Semi-quantum communication: Protocols for key agreement, controlled secure direct communication and dialogue
Chitra Shukla Kishore Thapliyal Anirban Pathak






Semi-quantum communication: Protocols for key agreement, controlled
secure direct communication and dialogue
    Chitra Shukla^a,email: shukla.chitra@i.mbox.nagoya-u.ac.jp ,
Kishore Thapliyal^b,email: tkishore36@yahoo.com,
Anirban Pathak^b,email: anirban.pathak@jiit.ac.in

^aGraduate School of Information Science, Nagoya
University, Furo-cho 1, 

Chikusa-ku, Nagoya, 464-8601, Japan 

^bJaypee Institute of Information Technology, A-10,
Sector-62, Noida, UP-201307, India 

 
    December 30, 2023
================================================================================================================================================================================================================================================================================================================================================================================


Semi-quantum protocols that allow some of the users to remain classical
are proposed for a large class of problems associated with secure
communication and secure multiparty computation. Specifically, first
time semi-quantum protocols are proposed for key agreement, controlled
deterministic secure communication  and dialogue, and it is shown
that the semi-quantum protocols for controlled deterministic secure
communication and dialogue can be reduced to semi-quantum protocols
for e-commerce and private comparison (socialist millionaire problem),
respectively. Complementing with the earlier proposed semi-quantum
schemes for key distribution, secret sharing and deterministic secure
communication, set of schemes proposed here and subsequent discussions
have established that almost every secure communication and computation
tasks that can be performed using fully quantum protocols can also
be performed in semi-quantum manner. Further, it addresses a fundamental
question in context of a large number problems- how
much quantumness is (how many quantum parties are) required to perform
a specific secure communication task? Some of the proposed schemes
are completely orthogonal-state-based, and thus, fundamentally different
from the existing semi-quantum schemes that are conjugate-coding-based.
Security, efficiency and applicability of the proposed schemes have
been discussed with appropriate importance.

Keywords: Semi-quantum protocol, quantum communication, key
agreement, quantum dialogue, deterministic secure quantum communication,
secure direct quantum communication.




§ INTRODUCTION


Since Bennett and Brassard's pioneering proposal of unconditionally
secure quantum key distribution (QKD) scheme based on conjugate coding
<cit.>, various facets of secure communication have been explored
using quantum resources. On the one hand, a large number of conjugate-coding-based
(BB84-type) schemes <cit.> have been proposed for
various tasks including QKD <cit.>, quantum key agreement
(QKA) <cit.>, quantum secure direct communication (QSDC)
<cit.>, deterministic secure quantum communication
(DSQC) <cit.>, quantum e-commerce <cit.>,
quantum dialogue <cit.>,
etc., on the other hand, serious attempts have been made to answer
two extremely important foundational questions- (1) Is conjugate coding
necessary for secure quantum communication? (2) How much quantumness
is needed for achieving unconditional security? Alternatively, whether
all the users involved in a secure communication scheme are required
to be quantum in the sense of their capacity to perform quantum measurement,
prepare quantum states in more than one mutually unbiased basis (MUBs)
and/or the ability to store quantum information? Efforts to answer
the first question have led to a set of orthogonal-state-based schemes
<cit.>, where
security is obtained without using our inability to simultaneously
measure a quantum state using two or more MUBs. These orthogonal-state-based
schemes <cit.>
have strongly established that any cryptographic task that can be
performed using a conjugate-coding-based scheme can also be performed
using an orthogonal-state-based scheme. Similarly, efforts to answer
the second question have led to a few semi-quantum schemes for secure
communication which use lesser amount of quantum resources than that
required by their fully quantum counterparts (protocols for same task
with all the participants having power to use quantum resources).
Protocols for a variety of quantum communication tasks have been proposed
under the semi-quantum regime; for example, semi-quantum key distribution
(SQKD) <cit.>,
semi-quantum information splitting (SQIS) <cit.>, semi-quantum
secret sharing (SQSS) <cit.>, semi-quantum
secure direct communication (SQSDC) <cit.>,
semi-quantum private comparison <cit.>, authenticated
semi-quantum direct communication <cit.> have been proposed.
The majority of these semi-quantum schemes are two-party schemes,
but a set of multi-party schemes involving more than one classical
Bob have also been proposed <cit.>. In some of these
multi-party semi-quantum schemes (especially, for multiparty SQKD)
it has been assumed that there exist a completely untrusted server/center
Charlie who, is a quantum user and either all <cit.>
or some <cit.> of the other users are classical. Further,
some serious attempts have been made for providing security proof
for semi-quantum protocols <cit.>.
However, to the best of our knowledge until now no semi-quantum protocol
has been proposed for a set of cryptographic tasks, e.g., (i) semi-quantum
key agreement (SQKA), (ii) controlled deterministic secure semi-quantum
communication (CDSSQC), (iii) semi-quantum dialogue (SQD). These tasks
are extremely important for their own merit as well as for the fact
that a scheme of CDSSQC can be easily reduced to a scheme of semi-quantum
e-commerce in analogy with Ref. <cit.>, where it is shown
that a controlled-DSQC scheme can be used for designing a scheme for
quantum online shopping. Further, a scheme for online shopping will
be of much more practical relevance if end users (especially buyers)
do not require quantum resources and consequently can be considered
as classical users. In brief, a semi-quantum scheme for e-commerce
is expected to be of much use. It is also known that a Ba An type
scheme for QD <cit.> can be reduced to a scheme of QPC <cit.>
and then the same can be used to solve socialist millionaire problem
<cit.>; a scheme of QKA can be generalized to multiparty case
and used to provide semi-quantum schemes for sealed bid auction <cit.>;
and in a similar manner, a CDSSQC scheme can be used to yield a scheme
for semi-quantum binary quantum voting in analogy with <cit.>.
The fact that no semi-quantum scheme exists for SQD, SQKA and CDSSQC
and their wide applicability to e-commerce, voting, private comparison
and other cryptographic tasks have motivated us to design new protocols
for SQD, SQKA and CDSSQC and to critically analyze their security
and efficiency. To do so, we have designed 2 new protocols for CDSSQC
and one protocol each for SQD and SQKA. These new protocols provide
some kind of completeness to the set of available semi-quantum schemes
and allows us to safely say that any secure communication task that
can be performed using full quantum scheme can also be performed with
a semi-quantum scheme. Such reduction of quantum resources is extremely
important as quantum resources are costly and it is not expected that
all the end users would possess quantum devices.

