A Multiparty Quantum Private Equality Comparison Scheme Relying on |GHZ₃⟩ States

Abstract

In this work, we present a new protocol that accomplishes multiparty quantum private comparison leveraging maximally entangled $|GH{Z}_3⟩$ triplets. Our intention was to develop a protocol that can be readily executed by contemporary quantum computers. This is possible because the protocol uses only $|GH{Z}_3⟩$ triplets, irrespective of the number n of millionaires. Although it is feasible to prepare multiparticle entangled states of high complexity, this is overly demanding on a contemporary quantum apparatus, especially in situations involving multiple entities. By relying exclusively on $|GH{Z}_3⟩$ states, we avoid these drawbacks and take a decisive step toward the practical implementation of the protocol. An important quantitative characteristic of the protocol is that the required quantum resources are linear both in the number of millionaires and the amount of information to be compared. Additionally, our protocol is suitable for both parallel and sequential execution. Ideally, its execution is envisioned to take place in parallel. Nonetheless, it is also possible to be implemented sequentially if the quantum resources are insufficient. Notably, our protocol involves two third parties, as opposed to a single third party in the majority of similar protocols. Trent, commonly featured in previous multiparty protocols, is now accompanied by Sophia. This dual setup allows for the simultaneous processing of all n millionaires’ fortunes. The new protocol does not rely on a quantum signature scheme or pre-shared keys, reducing complexity and cost. Implementation wise, uniformity is ensured as all millionaires use similar private circuits composed of Hadamard and CNOT gates. Lastly, the protocol is information-theoretically secure, preventing outside parties from learning about fortunes or inside players from knowing each other’s secret numbers.

1. Introduction

The pursuit of quantum computers with quantitative characteristics that surpass classical computers remains ongoing. Although this aspiration has not yet been achieved, there are certain important facts, such as IBM’s 127-qubit Eagle [1], 433-qubit Osprey [2], and the more recent 1121-qubit Condor [3], which indicate remarkable progress. Hopefully, the pace toward the quantum world has accelerated. Clearly, the present level of our quantum technology has matured significantly to warrant serious consideration for the design and implementation of cryptographic protocols. In this perspective, it is not surprising that quantum cryptographic methods have gained immense popularity since the landmark work by Bennett and Brassard [4], where the quantum key distribution was introduced for the first time. Furthermore, Shor [5] and Grover’s [6] famous quantum algorithms have demonstrated the potential vulnerability of many widely used security algorithms against quantum computers. In developing cryptographic systems that are secure against both quantum and classical computers, two fundamental approaches can be identified. One approach, often referred to as post-quantum or quantum-resistant cryptography, advocates for reliance on problems that are believed to be, but not yet formally proven to be, computationally hard. The other approach, commonly called quantum cryptography, advocates for reliance on the properties of quantum mechanics and thus takes advantage of nature’s own fundamental laws in order to achieve security. Today one can easily identify many active areas of research, such as quantum key distribution (see [4,7,8,9] and the more recent [10]), quantum secret sharing [11,12,13,14], quantum teleportation [15,16], and quantum-secure direction communication [17,18,19], to name just a few.

Another notable direction that aims to achieve the tenets of privacy and security through quantum mechanics is quantum private comparison (QPC from now on), initiated by Yang and Wen in their pioneering work [20]. Yang and Wen were the first to present a quantum protocol that enables Alice and Bob to find out if their private numbers are equal, without any party gaining additional information in case the numbers are different. This problem can be traced back to the fundamental works [21,22] by Yao, wherein the millionaires’ problem was introduced: two millionaires wish to know who is richer, but without divulging any information about the precise amount of their fortune to the other one. Following this line of thought, Boudot [23] proposed a classical protocol for the socialist millionaires’ problem, where two millionaires desire to find out if they are equally rich. Yang and Wen’s protocol is based on EPR pairs for comparing information with respect to equality and employs the help of a third party (TP). Almost simultaneously, the authors in [24] proposed an alternative QPC protocol utilizing triplets. In [25], a QPC protocol that relies on W triplets, and also uses a third party, was presented. Later, another QPC protocol using Bell states and a third party appeared in [26].

