Optics Communications 284 (2011) 3160–3163

Contents lists available at ScienceDirect

Optics Communications

j ourna l homepage: www.e lsev ie r.com/ locate /optcom

An efficient protocol for the quantum private comparison of equality with W state

Wen Liu ⁎, Yong-Bin Wang, Zheng-Tao JiangSchool of Computer Science, Communication University of China, Beijing 100024, China

⁎ Corresponding author.E-mail address: lw8206@gmail.com (W. Liu).

0030-4018/$ – see front matter. Crown Copyright © 20doi:10.1016/j.optcom.2011.02.017

a b s t r a c t

a r t i c l e i n f o

Article history:Received 12 October 2010Received in revised form 5 February 2011Accepted 9 February 2011Available online 26 February 2011

Keywords:Quantum private comparisonW stateSingle-particle measurementCorrectnessSecurity

We propose an efficient quantum protocol for comparing the equal information with the help of a semi-honest third party (TP). Our protocol utilizes the triplet W states and the single-particle measurement. Aprecise proof of security of the protocol is presented. The security of this protocol with respect to various kindsof outside attacks is discussed. Outside eavesdroppers cannot learn any information about the privateinformation. The security of this protocol with respect to various kinds of party attacks is also discussed. Oneparty cannot learn any information about the other's private information. The TP cannot learn any informationabout the private information, even about the comparison result or the length of secret inputs.

Crown Copyright © 2011 Published by Elsevier B.V. All rights reserved.

1. Introduction

In the last decade many interesting applications have beendeveloped based on quantum information, such as quantum keydistribution (QKD) [1–8], quantum secret sharing (QSS) and authen-tication [9–17], quantum secure direction communication (QSDC)[18–23], quantum teleportation [24–26], and so on. Secure multi-party computation (SMC) deals with computing a function on secretinputs in a distributed network where each party holds one of thesecret inputs, and that no more information is revealed to a party inthe computation than can be inferred from that party's input andoutput. In theory, the general SMC problem can be solved by circuitcluster, but Goldreich pointed out [27,28] that the general solution forspecial SMC problem is impractical and special solution for specialSMC problem should be developed for efficiency reasons. At present,the research on special SMC problem is of great interest in classicalsetting [29]. And in [30], Shor pointed out that SMC tasks can beperformed more efficiently by models based on quantum setting thanthose based on classical setting. This viewpoint leads us to explore thespecial SMC problems based on quantum information. Recently manyspecial SMC problems have been solved in quantum setting, such assecure multiparty quantum summation [31], quantum protocols foranonymous voting and surveying [32], etc.

The problem for private comparison of equality or socialistmillionaires' problem [33] is an important special SMC problem.Two millionaires want to know whether they happen to be equallyrich, but neither millionaire wants to simply disclose its wealth

11 Published by Elsevier B.V. All rig

information to the other. It's an extended problem of the millionaire'sproblem, introduced by Yao [34,35] in which two millionaires wish tocompare their riches to determine who is richer without disclosingany information about their riches to each other. The problem forprivate comparison of equality based on classical cryptography wasstudied in [36–39] and they cannot withstand powerful quantumcomputers. Recently, Yang et al. [40] proposed an efficient quantumprivate comparison protocol based on the decoy photon and two-photon entangled Einstein–Podolsky–Rosen (EPR) pairs. Yang'sprotocol included a dishonest TP. Chen et al. [41] proposed a newprotocol for dealing with the private comparison of equal informationbased on the triplet entangled states Greenberger–Horne–Zeilinger(GHZ). This protocol included a semi-honest TP. Chen et al. alsopointed out that other entanglement carrier, such as non-maximallyentanglement state, W state, can also be further considered for theprivate comparison of equal information.