Before we proceed further, it would be apt to note that in the existing
semi-quantum schemes different powers have been attributed to the
classical party (lets call him as Bob for the convenience of the discussion,
but in practice we often name a classical user as Alice, too). Traditionally,
it is assumed that a classical Bob does not have a quantum memory
and he can only perform a restricted set of classical operations over
a quantum channel. Specifically, Bob can prepare new qubits only in
the classical basis (i.e., in Z basis or {|0⟩,|1⟩}
basis). In other words, he is not allowed to prepare |±⟩
or other quantum states that can be viewed as superposition of |0⟩
and |1⟩ states. On receipt of a qubit Bob can either resend
(reflect) the qubit (independent of the basis used to prepare the
initial state) without causing any disturbance or measure it only
in the classical basis. He can also reorder the sequence of qubits
received by him by sending the qubits through different delay lines.
In fact, first ever semi-quantum scheme for key distribution was proposed
by Boyer et al., in 2007 <cit.>. In this pioneering work,
the user with restricted power was referred to as classical Bob and
in that work and in most of the subsequent works  (<cit.>
and references therein) it was assumed that Bob has access to a segment
of the quantum channel starting from Alice's lab going back to her
lab via Bob's lab; as before, the classical party Bob can either leave
the qubit passing through the channel undisturbed or perform measurement
in the computational basis, which can be followed by fresh preparation
of qubit in the computational basis. This was followed by a semi-quantum
scheme of key distribution <cit.>, where the classical party
can either choose not to disturb the qubit or to measure it in the
computational basis, and instead of preparing the fresh qubits in
the computational basis he may reorder the undisturbed qubits to ensure
unconditional security. Later, these schemes were modified to a set
of SQKD schemes with less than four quantum states, where Alice requires
quantum registers in some of the protocols <cit.>,
but does not require it in all the protocols. In what follows, we
attribute the same power to Bob in the schemes proposed in this paper.
In the schemes proposed below, senders are always classical and they
are referred to as classical Bob/Alice. This is in consistency with
the nomenclature used in most of the recent works  (<cit.>
and references therein). However, in the literature several other
restrictions have been put on classical Bob. For example, in Ref.
<cit.> a SQKD scheme was proposed where Bob was
not allowed to perform any measurement and he was referred to as “limited
classical Bob”. It was argued that a limited classical Bob can circumvent
some attacks related to the measurement device <cit.>.
However, the scheme proposed in <cit.> was not
measurement device independent. Similarly, in <cit.>
a server was delegated the task of performing measurement and application
of one of the two Pauli operations, while the classical users role
was restricted in randomly sending the received qubits to the server
for random application of operator or measurement. Such a classical
user was referred to as “nearly classical Bob”. 

Remaining part of the paper is organized as follows. In Sec. <ref>,
a protocol for SQKA among a quantum and a classical user is proposed.
Two CDSSQC schemes with a classical sender and a receiver and controller
both possessing quantum powers are proposed in Sec. <ref>.
In Sec. <ref>, a SQD scheme between a classical
and a quantum parties are designed. The security of the proposed schemes
against various possible attacks are discussed in the respective sections.
The qubit efficiency of the proposed schemes has been calculated in
Sec. <ref> before concluding the work in
Sec. <ref>.




§ PROTOCOL FOR SEMI-QUANTUM KEY AGREEMENT 


In analogy of the weaker notion of quantum key agreement, i.e., both
the parties take part in preparation of the final shared key, most
of the SQKD protocols may be categorized as SQKA schemes. Here, we
rather focus on the stronger notion of the key agreement, which corresponds
to the schemes where each party contribute equally to the final shared
key, and none of the parties can manipulate or know the final key
prior to the remaining parties (for detail see <cit.> and
references therein). We will also show that the proposed SQKA scheme
can be reduced to a scheme for SQKD, first of its own kind, in which
a sender can send a quantum key to the receiver in an unconditionally
secure and deterministic manner.

In this section, we propose a two-party semi-quantum key agreement
protocol, where Alice has all quantum powers, but Bob is classical,
i.e., he is restricted to perform the following operations (1) measure
and prepare the qubits only in the computational basis {|0⟩,|1⟩}
(also called classical basis), and (2) simply reflects the qubits
without disturbance. The working of the proposed protocol is illustrated
through a schematic diagram shown in Fig. <ref>. 




The following are the main steps in the protocol.




§ PROTOCOL 1



  Step1.1: Preparation of the quantum channel: Alice prepares
n+m=N number of Bell states, i.e., |ψ^+⟩^⊗ N,
where |ψ^+⟩=|00⟩+|11⟩/√(2).
Out of the total N Bell states, n will be used for key generation
while the remaining m will be used as decoy qubits for eavesdropping
checking. Subsequently, she prepares two ordered sequences of all
the first qubits and all the second qubits from the initial Bell states.
She keeps the first sequence with herself as home qubits (H) and sends
the second sequence to Bob as travel qubits (T) as shown by arrow
in Step1.1 of Fig. <ref>. Using a quantum random number
generator (QRNG), Alice also prepares her raw key of n bits K_A={K_A^1,K_A^2⋯ K_A^i⋯ K_A^n},
where K_A^i is the i^th bit of K_A, and K_A^i∈{0,1}
as shown in Step1.1 of Fig. <ref>. 

  Step1.2: Bob's encoding: Bob also prepares his raw key
K_B={K_B^1,K_B^2,⋯,K_B^i,⋯,K_B^n}
of n bits by using a RNG[Bob being classical, we refer to his random number generator as a
traditional pseudo random number generator, instead of a true random
number generator which is required to be quantum. This aspect of random
key generation in Bob's side is not explicitly discussed in the existing
works on semi-quantum protocols. However, it's not a serious issue
as on one hand, extremely good quality pseudo random numbers can be
generated classically (thus, use of a classical RNG will be sufficient
for the present purpose); on the other hand, QRNG are now commercially
available and is not considered as a costly quantum resource, so if
one just allows an otherwise classical user to have an QRNG, the modified
scheme could still be considered as a semi-quantum scheme as Bob would
still lack the power of performing quantum measurement and or storing
quantum information. In fact, measurement in classical basis would
be sufficient for generation of true random number if Bob can create
a |±⟩ state using a beam splitter.], (which is independent of Alice's QRNG), where K_B^i is the
i^th bit of the K_B with K_B^i∈{0,1}. After receiving
all the qubits from Alice, Bob randomly chooses one of the two operations,
either to measure or reflect as shown in Step1.1 of Fig. <ref>.
Specifically, he measures n qubits (chosen randomly) in the computational
basis, while reflects the remaining m qubits to be used later for
eavesdropping checking. 

He forms a string of his measurement outcomes as r_B={r_B^1,r_B^2,⋯,r_B^i,⋯,r_B^n},
where r_B^i is the measurement outcome of i^th qubit chosen
to be measured by Bob in the computational basis, and therefore, r_B^i∈{0,1}.
Then to encode his raw key K_B, he performs a bit wise XOR operation,
i.e., r_B⊕ K_B and prepares corresponding qubits in the
computational basis. Finally, he inserts the encoded n qubits back
into the string of reflected m qubits and sends the resultant sequence
r^b back to Alice only after applying a permutation operator
Π_N as shown by the first arrow in Step1.2 of Fig. <ref>.
These qubits would further be used to make the final shared key K_f.

  Step1.3: Announcements and eavesdropping checking: After
receiving an authenticated acknowledgment of the receipt of all the
qubits from Alice, Bob announces the permutation operator Π_m
corresponding to the qubits reflected by him. Though, this would reveal
which qubits have been measured and which qubits have been reflected
by Bob but Eve or Alice cannot gain any advantage due to lack of information
regarding the permutation operator Π_n. Further, to detect
eavesdropping, Alice firstly measures the reflected qubits in Bell
basis by combining them with respective partner home qubits. If she
finds the measurement result as |ψ^+⟩ state then they
confirm that no eavesdropping has happened, because the initial state
was prepared in |ψ^+⟩ state, and they move on to the
next step, otherwise they discard the protocol and start from the
beginning.

