1 Introduction

Quantum cryptography is an interdisciplinary subject which combines classical cryptography with quantum mechanics. It can achieve unconditional security provided by the laws of quantum physics, rather than the difficulties of mathematical calculation. There are plenty of diverse types of cryptographic protocols which have been mentioned before, for instance quantum key distribution (QKD) [1, 2], quantum key agreement (QKA) [3, 4], quantum secret sharing [5, 6], quantum secure direct communication [7, 8], quantum private comparison [9,10,11], quantum dialogue [12], quantum signature [13,14,15,16], and so on. At present, QKA [3, 4] is one of the most significant elements, which can realize the establishment of a shared key between two and more parties by using the public quantum channel. No party or subgroup can independently identify the shared key [17], so it is dissimilar from the QKD protocol [1], which predetermines the key, and subsequently distributes to other parties.

In Zhou et al. [3] who presented the first QKA protocol, numerous QKA protocols also have been introduced successively [18,19,20,21,22,23,24,25,26,27,28,29,30,31]. According to the BB84, Chong and Hwang [18] engineered an efficient two-party QKA protocol with the assistance of delayed measurement technique. On account of Bell state, a number of researchers also have presented some new two-party QKA protocols, such as Shukla et al.’s protocol [19], Chong et al.’s protocol [20], and Shi et al.’s protocol [21]. In [21], Shi and Zhong broadened the two-party QKA to multi-party QKA (MQKA). In their research, they presented the first multi-party QKA protocol on account of entanglement swapping and EPR pairs. Later, based on GHZ states and without decoy particles, Xu et al. [22] put forward a multi-particle QKA protocol. A large proportion of QKA protocols [18,19,20,21,22,23,24,25,26] are proposed in the ideal condition, which is that the quantum channel is an ideal channel without noise. Nevertheless, it is well known that quantum cryptographic protocols are inevitably disturbed by channel noise. In the channel of quantum noise, attackers are likely to hide their aggressive behavior with noise. As a result, it is extremely crucial to consider the channel noise in the process of designing the QKA protocol. At the moment, decoherence-free subspace (DFS) [27] which is an effective way to eliminate the influence of collective noise is almost unaffected by collective noise. Huang et al. [28] designed a QKA protocol and brought in two corresponding variations over collective noise. In the same year, Huang et al. [29] also devised a robust QKA protocol which made use of decoherence-free states to against collective decoherence. In 2016, on account of logical χ-states and logical Bell states, He et al. [30] devised two QKA protocols against collective noise. What’s more, in 2018, Gao et al. [31] established new QKA protocols which are immune to collective noise on the basis of four-particle logical GHZ states.

In non-ideal channels, in order to solve the problem of communication against noise when there are two or more different kinds of noise at the same time, Wu et al. [43] put forward an idea to construct special particle states that can resist both kinds of noise at the same time. The protocol needs to construct the generalized GHZ state of nine particles, the generalized unitary transformation, and the deceptive state. However, the paper only proposes an idea without the design of the protocol in detail. What’s more, because this method uses nine particle entanglement, the quantum resource cost is high and the qubit efficiency is low. Therefore, in our paper, we discuss problems of key negotiation under two kinds of noise in the non-ideal channel, respectively.

In our paper, we put forward two two-party QKA protocols on account of entanglement swapping. Two unrelated three-particle GHZ states are able to establish entanglement correlation just by using two Bell measurements. With the assistance of the entanglement swapping, our proposed QKA protocols can against two kinds of collective noise channels. Beyond that, in terms of qubit efficiency, we use fewer quantum bits but achieve higher quantum bit efficiency.

The organization of the remainder of this paper is as follows: The second section is used to describe the preliminaries of the whole paper. And Sect. 3 aims to give the description of our two-party QKA protocols in detail. In addition, we make a full analysis of the security of our protocols in Sect. 4. What’s more, for the sake of demonstrating the superiority of our protocols, we make a comparison with other QKA protocols against collective noise in regard to qubit efficiency in Sect. 5. At last, a brief conclusion is given in the final section.

2 Preliminaries

2.1 Unitary operations and entanglement swapping

At first, we present four unitary operations which are \( U_{00} \equiv I = |0\rangle \langle 0\left| + \right|1\rangle \langle 1| \), \( U_{01} \equiv X = |0\rangle \langle 1\left| + \right|1\rangle \langle 0| \), \( U_{10} \equiv Z = |0\rangle \langle 0\left| - \right|1\rangle \langle 1| \), and \( U_{11} \equiv iY = |0\rangle \langle 1\left| - \right|1\rangle \langle 0| \). Two nonorthogonal bases are defined as \( \{ |0\rangle ,|1\rangle \} \) and \( \{ | + \rangle ,| - \rangle \} \), where \( | + \rangle = \frac{1}{\sqrt 2 }(|0\rangle + |1\rangle ) \) and \( | - \rangle = \frac{1}{\sqrt 2 }(|0\rangle - |1\rangle ) \). There are four Bell states \( |\phi^{ \pm } \rangle = \frac{1}{\sqrt 2 }(|00\rangle \pm |11\rangle ) \) and \( |\psi^{ \pm } \rangle = \frac{1}{\sqrt 2 }(|01\rangle \pm |10\rangle ) \). After a unitary operation \( U_{{i_{1} i_{2} }} \) (\( i_{1} , i_{2} = 0, 1 \)) on its second particle, the Bell state is transformed into another Bell state. Table 1 shows the corresponding transformed results.

Table 1 Relationship between the unitary operations and the transformed Bell states
Full size table

The GHZ state is the maximum entanglement state of three particles. In this protocol, the three-particle GHZ state \( |G\rangle = \frac{1}{\sqrt 2 }\left( {\left| {010\rangle + } \right|101\rangle } \right) \) is used as a quantum source. At first, we prepare two GHZ states, \( |G\rangle_{123} = \frac{1}{\sqrt 2 }\left( {\left| {010\rangle + } \right|101\rangle } \right)_{123} \;{\text{and}}\;|G\rangle_{456 } \) = \( \frac{1}{\sqrt 2 }\left( {\left| {010\rangle + } \right|101\rangle } \right)_{456} \), as Eq. (1), where the subscript i denotes the ith qubit of \( |G\rangle_{123} \) and \( |G\rangle_{456} \).