In this paper, following some ideas of the quantum computationprotocols [19,30,40,41], we propose a new protocol for dealing withthe private comparison of equal information based on the W state1ffiffi3

p j100⟩ + j010⟩ + j001⟩ð Þ. Similar to some previous protocols[40,41], our protocol includes a third party, i.e., TP. The role of TP isonly to do some calculations. By comparison, this protocol has its ownadvantages. TheW state is more robust against loss of any single qubitthan GHZ state. The parties are only required to carry out the simplersingle-particle measurement instead of the two-particle Bell-basismeasurement. The TP cannot learn anything about the privateinformation, even about the comparison result or the length of secretinputs. And we also use the block transmission method to send qubitsin a batch by batch way, which was proposed in [18].

The structure of this paper is as follows: we propose an efficientquantum private comparison for equal information protocol in

hts reserved.

3161W. Liu et al. / Optics Communications 284 (2011) 3160–3163

Section 2 and we analyze the security of this protocol in Section 3. Abrief discussion and the concluding summary are given in Section 4.

2. The quantum private comparison of equal information

The following protocol allows two parties, Alice and Bob, todetermine whether their private information X and Y are equal, butexcept the result Bob learns nothing about X and Alice learns nothingabout Y.

The protocol for quantum private comparison of equal informationis described as follow:

Input: Alice has a private information X, Bob has a private informa-tionY. Thebinary representationsofX andY in F2N are (x0,x1,…,xN−1),(y0,y1,…,yN−1), where xi,yi∈{0,1}; X=∑ i=0

N−1xi2i, Y=∑ i=0N−1yi2i;

2N−1≤max{x,y}≤2N.Output: X=Y or X≠Y;The third party: Calvin.

Supposed that two parties, Alice and Calvin, use a QKD protocol toestablish a common secret key KAC and two parties, Bob and Calvin,use a QKD protocol to establish a common secret key KBC.

(1) Two parties, Alice and Bob, agree that |01⟩, |10⟩, |1⟩ representinformation 1; |00⟩, |0⟩ represent information 0.

(2)Alice and Bob share two groups of triplet W states. Sharing agroup of triplet W states could follow the way in [16].

Alice (Bob) prepares N three-qubit W states, each of which israndomly in one of the two states:

jΦ1⟩ =1ffiffiffi3

p j100⟩ + j010⟩ + j001⟩ð Þ123; ð1Þ

jΦ2⟩ =1ffiffiffi3

p j10 + ⟩ + j01 + ⟩ + j00−⟩ð Þ123; ð2Þ

where 1, 2 and 3 represent the three particles of W state. We denotethe ordered N three qubits W states prepared by Alice (Bob) with:

PA0 1;2;3ð Þ; P A

1 1;2;3ð Þ;…; PAN−1 1;2;3ð Þ

h iP B0 1;2;3ð Þ; PB

1 1;2;3ð Þ;…; PBN−1 1;2;3ð Þ

h i� � ð3Þ

(hereafter called SA(SB) sequence), where the subscript indicates theorder of the state in W sequence. Alice (Bob) takes particles 1 and 2from each state in SA(SB) to form an ordered particle sequence:

PA0 1;2ð Þ; PA

1 1;2ð Þ;…; PAN−1 1;2ð Þ

h iP B0 1;2ð Þ; PB

1 1;2ð Þ;…; P BN−1 1;2ð Þ

h i� �;

ð4Þ

which is called S1A(S1B) sequence. The remaining partner particles in

SA(SB)

PA0 3ð Þ; PA

1 3ð Þ;…; PAN−1 3ð Þ

h iP B0 3ð Þ; P B

1 3ð Þ;…; P BN−1 3ð Þ

h i� �;

ð5Þ

which is called S2A(S2B) sequence.

Alice (Bob) performs operation I or U on the particle 3 sequenceS2A(S2B) according to (x0,x1,…,xN−1)((y0,y1,…,yN−1)).

