A Quantum Dual-Signature Protocol Based on SNOP States without Trusted Participant

Abstract

Quantum dual-signature means that two signed quantum messages are combined and expected to be sent to two different recipients. A quantum signature requires the cooperation of two verifiers to complete the whole verification process. As an important quantum signature aspect, the trusted third party is introduced to the current protocols, which affects the practicability of the quantum signature protocols. In this paper, we propose a quantum dual-signature protocol without arbitrator and entanglement for the first time. In the proposed protocol, two independent verifiers are introduced, here they may be dishonest but not collaborate. Furthermore, strongly nonlocal orthogonal product states are used to preserve the protocol security, i.e., no one can deny or forge a valid signature, even though some of them conspired. Compared with existing quantum signature protocols, this protocol does not require a trusted third party and entanglement resources.

1. Introduction

With the development of the Internet, network communications have become more and more frequent in daily life. Therefore, it is particularly important to improve the security of network communications. Digital signatures are not only widely employed to authenticate the identity of communication participants, but also ensure the integrity of legal messages. For example, encrypting and signing the transmitted messages, verifying the identity of all parties, are necessary to ensure the security of network communications. As we know, the applied classic digital signature protocols are based on computational complexity, such as the decomposition of a large prime number. However, with the development of quantum algorithms [1], classic cryptographic protocols are becoming increasingly insecure. Fortunately, various quantum cryptography protocols, such as quantum key distribution (QKD) [2,3,4], controlled quantum teleportation [5,6,7,8,9,10], quantum secret sharing [11,12,13,14,15] and quantum secure direct communication [16,17,18,19], can be implemented on quantum networks [20,21,22,23,24]. Since their security is based on the laws of quantum mechanics, they are immune to the attacks on quantum computers. During them, designing digital signature protocols based on quantum technology is an important research aspect of quantum cryptographic protocols.

In 2001, Gottesman et al. [25] first proposed a quantum digital signature based on the fundamental principles of quantum physics, i.e., a quantum analogue of one-way functions which required $O(m)$ qubits is used to encrypt an $m$-bit message. In 2002, Zeng et al. [26] put forward a signature protocol based on the GHZ states, whose realization depends upon a trust arbitrator. Since then, many variations of quantum signature protocols have been presented. For example, Li et al. [27] proposed an arbitrated quantum signature protocol using Bell states instead of GHZ states. Zou et al. [28] presented an arbitrated quantum signature protocol without using entangled states. In 2016, Liu et al. [29] proposed a quantum dual-signature protocol, which combines two signed messages expected to be sent to two different recipients. In their protocol, the entanglement swapping with coherent states is applied. Compared to classic signatures, the quantum signature which involves quantum algorithms, could be more secure and efficient. As we know, quantum signatures also have wide applications in the ecommerce system as classic signatures.

All these protocols are based on the assumption that a trusted third party exists in the quantum network, though this is not practical. In 2015, Kang et al. [30] first proposed a controlled mutual quantum entity authentication using entanglement swapping by introducing an untrusted third party. However, the controller may perform an internal attack, because the others do not test the correlation of the entangled state. In order to prevent this security loophole, a checking procedure was added to confirm the correlation of the entangled state (see Ref. [31]). Nevertheless, Wang et al. [32] pointed out that there is still a secure flaw in Kang’s improved protocol [31], that is, the untrusted third party can obtain the shared key between the other participants without being detected. In 2016, Li et al. [33] proposed a secure quantum blind dual-signature scheme without arbitrators. It does not rely on an arbitrator in the verification phase as the previous quantum signature schemes do. The security is guaranteed by the entanglement in quantum information processing. Compared with the existing quantum signature protocols, it reduces the over rights of the third party in verification. However, the research on quantum digital signatures without arbitrators is still in its infancy.

The existing quantum digital signatures without arbitrators are usually implemented by entangled states. As we know, the preparation of entanglement in experiments is difficult. Therefore, it is very urgent to propose a more practical quantum signature protocol without arbitrators. Recently, the expression of quantum nonlocality has attracted more attention. In 2019, Halder et al. [34] first proposed a strong quantum nonlocality without entanglement and presented two explicit strongly nonlocal sets of quantum states in $C^3\otimes C^3\otimes C^3$ and $C^4\otimes C^4\otimes C^4$ quantum systems. For the sake of simplicity, we define these states as SNOP states. Compared with normal nonlocal orthogonal product states, SNOP states have strong quantum nonlocality for tripartite, i.e., they are locally irreducible in every bipartition. In this situation, if the private messages are encoded into SNOP states, the security of the private messages is ensured. This means that the attacker cannot determine the accurate whole state even if they obtain two particles of the SNOP states. A secure quantum signature protocol has to meet at least two requirements, i.e., non-forgery and non-repudiation. In this case, we propose a quantum dual-signature protocol based on SNOP states without a trusted third party. The security of our protocol is guaranteed by the secret encryption algorithm [35] and SNOP states. The encryption algorithm is mainly used to resist external attackers. Furthermore, each bipartite of the SNOP states is locally irreducible to resist internal attacks. In this case, the security of our protocol is shown, i.e., neither an external attacker nor an internal one can forge a signature. Moreover, no one can deny the signature.

