1 Introduction

Quantum cryptography covers many issues, such as quantum key distribution (QKD) [1, 2], quantum secret sharing (QSS) [3, 4], and quantum signature (QS) [5, 6]. Especially, quantum key distribution can be physically implemented [7, 8]. Quantum private comparison (QPC) as one of the important topics of quantum cryptography allows two participants to compare their secrets by using the principles of quantum mechanics without revealing any information about the secrets. The first QPC protocol was put forward by Yang et al. [9], which can compare the equality of two participants’ secrets by using Einstein–Podolsky–Rosen (EPR) pairs. After that, various QPC protocols have been proposed for different situations [10,11,12,13,14,15,16,17,18,19,20,21,22,23,24,25,26]. However, the quantum capability of two participants in previous QPC protocols is assumed to be unlimited. Actually, quantum resources are difficult to obtain under current technology. Therefore, how to reduce the requirement of quantum devices for the participants becomes an important problem. In 2016, Chou et al. [27] proposed the first semi-quantum private comparison (SQPC) protocol which reduced the quantum capability of two participants. The SQPC protocol allows two “classical” participants to compare their secrets with the help of a semi-dishonest third party (TP) who may misbehave but cannot collude with “classical” participants. A participant is said to be “classical” if one can only perform the following four operations: (1) preparing fresh qubits in the Z-basis \(\left\{ |0\rangle , |1\rangle \right\} \), (2) measuring qubits in the Z-basis, (3) reordering the qubits, and (4) sending or reflecting the qubits without disturbance.

However, both participants of almost all existing SQPC protocols need quantum measurements. Until recently, Jiang [28] presented a SQPC protocol based on Bell states, where quantum measurements are unnecessary. It can resist some famous attack, such as the intercept-resend attack, the measure-resend attack, and the entangle-measure attack. But we show that it suffers two types of attack. In the first type of attack, an outside eavesdropper can make participants accept a wrong result without being detected. In the second type of attack, a malicious participant not only can make the other participant accept a wrong result, but also has the possibility to learn the secret of the honest participant. Then, we improve Jiang’s SQPC protocol to avoid these two types of attack.

The rest of this paper is organized as follows. Section 2 briefly reviews Jiang’s SQPC protocol [28]. Two types of attack in Jiang’s SQPC protocol are given in Sect. 3. Section 4 presents the improved SQPC protocol. The security analysis of the proposed protocol is made in Sect. 5. Finally, we make a conclusion in Sect. 6.

2 Review of Jiang’s SQPC protocol

In Jiang’s SQPC protocol [28], one participant Alice owns a L-bit secret X and the other participant Bob also has a L-bit secret Y. Note that \( X = ( x_{1},x_{2},\ldots ,x_{L} )\) and \( Y = ( y_{1},y_{2},\ldots ,y_{L} )\), where \( x_{i} \), \( y_{i} \) \( \in \) \( \{0, 1\} \) and \( i = 1, 2,\ldots , L \). They want to compare the equality of their secrets securely with the help of a semi-honest TP. A semi-honest TP means that TP may misbehave, but cannot collude with participants. In the following, Jiang’s SQPC protocol is briefly reviewed.

Preparation stage: Alice and Bob share a common key sequence K of length L in advance through the semi-quantum key distribution (SQKD) protocol [29]. The ith bit of K is described as \( K_{i}\), the value of which is 0 or 1. Meanwhile, Alice prepares a L-bit raw key RA. Let \(RA_{i}\) be the ith bit of RA, where \( RA_{i}\in \left\{ 0, 1 \right\} \) and \( i=1,2,\ldots ,L \). Bob generates a L-bit raw key RB similarly to Alice’s operations.

  • Step 1: TP generates 2L Bell states randomly chosen from \( \left\{ |\varphi ^+\rangle =\frac{1}{\sqrt{2}}(|00\rangle +|11\rangle ) , |\varphi ^-\rangle =\frac{1}{\sqrt{2}}(|00\rangle -|11\rangle ) , |\psi ^+\rangle =\frac{1}{\sqrt{2}}(|01\rangle +|10\rangle ) , |\psi ^-\rangle =\frac{1}{\sqrt{2}}(|01\rangle {-}|10\rangle ) \right\} \) and divides these qubits into two sequences \(S_{A}\) and \(S_{B}\), which denote the first and the second qubits of all Bell states. Here, \( S_{Ai} \) is the ith qubit of \( S_{A} \), and \( S_{Bi} \) is the ith qubit of \( S_{B} \), where \( i=1,2,\ldots ,2L \). Then, TP sends \(S_{A}\) and \(S_{B}\) to Alice and Bob, respectively.

  • Step 2: When Alice and Bob receive each qubit, they randomly choose reflect-mode (this mode is denoted as CTRL) or encode-mode (this mode is denoted as SIFT). Specifically, if Alice chooses CTRL, she reflects the received qubit without disturbance. If Alice chooses SIFT, she computes \(MA_{i}=K_{i}\oplus RA_{i} \oplus x_{i}\), where \( \oplus \) is the modulo 2 addition operation, generates a fresh qubit in the Z-basis according to \( MA_{i}\), and sends it to TP. For instance, if \( MA_{i}=0 \), Alice prepares \( |0\rangle \), else prepares \( |1\rangle \). Bob performs similar operations as Alice does according to his own choice, namely that he reflects the received qubit without disturbance or generates a fresh qubit according to \( MB_{i}\) and sends it to TP.

  • Step 3: After TP receives all the qubits sent by Alice and Bob, Alice and Bob announce their choices in step 2.

  • Step 4: TP performs one of the four operations on the received qubits based on Alice and Bob’s choices as shown in Table 1. In case 1, when both Alice and Bob chose CTRL in step 2, TP performs the Bell state measurements on the reflected qubits used for checking errors. In cases 2, 3 and 4, to obtain the values of \(MA_{i}\) and \(MB_{i}\), TP performs Z-basis measurements on the qubits returned by Alice or Bob who selected SIFT in step 2.

  • Step 5: TP evaluates the error rate in case 1 in Table 1. If the error rate is higher than the predefined threshold, the protocol aborts; otherwise, it continues.

  • Step 6: Alice and Bob tell TP the values of RA and RB, respectively. Here, \( RA= [ RA_{1},RA_{2},\ldots ,RA_{L}] \) and \( RB= [ RB_{1},RB_{2},\ldots ,RB_{L}] \). TP computes \(R_{i} = MA_{i}\oplus MB_{i} \oplus RA_{i} \oplus RB_{i} \). If \(R_{i} \ne 0\), TP concludes that \(X \ne Y\) and ends the protocol due to

    $$\begin{aligned} \begin{aligned} R_{i}&= MA_{i}\oplus MB_{i} \oplus RA_{i} \oplus RB_{i} \\&=(x_{i}\oplus RA_{i}\oplus K_{i})\oplus (y_{i}\oplus RB_{i}\oplus K_{i})\oplus RA_{i} \oplus RB_{i}\\&=x_{i}\oplus y_{i}. \end{aligned} \end{aligned}$$
    (1)

    Otherwise, TP sets \(i = i + 1\) and repeats from the beginning of this step. If TP finds out that \(R_{i} = 0\) in the end, TP knows \(X=Y\). Finally, TP announces the result.