$$ \begin{aligned} & |G\rangle_{123} \otimes |G\rangle_{456} \\ & \quad = \frac{1}{\sqrt 2 }\left( {\left| {010\rangle + } \right|101\rangle } \right)_{123} \; \otimes \,\frac{1}{\sqrt 2 }\left( {\left| {010\rangle + } \right|101\rangle } \right)_{456} \\ & \quad = \frac{1}{2\sqrt 2 }\left( {\left| {\phi^{ + } } \right.\rangle_{14} \left( {\left| {10} \right.\rangle_{23} \left| {10} \right.\rangle_{56} + \left| {01} \right.\rangle_{23} \left| {01} \right.\rangle_{56} } \right)} \right. \\ & \quad \quad + \left| {\phi^{ - } \rangle } \right._{14} \left( {\left| {10} \right.\rangle_{23} \left| {10} \right.\rangle_{56} - \left| {01\rangle } \right._{23} \left| {01\rangle } \right._{56} } \right) \\ & \quad \quad + \left| {\psi^{ + } \rangle } \right._{14} \left( {\left| {10\rangle } \right._{23} \left| {01\rangle } \right._{56} + \left| {01} \right.\rangle_{23} \left| {10\rangle } \right._{56} } \right) \\ & \quad \quad \left. { + \left| {\psi^{ - } \rangle } \right._{14} \left( {\left| {10} \right.\rangle_{23} \left| {01\rangle } \right._{56} - \left| {01} \right.\rangle_{23} \left| {10} \right.\rangle_{56} } \right)} \right) \\ & \quad = \frac{1}{2\sqrt 2 }\left( {\left| {\phi^{ + } } \right.\rangle_{14} \left( {\left| {\phi^{ + } } \right.\rangle_{25} \left| {\phi^{ + } } \right.\rangle_{36} - \left| {\phi^{ - } \rangle } \right._{25} \left| {\phi^{ - } \rangle } \right._{36} } \right)} \right. \\ & \quad \quad + \left| {\phi^{ - } } \right.\rangle_{14} \left( {\left| {\phi^{ + } \rangle } \right._{25} \left| {\phi^{ - } } \right.\rangle_{36} - \left| {\phi^{ - } \rangle } \right._{25} \left| {\phi^{ + } \rangle } \right._{36} } \right) \\ & \quad \quad + \left| {\psi^{ + } } \right.\rangle_{14} \left( {\left| {\psi^{ + } \rangle } \right._{25} \left| {\psi^{ + } \rangle } \right._{36} - \left| {\psi^{ - } \rangle } \right._{25} \left| {\psi^{ - } } \right.\rangle_{36} } \right) \\ & \quad \quad \left. { + \left| {\psi^{ - } \rangle } \right._{14} \left( {\left| {\psi^{ + } \rangle } \right._{25} \left| {\psi^{ - } \rangle } \right._{36} - \left| {\psi^{ - } \rangle } \right._{25} \left| {\psi^{ + } \rangle } \right._{36} } \right)} \right) \\ \end{aligned} $$
(1)

If one person performs the Bell measurement on the second and the fifth qubits, and the third and the sixth qubits, another one performs measurement on the first and the fourth qubits, separately. According to Eq. (1), \( {\text{the}}\;{\text{state }}|G\rangle_{123} \otimes |G\rangle_{456} \) will collapse into one of the eight states: \( \{ \left| {\phi^{ + } } \right.\rangle_{14} \left| {\phi^{ + } \rangle } \right._{25} \left| {\phi^{ + } \rangle } \right._{36} \), \( \left| {\phi^{ + } \rangle } \right._{14} \left| {\phi^{ - } \rangle } \right._{25} \left| {\phi^{ - } \rangle } \right._{36} \), \( \left| {\phi^{ - } \rangle } \right._{14} \left| {\phi^{ + } \rangle } \right._{25} \left| {\phi^{ - } \rangle } \right._{36} \), \( \left| {\phi^{ - } } \right.\rangle_{14} \left| {\phi^{ - } } \right.\rangle_{25} \left| {\phi^{ + } } \right.\rangle_{36} \), \( \left| {\psi^{ + } } \right.\rangle_{14} \left| {\psi^{ + } \rangle } \right._{25} \left| {\psi^{ + } \rangle } \right._{36} \), \( \left| {\psi^{ + } \rangle } \right._{14} \left| {\psi^{ - } \rangle } \right._{25} \left| {\psi^{ - } \rangle } \right._{36} \), \( \left| {\psi^{ - } \rangle } \right._{14} \left| {\psi^{ + } \rangle } \right._{25} \left| {\psi^{ - } \rangle } \right._{36} \), and \( \left| {\psi^{ - } } \right.\rangle_{14} \left| {\psi^{ - } } \right.\rangle_{25} \left| {\psi^{ + } } \right.\rangle_{36} \} \). They are able to infer the post-measurement states of each other from the measurement results.

2.2 Collective noise

Practical quantum channels are the mostly optical fibers with fluctuations, uneven media, birefringence fluctuations, etc. Polarized photons will be affected by noise when they are transmitted in optical fibers as information carriers. Due to the fast transmission speed of photons, the noise change can be considered as slow change, that is, the quantum-state transmission time gap is shorter than the noise change time gap, and all photons will be affected by the same noise. These effects can be approximated as an unitary operation \( U\left( t \right) \) (t represents the quantum-state transmission time) which is the joint unitary noise channel model [41].

In this paper, we discuss two types of collective noise which are the collective-dephasing noise and the collective-rotation noise. Under the collective noise, the changes of N quantum bits can be expressed as \( \rho_{N} \, \to \,\left[ {U\left( t \right)} \right]^{ \otimes N} \rho_{N} \left[ {U\left( t \right)^{\dag } } \right]^{ \otimes N} \), and \( \rho_{N} \) is the density matrix of the quantum system. The effect of unitary operation U(t) can be further approximated as \( U\left| 0 \right.\rangle = \cos \theta \left| {0\rangle + e^{i\varphi } \sin \theta } \right|1\rangle \), \( U\left| 1 \right.\rangle = e^{i\Delta } \left( {\cos \theta |1} \right. \rangle - e^{i\varphi } \sin \theta |0\rangle \)). The parameters \( \Delta , \theta \;{\text{and}}\;\varphi \) are the fluctuation factors of the noise with time. When the \( \theta \) = 0, \( \Delta ,\varphi \) takes any value; the corresponding noise is collective-dephasing noise \( U_{\text{dp}} \) = \( \left( {\begin{array}{*{20}c} 1 & 0 \\ 0 & {{\text{e}}^{i\varphi } } \\ \end{array} } \right) \). Its effect on the photon horizontal polarization state \( |0\rangle \) and vertical polarization state \( |1\rangle \) is \( U_{\text{dp}} |0\rangle = \, |0\rangle \), \( U_{\text{dp}} |1\rangle = e^{i\varphi } |1\rangle \). When \( \Delta = \varphi = 0 \), \( \theta \) takes any value; the corresponding noise is collective-rotation noise \( U_{\text{r}} \) = \( \left( {\begin{array}{*{20}c} {\cos \theta } & {\sin \theta } \\ { - \sin \theta } & {\cos \theta } \\ \end{array} } \right) \). Under the circumstances of collective-rotation noise, the photon undergoes a joint flip which can be expressed as \( U_{\text{r}} |0\rangle = \cos \theta |0\rangle + \sin \theta |1\rangle \), \( U_{\text{r}} |1\rangle = - \sin \theta |0\rangle + \cos \theta |1\rangle \).