  Step1.4: Extraction of the final shared key K_f
by Bob: After ensuring that there is no eavesdropping, Alice announces
her secret key K_A publicly as shown by the first arrow in Step1.4
of Fig. <ref>, and Bob uses that information to prepare
his final shared key K_f=K_A⊕ K_B as he knows K_B.
Subsequently, he also reveals the the permutation operator Π_n.


Here, it is important to note that Alice announces her secret key
K_A only after the receipt of all the encoded qubits from Bob.
So, now Bob can not make any further changes as per his wish.

  Step1.5: Extraction of the final shared key K_f
by Alice: Once Alice has reordered Bob's encoded qubits she measures
both the home (H) and travel (T) qubits in the computational basis.
She obtains a string of n bits r_A corresponding to measurement
outcomes of home qubits, and she can use the measurement outcomes
of the travel qubits to know Bob's encoded raw key as the initial
Bell states are publicly known. For the specific choice of initial
Bell state here, i.e., |ψ^+⟩, the relation r_A=r_B
holds. Therefore, the final shared key would be 


    [                             K_f                               = K_A⊕ K_B=(r_A⊕ K_A)⊕(r_B⊕ K_B). ]

Hence, the final shared key K_f is shared between Alice and Bob.




In Eq. (<ref>), Eve may know Alice's secret key K_A
as this was announced through a classical channel. She is also aware
of r_A=r_B due to public knowledge of the initial choice of
Bell state. However, it does not affect the secrecy of the final shared
key K_f which is prepared as K_A⊕ K_B, because Eve
does not know anything about Bob's secret key K_B and the value
of r_A (or r_B).

Further, it should be noted here the computational basis measurement
is not the only choice by Alice, rather she can extract Bob's encoding
by performing Bell measurement. Here, we will skip that discussion
as the same has been discussed in the following section for semi-quantum
dialogue protocol.

If we assume that Alice is not intended to send her raw key (i.e.,
she does not announce her raw key) in the proposed SQKA protocol,
indeed following it faithfully, then it will reduce to a deterministic
SQKD protocol. Specifically, in analogy of ping-pong protocol <cit.>
to perform a quantum direct communication task, which was also shown
to share a quantum key in a deterministic manner. 




 §.§ Possible attack strategies and security 



  * Eve's attack: As mentioned beforehand Eve's ignorance
regarding the final shared key solely depends on the fact whether
Alice receives Bob's raw key in a secure manner. In other words, although
Eve is aware of the initial state and Alice's raw key, she still requires
Bob's key to obtain the final shared key. In what follows, we will
discuss some attacks, she may attempt to extract this information.


The easiest technique Eve may incorporate is a CNOT attack
(as described and attempted in Refs. <cit.>).
To be specific, she may prepare enough ancilla qubits (initially as
|0⟩) to perform a CNOT with each travel
qubit at control and an ancilla as a target while Alice to Bob communication.
This way the compound state of Alice's, Bob's and Eve's qubits, prior
to Bob's measurement, becomes |ψ_ ABE⟩=|000⟩+|111⟩/√(2).
As Bob returns some of the qubits performing single qubit measurement
in the computational basis on his qubit (B). The reduced state of
Alice's and Eve's qubits may be written as |ρ_ AE⟩=|00⟩⟨00|+|11⟩⟨11|/2
corresponding to Bob's measurement, while the three qubit state remains
unchanged for reflected qubits. Suppose Bob prepares a fresh qubit
|ξ_ B⟩=|r_B⊕ K_B⟩ and returns the
string of encoded qubits (in other words, measured qubits) and reflected
qubits to Alice (without applying a permutation operator). Subsequently,
Eve again performs a CNOT operation while Bob to Alice communication
with control on travel qubits and target on the ancilla qubits. It
is straightforward to check that in case of reflected qubits the state
reduces to |ψ_ ABE⟩=|00⟩+|11⟩/√(2)⊗|0⟩.
Whereas, for encoded qubits it may be written as |ρ_ ABE^'⟩=1/2(|0⟩⟨0|⊗|K_B⟩⟨ K_B|+|1⟩⟨1|⊗|K_B⊕1⟩⟨ K_B⊕1|)⊗|K_B⟩⟨ K_B|.
From which it may be observed that Eve will always obtain Bob's secret
key. However, this problem is circumvented using a permutation operator
(in Step1.2) by Bob on the string of encoded and reflected qubits.

As Eve's CNOT attack strategy is foiled by the use of a permutation
operator she may attempt other attack strategies. Suppose she performs
an intercept and resend attack. Specifically, in this attack,
she can prepare an equal number of Bell states as Alice and send all
the second qubits to Bob, keeping the Alice's original sequence with
herself. Bob follows the protocol and encodes n qubits randomly
and sends them to Alice, which is again intercepted by Eve. Subsequently,
Eve performs the Bell measurement on all the Bell pairs (which she
had initially prepared), and she may come to know which n qubits
were measured by Bob. Quantitatively, she can get this knowledge 75%
of the time as in the Bell measurement outcomes anything other than
the original state would result in a measurement performed by Bob.
Depending upon the Bell measurement outcomes Bob's encoding can also
be revealed as |ψ^-⟩ and |ϕ^±⟩ will
correspond to Bob's 0 and 1 in the computational basis, respectively
(see Section <ref> and Table <ref>
for more detail). Subsequently, she performs a measurement in the
computational basis on the qubits sent by Alice corresponding to each
qubit Bob has measured. Finally, she sends the new string of qubits
(comprising of freshly prepared and Alice's original qubits) to Alice
which will never fail in eavesdropping checking and Alice will announce
her key and Eve can get at least 75% of the shared key.

It is important to note here that 25% of the key of Alice and Bob
will also not match in this case. This may be attributed to the disturbance
caused due to eavesdropping, which left that signature and is a characteristic
nature of quantum communication. This fact can be explored to achieve
the security from this kind of an attack. Specifically, Alice and
Bob may choose to perform a verification strategy of a small part
of the shared key to check this kind of an attempt. 

As we have already incorporated a permutation of particles scheme
(performed by Bob) for security against CNOT attack, it becomes relevant
to see the feasibility of this attack in this case as well. Bob discloses
the permutation operator for decoy qubits only after an authenticated
acknowledgment by Alice. Therefore, Eve fails to obtain the encoded
bit value prior to this disclosure of Bob as it is, although it's
encoded in the computational basis, but she does not know the partner
Bell pair due to randomization. She will require this Bell pair to
decode the information as the measurement outcome of the partner Bell
particle acts as a key for decoding the Bob's information. Further,
Bob announces the correct order of particles only when less than a
threshold of errors are found during eavesdropping checking. 

Indeed, most of the attacks by an eavesdropper can be circumvented
if the classical Bob is given power to permute the string of qubits
with him, i.e., Bob can secure his raw key (information) in the proposed
SQKA scheme by permuting the particles before sending to Alice. 

There are some other attacks (see <cit.> for details) which
do not affect the security of the proposed protocol, like disturbance
attack, denial of service attack, and impersonation
attack (as it becomes void after incorporating an authentication
protocol).