In [27,28,29,30,31], the authors proposed different QPC protocols, having as a common characteristic the fact that they utilize entangled states, such as $\chi$, GHZ states, or highly entangled six-qubit states. The authors in [32] presented the first semi-quantum private comparison protocol for participants who compare their secrets without any quantum capability, and under an almost dishonest third-party. Similarly, in [33], an improved semi-quantum private comparison protocol was introduced, achieving a higher security level. There have also been different approaches, e.g., the authors in [34] do not use entanglement but still require a semi-honest third party as the QPC protocol proposed in [35] makes use of random rotation angles. Recently, a practical quantum-secure protocol for the socialist millionaires’ problem based on single photons was introduced, with emphasis on the ease of implementation with current technology [36]. For more pointers on the subject, the interested reader may consult the comprehensive survey [37]. Sophisticated quantum protocols for magnitude comparison have also been proposed in [38,39,40,41,42,43]; all these protocols envision d-level quantum systems and also require a third party. Typically, d is assumed to be greater than a certain threshold, which, in practice, considerably complicates their implementation on contemporary quantum computers based on qubits.

Chang et al. in [44] were the first to devise a clever generalization to n parties that requires $|GH{Z}_n\rangle$-class states and the prior distribution of a secret key to each of the n parties. This inspired researchers to design more multiparty quantum private comparison (MQPC for short) protocols. Along this direction, the authors in [45] proposed a different MQPC protocol based on a d-level quantum system. Similarly, the researchers in [46] introduced an MPQC protocol with an almost dishonest third party that requires a d-level quantum system, where also d is assumed greater than the largest number slated for comparison. Subsequently, in [47], an enhanced MQPC protocol was introduced that uses $|GH{Z}_n\rangle$-type states for n participants. Ye and Ye in [41] came up with a sophisticated MQPC protocol also based on a d-level quantum system. One of the novelties of their protocol was the creative utilization of two semi-honest third parties that eliminate the need for pre-shared keys between each pair. Other notable MQPC protocols were proposed in [42], relying on d-level $|GH{Z}_n\rangle$ states; in [48], exploiting properties of quantum homomorphic encryption; and in [49,50]. In constructing secure QPC protocols, there are certain obstacles. It has been shown in [51] that unconditionally secure classical computation involving two parties is not possible for certain categories of functions. Despite the fact that things are different in the quantum setting [52], Lo has demonstrated that it is impossible to securely evaluate the equality function in a two-party scenario [53]. This has necessitated the introduction of further assumptions, typically in the form of a semi-honest third party.

Given the current level of technology and the challenging issues that must still be overcome, today a hybrid approach, combining classical and quantum techniques to leverage the strengths of both paradigms, may be a fruitful solution. Toward this end, the sophisticated classical algebraic scheme introduced in [54] can offer many practical advantages. The new protocol we propose was designed from a computer scientist perspective that now or in the near future will be endowed with a quantum computer powerful enough to run a QMEP for a modest number of participants. The technological challenges and intricate implementation issues, such as the complexity of operations and the ability to control and measure the entangled states accurately, are not in the least underestimated, but from the point of view of an active quantum practitioner that is given a working apparatus, they may be assumed solved at least to a certain satisfactory degree. To make its presentation more easygoing for the reader, we describe it as a quantum game, something quite usual in the literature. The role of the millionaires is assumed by the famous Alice and her clones, which star alongside Sophia and Trent, who play the two third parties that are required for the secure implementation of the protocol. Quantum games were introduced in the two pioneering works [55,56] that go back to 1999. Since then, they have gained remarkable acceptance, mainly due to the fact that quantum strategies are often superior to classical ones [57,58,59,60]. The famous Prisoner’s Dilemma game provides a convincing example in this regard [56].

Contribution This article introduces a novel protocol, aptly named GHZ₃MQPEC, that accomplishes a multiparty quantum private comparison relying exclusively on $|GH{Z}_3\rangle$ triplets. In designing this protocol, our fundamental concern has been to come up with an algorithm that can be easily run on today’s quantum computers. We achieved this aim by utilizing only $|GH{Z}_3\rangle$ triplets for any number n of millionaires. While more complex multiparticle entangled states, not to mention high-dimensional quantum states, are possible, they are difficult to generate with existing quantum technology, leading to an extended preparation time and complexity, especially in cases where the number of players becomes arbitrarily large. Of course, there is a plethora of classes of entangled states, such as W states, cluster states, and graph states, to name just a few. Within the circuit model paradigm, GHZ states can be easily produced, given a powerful enough quantum computer, like the 1121-qubit Condor [3]. Technically, this is accomplished by employing efficient circuits that require only $lgn$ steps to prepare the $|GH{Z}_n\rangle$ state (see [61]). This is particularly true for $|GH{Z}_3\rangle$ states, being the simplest in their class.