I = j0⟩⟨0 j + j1⟩⟨1 j = 1 00 1

� �

U = j0⟩⟨1 j + j1⟩⟨0 j = 0 1−1 0

� � ð6Þ

For i=0 to N−1, do:If xi(yi)=0, Alice (Bob) performs operation I on P i

A(3)(P iB(3)); If

xi(yi)=1, Alice (Bob) performs operation U on P iA(3)(P i

B(3)).Alice (Bob) prepares N′ three-qubit W states, each of which is

randomly in one of the two states:

jΦ1⟩ =1ffiffiffi3

p j100⟩ + j010⟩ + j001⟩ð Þ123; ð7Þ

jΦ2⟩ =1ffiffiffi3

p j10 + ⟩ + j01 + ⟩ + j00−⟩ð Þ123; ð8Þ

where 1, 2 and 3 represent the three particles of W state. We denotethe ordered N′ three qubits W states prepared by Alice (Bob) with:

P A′0 1;2;3ð Þ; P A′

1 1;2;3ð Þ;…; P A′N′−1 1;2;3ð Þ

h iP B′0 1;2;3ð Þ; P B′

1 1;2;3ð Þ;…; PB′N′−1 1;2;3ð Þ

h i� � ð9Þ

(hereafter called SA′(SB′) sequence), where the subscript indicates theorder of the state in W sequence. Alice (Bob) takes particles 1 and 2from each state in SA′(SB′) to form an ordered particle sequence:

PA′0 1;2ð Þ; PA′

1 1;2ð Þ;…; PA′N′−1 1;2ð Þ

h iPB′0 1;2ð Þ; PB′

1 1;2ð Þ;…; PB′N′−1 1;2ð Þ

h i� �;

ð10Þ

which is called S1A′(S1B′) sequence. The remaining partner particles in

SA′(SB′)

PA′0 3ð Þ; PA′

1 3ð Þ;…; PA′N′−1 3ð Þ

h iPB′0 3ð Þ; PB′

1 3ð Þ;…; PB′N′−1 3ð Þ

h i� �;

ð11Þ

which is called S2A′(S2B′) sequence.

Alice inserts P iA′(1,2,3) of SA′ into SA and sends the insert positions

sequence Sq1 to Bob. This new sequence is denoted by SA″. Bob inserts PiB′

(1,2,3) of SB′ into SB according to Sq1. Thisnewsequence is denotedby SB″.Alice (Bob) takes particles 1 and 2 from each state in SA″(SB″) to

form an ordered particle sequence:

PA″0 1;2ð Þ; P A″

1 1;2ð Þ;…; PA″N + N′−1 1;2ð Þ

h iPB″0 1;2ð Þ; PB″

1 1;2ð Þ;…; P B″N + N′−1 1;2ð Þ

h i� �;

ð12Þ

which is called S1A″(S1B″) sequence. The remaining partner particles in

SA″(SB″)

P A″0 3ð Þ; P A″

1 3ð Þ;…; PA″N + N′−1 3ð Þ

h iPB″0 3ð Þ; P B″

1 3ð Þ;…; PB″N + N′−1 3ð Þ

h i� �;

ð13Þ

which is called S2A″(S2B″) sequence.

After doing these, Alice (Bob) sends S2A″(S2B″) to Bob (Alice).Alice (Bob) announces publicly the initial states SA″(SB″). If the

initial state is |Φ1⟩, Bob (Alice) has nothing to do; If the initial state is|Φ2⟩, Bob(Alice) performs Hadamard operation on S2

B″(S2A″).Both Alice and Bobmake single-particle measurement on SA′ in the

basis {|0⟩, |1⟩}. Alice lets Bob announce his measurement resultpublicly. The measurement results of the communication parties arecompletely correlated. If Alice's result is |10⟩ or |01⟩ (|00⟩), Bob'sresult should be |0⟩(|1⟩). Alice can then evaluate the error rate duringthe transmission of S2

A′ sequence. If the error rate exceeds thethreshold they preset, they abort the scheme. Otherwise, theycontinue to the next step.