  * Alice's attack: In the eavesdropping checking, at the end
of the round trip of Bell pairs, Bob announces the positions of the
reflected qubits in each of the Bell pairs and the remaining string
(i.e., encoded string after measurement) is in the computational basis
and Alice can know Bob's encoding before she announces her own. In
other words, she can control the final key completely as she can announce
her raw key accordingly. However, this is not desired in a genuine
key agreement scheme.

This possible attack by Alice is circumvented by the use of permutation
operator discussed in the last attack. As Bob reveals the permutation
he had applied on the freshly prepared qubits (on which his raw key
is encoded) only after Alice announces her raw key, she can not extract
his raw key due to lack of knowledge of pair particles corresponding
to each initially prepared Bell state. Hence, only after Alice's announcement
of her raw key she comes to know Bob's raw key with his cooperation.


To avoid this attack, we may also decide that both Alice and Bob share
the hash values of their raw keys during their communication due to
which if she wishes to change her raw key later, then the protocol
is aborted as the hash value for her modified raw key will not match
with original raw key.

  * Bob's attack: As mentioned in the Alice's attack that Bob
announces the permutation operator only after receiving her raw key.
One should notice here that the permuted string Bob has sent and corresponding
Alice's string are in computational basis. Further, Bob knows each
bit value in Alice's string as those are nothing but Bob's corresponding
measurement outcomes in Step 1.2. Once Bob knows Alice's raw key,
he may control the final key entirely by disclosing a new permutation
operator that suits his choice of shared key.

Therefore, it becomes important to incorporate the hash function as
if Bob has already shared the hash value of his key he cannot change
his raw key during announcement of permutation operator.




§ CONTROLLED DIRECT SECURE SEMI-QUANTUM COMMUNICATION 


If we observe the SQKA protocol proposed here, it can be stated that
Bob sends his raw key by a DSSQC scheme and Alice announces her raw
key. The security of the final key depends on the security of the
raw key of Bob. Hence, a semi-quantum counterpart of direct communication
scheme can be designed. However, avoiding the designing of various
schemes for the same task, we rather propose a controlled version
of direct communication scheme and discuss the feasibility of realizing
this scheme, which would directly imply the possibility of direct
communication scheme. Here, we will propose two controlled direct
secure semi-quantum communication protocols. Note that in the proposed
CDSSQC schemes only Alice is considered as a classical
party, while Bob and Charlie possess quantum powers.




 §.§ Protocol 2: Controlled direct secure semi-quantum communication 


The working of this scheme is as follows.


  Step2.1: Preparation of shared quantum channel: Charlie
prepares n+m=N copies of a three qubit entangled state


    |ψ⟩_GHZ- like=|ψ_1⟩|a⟩+|ψ_2⟩|b⟩/√(2),

where |ψ_i⟩∈{ |ψ^+⟩,|ψ^-⟩,|ϕ^+⟩,|ϕ^-⟩:|ψ^±⟩=|00⟩±|11⟩/√(2), |ϕ^±⟩=|01⟩±|10⟩/√(2),}
and ⟨ a|b⟩=δ_a,b. The classical user Alice will
encode her n-bit message on the n copies, while the remaining
m copies will be used as decoy qubits to check an eavesdropping
attempt. Subsequently, Charlie prepares three sequences of all the
first, second and third qubits of the entangled states. Finally, he
sends the first and second sequences to Alice and Bob, respectively.


They can check the correlations in a few of the shared quantum states
to avoid an eavesdropping attempt using intercept and resend attack,
i.e., Charlie measures his qubits in { |a⟩,|b⟩}
basis, while Alice and Bob in computational basis. However, such an
eavesdropping test would fail to provide security against measurement
and resend attack. Security against such an attack is discussed later.

In addition, Charlie and Bob both being capable of performing quantum
operations may perform BB84 subroutine (cf. <cit.>
and references therein) to ensure a secure transmission of the qubits
belonging to quantum channel. This would provide additional security
against intercept-resend attacks on  Charlie-Bob
quantum channel.

  Step2.2: Alice's encoding: Alice has a n bit message
M={M_A^1,M_A^2⋯ M_A^i⋯ M_A^n}. To encode
this message Alice measures n qubits (chosen randomly) in computational
basis to obtain measurement outcomes r_A={r_A^1,r_A^2⋯ r_A^i⋯ r_A^n},
and prepares a new string of qubits in { |0⟩,|1⟩}
basis corresponding to bit values M_A^i⊕ r_A^i. Finally,
she reinserts all these qubits back into the original sequence and
sends it to Bob only after permuting the string. It is important that
she leaves enough qubits undisturbed so that those qubits may be employed
as decoy qubits.

  Step2.3: Announcements and eavesdropping checking: After
receiving an authenticated acknowledgement of the receipt of all the
qubits from Bob, Alice announces which qubits have been encoded and
which qubits have been left as decoy qubits. She also discloses the
permutation operator applied only on the decoy qubits. Further, to
detect eavesdropping, Bob firstly measures the pair of decoy qubits
from Alice's and Bob's sequences in the Bell basis and with the help
of Charlie's corresponding measurement outcome (which reveals the
initial Bell state Alice and Bob were sharing) he can calculate the
errors. If sufficiently low errors are found they proceed to the next
step, otherwise start afresh.

  Step2.4: Decoding the message: To decode the message,
Bob can perform a measurement in the computational basis on all the
remaining qubits from both the sequences received from Charlie and
Alice. Subsequently, Alice also discloses her permutation on the message
encoded (or freshly prepared) qubits in her string. However, Bob cannot
 decode Alice's secret message yet, as he remains unaware of the Bell
state he was sharing with Alice until Charlie announces his measurement
outcome. 

  Step2.5: Charlie's announcement: Finally, Charlie announces
his measurement outcome in { |a⟩,|b⟩}
basis using which Bob can decode Alice's message.




 §.§ Protocol 3: Controlled direct secure semi-quantum communication based
on cryptographic switch


This controlled communication scheme is based on quantum cryptographic
switch scheme proposed in the past <cit.> and has been shown
to be useful in almost all the controlled communication schemes <cit.>.


  Step3.1: Preparation of the shared quantum channel: Charlie
prepares n+m=N copies of one of the Bell states, out of which n
Bell pairs will be used for sending messages and the rest as decoy
qubits. Subsequently, Charlie prepares two sequences of all the first
and second qubits of the entangled state. He also performs a permutation
operator on the second sequence. Finally, he sends the first and second
sequences to Alice and Bob, respectively.

Both Alice and Bob may check the correlations in a few of the shared
Bell states to avoid an eavesdropping attempt as was done in Step2.1.
Similarly, Charlie and Bob both being capable of performing quantum
operations may also perform BB84 subroutine (cf. <cit.>
and references therein).

  Step3.2: Same as Step2.2 of Protocol 2.

  Step3.3: Announcements and eavesdropping checking: After
receiving an authenticated acknowledgment of the receipt of all the
qubits from Bob, Alice announces which qubits have been encoded and
which qubits have been left as decoy qubits. She also discloses the
permutation operator corresponding to the decoy qubits only. Then
Charlie announces the correct positions of the partner pairs of decoy
Bell states in the Bob's sequence. To detect eavesdropping, Bob measures
the pairs of decoy qubits from Alice's and Bob's sequences in the
Bell basis to calculate the errors. If sufficiently low errors are
found they proceed to the next step, otherwise start afresh.