The rest of the paper is arranged as follows: In Section 2, some preliminary theories are introduced. In Section 3, we describe the quantum dual-signature protocol including the initializing phase, signing phase and verification phase. The security of our protocol is analyzed in Section 4. Finally, a short conclusion is given in Section 5.

2. Preliminaries

In this section, we describe an encryption algorithm—Key-Controlled-‘I’QOTP. Then, a set of SNOP states to encode messages are introduced.

2.1. Key-Controlled-‘I’QOTP

As we know, the quantum one time pad (QOTP) is an important way to generate quantum signatures [36]. However, Gao et al. [37] pointed out that there exist some security problems in these protocols. In the above security analysis of AQS protocols, one of the most basic assumptions is that the signature is generated by encrypting bitwise messages. In this case, the receiver may forge a legal signature by performing a corresponding operator to the signature and message without secret keys. In 2013, Zhang et al. [35] presented two types of improved encryption algorithms, called Key-Controlled-‘I’QOTP and Key-Controlled-‘T’QOTP, to prevent forgery attacks effectively. Here, we briefly introduce Key-Controlled-‘I’QOTP.

Firstly, a set $W$ with four Clifford operators is introduced to encrypt the message $|P\rangle$ to obtain $|S\rangle$. Secondly, the two bits $K_i$ and $K_{2n-i+1}$ in the shared key string $K$ are appointed to determine the corresponding operator in Table 1. Moreover, the message $|P\rangle$ is encrypted into $|S\rangle$ in the form of Equation (1).

$$|S\rangle ={\otimes }_{i=1}^n{\sigma }_x^{k_{2i}}{\sigma }_z^{k_{2i-1}}{W}_{K_i{K}_{2n-i+1}}|P\rangle$$ (1)

Table 1.

Corresponding encryption operators in “Key-Controlled-‘I’QOTP”.

${\mathit{K}}_{\mathit{i}}{\mathit{K}}_{\mathbf{2}\mathit{n}\mathbf{-}\mathit{i}\mathbf{+}\mathbf{1}}$	Encryption Operator
00	$W_{00}=\frac{1}{\sqrt{2}}({\sigma }_x+{\sigma }_z)$
01	$W_{01}=\frac{1}{\sqrt{2}}({\sigma }_y+{\sigma }_z)$
10	$W_{10}=\frac{1}{2}(I+i{\sigma }_x-i{\sigma }_y+i{\sigma }_z)$
11	$W_{11}=\frac{1}{2}(I+i{\sigma }_x+i{\sigma }_y+i{\sigma }_z)$

Here, we take $n=1$, $i=1$, $|P\rangle =\alpha |0\rangle +\beta |1\rangle$ and $K_1{K}_2=00$ as an example to demonstrate how to encrypt quantum states using secret keys. This is the way to generate quantum signatures in subsequent protocols.

$$\begin{array}{l}|S\rangle ={\otimes }_{i=1}^1{\sigma }_x^{k_2}{\sigma }_z^{k_1}{W}_{K_1{K}_2}\left(\alpha |0\rangle +\beta |1\rangle \right)\\ ={\sigma }_x^0{\sigma }_z^0{W}_{00}\left(\alpha |0\rangle +\beta |1\rangle \right)\\ =\frac{1}{\sqrt{2}}\left(|0\rangle \langle 1|+|1\rangle \langle 0|+|0\rangle \langle 0|-|1\rangle \langle 1|\right)\left(\alpha |0\rangle +\beta |1\rangle \right)\\ =\frac{1}{\sqrt{2}}\left(\alpha |1\rangle +\alpha |0\rangle +\beta |0\rangle -\beta |1\rangle \right)\\ =\frac{1}{\sqrt{2}}\left(\left(\alpha +\beta \right)|0\rangle +\left(\alpha -\beta \right)|1\rangle \right)\end{array}$$ (2)

Zhang et al. proved that this encryption algorithm can be applied to generate signatures which cannot be forged by the receiver. Therefore, in order to ensure security, Key-Controlled-‘I’QOTP is used in the following quantum dual-signature protocol.

2.2. SNOP States

In order to show our protocol, a type of SNOP states is introduced.

$$\begin{gathered} |1\rangle |2\rangle |1\pm 2\rangle ,|2\rangle |1\pm 2\rangle |1\rangle ,|1\pm 2\rangle |1\rangle |2\rangle \\ |1\rangle |3\rangle |1\pm 3\rangle ,|3\rangle |1\pm 3\rangle |1\rangle ,|1\pm 3\rangle |1\rangle |3\rangle \\ |2\rangle |3\rangle |1\pm 2\rangle ,|3\rangle |1\pm 2\rangle |2\rangle ,|1\pm 2\rangle |2\rangle |3\rangle \\ |3\rangle |2\rangle |1\pm 3\rangle ,|2\rangle |1\pm 3\rangle |3\rangle ,|1\pm 3\rangle |3\rangle |2\rangle \\ |1\rangle |1\rangle |1\rangle ,|2\rangle |2\rangle |2\rangle ,|3\rangle |3\rangle |3\rangle \end{gathered}$$ (3)

In Ref. [34], these states are proved to be locally irreducible in all bipartitions. Since local irreducibility is a sufficient condition for strong nonlocality, these states are strongly nonlocal. In this situation, as the messages are encoded into SNOP states, the security of the private messages is ensured. This means that the attacker cannot determine the accurate forms even if they obtain two particles of the SNOP states.

