Quantum dialogue by nonselective measurements

Mankind would not be developed without communication which may be public or private. Private communication should be confidential. That is why cryptography appeared since the early period of civilization. Unconditionally secure communication can be achieved by means of the one-time pad encryption system [1], but it is inconvenient in practice. The public key encryption system [2] is practically convenient, but relies on mathematical difficulty of problems that cannot be solved efficiently within current resources, such as the hardness of discrete logarithm problems and the factorization of a large integer, so its security is unproven and seriously threatened by scalable quantum computers [3]. A potential solution is quantum cryptography [4] that relies on the laws of quantum mechanics to distribute secret keys. The essential point is the use of quantum states for cryptographic tasks. Since nature forbids perfectly duplicating data encoded in a quantum state and any attempt to read the data disturbs the quantum state, eavesdropping by a unauthorized party, if any, can be detected by the authorized parties.

Let Alice and Bob be two authorized communicating parties. If Alice wishes to securely send Bob a message she must, together with Bob, first run a quantum protocol (like BB84 [5] or E91 [6] or others) to generate a shared secret key. Then, Alice combines each character of her plaintext message with the corresponding character of the generated key to form the so-called ciphertext, which is sent to Bob. Bob is able to decrypt the ciphertext by the same shared key. If Alice and Bob wish to secretly exchange their messages, they need to generate and share two different secret keys, one is used for Alice-to-Bob communication while the other for Bob-to-Alice's. Although it is absolutely secure, it requires establishing secret keys before actual encoding, sending and decoding messages. Here a question arises: can one still deliver confidential messages without a prior key distribution, as it is desirable in case of urgency? In fact, this can be done by the so-called quantum secure direct communication protocols (see, e.g., [7]). However, most of the proposed protocols for quantum secure direct communication allow only one-way communication, i.e., from a sender to a receiver. Later a quantum protocol was put forward [8, 9] that enables bidirectional communication, allowing two legitimate parties, Alice and Bob, to exchange their secret messages in a way much like a dialogue. Since then a great deal of improvements, modifications and extensions of the so-called quantum dialogue [8] have been made, including quantum dialogue using single photons [10, 11], quantum dialogue using entangled states and entanglement swapping [12], controlled quantum dialogue [13, 14], quantum dialogue using hyper-entanglement and Greenberger-Horne-Zeilinger states [15] against noises [16, 17], quantum dialogue combined with authenticated quantum secret sharing [18], quantum dialogue by continuous-variable states [19, 20], device-independent quantum dialogue [21], asymmetric quantum dialogue in noisy environment [22], semi-quantum dialogue [23] and so on.

In existing quantum dialogue protocols signals to be exchanged are encoded in type of states (e.g., by means of $m,n$ in Einstein–Podolsky–Rosen states [24] $\left| {{\Psi }_{mn}} \right\rangle =\frac{1}{\sqrt{2}}\sum\nolimits_{j=0}^{1}{{{(-1)}^{mj}}}\left|\, j,j\oplus n \right\rangle$, with $\oplus$ denoting addition modulo 2) and choice of operators (e.g., by means of $k,l$ in Pauli operators $\sigma _{z}^{k}\sigma _{x}^{l}$). In this work, we shall encode signals in the measurement bases. Also, nonselective measurements (i.e., measurements without reading the outcome) play an important role in executing the dialogue. This is somewhat surprising in comparison with classical situations. In classical world, making a measurement but disregarding its outcome is nothing else but doing nothing because this provides no information at all. However, in quantum world, the nature of measurement is totally different. Besides resulting probabilistic outcomes and disturbing the measured system, quantum measurement carried out in a specific basis inevitably leaves its trace behind, even without caring about its outcome. Therefore, nonselective measurements can be exploited for signalling [25]. The bases of measurement we are concerned with are mutually unbiased whose properties are briefly mentioned in section 2. Section 3 presents our quantum dialogue protocol with measurement bases as signals and nonselective measurement as a tool. We then analyse security of the protocol against typical eavesdropping attacks in section 4 and conclude in the last section 5.

Consider a quNit in an $N$-dimensional Hilbert space spanned in the computational basis by $N$ orthonormal basic states $\left\{\left| l \right\rangle ;l=0,1,...,N-1;N\gg 1 \right\}$. Let the $N$-dimensional Heisenberg–Weyl operators, which are natural generalization of Pauli operators ${{\sigma }_{x}}$ and ${{\sigma }_{z}}$, be

$$\begin{align} \newcommand{\e}{{\rm e}} \displaystyle X=\sum\limits_{l=0}^{N-1}{\left| l+1 \right\rangle \left\langle l \right|}\nonumber \end{align} \tag{ 1 }$$

$$\begin{align} \newcommand{\e}{{\rm e}} \displaystyle Z=\sum\limits_{l=0}^{N-1}{{{\Omega }^{l}}\left| l \right\rangle \left\langle l \right|},\nonumber \end{align} \tag{ 2 }$$

with '+' inside the ket denoting addition modulo $N$ and $\newcommand{\e}{{\rm e}} \Omega =\exp (2\pi i/N)$ the complex $N$th root of unity. It can be proved [26] that if $N$ is an odd prime, then there exists a complete set of $N+1$ mutually unbiased bases (MUBs), each is composed of $N$ orthonormal states which are eigenstates of the $N+1$ unitary operators $\{X{{Z}^{\beta }};\beta =0,1,...,N-1\}$ and $Z$. Namely, a $k$th state $\left(k=0,1,...,N-1 \right)$ of a $\beta$th basis can be found to be