The GHZ₃QPEC protocol makes quite modest demands on the quantity of quantum resources needed. As shown in Section 6.1, the number of qubits grows linearly both in the number of millionaires n and in the number m of qubits within each quantum register, reflecting the magnitude of the numbers to be compared. This allows the protocol to seamlessly scale with respect to both the number of players and the volume of information processed. This further attests to the potential of the GHZ₃MQPEC protocol for practical implementation. Another advantage of the protocol concerns its suitability for parallel as well as sequential execution. Although the execution of the quantum part of the protocol is envisioned to take place completely in parallel, it is also possible to be implemented sequentially. So, if the quantum resources are insufficient for the implementation of the protocol in one go, it is possible to partition the n of millionaires into smaller groups and process these groups sequentially, even to the point of executing the protocol serially for one millionaire at a time. Another distinguishing feature of our protocol is the existence of two third parties. Trent, featured in many previous multiparty protocols, is now accompanied by Sophia. The existence of two parties enables the simultaneous processing of all n millionaires’ fortunes in one go. In addition to the possibility of either parallel or sequential execution, this protocol is flexible enough to accommodate both localized and distributed settings, a capability that stems from its inherent use of entanglement. In the first case, all players physically are assumed to be at the same geographical location, whereas, in the second case, the players are in different spatial locations.

It is worth mentioning that the GHZ₃MQPEC protocol does not rely on a quantum signature scheme, or pre-shared keys, which reduces its complexity and cost. Moreover, the protocol guarantees consistency in its implementation because every millionaire uses pretty much the same private quantum circuit. With this architecture, a fully modular quantum system with identical modules is established. All private quantum circuits use only the ubiquitous CNOT and Hadamard quantum gates, which make them easy to build on modern quantum computers. Finally, it goes without saying that outside parties cannot learn any information about the millionaires’ fortunes, inside players cannot know the secret numbers of other players, and the GHZ₃MQPEC protocol is shown to be information-theoretically secure.

Organization

This document is structured as follows: Section 2 offers a brief summary of the key concepts, setting the stage for grasping our protocol. A thorough explanation of the hypotheses that support the GHZ₃MQPEC protocol is provided in Section 3. The GHZ₃MQPEC protocol is formally outlined in Section 4. An illustrative example that demonstrates how the protocol functions is presented in Section 5, while the issues of efficiency and security are examined in Section 6. The document wraps up with a recap and a discussion on the more intricate aspects of the protocol in Section 7.

2. Preliminary Concepts

2.1. $|GH{Z}_3\rangle$ States

Numerous quantum protocols can be characterized as interactions among familiar fictional characters, typically identified as Alice, Bob, Charlie, etc., and in this particular case, Sophia and Trent besides Alice. The players are engaged in efforts to exchange information in a manner that is both private and secure. Generally, secure communication is achieved through a combination of classical authenticated channels and quantum channels. The transmission of confidential information typically occurs via the quantum channel, employing a variety of techniques, followed by the exchange of messages through a classical public channel to complete the protocol. During this process, an adversary, commonly called Eve, may attempt to intercept this communication and extract any available information. In such scenarios, the primary advantage of quantum cryptography over classical methods lies in the protection afforded to the communicating parties during the information transmission through the quantum channel, which is grounded in fundamental principles of quantum mechanics, including the no-cloning theorem [62] and the concept of entanglement monogamy, among others.

Entanglement is the cornerstone of numerous quantum protocols, including the one discussed in this paper, and could potentially become the standard approach to quantum cryptography in the future thanks to its wide range of uses across the entire domain. It is a key concept in quantum mechanics and can be represented mathematically as the sum of two or more product states. GHZ states are a prominent class of maximally entangled states, involving three or more qubits. At its core, quantum entanglement suggests that quantum particles can become linked together, and the state of one particle can instantly affect the state of another, regardless of the distance between them. For those interested in exploring this topic further, standard textbooks like [63,64,65] are a great resource for a more in-depth explanation.

The Hadamard and CNOT gates, two common quantum gates, can be used to create $|GH{Z}_n\rangle$ states on modern quantum computers, as demonstrated by the power of the most recent IBM quantum computers [2,3]. n qubits, $n-1$ CNOT gates, and one Hadamard gate applied to the first qubit are needed to implement such a circuit. To build effective GHZ circuits, we follow [61], which provides a workable approach that requires only $lgn$ steps to prepare the $|GH{Z}_n\rangle$ state. Our new protocol employs $|GH{Z}_3\rangle$ triplets. A $|GH{Z}_3\rangle$ state is formally expressed by the following formula. To make clear that $|GH{Z}_3\rangle$ entanglement requires three separate entities, we use the subscripts A, S, and T to indicate which qubit belongs to Alice, Sophie, and Trent. Following this convention, qubits denoted by ${|·\rangle }_A$ belong to Alice, those denoted by ${|·\rangle }_S$ belong to Sophie, and those denoted by ${|·\rangle }_T$ belong to Trent:

$$\begin{array}{c}\hfill |GH{Z}_3\rangle ={\displaystyle \frac{1}{\sqrt{2}}}\left({|0\rangle }_T{|0\rangle }_S{|0\rangle }_A+{|1\rangle }_T{|1\rangle }_S{|1\rangle }_A\right).\end{array}$$