3. Quantum Dual-Signature Protocol with SNOP States

In this section, a quantum dual-signature protocol is given. Firstly, the identity of the participants and the process of the protocol are described in Section 3.1. Then, the specific protocol process is divided into the following three phases: the initializing phase, signing phase and verification phase.

3.1. Brief Description

There exist three roles in our protocol:

1. Alice is the applicant and signer;

2. Bob is the first verifier of the message;

3. Charlie is the second verifier.

When the applicant Alice needs to warrant a document, she first signs the application document; then, she sends the document to the first verifier Bob to verify one part of the document; next, Bob sends it to Charlie to verify the other part. The process of this protocol can be briefly seen in Figure 1.

Figure 1.

Process of the dual-signature protocol.

3.2. Initializing Phase

Step I1 ($Secret Key Assignment$): Alice shares the two keys’ sequences $K_{AB}$ and $K_{AC}$ with Bob and Charlie, respectively. Bob shares the key sequence $K_{BC}$ with Charlie. This can be achieved with the quantum key distribution (QKD) technique [2,3,4].

Step I2 ($Message Encoding$): The message $M$ is divided into $n$ groups, $M=M_1\left|\right|M_2\left|\right|\cdots \left|\right|M_n$; here $M_t$ is a 4-$bit$ of a classical bit sequence, where $t=1,2,3,\cdots ,n$. Alice encodes each $M_t$ to a quantum sequence $|S\rangle$ with the 16 states in Table 2; the remaining 11 states are used to detect eavesdropping in Table 3.

Table 2.

SNOP states used to encrypt messages.

Message	States	Message	States
$M_t=0000$	$|{\phi }_1\rangle =|1\rangle |2\rangle |1+2\rangle$	$M_t=1111$	$|{\phi }_9\rangle =|1\rangle |2\rangle |1-2\rangle$
$M_t=0001$	$|{\phi }_2\rangle =|1\rangle |3\rangle |1+3\rangle$	$M_t=1110$	$|{\phi }_{10}\rangle =|1\rangle |3\rangle |1-3\rangle$
$M_t=0010$	$|{\phi }_3\rangle =|2\rangle |3\rangle |1+2\rangle$	$M_t=1101$	$|{\phi }_{11}\rangle =|2\rangle |3\rangle |1-2\rangle$
$M_t=0100$	$|{\phi }_4\rangle =|3\rangle |2\rangle |1+3\rangle$	$M_t=1011$	$|{\phi }_{12}\rangle =|3\rangle |2\rangle |1-3\rangle$
$M_t=1000$	$|{\phi }_5\rangle =|1+2\rangle |1\rangle |2\rangle$	$M_t=0111$	$|{\phi }_{13}\rangle =|1-2\rangle |1\rangle |2\rangle$
$M_t=1001$	$|{\phi }_6\rangle =|1+3\rangle |1\rangle |3\rangle$	$M_t=0110$	$|{\phi }_{14}\rangle =|1-3\rangle |1\rangle |3\rangle$
$M_t=1010$	$|{\phi }_7\rangle =|1+2\rangle |2\rangle |3\rangle$	$M_t=0101$	$|{\phi }_{15}\rangle =|1-2\rangle |2\rangle |3\rangle$
$M_t=1100$	$|{\phi }_8\rangle =|1+3\rangle |3\rangle |2\rangle$	$M_t=0011$	$|{\phi }_{16}\rangle =|1-3\rangle |3\rangle |2\rangle$

Table 3.

SNOP states used to detect eavesdropping.

Decoy State
$|{\phi }_{17}\rangle =|2\rangle |1+2\rangle |2\rangle$	$|{\phi }_{18}\rangle =|2\rangle |1-2\rangle |2\rangle$
$|{\phi }_{19}\rangle =|3\rangle |1+3\rangle |1\rangle$	$|{\phi }_{20}\rangle =|3\rangle |1-3\rangle |1\rangle$
$|{\phi }_{21}\rangle =|3\rangle |1+2\rangle |2\rangle$	$|{\phi }_{22}\rangle =|3\rangle |1-2\rangle |2\rangle$
$|{\phi }_{23}\rangle =|2\rangle |1+3\rangle |3\rangle$	$|{\phi }_{24}\rangle =|2\rangle |1-3\rangle |3\rangle$
$|{\phi }_{25}\rangle =|1\rangle |1\rangle |1\rangle$	$|{\phi }_{26}\rangle =|2\rangle |2\rangle |2\rangle$
$|{\phi }_{27}\rangle =|3\rangle |3\rangle |3\rangle$

Step I3 ($Generating Quantum Sequence$): Alice generates three identical sequences $|S\rangle$, where the first sequence is denoted by $|S^a\rangle$, the second one is $|S^b\rangle$ and the last one is $|S^c\rangle$. By picking out each particle of above sequences, the corresponding quantum sequences $|S_1^a\rangle$, $|S_2^a\rangle$, $|S_3^a\rangle$, $|S_1^b\rangle$, $|S_2^b\rangle$, $|S_3^b\rangle$, $|S_1^c\rangle$, $|S_2^c\rangle$ and $|S_3^c\rangle$ are generated.

