{ - } } \right\rangle = \left( {\varvec{\sigma}_{\varvec{z}} \otimes \varvec{I}} \right)\left| {{\varvec{\Phi}}^{ + } } \right\rangle = \left( {\varvec{\sigma}_{\varvec{z}} \otimes \varvec{I}} \right)\frac{{\mathbf{1}}}{{\sqrt {\mathbf{2}} }}\left( {\left| {{\mathbf{00}}} \right\rangle + \left| {{\mathbf{11}}} \right\rangle } \right) = \frac{{\mathbf{1}}}{{\sqrt {\mathbf{2}} }}\left( {\left| {{\mathbf{00}}} \right\rangle - \left| {{\mathbf{11}}} \right\rangle } \right) $$

(14)

We define ${\text{Rev}} + -$ as the relationship between $\left| {\Phi^{ + } } \right\rangle$ and $\left| {\Psi^{ - } } \right\rangle$ where the bit and phase flips $i\sigma_{y}$. Finally, if $\left| {\Phi^{ + } } \right\rangle$ and $\left| {\Phi^{ + } } \right\rangle$ are identical, we define ${\text{ID}} + +$. These principles have been applied to $\left| {{\text{ID}} + + } \right\rangle$, $\left| {{\text{ID}} + - } \right\rangle$, $\left| {{\text{Rev}} + + } \right\rangle$, and $\left| {{\text{Rev}} + - } \right\rangle$, and the details of these are as follows.

$$ \begin{aligned} \left| {{\text{Rev}} + - } \right\rangle &= \left| {\Psi^{ + } } \right\rangle_{{\left( {2i - 1} \right)AB}} \left| {\Phi^{ - } } \right\rangle_{{\left( {2i} \right)AB}} \\ \quad &= \frac{1}{2}\left( { - \left| {\Phi^{ + } } \right\rangle_{{\left( {2i - 1} \right)\left( {2i} \right)A}} \left| {\Psi^{ - } } \right\rangle_{{\left( {2i - 1} \right)\left( {2i} \right)B}} + \left| {\Phi^{ - } } \right\rangle_{{\left( {2i - 1} \right)\left( {2i} \right)A}} \left| {\Psi^{ + } } \right\rangle_{{\left( {2i - 1} \right)\left( {2i} \right)B}} } \right. \\ & \left. {\quad \quad + \,\left| {\Psi^{ + } } \right\rangle_{{\left( {2i - 1} \right)\left( {2i} \right)A}} \left| {\Phi^{ - } } \right\rangle_{{\left( {2i - 1} \right)\left( {2i} \right)B}} - \left| {\Psi^{ - } } \right\rangle_{{\left( {2i - 1} \right)\left( {2i} \right)A}} \left| {\Phi^{ + } } \right\rangle_{{\left( {2i - 1} \right)\left( {2i} \right)B}} } \right), \\ \end{aligned} $$

(15)

$$ \begin{aligned} \quad \left| {{\text{ID}} + + } \right\rangle &= \left| {\Psi^{ + } } \right\rangle_{{\left( {2i - 1} \right)AB}} \left| {\Psi^{ + } } \right\rangle_{{\left( {2i} \right)AB}} \\ & \quad = \frac{1}{2}\left( {\left| {\Phi^{ + } } \right\rangle_{{\left( {2i - 1} \right)\left( {2i} \right)A}} \left| {\Phi^{ + } } \right\rangle_{{\left( {2i - 1} \right)\left( {2i} \right)B}} - \left| {\Phi^{ - } } \right\rangle_{{\left( {2i - 1} \right)\left( {2i} \right)A}} \left| {\Phi^{ - } } \right\rangle_{{\left( {2i - 1} \right)\left( {2i} \right)B}} } \right. \\ & \left. {\quad \quad + \,\left| {\Psi^{ + } } \right\rangle_{{\left( {2i - 1} \right)\left( {2i} \right)A}} \left| {\Psi^{ + } } \right\rangle_{{\left( {2i - 1} \right)\left( {2i} \right)B}} - \left| {\Psi^{ - } } \right\rangle_{{\left( {2i - 1} \right)\left( {2i} \right)A}} \left| {\Psi^{ - } } \right\rangle_{{\left( {2i - 1} \right)\left( {2i} \right)B}} } \right), \\ \end{aligned} $$

(16)

$$ \begin{aligned} \left| {{\text{ID}} + - } \right\rangle & = \left| {\Phi^{ + } } \right\rangle_{{\left( {2i - 1} \right)AB}} \left| {\Phi^{ - } } \right\rangle_{{\left( {2i} \right)AB}} \\ & \quad = \frac{1}{2}\left( {\left| {\Phi^{ + } } \right\rangle_{{\left( {2i - 1} \right)\left( {2i} \right)A}} \left| {\Phi^{ - } } \right\rangle_{{\left( {2i - 1} \right)\left( {2i} \right)B}} + \left| {\Phi^{ - } } \right\rangle_{{\left( {2i - 1} \right)\left( {2i} \right)A}} \left| {\Phi^{ + } } \right\rangle_{{\left( {2i - 1} \right)\left( {2i} \right)B}} } \right. \\ & \left. {\quad \quad - \,\left| {\Psi^{ + } } \right\rangle_{{\left( {2i - 1} \right)\left( {2i} \right)A}} \left| {\Psi^{ - } } \right\rangle_{{\left( {2i - 1} \right)\left( {2i} \right)B}} - \left| {\Psi^{ - } } \right\rangle_{{\left( {2i - 1} \right)\left( {2i} \right)A}} \left| {\Psi^{ + } } \right\rangle_{{\left( {2i - 1} \right)\left( {2i} \right)B}} } \right), \\ \end{aligned} $$

(17)

and

$$ \begin{aligned} \left| {{\text{Rev}} + + } \right\rangle & = \left| {\Phi^{ + } } \right\rangle_{{\left( {2i - 1} \right)AB}} \left| {\Psi^{ + } } \right\rangle_{{\left( {2i} \right)AB}} \\ & \quad = \frac{1}{2}\left( {\left| {\Phi^{ + } } \right\rangle_{{\left( {2i - 1} \right)\left( {2i} \right)A}} \left| {\Psi^{ + } } \right\rangle_{{\left( {2i - 1} \right)\left( {2i} \right)B}} + \left| {\Phi^{ - } } \right\rangle_{{\left( {2i - 1} \right)\left( {2i} \right)A}} \left| {\Psi^{ - } } \right\rangle_{{\left( {2i - 1} \right)\left( {2i} \right)B}} } \right. \\ & \left. {\quad \quad + \,\left| {\Psi^{ + } } \right\rangle_{{\left( {2i - 1} \right)\left( {2i} \right)A}} \left| {\Phi^{ + } } \right\rangle_{{\left( {2i - 1} \right)\left( {2i} \right)B}} + \left| {\Psi^{ - } } \right\rangle_{{\left( {2i - 1} \right)\left( {2i} \right)A}} \left| {\Phi^{ - } } \right\rangle_{{\left( {2i - 1} \right)\left( {2i} \right)B}} } \right). \\ \end{aligned} $$

(18)