  Step3.4: Decoding the message: To decode the message
Bob can perform a measurement in the computational basis on all the
remaining qubits from both the sequences received from Charlie and
Alice. Meanwhile, Alice discloses her permutation operator enabling
Bob to decode her message. However, he cannot decode Alice's secret
message yet as he is unaware of the permutation operator Charlie has
applied. 

  Step3.5: Charlie's announcement: Finally, Charlie sends
the information regarding the permutation operator to Bob, using which
Bob can decode Alice's message.

It is important to note that two of the three parties involved in
the CDSSQC protocols are considered quantum here. The possibilities
of minimizing the number of parties required to have quantum resources
will be investigated in the near future.

In the recent past, it has been established that the controlled counterparts
of secure direct communication schemes <cit.>
can provide solutions of a handful of real life problems. For instance,
schemes of quantum voting <cit.> and e-commerce <cit.>
are obtained by modifying the schemes for controlled DSQC. Here, we
present the first semi-quantum e-commerce scheme, in which Alice (buyer)
is classical, and Bob (merchant) and Charlie (online store) possess
quantum resources. Both Alice and Bob are registered users of the
online store Charlie. When Alice wishes to buy an item from Bob she
sends a request to Charlie, who prepares a tripartite state (as in
Eq. <ref> of Protocol 2) to be shared with Alice
and Bob. Alice encodes the information regarding her merchandise to
Bob and encodes it as described in Step2.2. The merchant can decode
Alice's order in Step2.5 but will deliver the order only after receiving
an acknowledgment from Charlie in Step2.5. Here, it is important to
note that in some of the recent schemes, Charlie can obtain information
about Alice's order and/or change it, which is not desired in a genuine
e-commerce scheme <cit.>. The semi-quantum e-commerce
scheme modified from the proposed CDSSQC scheme is free from such
an attack as Alice applies a permutation operator and discloses her
permutation operator only after a successful transmission of all the
travel particles. In a similar manner, another quantum e-commerce
scheme may be obtained using CDSSQC scheme presented as Protocol 3,
where the online store prepares only Bell states.




 §.§ Possible attack strategies and security 


Most of the attacks on the proposed CDSQC schemes may be circumvented
in the same manner as is done in the SQKA scheme in Section <ref>.
Here, we only mention additional attack strategies that may be adopted
by Eve.

As discussed while security of SQKA scheme, the easiest technique
for Eve would be a CNOT attack. Specifically,
she may entangle her ancilla qubits with the travel qubits from Charlie
to Alice and later disentangle them during Alice to Bob communication.
She succeeds in leaving no traces using this attack and getting Alice's
all the information (see Section <ref>
for detail). However, Alice may circumvent this attack just by applying
a permutation operator on all the qubits before sending them to Bob. 

Eve may choose to perform an intercept and resend attack. Specifically,
she can prepare an equal number of single qubits in the computational
basis as Charlie has sent to Alice and send all these qubits to Alice,
keeping the Charlie's original sequence with herself. When Alice,
Bob, and Charlie check the correlations in Step 1, they will detect
uncorrelated string with Alice corresponding to this attack.

Eve can measure the intercepted qubits in the computational basis
and prepares corresponding single qubits to resend to Alice. In this
case, Eve will not be detected during correlation checking. However,
Alice transmits the encoded qubits after permutation to Bob due to
which Eve fails to decode her message, and consequently, Eve will
be detected at Bob's port during eavesdropping checking. 

As mentioned beforehand both these attacks and the set of remaining
attacks may be circumvented due to permutation operator applied by
Alice.




§ SEMI-QUANTUM DIALOGUE


In this section, we propose a two-party protocol for SQD, where Alice
has all quantum powers and Bob is classical. The following are the
main steps of the protocol.


  Step4.1: Alice's preparation of quantum channel and encoding
on it: Alice prepares n+m=N number of initial Bell states, i.e.,
|ψ^+⟩^⊗ N, where |ψ^+⟩=|00⟩+|11⟩/√(2).
She prepares two ordered sequences of all the first qubits as home
(H) qubits and all the second qubits as travel (T) qubits from the
initial Bell states. She keeps the home (H) qubits with herself and
sends the string of travel qubits to classical Bob. The initial Bell
states and encoding schemes are publicly known and let's say that
U_A and U_B are the measurement operations of Alice and
Bob, respectively. 

  Step4.2: Bob's eavesdropping checking: Bob informs Alice
about the reception of the travel sequence by a classical channel.
Here, we can perform an eavesdroping checking strategy as discussed
above in Step 1.1 of CDSSQC schemes in Section <ref>
that the joint measurement in the computational basis by Alice and
Bob on the Bell pairs should be correlated. If they find error rate
more than a threshold value, then they abort the protocol and starts
from the beginning. 

  Step4.3: Bob's encoding: Bob measures n qubits (chosen
randomly) in the computational basis and records all the measurement
outcomes in a string of bits r_B. Then he prepares a string of
his message in binary as M_B. Finally, he prepares fresh qubits
in the computational basis for each bit value r_B⊕ M_B
and reinserts them in the original sequence. Then he sends the encoded
and decoy qubits back to Alice after performing a permutation on them.
Here, it is important to note that the encoding operation used by
Bob can be thought equivalent to Pauli operations { I,X}
but they are performed classically by Bob, i.e., remaining within
his classical domain.

  Step4.4: Alice's eavesdropping checking: After receiving
the authenticated acknowledgement of the receipt of all the qubits
from Alice, Bob announces the positions of decoy qubits along with
the corresponding permutation operator. Alice then measures all the
decoy qubits in the Bell basis and any measurement outcome other than
that of the initially prepared Bell state would correspond to an eavesdropping
attempt. 

  Step4.5: Alice's encoding and measurement: For sufficiently
low errors in eavesdropping checking Bob also discloses the permutation
operator applied on the freshly prepared message qubits and Alice
proceeds to encoding her secret on the qubits received from Bob by
applying Pauli operations { I,X}. Finally, she measures
the partner pairs in Bell basis and announces her measurement outcomes.
From the measurement outcomes, both Alice and Bob can extract Bob's
and Alice's message, respectively. 

Here, it should be noted that the Bell measurement performed in Step4.5
is not necessary, a two qubit measurement performed in the computational
basis will also work in the above mentioned case. 




In the recent past, it has been established that a scheme for quantum
dialogue can be modified to provide a solution for the quantum private
comparison, which can be viewed as a special form of socialist millionaire
problem <cit.>. In the semi-quantum private comparison (SQPC)
task <cit.>, two classical users wish to compare their
secrets of n-bits with the help of an untrusted third party possessing
quantum resources. Before performing the SQPC scheme, the untrusted
third party (Alice here) prepares a large number of copies of the
Bell states using which both Bob_1 and Bob_2
prepare two shared unconditionally secure symmetric strings in analogy
with the schemes described in <cit.>. They use one symmetric
string as a semi-quantum key, while the other to decide the positions
of the qubits they will choose to reflect or to measure. Specifically,
both the classical users decide to measure the ith qubit received
during the SQPC scheme if ith bit in the shared string is 1, otherwise
they reflect the qubit. Using this approach both classical users prepare
fresh qubit using the encoding operation defined in Step4.3, with
the only difference that this time the transmitted information is
encrypted by the shared key. Once Alice receives all the qubits and
measures all of them in the Bell basis. Both the classical users disclose
the string they had originally shared, using which Alice announces
the measurement outcomes corresponding to the reflected qubits. Bob_is
can subsequently compute the error rate from the measurement outcomes
and if the error rate is below the threshold, Alice publicly announces
1-bit secret whether both the users had the same amount of assets
or not (see <cit.> for detail). Thus, we establish that
a slight modification of Protocol 4 may lead to a new scheme for SQPC.
This is interesting as to the best of our knowledge until now there
exist only two proposals for SQPC <cit.>. 