Table 1All different cases of xi,yi's values.

xi yi MiA1(Mi

B2) MiA2(Mi

B1) CiA1(CiB2) Ci

A CiA2(CiB1) Ci

B Ci

0 0 |01⟩ or |10⟩(|0⟩) |0⟩(|01⟩ or |10⟩) 1(0) 1 0(1) 1 0|01⟩ or |10⟩(|1⟩) |0⟩(|00⟩ 1(1) 0 0(0) 0 0|00⟩(|0⟩) |1⟩(|01⟩ or |10⟩ 0(0) 0 1(1) 0 0|00⟩(|1⟩) |1⟩(|00⟩ 0(1) 1 1(0) 1 0

0 1 |01⟩ or |10⟩(|1⟩) |0⟩(|01⟩ or |10⟩) 1(1) 0 0(1) 1 1|01⟩ or |10⟩(|0⟩) |0⟩(|00⟩ 1(0) 1 0(0) 0 1|00⟩(|0⟩) |1⟩(|00⟩ 0(0) 0 1(0) 1 1|00⟩(|1⟩) |1⟩(|01⟩ or |10⟩) 0(1) 1 1(1) 0 1

1 0 |01⟩ or |10⟩(|0⟩) |1⟩(|01⟩ or |10⟩) 1(0) 1 1(1) 0 1|00⟩(|0⟩) |0⟩(|01⟩ or |10⟩) 0(0) 0 0(1) 1 1|00⟩(|1⟩) |0⟩(|00⟩ 0(1) 1 0(0) 0 1|01⟩ or |10⟩(|1⟩) |1⟩(|00⟩ 1(1) 0 1(0) 1 1

1 1 |01⟩ or |10⟩(|1⟩) |1⟩(|01⟩ or |10⟩) 1(1) 0 1(1) 0 0|01⟩ or |10⟩(|0⟩) |1⟩(|00⟩ 1(0) 1 1(0) 1 0|00⟩(|1⟩) |0⟩(|01⟩ or |10⟩ 0(1) 1 1(1) 1 0|00⟩(|0⟩) |0⟩(|00⟩ 0(0) 0 0(0) 0 0

3162 W. Liu et al. / Optics Communications 284 (2011) 3160–3163

Using the same method, Both Alice and Bob make single-particlemeasurement on SB′ in the basis {|0⟩, |1⟩}. Bob can then evaluate theerror rate during the transmission of S2B′ sequence. If the error rateexceeds the threshold they preset, they abort the scheme. Otherwise,they continue to the next step.

(3) Alice (Bob) makes single-particle measurement in the basis{|0⟩, |1⟩} on the particles sequences S1

A,S2B(S1B,S2A).For i=0 to N−1:If Alice (Bob)measures Pi

A(1,2)(PiB(1,2)) and the outcomeMi

A1(MiB1)

is |01⟩ or |10⟩, CiA1(Ci

B1)=1; If Alice (Bob) measures PiA(1,2)(Pi

B(1,2))and the outcomeMi

A1(MiB1) is |00⟩, Ci

A1(CiB1)=0.

If Alice (Bob)measures P iB(3)(P i

A(3)) and the outcomeMiB2(Mi

A2) is|1⟩, Ci

B2(CiA2)=1; If Alice (Bob) measures PiB(3)(PiA(3)) and the

outcome MiB2(Mi

A2) is |0⟩, C iB2(C i

A2)=0.Alice (Bob) calculates C i

A=C iA1⊕C i

B2(C iB=C i

B1⊕C iA2), where the

symbol ⊕ denotes the module 2 addition.After doing these, Alice (Bob) gets a binary sequence CA=(C0A,C1A,…,

CN1

A ) (CB=(C0B,C1

B,…,CN1

B )).(4) Alice (Bob) chooses a L-length random sequenceCA′=(C0A′,C1A′,…,

CL−1A′ )(C′B=(C0B′,C1B′,…,CL−1

B′ )), where CiA′,Ci

B′∈{0,1}, i=0,…,L−1. Alice(Bob) sends CA′(CB′) to Bob (Alice).