As can be seen from Eqs. (5) and (8), $\left| \xi \right\rangle_{{\left( {2i - 1} \right)ABC}} \otimes \left| \xi \right\rangle_{{\left( {2i} \right)ABC}}$ of Eq. (5) and $\sigma_{z} \left| \xi \right\rangle_{{\left( {2i - 1} \right)ABC}} \otimes \left| \xi \right\rangle_{{\left( {2i} \right)ABC}}$ of Eq. (8) are identical except for the sign ± of the relative phase. Therefore, Charlie cannot accurately estimate the operator $I$ or $\sigma_{z}$ applied by Alice with Bell measurement outcomes of Alice and Bob for the GHZ-like state of Eqs. (5) and (8). For example, suppose that the Bell measurement outcomes of Alice and Bob are $\left| {{\text{Rev}} + - } \right\rangle_{{\left( {2i - 1} \right)\left( {2i} \right)AB}}$ and the measurement outcomes of Charlie are $\left| {\Phi^{ + } } \right\rangle_{{\left( {2i - 1} \right)\left( {2i} \right)C}}$. Because these measurements can occur in both $\left| \xi \right\rangle_{{\left( {2i - 1} \right)ABC}} \otimes \left| \xi \right\rangle_{{\left( {2i} \right)ABC}}$ of Eq. (5) and $\sigma_{z} \left| \xi \right\rangle_{{\left( {2i - 1} \right)ABC}} \otimes \left| \xi \right\rangle_{{\left( {2i} \right)ABC}}$ of Eq. (8), Charlie cannot determine whether Alice used the $I$ or $\sigma_{z}$ operators. Similarly, as can be seen from Eqs. (6) and (7), $\sigma_{x} \left| \xi \right\rangle_{{\left( {2i - 1} \right)ABC}} \otimes \left| \xi \right\rangle_{{\left( {2i} \right)ABC}}$ of Eq. (6) and $i\sigma_{y} \left| \xi \right\rangle_{{\left( {2i - 1} \right)ABC}} \otimes \left| \xi \right\rangle_{{\left( {2i} \right)ABC}}$ of Eq. (7) are identical except for the sign ± of relative phase. Therefore, Charlie cannot accurately guess the operator $\sigma_{x}$ or ${\text{i}}\sigma_{y}$ applied by Alice with the Bell measurement outcomes of Alice and Bob for the GHZ-like state of Eqs. (6) and (7). As another example, suppose that the Bell measurement outcomes of Alice and Bob are $\left| {{\text{ID}} + - } \right\rangle_{{\left( {2i - 1} \right)\left( {2i} \right)AB}}$ and the measurement outcomes of Charlie are $\left| {\Phi^{ - } } \right\rangle_{{\left( {2i - 1} \right)\left( {2i} \right)C}}$. Because these measurements can occur in both $\sigma_{x} \left| \xi \right\rangle_{{\left( {2i - 1} \right)ABC}} \otimes \left| \xi \right\rangle_{{\left( {2i} \right)ABC}}$ of Eq. (6) and $i\sigma_{y} \left| \xi \right\rangle_{{\left( {2i - 1} \right)ABC}} \otimes \left| \xi \right\rangle_{{\left( {2i} \right)ABC}}$ of Eq. (7), Charlie cannot determine whether Alice used the $\sigma_{x}$ or ${\text{i}}\sigma_{y}$ operators. Consequently, Charlie can only estimate one of the two bits of the authentication key $k_{i} \in \left\{ {00, 01, 10, 11} \right\}$. Therefore, because the CMQEA protocol [1, 2] uses $N$ GHZ-like state sequences $\otimes_{i = 1}^{N} \left| \xi \right\rangle_{{\left( {2i - 1} \right)ABC}} \left| \xi \right\rangle_{{\left( {2i} \right)ABC}}$, the probability that Charlie obtains an authentication key sequence $K = \left( {k_{1} , k_{2} , k_{3} , \ldots ,k_{N} } \right)$ through an entanglement swapping attack is $1 /2^{N}$.

In addition to the probabilistic analysis thus far, the analysis in terms of information theory is as follows. If $I_{\text{E}}$ is the amount of information Eve can obtain from Alice and Bob’s measurement outcomes, then $I_{E}$ can be described as $I_{\text{E}} = H\left( {k_{i} } \right) - H\left( {k_{i} |a_{2i - 1} a_{2i} ,b_{2i - 1} b_{2i} } \right)$ [5]. Here, $H\left( X \right)$ is the Shannon entropy of the random variable $X$. $H\left( {k_{i} } \right) = 2$ because the key $k_{i} \in \left\{ {00, 01, 10, 11} \right\}$ is two bits of information. And, if $\left( {a_{2i - 1} a_{2i} ,b_{2i - 1} b_{2i} } \right) = \left| {{\text{Rev}} + \pm } \right\rangle$, $k_{i} \in \left\{ {00, 11} \right\}$; if $\left( {a_{2i - 1} a_{2i} ,b_{2i - 1} b_{2i} } \right) = \left| {{\text{ID}} + \pm } \right\rangle$, $k_{i} \in \left\{ {01, 10} \right\}$. Therefore, $H\left( {k_{i} |a_{2i - 1} a_{2i} ,b_{2i - 1} b_{2i} } \right) = 1$. As a result, $I_{\text{E}} = 1$, which means that 1 bit out of 2 bits is leaked.

4 Countermeasures against entanglement swapping attack

In this section, we explain three countermeasures to prevent an entanglement swapping attack: GHZ-like state sequences method, random number method, and honesty-checking method. Here, GHZ-like state sequence and random number methods were proposed to prevent outsider attacks in the original CMQEA protocol [2, 3] in 2015 and insider attacks by Gao in the improved CMQEA protocol [1] in 2018, respectively. In this section, we confirm in that both methods can prevent the entanglement swapping attack. The honesty-checking method has already been proposed by Wang as a countermeasure against the entanglement swapping attack.

As described in Sect. 2, the probability of an untrusted Charlie guessing an authentication key sequence through an entanglement swapping attack on the CMQEA protocol using $N$ GHZ-like state sequences is $1 /2^{N}$. The first countermeasure is to increase the number of $N$ states used in the protocol so that the entanglement swapping attack probability is very small. For example, if $N$ is 7, the probability of a successful attack is 0.78%. This means that an entanglement swapping attack is virtually impossible. However, this method is a passive countermeasure in which the 2-bit authentication key used for each session is guessed to have a 50% probability.

The second countermeasure was proposed by Wang et al. in a comment paper [4], and it is an honesty-checking method. In this method, Alice and Bob actively verify Charlie’s honesty by randomly selecting from the sequence of GHZ-like states before the E3 phase of Sect. 2. Here, the honesty-checking method is the same as the entanglement correlation check method and is well described in Ref [1]. For example, suppose Alice and Bob select $\left( {2j - 1} \right)$th and $\left( {2j} \right)$th GHZ-like states $\left|\varvec{\xi}\right\rangle_{{\left( {{\mathbf{2}}\varvec{j} - {\mathbf{1}}} \right)\varvec{ABC}}}$ and $\left|\varvec{\xi}\right\rangle_{{\left( {{\mathbf{2}}\varvec{j}} \right)\varvec{ABC}}}$:

$$ \begin{aligned} \left|\varvec{\xi}\right\rangle_{{({\mathbf{2}}\varvec{j} - {\mathbf{1}})\varvec{ABC}}} = & \frac{{\mathbf{1}}}{{\sqrt {\mathbf{2}} }}\left( {\left| {{\varvec{\Psi}}^{ + } } \right\rangle_{{({\mathbf{2}}\varvec{j} - {\mathbf{1}})\varvec{AB}}} \left| {\mathbf{0}} \right\rangle_{{({\mathbf{2}}\varvec{j} - {\mathbf{1}})\varvec{C}}} + \left| {{\varvec{\Phi}}^{ + } } \right\rangle_{{({\mathbf{2}}\varvec{j} - {\mathbf{1}})\varvec{AB}}} \left| {\mathbf{1}} \right\rangle_{{({\mathbf{2}}\varvec{j} - {\mathbf{1}})\varvec{C}}} } \right) \\ = & \frac{{\mathbf{1}}}{{\sqrt {\mathbf{2}} }}\left( {\left| {\varvec{x} + } \right\rangle \left| {\varvec{x} + } \right\rangle \left| {\varvec{x} + } \right\rangle - \left| {\varvec{x} - } \right\rangle \left| {\varvec{x} - } \right\rangle \left| {\varvec{x} - } \right\rangle } \right)_{{({\mathbf{2}}\varvec{j} - {\mathbf{1}})\varvec{ABC}}} \\ \end{aligned} $$