$$\begin{align} \newcommand{\e}{{\rm e}} \displaystyle \left| \beta ;k \right\rangle =\frac{1}{\sqrt{N}}\sum\limits_{l=0}^{N-1}{{{\Omega }^{(\beta +k)l-2k{{s}_{l}}}}\left| l \right\rangle },\nonumber \end{align} \tag{ 3 }$$

with

$$\begin{align} \newcommand{\e}{{\rm e}} \displaystyle {{s}_{l}}=\sum\limits_{j=l}^{N-1}{j}=\frac{1}{2}(N-l)(N+l-1),\nonumber \end{align} \tag{ 4 }$$

and a $k$th state $\left(k=0,1,...,N-1 \right)$ of the $(N+1)$th basis (which is the computational basis whose states are the eigenstates of the operator $Z$) is

$$\begin{align} \newcommand{\e}{{\rm e}} \displaystyle \left| N;k \right\rangle \equiv \left| k \right\rangle .\nonumber \end{align} \tag{ 5 }$$

Thus, there are $N(N+1)$ states in total which are grouped into $N+1$ bases (labelled by $\beta =0,1,\,\ldots ,N-1$ for the first $N$ bases and by $N$ for the $(N+1)$th basis) each has $N$ orthonormal states (labeled by $k=0,1,\ldots ,N-1$). In this paper, for our convenience, we make use of the Fourier-Gauss structure and adopt the form

$$\begin{align} \newcommand{\e}{{\rm e}} \displaystyle \left| \beta ;k \right\rangle =\frac{1}{\sqrt{N}}\sum\limits_{l=0}^{N-1}{{{\Omega }^{\beta {{l}^{2}}+kl}}\left| l \right\rangle },\nonumber \end{align} \tag{ 6 }$$

which are equivalent to (3) up to the indexing of bases. It can be shown that the $N+1$ bases (5) and (6) mentioned above obey the mutual unbiasedness conditions

$$\begin{align} \newcommand{\e}{{\rm e}} \displaystyle {{\left| \left\langle {{\beta }^{\prime }};{{k}^{\prime }} | \beta ;k \right\rangle \right|}^{2}}={{\left| \left\langle {{k}^{\prime }} | \beta ;k \right\rangle \right|}^{2}}=\frac{1}{N}\nonumber \end{align} \tag{ 7 }$$

for any $k,{{k}^{\prime }}$ and $\beta \ne {{\beta }^{\prime }}$, as must be due to definition of MUSs [27, 28].

We can generate any state $\left| \beta ;k \right\rangle$ from a state in the computational basis $\newcommand{\e}{{\rm e}} \left| k \right\rangle \equiv \left| N;k \right\rangle$ as follows. To generate the state $\left| 0;k \right\rangle$, we apply on $\left| k \right\rangle$ the unitary operator

$$\begin{align} \newcommand{\e}{{\rm e}} \displaystyle F=\frac{1}{\sqrt{N}}\sum\limits_{l=0}^{N-1}{\sum\limits_{m=0}^{N-1}{{{\Omega }^{ml}}\left| l \right\rangle \left\langle m \right|}},\nonumber \end{align} \tag{ 8 }$$

which is the discrete quantum Fourier transformation [29]. In fact,

$$\begin{align} \newcommand{\e}{{\rm e}} \displaystyle \begin{array}{@{}llllllllllllllllllll@{}} F\left| k \right\rangle =\frac{1}{\sqrt{N}}\sum\limits_{l=0}^{N-1}{\sum\limits_{m=0}^{N-1}{{{\Omega }^{ml}}\left| l \right\rangle \left\langle m | k \right\rangle }} \nonumber \\ \qquad =\frac{1}{\sqrt{N}}\sum\limits_{l=0}^{N-1}{{{\Omega }^{kl}}\left| l \right\rangle }=\left| 0;k \right\rangle , \end{array}\nonumber \end{align} \tag{ 9 }$$

where the last equality holds thanks to equation (6). As for the $N-1$ other states $\left| \beta ;k \right\rangle$ with $\beta =1,...,N-1$, we apply the unitary operator [28]

$$\begin{align} \newcommand{\e}{{\rm e}} \displaystyle U=\sum\limits_{m=0}^{N-1}{{{\Omega }^{{{m}^{2}}}}\left| m \right\rangle \left\langle m \right|}\nonumber \end{align} \tag{ 10 }$$

$\beta$ times on the previously generated state $\left| 0;k \right\rangle$ to obtain

$$\begin{align} \newcommand{\e}{{\rm e}} \displaystyle \begin{array}{@{}lllllllllllllllllllllllllllll@{}} {{U}^{\beta }}\left| 0;k \right\rangle =\frac{1}{\sqrt{N}}\sum\limits_{m,l=0}^{N-1}{{{\Omega }^{\beta {{m}^{2}}+kl}}\left| m \right\rangle \left\langle m | l \right\rangle } \nonumber \\ \qquad\qquad =\frac{1}{\sqrt{N}}\sum\limits_{l=0}^{N-1}{{{\Omega }^{\beta {{l}^{2}}+kl}}\left| l \right\rangle }=\left| \beta ;k \right\rangle , \end{array}\nonumber \end{align} \tag{ 11 }$$

where the last equality holds thanks to equation (6) too.

