Secure multiparty quantum key agreement against collusive attacks

Abstract

Quantum key agreement enables remote participants to fairly establish a secure shared key based on their private inputs. In the circular-type multiparty quantum key agreement mode, two or more malicious participants can collude together to steal private inputs of honest participants or to generate the final key alone. In this work, we focus on a powerful collusive attack strategy in which two or more malicious participants in particular positions, can learn sensitive information or generate the final key alone without revealing their malicious behaviour. Many of the current circular-type multiparty quantum key agreement protocols are not secure against this collusive attack strategy. As an example, we analyze the security of a recently proposed multiparty key agreement protocol to show the vulnerability of existing circular-type multiparty quantum key agreement protocols against this collusive attack. Moreover, we design a general secure multiparty key agreement model that would remove this vulnerability from such circular-type key agreement protocols and describe the necessary steps to implement this model. The proposed model is general and does not depend on the specific physical implementation of the quantum key agreement.

Introduction

The concept of the key agreement was first presented by Diffie–Hellman in 1976¹. It describes how two remote users can fairly generate a secured shared key based on their private inputs. In 1982, Ingemarsson et al.² extended the two-party key agreement protocol to a multiparty or group key agreement protocol. After that, several multiparty key agreement schemes have been published³. However, future quantum computers with sufficient power could threaten the security of many of the current public-key cryptosystems whose security mainly relies on unproven mathematical assumptions^4,5. For that reason, quantum applications in cryptography have attracted the attention of a lot of scientists and researchers to suggest and develop information-theoretically unconditional secure cryptosystems. One of the most common quantum cryptographic applications is quantum key distribution (QKD)⁶, in which remote participants can establish a shared random key securely even in the presence of an attacker with unlimited classical or quantum computing power. Subsequently, several quantum cryptographic applications have been introduced to solve various classical security issues^7–16.

Recently, quantum key agreement (QKA) has attracted the attention of a lot of researchers¹⁷. QKA ensures fairness between the involved participants to generate a shared secure key based on their private inputs. Using the quantum teleportation protocol, Zhou et al.¹⁷, in 2004, presented the first two-party QKA scheme. In 2013, the two-party QKA was extended to multiparty QKA protocols¹⁸. Subsequently, several multiparty QKA protocols have been presented^19–22. In general, as noted in¹⁸, there are three types of MQKA protocols; (1) the first type is the tree-type in which every party sends their secret data through independent quantum channels to all other parties²³; (2) the second type is the complete-graph-type in which every participant sends a sequence of qubits to each of the others parties to encode her or his secret information, (3) while in the third type that is the circle-type (sometimes called travelling-mode)^8,24, every party generates a random sequence of qubits and sends this sequence to another party who applies an encoding process producing a new evolved sequence of qubits and sends the new sequence to the next party; this process continues over all parties until the evolved sequence reaches the party who generates the first sequence. Compared to the other QKA types, the circle-type is more efficient and more easily achieves the property of fairness. For that reason, the QKA circle-type has been intensively investigated.

In 2016, Liu et al.¹⁸ pointed out that all existing circle-type multiparty quantum key agreement (CT-MQKA) protocols are vulnerable to collusive attack, and asked a challenging question about the possibility of designing a secure CT-MQKA protocol. In response to this question, several CT-MQKA protocols have been proposed to avoid collusive attacks. However, in this work, we show that many of the existing CT-MQKA protocols are also not secure against a collusive attack. We study, as an example, the security of Sun et al.’s¹⁹ MQKA protocol (named SCWZ protocol hereafter) to show the vulnerability of the existing CT-MQKA protocols to collusive attacks. Furthermore, we design a general secure model for CT-MQKA protocols and propose the necessary steps for this model.

The insecurity of existing CT-MQKA protocols

In this section, we show that many of the recently published works in CT-MQKA are not secure against collusive attacks^{19–21,25,26}. In general, there are two main collusive attack strategies, which could be applied to the CT-MQKA protocols:

The first collusive attack strategy

The first collusive attack strategy has been pointed out in^18,19. Any two dishonest participants $P_i$ and $P_j$ (where $i>j$; $i,j\in \{1,2,\cdots ,n\}$ and $n$ is the number of participants) in particular positions in the circle-type protocols can control the final key if their particular positions meet the following two conditions:

$$i-j=\frac{n}{2}\text{when}n\text{is even},$$ 1

$$i-j=\frac{n+1}{2}\text{or}\frac{n-1}{2}\text{when}n\text{is odd}.$$ 2

The second collusive attack strategy

The second collusive attack strategy can be described as follows. In the CT-MQKA schemes, any two dishonest participants $P_i$ and $P_j$ can steal the private inputs of an honest participant $P_k$ ($i,j,k\in \{1,2,\cdots ,n\}$) without being detected, if their positions meet one of the two following conditions:

$$i-j=2;\text{then k}=i-1;$$ 3

$$j-i=2;\text{then k}=j-1.$$ 4

Note, in our previous work⁸, we mentioned that two malicious users may try to deduce the private information of an honest one. However, in this work, we formulate and describe the general situation in which two dishonest participants can steal the private information of the honest ones as indicated in Eqs. (3) and (4).