 §.§ Possible attack strategies and security 


Most of the attacks on the proposed SQKA and CDSSQC schemes will also
be valid on the SQD scheme. Further, as mentioned beforehand most
of these attacks will be circumvented due to permutation operator
Bob has applied. Here, it is worth mentioning that permutation operator
is not a unique way to circumvent these attacks, a prior shared key
will also ensure the security of the protocol. A similar strategy
of using a prior shared key has been observed in a few protocols in
the past <cit.>. We would like to emphasize here that employing
a key for security is beyond the domain of direct communication. Therefore,
we have preferred permutation of particles over a key in all the proposed
schemes.

Further, it is shown in the past by some of the present authors <cit.>
that if the information regarding the initial state is not a public
knowledge and sent using a QSDC/DSQC protocol, then an inherent possible
attack in QD schemes, i.e., information leakage attack, can be circumvented.




§ EFFICIENCY ANALYSIS 


Performance of a quantum communication protocol can be characterized
using qubit efficiency <cit.>, η=c/q+b, which is
the ratio of c-bits of message transmitted using q number of
qubits and b-bits of classical communication. Note that the qubits
involved in eavesdropping checking as decoy qubits are counted while
calculating qubit efficiency, but the classical communication associated
with it is not considered.

Before computing the qubit efficiency of the four protocols proposed
here, we would like to note that in all the protocols the classical
senders are sending n bits of secret, while in Protocol 4 (protocol
for SQD, where both classical and quantum users transmit information),
the quantum user Alice was also able to send the same amount of information
to classical Bob. In all these cases, the classical sender encodes
n bits secret information using n-qubits. However, to ensure
the secure transmission of those n-qubits, another 3n-qubits
are utilized (i.e., m=3n). This is so because to ensure a secure
communication of n qubits, an equal number of decoy qubits are
required to be inserted randomly <cit.>. The error rate calculated
on the decoy qubits decides, whether to proceed with the protocol
or discard. In a semi-quantum scheme, a classical users cannot produce
decoy qubits, so to securely transmit n-bit of classical information,
he/she must receive 2n qubits from the quantum user, who would
require to send these 2n-qubits to be used by user along with another
2n qubits, which are decoy qubits for the quantum user- classical
user transmission. Thus, quantum user need to prepare and send 4n
qubits to a classical user for sending n bits of classical communication. 








The details of the number of qubits used for both sending the message
(q_c) and checking an eavesdropping attempt (d) in all the
protocols proposed here are explicitly mentioned in Table <ref>.
In the last column of the table the computed qubit efficiencies are
 listed. From Table <ref>, one can easily
observe that the qubit efficiency of three party schemes (Protocol
2 and 3) is less than that of two party schemes (Protocol 1 and 4).
This can be attributed to the nature of three party schemes, where
one party is supervising the one-way semi-quantum communication among
two remaining parties, which increases the resource requirements to
ensure the control power. In the controlled semi-quantum schemes,
the qubit efficiency computed for Protocol 3 is comparatively more
than Protocol 2 as the controller had chosen to prepare a bipartite
entangled state instead of tripartite entangled state used in Protocol
2. This fact is consistent with some of our recent observations <cit.>.
Among the two party protocols, Protocol 4 has a higher qubit efficiency
than that of Protocol 1 as the quantum communication involved in this
case is two-way.

Further, one may compare the calculated qubit efficiency with that
of the set of protocols designed for the same task with all the parties
possessing quantum resources. Such a comparison reveals that the requirement
of unconditional security leads to decrease in the qubit efficiency
for the schemes that are performed with one or more classical user(s)
(for example, the qubit efficiency of a QKA scheme was 14.29% which
is greater than 10% qubit efficiency obtained here for the SQKA protocol). 




§ CONCLUSION 


A set of schemes are proposed for various quantum communication tasks
involving one or more user(s) possessing restricted quantum resources.
To be specific, a protocol for key agreement between a classical and
a quantum party is proposed in which both parties equally contribute
in determining the final key and no one can control that key. To the
best of our knowledge this is the first attempt to design a key agreement
between classical and quantum parties. We have also proposed two novel
schemes for controlled communication from a classical sender and a
quantum receiver. It is important to note here that the proposed schemes
are not only the first schemes of their kind, i.e., semi-quantum in
nature, are also shown to be useful in designing a semi-quantum e-commerce
schemes that can provide unconditional security to a classical buyer.
The presented semi-quantum e-commerce schemes are relevant as the
buyer is supposed to possess minimum quantum resources, while the
online store (the controller) and the merchant may be equipped with
quantum resources. This kind of a semi-quantum scheme can be used
as a solution to a real life problem as in daily life, end users are
expected to be classical. The present work is also the first attempt
for designing semi-quantum schemes having direct real life application.
Further, the first and an unconditionally secure scheme for dialogue
among a classical and a quantum users is proposed here. Later it has
also been shown that the proposed SQD scheme can be modified to obtain
a solution for private comparison or socialist millionaire problem.
The security of the proposed schemes against various possible attack
strategies are also established.

The possibility of realizing semi-quantum schemes for these tasks
establishes that the applicability of the idea of semi-quantum schemes
is not restricted to key distribution and direct communication between
a classical and quantum or two classical (only with the help of a
third quantum party) parties. Our present work not only shows that
almost all the secure communication tasks that can be performed by
two quantum parties can also be performed in a semi-quantum manner
at the cost of increased requirement of the quantum resources to be
used by the quantum party. To establish this point, the qubit efficiencies
of the proposed schemes are computed, which are evidently lower than
the efficiency of the similar schemes with all the parties possessing
quantum resources. 

With the recent development of experimental facilities and a set of
recent experimental realizations of some quantum cryptographic schemes,
we hope that the present results will be experimentally realized in
the near future and these schemes or their variants will be used in
the devices to be designed for the daily life applications.

