- Email: [email protected]
Comment on: “Quantum exam” [Phys. Lett. A 350 (2006) 174]
Physics Letters A 360 (2007) 746–747 www.elsevier.com/locate/pla
Comment
Comment on: “Quantum exam” [Phys. Lett. A 350 (2006) 174] Jie Song, Shou Zhang ∗ Department of Physics, College of Science, Yanbian University, Yanji, Jilin 133002, PR China Received 20 March 2006; received in revised form 20 June 2006; accepted 4 August 2006 Available online 17 August 2006 Communicated by P.R. Holland
Abstract In the Letter [B.A. Nguyen, Phys. Lett. A 350 (2006) 174], a quantum exam protocol was presented. Here we show a cheating protocol, by which any student can get the other students’ solution without being detected. Then we propose a possible modified protocol against this attacking strategy. © 2006 Elsevier B.V. All rights reserved. PACS: 03.67.Hk; 03.65.Ud Keywords: Entanglement; CNOT operation
Recently, Nguyen [1] proposed an interesting quantum exam protocol by using multipartite GHZ states as quantum channel. In his protocol, a teacher Alice organizes an important exam with her remote students Bob 1, Bob 2, . . . , Bob N . There are two confidentiality constraints in this exam. One is that any outsider should not access the exam’s whole content, and the other is that Bob n cannot eavesdrop the N − 1 remaining Bobs’ solution without being detected. However, this study points out that if Bob n is not honest, he can gain the N − 1 remaining Bobs’ solution in the two protocols [1]. In other words, any Bob can cheat in this quantum exam without a track left behind. Now let us give a brief review of Naguyen’s protocol. For convenience, we use the same notations as in Ref. [1]. (1) Alice prepares a large number of GHZ states in the form 1 |Ψm = √ |0, 0, 0, . . . , 0 + |1, 1, 1, . . . , 1 a 1 2 ...N . m m m m 2
(1)
If these qubits are used in the process of solution-collecting process, Alice randomly performs a unitary operation |01| + DOI of original article: 10.1016/j.physleta.2005.09.071. * Corresponding author.
E-mail address: [email protected] (S. Zhang). 0375-9601/$ – see front matter © 2006 Elsevier B.V. All rights reserved. doi:10.1016/j.physleta.2006.08.019
|10| or |00| + |11| on each qubit to transfer the state |Ψm into |Φm . (2) Alice keeps qubit am and sends qubits 1m , 2m , . . . , Nm to Bob 1, Bob 2, . . . , Bob N , respectively. After all the Bobs receive their own qubits, Alice randomly choose a subset |Ψl (|Φl ) form the shared |Ψm (|Φm ). For each state of the subset Alice measures her qubit randomly in Bz or in Bx = {|+, |−} with |± = √1 (|0 ± |1). Then she asks every Bob to measure 2 their qubits in the same basis as hers. (3) Alice requires each Bob to publicly reveal the outcome of each his measurement and makes an error analysis. If the error rate exceeds a predetermined small value, Alice tells Bobs to restart the whole process, otherwise they record the order of the remaining shared |ψm -states (|Φm ) and perform the problem-giving process (4)–(6) or the problem-collecting process (4 )–(6 ). The problem-giving process (4) For a given m, Alice measures her qubit am in the basis Bz = {|0, |1}, then asks Bobs to do so with qubits nm . All the parties obtain the same outcome jmz where jmz = 0 (jmz = 1) if they find |0 (|1). (5) Alice publicly broadcasts the value xm = qm ⊕ jmz (“⊕” denotes an addition mod 2).