A decoherence-free subspace (DFS) is a subspace of a system’s Hilbert space that is invariant to non-unitary dynamics. Alternatively stated, they are a small section of the system Hilbert space where the system is decoupled from the environment, and thus, its evolution is completely unitary. Due to this character, DFS is utilized against the collective noise [27].

According to the characteristics of the collective-dephasing noise [27], the subspaces \( \left\{ {\left| 0 \right._{\text{dp}} \rangle , \left| 1 \right._{\text{dp}} \rangle } \right\} \) and \( \left\{ {\left| + \right._{\text{dp}} \rangle , \left| - \right._{\text{dp}} \rangle } \right\} \) are able to constitute a DFS which is immune to collective-dephasing noise, where \( \left| 0 \right._{\text{dp}} \rangle = |01\rangle \), \( \left| 1 \right._{\text{dp}} \rangle = |10\rangle \), \( \left| \pm \right._{\text{dp}} \rangle = \frac{1}{\sqrt 2 }(\left| 0 \right._{\text{dp}} \rangle \pm \left| 1 \right._{\text{dp}} \rangle )) = \frac{1}{\sqrt 2 }(|01\rangle \pm |10\rangle ) \). In the same way, the subspaces \( \left\{ {\left| 0 \right._{\text{r}} \rangle , \left| 1 \right._{\text{r}} \rangle } \right\} \) and \( \left\{ {\left| + \right._{\text{r}} \rangle , \left| - \right._{\text{r}} \rangle } \right\} \) are able to constitute a DFS which is immune to collective-rotation noise, where \( \left| 0 \right._{\text{r}} \rangle = |\phi^{ + } \rangle \), \( \left| 1 \right._{\text{r}} \rangle = |\psi^{ - } \rangle \), \( \left| \pm \right._{\text{r}} \rangle = \frac{1}{\sqrt 2 }(\left| 0 \right._{\text{r}} \rangle \pm \left| 1 \right._{\text{r}} \rangle ) = \frac{1}{\sqrt 2 }(|\phi^{ + } \rangle \pm |\psi^{ - } \rangle ) \).

It is obvious that GHZ state \( |G\rangle_{123} = \frac{1}{\sqrt 2 }\left( {\left| 0 \right.\rangle_{1} \left| {10} \right.\rangle_{23} + \left| 1 \right.\rangle_{1} \left| {01\rangle } \right._{23} } \right) \) = \( \frac{1}{\sqrt 2 }\left( {\left| 0 \right.\rangle_{1} \left| {1_{\text{dp}} \rangle } \right._{23} + \left| 1 \right.\rangle_{1} \left| {0_{\text{dp}} \rangle } \right._{23} } \right) \) is constant when the second and the third qubits are transmitted through the collective-dephasing noise channel. We can prepare that GHZ-like state \( |L\rangle_{123} \) = \( \frac{1}{\sqrt 2 }\left( {\left| {001\rangle - \left| {010} \right. + \left| {100} \right. + } \right|111\rangle } \right)_{123} \) = \( \frac{1}{\sqrt 2 }\left( {\left| 0 \right.\rangle_{1} \left| {1_{\text{r}} \rangle } \right._{23} + \left| {1\rangle } \right._{1} \left| {0_{\text{r}} \rangle } \right._{23} } \right) \) is constant when the second and the third qubits are transmitted through the collective-rotation noise channel.

3 Description of the QKA protocols against collective noise

Before the start of the protocol, both parties shall carry out identity authentication [42] to ensure that they are not impersonated by the intruder Eve.

3.1 The QKA protocol against collective-dephasing noise

Step 1 Alice and Bob randomly generate their own 2n-bit secret keys:

$$ K_{A} = \, \left\{ {K_{A}^{1} , K_{A}^{2} , \ldots , K_{A}^{n} } \right\},\quad K_{B} = \left\{ {K_{B}^{1} , K_{B}^{2} , \ldots , K_{B}^{n} } \right\}, $$

where \( K_{A }^{i} \),\( K_{B}^{i} \in \left\{ {00, 01, 10, 11} \right\} \) and i = 1, 2, \( \ldots , n \).

Step 2 Alice is going to generate a sequence of 2n GHZ states \( |G\rangle = \frac{1}{\sqrt 2 }\left( {\left| {010\rangle + } \right|101\rangle } \right) \). Then, use \( |G\rangle_{123} \otimes |G\rangle_{456} \) as a quantum source. According to Eq. (1), Alice remains particles 1 and 4, sends particles 2, 5 and 3, 6 to Bob. After that, Alice and Bob measure the particles they hold by Bell measurement, respectively. After measurement, the particles collapse to the Bell state, different Bell states correspond to different encodings. Alice and Bob negotiate the coding scheme as shown in Table 2.

Table 2 Relationship between the Bell states and the encodings
Full size table

Alice distributes 2n GHZ states into two ordered sequences named \( S_{A} \) and \( S_{B} \), she takes the first qubits to constitute a new sequence \( S_{A} \) = {\( q_{1}^{i} \)}, and the rest of the qubits are used to establish the other sequence \( S_{B} \) = {\( q_{2}^{i} , q_{3}^{i} \)}, for i = 1, 2, \( \ldots , 2n \). At the same time, 2n GHZ states are divided into \( q_{1} \), \( q_{2} \), \( q_{3} \). Then, the sequence of \( q_{1} \) contains the first particle of GHZ states, and the quantity of this sequence is 2n. Beyond that, the sequence of \( q_{2} \) contains the second particle of the GHZ state, and the sequence \( q_{3} \) contains a third particle of the GHZ state. Alice prepares m decoy logical qubits which are both randomly selected from \( \left\{ {\left| 0 \right._{\text{dp}} \rangle , \left| 1 \right._{\text{dp}} \rangle ,\left| + \right._{\text{dp}} \rangle , \left| - \right._{\text{dp}} \rangle } \right\} \). After that, Alice inserts them into \( S_{B} \) randomly to obtain \( S_{B}^{'} \) and keeps a record of the inserting positions. Then, Alice sends them to Bob and maintains the sequence \( S_{A} \).

