A novel semiquantum key distribution protocol with Bell states

: In this paper, a novel semiquantum key distribution (SQKD) protocol is proposed by using Bell state, where quantum Alice can share N secret bits with classical Bob via quantum channel. Classical Bob is required to measure particles with the Z basis, produce fresh particles within the Z basis and send particles via quantum channel. Security analysis turns out that this protocol is immune to various attacks launched by the outside eavesdropper. Compared with present SQKD protocols using Bell states without a third party, on one hand, this protocol has the highest qubit efficiency; and on the other hand, the reflecting operations of the classical user in this protocol contribute to the generation of final shared key.


Introduction
Quantum key distribution (QKD), which was first proposed by Bennett and Brassard [1] in 1984, is devoted to creating a private key shared between two remote users.In a quantum key distribution scheme [1,2], two remote users are always required to full quantum capabilities.Later, Boyer et al. [3,4] put forward the novel concept of semiquantum key distribution (SQKD), which releases a part of user from possessing full quantum capabilities.In Boyer et al.'s SQKD schemes [3,4], the classical user is restricted for the following actions: measuring particles with the Z basis (i.e.,   0 , 1 ), producing fresh particles with the Z basis, sending particles and scrambling particles via delay lines.In 2016, Krawec [5] put forward a novel SQKD scheme where the reflection operations (i.e., the receiver sending particles back to the sender without disturbance) of the classical user contribute to the generation of secret key.Subsequently, Ye et al. [6,7] utilized single photons in both polarization and spatial-mode degrees of freedom to design two novel SQKD schemes.Besides single photons based SQKD [1][2][3][4][5][6][7], numerous Bell states based SQKD schemes [8][9][10][11] have also been designed.However, in Bell states based SQKD schemes [8][9][10][11], the reflection operations of the classical user cannot contribute to the generation of secret key, which may decrease the qubit efficiency of communication.
In this paper, a novel Bell states based SQKD scheme is designed, where the reflection operations of the classical user contribute to the generation of secret key.Compared with present SQKD protocols using Bell states without a third party [8,9,11], this protocol has the highest qubit efficiency.

The proposed protocol
Alice can establish a private key of length N together with Bob through the following protocol.
Step 1：Alice produces a random bit sequence of length 2N (i.e., A C ) with a random number generator.In the meanwhile, Bob produces a random bit sequence of length 2N (i.e., B C ) with another random number generator.
Step 2：Alice produces 2N Bell states randomly in the four states   , , , , and splits these Bell states into two particle sequences, A S and B S .Here, ( ) , and A S is composed by all first particles of these Bell states, while B S is composed by all second particles of these Bell states.Then, Alice keeps A S in her hand and sends the particles of B S to Bob one by one.Except the first particle, Alice sends out the next particle only after receiving the previous one.
Step 3：On receiving the j th particle of B S , when Alice directly; and in the FLIP_B mode, Bob measures the j th particle of B S with the Z basis, produces a fresh particle in the state opposite to his corresponding measurement result and sends this fresh one back to Alice.Note that the opposite state of 0 is 1 , vice versa.The new particle sequence after Bob's operations is called as ' B S .
Step 4：After receiving all particles of ' B S from Bob, Alice performs her operations on the particles of A S .That is, for the j th particle of A S , when and in the FLIP_A mode, Alice measures the j th particle of A S with the Z basis, produces a fresh particle in the state opposite to her corresponding measurement result and keeps this fresh one in her hand.The new particle sequence after Alice's operations is called as ' A S .
Step 5：In order to check the security of quantum channel, Alice randomly chooses half particles of ' If the error rate of either of the above four Cases is abnormally high, Alice and Bob will stop the protocol; otherwise, the next Step will be implemented.
Step 6：There are N particles of ' T according to the following rule: when the corresponding initial prepared state is  + or  − and Alice's measurement result is  + or  − , Alice gets 0 i A T = ; when the corresponding initial prepared state is  + or  − and Alice's measurement result is  + or  − , Alice gets 1 i A T = ; when the corresponding initial prepared state is  + or  − and Alice's measurement result is  + or  − , Alice gets  .