J. Song, S. Zhang / Physics Letters A 360 (2007) 746–747
(6) Each Bob decodes Alice’s secret bit as qm = xm ⊕ jmz . The solution-collecting process (4 ) For a given m, Alice measures her qubit am in Bz with the outcome jazm = {0, 1}, then asks Bobs to do so with their qubits nm with the outcome jnzm = {0, 1}. (5 ) Each Bob n publicly announces the value ynm = rnm ⊕ z jnm . (6 ) Alice decodes the solution of Bob n as rnm = ynm ⊕ [δ0,snm jam + δ1,snm (jam + 1)]. Now let us describe our cheating strategy in the solutioncollecting process. Suppose Bob N is not honest, that is he wants to gain the ith Bob’s solution. For convenience, the original state can be expressed as 1 |Φm = √ 0, jm1 , jm2 , . . . , jmN 2 + 1, jm1 ⊕ 1, jm2 ⊕ 1, . . . jmN ⊕ 1 a
m 1m 2m ...Nm
,
(2)
(jmn ∈ {0, 1} and |jmn is the state of Bob n’s qubit) (1) When Alice sends qubit 1m , 2m , . . . , Nm to Bob 1, Bob 2, . . . , Bob N in the step 2 of the solution-collecting process, Bob N intercepts Bob i’s qubit. Bob N has prepared a qubit e in state |0 as his ancilla. He performs a CNOT operation Cim ,e on Bob i’s qubit im and his ancilla e (“im ” is the control bit and “e” is the target bit). The whole system’s state will be converted into 1 |Φm = √ 0, jm1 , . . . , jmN , jmi 2 + 1, jm1 ⊕ 1, . . . , jmN ⊕ 1, jmi ⊕ 1 a 1 ...N e , (3) m m
m
then Bob N performs a CNOT operation CNm ,e . The state of these qubits can be described by 1 |Φm = √ 0, jm1 , jm2 . . . jmN 2 + 1, jm1 ⊕ 1, jm2 ⊕ 1, . . . jmN ⊕ 1 a 1 2 ...N m m m m i N ⊗ jm ⊕ jm e .
747
Alice makes an eavesdropping check. All the other legitimate users can still get the correct result, when they perform the step (5 )–(6 ). If Bob N prepares N − 1 ancilla, he can gain N − 1 solutions from the remaining N − 1 Bobs. The similar case happens for the direct-collecting process. So we conclude that the solution-collecting process is not secure. We modify the |Φm sharing process as follows. (1 ) Alice prepares a large enough number of states {|Ψm } (group 1) and {|χm } (group 2). Each qubit in group 2 is randomly in one of four polarized single states |0, |1, |+ and |−. We call these qubits in group 2 checking qubits. Alice randomly sends N qubits in group 1 or 2 to all Bobs. If Alice sends these qubits in group 1, she keeps qubit am and sends qubits 1m , 2m , . . . , Nm to Bob 1, Bob 2, . . . , Bob N , respectively. Or else she sends group 2 qubits to all Bobs. (2 ) After all Bobs receive their own qubits, Alice announces which qubits are checking qubits. She tells all Bobs the position and the measuring-basis for each qubit of the group 2 . All Bobs measure their checking qubits in the same measuring-basis as hers, respectively. (3 ) Alice requires each Bob to publicly reveal the outcome of each his measurement. She analyzes the error rate of checking qubits. If the error rate is lower than a predetermined small value, the group 1’s qubits can be used for the solutioncollecting process, otherwise they restart from the step (1 ). In the protocol above, we present a |Φm -sharing process. To prevent Eve from eavesdropping, we introduce some checking qubits which are randomly in one of four polarized single states. Bob N cannot eavesdrop the other Bobs’ information by his ancilla without being detected. For example, Bob i’s checking qubit (im ) is in the state |+. Bob N ’s qubit (Nm ) is in |1Nm . When Bob N intercepts the qubit im and performs CNOT operations Cim ,e CNm ,e (“e” is Bob N ’s ancilla). These qubits’ state will be converted into √1 (|0, 1 + |1, 0)im ,e ⊗ |1Nm . It is easy 2
(4)
It can be seen from Eq. (4) that the qubit e has been disentangled from the N + 1-partite GHZ state. (2) In step (4 ), for a given m Alice measures her qubit am in Bz . Then Bob N also measures her qubit Nm and ancilla e in Bz , he can get Bob i’s outcome jizm according to jizm = jezm ⊕ jnzm . When Bob i publicly broadcasts the value yim = rim ⊕ jizm , Bob N know Bob i’s solution rim . Through above eavesdropping strategy, Bob N can get useful information without being detected, because his ancilla e has been disentangled form the N + 1-partite GHZ state before
to calculate that ρim = ρe = 12 I . After Bob N measures his ancilla, Bob i will possible get wrong measurement result. They will find there is Eve in quantum channel, when Alice publicly announces those checking qubits’ measurement result. In summary, we have shown if one of the students (Bob N ) is not honest in this quantum exam, he can get the other students’ solution by his ancilla without being detected. Furthermore, we also present a possible repairing to improve the security of quantum exam protocol against this kind of attacking. References [1] B.A. Nguyen, Phys. Lett. A 350 (2006) 174.