(1)

In view of the scope of the proposed protocol, it is necessary to use m$|GH{Z}_3\rangle$ triplets because a single $|GH{Z}_3\rangle$ triplet will not suffice. The mathematical description of the state of a composite system containing m$|GH{Z}_3\rangle$ triplets is shown below (see also [14,66]):

$$\begin{array}{c}\hfill {|GH{Z}_3\rangle }^{\otimes m}={\displaystyle \frac{1}{\sqrt{2^m}}}\sum _{\mathbf{x}\in {\mathbb{B}}^m}{|\mathbf{x}\rangle }_T{|\mathbf{x}\rangle }_S{|\mathbf{x}\rangle }_A.\end{array}$$

(2)

In writing Formula (2), the following notation is used:

• $\mathbb{B}$ is the binary set $\{0,1\}$.
• To differentiate syntactically the bit vector $\mathbf{x}\in {\mathbb{B}}^m$ from the bit $x\in \mathbb{B}$, the bit vector $\mathbf{x}$ is written in boldface. A bit vector $\mathbf{x}$ of length m is a sequence of n bits: $\mathbf{x}=x_{m-1}\cdots x_0$. There is also the special zero bit vector $\mathbf{0}$, in which all the bits are zero; that is, $\mathbf{0}=0\cdots 0$.
• Each bit vector $\mathbf{x}\in {\mathbb{B}}^m$ serves as the binary form of one of the $2^m$ basis kets that constitute the computational basis of the underlying $2^m$-dimensional Hilbert space.
• As we have previously explained, to avoid ambiguity, we rely on the subscripts A, S, and T to indicate which qubits belong to Alice, Sophie, and Trent’s quantum registers, respectively.

2.2. Inner Product Modulo 2 Operation

Inner product modulo 2 is a binary operation defined on bit vectors of equal length. This operation requires two bit vectors $\mathbf{x},\mathbf{y}\in {\mathbb{B}}^m$ as inputs and returns their inner product, denoted by $\mathbf{x}•\mathbf{y}$. Assuming that $\mathbf{x}=x_{m-1}\cdots x_0$ and $\mathbf{y}=y_{m-1}\cdots y_0$, then $\mathbf{x}•\mathbf{y}$ is given by

$$\mathbf{x}•\mathbf{y}{x}_{m-1}{y}_{m-1}\oplus \cdots \oplus x_0{y}_0,$$

(3)

where the symbol := stands for “is defined as”, and ⊕ is addition modulo 2. This operation is employed in many important formulae of quantum computation and information. One such fundamental formula is given below; it concerns the application of the m-fold Hadamard on an arbitrary ket $|\mathbf{x}\rangle$, and we shall use it during the detailed analysis of our quantum protocol. This formula is proved in many textbooks, such as [63,67]:

$$\begin{array}{c}{H}^{\otimes m}|\mathbf{x}\rangle ={\displaystyle \frac{1}{\sqrt{2^m}}}\sum _{\mathbf{z}\in {\mathbb{B}}^m}{(-1)}^{\mathbf{z}•\mathbf{x}}|\mathbf{z}\rangle .\end{array}$$

(4)

An important property of the inner product modulo 2 operation is a special type of symmetry that can be used to partition the set of bit vectors into two subsets of equal cardinality. Specifically, any constant bit vector $\mathbf{c}$ of ${\mathbb{B}}^m$, other than $\mathbf{0}$, exhibits the following property: for exactly half of the bit vectors $\mathbf{x}\in {\mathbb{B}}^m$, $\mathbf{c}•\mathbf{x}=0$, and for the remaining half, $\mathbf{c}•\mathbf{x}=1$. Clearly, $\mathbf{0}$ is an exception to the above rule because if $\mathbf{c}=\mathbf{0}$, then for all $\mathbf{x}\in {\mathbb{B}}^m$, $\mathbf{c}•\mathbf{x}=0$. In accordance with [68], this fact is henceforth referred to as the Characteristic Inner Product (CIP) property:

$$\mathbf{c}=0\Rightarrow \text{for} \text{every} 2^m \text{bit} \text{vector} \mathbf{x}\in {\mathbb{B}}^m,\mathbf{c}•\mathbf{x}=0$$

(5)

$$\mathbf{c}\ne 0\Rightarrow \left\{\begin{array}{c}\text{for} 2^{m-1} \text{bit} \text{vectors} \mathbf{x}\in {\mathbb{B}}^m,\mathbf{c}•\mathbf{x}=0\\ \text{for} 2^{m-1} \text{bit} \text{vectors} \mathbf{x}\in {\mathbb{B}}^m,\mathbf{c}•\mathbf{x}=1\end{array}\right\}$$