(19)

$$ \begin{aligned} \left|\varvec{\xi}\right\rangle_{{({\mathbf{2}}\varvec{j})\varvec{ABC}}} & = \frac{{\mathbf{1}}}{{\sqrt {\mathbf{2}} }}\left( {\left| {{\varvec{\Phi}}^{ - } } \right\rangle_{{({\mathbf{2}}\varvec{j})\varvec{AB}}} \left| {\mathbf{0}} \right\rangle_{{({\mathbf{2}}\varvec{j})\varvec{C}}} - \left| {{\varvec{\Psi}}^{ + } } \right\rangle_{{({\mathbf{2}}\varvec{j})\varvec{AB}}} \left| {\mathbf{1}} \right\rangle_{{({\mathbf{2}}\varvec{j})\varvec{C}}} } \right) \\ & = \frac{{\mathbf{1}}}{{\sqrt {\mathbf{2}} }}\left( {\left| {\varvec{y} + } \right\rangle \left| {\varvec{y} + } \right\rangle \left| {\varvec{y} + } \right\rangle - \left| {\varvec{y} - } \right\rangle \left| {\varvec{y} - } \right\rangle \left| {\varvec{y} - } \right\rangle } \right)_{{({\mathbf{2}}\varvec{j})\varvec{ABC}}} \\ \end{aligned} $$

(20)

Here, $\left| {x + } \right\rangle$ and $\left| {\varvec{x}{\mathbf{ - }}} \right\rangle$ are the eigenstates of $\sigma_{x}$, and $\left| {y + } \right\rangle$ and $\left| {y - } \right\rangle$ are the eigenstates of $\sigma_{y}$. Then, Alice and Bob inform Charlie of the location of the $\left( {2j - 1} \right)$th state and the measurement base $\sigma_{z}$ or $\sigma_{x}$. They also inform Charlie of the location of the $\left( {2j} \right)$th state and the measurement base $\sigma_{z}$ or $\sigma_{y}$. Charlie measures the $\left( {2j - 1} \right)$th state of Eq. (19) with the base $\sigma_{z}$ or $\sigma_{x}$ and the $\left( {2j} \right)$th state of Eq. (20) with the base $\sigma_{z}$ or $\sigma_{y}$ and announces each outcome with the basis to Alice and Bob. Alice and Bob then measure each $\left( {2j - 1} \right)$th and $\left( {2j} \right)$th state on the same basis as Charlie. The outcomes of these measurements should be in accordance with Tables 1 and 2; otherwise, Charlie is deemed to have committed fraud. Because Alice and Bob perform this method before performing the Bell measurement of E3 phase in Sect. 2, this method can block Charlie’s malicious behavior and is an active countermeasure. Hence, Alice and Bob’s authentication keys are not exposed. The only disadvantage of this method is that it requires some state consumption for honesty-checking.

Table 1 Measurement outcomes from the honesty-check of the $\left( {2j - 1} \right)$th state in Eq. (19)

Table 2 Measurement outcomes from the honesty-check of the $\left( {2j} \right)$th state in Eq. (20)

As a final countermeasure, Alice and Bob can use a random number to defend themselves against Eve’s attack. This method has already been proposed to prevent Charlie’s internal attack in the CMQEA protocol [1], and Alice and Bob use it after encrypting the authentication key with each random number. The proposed method involves using a random number; the protocol that modifies the entity authentication phase is described below [1].

E1′ (a) Alice and Bob prepare random numbers $r_{\left( i \right)A}$ and $r_{\left( i \right)B}$, where $r_{\left( i \right)A} , r_{\left( i \right)B} \in \left\{ {00, 01, 10, 11} \right\}$. Then, they encrypt their previously shared authentication key $k_{i}$ with their own random numbers $r_{\left( i \right)A}$ and $r_{\left( i \right)B}$:

$$ \varvec{k}_{{(\varvec{i})\varvec{A}}} = \varvec{k}_{\varvec{i}} \oplus \varvec{r}_{{(\varvec{i})\varvec{A}}} $$

(21)

$$ \varvec{k}_{{(\varvec{i})\varvec{B}}} = \varvec{k}_{\varvec{i}} \oplus \varvec{r}_{{(\varvec{i})\varvec{B}}} $$

(22)

Here, symbol $\oplus$ indicates exclusive or, XOR.

• E1′ (b) Charlie randomly selects only one from among Alice or Bob. If Charlie selects Alice, Alice applies the Pauli operator $\sigma_{{\varvec{k}_{{(\varvec{i})\varvec{A}}} }}$ corresponding to the encrypted authentication key $\varvec{k}_{{(\varvec{i})\varvec{A}}} = \varvec{k}_{\varvec{i}} \oplus r_{(i)A}$ of Eq. (21) to the qubit $A_{{\left( {2i - 1} \right)}}$:

  $$ \begin{aligned} &\varvec{\sigma}_{{\varvec{k}_{{(\varvec{i})\varvec{A}}} }} \left|\varvec{\xi}\right\rangle_{{({\mathbf{2}}\varvec{i} - {\mathbf{1}})\varvec{ABC}}} \otimes \left|\varvec{\xi}\right\rangle_{{({\mathbf{2}}\varvec{i})\varvec{ABC}}} \\ & \quad = \frac{{\mathbf{1}}}{{\sqrt {\mathbf{2}} }}\left[ {\left( {\varvec{\sigma}_{{\varvec{k}_{{(\varvec{i})\varvec{A}}} }} \otimes \varvec{I}} \right)\left| {{\varvec{\Psi}}^{ + } } \right\rangle_{{({\mathbf{2}}\varvec{i} - {\mathbf{1}})\varvec{AB}}} \left| {\mathbf{0}} \right\rangle_{{({\mathbf{2}}\varvec{i} - {\mathbf{1}})\varvec{C}}} + \left( {\varvec{\sigma}_{{\varvec{k}_{{(\varvec{i})\varvec{A}}} }} \otimes \varvec{I}} \right)\left| {\Phi^{ + } } \right\rangle_{{({\mathbf{2}}\varvec{i} - {\mathbf{1}})\varvec{AB}}} \left| {\mathbf{1}} \right\rangle_{{({\mathbf{2}}\varvec{i} - {\mathbf{1}})\varvec{C}}} } \right] \\ & \quad \quad \otimes \frac{{\mathbf{1}}}{{\sqrt {\mathbf{2}} }}\left( {\left| {{\varvec{\Phi}}^{ - } } \right\rangle_{{({\mathbf{2}}\varvec{i})\varvec{AB}}} \left| {\mathbf{0}} \right\rangle_{{({\mathbf{2}}\varvec{i})\varvec{C}}} - \left| {{\varvec{\Psi}}^{ + } } \right\rangle_{{({\mathbf{2}}\varvec{i})\varvec{AB}}} \left| {\mathbf{1}} \right\rangle_{{({\mathbf{2}}\varvec{i})\varvec{C}}} } \right) \\ \end{aligned} $$

  (23)

  If Charlie selects Bob, Bob applies the Pauli operator corresponding to the classical bit $\varvec{k}_{{\left( \varvec{i} \right)\varvec{B}}} = \varvec{k}_{\varvec{i}} \oplus r_{{\left( i \right)\varvec{B}}}$ of Eq. (22) to the qubit $B_{{\left( {2i} \right)}}$:

  $$ \begin{aligned} & \left|\varvec{\xi}\right\rangle_{{({\mathbf{2}}\varvec{i} - {\mathbf{1}})\varvec{ABC}}} \otimes\varvec{\sigma}_{{\varvec{k}_{{(\varvec{i})\varvec{B}}} }} \left|\varvec{\xi}\right\rangle_{{({\mathbf{2}}\varvec{i})\varvec{ABC}}} \\ & \quad = \frac{{\mathbf{1}}}{{\sqrt {\mathbf{2}} }}\left( {\left| {{\varvec{\Psi}}^{ + } } \right\rangle_{{({\mathbf{2}}\varvec{i} - {\mathbf{1}})\varvec{AB}}} \left| {\mathbf{0}} \right\rangle_{{({\mathbf{2}}\varvec{i} - {\mathbf{1}})\varvec{C}}} + \left| {{\varvec{\Phi}}^{ + } } \right\rangle_{{({\mathbf{2}}\varvec{i} - {\mathbf{1}})\varvec{AB}}} \left| {\mathbf{1}} \right\rangle_{{({\mathbf{2}}\varvec{i} - {\mathbf{1}})\varvec{C}}} } \right) \\ & \quad \quad \otimes \frac{{\mathbf{1}}}{{\sqrt {\mathbf{2}} }}\left[ {\left( {\varvec{I} \otimes\varvec{\sigma}_{{\varvec{k}_{{(\varvec{i})\varvec{B}}} }} } \right)\left| {{\varvec{\Phi}}^{ - } } \right\rangle_{{({\mathbf{2}}\varvec{i})\varvec{AB}}} \left| {\mathbf{0}} \right\rangle_{{({\mathbf{2}}\varvec{i})\varvec{C}}} - \left( {\varvec{I} \otimes\varvec{\sigma}_{{\varvec{k}_{{(\varvec{i})\varvec{B}}} }} } \right)\left| {{\varvec{\Psi}}^{ + } } \right\rangle_{{({\mathbf{2}}\varvec{i})\varvec{AB}}} \left| {\mathbf{1}} \right\rangle_{{({\mathbf{2}}\varvec{i})\varvec{C}}} } \right] \\ \end{aligned} $$