Table 1 Participants’ actions on the qubit in each position in Jiang’s protocol [28]
Full size table

3 Two types of attack in Jiang’s SQPC protocol

In this section, we analyze two types of attack in Jiang’s SQPC protocol [28], namely outside attack and participant attack. In the first case, an outside eavesdropper can make participants accept a wrong result. In the second case, a malicious participant can make the other participant accept a wrong result and obtain the secret of the honest participant. Furthermore, the attack cannot be detected in both cases.

Before giving two specific attacks, we briefly analyze why the SQPC protocol proposed by Jiang [28] is insecure against them. The main reason is that the security analysis of Ref. [28] ignores the case that Eve not only can intercept qubits and send fake qubits, but also may store qubits. Specifically, Eve intercepts and stores qubits sent by TP in step 1 and sends fake qubits to Alice and Bob. Then, when Alice and Bob return the qubits to TP in step 2, Eve also intercepts the qubits and sends the qubits stored in her memories to TP instead. In this case, TP cannot detect Eve’s attack since what Eve returned were the qubits that he sent. In addition, the entangle-measure attack that Eve may entangle her qubits with the qubits from TP sent to Alice or Bob is also not analyzed. We will make more complete security analysis of the improved protocol to be proposed later.

In the following, two types of attack that may occur in Jiang’s SQPC protocol [28] are given, respectively.

3.1 Outside attack on Jiang’s SQPC protocol

In this case, an outside eavesdropper Eve can intercept transmitted qubits and replace them with her own qubits in some steps to cause participants to obtain a wrong result. The specific operations of the outside attack are as follows.

In step 1, Eve intercepts \( S_{Ai} \) and \( S_{Bi} \) which TP sends to Alice and Bob and retains them in her quantum memories. Then, she sends fake qubits to Alice and Bob, the states of which are randomly chosen from \(\{|0\rangle ,|1\rangle \}\).

In step 2, no matter which operation Alice and Bob chose, Eve intercepts the qubits sent by them and after that sends \(S_{Ai}\) and \( S_{Bi} \) in the corresponding positions retained in her quantum memory to TP.

Because the Bell states used for detection are the same as the initial Bell states prepared by TP, Eve can pass the eavesdropping check in step 5. Then, TP announces the result. But due to Eve’s attack, TP obtains the wrong \(MA_{i}\) and \(MB_{i}\) in step 4 which may lead to an incorrect result. Therefore, although Eve cannot obtain the secret message, she successfully performs an outside attack to make two participants get a wrong result without being detected.

3.2 Participant attack on Jiang’s SQPC protocol

In this subsection, we assume that Bob is a malicious participant who wants to get Alice’s secret. Bob may not only intercept transmitted qubits and replace them with his own qubits in some steps in order to cause participants to obtain a wrong result, but also perform quantum measurements to obtain the values of \(MA_i\) for learning the secret of Alice. The specific operations of the participant attack are as follows.

In step 1, for each qubit \(S_{Ai}\) which TP sent to Alice, Bob intercepts it and retains it in his quantum memory. Subsequently, Bob sends a fake qubit prepared by himself to Alice.

In step 2, no matter which operation Alice chose, Bob intercepts the qubit from Alice to TP and retains it in his quantum memory. Then, he sends \(S_{Ai}\) retained in his quantum memory to TP instead.

In step 3, Alice and Bob announce their choices in step 2. Bob performs Z-basis measurements on the qubits which were sent by Alice after she selected SIFT and kept by Bob to learn the values of \(MA_i\).

Since the Bell states used for detection are the same as initial Bell states prepared by TP, Bob can pass the eavesdropping check in step 5. After Alice and Bob publish \( RA_{i} \) and \( RB_{i} \), TP calculates the result by using \(MA_i\) and \(MB_i\) and announces it. But this result may be wrong since Bob replaced the qubits that were sent to TP by Alice in step 2 and it may make TP obtain the wrong \(MA_i\) in step 4. Furthermore, when Bob obtains the values of \( RA_{i} \) published by Alice in step 6, he can learn Alice’s secret by calculating

$$\begin{aligned} \begin{aligned}&MA_{i}\oplus RA_{i} \oplus K_{i}\\&\quad =(x_{i}\oplus RA_{i}\oplus K_{i})\oplus RA_{i} \oplus K_{i}\\&\quad =x_{i}. \end{aligned} \end{aligned}$$
(2)

Therefore, Bob not only can make the honest participant Alice accept the wrong result, but also can obtain Alice’s secret without being detected.

4 The proposed improved SQPC protocol

In this part, we improve the SQPC protocol given by Jiang [28] to resist the proposed two types of attack. Similar to Jiang’s protocol [28], two participants Alice and Bob want to securely compare the equality of their secrets with the help of a semi-dishonest TP. Alice has a L-bit secret X and Bob has a L-bit secret Y, respectively. Let \( x_{i} \) be the ith bit of X and \( y_{i} \) be the ith bit of Y, where \( x_{i}, y_{i}\in \{0, 1\}\) and \( i = 1, 2,\ldots , L\). The detailed steps are given as follows.

Preparation stage: Alice and Bob first share a common key sequence K of length L by using the SQKD protocol [29]. Set \( K_{i} \) as the ith bit of K, where \( K_{i}\in \left\{ 0, 1 \right\} \) and \( i=1,2,\ldots ,L \). Meanwhile, Alice prepares a L-bit raw key RA. In addition, \(RA_{i}\) means the ith bit of RA, where \( RA_{i}\in \left\{ 0, 1 \right\} \) and \( i=1,2,\ldots ,L \). A L-bit raw key RB is produced by Bob by employing similar operations as those done by Alice.

  • Step 1: TP generates 3L Bell states randomly chosen from \(\{|\varphi ^+\rangle =\frac{1}{\sqrt{2}}(|00\rangle +|11\rangle ) \), \( |\varphi ^-\rangle =\frac{1}{\sqrt{2}}(|00\rangle -|11\rangle ) \), \( |\psi ^+\rangle =\frac{1}{\sqrt{2}}(|01\rangle +|10\rangle ) \), \( |\psi ^-\rangle =\frac{1}{\sqrt{2}}(|01\rangle -|10\rangle )\} \) and divides these qubits into two sequences \(S_{A}\) and \(S_{B}\), which denote the first and the second qubits of all Bell states. Then, TP sends \(S_{A}\) to Alice and \(S_{B}\) to Bob, respectively.

  • Step 2: When Alice and Bob receive each qubit, they randomly choose reflect-mode (we call this mode as CTRL), encode-mode (we call this mode as SIFT), or detect-mode(we denote this mode as DETECT). Specifically, the three modes can be described in the following.