For example, we suppose that $|S\rangle =|{\phi }_1\rangle |{\phi }_2\rangle |{\phi }_3\rangle |{\phi }_4\rangle |{\phi }_{13}\rangle |{\phi }_{14}\rangle |{\phi }_{15}\rangle |{\phi }_{16}\rangle$. Then, the specific forms of $|S^a\rangle$, $|S^b\rangle$ and $|S^c\rangle$ are depicted in Equation (4).

$$\begin{array}{l}|S^a\rangle =|1\rangle |1\rangle |2\rangle |3\rangle |1-2\rangle |1-3\rangle |1-2\rangle |1-3\rangle \\ |S^b\rangle =|2\rangle |3\rangle |3\rangle |2\rangle |1\rangle |1\rangle |2\rangle |3\rangle \\ |S^c\rangle =|1+2\rangle |1+3\rangle |1+2\rangle |1+3\rangle |2\rangle |3\rangle |3\rangle |2\rangle \end{array}$$ (4)

3.3. Signing Phase

Step S ($Sending Sequence to Bob$): Firstly, Alice encrypts $|S_3^a\rangle$ and $|S_3^b\rangle$ with $K_{AB}$ to obtain $|\overline{S_3^a}\rangle$ and $|\overline{S_3^b}\rangle$; then, she encrypts $|S_1^c\rangle$, $|S_3^c\rangle$, $|\overline{S_3^a}\rangle$ and $|\overline{S_3^b}\rangle$ with $K_{AC}$ to obtain $S_{AC}$.

$$S_{AC}=E_{K_{AC}}\left\{\right|S_1^c\rangle ,|S_3^c\rangle ,|\overline{S_3^a}\rangle ,|\overline{S_3^b}\rangle \}$$ (5)

Secondly, Alice encrypts $|S_2^a\rangle$ and $|S_2^c\rangle$ with $K_{AC}$ to obtain $|\widetilde{S_2^a}\rangle$ and $|\widetilde{S_2^c}\rangle$; then, she encrypts $|S_1^a\rangle$, $|S_1^b\rangle$, $|\widetilde{S_2^a}\rangle$, $|S_2^b\rangle$, $|\widetilde{S_2^c}\rangle$ and $S_{AC}$ with $K_{AB}$ to obtain $S_{AB}$ as her signature. Finally, she inserts the decoy states randomly in $S_{AB}$ to obtain ${S^{\prime }}_{AB}$ and sends it to Bob. The symbolic representation can be seen in Table 4.

$$S_{AB}=E_{K_{AB}}\left\{\right|S_1^a\rangle ,|S_1^b\rangle ,|\widetilde{S_2^a}\rangle ,|S_2^b\rangle ,|\widetilde{S_2^c}\rangle ,S_{AC}\}$$ (6)

Table 4.

Symbolic representation.

Sequence	Signature
$|\widetilde{S_2^a}\rangle$	$E_{K_{AC}}\left\{\right|S_2^a\rangle \}$
$|\widetilde{S_2^c}\rangle$	$E_{K_{AC}}\left\{\right|S_2^c\rangle \}$
$|\overline{S_3^a}\rangle$	$E_{K_{AB}}\left\{\right|S_3^a\rangle \}$
$|\overline{S_3^b}\rangle$	$E_{K_{AB}}\left\{\right|S_3^b\rangle \}$

3.4. Verification Phase

Step V1 ($Detect Eavesdropping$): After Bob announces that he has received the sequences ${S^{\prime }}_{AB}$, Alice tells Bob the positions and the initial states of the decoy particles. Then, Bob measures each of the decoy particles with the corresponding basis and compares the measurement outcome with its initial state to check for eavesdropping. If the error probability is within a certain threshold, Bob recovers the sequences $S_{AB}$; otherwise, he aborts the protocol.

Step V2 ($Bo{b}^{\prime }s Verification of the First Stage$): Bob decrypts $S_{AB}$ and verifies whether $|S_1^a\rangle$ is equal to $|S_1^b\rangle$ with SWAP operations [38,39,40]. Here, $V_{B_1}$ represents the results.

$$D_{K_{AB}}\left\{S_{AB}\right\}=\left\{\right|S_1^a\rangle ,|S_1^b\rangle ,|\widetilde{S_2^a}\rangle ,|S_2^b\rangle ,|\widetilde{S_2^c}\rangle ,S_{AC}\}$$ (7)

$$\begin{array}{l}{V}_{B_1}=\left\{\begin{array}{ll}1,\hfill & |S_1^a\rangle =|S_1^b\rangle \hfill \\ 0,\hfill & |S_1^a\rangle \ne |S_1^b\rangle \hfill \end{array}\right.\hfill \end{array}$$ (8)

If $V_{B_1}=0$, he rejects the quantum signature directly; otherwise, he sends $S_B$ to Charlie.