Step 3 After that, Bob accepts the sequence \( S_{B}^{'} \); Alice indicates the location and the measurement basis of the decoy logical qubits. Afterward, Bob measures the decoy logical qubits with the announced bases. And he reports the measurement results to Alice. Alice compares the measurement results with initial states of the decoy logical qubits in order to calculate the error rate. In this process, if the error rate is less than the given threshold value, they will continue to perform the next step. If not, they will give up this protocol and restart it.

Step 4 On the basis of Eq. (1), n pair GHZ states \( |G\rangle \) means there are n \( |G\rangle_{123} \otimes |G\rangle_{456} \) as the quantum source, the sequence of \( q_{1} \) contains the first and the fourth particle, the sequence of \( q_{2} \) contains the second and the fifth particle, the sequence of \( q_{3} \) contains the third and the sixth particle. Then, Alice performs Bell measurement on qubits {\( q_{1}^{2j - 1} \), \( q_{1}^{2j} \)}; Bob measures the qubits {\( q_{2}^{2j - 1} \), \( q_{2}^{2j} \)} and {\( q_{3}^{2j - 1} \), \( q_{3}^{2j} \)}, for j = 1, 2, \( \ldots , n \). After the measurement, the state \( \left| G \right._{123} \otimes \left| G \right._{456} \) will collapses into one of the four states as shown in Eq. (1). On the basis of the measurement correlation of Eq. (1), Alice and Bob are able to deduce the post-measurement states of each other. Later, according to the coding rules negotiated by Step 1, the post-measurement status of Alice and Bob is converted into a classic bit string \( M \, = M_{1} ||M_{2} || \cdots ||M_{n} \), where \( M_{i} \in \left\{ {00, 01, 10, 11} \right\} \) (i = 1, 2, \( \ldots , n \)). Since both sides can infer each other’s state, they have a common M.

Step 5 Let \( K_{{A_{1} }}^{i} K_{{A_{2} }}^{i} \) = \( K_{A}^{i} \). Alice can encode the key \( K_{A} \) by performing the unitary operation \( U_{{K_{{A_{1} }}^{i} K_{{A_{2} }}^{i} }} \) on the post-measurement qubits {\( q_{1}^{2j} \)}; it means the even number of particles in the \( q_{1} \) sequence, where i, j = 1, 2, \( \ldots , n \). Obtain the encoded quantum-state sequence which is able to be denoted as \( S_{D}^{*} \). The qubit sequence {\( q_{1}^{2j - 1} \)} is denoted as \( S_{C} \). Consequently, the corresponding two particles in \( S_{C} \) and \( S_{D}^{*} \) constitute a new Bell state. On account of the new Bell states, Alice prepares the corresponding logical Bell states as follows:

$$ \begin{aligned} \left| \phi \right._{\text{dp}}^{ + } \rangle_{{C_{1} C_{2} D_{1} D_{2} }} & = \frac{1}{\sqrt 2 }\left( {\left| 0 \right._{\text{dp}} \rangle \left| 0 \right._{\text{dp}} \rangle + \left| 1 \right._{\text{dp}} \rangle \left| 1 \right._{\text{dp}} \rangle } \right)_{{C_{1} C_{2} D_{1} D_{2} }} \\ & = \frac{1}{\sqrt 2 }\left( {\left| {\phi^{ + } \rangle } \right.\left| {\phi^{ + } } \right.\rangle - \left| {\phi^{ - } \rangle } \right.\left| {\phi^{ - } \rangle } \right.} \right)_{{C_{1} D_{1} C_{2} D_{2} }} \\ \left| \phi \right._{\text{dp}}^{ - } \rangle_{{C_{1} C_{2} D_{1} D_{2} }} & = \frac{1}{\sqrt 2 }\left( {\left| 0 \right._{\text{dp}} \rangle \left| 0 \right._{\text{dp}} \rangle - \left| 1 \right._{\text{dp}} \rangle \left| 1 \right._{\text{dp}} \rangle } \right)_{{C_{1} C_{2} D_{1} D_{2} }} \\ & = \frac{1}{\sqrt 2 }\left( {\left| {\phi^{ - } \rangle } \right.\left| {\phi^{ + } \rangle } \right. - \left| {\phi^{ + } \rangle } \right.\left| {\phi^{ - } \rangle } \right.} \right)_{{C_{1} D_{1} C_{2} D_{2} }} \\ \left| \psi \right._{\text{dp}}^{ + } \rangle_{{C_{1} C_{2} D_{1} D_{2} }} & = \frac{1}{\sqrt 2 }\left( {\left| 0 \right._{\text{dp}} \rangle \left| 1 \right._{\text{dp}} \rangle + \left| 1 \right._{\text{dp}} \rangle \left| 0 \right._{\text{dp}} \rangle } \right)_{{C_{1} C_{2} D_{1} D_{2} }} \\ & = \frac{1}{\sqrt 2 }\left( {\left| {\psi^{ + } } \right.\rangle \left| {\psi^{ + } } \right.\rangle - \left| {\psi^{ - } \rangle } \right.\left| {\psi^{ - } } \right.\rangle } \right)_{{C_{1} D_{1} C_{2} D_{2} }} \\ \left| \psi \right._{\text{dp}}^{ - } \rangle_{{C_{1} C_{2} D_{1} D_{2} }} & = \frac{1}{\sqrt 2 }\left( {\left| 0 \right._{\text{dp}} \rangle \left| 1 \right._{\text{dp}} \rangle - \left| 1 \right._{\text{dp}} \rangle \left| 0 \right._{\text{dp}} \rangle } \right)_{{C_{1} C_{2} D_{1} D_{2} }} \\ & = \frac{1}{\sqrt 2 }\left( {\left| {\psi^{ - } } \right.\rangle \left| {\psi^{ + } \rangle } \right. - \left| {\psi^{ + } \rangle } \right.\left| {\psi^{ - } \rangle } \right.} \right)_{{C_{1} D_{1} C_{2} D_{2} }} \\ \end{aligned} $$
(2)