    • (1) CTRL: Alice reflects the received qubit without disturbance.

    • (2) SIFT: Alice performs Z-basis measurement on the received qubit and records the measurement result as \(MA_{i}\). Then, Alice generates a fresh qubit in the Z-basis according to \( MA_{i} \) and sends it to TP. For example, if \(MA_{i} = 0\), she will generate \( |0\rangle \), else will generate \( |1\rangle \). Meanwhile, Alice calculates \(RA_{i}' = \) \(K_{i}\oplus RA_{i} \oplus x_{i} \oplus MA_{i}\), where \( i=1,2,\ldots ,L \).

    • (3) DETECT: Alice discards the qubit from TP, generates a trap qubit randomly chosen from \( \left\{ |0\rangle , |1\rangle \right\} \), and sends it to TP.

Bob does operations similar to what Alice does according to his own choices. For each received qubit, he also randomly chooses CTRL, SIFT, or DETECT. For CTRL, he just reflects back the qubit without doing anything; for SIFT, he generates a fresh qubit according to the value of \( MB_{i}\) to be sent to TP and evaluates \(RB_{i}' = K_{i}\oplus RB_{i} \oplus y_{i} \oplus MB_{i}\); and for DETECT, he generates a trap qubit and sends it to TP.

  • Step 3: After TP receives all the qubits sent by Alice and Bob, Alice and Bob announce their choices in step 2.

  • Step 4: TP performs different operations on the received qubits based on Alice and Bob’s choices. Since both Alice and Bob can choose CTRL, SIFT, and DETECT, there are nine cases as follows.

    • Case 1: When both Alice and Bob chose CTRL, TP performs the Bell state measurement on the reflected qubits for detecting eavesdropping.

    • Case 2: If Alice chose CTRL and Bob chose DETECT, TP performs Z-basis measurement on the trap qubit which was sent by Bob and announces the result. Note that for the qubit returned by Alice, TP does nothing.

    • Case 3: If Alice chose CTRL and Bob chose SIFT, TP performs Z-basis measurement on the qubit which was sent by Bob to learn the value of \(MB_{i}\).

    • Case 4: For both Alice and Bob chose DETECT, TP performs Z-basis measurements on the trap qubits which were sent by Alice and Bob and announces the results of the measurements.

    • Case 5: Similar to case 2, if Alice chose DETECT and Bob chose CTRL, TP performs Z-basis measurement on the trap qubit which was sent by Alice and announces the result.

    • Case 6: If Alice chose DETECT and Bob chose SIFT, TP performs Z-basis measurements on the qubits which were sent by Alice and reveals the result. He also applies the measurements on the qubit sent by Bob to learn the value of \(MB_{i}\).

    • Case 7: If both Alice and Bob chose SIFT, TP obtains the values of \(MA_{i}\) and \(MB_{i}\) by performing Z-basis measurements on the qubits returned by Alice and Bob.

    • Case 8: Similar to case 3, when Alice chose SIFT and Bob chose CTRL, TP only performs Z-basis measurement on the qubits from Alice to learn the value of \(MA_{i}\).

    • Case 9: When Alice chose SIFT and Bob chose DETECT, TP performs Z-basis measurement on the qubits from Alice to learn the value of \(MA_{i}\). He also applies Z-basis measurement on the trap qubit from Bob and reveals the measurement result of it.

  • Step 5: TP evaluates the error rate in case 1 in terms of the results of the Bell state measurements. Alice and Bob also evaluate the error rate in cases 2, 4, 5, 6, and 9 according to the measurement results of trap qubits. If the error rate in any case is higher than the predefined threshold, the protocol aborts; otherwise, it continues.

  • Step 6: Alice publishes the value of \(RA_{i}\oplus RA_{i}'\) and Bob reveals \(RB_{i}\oplus RB_{i}'\), where \( i=1,2,\ldots ,L \). Then, TP computes

    $$\begin{aligned} \begin{aligned} R_{i}&= MA_{i}\oplus MB_{i} \oplus (RA_{i} \oplus RA_{i}') \oplus (RB_{i} \oplus RB_{i}')\\&= MA_{i}\oplus MB_{i} \oplus (RA_{i} \oplus K_{i} \oplus RA_{i} \oplus x_{i} \oplus MA_{i})\\&\quad \oplus (RB_{i} \oplus K_{i} \oplus RB_{i} \oplus y_{i}\oplus MB_{i})\\&= x_{i}\oplus y_{i}. \end{aligned} \end{aligned}$$
    (3)

    If \(R_{i} \ne 0\), TP concludes that \(X \ne Y\) and ends the protocol. Otherwise, TP sets \(i = i + 1\) and repeats from the beginning of this step. If TP finds out that \(R_{i} = 0\) in the end, TP learns \(X=Y\). Finally, TP announces the result.

5 Security analysis

In this section, we show the improved SQPC protocol can avoid the proposed two types of attack on Jiang’s SQPC protocol [28] and it also can resist other types of attack as Jiang’s protocol did.

5.1 Participant attack

Firstly, we show that the proposed participant attack on the SQPC protocol in Ref. [28] is impossible in the proposed protocol. Without loss of generality, we suppose Bob is dishonest. In step 1, the dishonest participant Bob intercepts the qubits sent by TP to Alice and retains them in his quantum memories. In step 2, Bob intercepts the qubits returned by Alice and sends the stored qubits to Alice instead. In these two steps, TP and Alice cannot discover Bob’s eavesdropping. However, in step 3, as Alice announced the positions of her trap qubits, TP should measure these trap qubits and publish the measurement results in step 4. If Bob replaced the qubit returned by Alice with the qubit in his quantum memory, the probability that TP produces a wrong measurement result of the trap qubit is \( \frac{1}{2} \) and the probability of Bob passing the security check is also \( \frac{1}{2} \) if Alice chooses DETECT. Note that Alice and Bob chose each DETECT, SIFT and CTRL with probability \(\frac{1}{3}\). Therefore, the probability of the dishonest participant being detected will be \(P_{1} = 1- (\frac{1}{3} \times \frac{1}{2}+\frac{2}{3})^{L} = 1-(\frac{5}{6})^{L}\), where L is the number of the trap qubits produced by Alice, and it is close to 1 if L is large enough.

Besides the proposed participant attack, the improved SQPC protocol also can resist some other typical types of participant attack, such as the intercept-resend attack, the measure-resend attack, and the entangle-measure attack, which are similar as that in the original Jiang’s protocol. The reason is that the basic steps of the two protocols are similar and the main difference mainly lies in that in step 2 of the proposed protocol, the operations are different in two cases except CTRL. In one case, DETECT is used to detect attack by the use of trap qubits and in the other case, SIFT requires the participants to measure the received qubits instead of discarding them directly in Jiang’s protocol [28]. Thus, we only briefly analyze these types of attack in the following, and more details can be found in Ref. [28].