Alice inserts CiA′(i=0,…,L−1) of CA′ into the binary sequence CA

and gets a new (N+L)− length binary sequence denoted by CA″. Alicealso records the insert position and sends the insert positionssequence Sq to Bob. Bob inserts C i

B′(i=0,…,L−1) of CB′ into thebinary sequence CB according to Sq and gets a new (N+L)− lengthbinary sequence denoted by CB″. Alice (Bob) uses quantum-one-timepad and KAC(KBC) to encrypt the new binary sequence CA″(CB″) andgets E(CA″)(E(CB″)). Alice (Bob) sends E(CA″)(E(CB″)) to the third party,Calvin.

(5) After using KAC,KBC to decrypt E(CA″),E(CB″) and getting CA″,CB″,Calvin calculates:

R′ = ∑N−1i=0 C A

i ⊕CBi

� �+ ∑L−1

i=0 CA′i ⊕CB′

i

� �: ð14Þ

Calvin sends R′ to Alice and Bob.(6) After receiving CA′,CB′,R′, Alice and Bob calculates:

R = R′−∑L−1i = 0 CA′

i ⊕ CB′i

� �: ð15Þ

If R=0, Alice and Bob gets X=Y; otherwise X≠Y.In order to improve the efficiency of the protocol, Alice and Bob can

follow some ideas in [34] to deal with their two private information. Aliceand Bob divide their binary strings (x0,x1,…,xN−1),(y0,y1,…,yN−1) byway of L(LN1) bits as a group. These groups are denoted by

A1;A2;…A NL

� �+1

!; B1;B2;…;B N

L

� �+1

!. They can use our protocol to

compare two groups Ai,Bi belonged to Alice and Bob respectively. IfAi≠Bi, they can terminate the comparison and know X≠Y; otherwisethey have to continue to compare others groups.

3. Analysis

3.1. Correctness

In this section, we show that the output of our protocol is correct.Alice has a private information X, Bob has a private information Y.The binary representations of X and Y in F2N are (x0,x1,…,xN−1),(y0,y1,…,yN−1), where xi,yi∈{0,1}; X=∑ i=0

N−1xi2i,Y=∑ i=0N−1yi2i; 2N−1≤

max{x,y}≤2N.For i=0 to N−1, Alice and Bob useW state P i

A(1,2,3),P iB(1,2,3) to

compare whether xi,yi are equal. All different cases of xi,yi's valuesare shown in Table 1. We denotes Alice's measurement outcomesof P i

A(1,2),P iB(3) as Mi

A1,MiB2 and Bob's measurement outcomes of

P iA(3),P i

B(1,2) as MiA2, Mi

B1. The codings of MiA1,Mi

B2 are denoted as

C iA1,C i

B2 and the codings of MiA2,Mi

B1 are denoted as C iA2,C i

B1. Theresults of C i

A1⊕C iB2,C i

A2⊕C iB1 are denoted as C i

A,C iB, which are send

to Calvin. After doing C iA⊕C i

B which is denoted by Ci, Calvin getsthe result of the comparison between xi,yi. If Ci=0, then xi=yi;otherwise xi≠yi.

We have to point out that in order not to leak the comparing resultof X,Y to Calvin, Alice and Bob inserts some random into theirsequences of C i

A,C iB. After eliminating the effect of these random, Alice

and Bob can get the result R=∑ i=0L−1(CiA′⊕ Ci

B′). If R=0, Alice and Bobgets X=Y; otherwise X≠Y.

3.2. Security

Firstly, we show that the outside attack is invalid to our protocol.Secondly, we show that the two dishonest parties, Alice and Bob,cannot get any information about the private information of eachother and the semi-honest third party, Calvin, cannot get anyinformation about the private information of Alice and Bob, evenabout the length of X,Y or the comparison result of X,Y.