Review of SCWZ’s protocol

In SCWZ’s protocol¹⁹, there are $n$ participants and each participant $P_i$ ($i=1,2,\cdots ,n$) has an $m-bit$ key ($K_i$). The participants want to generate a shared secret key $K$ fairly, where $K=K_1\oplus K_2\oplus \cdots \oplus K_n$. The steps of the SCWZ’s protocol can be described as follows.

1. Preparation phase. The server generates $n$ sequences of random single-photons. Each sequence $S_i$ ($i=1,2,\cdots ,n$) contains $m$ single-photons and each photon is selected randomly from the four states {$\left|+\right)⟩,\left|-\right)⟩,\left|0\right)⟩,\left|1\right)⟩$}, where $\left|\pm \right)⟩=\frac{1}{\sqrt{2}}(\left|0\right)⟩\pm \left|1\right)⟩)$. The server also generates $n$ sequences of random single photons (called $C_i$), which are used as decoy photons to check the existence of eavesdroppers. Each single decoy photon is randomly selected from the states {$\left|+\right)⟩,\left|-\right)⟩,\left|+,y\right)⟩,\left|-,y\right)⟩$}, where $\left|\pm ,y\right)⟩=\frac{1}{\sqrt{2}}(\left|0\right)⟩\pm i\left|1\right)⟩)$. The server then randomly inserts and distributes the single-photons of $C_i$ into $S_i$ getting a new sequence $S_i^{{}^{\prime }}$, and sends the new sequence ($S_i$) to $P_i$.

2. Detection phase. Upon receiving $S_i^{{}^{\prime }}$, each participant sends an acknowledgment to the server. Then the server announces the positions of $C_i$ and their measurement bases. Each $P_i$ measures $C_i$ based on the corresponding measurement bases and stores the results. $P_i$ then randomly announces half of the measurement results of $C_i$; the server, in turn, announces the initial states of the second half of $C_i$. Then both the server and $P_i$ collaborate to compute the error rate. They end the protocol if the error rate higher than a predefined value. Otherwise, they continue with the protocol.

3. After $P_i$ gets the secure sequence $S_i$, each participant performs the next sub-steps:

   • A.
     Encoding phase. $P_i$ encodes secret information ($K_i$) onto $S_i$ by applying the unitary operation $U=\left|0\right)⟩⟨1|-\left|1\right)⟩⟨0|$ when the classical bit of the secret $K_i$ is 1, and the unitary operation $I=\left|0\right)⟩⟨0|+\left|1\right)⟩⟨1|$ when the classical bit $K_i$ is 0. $P_i$ then reorders the decoy states that were prepared and inserted by the server in Step (1) and reinserts them in random positions into the encoded sequence obtaining a new sequence ($S_i^{i+1}$), and sends $S_i^{i+1}$ to $P_{i+1}$.
   • B.
     Eavesdropping check phase. Upon receiving $S_i^{i+1}$, $P_{i+1}$ and $P_i$ check the security of the transmission by performing the same process indicated in step (2) between the server and $P_i$.
   • C.
     Encoding phase. After checking the security of transmission, $P_{i+1}$ encodes secret information ($K_{i+1}$) onto $S_i$ following the same rules as in step (A). $P_{i+1}$ then reorders the decoy states and reinserts them in random positions into the encoded sequence obtaining a new sequence ($S_i^{i+2}$), and sends $S_i^{i+2}$ to $P_{i+2}$.
   • D.
     Similarly, the rest of the participants ($P_{i+2},P_{i+3},\cdots ,P_{i-2}$) perform the Eavesdropping check phase and the Encoding phase indicated in steps (B) and (C).
   • E.
     Upon receiving $S_i^{i-2}$, $P_{i-1}$ and $P_{i-2}$ check the security of transmission. If the quantum channel between $P_{i-1}$ and $P_{i-2}$ is secure, $P_{i-2}$ discards the decoy photons to get $S_i$, and informs the server of this fact.

4. When all the $P_{i-1}$ receive $S_i$, they send an acknowledgment to the server, and the server announces the measurement bases of $S_i$ to all the $P_{i-1}$. After that, each $P_{i-1}$ uses the corresponding measurement bases to measure $S_i$ obtaining $K_i^{{}^{\prime }}$, where $K_i^{\prime }=K_i\oplus K_{i+1}\oplus \cdots \oplus K_{i-2}$. Finally, $P_{i-1}$ can recover the final shared secret key $K=K_i^{{}^{\prime }}\oplus K_{i-1}$.

The collusive attack against CT-MQKA protocols

In this section, we show that the SCWZ’s protocol, as an example of CT-MQKA protocols, is insecure against a collusive attack. Although the authors of SCWZ’s protocol have presented a security analysis to prove the security of their protocol against the first model of the collusive attack, their protocol is not secure against the second security model of collusive attack. That is to say, any two dishonest participants $P_i$ and $P_j$ in particular positions meeting the conditions in (3) and (4) can easily steal the private key of honest participants ($P_k$).