(6)

For our protocol, and also the purpose of creating decoys, we utilize two other signature states, namely $|+\rangle$ and $|-\rangle$, defined as

$$\begin{array}{c}\hfill |+\rangle =H|0\rangle ={\displaystyle \frac{|0\rangle +|1\rangle }{\sqrt{2}}}\end{array}$$

(7)

$$\begin{array}{c}\hfill |-\rangle =H|1\rangle ={\displaystyle \frac{|0\rangle -|1\rangle }{\sqrt{2}}}\end{array}$$

(8)

During the execution of the protocol itself, all measurements are carried out in relation to the computational basis $\{|0\rangle ,|1\rangle \}$. However, during the test for eavesdropping detection, decoys are also measured with respect to the Hadamard basis.

3. The Setup

This paper introduces a novel protocol designed to practically and efficiently accomplish a multiparty quantum private equality comparison using only $|GH{Z}_3\rangle$ states. Henceforth, for succinctness, we shall refer to this protocol with the acronym GHZ₃MQPEC. In this section, we give an in-depth explanation of the whole setup and the hypotheses that guarantee the correct implementation of GHZ₃MQPEC.

3.1. The Actors

Before we formally introduce the players involved in the GHZ₃MQPEC, we clarify one important notion, that of the semi-honest player. After it was established that it is impossible to compute the equality function securely in situations involving two parties [53], it became clear that to achieve a secure private comparison, additional assumptions must be put forth. In the literature, the most well-known such assumption is that of a semi-honest third party. Definition 1 clarifies what this entails.

Definition 1

(Semi-honest player). A semi-honest player exhibits the following traits:

• Always executes the protocol faithfully.
• Cannot conspire with any other player.
• Cannot be corrupted by an outside entity.
• Keeps track of all intermediate calculations and may attempt to steal information from the records.

To put it another way, a semi-honest player sticks to the rules of the protocol so as to assist the interested parties in doing the equality comparison but is also interested in learning their personal information.

The GHZ₃MQPEC protocol evolves as a game played by $n+2$ players, where n is an arbitrarily large positive integer. So, without further ado, we list the actors and the rules governing their behavior below:

(A₁)

There are n players, the millionaires, who are designated by Alice₀, …, Alice_n−1. Each Alice_i, $0\le i\le n-1$, desires to find out whether her fortune is equal or not to the fortune of every other Alice_j, $0\le j\ne i\le n-1$, but without ever divulging her actual fortune to any other in-game player or outside eavesdropper. For the needs of the protocol, the millionaires’ fortunes are represented in binary and not in decimal. In particular, Alice_i’s fortune is designated by the bit vector ${\mathbf{f}}_i$, $0\le i\le n-1$. There is a catch, however, in the whole setup. The millionaires, in case their fortunes turn out to be different, must not be able to infer any additional information besides the fact that they are different, not even a single bit of the other player’s fortune.

To allow for more generality, the millionaires are assumed to be in different locations.

(A₂)

Additionally, there are two semi-honest third parties, Sophia and Trent, whose participation is essential for the correct implementation of the protocol. So, in total, this game involves $n+2$ players, all in different regions of space.

(A₃)

Sophia’s role is critical as we explain now. The rationale behind the GHZ₃MQPEC protocol is the following: instead of Alice_i and Alice_j directly comparing their fortunes ${\mathbf{f}}_i$ and ${\mathbf{f}}_j$, $0\le j\ne i\le n-1$, they both compare their fortune with a fixed but secret number $\mathbf{s}$. If $\mathbf{s}\oplus {\mathbf{f}}_i=\mathbf{s}\oplus {\mathbf{f}}_j$, then ${\mathbf{f}}_i={\mathbf{f}}_j$, whereas if $\mathbf{s}\oplus {\mathbf{f}}_i\ne \mathbf{s}\oplus {\mathbf{f}}_j$, then ${\mathbf{f}}_i\ne {\mathbf{f}}_j$. Sophia is responsible for randomly choosing a secret number $\mathbf{s}$ and embedding it into the global entanglement. It goes without saying that Sophia must never reveal her secret number $\mathbf{s}$ to any other in-game player or outside eavesdropper.