We now deal with bipartite entanglement in MUSs. Consider two quNits $1$ and $2$. QuNit $1$ is prepared in the state ${{\left| \beta ;k \right\rangle }_{1}}$ with fixed $\beta$ and $k$, while quNit $2$ in the state $\newcommand{\e}{{\rm e}} {{\left| N;q \right\rangle }_{2}}\equiv {{\left| q \right\rangle }_{2}}$ with a fixed $q$. Let $C{{S}_{12}}$ and $CS_{12}^{+}$,

$$\begin{align} \newcommand{\e}{{\rm e}} \displaystyle C{{S}_{12}}{{\left| m \right\rangle }_{1}}{{\left| n \right\rangle }_{2}}={{\left| m \right\rangle }_{1}}{{\left| n+m \right\rangle }_{2}}\nonumber \end{align} \tag{ 12 }$$

and

$$\begin{align} \newcommand{\e}{{\rm e}} \displaystyle CS_{12}^{{\rm +}}{{\left| m \right\rangle }_{1}}{{\left| n \right\rangle }_{2}}={{\left| m \right\rangle }_{1}}{{\left| n-m \right\rangle }_{2}},\nonumber \end{align} \tag{ 13 }$$

with algebra inside the kets modulo $N$ and $\newcommand{\e}{{\rm e}} \left| -l \right\rangle \equiv \left| N-l \right\rangle$, be two-quNit controlled-shift-forward and controlled-shift-backward gates, with quNit $1$ the control quNit and quNit $2$ the target one. Then,

$$\begin{align} \newcommand{\e}{{\rm e}} \displaystyle {{\left| \beta ;k,q \right\rangle }_{12}}=C{{S}_{12}}{{\left| \beta ;k \right\rangle }_{1}}{{\left| q \right\rangle }_{2}}=\frac{1}{\sqrt{N}}\sum\limits_{l=0}^{N-1}{{{\Omega }^{\beta {{l}^{2}}+kl}}{{\left| l \right\rangle }_{1}}{{\left| q+l \right\rangle }_{2}}}\nonumber \end{align} \tag{ 14 }$$

is a two-quNit entangled state. The entanglement of state (14) is ensured by the property that if quNit $1$ and quNit $2$ are measured separately in their computational bases then the outcome $a$ corresponding to finding ${{\left| a \right\rangle }_{1}}$ and the outcome $b$ corresponding to finding ${{\left| b \right\rangle }_{2}}$ satisfy the equality

$$\begin{align} \newcommand{\e}{{\rm e}} \displaystyle b=q+a,\nonumber \end{align} \tag{ 15 }$$

independent of concrete sequence of the two measurements, revealing a nonclassical correlation (entanglement) between the two quNits. In total there are ${{N}^{3}}$ entangled states of the form (14) which are characterized by three parameters $\beta ,k,q\in \{0,1,...,N-1\}$. On the other hand, having two quNits of such a state in the same place with unknown $k,q$ and known $\beta$ we can easily identify it by first performing $CS_{12}^{{\rm +}}$ on it and then measuring the first quNit in the basis $\beta$ and the second quNit in the computational basis (i.e., basis $N$). Namely, because

$$\begin{align} \newcommand{\e}{{\rm e}} \displaystyle CS_{12}^{+}{{\left| \beta ;k,q \right\rangle }_{12}}=\left(\frac{1}{\sqrt{N}}\sum\limits_{l=0}^{N-1}{{{\Omega }^{\beta {{l}^{2}}+kl}}{{\left| l \right\rangle }_{1}}} \right){{\left| q \right\rangle }_{2}}={{\left| \beta ;k \right\rangle }_{1}}{{\left| q \right\rangle }_{2}},\nonumber \end{align} \tag{ 16 }$$

the subsequent single-quNit measurements will determine the values of $k$ and $q$, thus identifying the two-quNit entangled state under question. Yet, if the two quNits are separated spatially so that the two-quNit gate $CS_{12}^{+}$ cannot be performed, then a unknown two-quNit entangled state remains unknown. In passing we note a couple of formulae, namely

$$\begin{align} \newcommand{\e}{{\rm e}} \displaystyle _{1}{{\left\langle {{\beta }^{\prime }};p | \beta ;k,q \right\rangle }_{12}}=\frac{1}{N}\sum\limits_{l=0}^{N-1}{{{\Omega }^{(\beta -{{\beta }^{\prime }}){{l}^{2}}+(k-p)l}}{{\left| q+l \right\rangle }_{2}}},\nonumber \end{align} \tag{ 17 }$$

and

$$\begin{align} \newcommand{\e}{{\rm e}} \displaystyle _{1}{{\left\langle\,p | \beta ;k,q \right\rangle }_{12}}=\frac{1}{\sqrt{N}}{{\Omega }^{\beta {{p}^{2}}+kp}}{{\left| q+p \right\rangle }_{2}}\nonumber \end{align} \tag{ 18 }$$

which prove to be useful later.

In this section we shall show in detail how Alice and Bob can 'talk' with each other in a quantum manner. Before that let us describe a simpler task of how Alice and Bob can exchange a pair of secret numbers. Let Alice have a number which is either ${{\beta }^{\prime }}\in \{0,1,...,N-1\}$ or $N$ with $N$ being a large prime and Bob a number $\beta \in \{0,1,...,N-1\}$. Suppose they wish to exchange their numbers securely. Since classical communication is insecure they must do this quantumly. A way to do this is as follows.

To start with, Bob prepares a state ${{\left| \beta ;k,q \right\rangle }_{AB}}$, with known $\beta ,k,q$, then sends quNit $A$ to Alice but keeps quNit $B$ with himself. Alice, upon receiving $A$, measures it either in the basis ${{\beta }^{\prime }}$ (if she wishes to send number ${{\beta }^{\prime }}$ to Bob) or in the computational basis (if she wishes to send number $N$ to Bob). After her measurement she returns $A$ back to Bob without recording the outcome (that is, Alice's measurement is nonselective).