Without loss of generality, assume we have three participants $P_1$, $P_2$, and $P_3$ and they have three private keys, e.g., $K_1=1000$, $K_2=0101$, and $K_3=1001$, respectively. And the three participants intend to share a secret key ($K$), here $K=K_1\oplus K_2\oplus K_3=0100$. We also assume that $P_1$ and $P_3$ are two dishonest participants and they need to steal the private key of the honest one ($P_2$); hence they can deduce the final key without being caught.

In SCWZ’s protocol, the server generates three random sequences, e.g., $S_1=\{\left|+\right)⟩,\left|0\right)⟩,\left|1\right)⟩,\left|-\right)⟩\}$, $S_2=\{\left|0\right)⟩,\left|1\right)⟩,\left|0\right)⟩,\left|1\right)⟩\}$, and $S_3=\{\left|0\right)⟩,\left|+\right)⟩,\left|-\right)⟩,\left|1\right)⟩\}$ each one consists of four single-photons. Also, the server generates three random sequences $C_1$, $C_2$, and $C_3$ each one consists of four decoy single-photon states. Then the server randomly inserts the decoy state $C_1$ ($C_2$/$C_3$) into $S_1=\{\left|+\right)⟩,\left|0\right)⟩,\left|1\right)⟩,\left|-\right)⟩\}$ ($S_2=\{\left|0\right)⟩,\left|1\right)⟩,\left|0\right)⟩,\left|1\right)⟩\}$/$S_3=\{\left|0\right)⟩,\left|+\right)⟩,\left|-\right)⟩,\left|1\right)⟩\}$) and sends it to $P_1$ ($P_2$/$P_3$). After checking the security of the transmission, each participant discards the decoys and encodes their private information based on the encoding rule mentioned in Step 3.A. Subsequently, each participant sends the sequence in a circle to the other participants to encode their private inputs until the sequence is returned to the participant.

For simplicity, we show here the circle of $S_1$ (Fig. 1a) which will be used by the participant $P_1$ to get the final key ($K$). First, $P_1$ receives $S_1=\{\left|+\right)⟩,\left|0\right)⟩,\left|1\right)⟩,\left|-\right)⟩\}$ from the server to encode her or his information and get the final key. Second, $P_1$ encodes a private input, i.e., $K_1=1000$ into $S_1$ getting the new sequence $S_1=\{U\left|+\right)⟩,I\left|0\right)⟩,I\left|1\right)⟩,I\left|-\right)⟩\}$. Third, $P_1$ inserts some decoy photons into $S_1$ and sends it to the dishonest $P_3$ instead of sending it to $P_2$. After checking the security of the transmission, $P_3$ discards the decoy states and gets $S_1=\{U\left|+\right)⟩,I\left|0\right)⟩,I\left|1\right)⟩,I\left|-\right)⟩\}$. At the same time, the dishonest $P_1$ generates a counterfeit sequence, e.g., $S_1^{{}^{\prime }}=\{\left|0\right)⟩,\left|0\right)⟩,\left|-\right)⟩,\left|+\right)⟩\}$ with decoy states and sends it to both $P_2$ and $P_3$. $P_1$ only tells $P_3$ that the sequence $S_1^{{}^{\prime }}$ is the counterfeit one. Since the honest participant ($P_2$) does not have $K_1=1000$ and does not knows $S_1=\{\left|+\right)⟩,\left|0\right)⟩,\left|1\right)⟩,\left|-\right)⟩\}$, she or he cannot know what the received new sequence looks like (i.e., $S_1=\{U\left|+\right)⟩,I\left|0\right)⟩,I\left|1\right)⟩,I\left|-\right)⟩\}$).

Figure 1.

An example of a three-party QKA protocol. Any two dishonest participants in particular positions can steal the private input of an honest participant.

Obviously, $P_2$ cannot distinguish between the genuine sequences and the counterfeit ones. So, $P_2$ encodes the private data, i.e., $K_2=0101$ into $S_1^{{}^{\prime }}$ getting $S_1^{{}^{\prime }}=\{I\left|0\right)⟩,U\left|0\right)⟩,I\left|-\right)⟩,U\left|+\right)⟩\}$ and sends $S_1^{{}^{\prime }}$ with decoy states to $P_3$. After checking the security of the transmission, $P_3$ discards the decoy qubits and gets $S_1^{{}^{\prime }}$. $P_3$ then requests the corresponding measurement bases of $S_1^{{}^{\prime }}$ from $P_1$ to get $K_2=0101$. Based on her or his private key, i.e., $K_3=1001$ and the private key of $P_2$, $P_3$ applies the corresponding unitary operations to the genuine sequence $S_1=\{U\left|+\right)⟩,I\left|0\right)⟩,I\left|1\right)⟩,I\left|-\right)⟩\}$ getting $S_1=\{U(I(U\left|+\right)⟩)),I(U(I\left|0\right)⟩)),I(I(I\left|1\right)⟩)),U(U\left(I,\left|-\right),⟩\right))\}$ and sends it to $P_1$. Then the participants announce to the server that the quantum channels are secure. Finally, the server announces the measurement bases of $S_1$ to $P_1$ thus enabling $P_1$ to get $\text{K}$.