The new sequences \( S_{C} \,^{\left( 1 \right)} \) and \( S_{D}^{{*^{{}} }} \,^{\left( 1 \right)} \) are made up of logical qubits C (two physical qubits \( C_{1} \) and \( C_{2} \)) and logical qubits D (two physical qubits \( D_{1} \) and \( D_{2} \)) separately. Later, Alice selects a permutation operator \( \varPi_{n} \) randomly and performs the permutation operator \( \varPi_{n} \) on \( S_{C}^{\left( 1 \right)} \) to obtain the new quantum-state sequence \( S_{C}^{\left( 2 \right)} \). Soon after, Alice randomly selects m decoy states from {\( \left| 0 \right._{\text{dp}} \rangle , \left| 1 \right._{\text{dp}} \rangle \), \( \left| + \right._{\text{dp}} , \left| - \right._{\text{dp}} \)}, and randomly inserts them into \( S_{C}^{\left( 2 \right)} \) and \( S_{D}^{{*^{\left( 1 \right)} }} \) in order to obtain the new quantum-state sequence \( S_{C} \,^{\left( 2 \right)\prime } \) and \( S_{D}^{*} \,^{\left( 1 \right)\prime } \). Alice sends the sequences \( S_{C} \,^{\left( 2 \right)\prime } \) and \( S_{D}^{ *} \,^{\left( 1 \right)\prime } \) to Bob.

Step 6 It is similar to Step 3; when Bob receives the sequences \( S_{C} \;^{\left( 2 \right)\prime } \) and \( S_{D}^{ *} \,^{\left( 1 \right)\prime } \), two parties perform a second eavesdropping check.

Step 7 Bob declares the value \( K_{B}^{ '} = K_{B} \oplus M = \{ K_{B}^{1} \oplus M_{1} ,K_{B}^{2} \oplus M_{2} , \ldots ,K_{B}^{n} \oplus M_{n} \} \). On account of the value M, Alice is able to derive the key \( K_{B} \). Beyond that, Alice is able to compute the shared key \( K_{AB} = (K_{A} \oplus K_{B} )||(K_{A} \oplus K_{B} \oplus M) \).

Step 8 Alice announces the permutation operator \( \varPi_{n} \). Bob who wants to obtain the sequence \( S_{C} \,^{\left( 1 \right)} \) applies its inverse permutation to the sequence \( S_{C}^{\left( 2 \right)} \). He associates the sequence \( S_{C} \,^{\left( 1 \right)} \) with the sequence \( S_{D}^{*} \,^{\left( 1 \right)} \) in order to obtain n logical Bell states. After that, he carries out the Bell measurements on the particles \( C_{1} \), \( D_{1} \) as well as the particles \( C_{2} \), \( D_{2} \), respectively. In the light of Eq. (2), Bob deduces the physical Bell state corresponding to each pair of particles in \( S_{C} \,^{\left( 1 \right)} \) and \( S_{D}^{*} \,^{\left( 1 \right)} \). What’s more, on the basis of Table 1, Bob is able to deduce \( K_{A} \). Beyond that, Bob can figure the shared key \( K_{AB} = (K_{A} \oplus K_{B} )||(K_{A} \oplus K_{B} \oplus M) \).

3.2 The QKA protocol against collective-rotation noise

Step 1 Alice and Bob randomly generate their 2n-bit secret keys:

$$ K_{A} = \left\{ {K_{A}^{1} , K_{A}^{2} , \ldots , K_{A}^{n} ,K_{B} } \right\} = \left\{ {K_{B}^{1} , K_{B}^{2} , \ldots , K_{B}^{n} } \right\}, $$

where \( K_{A }^{i} \), \( K_{B}^{i} \) \( \in \left\{ {00, 01, 10, 11} \right\} \) and i = 1, 2, \( \ldots , n \).

Step 2 Alice prepares a sequence of 2n GHZ-like states \( |L\rangle_{123} \) = \( \frac{1}{\sqrt 2 }\left( {\left| {001\rangle - \left| {010} \right. + \left| {100} \right. + } \right|111\rangle } \right)_{123} \). Use \( |L\rangle_{123} \otimes |L\rangle_{456} \) as a quantum source:

$$ \begin{aligned} & \left| L \right._{123} \otimes \left| L \right._{456} \\ & \quad = \frac{1}{\sqrt 2 }\left( {\left| {001\rangle - \left| {010} \right. + \left| {100} \right. + } \right|111\rangle } \right)_{123} \\ & \quad \otimes \frac{1}{\sqrt 2 }\left( {\left| {001\rangle - \left| {010} \right. + \left| {100} \right. + } \right|111\rangle } \right)_{456} \\ & \quad = \frac{1}{\sqrt 2 }\left( {\left| 0 \right.\rangle_{1} \left| {\psi^{ - } \rangle } \right._{23} + \left| 1 \right.\rangle_{1} \left| {\phi^{ + } \rangle } \right._{23} } \right) \\ & \quad \otimes \frac{1}{\sqrt 2 }\left( {\left| 0 \right.\rangle_{4} \left| {\psi^{ - } } \right.\rangle_{56} + \left| 1 \right.\rangle_{4} \left| {\phi^{ + } } \right.\rangle_{56} } \right) \\ & \quad = \frac{1}{2\sqrt 2 }\left( {\left| {\phi^{ + } } \right.\rangle_{14} \left( {\left| {\phi^{ + } } \right.\rangle_{25} \left| {\phi^{ + } } \right.\rangle_{36} + \left| {\psi^{ - } \rangle } \right._{25} \left| {\psi^{ - } } \right.\rangle_{36} } \right)} \right. \\ & \quad + \left| {\phi^{ - } } \right._{14} \left( { - \left| {\phi^{ - } \rangle } \right._{25} \left| {\phi^{ - } \rangle } \right._{36} - \left| {\psi^{ + } \rangle } \right._{25} \left| {\psi^{ + } } \right.\rangle_{36} } \right) \\ & \quad + \left| {\psi^{ + } } \right._{14} \left( {\left| {\phi^{ - } \rangle } \right._{25} \left| {\psi^{ + } } \right.\rangle_{36} - \left| {\psi^{ + } } \right.\rangle_{25} \left| {\phi^{ - } } \right.\rangle_{36} } \right) \\ & \quad \left. { + \left| {\psi^{ - } } \right._{14} \left( { - \left| {\phi^{ + } \rangle } \right._{25} \left| {\psi^{ - } } \right.\rangle_{36} + \left| {\psi^{ - } \rangle } \right._{25} \left| {\phi^{ + } \rangle } \right._{36} } \right)} \right) \\ \end{aligned} $$
(3)

Similar to protocol 3.1, Alice and Bob negotiate the coding scheme as shown in Table 3.