  (24)

  Here, $\varvec{k}_{\varvec{i}} \left( { = \varvec{k}_{{\left( \varvec{i} \right)\varvec{A}}} \oplus r_{\left( i \right)A} = \varvec{k}_{{\left( \varvec{i} \right)\varvec{B}}} \oplus r_{{\left( i \right)\varvec{B}}} } \right)$ is a authentication key pre-shared by Alice and Bob in the preparation phase, $\varvec{k}_{\varvec{i}} \in \left\{ {00, 01, 10, 11} \right\}$.

• E2′ Charlie executes the $\sigma_{z}$-basis measurement on the qubits $\left\{ {C_{{\left( {2i - 1} \right)}} , C_{{\left( {2i} \right)}} } \right\}$ in Eq. (23) or Eq. (24). His measurement outcome is $c_{2i - 1} c_{2i}$, where $c_{2i - 1} c_{2i} \in \left\{ {00, 01, 10, 11} \right\}$. After Charlie’s measurement, the GHZ-like states of Eq. (23) collapse into

  $$ \begin{aligned} c_{2i - 1} c_{2i} & = 00 :\left[ {\sigma_{{k_{(i)A} }} \left| {\Psi^{ + } } \right\rangle_{(2i - 1)AB} } \right]\left| {\Phi^{ - } } \right\rangle_{(2i)AB} , \\ c_{2i - 1} c_{2i} & = 01 :\left[ {\varvec{\sigma}_{{\varvec{k}_{{(\varvec{i})\varvec{A}}} }} \left| {{\varvec{\Psi}}^{ + } } \right\rangle_{{({\mathbf{2}}\varvec{i} - {\mathbf{1}})\varvec{AB}}} } \right]\left| {{\varvec{\Psi}}^{ + } } \right\rangle_{{({\mathbf{2}}\varvec{i})\varvec{AB}}} , \\ c_{2i - 1} c_{2i} & = 10 :\left[ {\sigma_{{k_{(i)A} }} \left| {\Phi^{ + } } \right\rangle_{(2i - 1)AB} } \right]\left| {\Phi^{ - } } \right\rangle_{(2i)AB} , \\ {\text{or}}\; c_{2i - 1} c_{2i} & = 11 :\left[ {\sigma_{{k_{(i)A} }} \left| {\Phi^{ + } } \right\rangle_{(2i - 1)AB} } \right]\left| {{\varvec{\Psi}}^{ + } } \right\rangle_{{({\mathbf{2}}\varvec{i})\varvec{AB}}} \\ \end{aligned} $$

  (25)

  and the GHZ-like states of Eq. (24) collapse into

  $$ \begin{aligned} c_{2i - 1} c_{2i} & = 00 :\left| {\Psi^{ + } } \right\rangle_{(2i - 1)AB} \left[ {\sigma_{{k_{(i)B} }} \left| {\Phi^{ - } } \right\rangle_{{\left( {2i} \right)AB}} } \right], \\ c_{2i - 1} c_{2i} & = 01 :\left| {{\varvec{\Psi}}^{ + } } \right\rangle_{{{\mathbf{(2}}\varvec{i} - {\mathbf{1}})\varvec{AB}}} \left| {\Psi^{ + } } \right\rangle_{{\left( {2i - 1} \right)AB}} \left[ {\sigma_{{k_{\left( i \right)B} }} \left| {{\varvec{\Psi}}^{ + } } \right\rangle_{{({\mathbf{2}}\varvec{i})\varvec{AB}}} } \right], \\ c_{2i - 1} c_{2i} & = 10 :\left| {\Phi^{ + } } \right\rangle_{(2i - 1)AB} \left[ {\sigma_{{k_{(i)B} }} \left| {\Phi^{ - } } \right\rangle_{{\left( {2i} \right)AB}} } \right], \\ {\text{or}}\;c_{2i - 1} c_{2i} & = 11 :\left| {\Phi^{ + } } \right\rangle_{(2i - 1)AB} \left[ {\sigma_{{k_{(i)B} }} \left| {{\varvec{\Psi}}^{ + } } \right\rangle_{{({\mathbf{2}}\varvec{i})\varvec{AB}}} } \right] \\ \end{aligned} $$

  (26)

  with a 25% probability, and Alice and Bob share one of the pairs of the entangled states. For the first example, when $\varvec{k}_{\varvec{i}} = 11$ and $r_{\left( i \right)A} = 01$, Alice applies the Pauli operator $i\sigma_{y} \left( { = \sigma_{{\varvec{k}_{\varvec{i}} \oplus r_{(i)A} }} = \sigma_{10} } \right)$ to the qubit $A_{{\left( {2i - 1} \right)}}$ in GHZ-like state of Eq. (25):

  $$ \begin{aligned} c_{2i - 1} c_{2i} & = 00 :\left[ {\varvec{i}\sigma_{{\mathbf{y}}} \left| {\Psi^{ + } } \right\rangle_{(2i - 1)AB} } \right]\left| {\Phi^{ - } } \right\rangle_{(2i)AB} = \left| {\Phi^{ - } } \right\rangle_{(2i - 1)AB} \left| {\Phi^{ - } } \right\rangle_{(2i)AB} = \left| {{\text{ID}} + + } \right\rangle_{{\left( {2i - 1} \right)\left( {2i} \right)AB}} , \\ c_{2i - 1} c_{2i} & = 01 : \left[ {\varvec{i}\sigma_{{\mathbf{y}}} \left| {{\varvec{\Psi}}^{ + } } \right\rangle_{{({\mathbf{2}}\varvec{i} - {\mathbf{1}})\varvec{AB}}} } \right]\left| {{\varvec{\Psi}}^{ + } } \right\rangle_{{({\mathbf{2}}\varvec{i})\varvec{AB}}} = \left| {\Phi^{ - } } \right\rangle_{(2i - 1)AB} \left| {{\varvec{\Psi}}^{ + } } \right\rangle_{{({\mathbf{2}}\varvec{i})\varvec{AB}}} = \left| {{\text{Rev}} + - } \right\rangle_{{\left( {2i - 1} \right)\left( {2i} \right)AB}} , \\ c_{2i - 1} c_{2i} & = 10 :\left[ {\varvec{i}\sigma_{{\mathbf{y}}} \left| {\Phi^{ + } } \right\rangle_{(2i - 1)AB} } \right]\left| {\Phi^{ - } } \right\rangle_{(2i)AB} = \left| {{\varvec{\Psi}}^{ - } } \right\rangle_{(2i - 1)AB} \left| {\Phi^{ - } } \right\rangle_{(2i)AB} = \left| {{\text{Rev}} + + } \right\rangle_{{\left( {2i - 1} \right)\left( {2i} \right)AB}} , \\ {\text{or}}\;c_{2i - 1} c_{2i} & = 11 :\left[ {\varvec{i}\sigma_{{\mathbf{y}}} \left| {\Phi^{ + } } \right\rangle_{(2i - 1)AB} } \right]\left| {{\varvec{\Psi}}^{ + } } \right\rangle_{{({\mathbf{2}}\varvec{i})\varvec{AB}}} = \left| {{\varvec{\Psi}}^{ - } } \right\rangle_{(2i - 1)AB} \left| {{\varvec{\Psi}}^{ + } } \right\rangle_{{({\mathbf{2}}\varvec{i})\varvec{AB}}} = \left| {{\text{ID}} + - } \right\rangle_{{\left( {2i - 1} \right)\left( {2i} \right)AB}} . \\ \end{aligned} $$