Similarly, if $P_2$ and $P_3$ ($P_2$ and $P_1$) are the dishonest participants they can steal the private key of the honest participant $P_1$ ($P_3$) in the circle while sending $S_2$ ($S_3$), as shown in Fig. 1b (Fig. 1c). By applying the same attack strategy, most of the existing CR-MQKA protocols^{19–21,25,26} are vulnerable to this collusive attack.

The proposed secure CT-MQKA protocol

In this section, we give a general secure model of CT-MQKA against the collusive attack described above. Whereas our protocol can be implemented with photons, we describe it in more general terms here. The idea of adopting a semi-honest client–server model (or a third party) has been adopted in many previous QKA protocols to ensure the security of communication^{19,22,27–29}. Suppose we have $n$ participants who want to generate a shared secret key $K$ fairly, where $K=K_1\oplus K_2\oplus \cdots \oplus K_n$ with length $m$. Every participant ($P_i$) selects a private random classical key ($K_i^{{}^{\prime }}$), where $\left|K_i^{{}^{\prime }}\right|=\left|K_i\right|+nl$. Here, $l$ is the number of decoy states used for checking the security of a quantum channel, and $i=1,2,\cdots n$.

The general steps of this secure CT-MQKA model can be described as follows:

Step (1) The server generates $n$ sequences $S_i$ ($i$= 1, 2, …, n), with each sequence containing $m+nl$ single qubits. The server records the position of every single qubit. Every qubit is selected randomly from the four quantum states $\left\{\left|+\right.〉=\frac{1}{\sqrt{2}}\left(\left|0\right.〉+\left|1\right.〉\right),\left|-\right.〉=\frac{1}{\sqrt{2}}\left(\left|0\right.〉-\left|1\right.〉\right),\left|0\right.〉,\left|1\right.〉\right\}$.

Step (2) The server also generates additional $n$ sequences of random single qubits (called $C_i$), which are used as decoy states to check the existence of eavesdroppers. Every single decoy qubit is randomly selected from the four quantum states {$\left|+\right)⟩,\left|-\right)⟩,\left|0\right)⟩,\left|1\right)⟩$}. The server inserts $C_i$ into $S_i$ producing a new sequence $S_i^{{}^{\prime }}$, and sends the new sequence ($S_i^{{}^{\prime }}$) to $P_i$.

Step (3) Upon receiving $S_i^{{}^{\prime }}$, every participant sends an acknowledgment to the server.

Step (4) In this step, the server announces the positions of $C_i$ and their measurement bases. Every $P_i$ measures $C_i$ based on the corresponding measurement bases and stores the results. Randomly, $P_i$ selects half of the qubits in $C_i$ and announces their measurement results to the server. The server, in turn, announces the initial states of the second half of $C_i$. Both the server and $P_i$ collaborate to compute the error rate. They end the protocol if the error rate is higher than a predefined value. Otherwise, $P_i$ discards $C_i$ from $S_i^{{}^{\prime }}$ getting $S_i$ and continues to Step (5).

Step (5) After each $P_i$ gets the secure sequence $S_i$, they start to perform the next sub-steps.

1. Encoding phase. $P_i$ encodes the secret information ($K_i^{{}^{\prime }}$) onto $S_i$ by applying the unitary operation $I=\left|0\right)⟩⟨0|+\left|1\right)⟩⟨1|$ when the classical bit $K_i^{{}^{\prime }}$ is 0, and the unitary operation $U=\left|0\right)⟩⟨1|-\left|1\right)⟩⟨0|$ if the classical bit $K_i^{{}^{\prime }}$ is 1 as indicated in Table 1.

2. Detecting the external attack phase. For detecting external eavesdroppers, $P_i$ generates a sequence of random single qubits ($C_{\mathit{pi}}$) as in Steps (1) and (2), which are used as decoy qubits to check the existence of eavesdroppers in the quantum channel between $P_i$ and $P_{i+1}$ (note, the symbol $+$ in “i + 1” represents the additional mod $n$. $P_i$ inserts $C_{\mathit{pi}}$ into $S_i$ producing a new sequence $S_{i\mapsto i+1}$, and sends the new sequence ($S_{i\mapsto i+1}$) to $P_{i+1}$. As in Step (4), $P_i$ and $P_{i+1}$ share the information of $C_{\mathit{pi}}$ and collaborate to compute the error rate. $P_i$ and $P_{i+1}$ end the protocol if the error rate is higher than a predefined value. Otherwise, $P_{i+1}$ discards $C_{\mathit{pi}}$ from $S_{i\mapsto i+1}$ obtaining $S_i$ and continues to the next process.