For Alice's measurement in basis ${{\beta }^{\prime }}$, she uses the projectors

$$\begin{align} \newcommand{\e}{{\rm e}} \displaystyle {{\Pi }_{A}}\left({{\beta }^{\prime }},p \right)={{\left| {{\beta }^{\prime }};p \right\rangle }_{A}}\left\langle {{\beta }^{\prime }};p \right|,\nonumber \end{align} \tag{ 19 }$$

with $p=0,1,...,N-1$. There are $N$ measurement outcomes corresponding to finding $A$ in state ${{\left| {{\beta }^{\prime }};p \right\rangle }_{A}}$ with $p\in \{0,1,...,N-1\}$, each occurs with some probability. For whatever the outcome, if Alice records it then quNit $A$ will be disentangled from quNit $B$. This scenario is not of our interest. Here, we are concerned with nonselective measurement so no outcomes are to be recorded: quNits $A$ and $B$ are not projected on a pure product state but become in a mixed state of the form

$$\begin{align} \newcommand{\e}{{\rm e}} \displaystyle {{\rho }_{AB}}(\beta ,{{\beta }^{\prime }},k,q)=\sum\limits_{p=0}^{N-1}{{{\Pi }_{A}}({{\beta }^{\prime }},p){{\rho }_{AB}}(\beta ,k,q){{\Pi }_{A}}({{\beta }^{\prime }},p)},\nonumber \end{align} \tag{ 20 }$$

where

$$\begin{align} \newcommand{\e}{{\rm e}} \displaystyle {{\rho }_{AB}}(\beta ,k,q)={{\left| \beta ;k,q \right\rangle }_{AB}}\left\langle \beta ;k,q \right|.\nonumber \end{align} \tag{ 21 }$$

Evidently, ${{\rho }_{AB}}(\beta ,{{\beta }^{\prime }},k,q)$ depends explicitly not only on $\beta ,k,q$ but also on ${{\beta }^{\prime }}$ which is the very point of nonselective measurement that we exploit for our quantum dialogue protocol. Bob, upon getting back from Alice the quNit $A$, measures the two quNits $A$ and $B$ in the bases in which he prepared the initial two-quNit entangled state (14). Technically, this means that he makes use of $CS_{AB}^{{\rm +}}$ defined in equation (13) to transform (20) to $CS_{AB}^{{\rm +}}{{\rho }_{AB}}(\beta ,{{\beta }^{\prime }},k,q)C{{S}_{AB}}$ then measures quNit $A$ in the basis $\beta$ and quNit $B$ in the computational basis. In other words, we can say that Bob uses the following projectors

$$\begin{align} \newcommand{\e}{{\rm e}} \displaystyle {{\Pi }_{AB}}(\beta ,{{k}^{\prime }},{{q}^{\prime }})={{\left| \beta ;{{k}^{\prime }},{{q}^{\prime }} \right\rangle }_{AB}}\left\langle \beta ;{{k}^{\prime }},{{q}^{\prime }} \right|,\nonumber \end{align}$$

with ${{k}^{\prime }},{{q}^{\prime }}=0,1,...,N-1$. There are ${{N}^{2}}$ measurement outcomes corresponding to finding $A$ and $B$ in state ${{\left| \beta ;{{k}^{\prime }},{{q}^{\prime }} \right\rangle }_{AB}}$ with some ${k}',{q}'\in \{0,1,...,N-1\}$, occurring with probability

$$\begin{align} \newcommand{\e}{{\rm e}} \displaystyle {{P}_{AB}}(\beta ,{{\beta }^{\prime }},k,q,{{k}^{\prime }},{{q}^{\prime }})={{}_{AB}}\left\langle \beta ;{{k}^{\prime }},{{q}^{\prime }} \right|{{\rho }_{AB}}(\beta ,{{\beta }^{\prime }},k,q){{\left| \beta ;{{k}^{\prime }},{{q}^{\prime }} \right\rangle }_{AB}}.\nonumber \end{align} \tag{ 22 }$$

Putting the right-hand-side of equation (20) into the right-hand-side of equation (22) and taking into account equation (17) yields

$$\begin{align} \newcommand{\e}{{\rm e}} \displaystyle \begin{array}{@{}cccccccccccccccccccc@{}} & {{P}_{AB}}\left(\beta ,{{\beta }^{\prime }},k,q,{{k}^{\prime }},{{q}^{\prime }} \right)=\sum\limits_{p=0}^{N-1}{{{\left| _{AB}{{\left\langle \beta ;{{k}^{\prime }},{{q}^{\prime }} | {{\beta }^{\prime }};p \right\rangle }_{A}}{{\left\langle {{\beta }^{\prime }};p | \beta ;k,q \right\rangle }_{AB}} \right|}^{2}}} \nonumber \\ &\,\,\, =\frac{1}{N}{{\delta }_{k-{{k}^{\prime }},2(\beta -{{\beta }^{\prime }})(q-{{q}^{\prime }})}}, \end{array}\nonumber \end{align} \tag{ 23 }$$

with ${{\delta }_{a,b}}$ the Kronecker delta equal to $1$ if $a=b$ and to $0$ if $a\ne b$.