Acknowledgment: CS thanks Japan Society for the
Promotion of Science (JSPS), Grant-in-Aid for JSPS Fellows no. 15F15015.
KT and AP thank Defense Research & Development Organization (DRDO),
India for the support provided through the project number ERIP/ER/1403163/M/01/1603.
10
bb84Bennett, C. H., Brassard, G.: Quantum cryptography:
Public key distribution and coin tossing. In Proceedings of the IEEE
International Conference on Computers, Systems, and Signal Processing,
Bangalore, India, 175-179 (1984)

bookPathak, A.: Elements of Quantum Computation and Quantum
Communication. CRC Press, Boca Raton, USA (2013)

ekertEkert, A. K.: Quantum cryptography based on Bell's
theorem. Phys. Rev. Lett. 67, 661 (1991)

b92Bennett, C. H.: Quantum cryptography using any two nonorthogonal
states. Phys. Rev. Lett. 68, 3121 (1992)

QKA_ourShukla, C., Alam, N., Pathak, A.: Protocols of quantum
key agreement solely using Bell states and Bell measurement. Quantum
Inf. Process. 13, 2391 (2014)

ping-pongBostr�m, K. Felbinger, T.: Deterministic secure
direct communication using entanglement. Phys. Rev. Lett. 89,
187902 (2002)

AninditaBanerjee, A., Pathak, A.: Maximally efficient protocols
for direct secure quantum communication. Phys. Lett. A 376,
2944 (2012)

dsqc-1Shukla, C., Banerjee, A., Pathak, A.: Improved protocols
of secure quantum communication using W states. Int. J. Theor. Phys.
52, 1914 (2013)

reviewLong, G.-l., Deng, F.-g., Wang, C., Li, X.-h., Wen,
K., Wang, W.-y.: Quantum secure direct communication and deterministic
secure quantum communication. Front. Phys. China 2, 251 (2007)

online-shopHuang, W., Yang, Y.-H., Jia, H.-Y.: Cryptanalysis
and improvement of a quantum communication-based online shopping mechanism.
Quantum Inf. Process. 14, 2211-2225, (2015)

ba-anAn, N. B.: Quantum dialogue. Phys. Lett. A 328,
6 (2004)

baan_newAn, N. B.: Secure dialogue without a prior key
distribution. J. Kor. Phys. Soc. 47, 562 (2005)

ManMan, Z. X., Zhang, Z. J., Li, Y.: Quantum dialogue revisited.
Chin. Phys. Lett. 22, 22 (2005)

shi-auxilaryShi, G.-F.: Bidirectional quantum secure communication
scheme based on Bell states and auxiliary particles. Opt. Commun.
283, 5275 (2010)

NaseriNaseri, M.: An efficient protocol for quantum secure
dialogue with authentication by using single photons. Int. J. Quantum
Info. 9, 1677 (2011)

qdShukla, C., Kothari, V., Banerjee, A., Pathak, A.: On
the qroup-theoretic structure of a class of quantum dialogue protocols.
Phys. Lett. A 377, 518 (2013)

xiaXia, Y., Fu, C.-B., Zhang, S., Hong, S.-K., Yeon,
K.-H., Um, C.-I.: Quantum dialogue by using the GHZ state. J. Kor.
Phys. Soc. 48, 24 (2006)

dong-wDong, L., Xiu, X.-M., Gao, Y.-J., Chi, F.: Quantum
dialogue protocol using a class of three-photon W states. Commun.
Theor. Phys. 52, 853 (2009)

gao-swappingGao, G.: Two quantum dialogue protocols without
information leakage. Opt. Commun. 283, 2288 (2010)

referee2Zhou, N. R., Hua, T. X., Wu, G. T., He, C. S.,
Zhang, Y.: Single-photon secure quantum dialogue protocol without
information leakage. Int. J. Theor. Phys. 53, 3829 (2014)

QD-qutritZhang, L.-L., Zhan,Y.-B.: Quantum dialogue by
using the two-qutrit entangled states. Mod. Phys. Lett. B 23,
2993 (2009)

com-QD-qutGao, G.: Information leakage in quantum dialogue
by using the two-qutrit entangled states. Mod. Phys. Lett. B 28,
1450094 (2014)

CV-QDYu, Z. B., Gong, L. H., Zhu, Q. B., Cheng, S., Zhou,
N. R.: Efficient three-party quantum dialogue protocol based on the
continuous variable GHZ states. Int. J. Theor. Phys. 55,
3147 (2016)

probAuthQDHwang, T., Luo, Y.-P.: Probabilistic authenticated
quantum dialogue. Quantum Inf. Process. 14, 4631 (2015)

QSDD1Zheng, C., Long, G.F.: Quantum secure direct dialogue
using Einstein-Podolsky-Rosen pairs. Sci. China Phys. Mech. Astron.
57, 1238 (2014)

QSDD2Ye, T.-Y.: Quantum secure direct dialogue over collective
noise channels based on logical Bell states. Quantum Inf. Process.
14, 1487 (2015)

QD-EnSwapWang, H., Zhang, Y. Q., Liu, X. F., & Hu, Y.
P.:. Efficient quantum dialogue using entangled states and entanglement
swapping without information leakage. Quantum Info. Process. 15,
2593-2603 (2016)

quantum_telephon1Wen, X., Liu, Y., Zhou, N.: Secure quantum
telephone. Opt. Commun. 275, 278 (2007)

Y_Sun_improve_telephoneSun, Y., Wen, Q.-Y., Gao, F., Zhu,
F.-C.: Improving the security of secure quantum telephone against
an attack with fake particles and local operations. Opt. Commun. 282,
2278 (2009)

sakshi-panigrahi-eplJain, S., Muralidharan, S., Panigrahi,
P. K.: Secure quantum conversation through non-destructive discrimination
of highly entangled multipartite states. Eur. Phys. Lett. 87,
60008 (2009)

N09Noh, T. G.: Counterfactual quantum cryptography. Phys.
Rev. Lett. 103, 230501 (2009)

vaidman-goldenbergGoldenberg, L., Vaidman, L.: Quantum
cryptography based on orthogonal states. Phys. Rev. Lett. 75,
1239 (1995)

cs-thesisShukla, C.: Design and analysis of quantum communication
protocols. Ph.D. thesis, Jaypee Institute of Information Technology,
Sector-62, Noida, India, 1-166 (2015)

QPC_KishoreThapliyal, K., Sharma, R. D., Pathak, A.: Orthogonal-state-based
and semi-quantum protocols for quantum private comparison in noisy
environment. arXiv:1608.00101 (2016)

Talmor2007bBoyer, M., Kenigsberg, D., Mor, T.: Quantum
key distribution with classical Bob. Phys. Rev. Lett. 99,
140501 (2007)

talmor2Boyer, M., Gelles, R., Kenigsberg, D., Mor, T.:
Semiquantum key distribution. Phys. Rev. A 79, 032341 (2009)

Zou_less_than_4_quantum_statesZou, X., Qiu., D., Li., L.,
Wu., L., Li, L.: Semiquantum-key distribution using less than four
quantum states. Phys. Rev. A 79, 052312 (2009)

Zou2015qinpZou, X., Qiu, D., Zhang, S., Mateus, P.: Semiquantum
key distribution without invoking the classical party’s
measurement capability. Quantum Info. Process. 14, 2981-2996
(2015)

nearly-c-BobLi, Q., Chan, W.-H., Zhang, S.: Semiquantum
key distribution with secure delegated quantum computation. Sci. Rep.
6, 19898 (2016)

Semi-AQKDYu, K.-F., Yang, C.-W., Liao, C.-H., Hwang, T.:
Authenticated semi-quantum key distribution protocol using Bell states.
Quantum Inf. Process. 13, 1457-1465 (2014)

MediatedSQKDKrawec, W. O.: Mediated semiquantum key distribution.
Phys. Rev. A 91, 032323 (2015)

multiuserSemiQKDZhang, X.-Z., Gong, W.-G., Tan, Y.-G.,
Ren, Z.-Z. & Guo, X.-T. Quantum key distribution series network protocol
with m-classical Bobs. Chin. Phys. B 18, 2143-2148 (2009)