Comment
Comment on: “Quantum exam” [Phys. Lett. A 350 (2006) 174] Jie Song, Shou Zhang ∗ Department of Physics, College of Science, Yanbian University, Yanji, Jilin 133002, PR China Received 20 March 2006; received in revised form 20 June 2006; accepted 4 August 2006 Available online 17 August 2006 Communicated by P.R. Holland
Abstract In the Letter [B.A. Nguyen, Phys. Lett. A 350 (2006) 174], a quantum exam protocol was presented. Here we show a cheating protocol, by which any student can get the other students’ solution without being detected. Then we propose a possible modified protocol against this attacking strategy. © 2006 Elsevier B.V. All rights reserved. PACS: 03.67.Hk; 03.65.Ud Keywords: Entanglement; CNOT operation
Recently, Nguyen [1] proposed an interesting quantum exam protocol by using multipartite GHZ states as quantum channel. In his protocol, a teacher Alice organizes an important exam with her remote students Bob 1, Bob 2, . . . , Bob N . There are two confidentiality constraints in this exam. One is that any outsider should not access the exam’s whole content, and the other is that Bob n cannot eavesdrop the N − 1 remaining Bobs’ solution without being detected. However, this study points out that if Bob n is not honest, he can gain the N − 1 remaining Bobs’ solution in the two protocols [1]. In other words, any Bob can cheat in this quantum exam without a track left behind. Now let us give a brief review of Naguyen’s protocol. For convenience, we use the same notations as in Ref. [1]. (1) Alice prepares a large number of GHZ states in the form 1 |Ψm = √ |0, 0, 0, . . . , 0 + |1, 1, 1, . . . , 1 a 1 2 ...N . m m m m 2
(1)
If these qubits are used in the process of solution-collecting process, Alice randomly performs a unitary operation |01| + DOI of original article: 10.1016/j.physleta.2005.09.071. * Corresponding author.
E-mail address: [email protected] (S. Zhang). 0375-9601/$ – see front matter © 2006 Elsevier B.V. All rights reserved. doi:10.1016/j.physleta.2006.08.019
|10| or |00| + |11| on each qubit to transfer the state |Ψm into |Φm . (2) Alice keeps qubit am and sends qubits 1m , 2m , . . . , Nm to Bob 1, Bob 2, . . . , Bob N , respectively. After all the Bobs receive their own qubits, Alice randomly choose a subset |Ψl (|Φl ) form the shared |Ψm (|Φm ). For each state of the subset Alice measures her qubit randomly in Bz or in Bx = {|+, |−} with |± = √1 (|0 ± |1). Then she asks every Bob to measure 2 their qubits in the same basis as hers. (3) Alice requires each Bob to publicly reveal the outcome of each his measurement and makes an error analysis. If the error rate exceeds a predetermined small value, Alice tells Bobs to restart the whole process, otherwise they record the order of the remaining shared |ψm -states (|Φm ) and perform the problem-giving process (4)–(6) or the problem-collecting process (4 )–(6 ). The problem-giving process (4) For a given m, Alice measures her qubit am in the basis Bz = {|0, |1}, then asks Bobs to do so with qubits nm . All the parties obtain the same outcome jmz where jmz = 0 (jmz = 1) if they find |0 (|1). (5) Alice publicly broadcasts the value xm = qm ⊕ jmz (“⊕” denotes an addition mod 2).