For the intercept-resend attack, a dishonest participant Bob may intercept the qubits from Alice or TP during the transmission and send fake qubits to them. Suppose TP prepares the Bell state \( |\varphi ^+\rangle \) and Bob intercepts the first qubit which is sent to Alice. In step 2, if both Alice and Bob chose CTRL, the initial Bell state would not change because they reflected the received qubits without disturbance. However, Bob does not know Alice choices. If he sends fake qubits to Alice in this case, TP will perform the Bell state measurement on the received qubits and obtain \( |\varphi ^+\rangle \), \( |\varphi ^-\rangle \), \( |\psi ^+\rangle \), and \( |\psi ^-\rangle \) with equal probability. TP can detect Bob’s attack with the probability of \(\frac{3}{4}\). Moreover, if Alice chose DETECT in step 2 and Bob intercepts the trap qubit, Bob will be detected with probability of \(\frac{1}{2}\) since the trap qubit’s state is unknown to Bob. For instance, if the state of the trap qubit generated by Alice is \( |0\rangle \), then Bob intercepts the trap qubit and sends the fake qubit to TP, and Bob has the probability of \(\frac{1}{2}\) to send \(|1\rangle \). Consequently, the probability of dishonest Bob being detected will be \( P_{2} = 1-(\frac{1}{9}\times \frac{1}{4}+ \frac{1}{3}\times \frac{1}{2} +\frac{5}{9})^{L}=1- (\frac{3}{4})^{L}\), which is close to 1 when L is large enough.

The measure-resend attack here is that Bob intercepts the qubits from Alice or TP and measures them in the Z-basis to obtain some information and then sends the qubits which are the same as the measurement qubits to Alice or TP. In step 4, TP should perform the Bell measurement on the received qubits which were sent by Alice and Bob if they selected CTRL in step 2. Bob may be detected by TP with the probability of \(\frac{1}{2}\) because the measurements made by Bob lead to collapse of the initial Bell states. For example, suppose TP prepares the Bell state \( |\varphi ^+\rangle \). If Bob intercepts and measures it, the state will collapse into \( |00\rangle \) or \(|11\rangle \) with equal probability. When TP performs the Bell state measurement on the received qubits, he obtains \( |\varphi ^+\rangle \) or \( |\varphi ^-\rangle \) with equal probability. Thus, the probability of Bob being detected is \( P_{3} = 1-(\frac{1}{9} \times \frac{1}{2}+\frac{8}{9})^{L}=1- (\frac{17}{18})^{L}\) and it is close to 1, when L is large enough.

The entangle-measure attack means that Bob entangles each transmitted qubit with an ancillary qubit by performing an unitary operation and then measures these ancillary qubits later to obtain some information. Specifically, Bob entangles his ancillary qubit with the qubit from TP to Alice through performing the unitary operation \(U_{E}\). When Alice returns qubits to TP, Bob also performs another unitary operation \(U_{F}\) on the intercepted qubit. The \(U_{E}\) can be defined as follows:

$$\begin{aligned} \begin{aligned} U_{E}(|e\rangle _{E}|0\rangle )&=a_{0} |f_{0}\rangle _{E}|0\rangle + a_{1}|f_{1}\rangle _{E}|1\rangle \\ U_{E}(|e\rangle _{E}|1\rangle )&=b_{0} |g_{0}\rangle _{E}|0\rangle + b_{1}|g_{1}\rangle _{E}|1\rangle , \end{aligned} \end{aligned}$$
(4)

where \(|a_{0}|^2+|a_{1}|^2=1\), \(|b_{0}|^2+|b_{1}|^2=1 \), \(|e\rangle \) is an ancillary qubit prepared by Bob, and \(\left\{ |f_{0}\rangle , |f_{1}\rangle \right\} \), \(\left\{ |g_{0}\rangle , |g_{1}\rangle \right\} \) are arbitrary and not necessarily orthogonal states. The \(U_{F}\) can be defined as follows:

$$\begin{aligned} \begin{aligned} U_{F}(|f_{0}\rangle _E|0\rangle )&=c_{0} |h_{0}\rangle _{E}|0\rangle + c_{1} |h_{1}\rangle _{E}|1\rangle \\ U_{F}(|f_{0}\rangle _E|1\rangle )&=d_{0} |i_{0}\rangle _{E}|0\rangle + d_{1} |i_{1}\rangle _{E}|1\rangle \\ U_{F}(|f_{1}\rangle _E|0\rangle )&=p_{0} |j_{0}\rangle _{E}|0\rangle + p_{1} |j_{1}\rangle _{E}|1\rangle \\ U_{F}(|f_{1}\rangle _E|1\rangle )&=q_{0} |k_{0}\rangle _{E}|0\rangle + q_{1} |k_{1}\rangle _{E}|1\rangle \\ U_{F}(|g_{0}\rangle _E|0\rangle )&=r_{0} |l_{0}\rangle _{E}|0\rangle + r_{1} |l_{1}\rangle _{E}|1\rangle \\ U_{F}(|g_{0}\rangle _E|1\rangle )&=s_{0} |m_{0}\rangle _{E}|0\rangle + s_{1} |m_{1}\rangle _{E}|1\rangle \\ U_{F}(|g_{1}\rangle _E|0\rangle )&=t_{0} |n_{0}\rangle _{E}|0\rangle + t_{1} |n_{1}\rangle _{E}|1\rangle \\ U_{F}(|g_{1}\rangle _E|1\rangle )&=u_{0} |o_{0}\rangle _{E}|0\rangle + u_{1} |o_{1}\rangle _{E}|1\rangle ,\\ \end{aligned} \end{aligned}$$
(5)

where \(|c_{0}|^2+|c_{1}|^2=1\), \(|d_{0}|^2+|d_{1}|^2=1 \), \(|p_{0}|^2+|p_{1}|^2=1\), \(|q_{0}|^2+|q_{1}|^2=1 \), \(|r_{0}|^2\) \(+|r_{1}|^2=1\), \(|s_{0}|^2+|s_{1}|^2=1 \), \(|t_{0}|^2+|t_{1}|^2=1\), \(|u_{0}|^2+|u_{1}|^2=1 \), and \(\left\{ |h_{0}\rangle , |h_{1}\rangle \right\} \), \(\left\{ |i_{0}\rangle , |i_{1}\rangle \right\} \), \(\left\{ |j_{0}\rangle , |j_{1}\rangle \right\} \), \(\left\{ |k_{0}\rangle , |k_{1}\rangle \right\} \), \(\left\{ |l_{0}\rangle , |l_{1}\rangle \right\} \), \(\left\{ |m_{0}\rangle , |m_{1}\rangle \right\} \), \(\left\{ |n_{0}\rangle , |n_{1}\rangle \right\} \), \(\left\{ |o_{0}\rangle ,\right. \) \(\left. |o_{1}\rangle \right\} \) are arbitrary states and they are not necessarily orthogonal. Suppose TP prepares the Bell state \( |\varphi ^+\rangle \) as an example. The cases that TP prepares other Bell states are similar. After Bob performs the operation \(U_{E}\) in step 1, the state of the entire system becomes

$$\begin{aligned} \begin{aligned} |\varphi _{1}\rangle&= (U_{E}\otimes I_{B})(|e\rangle _E|\varphi ^+\rangle _{AB})\\&=\frac{1}{\sqrt{2}}(a_{0} |f_{0}\rangle |00\rangle + a_{1}|f_{1}\rangle |10\rangle +b_{0} |g_{0}\rangle |01\rangle + b_{1}|g_{1}\rangle |11\rangle )_{EAB}. \end{aligned} \end{aligned}$$
(6)