Security Analysis
(1) The intercept-resend attack Eve intercepts the particle of B S sent from Alice and transmits the fake one she prepared within the Z basis in advance to Bob instead.When Alice enters into the REFLECT_A mode for the corresponding particle of A S and Bob enters into the REFLECT_B mode for the fake particle, the attack behavior of Eve can be detected with the probability of 3 4 ; when Alice enters into the FLIP_A mode for the corresponding particle of A S and Bob enters into the REFLECT_B mode for the fake particle, the attack behavior of Eve can be detected with the probability of 1 2 ; when Alice enters into the REFLECT_A mode for the corresponding particle of A S and Bob enters into the FLIP_B mode for the fake particle, the attack behavior of Eve can be detected with the probability of 1 2 ; and when Alice enters into the FLIP_A mode for the corresponding particle of A S and Bob enters into the FLIP_B mode for the fake particle, the attack behavior of Eve can be detected with the probability of 1 2 . Because one particle of ' B S is chosen for security check with the probability of 1 2 , Eve's intercept-resend attack on one particle of B S is detected with the probability of 4 4 4 2 4 2 4 2 32 . As there are N particles of ' B S chosen for security check, Eve's intercept-resend attack is detected with the probability of .
Table 1 Relationships among Alice's measurement result on the i th remaining particles of ' The measure-resend attack Eve intercepts the particle of B S sent from Alice, measures it with the Z basis and sends the obtained state to Bob instead.When Alice enters into the REFLECT_A mode for the corresponding particle of A S and Bob enters into the REFLECT_B mode for the received particle, the attack behavior of Eve can be detected with the probability of 1 2 ; when Alice enters into the FLIP_A mode for the corresponding particle of A S and Bob enters into the REFLECT_B mode for the received particle, the attack behavior of Eve can be detected with the probability of 0; when Alice enters into the REFLECT_A mode for the corresponding particle of A S and Bob enters into the FLIP_B mode for the received particle, the attack behavior of Eve can be detected with the probability of 0; and when Alice enters into the FLIP_A mode for the corresponding particle of A S and Bob enters into the FLIP_B mode for the received particle, the attack behavior of Eve can be detected with the probability of 0. Because one particle of ' B S is chosen for security check with the probability of 1 2 , Eve's measure-resend attack on one particle of B S is detected with the probability of  Alice.The receiver can put a wavelength filter and a photon number splitter in front of her device to defeat Eve's invisible photon eavesdropping attack and delay-photon Trojan horse attack, respectively [12,13].

Discussion and conclusion
The communication efficiency of this protocol is evaluated by the qubit efficiency, which is defined as [2] k qc Here, k  is the number of secret bits established between Alice and Bob, q  is the number of , splits these Bell states into A S and B S , and keeps A S in her hand and sends the particles of B S to Bob one by one.When Alice entered into the FLIP_A mode for half particles of A S , she needs to produce N fresh qubits; and when Bob entered into the FLIP_B mode for half particles of B S , he also needs to produce N fresh qubits.
Hence, In addition, the comparison of this protocol and present SQKD protocols using Bell states without a third party [8,9,11] are made.The comparison results are shown in Table 2 for clarity.It is apparent from Table 2 that compared with the SQKD protocols in Refs.[8,9,11], this protocol has the highest qubit efficiency and has the merit that the reflecting operations of the classical user contribute to the generation of final shared key.
In summary, a novel SQKD protocol based on Bell state is put forward, in order to realize that quantum Alice establishes N secret bits together with classical Bob via quantum channel.Classical Bob needs to measure particles with the Z basis, produce fresh particles within the Z basis and send Bob enters into the FLIP_B mode.Here, j B C is the j th bit of B in the REFLECT_B mode, Bob returns the j th particle of B S to Alice enters into the FLIP_A mode.Here, j A C is the j th bit of A in the REFLECT_A mode, Alice does nothing on the j th particle of A S ;

BS
and requires Bob to publish his operation modes for the corresponding particles of B S .When Alice entered into the REFLECT_A mode for the corresponding particle of A S and Bob entered into the REFLECT_B mode for the corresponding particle of B S , Alice performs Bell basis measurement on the corresponding particles of ' A S and ' B S .When there is no eavesdropper, Alice's Bell basis measurement result should be same to the initial prepared state.When Alice entered into the REFLECT_A mode for the corresponding particle of A S and Bob entered into the FLIP_B mode for the corresponding particle of B S , Alice measures the corresponding particles of ' A S and ' B S with the Z basis and requires Bob to publish his Z basis measurement result on the corresponding particle of B S .When there is no eavesdropper, Alice's Z basis measurement results on the corresponding particles of ' A S and ' B S and Bob's Z basis measurement result on the corresponding particle of B S should be correctly related.When Alice entered into the FLIP_A mode for the corresponding particle of A S and Bob entered into the REFLECT_B mode for the corresponding particle of B S , Alice measures the corresponding particles of ' A S and ' B S with the Z basis.When there is no eavesdropper, Alice's Z basis measurement results on the corresponding particles of ' A S and ' B S should be correctly related.When Alice entered into the FLIP_A mode for the corresponding particle of A S and Bob entered into the FLIP_B mode for the corresponding particle of B S , Alice measures the corresponding particles of ' A S and ' B S with the Z basis and requires Bob to publish his Z basis measurement result on the corresponding particle of B S .When there is no eavesdropper, Alice's Z basis measurement results on the corresponding particles of ' A S and ' B S and Bob's Z basis measurement result on the corresponding particle of B S should be correctly related.

AS.
and N particles of ' B S left now.Alice performs Bell basis measurement on the i th remaining particles of ' According to her measurement result on the i th remaining particles of ' A S and ' B S and the corresponding initial prepared state, Alice obtains a classical bit i A when the corresponding initial prepared state is  + or  − and Alice's measurement result is  + or  − , The relationships among Alice's measurement result on the i th remaining particles of' ) The Trojan horse attack Alice sends the particles of B S to Bob; after his operations, Bob sends the particles of ' B S to consumed qubits and c is the number of consumed classical bits via classical communication.Here disregards the classical resources consumed during security check processes.In this protocol, the number of secret bits established between Alice and Bob is N , so k N  = .Alice produces 2N Bell states randomly in the four states  

Table 1 .
According to Table 1, it is easy to get that i