$$S_B=E_{K_{BC}}\left\{\right|\widetilde{S_2^a}\rangle ,|\widetilde{S_2^c}\rangle ,S_{AC}\}$$ (9)

Step V3 ($Charli{e}^{\prime }s Verification of the First Stage$): Charlie decrypts $S_B$, verifies whether $|S_2^a\rangle$ is equal to $|S_2^c\rangle$ and generates $V_C$.

$$D_{K_{BC}}\left\{S_B\right\}=\left\{\right|\widetilde{S_2^a}\rangle ,|\widetilde{S_2^c}\rangle ,S_{AC}\}$$ (10)

$$D_{K_{AC}}\left\{\right|\widetilde{S_2^a}\rangle ,|\widetilde{S_2^c}\rangle \}=\left\{\right|S_2^a\rangle ,|S_2^c\rangle \}$$ (11)

$$\begin{array}{l}{V}_C=\left\{\begin{array}{ll}1,\hfill & |S_2^a\rangle =|S_2^c\rangle \hfill \\ 0,\hfill & |S_2^a\rangle \ne |S_2^c\rangle \hfill \end{array}\right.\hfill \end{array}$$ (12)

If $V_C$ is equal to 0, Charlie will reject the quantum signature directly; otherwise, he will decrypt $S_{AC}$ and send $S_C$ to Bob.

$$D_{K_{AC}}\left\{S_{AC}\right\}=\left\{\right|S_1^c\rangle ,|S_3^c\rangle ,|\overline{S_3^a}\rangle ,|\overline{S_3^b}\rangle \}$$ (13)

$$S_C=E_{K_{BC}}\left\{\right|\overline{S_3^a}\rangle ,|\overline{S_3^b}\rangle \}$$ (14)

Step V4 ($Bo{b}^{\prime }sVerification of the Second Stage$): Bob first decrypts $S_C$ with $K_{BC}$ and $K_{AB}$; then, he verifies whether $|S_3^a\rangle$ is equal to $|S_3^b\rangle$ and generates $V_{B_2}$.

$$D_{K_{BC}}\left\{S_C\right\}=|\overline{S_3^a}\rangle ,|\overline{S_3^b}\rangle$$ (15)

$$D_{K_{AB}}\left\{\right|\overline{S_3^a}\rangle ,|\overline{S_3^b}\rangle \}=|S_3^a\rangle ,|S_3^b\rangle$$ (16)

$$\begin{array}{l}{V}_{B_2}=\left\{\begin{array}{ll}1,\hfill & |S_3^a\rangle =|S_3^b\rangle \hfill \\ 0,\hfill & |S_3^a\rangle \ne |S_3^b\rangle \hfill \end{array}\right.\hfill \end{array}$$ (17)

If $V_{B_2}$ is equal to 0, Bob will reject the quantum signature directly; otherwise, he will recover the sequence $|S\rangle$ by $|S_1^b\rangle$, $|S_2^b\rangle$ and $|S_3^b\rangle$ to obtain $m_j^b$ according to the rule in Table 5.

Table 5.

Verifier’s measurement rules.

Message	Bases
$M_t=0000\mapsto |{\phi }_1\rangle =|1\rangle |2\rangle |1+2\rangle$ $M_t=1111\mapsto |{\phi }_9\rangle =|1\rangle |2\rangle |1-2\rangle$	$\left\{\right|1\rangle ,|2\rangle ,|3\rangle {\}}_1$ $\left\{\right|1\rangle ,|2\rangle ,|3\rangle {\}}_2$ $\left\{\right|1+2\rangle ,|1-2\rangle ,|3\rangle {\}}_3$
$M_t=0001\mapsto |{\phi }_2\rangle =|1\rangle |3\rangle |1+3\rangle$ $M_t=1110\mapsto |{\phi }_{10}\rangle =|1\rangle |3\rangle |1-3\rangle$	$\left\{\right|1\rangle ,|2\rangle ,|3\rangle {\}}_1$ $\left\{\right|1\rangle ,|2\rangle ,|3\rangle {\}}_2$ $\left\{\right|1+3\rangle ,|1-3\rangle ,|2\rangle {\}}_3$
$M_t=0010\mapsto |{\phi }_3\rangle =|2\rangle |3\rangle |1+2\rangle$ $M_t=1101\mapsto |{\phi }_{11}\rangle =|2\rangle |3\rangle |1-2\rangle$	$\left\{\right|1\rangle ,|2\rangle ,|3\rangle {\}}_1$ $\left\{\right|1\rangle ,|2\rangle ,|3\rangle {\}}_2$ $\left\{\right|1+2\rangle ,|1-2\rangle ,|3\rangle {\}}_3$
$M_t=0100\mapsto |{\phi }_4\rangle =|3\rangle |2\rangle |1+3\rangle$ $M_t=1011\mapsto |{\phi }_{12}\rangle =|3\rangle |2\rangle |1-3\rangle$	$\left\{\right|1\rangle ,|2\rangle ,|3\rangle {\}}_1$ $\left\{\right|1\rangle ,|2\rangle ,|3\rangle {\}}_2$ $\left\{\right|1+3\rangle ,|1-3\rangle ,|2\rangle {\}}_3$
$M_t=1000\mapsto |{\phi }_5\rangle =|1+2\rangle |1\rangle |2\rangle$ $M_t=0111\mapsto |{\phi }_{13}\rangle =|1-2\rangle |1\rangle |2\rangle$	$\left\{\right|1+2\rangle ,|1-2\rangle ,|3\rangle {\}}_1$ $\left\{\right|1\rangle ,|2\rangle ,|3\rangle {\}}_2$ $\left\{\right|1\rangle ,|2\rangle ,|3\rangle {\}}_3$
$M_t=1001\mapsto |{\phi }_6\rangle =|1+3\rangle |1\rangle |3\rangle$ $M_t=0110\mapsto |{\phi }_{14}\rangle =|1-3\rangle |1\rangle |3\rangle$	$\left\{\right|1+3\rangle ,|1-3\rangle ,|2\rangle {\}}_1$ $\left\{\right|1\rangle ,|2\rangle ,|3\rangle {\}}_2$ $\left\{\right|1\rangle ,|2\rangle ,|3\rangle {\}}_3$
$M_t=1010\mapsto |{\phi }_7\rangle =|1+2\rangle |2\rangle |3\rangle$ $M_t=0101\mapsto |{\phi }_{15}\rangle =|1-2\rangle |2\rangle |3\rangle$	$\left\{\right|1+2\rangle ,|1-2\rangle ,|3\rangle {\}}_1$ $\left\{\right|1\rangle ,|2\rangle ,|3\rangle {\}}_2$ $\left\{\right|1\rangle ,|2\rangle ,|3\rangle {\}}_3$
$M_t=1100\mapsto |{\phi }_8\rangle =|1+3\rangle |3\rangle |2\rangle$ $M_t=0011\mapsto |{\phi }_{16}\rangle =|1-3\rangle |3\rangle |2\rangle$	$\left\{\right|1+3\rangle ,|1-3\rangle ,|2\rangle {\}}_1$ $\left\{\right|1\rangle ,|2\rangle ,|3\rangle {\}}_2$ $\left\{\right|1\rangle ,|2\rangle ,|3\rangle {\}}_3$