When Alice and Bob receive each qubit, they randomly choose CTRL, SIFT, or DETECT in step 2 and return the corresponding qubits to TP based on different operations. Bob performs another operation \(U_{F}\) on the qubits returned by Alice and the ancillary qubit. Suppose Alice chose DETECT and Bob chose CTRL and then Alice generated \(|0\rangle \) to be sent to TP. After Bob performs the operation \(U_{F}\) on Alice’s trap qubit and his ancillary qubit, the state of the entire quantum system should be

$$\begin{aligned} \begin{aligned} |\varphi _{2}\rangle&=(U_{F}\otimes I_{A} \otimes I_{B} ) \frac{1}{\sqrt{2}}(a_{0} |f_{0}\rangle |0\rangle |00\rangle + a_{1}|f_{1}\rangle |0\rangle |10\rangle +b_{0}|g_{0}\rangle |0\rangle |01\rangle + b_{1}|g_{1}\rangle |0\rangle |11\rangle )_{ETAB}\\&= \frac{1}{\sqrt{2}}\left[ \begin{aligned}&a_{0}(c_{0} |h_{0}\rangle |0\rangle + c_{1}|h_{1}\rangle |1\rangle )|00\rangle + a_{1}(p_{0} |j_{0}\rangle |0\rangle + p_{1}|j_{1}\rangle |1\rangle )|10\rangle \\&+b_{0}(r_{0} |l_{0}\rangle |0\rangle + r_{1}|l_{1}\rangle |1\rangle )|01\rangle + b_{1}(t_{0} |n_{0}\rangle |0\rangle + t_{1}|n_{1}\rangle |1\rangle )|11\rangle \end{aligned}\right] _{ETAB}.\\ \end{aligned}\nonumber \\ \end{aligned}$$
(7)

Suppose \(\left\{ |h_{0}\rangle , |h_{1}'\rangle \right\} \), \(\left\{ |i_{0}\rangle , |i_{1}'\rangle \right\} \), \(\left\{ |j_{0}\rangle , |j_{1}'\rangle \right\} \), \(\left\{ |k_{0}\rangle , |k_{1}'\rangle \right\} \), \(\left\{ |l_{0}\rangle , |l_{1}'\rangle \right\} \), \(\left\{ |m_{0}\rangle ,\right. \) \(\left. |m_{1}'\rangle \right\} \), \(\left\{ |n_{0}\rangle , |n_{1}'\rangle \right\} \), \(\left\{ |o_{0}\rangle , |o_{1}'\rangle \right\} \) are eight orthogonal bases. The state of the trap qubit sent by Alice now can be described by the reduced density operator \(\rho ^{T}\) as follows:

$$\begin{aligned} \begin{aligned} \rho ^{T}&=tr_{EAB}(|\varphi _{2}\rangle \langle \varphi _{2}|)\\&= \frac{1}{\sqrt{2}}\left\{ \begin{aligned}&tr_{EAB}\left[ a_{0}(c_{0} |h_{0}\rangle |0\rangle + c_{1}|h_{1}\rangle |1\rangle )|00\rangle \langle 00|a_{0}^*(c_{0}^* \langle h_{0}|\langle 0| + c_{1}^*\langle h_{1}|\langle 1| )\right] \\&\quad +tr_{EAB}\left[ a_{1}(p_{0} |j_{0}\rangle |0\rangle + p_{1}|j_{1}\rangle |1\rangle )|10\rangle \langle 10|a_{1}^*(p_{0}^* \langle j_{0}|\langle 0| + p_{1}^*\langle j_{1}|\langle 1| )\right] \\&\quad +tr_{EAB}\left[ b_{0}(r_{0} |l_{0}\rangle |0\rangle + r_{1}|l_{1}\rangle |1\rangle )|01\rangle \langle 01|b_{0}^*(r_{0}^* \langle l_{0}|\langle 0| + r_{1}^*\langle l_{1}|\langle 1| )\right] \\&\quad +tr_{EAB}\left[ b_{1}(t_{0} |n_{0}\rangle |0\rangle + t_{1}|n_{1}\rangle |1\rangle )|11\rangle \langle 11|b_{1}^*(t_{0}^* \langle n_{0}|\langle 0| + t_{1}^*\langle n_{1}|\langle 1| )\right] \end{aligned}\right\} \\&=\frac{1}{\sqrt{2}} \left[ \begin{aligned}&(a_{0}c_{0}|0\rangle + a_{0}c_{1}\langle h_{0}|h_{1}\rangle |1\rangle )(a_{0}^*c_{0}^*\langle 0| + a_{0}^*c_{1}^*\langle h_{1}|h_{0}\rangle \langle 1|)\\&\quad +(a_{0}c_{1}\langle h_{1}'|h_{1}\rangle |1\rangle )( a_{0}^*c_{1}^*\langle h_{1}|h_{1}'\rangle \langle 1| )\\&\quad +(a_{1}p_{0}|0\rangle + a_{1}p_{1}\langle j_{0}|j_{1}\rangle |1\rangle )(a_{1}^*p_{0}^*\langle 0| + a_{1}^*p_{1}^*\langle j_{1}|j_{0}\rangle \langle 1| )\\&\quad +(a_{1}p_{1}\langle j_{1}'|j_{1}\rangle |1\rangle )(a_{1}^*p_{1}^*\langle j_{1}|j_{1}'\rangle \langle 1| )\\&\quad +(b_{0}r_{0}|0\rangle + b_{0}r_{1}\langle l_{0}|l_{1}\rangle |1\rangle )(b_{0}^*r_{0}^*\langle 0| + b_{0}^*r_{1}^*\langle l_{1}|l_{0}\rangle \langle 1| )\\&\quad +(b_{0}r_{1}\langle l_{1}'|l_{1}\rangle |1\rangle )(b_{0}^*r_{1}^*\langle l_{1}|l_{1}'\rangle \langle 1| )\\&\quad +(b_{1}t_{0}|0\rangle + b_{1}t_{1}\langle n_{0}|n_{1}\rangle |1\rangle )(b_{1}^*t_{0}^*\langle 0| + b_{1}^*t_{1}^*\langle n_{1}|n_{0}\rangle \langle 1| )\\&\quad +(b_{1}t_{1}\langle n_{1}'|n_{1}\rangle |1\rangle )(b_{1}^*t_{1}^*\langle n_{1}|n_{1}'\rangle \langle 1| ) \end{aligned}\right] \\&= \frac{1}{\sqrt{2}}\left( \begin{aligned}&|a_{0}c_{0}|^2|0\rangle \langle 0| + |a_{0}c_{1}\langle h_{0}|h_{1}\rangle |^2|1\rangle \langle 1|+|a_{0}c_{1}\langle h_{1}'|h_{1}\rangle |^2|1\rangle \langle 1|\\&\quad +|a_{1}p_{0}|^2|0\rangle \langle 0| + |a_{1}p_{1}\langle j_{0}|j_{1}\rangle |^2|1\rangle \langle 1|+|a_{1}p_{1}\langle j_{1}'|j_{1}\rangle |^2|1\rangle \langle 1|\\&\quad +|b_{0}r_{0}|^2|0\rangle \langle 0| + |b_{0}r_{1}\langle l_{0}|l_{1}\rangle |^2|1\rangle \langle 1|+|b_{0}r_{1}\langle l_{1}'|l_{1}\rangle |^2|1\rangle \langle 1|\\&\quad +|b_{1}t_{0}|^2|0\rangle \langle 0| + |b_{1}t_{1}\langle n_{0}|n_{1}\rangle |^2|1\rangle \langle 1|+|b_{1}t_{1}\langle n_{1}'|n_{1}\rangle |^2|1\rangle \langle 1| \end{aligned}\right) \\&= \frac{1}{\sqrt{2}}\left[ \begin{aligned}&(|a_{0}c_{0}|^2+|a_{1}p_{0}|^2+|b_{0}r_{0}|^2+|b_{1}t_{0}|^2)|0\rangle \langle 0|+(|a_{0}c_{1}\langle h_{0}|h_{1}\rangle |^2\\&\quad + |a_{0}c_{1}\langle h_{1}'|h_{1}\rangle |^2+ |a_{1}p_{1}\langle j_{0}|j_{1}\rangle |^2+|a_{1}p_{1}\langle j_{1}'|j_{1}\rangle |^2+ |b_{0}r_{1}\langle l_{0}|l_{1}\rangle |^2\\&\quad +|b_{0}r_{1}\langle l_{1}'|l_{1}\rangle |^2+ |b_{1}t_{1}\langle n_{0}|n_{1}\rangle |^2+|b_{1}t_{1}\langle n_{1}'|n_{1}\rangle |^2)|1\rangle \langle 1|\\ \end{aligned}\right] .\\ \end{aligned} \end{aligned}$$
(8)