  (27)

  For the second example, when $\varvec{k}_{\varvec{i}} = 11$ and $r_{\left( i \right)A} = 10$, Alice applies the Pauli operator $\sigma_{x} \left( { = \sigma_{{\varvec{k}_{\varvec{i}} \oplus r_{\left( i \right)A} }} = \sigma_{10} } \right)$ to the qubit $A_{{\left( {2i - 1} \right)}}$ in GHZ-like state of Eq. (25):

  $$ \begin{aligned} c_{2i - 1} c_{2i} & = 00 :\left[ {\sigma_{x} \left| {\Psi^{ + } } \right\rangle_{(2i - 1)AB} } \right]\left| {\Phi^{ - } } \right\rangle_{{\left( {2i} \right)AB}} = \left| {\Phi^{ + } } \right\rangle_{(2i - 1)AB} \left| {\Phi^{ - } } \right\rangle_{{\left( {2i} \right)AB}} = \left| {{\text{ID}} + - } \right\rangle_{{\left( {2i - 1} \right)\left( {2i} \right)AB}} , \\ c_{2i - 1} c_{2i} & = 01 : \left[ {\sigma_{x} \left| {{\varvec{\Psi}}^{ + } } \right\rangle_{{({\mathbf{2}}\varvec{i} - {\mathbf{1}})\varvec{AB}}} } \right]\left| {{\varvec{\Psi}}^{ + } } \right\rangle_{{({\mathbf{2}}\varvec{i})\varvec{AB}}} = \left| {\Phi^{ + } } \right\rangle_{(2i - 1)AB} \left| {{\varvec{\Psi}}^{ + } } \right\rangle_{{({\mathbf{2}}\varvec{i})\varvec{AB}}} = \left| {{\text{Rev}} + + } \right\rangle_{{\left( {2i - 1} \right)\left( {2i} \right)AB}} , \\ c_{2i - 1} c_{2i} & = 10 :\left[ {\sigma_{x} \left| {\Phi^{ + } } \right\rangle_{(2i - 1)AB} } \right]\left| {\Phi^{ - } } \right\rangle_{{\left( {2i} \right)AB}} = \left| {{\varvec{\Psi}}^{ + } } \right\rangle_{(2i - 1)AB} \left| {\Phi^{ - } } \right\rangle_{{\left( {2i} \right)AB}} = \left| {{\text{Rev}} + - } \right\rangle_{{\left( {2i - 1} \right)\left( {2i} \right)AB}} , \\ {\text{or}}\;c_{2i - 1} c_{2i} & = 11 :\left[ {\sigma_{x} \left| {\Phi^{ + } } \right\rangle_{(2i - 1)AB} } \right]\left| {{\varvec{\Psi}}^{ + } } \right\rangle_{{({\mathbf{2}}\varvec{i})\varvec{AB}}} = \left| {{\varvec{\Psi}}^{ + } } \right\rangle_{(2i - 1)AB} \left| {{\varvec{\Psi}}^{ + } } \right\rangle_{{({\mathbf{2}}\varvec{i})\varvec{AB}}} = \left| {{\text{ID}} + + } \right\rangle_{{\left( {2i - 1} \right)\left( {2i} \right)AB}} . \\ \end{aligned} $$

  (28)

  For the third example, when $\varvec{k}_{\varvec{i}} = 11$ and $r_{\left( i \right)B} = 10$, Bob applies the Pauli operator $\sigma_{x} \left( { = \sigma_{{\varvec{k}_{\varvec{i}} \oplus r_{\left( i \right)A} }} = \sigma_{01} } \right)$ to the qubit $B_{{\left( {2i - 1} \right)}}$ in GHZ-like state of Eq. (26):

  $$ \begin{aligned} c_{2i - 1} c_{2i} & = 00 :\left| {\Psi^{ + } } \right\rangle_{{\left( {2i - 1} \right)AB}} \left[ {\sigma_{x} \left| {\Phi^{ - } } \right\rangle_{{\left( {2i} \right)AB}} } \right] = \left| {\Psi^{ + } } \right\rangle_{{\left( {2i - 1} \right)AB}} \left| {\Psi^{ - } } \right\rangle_{{\left( {2i} \right)AB}} = \left| {{\text{ID}} + - } \right\rangle_{{\left( {2i - 1} \right)\left( {2i} \right)AB}} , \\ c_{2i - 1} c_{2i} & = 01 :\left| {{\varvec{\Psi}}^{ + } } \right\rangle_{{({\mathbf{2}}\varvec{i} - {\mathbf{1}})\varvec{AB}}} \left[ {\sigma_{x} \left| {{\varvec{\Psi}}^{ + } } \right\rangle_{{({\mathbf{2}}\varvec{i})\varvec{AB}}} } \right] = \left| {\Psi^{ + } } \right\rangle_{{\left( {2i - 1} \right)AB}} \left| {\Phi^{ + } } \right\rangle_{{\left( {2i} \right)AB}} = \left| {{\text{Rev}} + + } \right\rangle_{{\left( {2i - 1} \right)\left( {2i} \right)AB}} , \\ c_{2i - 1} c_{2i} & = 10 :\left| {\Phi^{ + } } \right\rangle_{{\left( {2i - 1} \right)AB}} \left[ {\sigma_{x} \left| {\Phi^{ - } } \right\rangle_{{\left( {2i} \right)AB}} } \right] = \left| {\Phi^{ + } } \right\rangle_{{\left( {2i - 1} \right)AB}} \left| {\Psi^{ - } } \right\rangle_{{\left( {2i} \right)AB}} = \left| {{\text{Rev}} + - } \right\rangle_{{\left( {2i - 1} \right)\left( {2i} \right)AB}} , \\ or\;c_{2i - 1} c_{2i} & = 11 : \left| {\Phi^{ + } } \right\rangle_{{\left( {2i - 1} \right)AB}} \left[ {\sigma_{x} \left| {{\varvec{\Psi}}^{ + } } \right\rangle_{{({\mathbf{2}}\varvec{i})\varvec{AB}}} } \right] = \left| {\Phi^{ + } } \right\rangle_{{\left( {2i - 1} \right)AB}} \left| {\Phi^{ + } } \right\rangle_{{\left( {2i} \right)AB}} = \left| {{\text{ID}} + + } \right\rangle_{{\left( {2i - 1} \right)\left( {2i} \right)AB}} . \\ \end{aligned} $$

  (29)