As for Alice's measurement in the computational basis, the projectors to be used are

$$\begin{align} \newcommand{\e}{{\rm e}} \displaystyle {{\Pi }_{A}}(N;p)={{\left| N;p \right\rangle }_{A}}\left\langle N;p \right|\equiv {{\left| p \right\rangle }_{A}}\left\langle\,p \right|={{\Pi }_{A}}(\,p),\nonumber \end{align} \tag{ 24 }$$

with $p=0,1,...,N-1$. Alice would probabilistically obtain one of the $N$ outcomes corresponding to finding $A$ in state ${{\left| p \right\rangle }_{A}}$ with $p\in \{0,1,...,N-1\}$. Without reading the outcomes the two quNits $A$ and $B$ after Alice's measurement are described by the density matrix

$$\begin{align} \newcommand{\e}{{\rm e}} \displaystyle {{\rho }_{AB}}(\beta ,N,k,q)=\sum\limits_{p=0}^{N-1}{{{\Pi }_{A}}}(\,p){{\rho }_{AB}}(\beta ,k,q){{\Pi }_{A}}(\,p),\nonumber \end{align}$$

with ${{\rho }_{AB}}(\beta ,k,q)$ given by equation (21). Bob, in possession of both the quNits $A$ and $B$ at hand, measures them in the bases $\left\{{{\left| \beta ;{{k}^{\prime }},{{q}^{\prime }} \right\rangle }_{AB}};{{k}^{\prime }},{{q}^{\prime }}=0,1,...,N-1 \right\}$, as in the case of Alice's measurement in basis ${{\beta }^{\prime }}$. The probability of finding state ${{\left| \beta ;{{k}^{\prime }},{{q}^{\prime }} \right\rangle }_{AB}}$ can be calculated by virtue of equations (18) and (24) as

$$\begin{align} \newcommand{\e}{{\rm e}} \displaystyle \begin{array}{@{}llllllllllllllllllllllllll@{}} {{P}_{AB}}(\beta ,N,k,q,{{k}^{\prime }},{{q}^{\prime }})={{}_{AB}}\langle \beta ;{{k}^{\prime }},{{q}^{\prime }}|{{\rho }_{AB}}(\beta ,N,k,q){{\left| \beta ;{{k}^{\prime }},{{q}^{\prime }} \right\rangle }_{AB}} \nonumber \\ \qquad\qquad\qquad \qquad\quad =\sum\limits_{p=0}^{N-1}{{{\left| _{AB}{{\left\langle \beta ;{{k}^{\prime }},{{q}^{\prime }} | p \right\rangle }_{A}}{{\left\langle\,p | \beta ;k,q \right\rangle }_{AB}} \right|}^{2}}} \nonumber \\ \qquad\qquad \qquad\qquad\quad=\frac{1}{N}{{\delta }_{q,{q}'}}. \end{array}\nonumber \end{align} \tag{ 25 }$$

The expressions (23) and (25) indicate the following.

• (i)  
  If ${{q}^{\prime }}=q$ and ${{k}^{\prime }}=k$, then ${{P}_{AB}}(\beta ,{{\beta }^{\prime }},k,q,{{k}^{\prime }},{{q}^{\prime }})=$ ${{P}_{AB}}(\beta ,N,k,q,{{k}^{\prime }},{{q}^{\prime }})=1/N$. So we are not able to know with certainty in which basis Alice measured her quNit $A$, as it may equally be in basis ${{\beta }^{\prime }}$ or in the computational basis $N$.
• (ii)  
  If ${{q}^{\prime }}=q$ and ${{k}^{\prime }}\ne k,$ then ${{P}_{AB}}(\beta ,{{\beta }^{\prime }},k,q,{{k}^{\prime }},{{q}^{\prime }})=0$, but ${{P}_{AB}}(\beta ,N,k,q,{{k}^{\prime }},{{q}^{\prime }})=1/N$. So we know with certainty that Alice measured her quNit $A$ in the computational basis, the basis $N$.
• (iii)  
  If ${{q}^{\prime }}\ne q$, then ${{P}_{AB}}(\beta ,N,k,q,{{k}^{\prime }},{{q}^{\prime }})=0$, but ${{P}_{AB}}(\beta ,{{\beta }^{\prime }},k,q,{{k}^{\prime }},{{q}^{\prime }})=1/N$. So we know with certainty that Alice measured her quNit $A$ in the basis

  $$\begin{align} \newcommand{\e}{{\rm e}} \displaystyle {{\beta }^{\prime }}=\beta +\frac{{{k}^{\prime }}-k}{2(q-{{q}^{\prime }})}.\nonumber \end{align} \tag{ 26 }$$

Particularly in this case, if ${{k}^{\prime }}=k$, we know ${{\beta }^{\prime }}$ with certainty ${{\beta }^{\prime }}=\beta$. Thus, almost always Bob is able to know Alice's secret number, ${{\beta }^{\prime }}$ or $N$. Bob fails just in the only case (i) with probability $1/N$ which is vanishing in the large-$N$ limit.

Now, to let Alice know his secret number $\beta$, Bob sends Alice (in fact, just public announcement suffices) the number $\gamma =\beta +{{\beta }^{\prime }}$ or $\gamma =\beta +N$ depending on whether his outcome is ${{q}^{\prime }}\ne q$ or ${{q}^{\prime }}=q$ and ${{k}^{\prime }}\ne k$. Obviously, Alice is able to determine with certainty what is $\beta$ by correspondingly substracting ${{\beta }^{\prime }}$ or $N$ from $\gamma$. Because here $N$ is large it is highly hard for anyone, who does not know ${{\beta }^{\prime }}$ or $N$, to obtain the right value of $\beta$ from the announced value of $\gamma$.

As described by the above quantum procedure, the two people can at the same time exchange two numbers: ${{\beta }^{\prime }}\in \{0,1,...,N-1\}$ or $N$ from Alice to Bob and $\beta \in \{0,1,...,N-1\}$ from Bob to Alice. It is alright if no eavesdropper, Eve, exists. In practical real-life conditions Eve is supposed to exist and, as a powerful person capable of doing anything allowed by Nature, she can devise wise strategies of attack to steal partial or even full information if Alice and Bob ignore proper methods of control. In the rest part of this paper, we suggest a full protocol with suitable controls for Alice and Bob to 'talk' with each other in front of Eve's nose.