TP should measure the trap qubit from Alice in the Z-basis and publish the measurement result later. If Bob wants to induce no error after performing \(U_{F}\), the probability that TP obtains \(|0\rangle \) after performing the measurement on the trap qubit returned by Alice must be 1. It also means

$$\begin{aligned} \begin{aligned} P(|1\rangle )&=tr(|1\rangle \langle 1|\rho ^{T})\\&= \frac{1}{\sqrt{2}} \left( \begin{aligned}&|a_{0}c_{1}\langle h_{0}|h_{1}\rangle |^2+|a_{0}c_{1}\langle h_{1}'|h_{1}\rangle |^2+|a_{1}p_{1}\langle j_{0}|j_{1}\rangle |^2+|a_{1}p_{1}\langle j_{1}'|j_{1}\rangle |^2\\&\quad +|b_{0}r_{1}\langle l_{0}|l_{1}\rangle |^2+|b_{0}r_{1}\langle l_{1}'|l_{1}\rangle |^2+|b_{1}t_{1}\langle n_{0}|n_{1}\rangle |^2+|b_{1}t_{1}\langle n_{1}'|n_{1}\rangle |^2 \end{aligned}\right) \\&=0 \end{aligned} \end{aligned}$$
(9)

From Eq. (9), we can get

$$\begin{aligned} \begin{aligned} a_{0}c_{1}=0, a_{1}p_{1}=0, b_{0}r_{1}=0, b_{1}t_{1}=0. \end{aligned} \end{aligned}$$
(10)

Note that if Bob sets \(|h_{1}\rangle =|h_{1}'\rangle \), \(|j_{1}\rangle =|j_{1}'\rangle \), \(|l_{1}\rangle =|l_{1}'\rangle \) and \(|n_{1}\rangle =|n_{1}'\rangle \), Eq. (10) still can be obtained. Similarly, if Alice prepared the state \( |1\rangle _{T}\), the state of the entire quantum system after Bob performed \(U_F\) should be

$$\begin{aligned} \begin{aligned} |\varphi _{3}\rangle&= (U_{F}\otimes I_{A} \otimes I_{B} ) \frac{1}{\sqrt{2}}( a_{0} |f_{0}\rangle |1\rangle |00\rangle + a_{1}|f_{1}\rangle |1\rangle |10\rangle +b_{0}|g_{0}\rangle |1\rangle |01\rangle + b_{1}|g_{1}\rangle |1\rangle |11\rangle )_{ETAB}\\&= \frac{1}{\sqrt{2}}\left[ \begin{aligned}&a_{0}(d_{0} |i_{0}\rangle |0\rangle + d_{1}|i_{1}\rangle |1\rangle )|00\rangle + a_{1}(q_{0} |k_{0}\rangle |0\rangle + q_{1}|k_{1}\rangle |1\rangle )|10\rangle \\&\quad +b_{0}(s_{0} |m_{0}\rangle |0\rangle + s_{1}|m_{1}\rangle |1\rangle )|01\rangle + b_{1}(u_{0} |o_{0}\rangle |0\rangle + u_{1}|o_{1}\rangle |1\rangle )|11\rangle \end{aligned}\right] _{ETAB}.\\ \end{aligned} \end{aligned}$$
(11)

Similarly, the state of the trap qubit returned by Alice can be given by the following reduced density operator \(\rho '^{T}\)

$$\begin{aligned} \begin{aligned} \rho '^{T}&=tr_{EAB}(|\varphi _{3}\rangle \langle \varphi _{3}|)\\&= \frac{1}{\sqrt{2}}\left[ \begin{aligned}&(|a_{0}d_{0}|^2+|a_{1}q_{0}|^2+|b_{0}s_{0}|^2+|b_{1}u_{0}|^2)|0\rangle \langle 0|+(|a_{0}d_{1}\langle i_{0}|i_{1}\rangle |^2\\&\quad + |a_{0}d_{1}\langle i_{1}'|i_{1}\rangle |^2+ |a_{1}q_{1}\langle k_{0}|k_{1}\rangle |^2+|a_{1}q_{1}\langle k_{1}'|k_{1}\rangle |^2+ |b_{0}s_{1}\langle m_{0}|m_{1}\rangle |^2\\&\quad +|b_{0}s_{1}\langle m_{1}'|m_{1}\rangle |^2+ |b_{1}u_{1}\langle o_{0}|o_{1}\rangle |^2+|b_{1}u_{1}\langle o_{1}'|o_{1}\rangle |^2)|1\rangle \langle 1|\\ \end{aligned}\right] \\ \end{aligned} \end{aligned}$$
(12)