3. Detecting the internal attack phase. Upon confirming that the communication between $P_i$ and $P_{i+1}$ is secure against external attackers, the server randomly selects $l$ single-qubits as decoy qubits from $S_{i\mapsto i+1}$, by announcing their positions, and asks $P_i$ to publicly announce the unitary operations that were applied to the $l$ qubits. Subsequently, the server announces the measurement bases of the $l$ qubits to $P_{i+1}$. $P_{i+1}$ measures the $l$ qubits using the corresponding measurement bases. Based on the measurement results, the measurement bases, and the applied unitary operations, $P_{i+1}$ can judge whether the $l$ qubits are genuine or not. If not, $P_{i+1}$ ends the protocol. Otherwise, the participants do the following:

   • i)
     $P_{i+1}$ discards the $l$ qubits from $S_{i\mapsto i+1}$ that were selected by the server;
   • ii)
     The server also discards the corresponding $l$ qubits from $S_i$;
   • iii)
     Every $P_i$ discards the corresponding classical bits from their private keys $K_i^{{}^{\prime }}$.

4. As in Step (5.a), $P_{i+1}$ encodes the secret information ($K_{i+1}^{{}^{\prime }}$) onto $S_i$ and inserts some random decoy states ($C_{pi+1}$) into $S_{i\mapsto i+1}$ producing $S_{i\mapsto i+2}$. Afterwards, $P_{i+1}$ sends $S_{i\mapsto i+2}$ to $P_{i+2}$.

5. Upon $P_{i+2}$ receiving $S_{i\mapsto i+2}$, $P_{i+1}$ and $P_{i+2}$ collaborate to check the security of communication by performing Step (5.a–5.d).

6. $P_{i+2}$ encodes her or his information and sends the new sequences to the next participants. This process continues until $P_i$ receives the secure quantum message ($S_{i\mapsto i-1}$) from $P_{i-1}$; here, the symbol “−” in “i − 1” represents the subtraction mod $n$.

Table 1.

The encoding rules.

Unitary operations/quantum states	$\left|0\right)⟩$	$\left|1\right)⟩$	$\left|+\right)⟩$	$\left|-\right)⟩$
$0\Rightarrow I$	$\left|0\right.〉$	$\left|1\right.〉$	$\left|+\right.〉$	$\left|-\right.〉$
$1\Rightarrow U$	$-\left|1\right.〉$	$\left|0\right.〉$	$\left|-\right.〉$	$-\left|+\right.〉$

The unitary operation $I$ represents 0 and the unitary operation $U$ represents 1.

Step (6): When all $P_i$ s receive $S_{i\mapsto i-1}$, they discard the decoy qubits getting $S_i$. Hence, each participant loses $\mathit{nl}$ classical bits from $K_i^{{}^{\prime }}$ getting $K_i$ with length $m$. After that, they send an acknowledgment to the server, and the server announces the measurement bases of $S_i$ to all the $P_i$ s. Finally, every $P_i$ uses the corresponding measurement bases to measure $S_i$ obtaining $K$, where $K=K_1\oplus K_2\oplus \cdots \oplus K_n$.

Illustration of the proposed protocol

For simplicity, suppose we have three participants $P_1$, $P_2$, and $P_3$ and they want to generate a shared secret key $K=K_1\oplus K_2\oplus K_3$ with length $m$ (e.g., $m=3$). $P_1$, $P_2$, and $P_3$ have three private keys $K_1^{{}^{\prime }}$, $K_2^{{}^{\prime }}$, and $K_3^{{}^{\prime }}$, respectively, with length $m+nl$, e.g., $m+nl=3+(3\ast 3)=12$; here $\mathit{nl}$ is the number of decoy states for checking the security of all quantum channels in one complete circle, and for the $n$ circle it will be $m+nl$. Here, there are three complete circles for three participants, and the number of decoy qubits for checking the security of all quantum channels is $n\ast nl=9l$. Also, we assume that, $K_1^{{}^{\prime }}=000001101101$, $K_2^{{}^{\prime }}=111011101000$, and $K_3^{{}^{\prime }}=110011010110$.

The server generates a sequence of quantum states contains 12 random states (e.g., $S_1=$ $\left|0\right)⟩,\left|0\right)⟩,\left|0\right)⟩,\left|1\right)⟩\left|0\right)⟩,\left|0\right)⟩,\left|1\right)⟩\left|0\right)⟩,\left|1\right)⟩,\left|-\right)⟩,\left|+\right)⟩,\left|-\right)⟩$) for the first circle and sends it to $P_1$. $P_1$ checks the security of the transmission with the server as in Step (4). Based on her/his private data ($K_1^{{}^{\prime }}$), $P_1$ applies the unitary operations {$I,I,I,I,I,U,U,I,U,U,I,U$} to $S_1$ getting $S_{1\mapsto 2}=\left|0\right)⟩,\left|0\right)⟩,\left|0\right)⟩,\left|1\right)⟩\left|0\right)⟩,-\left|1\right)⟩,\left|0\right)⟩\left|0\right)⟩,\left|0\right)⟩,-\left|+\right)⟩,\left|+\right)⟩,-\left|+\right)⟩$. To secure the communication, $P_1$ inserts some decoy qubits into $S_{1\mapsto 2}$ and sends $S_{1\mapsto 2}$ to $P_2$. Subsequently, $P_2$ performs Step (5.b) to detect the external attack.