Let Alice have a set of secret numbers $\left\{{{\alpha }_{1}},{{\alpha }_{2}},...,{{\alpha }_{L}} \right\}$ while Bob a set of other secret numbers $\left\{{{\beta }_{1}},{{\beta }_{2}},...,{{\beta }_{L}} \right\}$, where $L\gg 1$, ${{\alpha }_{j}}\in \{0,1,...,N\}$ and ${{\beta }_{j}}\in \{0,1,...,N-1\}$. Suppose that they want to securely exchange their numbers sequentially like in a conversation, i.e., for each $j$, from $j=1$ until $j=L$, Alice 'asks' ${{\alpha }_{j}}$ and Bob 'answers' ${{\beta }_{j}}$. For that purpose they are suggested to proceed as follows (see figure 1).

• S1.  
  $j=0$.
• S2.  
  $j=j+1$. Bob entangles quNits ${{A}_{j}}$ and ${{B}_{j}}$ into state ${{\left| {{\beta }_{j}};{{k}_{j}},{{q}_{j}} \right\rangle }_{{{A}_{j}}{{B}_{j}}}}$ of equation (14), then sends ${{A}_{j}}$ to Alice and keeps ${{B}_{j}}$ in his lab.
• S3.  
  After receiving quNit ${{A}_{j}},$ Alice with probability ${{v}_{1}}$ performs a control mode of type 1 (CM1) or with probability $1-{{v}_{1}}$ executes a message mode of type 1 (MM1).

  • CM1.  
    Alice measures quNit ${{A}_{j}}$ in the computational basis and publicly publishes the measurement outcome ${{a}_{j}}$ which with a probability of $1/N$ takes on a value equal to $0,1,2,\ldots$ or $N-1$ corresponding to finding ${{\left| 0 \right\rangle }_{{{A}_{j}}}},{{\left| 1 \right\rangle }_{{{A}_{j}}}},{{\left| 2 \right\rangle }_{{{A}_{j}}}},...$ or ${{\left| N-1 \right\rangle }_{{{A}_{j}}}}$, respectively. She also informs Bob of her choice and asks him to measure quNit ${{B}_{j}}$ in the computational basis. The outcome ${{b}_{j}}$ of Bob's measurement corresponding to finding ${{\left| {{b}_{j}} \right\rangle }_{{{B}_{j}}}}$ also with a probability of $1/N$ takes on a value equal to $0,1,2,\ldots$ or $N-1$. Then Bob checks the equality (15) which here reads ${{b}_{j}}={{q}_{j}}+{{a}_{j}}$. If the equality holds, then he sets $j=j-1$ and goes back to S2 to continue. Otherwise, i.e., the equality is violated, then protocol should be restarted from S1.
  • MM1.  
    Alice encodes her number ${{\alpha }_{j}}$ by measuring quNit ${{A}_{j}}$ in the basis ${{\alpha }_{j}}$ then sends it (i.e., the measured quNit ${{A}_{j}})$ back to Bob without reading the measurement outcome.
• S4.  
  Bob uses the bases, in which the $j$th entangled state was prepared in S2, to jointly measure quNits ${{A}_{j}}$ and ${{B}_{j}}.$ Let his measurement outcome be a pair of numbers $k_{j}^{\prime },q_{j}^{\prime }\in \{0,1,...,N-1\}$ corresponding to finding ${{\left| {{\beta }_{j}};k_{j}^{\prime },q_{j}^{\prime } \right\rangle }_{{{A}_{j}}{{B}_{j}}}}$.
• S5.  
  Bob compares $k_{j}^{\prime }$ with ${{k}_{j}}$ and $q_{j}^{\prime }$ with ${{q}_{j}}.$ If $k_{j}^{\prime }={{k}_{j}}$ and $q_{j}^{\prime }={{q}_{j}}$, Bob sets $j=j-1$ and returns to S2 to continue. Otherwise, he with probability ${{v}_{2}}$ performs a control mode of type 2 (CM2) or with probability $1-{{v}_{2}}$ executes a message mode of type 2 (MM2).

  • CM2.  
    Bob informs Alice of his choice and asks her to reveal ${{\alpha }_{j}}$, then checks whether $N{{\delta }_{q_{j}^{\prime },{{q}_{j}}}}+$$(1-{{\delta }_{q_{j}^{\prime },{{q}_{j}}}})\left[ {{\beta }_{j}}+\frac{1}{2}{\left(k_{j}^{\prime }-{{k}_{j}} \right)}/{\left({{q}_{j}}=q_{j}^{\prime } \right)}\; \right]-{{\alpha }_{j}}=0$ or not. If it is, then Bob sets $j=j-1$ and returns to S2 to continue. Otherwise, the protocol should be restarted from S1.
  • MM2.  
    Bob decodes Alice's number as ${{\alpha }_{j}}=N{{\delta }_{q_{j}^{\prime },{{q}_{j}}}}+$$(1-{{\delta }_{q_{j}^{\prime },{{q}_{j}}}})\left[ {{\beta }_{j}}+\frac{1}{2}{\left(k_{j}^{\prime }-{{k}_{j}} \right)}/{\left({{q}_{j}}=q_{j}^{\prime } \right)}\; \right]$.
• S6.  
  Bob publicly announces ${{\gamma }_{j}}={{\alpha }_{j}}+{{\beta }_{j}}$.
• S7.  
  Hearing ${{\gamma }_{j}}$ from the public announcement, Alice decodes Bob's number as ${{\beta }_{j}}={{\gamma }_{j}}-{{\alpha }_{j}}$.
• S8.  
  If $j<L$, the protocol returns to S2 to continue. Otherwise (i.e., $j=L)$, it goes to S9.
• S9.  
  End.