• E3′ Alice and Bob execute the Bell-basis measurements on the qubits $\left\{ {A_{{\left( {2i - 1} \right)}} , A_{{\left( {2i} \right)}} } \right\}$ and $\left\{ {B_{{\left( {2i - 1} \right)}} , B_{{\left( {2i} \right)}} } \right\}$ of Eqs. (25) and (26), respectively. Then, they exchange their measurement outcomes, $a_{2i - 1} a_{2i}$ and $b_{2i - 1} b_{2i}$ ($a_{j} \;\& \;b_{j} \in \left\{ {0, 1} \right\}, j = 2i - 1\;{\text{or}}\; 2i)$. From the first example of phase E2′, if Charlie’s measurement outcomes $c_{2i - 1} c_{2i} = 01$, the Bell states shared by Alice and Bob are $\left| {\Phi^{ - } } \right\rangle_{{\left( {2i - 1} \right)AB}} \left| {\Psi^{ + } } \right\rangle_{{\left( {2i} \right)AB}} = \left| {{\text{Rev}} + - } \right\rangle_{{\left( {2i - 1} \right)\left( {2i} \right)AB}}$ in Eq. (27). Therefore, the Bell-state measurement outcomes $\left( {a_{2i - 1} a_{2i} , b_{2i - 1} b_{2i} } \right)$ of Alice and Bob are as follows:

  $$ \begin{aligned} \left( {00, 11} \right): \left| {\Phi^{ + } } \right\rangle_{{\left( {2i - 1} \right)A\left( {2i} \right)A}} \left| {\Psi^{ - } } \right\rangle_{{\left( {2i - 1} \right)B\left( {2i} \right)B}} \hfill \\ \left( {01,10} \right):\left| {\Phi^{ - } } \right\rangle_{{\left( {2i - 1} \right)A\left( {2i} \right)A}} \left| {\Psi^{ + } } \right\rangle_{{\left( {2i - 1} \right)B\left( {2i} \right)B}} \hfill \\ \left( {10, 01} \right):\left| {\Psi^{ + } } \right\rangle_{{\left( {2i - 1} \right)A\left( {2i} \right)A}} \left| {\Phi^{ - } } \right\rangle_{{\left( {2i - 1} \right)B\left( {2i} \right)B}} \hfill \\ \left( {11, 00} \right):\left| {\Psi^{ - } } \right\rangle_{{\left( {2i - 1} \right)A\left( {2i} \right)A}} \left| {\Phi^{ + } } \right\rangle_{{\left( {2i - 1} \right)B\left( {2i} \right)B}} \hfill \\ \end{aligned} $$

  (30)

  Then, they exchange their measurement outcomes $\left( {a_{2i - 1} a_{2i} , b_{2i - 1} b_{2i} } \right)$ in Eq. (30). From the second example of phase E2′, if Charlie’ measurement outcomes $c_{2i - 1} c_{2i} = 10$, the Bell states shared by Alice and Bob are $\left| {{\varvec{\Psi}}^{ + } } \right\rangle_{(2i - 1)AB} \left| {\Phi^{ - } } \right\rangle_{{\left( {2i} \right)AB}} = \left| {{\text{Rev}} + - } \right\rangle_{{\left( {2i - 1} \right)\left( {2i} \right)AB}}$ in Eq. (28). Therefore, the Bell-state measurement outcomes $\left( {a_{2i - 1} a_{2i} , b_{2i - 1} b_{2i} } \right)$ of Alice and Bob are the same as Eq. (30). From the third example of phase E2′, if Charlie’s measurement outcomes $c_{2i - 1} c_{2i} = 01$, the Bell states shared by Alice and Bob are $\left| {\Psi^{ + } } \right\rangle_{{\left( {2i - 1} \right)AB}} \left| {\Phi^{ + } } \right\rangle_{{\left( {2i} \right)AB}} = \left| {{\text{Rev}} + + } \right\rangle_{{\left( {2i - 1} \right)\left( {2i} \right)AB}}$ in Eq. (29). Therefore, the Bell-state measurement outcomes $\left( {a_{2i - 1} a_{2i} , b_{2i - 1} b_{2i} } \right)$ of Alice and Bob are as follows:

  $$ \begin{aligned} \left( {00, 10} \right): \left| {\Phi^{ + } } \right\rangle_{{\left( {2i - 1} \right)A\left( {2i} \right)A}} \left| {\Psi^{ + } } \right\rangle_{{\left( {2i - 1} \right)B\left( {2i} \right)B}} \hfill \\ \left( {01,11} \right):\left| {\Phi^{ - } } \right\rangle_{{\left( {2i - 1} \right)A\left( {2i} \right)A}} \left| {\Psi^{ - } } \right\rangle_{{\left( {2i - 1} \right)B\left( {2i} \right)B}} \hfill \\ \left( {10, 00} \right):\left| {\Psi^{ + } } \right\rangle_{{\left( {2i - 1} \right)A\left( {2i} \right)A}} \left| {\Phi^{ + } } \right\rangle_{{\left( {2i - 1} \right)B\left( {2i} \right)B}} \hfill \\ \left( {11, 01} \right):\left| {\Psi^{ - } } \right\rangle_{{\left( {2i - 1} \right)A\left( {2i} \right)A}} \left| {\Phi^{ - } } \right\rangle_{{\left( {2i - 1} \right)B\left( {2i} \right)B}} \hfill \\ \end{aligned} $$

  (31)

  Then, they exchange their measurement outcomes $\left( {a_{2i - 1} a_{2i} , b_{2i - 1} b_{2i} } \right)$ in Eq. (31).

• E4′ (a) Charlie reveals the measurement outcomes $c_{2i - 1} c_{2i}$ acquired in Phase E2′; then, Alice or Bob announces $r_{A}$ or $r_{B}$ to Charlie, respectively.

• E4′ (b) Alice and Bob confirm whether their classical bits, $a_{2i - 1} a_{2i}$, $b_{2i - 1} b_{2i}$, and $c_{2i - 1} c_{2i}$, correspond to the encrypted authentication key $\varvec{k}_{{\left( \varvec{i} \right)\varvec{A}}} = \varvec{k}_{\varvec{i}} \oplus \varvec{r}_{{\left( \varvec{i} \right)\varvec{A}}}$ or $\varvec{k}_{{\left( \varvec{i} \right)\varvec{B}}} = \varvec{k}_{\varvec{i}} \oplus \varvec{r}_{{\left( \varvec{i} \right)\varvec{B}}}$, as presented in Table 4 in [2]. From the first example of phase E3′, because the encrypted authentication key $\varvec{k}_{{\left( \varvec{i} \right)\varvec{A}}} = \varvec{k}_{\varvec{i}} \oplus \varvec{r}_{{\left( \varvec{i} \right)\varvec{A}}}$ is 10 and $c_{2i - 1} c_{2i}$ is 01, the Bell-state measurement outcomes $\left( {a_{2i - 1} a_{2i} , b_{2i - 1} b_{2i} } \right)$ of Alice and Bob must be one of the results of Eq. (30). Note that $\varvec{k}_{\varvec{i}} = 11$ and $r_{\left( i \right)A} = 01$. From the second example of E3′ phase, because the encrypted authentication key $\varvec{k}_{{\left( \varvec{i} \right)\varvec{A}}} = \varvec{k}_{\varvec{i}} \oplus \varvec{r}_{{\left( \varvec{i} \right)\varvec{A}}}$ is 01 and $c_{2i - 1} c_{2i}$ is 10, the Bell-state measurement outcomes $\left( {a_{2i - 1} a_{2i} , b_{2i - 1} b_{2i} } \right)$ of Alice and Bob must also be one of the results of Eq. (30). Note that $\varvec{k}_{\varvec{i}} = 11$ and $r_{\left( i \right)A} = 01$. From the third example of phase E3′, because the encrypted authentication key $\varvec{k}_{{\left( \varvec{i} \right)\varvec{B}}} = \varvec{k}_{\varvec{i}} \oplus \varvec{r}_{{\left( \varvec{i} \right)\varvec{B}}}$ is 01 and $c_{2i - 1} c_{2i}$ is 01, the Bell-state measurement outcomes $\left( {a_{2i - 1} a_{2i} , b_{2i - 1} b_{2i} } \right)$ of Alice and Bob must be one of the results of Eq. (31). Note that $\varvec{k}_{\varvec{i}} = 11$ and $r_{\left( i \right)B} = 10$.