Step V5 ($Charli{e}^{\prime }s Verification of the Second Stage$): Similarly, Charlie recovers the sequence $|S\rangle$ according to $|S_1^c\rangle$, $|S_2^c\rangle$ and $|S_3^c\rangle$, by the rules in Table 5, to obtain $m_j^c$. If $m_j^b=m_j^c$, Charlie will announce it is the valid signature of $m_j$; otherwise, he will reject this signature. The process can be briefly seen in Figure 2.

Figure 2.

Brief summary of protocol process.

4. Security and Efficiency Analysis

As mentioned above, a secure quantum signature protocol has to meet at least two requirements, i.e., non-forgery and non-repudiation. In our protocol, the above requirements are completely satisfied. The security of our protocol is guaranteed by the secret encryption algorithm Key-Controlled-‘I’QOTP and SNOP states. The encryption algorithm is mainly used to resist external attackers. Furthermore, each bipartite of the SNOP states is locally irreducible to resist internal attacks. In this case, the security of our protocol is shown, i.e., neither an external attacker nor an internal one can forge a signature. Moreover, no one can deny the signature. The specific analysis can be seen in the following subsections.

4.1. Non-Forgery

4.1.1. Resistance to Outside Attacks Based on Encryption Algorithm

$(i) Eve Forges Alic{e}^{\prime }s Signature.$

In order to forge Alice’s signature, Eve has to intercept the sequences in Step S. Then, he could change Alice’s signature and replace ${S^{\prime }}_{AB}$ with $S^{″}{}_{AB}$. However, since the original keys are shared with QKD, it is impossible for her to succeed. If he attempts to forge Alice’s signature without $K_{AB}$, he will perform an operator corresponding to the signature and message. In our protocol, as Key-Controlled-‘I’QOTP is used to generate signature $S_{AB}$, he would not be able to identify the forms of encryption operators except for Alice and Bob, as shown in Table 6.

Table 6.

The attacker’s possible encryption, decryption and possible forgery attacks are under Key-Controlled-‘I’QOTP.

Encryption	Eve’s Possible Decryptions	Eve’s Forgery of Operation	Signature
$I$	$W_i^{+}Q{W}_i$		00 01 10 11
${\sigma }_z$	$W_i^{+}{\sigma }_{z}Q{\sigma }_z{W}_i$	${\sigma }_z$	${\sigma }_z$ ${\sigma }_x$ ${\sigma }_y$ ${\sigma }_z$
${\sigma }_x$	$W_i^{+}{\sigma }_{x}Q{\sigma }_x{W}_i$	${\sigma }_x$	${\sigma }_y$ ${\sigma }_z$ ${\sigma }_z$ ${\sigma }_x$
${\sigma }_y$	$W_i^{+}{\sigma }_{y}Q{\sigma }_y{W}_i$	${\sigma }_y$	${\sigma }_x$ ${\sigma }_y$ ${\sigma }_x$ ${\sigma }_y$

From Table 6, it can be seen that, if Eve wants to forge one qubit of Alice’s signature with ${\sigma }_x$ or ${\sigma }_y$, the probability of success will be $\frac{1}{3}$. Moreover, the probability will be $\frac{1}{2}$ if the forgery operation is ${\sigma }_z$. Furthermore, if the length of the message is $m$, the probability $P_E$ of Eve’s forgery’s success will be

$$P_E={(\frac{1}{3})}^k{(\frac{1}{2})}^{m-k}$$ (18)

where $k(0\le k\le m,0\le m\le n)$ represents the total number of qubits which Eve wants to forge the sequence by ${\sigma }_x$ and ${\sigma }_y$; $(m-k)$ represents the number of qubits forged by ${\sigma }_z$. With this encryption algorithm, Eve can be detected during Bob’s verification phase.