If Bob does not want to induce any error, TP should obtain \( |1\rangle \) with probability 1 after he measures the trap qubit. Due to \(P(|0\rangle )=tr(|0\rangle \langle 0|\rho '^{T})=0\), we can obtain

$$\begin{aligned} \begin{aligned} a_{0}d_{0}=0, a_{1}q_{0}=0, b_{0}s_{0}=0, b_{1}u_{0}=0. \end{aligned} \end{aligned}$$
(13)

If both Alice and Bob chose CTRL in step 2 and Bob implemented the operations \(U_{E}\) and \(U_{F}\), the state of the quantum system should become

$$\begin{aligned} \begin{aligned} |\varphi _{4}\rangle&= (U_{F}\otimes I_{B} )\frac{1}{\sqrt{2}}(a_{0} |f_{0}\rangle |00\rangle + a_{1}|f_{1}\rangle |10\rangle +b_{0} |g_{0}\rangle |01\rangle + b_{1}|g_{1}\rangle |11\rangle )_{EAB}\\&=\frac{1}{\sqrt{2}}\left[ \begin{aligned}&a_{0} (c_{0}|h_{0}\rangle |0\rangle + c_{1}|h_{1}\rangle |1\rangle )|0\rangle + a_{1}(q_{0} |k_{0}\rangle |0\rangle +q_{1}|k_{1}\rangle |1\rangle )0\rangle \\&\quad +b_{0} (r_{0} |l_{0}\rangle |0\rangle + r_{1} |l_{1}\rangle |1\rangle )|1\rangle + b_{1}(u_{0} |o_{0}\rangle |0\rangle + u_{1}|o_{1}\rangle |1\rangle )|1\rangle \end{aligned}\right] _{EAB}\\&=\frac{1}{\sqrt{2}}\left( \begin{aligned}&a_{0}c_{0}|h_{0}\rangle |00\rangle + a_{0}c_{1}|h_{1}\rangle |10\rangle + a_{1}q_{0} |k_{0}\rangle |00\rangle +a_{1}q_{1}|k_{1}\rangle |10\rangle \\&\quad +b_{0}r_{0} |l_{0}\rangle |01\rangle + b_{0}r_{1} |l_{1}\rangle |11\rangle + b_{1}u_{0} |o_{0}\rangle |01\rangle + b_{1}u_{1}|o_{1}\rangle |11\rangle \end{aligned}\right) _{EAB}\\&=\frac{1}{2}\left[ \begin{aligned}&a_{0}c_{0}|h_{0}\rangle (|\varphi ^+\rangle +|\varphi ^-\rangle ) + a_{0}c_{1}|h_{1}\rangle (|\psi ^+\rangle -|\psi ^-\rangle )+ a_{1}q_{0}|k_{0}\rangle (|\varphi ^+\rangle +|\varphi ^-\rangle )\\&\quad +a_{1}q_{1}|k_{1}\rangle (|\psi ^+\rangle -|\psi ^-\rangle ) +b_{0}r_{0} |l_{0}\rangle (|\psi ^+\rangle +|\psi ^-\rangle ) + b_{0}r_{1}|l_{1}\rangle (|\varphi ^+\rangle -|\varphi ^-\rangle )\\&\quad +b_{1}u_{0} |o_{0}\rangle (|\psi ^+\rangle +|\psi ^-\rangle ) + b_{1}u_{1}|o_{1}\rangle (|\varphi ^+\rangle -|\varphi ^-\rangle ) \end{aligned}\right] _{EAB}\\&=\frac{1}{2}\left( \begin{aligned}&a_{0}c_{0}|h_{0}\rangle |\varphi ^+\rangle +a_{0}c_{0}|h_{0}\rangle |\varphi ^-\rangle + a_{1}q_{1}|k_{1}\rangle |\psi ^+\rangle -a_{1}q_{1}|k_{1}\rangle |\psi ^-\rangle \\&\quad +b_{0}r_{0} |l_{0}\rangle |\psi ^+\rangle +b_{0}r_{0} |l_{0}\rangle |\psi ^-\rangle + b_{1}u_{1}|o_{1}\rangle |\varphi ^+\rangle -b_{1}u_{1}|o_{1}\rangle |\varphi ^-\rangle \end{aligned}\right) _{EAB}.\\ \end{aligned} \end{aligned}$$
(14)

In this case, the state of the two qubits that TP received can be described by the reduced density operator \(\rho ^{AB}\) as follows:

$$\begin{aligned} \begin{aligned} \rho ^{AB}&=tr_{E}(|\varphi _{4}\rangle \langle \varphi _{4}|)\\&=\frac{1}{2}\left[ \begin{aligned}&tr_{E}(|a_{0}c_{0}|^2|h_{0}\rangle |\varphi ^+\rangle \langle \varphi ^+|\langle h_{0}|) +tr_{E}(|a_{0}c_{0}|^2|h_{0}\rangle |\varphi ^-\rangle \langle \varphi ^-| \langle h_{0}|)\\&\quad +tr_{E}(|a_{1}q_{1}|^2|k_{1}\rangle |\psi ^+\rangle \langle \psi ^+|\langle k_{1}|) -tr_{E}(|a_{1}q_{1}|^2|k_{1}\rangle |\psi ^-\rangle \langle \psi ^-|\langle k_{1}|)\\&\quad +tr_{E}(|b_{0}r_{0}|^2|l_{0}\rangle |\psi ^+\rangle \langle \psi ^+|\langle l_{0}|) +tr_{E}(|b_{0}r_{0}|^2|l_{0}\rangle |\psi ^-\rangle \langle \psi ^-| \langle l_{0}|)\\&\quad + tr_{E}(|b_{1}u_{1}|^2|o_{1}\rangle |\varphi ^+\rangle \langle \varphi ^+| \langle o_{1}|) -tr_{E}(|b_{1}u_{1}|^2|o_{1}\rangle |\varphi ^-\rangle \langle \varphi ^-| \langle o_{1}|) \end{aligned}\right] \\&=\frac{1}{2}\left[ \begin{aligned}&(|a_{0}c_{0}|^2|\varphi ^+\rangle \langle \varphi ^+|) +(|a_{0}c_{0}|^2|\varphi ^-\rangle \langle \varphi ^-| )\\&\quad +(|a_{1}q_{1}|^2|\psi ^+\rangle \langle \psi ^+|) -(|a_{1}q_{1}|^2|\psi ^-\rangle \langle \psi ^-|)\\&\quad +(|b_{0}r_{0}|^2|\psi ^+\rangle \langle \psi ^+|) +(|b_{0}r_{0}|^2|\psi ^-\rangle \langle \psi ^-|)\\&\quad + (|b_{1}u_{1}|^2|\varphi ^+\rangle \langle \varphi ^+|) -(|b_{1}u_{1}|^2|\varphi ^-\rangle \langle \varphi ^-|) \end{aligned}\right] \\&=\frac{1}{2}\left[ \begin{aligned}&(|a_{0}c_{0}|^2+|b_{1}u_{1}|^2)|\varphi ^+\rangle \langle \varphi ^+|\\&\quad +(|a_{0}c_{0}|^2-|b_{1}u_{1}|^2)|\varphi ^-\rangle \langle \varphi ^-| \\&\quad +(|a_{1}q_{1}|^2+|b_{0}r_{0}|^2)|\psi ^+\rangle \langle \psi ^+|\\&\quad +(|b_{0}r_{0}|^2-|a_{1}q_{1}|^2)|\psi ^-\rangle \langle \psi ^-|\\ \end{aligned}\right] \\ \end{aligned} \end{aligned}$$
(15)