Table 3 Relationship between the Bell states and the encodings
Full size table

Alice separates these GHZ-like states into two ordered sequences \( S_{A} \) and \( S_{B} \); she takes the first qubits to form a new sequence \( S_{A} \) = {\( q_{1}^{i} \)} and the remaining qubits form the another sequence \( S_{B} \) = {\( q_{2}^{i} , q_{3}^{i} \)}, for i = 1, 2,\( \ldots , 2n \). Alice prepares m decoy logical qubits which are randomly selected from {\( \left| 0 \right._{\text{dp}} \rangle , \left| 1 \right._{\text{dp}} \rangle \), \( \left| + \right._{\text{dp}} \rangle , \left| - \right._{\text{dp}} \rangle \)}, whereafter Alice inserts them into \( S_{B} \) randomly to obtain \( S_{B}^{'} \) and keeps a record of the inserting positions. After that, Alice sends them to Bob and keeps the sequence \( S_{A} \).

Steps 3–4 These steps are almost identical to Steps 3–4 of protocol against collective-dephasing noise.

Step 5 Alice is able to encode the key \( K_{A} \) by performing the unitary operation \( U_{{K_{{A_{1} }}^{i} K_{{A_{2} }}^{i} }} \) on the post-measurement qubits {\( q_{1}^{2j} \)}, where i, j = 1, 2, \( \ldots , n \). And she could obtain the encoded quantum-state sequence which is recorded as \( S_{D}^{*} \). What’s more, the qubit sequence {\( q_{1}^{2j - 1} \)} is denoted as \( S_{C} \). As a consequence, the corresponding two particles in \( S_{C} \) and \( S_{D}^{*} \) constitute a new Bell state. On account of the new Bell states, Alice prepares the corresponding logical Bell states as follows:

$$ \begin{aligned} \left| \phi \right._{{rA_{1} A_{2} B_{1} B_{2} }}^{ + } & = \frac{1}{\sqrt 2 }\left( {\left| 0 \right._{r} \rangle \left| 0 \right._{r} \rangle + \left| 1 \right._{r} \rangle \left| 1 \right._{r} \rangle } \right)_{{A_{1} A_{2} B_{1} B_{2} }} \\ & = \frac{1}{\sqrt 2 }\left( {\left| {\phi^{ + } \rangle } \right.\left| {\phi^{ + } \rangle } \right. + \left| {\psi^{ - } \rangle } \right.\left| {\psi^{ - } \rangle } \right.} \right)_{{A_{1} B_{1} A_{2} B_{2} }} \\ \left| \phi \right._{{rA_{1} A_{2} B_{1} B_{2} }}^{ - } & = \frac{1}{\sqrt 2 }\left( {\left| 0 \right._{r} \rangle \left| 0 \right._{r} \rangle - \left| 1 \right._{r} \rangle \left| 1 \right._{r} \rangle } \right)_{{A_{1} A_{2} B_{1} B_{2} }} \\ & = \frac{1}{\sqrt 2 }\left( {\left| {\phi^{ - } } \right.\rangle \left| {\phi^{ - } \rangle } \right. + \left| {\psi^{ + } \rangle } \right.\left| {\psi^{ + } \rangle } \right.} \right)_{{A_{1} B_{1} A_{2} B_{2} }} \\ \left| \psi \right._{{rA_{1} A_{2} B_{1} B_{2} }}^{ + } & = \frac{1}{\sqrt 2 }\left( {\left| 0 \right._{r} \rangle \left| 1 \right._{r} \rangle + \left| 1 \right._{r} \rangle \left| 0 \right._{r} \rangle } \right)_{{A_{1} A_{2} B_{1} B_{2} }} \\ & = \frac{1}{\sqrt 2 }\left( {\left| {\phi^{ - } } \right.\rangle \left| {\psi^{ + } \rangle } \right. - \left| {\psi^{ + } } \right.\rangle \left| {\phi^{ - } \rangle } \right.} \right)_{{A_{1} B_{1} A_{2} B_{2} }} \\ \left| \psi \right._{{rA_{1} A_{2} B_{1} B_{2} }}^{ - } & = \frac{1}{\sqrt 2 }\left( {\left| 0 \right._{r} \rangle \left| 1 \right._{r} \rangle - \left| 1 \right._{r} \rangle \left| 0 \right._{r} \rangle } \right)_{{A_{1} A_{2} B_{1} B_{2} }} \\ & = \frac{1}{\sqrt 2 }\left( {\left| {\phi^{ + } \rangle } \right.\left| {\psi^{ - } \rangle } \right. - \left| {\psi^{ - } } \right.\rangle \left| {\phi^{ + } } \right.\rangle } \right)_{{A_{1} B_{1} A_{2} B_{2} }} \\ \end{aligned} $$
(4)

The new sequences \( S_{C} \,^{\left( 1 \right)} \) and \( S_{D}^{*} \,^{\left( 1 \right)} \) are made up of logical qubits C (two physical qubits \( C_{1} \) and \( C_{2} \)) and logical qubits D (two physical qubits \( D_{1} \) and \( D_{2} \)), respectively. Later, Alice selects a permutation operator \( \varPi_{n} \) randomly and performs the permutation operator \( \varPi_{n} \) on \( S_{C} \,^{\left( 1 \right)} \), in order to obtain the new quantum-state sequence \( S_{C} \,^{\left( 2 \right)} \). Soon after, Alice randomly selects m decoy states from {\( \left| 0 \right._{\text{dp}} , \left| 1 \right._{\text{dp}} \), \( \left| + \right._{\text{dp}} , \left| - \right._{\text{dp}} \)}, and randomly inserts them into \( S_{C}^{\left( 2 \right)} \) and \( S_{D}^{*} \,^{\left( 1 \right)} \) to obtain the new quantum-state sequence \( S_{C} \,^{\left( 2 \right)'} \) and \( S_{D}^{*} \,^{\left( 1 \right)'} \). In the end, Alice sends the sequences \( S_{C} \,^{\left( 2 \right) '} \) and \( S_{D}^{ *} \,^{\left( 1 \right) '} \) to Bob.