Here, we analyze when the entanglement swapping attacks are applied to these methods. As in the first example, if an authentication key $k_{i} = 11$ and Alice’s random number $r_{A} = 01$, Alice applies the Pauli operator $i\sigma_{y} \left( { = U_{{k_{i} \oplus r_{A} }} } \right)$, which corresponds to an encrypted authentication key $\varvec{k}_{{\left( \varvec{i} \right)\varvec{A}}} = \varvec{k}_{\varvec{i}} \oplus \varvec{r}_{{\left( \varvec{i} \right)\varvec{A}}} = 10$, to the qubit $\left( {2i - 1} \right)A$ in GHZ-like states of Eq. (23), as follows:

$$ \begin{aligned} i\sigma_{y} \left| \xi \right\rangle_{{\left( {2i - 1} \right)ABC}} \otimes \left| \xi \right\rangle_{{\left( {2i} \right)ABC}} = & \frac{1}{2}\left( {\left| {\Phi^{ - } } \right\rangle_{{\left( {2i - 1} \right)AB}} \left| {\Phi^{ - } } \right\rangle_{{\left( {2i} \right)AB}} \left| 0 \right\rangle_{{\left( {2i - 1} \right)C}} \left| 0 \right\rangle_{{\left( {2i} \right)C}} } \right. \\ & \quad - \,\left| {\Phi^{ - } } \right\rangle_{{\left( {2i - 1} \right)AB}} \left| {\Psi^{ + } } \right\rangle_{{\left( {2i} \right)AB}} \left| 0 \right\rangle_{{\left( {2i - 1} \right)C}} \left| 1 \right\rangle_{{\left( {2i} \right)C}} \\ & \quad + \,\left| {\Psi^{ - } } \right\rangle_{{\left( {2i - 1} \right)AB}} \left| {\Phi^{ - } } \right\rangle_{{\left( {2i} \right)AB}} \left| 1 \right\rangle_{{\left( {2i - 1} \right)C}} \left| 0 \right\rangle_{{\left( {2i} \right)C}} \\ & \quad + \,\left. {\left| {\Psi^{ - } } \right\rangle_{{\left( {2i - 1} \right)AB}} \left| {\Psi^{ + } } \right\rangle_{{\left( {2i} \right)AB}} \left| 0 \right\rangle_{{\left( {2i - 1} \right)C}} \left| 1 \right\rangle_{{\left( {2i} \right)C}} } \right) \\ \end{aligned} $$

(32)

The GHZ-like states of Eq. $\left( {32} \right)$ are rearranged as follows:

$$ \begin{aligned} & i\sigma_{y} \left| \xi \right\rangle_{{\left( {2i - 1} \right)ABC}} \otimes \left| \xi \right\rangle_{{\left( {2i} \right)ABC}} \\ & = \frac{1}{2}\left[ {\left( {\left| {{\text{ID}} + + } \right\rangle_{{\left( {2i - 1} \right)\left( {2i} \right)A\left( {2i - 1} \right)\left( {2i} \right)B}} + \left| {{\text{ID}} + - } \right\rangle_{{\left( {2i - 1} \right)\left( {2i} \right)A\left( {2i - 1} \right)\left( {2i} \right)B}} } \right)\left| {\Phi^{ + } } \right\rangle_{{\left( {2i - 1} \right)\left( {2i} \right)C}} } \right. \\ & \quad + \,\left( {\left| {{\text{ID}} + + } \right\rangle_{{\left( {2i - 1} \right)\left( {2i} \right)A\left( {2i - 1} \right)\left( {2i} \right)B}} - \left| {{\text{ID}} + - } \right\rangle_{{\left( {2i - 1} \right)\left( {2i} \right)A\left( {2i - 1} \right)\left( {2i} \right)B}} } \right)\left| {\Phi^{ - } } \right\rangle_{{\left( {2i - 1} \right)\left( {2i} \right)C}} \\ & \quad - \,\left( {\left| {{\text{Rev}} + - } \right\rangle_{{\left( {2i - 1} \right)\left( {2i} \right)A\left( {2i - 1} \right)\left( {2i} \right)B}} - \left| {{\text{Rev}} + + } \right\rangle_{{\left( {2i - 1} \right)\left( {2i} \right)A\left( {2i - 1} \right)\left( {2i} \right)B}} } \right)\left| {\Psi^{ + } } \right\rangle_{{\left( {2i - 1} \right)\left( {2i} \right)C}} \\ & \left. {\quad - \,\left( {\left| {{\text{Rev}} + - } \right\rangle_{{\left( {2i - 1} \right)\left( {2i} \right)A\left( {2i - 1} \right)\left( {2i} \right)B}} + \left| {{\text{Rev}} + + } \right\rangle_{{\left( {2i - 1} \right)\left( {2i} \right)A\left( {2i - 1} \right)\left( {2i} \right)B}} } \right)\left| {\Psi^{ - } } \right\rangle_{{\left( {2i - 1} \right)\left( {2i} \right)C}} } \right] \\ \end{aligned} $$

(33)

After Alice and Bob’ Bell measurements on $\{ \left( {2i} \right)\left( {2i - 1} \right)A$ and $\left( {2i} \right)\left( {2i - 1} \right)B$ qubits of the GHZ-like states of Eq. (33), Charlie performs a Bell measurement on the $\left( {2i} \right)C$ and $\left( {2i - 1} \right)C$ qubits of Eq. (33) without following the E2′ phase. If Alice and Bob’s measurement outcomes $\left( {a_{2i - 1} a_{2i} , b_{2i - 1} b_{2i} } \right)$ are $\left| {{\text{Rev}} + - } \right\rangle_{{\left( {2i - 1} \right)\left( {2i} \right)A\left( {2i - 1} \right)\left( {2i} \right)B}}$, Charlie’s measurement outcomes $c_{2i - 1} c_{2i}$ must be $\left| {\Psi^{ + } } \right\rangle_{{\left( {2i - 1} \right)\left( {2i} \right)C}}$ or $\left| {\Psi^{ - } } \right\rangle_{{\left( {2i - 1} \right)\left( {2i} \right)C}}$. Then, they exchange their measurement outcomes $\left( {a_{2i - 1} a_{2i} , b_{2i - 1} b_{2i} } \right)$. Through these measurement outcomes, Charlie cannot accurately guess that the Pauli operator applied by Alice is $\sigma_{x}$, which corresponds to the encrypted authentication key $\varvec{k}_{{\left( \varvec{i} \right)\varvec{A}}} = \varvec{k}_{\varvec{i}} \oplus \varvec{r}_{{\left( \varvec{i} \right)\varvec{A}}} = 01$, or $i\sigma_{y}$, which corresponds to the encrypted authentication key $\varvec{k}_{{\left( \varvec{i} \right)\varvec{A}}} = \varvec{k}_{\varvec{i}} \oplus \varvec{r}_{{\left( \varvec{i} \right)\varvec{A}}} = 10$. Note that, Eq. (33) is the same as Eq. (7). Furthermore, as mentioned in Sect. 3, since Eq. (6) and Eq. (33) (= Eq. (7)) differ only in the relative phase ±, it is impossible to distinguish these two equations even if Charlie obtains the measurement outcomes of Alice and Bob. Therefore, Charlie can only estimate the encrypted key $\varvec{k}_{{\left( \varvec{i} \right)\varvec{A}}} \in \left\{ {01, 10} \right\}$ with a 1/2 probability but cannot know the authentication key $k_{i} = 11$. To find out the authentication key $\varvec{k}_{\varvec{i}}$, Charlie should perform phase E4′ (a). Furthermore, in phase E4′ (a), Charlie acts as if it were $\sigma_{z}$-basis measurements rather than Bell measurements as in phase E2′. To do this, as Eqs. (27) or (28), Charlie must release the appropriate measurement outcomes. However, Charlie does not know the proper measurement outcomes $c_{2i - 1} c_{2i}$ corresponding to Alice and Bob’s measurement outcomes $\left( {a_{2i - 1} a_{2i} , b_{2i - 1} b_{2i} } \right) = \left| {{\text{Rev}} + - } \right\rangle_{{\left( {2i - 1} \right)\left( {2i} \right)A\left( {2i - 1} \right)\left( {2i} \right)B}}$. The reason is that even if Charlie knows their outcomes, he still does not know the encrypted authentication key $\varvec{k}_{{\left( \varvec{i} \right)\varvec{A}}} \in \left\{ {01, 10} \right\}$ correctly. Therefore, Charlie cannot guess if his measurement should be $c_{2i - 1} c_{2i} = 01$ in Eq. (27) or $c_{2i - 1} c_{2i} = 10$ in Eq. (28). As a result, Charlie’s attack is revealed in the final verification phase, E4′ (b).