As in Step (5.c), the server chooses random $l$ states (e.g., $l=1$) from $S_1$ and announce the position of $l$ (e.g., the position of last state in $S_1$) to $P_1$ and $P_2$. The server asks $P_1$ to announce the unitary operation that was applied to $l$, and asks $P_2$ to announce the measurement result of the corresponding states in $S_{1\mapsto 2}$ (i.e., $-\left|+\right)⟩$), respectively. Based on the announced information ($\left|-\right)⟩$, $U$, $-\left|+\right)⟩$), the server can judge whether $P_2$ has received genuine information or not.

Later, the server and $P_2$ discard the last sequence from $S_1$ and $S_{1\mapsto 2}$ getting newly updated sequences $S_1=(\left|0\right)⟩,\left|0\right)⟩,\left|0\right)⟩,\left|1\right)⟩\left|0\right)⟩,\left|0\right)⟩,\left|1\right)⟩\left|0\right)⟩,\left|1\right)⟩,\left|-\right)⟩,\left|+\right)⟩$) and $S_{1\mapsto 2}=(\left|0\right)⟩,\left|0\right)⟩,\left|0\right)⟩,\left|1\right)⟩\left|0\right)⟩,-\left|1\right)⟩,\left|0\right)⟩\left|0\right)⟩,\left|0\right)⟩,-\left|+\right)⟩,\left|+\right)⟩$), respectively. Also, all participants update their private keys by discarding the corresponding classical bits. The updated private keys of $P_1$, $P_2$, and $P_3$ become $K_1^{{}^{\prime }}=00000110110$, $K_2^{{}^{\prime }}=11101110100$, and $K_3^{{}^{\prime }}=11001101011$, respectively. They also consume two quantum states (e.g., the last two states) for checking the quantum channel between ($P_2$ and $P_3$) and ($P_3$ and $P_1$).

The updated private keys after completing one circle are as follows: $K_1^{{}^{\prime }}=000001101$, $K_2^{{}^{\prime }}=111011101$, and $K_3^{{}^{\prime }}=110011010$. And the updated private keys after completing the three circles are as follows: $K_1^{{}^{\prime }}=000$, $K_2^{{}^{\prime }}=111$, and $K_3^{{}^{\prime }}=110$. Now, $\left|K\right|=\left|K_1\right|=\left|K_2\right|=\left|K_3\right|=\left|K_1^{{}^{\prime }}\right|=\left|K_2^{{}^{\prime }}\right|=\left|K_2^{{}^{\prime }}\right|$. Finally, each participant can get the final key $K=K_1\oplus K_2\oplus K_3=000\oplus 111\oplus 110=001$. Note that for simplicity, we assumed that the server frequently chooses the last qubit for checking the security of communication; but the selected positions should be completely random.

Applying the proposed model to SCWZ’s protocol

Taking SCWZ’s protocol¹⁹ as an example, we show in this section how to address the vulnerability of CT-MQKA protocols to the collusive attack.

In SCWZ’s protocol¹⁹, there are $n$ participants and each participant $P_i$ ($i=1,2,\cdots ,n$) has an m-bit key ($K_i$). All participants want to fairly generate a shared secret key ($K=K_1\oplus K_2\oplus \cdots \oplus K_n$). Also, there is a server that generates $n$ sequences of random single-photons. Each sequence $S_i$ contains $m$ random single-photons. The server generates additional $n$ sequences of random single photons ($C_i$), which are used as decoy photons to check the existence of eavesdroppers.

Based on our proposed model, SCWZ’s protocol should be modified as follows.

1. Each participant ($P_i$) should prepare the length of her/his private keys ($K_i$) to be $m+nl$.

2. The length of the quantum sequences generated by the server should also be $m+nl$.

3. As in Step (5.b), $P_i$ should generate a sequence of random single-qubits ($C_{\mathit{pi}}$) to check the security of the quantum channel between the sender ($P_i$) and receiver ($P_{i+1}$).

4. To detect the collusive attack, the server randomly selects $l$ single-qubits from the $m+nl$ single-qubits and uses them as decoy qubits to check the security of quantum channels between every two participants, as proposed in Step (5.c).

5. All participants update their keys by discarding the classical bits corresponding to the single qubits that were used as decoy qubits.

The security analysis

This section presents detailed security analyses for both external eavesdropping and internal attacks.