(A₄)

Trent’s role is also essential. First of all, he is responsible for the generation of the $|GH{Z}_3\rangle$ triplets and their distribution to the $n+2$ players according to the entanglement distribution scheme explained in Definition 2. Moreover, at the end of the protocol, he determines for each Alice_i, $0\le i\le n-1$, whether her fortune is equal or not to that of every other Alice_j, $0\le j\ne i\le n-1$. Trent must only announce the corresponding decision in the form of a single bit, e.g., YES_i,j or NO_i,j. Trent must never reveal the private measurements and records he used to arrive at his decisions to any other in-game player or outside eavesdropper.

(A₅)

All players agree beforehand on the number m of qubits sufficient to store their fortunes ${\mathbf{f}}_i$, $0\le i\le n-1$, and Sophia’s secret number $\mathbf{s}$.

We clarify that the millionaires do not wish to compare their fortunes in terms of relative size, i.e., to establish which one is greater than the other; just to know if they are equal or not.

Furthermore, as is the norm in the literature, it is presumed that the quantum channel operates as an ideal channel, characterized by the absence of noise and the retention of the particle. This simplifying assumption overlooks critical practical challenges such as losses, decoherence, specific ambient conditions in free-space channels, and the optical fibers. We fully understand the utmost importance of such issues related to noise, channel loss, control of entanglement, and scalability, which affect the practical implementation of any entanglement-based quantum protocol. Nonetheless, we believe that such issues are outside the modest scope of this article, which is focused on establishing the theoretical merits of the new protocol. Additionally, the classical channels are regarded as authenticated channels, wherein the transmitted message remains public but is impervious to alteration by any adversary.

3.2. The Entanglement Distribution Scheme

The implementation of the GHZ₃MQPEC protocol requires a versatile composite system consisting of smaller subsystems. The unique feature of this configuration is the entanglement of the corresponding qubits in the $|GH{Z}_3\rangle$ state across all triplets of associated quantum registers. This is an immediate consequence of the employed Uniform $|GH{Z}_3\rangle$ Distribution Scheme, as explained in the next Definition 2.

Definition 2

(Uniform $|GH{Z}_3\rangle$ Distribution Scheme). The Uniform $|GH{Z}_3\rangle$ Distribution Scheme stipulates the following:

• Alice_i, $0\le i\le n-1$, is endowed with an m-qubit input register $AI{R}_i$.
• For every Alice_i, Sophia, and Trent, each utilize an m-qubit input register corresponding to Alice_i, denoted by $SI{R}_i$ and $TI{R}_i$, $0\le i\le n-1$, respectively.
• For every Alice_i, $0\le i\le n-1$, Trent generates $3m$ triplets $(p,q,r)$ entangled in the $|GH{Z}_3\rangle$ state. Trent keeps the first qubit p and transmits the second and third qubits q and r to Sophia and Alice_i, respectively.

This scheme effectively creates for every Alice_i, $0\le i\le n-1$, a triplet of quantum registers, namely $(TI{R}_i,SI{R}_i,AI{R}_i)$. These associated registers are strongly linked because their corresponding qubits are maximally entangled in the $|GH{Z}_3\rangle$ state. This is visualized in Figure 1, which conveys this setup, whereby the qubits that belong to the same $|GH{Z}_3\rangle$ triplet are painted in the same color.

In this composite system, each register holds m qubits. It is important to emphasize that the spatial arrangement of the registers, whether they are co-located or dispersed across various locations, is of no consequence. The entanglement effect derived from the m$|GH{Z}_3\rangle$ triplets will produce the required correlations, regardless of whether the composite system is confined to a single area or is fully distributed. This distinctive characteristic of entanglement enables us to conceptualize the entire setup as a cohesive system. Any practical implementation of the GHZ₃MQPEC protocol will require Trent to also prepare decoys. This technique is ubiquitous in the literature and is, typically, referred to as the decoy technique. There are many well-written expositions that thoroughly explain the specifics; we refer to [20,26,36,41,43,44,47,69], to cite just a few. The idea is that if the party responsible for the generation of the entangled triplets also produces decoys randomly chosen from one of the $|0\rangle ,|1\rangle ,|+\rangle ,|-\rangle$ states, it is possible to discover the presence of an eavesdropper. These decoys are randomly inserted into the transmitted sequence(s). We have not mentioned the decoys in Definition 2 to avoid clutter and make the main idea of the protocol easier to grasp.