$(ii) Eve Forges Bo{b}^{\prime }s Verification Results.$

For Eve to intercept the sequences in Step V2, he has to change the sequence $S_B$ with ${S^{\prime }}_B$ and send it to Charlie. Similarly, Eve cannot know the secret key $K_{BC}$. Therefore, Eve’s forgery will be discovered by Charlie once Eve changes only a small part of $S_B$. Similarly, if Eve forges Charlie’s verification results, similarly, his forgery will be found by Bob.

4.1.2. Resistance to Inside Attacks Based on SNOP States

Above, we guarantee that two verifiers are not dishonest at the same time. This assumption is satisfied with the actual situation. In fact, if both verifiers are dishonest, the protocol will be insecure and impractical. Here, we discuss the dishonesty of the verifier, specifically in the case in which one verifier wants to forge a signature to evade the verification of the other one.

According to our analysis above, the encryption algorithm can resist some forgery attacks, but, for internal attackers who know the secret key, the security needs to be further discussed as follows. Here, SNOP states provides a nature property for resisting internal attacks, i.e., they are locally irreducible in every bipartition. This means that the attacker cannot determine the accurate whole state even if they obtain two particles of the SNOP states. The specific analysis can be seen in the following subsections.

$(i) Bo{b}^{\prime }s Forgery.$

This is different from Eve’s forgery of Alice’s signature; Bob does not need to intercept the sequences because he has the secret key $K_{AB}$. If he attempts to replace $S_{AC}$ with ${S^{\prime }}_{AC}$ in Step V2, his forgery will not succeed. Since the sequences $S_{AC}$ are generated by Key-Controlled-‘I’QOTP with the key $K_{AC}$, Bob cannot identify the forms of encryption operators, except for Alice and Charlie. Similar to the analysis above, Bob’s forgery will be discovered by Charlie in Step V3.

Based on the analysis above, we assume that Bob attempts to restore all the SNOP states by the sequences $|S_1^b\rangle$ and $|S_2^b\rangle$. He can only choose the measurement basis randomly. There are three possible cases seen in Table 7. The probability that he chooses any basis is $\frac{1}{3}$. From Table 7, we can deduce that the probability of choosing the correct measurement basis and obtain one bit, as shown in Equation (19).

Table 7.

Measurement basis and possible measurement results of attackers.

State	$\mathbf{|}\mathbf{1}\mathbf{\rangle }$	$\mathbf{|}\mathbf{2}\mathbf{\rangle }$	$\mathbf{|}\mathbf{3}\mathbf{\rangle }$	$\mathbf{|}\mathbf{1}\mathbf{+}\mathbf{2}\mathbf{\rangle }$	$\mathbf{|}\mathbf{1}\mathbf{-}\mathbf{2}\mathbf{\rangle }$	$\mathbf{|}\mathbf{1}\mathbf{+}\mathbf{3}\mathbf{\rangle }$	$\mathbf{|}\mathbf{1}\mathbf{-}\mathbf{3}\mathbf{\rangle }$
$A_1=\left\{\right|1\rangle ,|2\rangle ,|3\rangle \}$	1	1	1	0	0	0	0
$A_2=\left\{\right|1+2\rangle ,|1-2\rangle ,|3\rangle \}$	0	0	1	1	1	0	0
$A_3=\left\{\right|1+3\rangle ,|1-3\rangle ,|2\rangle \}$	0	1	0	0	0	1	1

$$\begin{array}{c}P=\frac{\frac{1}{3}\times 1+\frac{1}{3}\times 2+\frac{1}{3}\times 2+\frac{1}{3}\times 1+\frac{1}{3}\times 1+\frac{1}{3}\times 1+\frac{1}{3}\times 1}{16}=\frac{3}{16}\end{array}$$ (19)

For the $n$ length of the quantum sequence, it is not difficult to see that the probability of Bob’s successful attack $P^{\prime }$ tends to be zero with the increase in $n$ in Equation (20).

$$\begin{array}{c}\begin{array}{c}{P}^{\prime }=P^n={(\frac{3}{16})}^n\end{array}\end{array}$$ (20)

$(ii) Charli{e}^{\prime }s Forgery.$

We assume Charlie tries to modify $|\overline{S_3^a}\rangle$ and $|\overline{S_3^b}\rangle$ according to the sequence $|S_3^c\rangle$ in his hands to make $|S_3^a\rangle$ and $|S_3^b\rangle$ equal. Similarly, Charlie cannot identify the forms of the encryption operators without the key $K_{AB}$. If $|S_3^a\rangle \ne |S_3^b\rangle$, Charlie’s forgery will be discovered by Bob in Step V4. The process can be briefly seen in Figure 3.