3.2.1. Outside attackWe analyze the possibility of the outside eavesdropper to get

information about X and Y in every step of protocol.In step 1, 3, and 6, there is not any information to transfer. In step

2, the outside eavesdropper can attack the quantum channel whenAlice and Bob share two groups of triplet W states. These two groupsof triplet W states are not leaked to an unauthorized user. It wasshown in [23] that outside eavesdropper's several kinds of attacks,such as the intercept-resend attack, the collective attack, weredetected with nonzero probability during the security checkingprocess and the protocol was secure with a noise quantum channel.In step 4, Alice and Bob send the new binary sequences CA″,CB″ to thethird party, Calvin, through the secure channels. The outsideeavesdropper can eavesdrop anything from these two channels. Instep 5, Calvin sends R′ to Alice and Bob. Because there is a part ofrandom in R′, outside eavesdropper cannot get the comparing result.So in every step of our protocol, the outside eavesdropper cannot getany information X and Y.

3.2.2. Party attackWe analyze the possibility of the three parties to get information

about X and Y in our protocol. Because the role of Alice is same as thatof Bob, we firstly analyze the case that Alice wants to learn Bob'sprivate information Y. Secondly, we analyze the case that the thirdparty, Calvin, wants to learn the private information X,Y.

3163W. Liu et al. / Optics Communications 284 (2011) 3160–3163

Case 1. Alice wants to learn Bob's private information Y.

Alice can only infer Bob's private information from the measure-ment Mi

B2 of PiB(3) which is in Alice's hand and C iB which is send from

Bob to Calvin. PiB(3) is shared by Bob. Bob shares the ith tripletW state

PiB(1,2,3) and performs operation I or U on the particle 3 P i

B(3)according to yi. No matter that yi is 0 or 1, Alice's measurementoutcome of Pi

B(3) is |0⟩ or |1⟩. Because these measurement resultshave the same probability which is shown in Table 1, Alice cannotinfer any information about Bob's private information yi from themeasurement outcome of P i

B(3). C iB is send through the secure

channels from Bob to Calvin and Alice cannot eavesdrop anyinformation about C i

B. So she cannot get any information aboutBob's private information.

We can use the same method to analyze that Bob cannot learn anyinformation about Alice's private information X.

Case 2. Calvin wants to learn the private information X,Y.

Calvin can only infer private information X,Y from CA″,CB″. BecauseAlice and Bob insert some confusion random, Calvin cannot find outwhich number is related to X,Y in CA″,CB″. So Calvin cannot learn theprivate information X,Y, even about the comparison result of xi,yi andthe length of X,Y.

4. Discussion and conclusions

In summary, we propose a new quantum private comparisonprotocol based on the triplet W states and the single-particlemeasurement. With the help of a semi-honest TP, two parties canknow whether the private information X and Y are equal or not. Ourprotocol cannot only withstand outside attacks, but also preserve theprivacy of X and Y. Alice and Bob cannot learn private information ownby each other. And the semi-honest TP also cannot learn anyinformation about the private information X,Y.

In our further works, the quantum private comparison protocolwith triplet W state can be studied without two single-directionsecure channels and the two-party protocol can be extended to thecase of multi-party. The quantum protocol for the millionairesproblem can be also studied.

Acknowledgments

This paper is supported by Beijing Municipal Special Fund forCultural and Creative Industries (2009); the Engineering CourseProgramming Project of Communication University of China, Grant

No. XNG0925; the National “211” Development Fund for KeyEngineering Programs; and the Beijing Municipal Natural ScienceFoundation (4112052).

References

[1] C.H. Bennett, G. Brassard, Proc. IEEE Int. Conf. on Computers, Systems, and SignalProcessing, Bangalore, India, 1984, p. 175.

[2] N. Gisin, G. Ribordy, W. Tittel, H. Zbinden, Rev. Mod. Phys. 74 (2002) 145.[3] A.K. Ekert, Phys. Rev. Lett. 67 (1991) 661.[4] C.H. Bennett, G. Brassard, N.D. Mermin, Phys. Rev. Lett. 67 (1992) 557.[5] P.W. Shor, J. Preskill, Phys. Rev. Lett. 85 (2000) 441.[6] F.G. Deng, X.S. Liu, Y.J. Ma, L. Xiao, G.L. Long, Chin. Phys. Lett. 19 (2002) 893.[7] F.G. Deng, G.L. Long, Phys. Rev. A 68 (2003) 042315.[8] T. Yan, F.L. Yan, Chin. Sci. Bull. 56 (2011) 24.[9] A. Karlsson, M. Koashi, N. Imoto, Phys. Rev. A 59 (1999) 052307.