Zoom In Zoom Out Reset image size

If S9 is reached, Alice and Bob succeeds their dialogue with a security level proportional to the length $L$ of the dialogue. More about security will be analyzed in the next section.

Since quNit ${{B}_{j}}$ remains always with Bob, Eve is only able to access quNit ${{A}_{j}}$ that travels back and forth between Alice and Bob. However, initially quNit ${{A}_{j}}$ is maximally entangled with quNit ${{B}_{j}}$ so its individual state,

$$\begin{align} \newcommand{\e}{{\rm e}} \displaystyle {{\rho }_{A}}={\rm T}{{{\rm r}}_{B}}{{\rho }_{AB}}(\beta ,k,q)=\frac{1}{N}\sum\limits_{l=0}^{N-1}{{{\left| l \right\rangle }_{A}}}\left\langle l \right|=\frac{{\hat{1}}}{N},\nonumber \end{align} \tag{ 27 }$$

with $\hat{1}$ the $N$-dimensional unit matrix, is maximally mixed containing no information and thus manipulating ${{A}_{j}}$ alone is useless. Eve is surely aware of that and will intentionally attack with additional resources.

Most impressive is perhaps the attack called capture-and-replace one. Eve ambushes on both routes from Bob to Alice as well as from Alice to Bob. She creates her own entangled state ${{\left| \beta _{j}^{\prime\prime };k_{j}^{\prime\prime },q_{j}^{\prime\prime } \right\rangle }_{{{C}_{j}}{{D}_{j}}}}$ with $\beta _{j}^{\prime\prime };k_{j}^{\prime\prime },{{q}^{\prime\prime }}$ chosen at her will and, when Bob releases quNit ${{A}_{j}}$, captures it and stores it in a quantum memory, followed by replacing quNit ${{A}_{j}}$ by quNit ${{C}_{j}}$ to be sent to Alice. Alice would encode her number ${{\alpha }_{j}}$ on the state of quNit ${{C}_{j}}$ as in MM1, then send quNit ${{C}_{j}}$ to Bob without recording the measurement outcome as designed by the protocol. Eve again captures quNit ${{C}_{j}}$ and, as Bob would do in S4 with quNits ${{A}_{j}}$ and ${{B}_{j}},$ she measures quNits ${{C}_{j}}$ and ${{D}_{j}}$ in the basis $\left\{{{\left| \beta _{j}^{\prime\prime };k_{j}^{\prime },q_{j}^{\prime } \right\rangle }_{{{C}_{j}}{{D}_{j}}}} \right\}.$ If $q_{j}^{\prime }=q_{j}^{\prime\prime }$ and $k_{j}^{\prime }=k_{j}^{\prime\prime }$ are obtained, Eve gets no information about ${{\alpha }_{j}}$ so she puts quNit ${{C}_{j}}$ aside but takes quNit ${{A}_{j}}$ intact from the quantum memory and sends it back to Bob. Bob's measurement outcome in S4 must be $k_{j}^{\prime }={{k}_{j}},q_{j}^{\prime }={{q}_{j}}$ so that the protocol returns back to S2 to continue. Otherwise, i.e., if $q_{j}^{\prime }=q_{j}^{\prime\prime }$, $k_{j}^{\prime }\ne k_{j}^{\prime\prime }$ or $q_{j}^{\prime }\ne q_{j}^{\prime\prime }$, Eve determines ${{\alpha }_{j}}$ as in MM2. After having known ${{\alpha }_{j}}$, Eve uses the basis ${{\alpha }_{j}}$ to nonselectively measure quNit ${{A}_{j}}$ he stored before in the memory, then sends this measured quNit ${{A}_{j}}$ back to Bob, who would execute S4 to obtain ${{\alpha }_{j}}$ and proceeds further to broadcast ${{\gamma }_{j}}={{\alpha }_{j}}+{{\beta }_{j}}$. This broadcasting provides both Alice and Eve with the value of ${{\beta }_{j}}$. Thus, through the above described capture-and-replace attack, Eve is able to eavesdrop the whole dialogue between Alice and Bob. Unfortunately for Eve, there are control modes that help Alice and Bob to detect her presence. It is easy to observe that Eve is immune to CM2 but is not to CM1 because ${{B}_{j}}$ and ${{C}_{j}}$ are not correlated at all. Let us denote by $\mathcal{L}$ the total number of the protocol run. Eve would be detected by a CM1 run with a probability $d=(1-1/N){{v}_{1}}$ or, in other words, she would pass with a probability $1-d$. If Eve is detected in the first run, $\mathcal{L}=1$, the detection probability is ${{P}_{{\rm Detect}}}(1)=d$. If Eve passes the first run but is detected in the second run, $\mathcal{L}=2$, the detection probability is ${{P}_{{\rm Detect}}}(2)=(1-d)d$. If Eve passes the first two runs but is detected in the third run, $\mathcal{L}=3,$ the detection probability is ${{P}_{{\rm Detect}}}(3)={{(1-d)}^{2}}d$, and so on. The total detection probability for $\mathcal{L}$ runs is therefore

$$\begin{align} \newcommand{\e}{{\rm e}} \displaystyle \begin{array}{@{}cccccccccccccccccccc@{}} & {{P}_{{\rm TotalDetect}}}=\sum\limits_{l=0}^{\mathcal{L}-1}{{{P}_{{\rm Detect}}}}(l)=\sum\limits_{l=0}^{\mathcal{L}-1}{{{(1-d)}^{l}}}d \nonumber \\ & =1-{{\left(1-\frac{(N-1){{v}_{1}}}{N} \right)}^{\mathcal{L}}}. \end{array}\nonumber \end{align} \tag{ 28 }$$