QKD-limited-c-BobSun, Z.-W., Du, R.-G., Long, D.-Y.: Quantum
key distribution with limited classical Bob. Int. J. Quant. Inf. 11,
1350005 (2013)

Kraweck-phd-thesis-2015Krawec, W. O.: Semi-Quantum key
distribution: protocols, security analysis, and new models. PhD thesis
submitted at Stevens Institute of Technology, New Jersey, USA (2015)

Krawec-3-qinpKrawec, W. O.: Restricted attacks on semi-quantum
key distribution protocols. Quantum Info. Process. 13, 2417-2436,
(2014)

QKD_with_classical_AliceLu, H., Cai, Q.-Y.: Quantum key
distribution with classical Alice. Int. J. Quantum Inf. 6,
1195-1202 (2008)

Li16_without_classical_channelLi, C. M., Yu, K. F., Kao,
S. H. et al. Authenticated semi-quantum key distributions without
classical channel. Quantum Inf Process. 15, 2881 (2016)

tamor3Boyer, M., Mor. T.: Comment on “Semiquantum-key
distribution using less than four quantum states”.
Phys. Rev. A 83, 046301 (2011)

goutampal-eavesdroppingMaitra, A., Goutam, P.: Eavesdropping
in semiquantum key distribution protocol. Info. Processing Letters
113, 418-422 (2013)

nie-sqis1Nie, Y.-y., Li, Y.-h., Wang, Z.-s.: Semi-quantum
information splitting using GHZ-type states. Quantum Info. process.
12, 437-448 (2013)

sqss-2010Qin, L., Chan, W. H., Long, D.-Y.: Semiquantum
secret sharing using entangled states. Phys. Rev. A 82, 022303
(2010)

LI-sqssLi, L., Qui, D., and Mateus, P.: Quantum secret
sharing with classical Bobs. Journal of Physics A Mathematical and
Theoretical 46, 045304 (2013)

attack_on_sqisJason, L., Yang, C.-W., Tsai, C.-W., Hwang,
T.: Intercept-resend attacks on semi-quantum secret sharing and the
improvements. Int. J. of Theor. Phys. 52, 156-162 (2013)

semi-AQSDCLuo, Y.-P., Hwang, T.: Authenticated semi-quantum
direct communication protocols using Bell states. Quantum Inf. Process
15, 947-958 (2016)

3-step-QSDCZou, X.-F., Qiu, D.-W.: Three-step semiquantum
secure direct communication protocol. Physics, Mechanics & Astronomy,
57 , 1696-1702 (2014)

SQPCChou, W.-H., Hwang, T., Gu, J.: Semi-quantum private
comparison protocol under an almost-dishonest third party, arXiv:1607.07961v2
(2016)

Krwawec-2-2015-security-proofKrawec, W. O.: Security proof
of a semi-quantum key distribution protocol. In Information Theory
(ISIT), IEEE International Symposium, 686-690 (2015)

1Security-SQKDMiyadera, T.: Relation between information
and disturbance in quantum key distribution protocol with classical
Alice. Int. J. of Quant. Inf.  9, 1427-1435 (2011)

2Security-SQKDKrawec, W.O.: Security proof of a semi-quantum
key distribution protocol. DOI: 10.1109/ISIT.2015.7282542, IEEE 2015.

3Security-SQKDKrawec, W.O.: Security of a semi-quantum
protocol where reflections contribute to the secret key. Quantum Inf.
Process. 15 2067-2090 (2016) 

security_zhang1Zhang, W., Qiu, D., Zou, X. and Mateus,
P.: A single-state semi-quantum key distribution protocol and its
security proof. arXiv preprint arXiv:1612.03087 (2016)

security_zhang2Zhang, W. and Qiu, D.: Security of a single-state
semi-quantum key distribution protocol. arXiv preprint arXiv:1612.03170
(2016)

e-commerceChou, Y.-H., Lin, F.-J., Zeng, G.-J.: An efficient
novel online shopping mechanism based on quantum communication. Electron
Commer. Res. 14, 349-367 (2014) 

Our-auctionSharma, R. D., Thapliyal, K., Pathak, A.: Quantum
sealed-bid auction using a modified scheme for multiparty circular
quantum key agreement. arXiv:1612.08844v1 (2016)

Voting1Thapliyal, K., Sharma, R. D., Pathak, A.: Protocols
for quantum binary voting. Int. J. of Quantum Info. 15, 1750007
(2017)

Voting2Sharma, R. D., De, A.: Quantum voting using single
qubits. Indian Journal of Science and Technology 9, 98637
(2016)

Implementation_attack1Fung, C.-H. F., Qi, B., Tamaki, K.,
Lo, H.-K.: Phase-remapping attack in practical quantum-key-distribution
systems. Phys. Rev. A 75, 032314 (2007)

Implementation_attack2Zhao, Y., Fung, C.-H. F., Qi, B.,
Chen, C., Lo, H.-K.: Quantum hacking: Experimental demonstration of
time-shift attack against practical quantum-key-distribution systems.
Phys. Rev. A 78, 042333 (2008)

Implementation_attack3Lydersen, L., Wiechers, C., Wittmann,
C., Elser, D., Skaar, J., Makarov, V.: Hacking commercial quantum
cryptography systems by tailored bright illumination. Nat. Photonics
4, 686 (2010)

talmor2007Boyer, M., Dan, K., Tal, M.: Quantum key distribution
with classical Bob. In Quantum, Nano, and Micro Tech., ICQNM'07. First
International Conference, IEEE, 10-10 (2007)

QCBanerjee, A., Thapliyal, K., Shukla, C., Pathak, A.:
Quantum conference. arxiv:1702.00389v1 (2017)

AQDBanerjee, A., Shukla, C., Thapliyal, K., Pathak, A.,
Panigrahi, P. K.: Asymmetric quantum dialogue in noisy environment.
Quantum Inf. Process. doi:10.1007/s11128-016-1508-4 (2016)

decoySharma, R. D., Thapliyal, K., Pathak, A., Pan, A.
K., De, A.: Which verification qubits perform best for secure communication
in noisy channel? Quantum Inf. Process. 15, 1703-1718 (2016)

switchSrinatha, N., Omkar, S., Srikanth, R., Banerjee,
S., Pathak, A.: The quantum cryptographic switch. Quantum Inf. Process.
13, 59 (2014)

crypt-switchThapliyal, K., Pathak, A.: Applications of
quantum cryptographic switch: Various tasks related to controlled
quantum communication can be performed using Bell states and permutation
of particles. Quantum Inf. Process. 14, 2599 (2015)

cdsqcPathak, A.: Efficient protocols for unidirectional
and bidirectional controlled deterministic secure quantum communication:
Different alternative approaches. Quantum Inf. Process. 14,
2195 (2015)

referee1Yu, Z. B., Gong, L. H., Wen, R. H.: Novel multiparty
controlled bidirectional quantum secure direct communication based
on continuous-variable states. Int. J. Theor. Phys. 55, 1447
(2016)

effCabello, A.: Quantum key distribution in the Holevo
limit. Phys. Rev. Lett. 85, 5635 (2000)

nielsenNielsen, M. A., Chuang, I. L.: Quantum Computation
and Quantum Informatiom. Cambridge University Press, New Delhi (2008)