4. The GHZ₃MQPEC Protocol

Our aim in the current section is to provide a thorough presentation of the new protocol. The protocol is designed to accomplish a quantum private equality comparison among an arbitrarily large number n of millionaires using only $|GH{Z}_3\rangle$ states. From now on, we shall refer to it simply by its acronym GHZ₃MQPEC. Its most important characteristic traits are outlined below:

• Ease of implementation. Besides EPR pairs, $|GH{Z}_3\rangle$ triplets are arguably the easiest maximally entangled states that can be produced by a modern quantum apparatus. The fact that, irrespective of the number n of millionaires, the GHZ₃MQPEC protocol can be executed with $|GH{Z}_3\rangle$ triplets exclusively guarantees the feasibility of its implementation.
• Efficiency and scalability. The forthcoming mathematical analysis in Section 6 corroborates the efficiency of the GHZ₃MQPEC protocol. Moreover, one of its most important qualitative features is that the required quantum resources scale linearly both in the number n of millionaires and the number m of qubits necessary to store their fortunes, which further enhances its potential applicability.
• Parallel or sequential execution. Although the execution of the quantum part of the GHZ₃MQPEC protocol is envisioned to take place completely in parallel, it is also possible to be implemented sequentially. So, if the quantum resources do not suffice for the execution of the protocol in one go, it is possible to partition the n of millionaires into smaller groups and process these groups sequentially, even to the point of executing the protocol serially for one millionaire at a time.

Box 1 gives a succinct outline of the intuition behind the GHZ₃MQPEC protocol, and Box 2 explains how GHZ₃MQPEC can be simplified in the special case of 2 millionaires. A useful overview of the GHZ₃MQPEC protocol is also given by the block diagram of Figure 2, containing the actions taking place during the execution of the protocol. Our protocol consists of an initial quantum part followed by a classical part. The former takes place through quantum channels and the latter through public classical channels.

Table 1. This table contains the acronyms appearing in the block diagram of Figure 2.

Notations and Abbreviations
Symbolism	Operation
TCQ	Trent creates $nm$ triplets of qubits in the $|GH{Z}_3\rangle$ state
TS	Trent sends to Sophia one qubit from each triplet through a quantum channel
TA0	Trent sends to Alicen−2 one qubit from each triplet via a quantum channel
TAn−2	Trent sends to Alicen−2 one qubit from each triplet via a quantum channel
TAn−1	Trent sends to Alicen−1 one qubit from each triplet via a quantum channel
SQC	Sophia applies her quantum circuit and measures her input register
A0QC	Alice0 applies her quantum circuit and measures her input register
TQC	Trent applies his quantum circuit and measures his input register
An−2QC	Alicen−2 applies her quantum circuit and measures her input register
An−1QC	Alicen−1 applies her quantum circuit and measures her input register
${\mathbf{y}}_{\mathbf{S}}$	Sophia sends to Trent the bit vector ${\mathbf{y}}_{\mathbf{S}}$ through a classical public channel
${\mathbf{y}}_{{\mathbf{A}}_{\mathbf{0}}}$	Alice0 sends to Bob the bit vector ${\mathbf{y}}_{{\mathbf{A}}_{\mathbf{0}}}$ via a classical public channel
${\mathbf{y}}_{{\mathbf{A}}_{\mathbf{n}-\mathbf{1}}}$	Alicen−2 sends to Bob the bit vector ${\mathbf{y}}_{{\mathbf{A}}_{\mathbf{n}-\mathbf{2}}}$ via a classical public channel
${\mathbf{y}}_{{\mathbf{A}}_{\mathbf{n}-\mathbf{1}}}$	Alicen−1 sends to Bob the bit vector ${\mathbf{y}}_{{\mathbf{A}}_{\mathbf{n}-\mathbf{1}}}$ via a classical public channel

below contains the acronyms that appear in Figure 2.

Box 1. The intuition behind the GHZ₃MQPEC protocol

The GHZ₃MQPEC protocol uses entanglement. It is the phenomenon of entanglement that allows for the secret and untraceable encoding of information in the global state of the composite quantum system. The precise mathematical formulation of the correlations among the individual subsystem as encoded into the global state takes the form given by Equation (17), which we call the Hadamard Entanglement Property.

The other prevalent idea is that instead of having Alice_i and Alice_j directly comparing their fortunes ${\mathbf{f}}_i$ and ${\mathbf{f}}_j$, $0\le j\ne i\le n-1$, they can both compare their fortune with a fixed but secret number $\mathbf{s}$. If $\mathbf{s}\oplus {\mathbf{f}}_i=\mathbf{s}\oplus {\mathbf{f}}_j$, then ${\mathbf{f}}_i={\mathbf{f}}_j$, whereas if $\mathbf{s}\oplus {\mathbf{f}}_i\ne \mathbf{s}\oplus {\mathbf{f}}_j$, then ${\mathbf{f}}_i\ne {\mathbf{f}}_j$. Sophia is responsible for randomly choosing a secret number $\mathbf{s}$ and embedding it into the global entanglement. It goes without saying that Sophia must never reveal her secret number $\mathbf{s}$.