Steps 6–8 These steps are almost the same as Steps 6–8 of protocol against collective-dephasing noise.

4 Security analysis

In section four, we intend to discuss the security of the protocol. As can be seen from the security analysis, the two QKA protocols which we have proposed before are able to resist common attacks from the internal and external attackers.

Since the protocol only transmits logical qubits in quantum channels, these are not attacked by the collective-dephasing noise and the collective-rotation noise [32], respectively.

4.1 Participant attack

Gao et al. [33,34,35] first proposed the concept of participant attack which refers to some legitimate participants who may be dishonest rather than external eavesdroppers. Additionally, they try to conduct an attack for their own purposes. For diverse quantum cryptographic protocols, the purpose of the participants is diverse. For instance, for a QKA protocol, the dishonest participant might intend to control the shared key and decide it entirely by himself alone.

At first, it can be assumed that Bob is dishonest and Alice is honest. Due to delayed measurement technology [36], even if Bob got decode \( K_{A} \) by measuring the particles before he announces \( K_{B}^{ '} = K_{B} \oplus M \), he could not get the correct \( K_{A} \) because he still did not know the permutation operation \( \varPi_{n} \). Therefore, the participant attack of Alice will not succeed. Then, we assume that Alice is dishonest and Bob is honest. Before Alice sends the encoded message qubits, she cannot obtain \( K_{B}^{ '} \). So for Alice there is no way to control \( K_{AB} \). Therefore, Bob’s participant attack will not succeed.

4.2 Outsider attack

Suppose Eve wants to get the shared key, she has to eavesdrop the information of M and \( K_{A} \). The possible main attacks are the Trojan horse attacks, the intercept-resend attack, the measure-resend attack, the entangle-measure attack, and the double CNOT attack.

Trojan horse attacks: In the two proposed QKA protocols, each photon can only be transmitted once via the quantum channel. Thus, our two QKA protocols are immune to Trojan horse attacks [37, 38].

Intercept-resend attack: In our two protocols, we randomly select the decoy logical qubits from two nonorthogonal bases {\( \left| 0 \right._{\text{dp}} \rangle , \left| 1 \right._{\text{dp}} \rangle \)}(or {\( \left| 0 \right._{\text{r}} \rangle , \left| 1 \right._{\text{r}} \rangle \)}) and {\( \left| + \right._{\text{dp}} \rangle , \left| - \right._{\text{dp}} \rangle \)(or \( \left| + \right._{\text{r}} \rangle , \left| - \right._{\text{r}} \rangle \)) and then randomly insert into all the transmitted sequences. Eve does not recognize the positions and the states of the corresponding decoy logical qubits before the eavesdropping checks. If Eve performs the interception-resend attack, based on the characteristics of decoy logical states, we will know the probability that her attack will be found is \( 1 - \left( {\frac{1}{2}} \right)^{m} \) (m denotes the number of decoy logical qubits). Therefore, Eve’s attack cannot pass the eavesdropping checks.

Measure-resend attack: If Eve conducts the measure-resend attack, because Eve does not know the positions and the states of the corresponding decoy logical qubits, his measure will change the states of the decoy logical qubits. It will be discovered with the probability of \( 1 - \left( {\frac{3}{4}} \right)^{m} \). Hence, m denotes the number of decoy logical qubits.

Entangle-measure attack: In order to implement the entangle-measure attack, Eve needs to entangle the transmitted logical qubits with her auxiliary photons \( |E\rangle \). Eve performs the unitary operation U to the transmitted logical qubits and her ancillary photons \( |E\rangle \). We suppose that \( |e_{0} e_{0} \rangle ,|e_{0} e_{1} \rangle ,|e_{1} e_{0} \rangle ,|e_{1} e_{1} \rangle ,|e_{0}^{'} e_{0}^{'} \rangle ,|e_{0}^{'} e_{1}^{'} \rangle ,|e_{1}^{'} e_{0}^{'} \rangle ,|e_{1}^{'} e_{1}^{'} \rangle \) are probe states. Hence, we take the collective-dephasing noise as an example. And we can get the results as follows:

$$ \begin{aligned} U(\left| 0 \right._{\text{dp}} |E\rangle ) \, & = a_{00} |00\rangle |e_{0} e_{0} \rangle \, + a_{01} |01\rangle e_{0} e_{1} \rangle + a_{10} |10\rangle |e_{1} e_{0} \rangle \, + a_{11} |11\rangle |e_{1} e_{1} \rangle , \\ U(\left| 1 \right._{\text{dp}} |E\rangle ) \, & = b_{00} |00\rangle |e_{0}^{'} e_{0}^{'} \rangle \, + b_{01} |01\rangle |e_{0}^{'} e_{1}^{'} \rangle \, + b_{10} |10\rangle |e_{1}^{'} e_{0}^{'} \rangle \, + b_{11} |11\rangle |e_{1}^{'} e_{1}^{'} \rangle , \\ U(\left| + \right._{\text{dp}} |E\rangle ) \, & = \frac{1}{\sqrt 2 }[U(\left| 0 \right._{\text{dp}} |E\rangle ) + U(\left| 1 \right._{\text{dp}} |E\rangle )] \\ & = \frac{1}{2}\left[ {\left| {\phi^{ + } } \right.(a_{00} |e_{0} e_{0} \rangle ) \, + a_{11} |e_{1} e_{1} \rangle \, + b_{00} |e_{0}^{'} e_{0}^{'} \rangle \, + b_{11} |e_{1}^{'} e_{1}^{'} \rangle } \right. \\ & \quad + \left| {\phi^{ - } } \right.(a_{00} |e_{0} e_{0} \rangle ) - a_{11} |e_{1} e_{1} \rangle \, + b_{00} |e_{0}^{'} e_{0}^{'} \rangle - b_{11} |e_{1}^{'} e_{1}^{'} \rangle \\ & \quad + \left| {\psi^{ + } } \right.(a_{01} |e_{0} e_{1} \rangle ) \, + a_{10} |e_{1} e_{0} \rangle \, + b_{01} |e_{0}^{'} e_{1}^{'} \rangle \, + b_{10} |e_{1}^{'} e_{0}^{'} \rangle \\ & \quad \left. { + \left| {\psi^{ - } } \right.(a_{01} |e_{0} e_{1} \rangle ) - a_{10} |e_{1} e_{0} \rangle \, + b_{01} |e_{0}^{'} e_{1}^{'} \rangle - b_{10} |e_{1}^{'} e_{0}^{'} \rangle } \right], \\ U(\left| - \right._{\text{dp}} |E\rangle ) \, & = \frac{1}{\sqrt 2 }[U(\left| 0 \right._{\text{dp}} |E\rangle ) - U(\left| 1 \right._{\text{dp}} |E\rangle )] \\ & = \frac{1}{2}\left[ {\left| {\phi^{ + } } \right.(a_{00} |e_{0} e_{0} \rangle ) \, + a_{11} |e_{1} e_{1} \rangle - b_{00} |e_{0}^{'} e_{0}^{'} \rangle - b_{11} |e_{1}^{'} e_{1}^{'} \rangle } \right. \\ & \quad + \left| {\phi^{ - } } \right.(a_{00} |e_{0} e_{0} \rangle ) - a_{11} |e_{1} e_{1} \rangle - b_{00} |e_{0}^{'} e_{0}^{'} \rangle + b_{11} |e_{1}^{'} e_{1}^{'} \rangle \\ & \quad + \left| {\psi^{ + } } \right.(a_{01} |e_{0} e_{1} \rangle ) \, + a_{10} |e_{1} e_{0} \rangle - b_{01} |e_{0}^{'} e_{1}^{'} \rangle - b_{10} |e_{1}^{'} e_{0}^{'} \rangle \\ & \quad \left. { + \left| {\psi^{ - } } \right.(a_{01} |e_{0} e_{1} \rangle ) - a_{10} |e_{1} e_{0} \rangle - b_{01} |e_{0}^{'} e_{1}^{'} \rangle + b_{10} |e_{1}^{'} e_{0}^{'} \rangle } \right] \\ \end{aligned} $$
(5)