External attack

In the proposed protocol, the decoy qubit technique is used to prevent external eavesdroppers from attacking the protocol. To achieve that, a sequence of single decoy qubits is randomly selected from the states {$\left|+\right)⟩,\left|-\right)⟩,\left|0\right)⟩,\left|1\right)⟩$} and randomly inserted into the secret message. The eavesdropper (Eve) cannot distinguish between the decoy-states and secret message states. Eve may try to entangle a secret message state with an auxiliary quantum state ($\left|\mathit{ϵ}\right)⟩$) by applying a unitary operation (${\mathit{U}}_{\mathit{ϵ}}$) as follows:

$$U_{ϵ}\left|0\right)⟩\left|ϵ\right)⟩={\alpha }_1\left|0\right)⟩\left|{ϵ}_{00}\right)⟩+a_2\left|1\right)⟩\left|{ϵ}_{01}\right)⟩,$$ 5

$$U_{ϵ}\left|1\right)⟩\left|ϵ\right)⟩={\alpha }_1\left|0\right)⟩\left|{ϵ}_{10}\right)⟩+a_2\left|1\right)⟩\left|{ϵ}_{11}\right)⟩,$$ 6

$$U_{ϵ}\left|+\right)⟩\left|ϵ\right)⟩=\frac{1}{2}\left[\left|+\right),⟩\left({\alpha }_1,\left|{ϵ}_{00}\right),⟩+,{\alpha }_2,\left|{ϵ}_{01}\right),⟩+,{\alpha }_3,\left|{ϵ}_{10}\right),⟩+{\alpha }_4\left|{ϵ}_{11}\right)⟩\right)+\left|-\right)⟩,\left({\alpha }_1,\left|{ϵ}_{00}\right),⟩-,{\alpha }_2,\left|{ϵ}_{01}\right),⟩+,{\alpha }_3,\left|{ϵ}_{10}\right),⟩-{\alpha }_4\left|{ϵ}_{11}\right)⟩\right)\right],$$ 7

$$U_{ϵ}\left|-\right)⟩\left|ϵ\right)⟩=\frac{1}{2}\left[\left|+\right),⟩\left({\alpha }_1,\left|{ϵ}_{00}\right),⟩+,{\alpha }_2,\left|{ϵ}_{01}\right),⟩-,{\alpha }_3,\left|{ϵ}_{10}\right),⟩-{\alpha }_4\left|{ϵ}_{11}\right)⟩\right)+\left|-\right)⟩,\left({\alpha }_1,\left|{ϵ}_{00}\right),⟩-,{\alpha }_2,\left|{ϵ}_{01}\right),⟩-,{\alpha }_3,\left|{ϵ}_{10}\right),⟩+{\alpha }_4\left|{ϵ}_{11}\right)⟩\right)\right].$$ 8

In (5) and (6), ${\left|{\alpha }_1\right|}^2+{\left|a_2\right|}^2=1$ and ${\left|{\alpha }_3\right|}^2+{\left|{\alpha }_4\right|}^2=1$. Also, $\left|{ϵ}_{00}\right)⟩$, $\left|{ϵ}_{01}\right)⟩$, $\left|{ϵ}_{10}\right)⟩$, and $\left|{ϵ}_{11}\right)⟩$ are four ancilla states decided by Eve. To pass the external eavesdropping detection phase, Eve sets ${\alpha }_2={\alpha }_3=0$, if the targeted quantum state is $\left|0\right)⟩$ or $\left|1\right)⟩$, and $\left({\alpha }_1,\left|e_{00}\right),⟩+,{\alpha }_2,\left|e_{01}\right),⟩-,{\alpha }_3,\left|e_{10}\right),⟩-{\alpha }_4\left|e_{11}\right)⟩\right)=\left({\alpha }_1,\left|e_{00}\right),⟩-,{\alpha }_2,\left|e_{01}\right),⟩+,{\alpha }_3,\left|e_{10}\right),⟩-{\alpha }_4\left|e_{11}\right)⟩\right)=0$, if the targeted quantum state is $\left|+\right)⟩$ or $\left|-\right)⟩$. But these malicious procedures cannot help Eve to extract any useful information from the private inputs. For example, if Eve sets ${\alpha }_2={\alpha }_3=0$, she gets ${\left|{\alpha }_1\right|}^2={\left|{\alpha }_4\right|}^2=1$, which means that ${\alpha }_1\left|{ϵ}_{00}\right)⟩={\alpha }_4\left|{ϵ}_{11}\right)⟩$. So, Eve cannot reveal private inputs. Besides, the proposed CT-MQKA protocol is not open to the Trojan horse attack since all information is sent in a one-way manner^30,31.

Internal attack

In the proposed model, internal attacks may be divided into three types of attacks: (1) Server’s attack; (2) Participant’s attack; (3) Collusive attack. Participant’s attack is similar to server’s attack in this work. Therefore, we only discuss here the server’s attack and collusive attack.