TP should perform Bell state measurements on the received qubits to check errors. If Bob wants to avoid being detected, TP should obtain \( |\varphi ^+\rangle \) with probability 1, as the initial Bell state should not be changed after \(U_{E}\) and \(U_{F}\) are executed. Therefore, the following equations must be true:

$$\begin{aligned} \begin{aligned} P(|\varphi ^+\rangle )&=\frac{1}{2}(|a_{0}c_{0}|^2+|b_{1}u_{1}|^2) =1,\\ P(|\varphi ^-\rangle )&=\frac{1}{2}(|a_{0}c_{0}|^2-|b_{1}u_{1}|^2) =0,\\ P(|\psi ^+\rangle )&=\frac{1}{2}(|a_{1}q_{1}|^2 +|b_{0}r_{0}|^2)=0,\\ P(|\psi ^-\rangle )&=\frac{1}{2}(|b_{0}r_{0}|^2-|a_{1}q_{1}|^2)=0.\\ \end{aligned} \end{aligned}$$
(16)

Based on them, we can deduce

$$\begin{aligned} \begin{aligned} |a_{0}c_{0}|^2=|b_{1}u_{1}|^2=1, a_{1}q_{1}=0, b_{0}r_{0}=0. \end{aligned} \end{aligned}$$
(17)

Then, according to Eqs. (10), (13), and (17), we have

$$\begin{aligned} \begin{aligned} a_{1}=0, b_{0}=0, c_{1}=0, d_{0}=0, t_{1}=0, u_{0}=0. \end{aligned} \end{aligned}$$
(18)

Therefore, the operation \(U_{E}\) should be described as follows:

$$\begin{aligned} \begin{aligned}&U_{E}(|e\rangle _{E}|0\rangle )=a_{0}|f_{0}\rangle _{E}|0\rangle \\&U_{E}(|e\rangle _{E}|1\rangle )=b_{1}|g_{1}\rangle _{E}|1\rangle .\\ \end{aligned} \end{aligned}$$
(19)

Similarly, the operation \(U_{F}\) should be given as follows:

$$\begin{aligned} \begin{aligned}&U_{F}(|f_{0}\rangle _{E}|0\rangle )=c_{0}|h_{0}\rangle _{E}|0\rangle \\&U_{F}(|f_{0}\rangle _{E}|1\rangle )=d_{1}|i_{1}\rangle _{E}|1\rangle \\&U_{F}(|g_{1}\rangle _{E}|0\rangle )=t_{0}|n_{0}\rangle _{E}|0\rangle \\&U_{F}(|g_{1}\rangle _{E}|1\rangle )=u_{1}|o_{1}\rangle _{E}|1\rangle .\\ \end{aligned} \end{aligned}$$
(20)

In terms of Eqs. (19) and (20), we can conclude that if Bob induces no error, his ancillary qubits and Alice’s qubits should not be entangled. However, if Bob does not entangle his ancillary qubits with Alice’s qubits, he cannot obtain any useful information about Alice’s secret by measuring his ancillary qubits. Thus, the proposed protocol is secure to against the entangle-measure attack.

In addition, we discuss the double CNOT attack, which is a special type of entangle-measure attack actually. Recently, Chen et al. [30] showed that Jiang’s protocol suffers from the double CNOT attack where a dishonest participant implements the CNOT operations twice during the transmission of qubits to obtain some useful information about another participant’s secret. As the participants use the measure-resend model and the states of returned qubits are consistent with the measurement results in the improved protocol, the attacker also cannot obtain any useful information even if the double CNOT attack is used.

5.2 Outsider attack

Actually, an external party Eve may also launch various types of attack on the protocol. Since a malicious participant can obtain more useful information than an external eavesdropper Eve, such as the value of K, if he cannot obtain the honest participant’s secret by various types of attack, such as the intercept-resend attack, the measure-resend attack, and the entangle-measure attack, the Eve also cannot obtain their secrets by these types of attack. But in Jiang’s protocol [28], even if an outside Eve cannot learn the secrets of two participants, she can make them accept a wrong result without being detected. Here, we show the improved protocol also can be secure against such an outsider attack.

In steps 1 and 2, Eve performs similar operations as the previous dishonest participant did, namely that Eve intercepts and retains the qubits sent by TP and then replaces the qubits returned by two participants with the kept qubits. The participants should announce the positions of the trap qubits in step 3 and TP will measure these trap qubits and publish the measurement results in step 4. If Eve replaces the trap qubits with other qubits, the probability that making the measurement result of each trap qubit in an error would be \( \frac{1}{2} \) if either Alice or Bob chose DETECT. Thus, the probability that Eve is detected will be \(T_{1} = 1-(\frac{1}{3} \times \frac{1}{2}+\frac{2}{3})^{2L} = 1-(\frac{5}{6})^{2L}\), where 2L is the number of the trap qubits prepared by Alice and Bob. It is reduced to 1 when L is sufficiently large. Consequently, Eve cannot let participants accept a wrong result without being detected.

5.3 TP attack

In the proposed SQPC protocol, although the semi-honest TP must faithfully execute the procedure of the protocol, he may attempt to deduce the secret information of the two participants by performing the entangle-measure attack similar to other attacker. Besides, TP can easily get MA and MB by performing measurement as well as \(RA \oplus RA'\) and \(RB\oplus RB'\) which are published by the two participants. However, TP still cannot obtain the information about X and Y because he does not know the key K shared by Alice and Bob which is used to encrypt the secrets.

6 Conclusion

In this paper, we have proposed two types of attack based on Jiang’s SQPC protocol [28]. In the first type of attack, an outside eavesdropper can make two participants accept a wrong result. In the second type of attack, a dishonest participant can make the other participant accept a wrong result and obtain the secret of the other participant. Neither type of attack can be detected by honest participants. Furthermore, we have proposed an improved SQPC protocol which can avoid these two types of attack by increasing the quantum measurement capability of the participants. Actually, another solution to resist the proposed two kinds of attack is to allow “classical” participants to have quantum memory to reorder qubits, but quantum memory is more difficult to realize in current technologies.