5 Entanglement swapping attack-resistance CMQEA protocol

In order to the CMQEA protocol to be fundamentally resistant to the entanglement swapping attack described in the above chapter 3, Alice and Bob’s measurement outcomes should be the same even if this attack is performed. Therefore, we propose to use GHZ-like states

$$ \begin{aligned} \left|\varvec{\xi}\right\rangle_{{({\mathbf{2}}\varvec{i} - {\mathbf{1}})\varvec{ABC}}} \otimes \left|\varvec{\xi}\right\rangle_{{\left( {{\mathbf{2}}\varvec{i}} \right)\varvec{ABC}}} & = \frac{{\mathbf{1}}}{{\sqrt {\mathbf{2}} }}\left( {\left| {{\varvec{\Psi}}^{ + } } \right\rangle_{{({\mathbf{2}}\varvec{i} - {\mathbf{1}})\varvec{AB}}} \left| {\mathbf{0}} \right\rangle_{{({\mathbf{2}}\varvec{i} - {\mathbf{1}})\varvec{C}}} + \left| {{\varvec{\Psi}}^{ - } } \right\rangle_{{({\mathbf{2}}\varvec{i} - {\mathbf{1}})\varvec{AB}}} \left| {\mathbf{1}} \right\rangle_{{({\mathbf{2}}\varvec{i} - {\mathbf{1}})\varvec{C}}} } \right) \\ & \quad \otimes \frac{{\mathbf{1}}}{{\sqrt {\mathbf{2}} }}\left( {\left| {{\varvec{\Psi}}^{ + } } \right\rangle_{{({\mathbf{2}}\varvec{i})\varvec{AB}}} \left| {\mathbf{0}} \right\rangle_{{({\mathbf{2}}\varvec{i})\varvec{C}}} + \left| {{\varvec{\Psi}}^{ - } } \right\rangle_{{({\mathbf{2}}\varvec{i})\varvec{AB}}} \left| {\mathbf{1}} \right\rangle_{{({\mathbf{2}}\varvec{i})\varvec{C}}} } \right) \\ \end{aligned} $$

(34)

as the initial state instead of GHZ-like states in Eq. (1). Note that, Alice and Bob only use two Pauli operators $\sigma_{{k_{i} }} \in \left\{ {\sigma_{0} = I, \sigma_{1} = \sigma_{z} } \right\}$ for an entity authentication. Here, $k_{i} \in \left\{ {0, 1} \right\}$. In this case, even if an untrusted third party executes the entanglement swapping attack, Alice and Bob’s measurement outcomes will always be $\left| {{\mathbf{Rev}} + + } \right\rangle_{{({\mathbf{2}}\varvec{i} - {\mathbf{1}})({\mathbf{2}}\varvec{i})\varvec{AB}}}$ or $\left| {{\mathbf{Rev}} + - } \right\rangle_{{({\mathbf{2}}\varvec{i} - {\mathbf{1}})({\mathbf{2}}\varvec{i})\varvec{AB}}}$:

$$ \begin{aligned} & \left| \xi \right\rangle_{{\left( {2i - 1} \right)ABC}} \otimes \left| \xi \right\rangle_{{\left( {2i} \right)ABC}} \\ & = \frac{1}{2}\left[ {\left( {\left| {{\mathbf{Rev}} + + } \right\rangle_{{({\mathbf{2}}\varvec{i} - {\mathbf{1}})({\mathbf{2}}\varvec{i})\varvec{AB}}} + \left| {{\mathbf{Rev}} + - } \right\rangle_{{({\mathbf{2}}\varvec{i} - {\mathbf{1}})({\mathbf{2}}\varvec{i})\varvec{AB}}} } \right)\left| {{\varvec{\Phi}}^{ + } } \right\rangle_{{({\mathbf{2}}\varvec{i} - {\mathbf{1}})({\mathbf{2}}\varvec{i})\varvec{C}}} } \right. \\ & \quad \quad + \,\left( {\left| {{\mathbf{Rev}} + + } \right\rangle_{{({\mathbf{2}}\varvec{i} - {\mathbf{1}})({\mathbf{2}}\varvec{i})\varvec{AB}}} - \left| {{\mathbf{Rev}} + - } \right\rangle_{{({\mathbf{2}}\varvec{i} - {\mathbf{1}})({\mathbf{2}}\varvec{i})\varvec{AB}}} } \right)\left| {\Phi^{ - } } \right\rangle_{(2i - 1)(2i)C} \\ & \quad \quad + \,\left( {\left| {{\mathbf{Rev}} + + } \right\rangle_{{({\mathbf{2}}\varvec{i} - {\mathbf{1}})({\mathbf{2}}\varvec{i})\varvec{AB}}} + \left| {{\mathbf{Rev}} + - } \right\rangle_{{({\mathbf{2}}\varvec{i} - {\mathbf{1}})({\mathbf{2}}\varvec{i})\varvec{AB}}} } \right)\left| {\Psi^{ + } } \right\rangle_{(2i - 1)(2i)C} \\ & \left. {\quad \quad + \,\left( {\left| {{\mathbf{Rev}} + + } \right\rangle_{{({\mathbf{2}}\varvec{i} - {\mathbf{1}})({\mathbf{2}}\varvec{i})\varvec{AB}}} - \left| {{\mathbf{Rev}} + - } \right\rangle_{{({\mathbf{2}}\varvec{i} - {\mathbf{1}})({\mathbf{2}}\varvec{i})\varvec{AB}}} } \right)\left| {\Psi^{ - } } \right\rangle_{(2i - 1)(2i)C} } \right] \\ \end{aligned} $$

(35)

As a result, no matter what measurement outcomes $\left| {\Phi^{ + } } \right\rangle_{{\left( {2i - 1} \right)\left( {2i} \right)C}}$, $\left| {\Phi^{ - } } \right\rangle_{{\left( {2i - 1} \right)\left( {2i} \right)C}}$, $\left| {\Psi^{ + } } \right\rangle_{{\left( {2i - 1} \right)\left( {2i} \right)C}}$, and $\left| {\Psi^{ - } } \right\rangle_{{\left( {2i - 1} \right)\left( {2i} \right)C}}$ are obtained by the third party, it is impossible to estimate the secret key $k_{i} \in \left\{ {0, 1} \right\}$. If the security of the protocol is described in terms of information theory, then there is no information Eve can obtain from Alice and Bob’s measurements [5]. Therefore, no information leakage occurs in the proposed protocol. For this to work well, Alice and Bob should pre-verify that the third party has shared the GHZ-like states of Eq. (34).

6 Conclusions and Discussion

We described the security of the CMQEA protocol against an entanglement swapping attack by an untrusted third party, Charlie. In particular, we analyzed the possibility of leakage of authentication information when Charlie performs a Bell measurement in the CMQEA protocol. Accordingly, we confirmed that the authentication key sequences could be leaked by untrusted Charlie’s entanglement swapping attack with a probability of $1/2^{N}$. In addition, we described three methods of using the sequence of GHZ-like states, the honesty-checking method, and a random number method to prevent such a threat.

To implement the original CMQEA protocol, GHZ states should be created and Bell-state measurement (BSM) should be performed. Many experimental results for generating GHZ states have been reported [6, 7]. However, when performing BSM based on linear optics, there is a limit in which Bell states $\left| {\Phi^{ \pm } } \right\rangle$ cannot be determined accurately [8, 9]. As a result, when implementing the CMQEA protocol based on linear optics, there is an error that users cannot be verified with a 50% probability. On the other hand, the CMQEA protocol can be implemented based on nonlinear optics. In this case, the BSM can distinguish all four Bell states, but a decoherence has a significant effect [10, 11]. On the other hand, the improved protocol in Sect. 5 is feasible because of quantum communication protocols that use authentication with only two Bell states $\left| {\Psi^{ \pm } } \right\rangle$. Besides, the application of error correction and privacy amplification to this protocol can improve security and practicality [12].