[10] L. Xiao, G.L. Long, F.G. Deng, J.W. Pan, Phys. Rev. A 69 (2004) 162.[11] F.G. Deng, H.Y. Zhou, G.L. Long, Phys. Lett. A 337 (2005) 329.[12] Y.H. Wang, H.S. Song, Chin. Sci. Bull. 54 (2009) 2599.[13] G. Gao, Opt. Commun. 283 (2010) 2997.[14] B. Gu, L.L. Mu, L.G. Ling, Opt. Commun. 283 (2010) 3099.[15] L. Hao, J.L. Li, G.L. Long, Sci. China Phys. Mech. Astron. 53 (2010) 491.[16] R.H. Shi, L.S. Huang, W. Yang, H. Zhong, Sci. China Phys. Mech. Astron. 53 (2010)

2238.[17] X.L. Zhang, Chin. Sci. Bull. 54 (2009) 2018.[18] G.L. Long, X.S. Liu, Phys. Rev. A 65 (2002) 032302.[19] F.G. Deng, G.L. Long, X.S. Liu, Phys. Rev. A 68 (2003) 042317.[20] F.G. Deng, G.L. Long, Phys. Rev. A 69 (2004) 052319.[21] C. Wang, et al., Phys. Rev. A 71 (2005) 044305.[22] X.B. Chen, T.Y. Wang, J.Z. Du, Q.Y. Wen, F.C. Zhu, Int. J. Quant. Inform. 6 (2008) 543.[23] J. Wang, Q. Zhang, C.J. Tang, Commun. Theor. Phys. 48 (2007) 637.[24] C.H. Bennett, et al., Phys. Rev. Lett. 70 (1993) 1895.[25] D. Bouwmeester, J.W. Pan, et al., Nature 390 (1997) 575.[26] X.B. Chen, Q.Y. Wen, et al., Phys. Rev. A (2009) 036301.[27] O. Goldreich, S. Micali, A. Wigderson, Proceedings of the 19th Annual ACM

Conference on Theory of Computing, New York, USA, 1987, p. 218.[28] O. Goldreich, Secure Multi-party Computation (working draft) Manuscript, , 2000.[29] S. Goldreich, S. Micali, A. Wigderson, Proceedings of the 16th Annual ACM

Symposium on Principles of Distributed Computing, Santa Barbara, California,United States, 1997, p. 1.

[30] P.W. Shor, SIAM J. Comput. 26 (1997) 1484.[31] J.Z. Du, X.B. Chen, Q.Y. Wen, F.C. Zhu, Acta Phys. Sin. 56 (2007) 6214.[32] J.A. Vaccaro, J. Spring, A. Chefles, Phys. Rev. A (2007) 012333.[33] J. Markus, Y. Moti, Proceedings of the 16th Annual International Cryptology

Conference on advances in cryptology, London, UK, 1996, p. 186.[34] A. Yao, Proc. 23rd IEEE symposium on foundations of computer science, 1982,

p. 160.[35] A. Yao, Proceedings of the 27th annual symposium on foundations of computer

science,Washington, DC, USA, 1986, p. 162.[36] R. Fagin, M. Naor, P. Winkler, Commun. ACM 39 (1996) 77.[37] C. Cachin, Proceedings of the 6th ACM conference on computer and communica-

tions security, New York, NY, USA, 1999, p. 120.[38] B. Fabrice, S. Berry, et al., Discrete Appl. Math. 111 (2001) 23.[39] J. Qin, Z.F. Zhang, D.G. Feng, B. Li, J. Softw. 15 (2004) 421.[40] Y.G. Yang, Q.Y. Wen, J. Phys. A Math. Theor. 42 (2009) 055305.[41] X.B. Chen, G. Xu, X.X. Niu, Opt. Commun. 283 (2010) 1561.