Server’s attack

In this work, we assume that the server is semi-honest. That is, it faithfully executes the operations delegated by participants and does not collude with other participants to steal sensitive information, but may try to get the information of secret keys. Participants employ the decoy photon method to secure the communications between every two participants. Hence, the server must adopt one of the external attack strategies if it wants to get sensitive information. However, we show in the “External attack” section that the proposed model is secure against external attacks. Accordingly, the malicious server may resort to guessing the required information or generate the final key as follows:

1. Passing the security check. In Step (1), the server sends $S_i$ to $P_i$ as an initial quantum sequence for generating the final key. In Step (5), $P_i$ uses $S_i$ to encode her/his private data and inserts some decoy qubits for security check before sending them to $P_{i+1}$. To successfully pass the security check, the server must correctly guess the measurement bases of the decoy qubits and guess the initial bases to correctly resend $P_i$’s qubits to $P_{i+1}$ without been caught. The probability of correctly guessing a measurement basis for each qubit is 50%, and the probability of correctly guessing an initial basis is also 50%. Therefore, the probability ($\mathit{pr}$) of passing the eavesdropping check is as follows:

   $$pr={\mathit{pr}}_1\times {\mathit{pr}}_2\times \cdots \times {\mathit{pr}}_{\text{n}}={\left(\frac{1}{2},\times ,\frac{1}{2}\right)}^{\mathit{nl}}\times {\left(\frac{1}{2},\times ,\frac{1}{2}\right)}^{\mathit{nl}}\times \cdots \times {\left(\frac{1}{2},\times ,\frac{1}{2}\right)}^{\mathit{nl}}={\left(\frac{1}{2},\times ,\frac{1}{2}\right)}^{\mathit{nl}}.$$ 9

   here, ${\mathit{pr}}_i$ ($i=1,2,\cdots ,n$) is the probability of correctly guessing the $i$th sequence of decoy qubits, and $l$ is the length of each decoy qubit sequence.
2. Guessing participants’ private keys. Since $K=K_1\oplus K_2\oplus \cdots \oplus K_n$, the server needs to correctly guess all participants’ private keys to get $K$. The probability ($\mathit{pr}$) of correctly guessing the final key $K$ is as follows:

   $$pr={\mathit{pr}}_1\times {\mathit{pr}}_2\times \cdots \times {\mathit{pr}}_{\text{n}}={{\left(\frac{1}{2}\right)}^l\times {\left(\frac{1}{2}\right)}^l\times \cdots {\times \left(\frac{1}{2}\right)}^l=\left(\frac{1}{2}\right)}^{\mathit{nl}}.$$ 10

   here, ${\mathit{pr}}_i$ ($i=1,2,\cdots ,n$) is the probability of correctly guessing $K_i$, and $l$ is the length of $K_i$.
3. Guessing the final key ($K$). The server may try to directly guess the final key ($K$). In that case, the probability ($\mathit{pr}$) is as follows:

   $$pr={\left(\frac{1}{2}\right)}^l,\text{where}l\text{is the length of}K.$$ 11

   In Eqs. (9–11), if $l$ is large enough the probability of guessing the final key or required information is close to zero or negligible.

Collusive attack

A collusive attack is the most powerful internal attack in which two or more dishonest participants collude together to extract sensitive information or generate the final key alone without revealing their malicious behaviour. In this section, we show that the proposed model is immune to collusive attacks, such that any group of dishonest participants trying to perform a collusive attack (including the two attack strategies mentioned in the section The insecurity of existing CT-MQKA protocols) will be detected immediately.

Basically, dishonest participants rely on two important processes to successfully achieve the collusive attack; (1) sharing information about the carrier quantum states that will be used to encode the private data and generate the final key, (2) deceiving the honest participants to deduce their private data by sending forged data. In our protocol, a semi-honest server is used to prevent dishonest participants from sending forged data to the honest ones. The server generates $S_i$ with decoy qubits in Step (1) and sends it to $P_i$ in Step (2). In Step (5.b), $P_i$ sends her/his encoded sequence to $P_{i+1}$. To prevent the collusive attack, in Step (5. c), the server participates in checking the security of transmission to make sure that $P_i$ does not send forged qubits to $P_{i+1}$ by randomly selecting some qubits and asking the participants to divulge the related information. Accordingly, the protocol guarantees that the honest participant has received genuine data, and the dishonest participants cannot obtain useful information to generate the final key alone or steal the private inputs of honest participants.

Moreover, if the dishonest participants try to adopt guessing strategies they will be detected with high probability as indicated in Eqs. (9–11). Thus, we can say that the proposed model is secure against internal attacks.

Conclusion

In this work, we showed that most of the existing circular-type multiparty quantum key agreement protocols are insecure against a specific type of collusive attack. We analyzed the security of a recently proposed circular-type multiparty quantum key agreement protocol to demonstrate the vulnerability of such protocols. Then, we proposed a general secure quantum key agreement model to avoid the different types of collusive attacks. We showed that the proposed protocol could generate the final key correctly and that the proposed protocol is secure against all known collusive attack strategies.

Author contributions

H.A. designed the scheme. H.A., A.M. and S.G. did security analysis and comparisons. All authors contributed to the writing and discussion of the paper.

Competing interests

The authors declare no competing interests.