Figure 3.

The process of verification phase.

4.2. Non-Repudiation

Alice could attempt to deny her signature in two ways. One is directly denying her signature. Here Alice’s signatures $S_{AB}$ and $S_{AC}$ are generated by $K_{AB}$ and $K_{AC}$, only known to Bob and Charlie. Once Bob and Charlie have verified the validity of the signatures, she will not be able to deny them. Moreover, since Key-Controlled-‘I’QOTP is used, no one can find the corresponding location without knowing $K_{AB}$ and $K_{AC}$. If $|S_1^a\rangle =|S_1^b\rangle$ and $|S_2^a\rangle =|S_2^c\rangle$, it will be impossible for Alice to deny.

The other way is that Alice denied the signature after Bob verified it. If $m_j^b=m_j^c$, Bob and Charlie will be able to judge whether Alice denies. The sequences $|\overline{S_3^a}\rangle$ and $|\overline{S_3^b}\rangle$ are encrypted with the key $K_{AB}$ and the key $K_{AB}$ is generated by Key-Controlled-‘I’QOTP. Therefore, Charlie cannot know the secret key $K_{AB}$. If Charlie attempts to modify the sequence, Bob will find this attack in Step V4. Similarly, Alice will not succeed in denying the signature after Charlie’s verification.

5. Discussion and Conclusions

We summarize and compare our protocol with the quantum signature protocols proposed above in Table 8. Compared with the existing quantum signature protocols, our protocol does not need a trusted third party and entanglement resources for the first time.

Table 8.

Comparison among some different quantum signature protocols.

Protocol	Resources	Trust Third Party	Contribution
Zeng et al. [26]	GHZ states	Yes	Arbitrated quantum signature (AQS) protocol is proposed for the first time.
Li et al. [27]	Bell states	Yes	AQS protocol first proposed using Bell states instead of GHZ states.
Zou et al. [28]	Single photon	Yes	AQS protocol without entangled resources is proposed for the first time.
Liu et al. [29]	Coherent states	Yes	Innovation of quantum dual- signature.
Kang et al. [30]	GHZ states	No	The signature protocol without arbitrator is proposed for the first time.
Kang et al. [31]	GHZ-like states	No	Further improvement on the protocol in Ref. [30].
Wang et al. [32]	GHZ-like states, Bell states	No	Further improvement on the protocol in Ref. [31].
Li et al. [33]	Bell states	No	A novel quantum signature protocol without arbitrator is proposed for the first time.
Our protocol	SNOP states	No	A quantum signature protocol without arbitrator and entangled resources is proposed for the first time.

Comparing with the existing quantum signature protocols, the signature of our protocol requires the cooperation of two verifiers to complete the whole verification process without an arbitrator. In this case, the function has wide applications in practical management. By introducing SNOP states, the present protocol seems more efficient and easier to be realized in noisy intermediate-scale quantum (NISQ) devices, as no entangled resources are required. According to our analysis, the protocol based on SNOP states is immune to attacks from the inside and outside. In other words, the attacker cannot determine the accurate whole state even if they obtain two particles of the SNOP states. Furthermore, we give a potential application for the SNOP states and put forward a series of ideas. We think SNOP states could also be applied to electronic payments, voting systems and so on. Moreover, we believe that SNOP states must have better application scenarios in the future. Finally, we hope that our results are instructive to further research on other quantum cryptographic protocols.

Abbreviations

The following abbreviations are used in this manuscript:

QKD	quantum key distribution
SNOP	strongly nonlocal orthogonal product
QOTP	quantum one time pad
AQS	arbitrated quantum signature
NISQ	noisy intermediate-scale quantum

Author Contributions

Conceptualization, X.Z. and K.Z.; methodology, X.Z.; software, X.Z.; validation, X.Z., K.Z., L.Z., G.T. and T.S.; writing—original draft preparation, X.Z.; writing—review and editing, X.Z., K.Z. and L.Z. All authors have read and agreed to the published version of the manuscript.

Funding

This research was funded by the National Natural Science Foundation of China under Grant No. 61802118 and No. 61801459, the National Postdoctoral Program for Innovative Talent Grant No. BX20190335, the Natural Science Foundation of Heilongjiang Province under Grant No. YQ2020-F013, the University Nursing Program for Young Scholars with Creative Talents in Heilongjiang Province under Grant No. UNPYSCT-2018015, the Anhui Initiative in Quantum Information Technologies Grant No. AHY150100, the Central Universities Grant No. 21620433, the Guangxi Key Laboratory of Cryptography and Information Security Grant No. GCIS201922 and the open Foundation of State key Laboratory of Networking and Switching Technology (BUPT) under Grant No. SKLNST-2018-1-07. The Outstanding Youth Fund of Heilongjiang University supported Kejia Zhang, the Heilongjiang University Innovation Fund Grant No.YJSCX2021-082HLJU.

Institutional Review Board Statement

Not applicable.

Informed Consent Statement

Not applicable.

Conflicts of Interest

The authors declare no conflict of interest.