As the total number of run $\mathcal{L}$ is related to the length $L$ of the dialogue by $\mathcal{L}=L/(1-{{v}_{1}}-{{v}_{2}})$, the total detection probability can be reexpressed in terms of $L$ as

$$\begin{align} \newcommand{\e}{{\rm e}} \displaystyle {{P}_{{\rm TotalDetect}}}==1-{{\left(1-\frac{(N-1){{v}_{1}}}{N} \right)}^{L/(1-{{v}_{1}}-{{v}_{2}})}}.\nonumber \end{align} \tag{ 29 }$$

Clearly from equation (29), ${{P}_{{\rm TotalDetect}}}\to 1$ in the limit of large $L$ and/or large $N$, for any possible values of ${{v}_{1}}$ and ${{v}_{2}}$.

We next consider another attack called measure-and-forward one. When quNit ${{A}_{j}}$ appears from Bob side, Eve measures it in the computational basis with an outcome ${{\left| {{a}_{j}} \right\rangle }_{{{A}_{j}}}}$ and forwards the measured quNit to Alice. As a result of entanglement, the state of quNit ${{B}_{j}}$ immediately collapses into ${{\left| {{q}_{j}}+{{a}_{j}} \right\rangle }_{{{B}_{j}}}}$, implying immunity of such an Eve's action to CM1. Anyway, after Eve's measurement, the state of the two quNits ${{A}_{j}}$ and ${{B}_{j}}$, up to a global phase factor, becomes

$$\begin{align} \newcommand{\e}{{\rm e}} \displaystyle \begin{array}{@{}cccccccccccccccccccc@{}} & {{\left| {{a}_{j}} \right\rangle }_{{{A}_{j}}}}{{\left| {{q}_{j}}+{{a}_{j}} \right\rangle }_{{{B}_{j}}}}=\sum\limits_{{{v}_{j}}{{u}_{j}}=0}^{N-1}{{{\left| {{\beta }_{j}};{{u}_{j}},{{v}_{j}} \right\rangle }_{{{A}_{j}}{{B}_{j}}}}}{{\left\langle {{\beta }_{j}};{{u}_{j}},{{v}_{j}} | {{a}_{j}} \right\rangle }_{{{A}_{j}}}}{{\left| {{q}_{j}}+{{a}_{j}} \right\rangle }_{{{B}_{j}}}} \nonumber \\ & =\frac{1}{\sqrt{N}}\sum\limits_{{{u}_{j}}=0}^{N-1}{{{\Omega }^{-{{u}_{j}}{{a}_{j}}}}}{{\left| {{\beta }_{j}};{{u}_{j}},{{q}_{j}} \right\rangle }_{{{A}_{j}}{{B}_{j}}}}, \end{array}\nonumber \end{align} \tag{ 30 }$$

which is a superposition of $N$ entangled states, of which only one, that with ${{u}_{j}}={{k}_{j}}$, coincides (ignoring the weight coefficient) with the state prepared in S2. Without CM2, Eve's action is hidden, Alice executes MM1 and Bob executes MM2, as designed. But, with a probability of $(N-1)/N$ (for ${{u}_{j}}\ne {{k}_{j}}$), they exchange totally wrong data. Unfortunately for Eve, there is CM2 that helps Alice and Bob to detect her presence. Namely, because the number Bob decodes in S4 differs from the number Alice encodes in MM1 in most of the cases, Eve' action is exposed with CM2. The total detection probability for $\mathcal{L}$ runs has the form of (28), but with ${{v}_{1}}$ in $d$ replaced by ${{v}_{2}}$.

Also, to prevent anyone from pretending Bob to get Alice's secret numbers (so-called masquerading attack), it is assumed that the two parties always keep in touch with each other via phone/fax before as well as during the performance of the quantum dialogue. Such assumption is implicit in section 3.

Because both directions between Alice and Bob are controlled the protocol designed in section 3 proves to be secure against other typical attacks: Eve would be detected by CM1 or/and CM2.

We have designed a quantum protocol for two-way communication allowing two parties, Alice and Bob, to simultaneously exchange their data in a manner like in a dialogue. Many different protocols of this quantum dialogue kind have been proposed previously. Most of them rely on superdense coding [30]. Our protocol here, instead, makes use of nonselective measurements with choices of measurement bases as signals to exchange. Because the protocol is two-way, two-way should also be the control. In fact, our bidirectional controlling, one on the Bob-to-Alice direction and the other on the Alice-to-Bob direction, make the protocol secure against commonly encountered eavesdropping attacks. Our analysis shows that the security is not absolute but asymptotic in the sense that the eavesdropper's detection probability approaches $1$ if the dimension of the quantum carrier is high or/and the size of the to-be-exchanged data is large. Because of such kind of security, this (as well as other quantum dialogue protocols) is advised to apply only in urgent circumstances when top-secrecy is not prerequisite. Anyway, our protocol sheds some more insight into distinction between classical and quantum measurements and the idea of it may suggest novel applications based on still-less-explored features of quantum measurements.

The author dedicates this paper to his teacher, Professor Van Hieu Nguyen, on the occasion of the teacher's 80th birthday. This work is supported by Vietnam National Foundation for Science and Technology Development (NAFOSTED) under project no. 103.01-2017.08.