J. Song, S. Zhang / Physics Letters A 360 (2007) 746–747
(6) Each Bob decodes Alice’s secret bit as qm = xm ⊕ jmz . The solution-collecting process (4 ) For a given m, Alice measures her qubit am in Bz with the outcome jazm = {0, 1}, then asks Bobs to do so with their qubits nm with the outcome jnzm = {0, 1}. (5 ) Each Bob n publicly announces the value ynm = rnm ⊕ z jnm . (6 ) Alice decodes the solution of Bob n as rnm = ynm ⊕ [δ0,snm jam + δ1,snm (jam + 1)]. Now let us describe our cheating strategy in the solutioncollecting process. Suppose Bob N is not honest, that is he wants to gain the ith Bob’s solution. For convenience, the original state can be expressed as 1 |Φm = √ 0, jm1 , jm2 , . . . , jmN 2 + 1, jm1 ⊕ 1, jm2 ⊕ 1, . . . jmN ⊕ 1 a
m 1m 2m ...Nm
,
(2)
(jmn ∈ {0, 1} and |jmn is the state of Bob n’s qubit) (1) When Alice sends qubit 1m , 2m , . . . , Nm to Bob 1, Bob 2, . . . , Bob N in the step 2 of the solution-collecting process, Bob N intercepts Bob i’s qubit. Bob N has prepared a qubit e in state |0 as his ancilla. He performs a CNOT operation Cim ,e on Bob i’s qubit im and his ancilla e (“im ” is the control bit and “e” is the target bit). The whole system’s state will be converted into 1 |Φm = √ 0, jm1 , . . . , jmN , jmi 2 + 1, jm1 ⊕ 1, . . . , jmN ⊕ 1, jmi ⊕ 1 a 1 ...N e , (3) m m
m
then Bob N performs a CNOT operation CNm ,e . The state of these qubits can be described by 1 |Φm = √ 0, jm1 , jm2 . . . jmN 2 + 1, jm1 ⊕ 1, jm2 ⊕ 1, . . . jmN ⊕ 1 a 1 2 ...N m m m m i N ⊗ jm ⊕ jm e .
747
Alice makes an eavesdropping check. All the other legitimate users can still get the correct result, when they perform the step (5 )–(6 ). If Bob N prepares N − 1 ancilla, he can gain N − 1 solutions from the remaining N − 1 Bobs. The similar case happens for the direct-collecting process. So we conclude that the solution-collecting process is not secure. We modify the |Φm sharing process as follows. (1 ) Alice prepares a large enough number of states {|Ψm } (group 1) and {|χm } (group 2). Each qubit in group 2 is randomly in one of four polarized single states |0, |1, |+ and |−. We call these qubits in group 2 checking qubits. Alice randomly sends N qubits in group 1 or 2 to all Bobs. If Alice sends these qubits in group 1, she keeps qubit am and sends qubits 1m , 2m , . . . , Nm to Bob 1, Bob 2, . . . , Bob N , respectively. Or else she sends group 2 qubits to all Bobs. (2 ) After all Bobs receive their own qubits, Alice announces which qubits are checking qubits. She tells all Bobs the position and the measuring-basis for each qubit of the group 2 . All Bobs measure their checking qubits in the same measuring-basis as hers, respectively. (3 ) Alice requires each Bob to publicly reveal the outcome of each his measurement. She analyzes the error rate of checking qubits. If the error rate is lower than a predetermined small value, the group 1’s qubits can be used for the solutioncollecting process, otherwise they restart from the step (1 ). In the protocol above, we present a |Φm -sharing process. To prevent Eve from eavesdropping, we introduce some checking qubits which are randomly in one of four polarized single states. Bob N cannot eavesdrop the other Bobs’ information by his ancilla without being detected. For example, Bob i’s checking qubit (im ) is in the state |+. Bob N ’s qubit (Nm ) is in |1Nm . When Bob N intercepts the qubit im and performs CNOT operations Cim ,e CNm ,e (“e” is Bob N ’s ancilla). These qubits’ state will be converted into √1 (|0, 1 + |1, 0)im ,e ⊗ |1Nm . It is easy 2
(4)
It can be seen from Eq. (4) that the qubit e has been disentangled from the N + 1-partite GHZ state. (2) In step (4 ), for a given m Alice measures her qubit am in Bz . Then Bob N also measures her qubit Nm and ancilla e in Bz , he can get Bob i’s outcome jizm according to jizm = jezm ⊕ jnzm . When Bob i publicly broadcasts the value yim = rim ⊕ jizm , Bob N know Bob i’s solution rim . Through above eavesdropping strategy, Bob N can get useful information without being detected, because his ancilla e has been disentangled form the N + 1-partite GHZ state before
to calculate that ρim = ρe = 12 I . After Bob N measures his ancilla, Bob i will possible get wrong measurement result. They will find there is Eve in quantum channel, when Alice publicly announces those checking qubits’ measurement result. In summary, we have shown if one of the students (Bob N ) is not honest in this quantum exam, he can get the other students’ solution by his ancilla without being detected. Furthermore, we also present a possible repairing to improve the security of quantum exam protocol against this kind of attacking. References [1] B.A. Nguyen, Phys. Lett. A 350 (2006) 174.