where \( \left| {a_{00} } \right|^{2} \) + \( \left| {a_{01} } \right|^{2} \) + \( \left| {a_{10} } \right|^{2} \) + \( \left| {a_{11} } \right|^{2} \) = 1, \( \left| {b_{00} } \right|^{2} \) + \( \left| {b_{01} } \right|^{2} \) + \( \left| {b_{10} } \right|^{2} \) + \( \left| {b_{11} } \right|^{2} \) = 1. If Eve does not intend to be detected by eavesdropping check, then U must meet four conditions: \( a_{01} \) = \( b_{10} \) = 1, \( a_{00} \) = \( a_{10} \) = \( a_{11} \) = 0, \( b_{00} \) = \( b_{01} \) = \( b_{11} \) = 0 and \( a_{01} |e_{0} e_{1} \rangle = b_{10} |e_{1}^{'} e_{0}^{'} \rangle \), because Eve cannot distinguish the auxiliary photons \( a_{01} |e_{0} e_{1} \rangle \) from \( b_{10} |e_{1}^{'} e_{0}^{'} \rangle \), that is, she cannot acquire useful information about \( K_{A} \) and \( M \). Thus, our two protocols can resist the entangle-measure attack.

Double CNOT attack: As for the double CNOT attack mentioned in Gu et al. [44], Eve prepares state \( |00\rangle \) in advance. When Alice and Bob transmit information, a CNOT attack is used for logical quantum bits in the channel. The attack result is shown in Eq. (6):

$$ \begin{aligned} & {\text{CNOT}}\left( {1,3} \right){\text{CNOT}}\left( {2,4} \right)|01\rangle _{{12}} \otimes |00\rangle _{{34}} = |0101\rangle _{{1234}} , \\ & {\text{CNOT}}\left( {1,3} \right){\text{CNOT}}\left( {2,4} \right)|10\rangle _{{12}} \otimes |00\rangle _{{34}} = |1010\rangle _{{1234}} , \\ & {\text{CNOT}}\left( {1,3} \right){\text{CNOT}}\left( {2,4} \right)\frac{1}{{\sqrt 2 }}\left( {01} \right.\rangle + |10\rangle )_{{12}} \otimes |00\rangle _{{34}} = \frac{1}{{\sqrt 2 }}\left( {\left| {0101\rangle + } \right|1010\rangle } \right)_{{1234}} , \\ & {\text{CNOT}}\left( {1,3} \right){\text{CNOT}}\left( {2,4} \right)\frac{1}{{\sqrt 2 }}\left( {01} \right.\rangle - |10\rangle )_{{12}} \otimes |00\rangle _{{34}} = \frac{1}{{\sqrt 2 }}\left( {0101} \right. - |1010\rangle )_{{1234}} , \\ \end{aligned} $$
(6)

Eve introduced entanglement in the CNOT attack on \( \left| \pm \right._{dp} \), so after a CNOT attack, the entanglement error will be detected in the eavesdropping detection of Step 3. So the protocol we designed can successfully withstand double CNOT attack. And the final key acquisition depends on the classic bit string M measured in the middle. The composition of M is determined by the states held by both Alice and Bob. So the protocol we designed can successfully withstand double CNOT attack.

5 Efficiency analysis

Cabello [39] introduced the qubit efficiency of a QKA protocol is widely applied, which is given as \( \eta = \frac{c}{q + b} \), where c, q, and b denote the number of the agreement classical bits, the number of qubits used, and the number of classical bits exchanged for decoding the message, respectively. Let n be the number of GHZ states and m be the number of decoy states in each transmitted quantum sequence, the qubit efficiency of our two QKA protocols is \( \eta = \) \( \frac{4n}{8n + 4m + 4m + n + 2n} \). Let m = n, we have \( \eta = \frac{4}{17} \) = 23.53%. The comparison between our protocols and several kinds of others two-party protocols against collective noise is shown in Table 4. As shown in Table 4, our protocol has better global performance in terms of quantum resource cost and qubit efficiency.

Table 4 Comparison between our protocols and the proposed two-party protocols
Full size table

6 Conclusion

On account of logical GHZ states and logical Bell states, we propose two two-party QKA protocols against the collective-dephasing noise and the collective-rotation noise, respectively. As we can see from the security analysis, the proposed protocol is sufficiently secure to effectively protect against common internal and external attacks. Furthermore, compared with the existing two-party QKA protocol, the protocols proposed in this paper have a higher advantage in the cost of quantum resources and the efficiency of qubits.

For future work, I have two thoughts: Firstly, we only proposed the two-party QKA protocol, which can be studied for the multi-party QKA protocol. Secondly, the protocol we propose is to assume that there is only one kind of noise exists in the channel. If there are two kinds of noise in the channel, it is interesting to study how to construct QKA protocols. Therefore, this is the direction of our future research.