Box 2. The special case of 2 millionaires

>To compare the fortunes of $n>2$ millionaires, Sophia serves as a secret, albeit fixed, point of reference. To give a geometric analogy, one could say that Sophia is the center of a collection of virtual concentric circles and those millionaires that possess the same fortune are points of the same circle. Thus, for $n>2$, Sophia is indispensable.

Nonetheless, in the very special case where $n=2$, which is when there are only 2 millionaires, Sophia becomes unnecessary. In this case, Trent alone suffices. We explain how the protocol and the corresponding quantum setup become simpler in such a special case in Section 7.

The quantum circuit that implements the GHZ₃MQPEC protocol for Alice_i is designated by $Q{C}_i$, $0\le i\le n-1$ and is visualized in Figure 3. Considering the depiction of the quantum circuit $Q{C}_i$, $0\le i\le n-1$, in Figure 3, we note the following conventions:

• For consistency, all quantum circuits follow the Qiskit [70] convention with respect to the order of qubits. Qiskit adheres to the little-endian qubit-indexing scheme, positioning the least significant qubit on the right side. Consequently, in the figure, the least significant qubit is placed at the top, while the most significant qubit is located at the bottom.
• $Q{C}_i$ is the quantum circuit corresponding to Alice_i.
• $TI{R}_i,SI{R}_i$, and $AI{R}_i$ are the input registers, each containing m qubits, in the local private circuits of Trent, Sophia, and Alice_i, respectively. Their corresponding qubits are entangled, a fact that is visually indicated by the wavy red line connecting them.
• $SO{R}_i$ is Sophia’s single-qubit output register that is initialized to $|-\rangle$. Analogously, $AO{R}_i$ is Alice_i’s single-qubit output register also initialized to $|-\rangle$.
• $U_{\mathbf{s}}$ is Sophia’s unitary transform, as expressed by Equation (10). $U_{{\mathbf{f}}_i}$ is the unitary transform used by Alice_i, which is described by Equation (11).
• $H^{\otimes m}$ is the m-fold Hadamard transform.
• Alice_i, $0\le i\le n-1$, Sophia, and Trent act on their local circuits in a private and secret manner. Alice_i’s private circuit is structurally similar to Sophia’s, but there is a critical difference. Alice_i encodes her fortune ${\mathbf{f}}_i$ into the global state of the system using an appropriate unitary transform $U_{{\mathbf{f}}_i}$. Similarly, Sophia embeds her secret number $\mathbf{s}$ into the global system through her unitary transform $U_{\mathbf{s}}$. Since, in general, ${\mathbf{f}}_i\ne \mathbf{s}$, the unitary transforms $U_{{\mathbf{f}}_i}$ and $U_{\mathbf{s}}$ are different.

Ideally, assuming sufficient quantum resources, we shall employ a parallel array of n such circuits $Q{C}_0,\cdots ,Q{C}_{n-1}$, as visualized in Figure 4. In case this is not feasible, due to a lack of adequate resources, it is possible to employ these circuits in sequential batches, as we show in Figure 5. All quantum circuits $Q{C}_i$, $0\le i\le n-1$, are structurally identical, their only possible difference being in unitary transform $U_{{\mathbf{f}}_i}$ that embeds Alice_i’s fortune ${\mathbf{f}}_i$ into the system. Obviously, if Alice_i and Alice_j’s fortunes ${\mathbf{f}}_i$ and ${\mathbf{f}}_j$, $0\le j\ne i\le n-1$, are equal, the corresponding unitary transforms $U_{{\mathbf{f}}_i}$ and $U_{{\mathbf{f}}_j}$ are the same; otherwise, they are different.

Utilizing (2), the start state $|{\psi }_0\rangle$ of the quantum circuit depicted in Figure 3 can be expressed as

$$|{\psi }_0\rangle ={\displaystyle \frac{1}{\sqrt{2^m}}}\sum _{\mathbf{x}\in {\mathbb{B}}^m}{|\mathbf{x}\rangle }_T{|-\rangle }_S{|\mathbf{x}\rangle }_S{|-\rangle }_i{|\mathbf{x}\rangle }_i.$$

(9)

As mentioned previously, throughout our analysis, we shall use the subscripts T, S, and i to clarify that we refer to the kets in the private circuits of Trent, Sophia, and Alice_i, respectively. Hopefully, this practice will enhance readability and avoid any ambiguity.

The execution of the protocol commences in earnest by having Sophia and Alice_i act on their private circuits via their secret unitary transforms $U_{\mathbf{s}}$ and $U_{{\mathbf{f}}_i}$. By doing so, both of them encode their secret numbers into the entangled state of the global circuit. Let us emphasize that Sophia and Alice_i’s actions result in the embedding of their private numbers into the entanglement of the three input registers of the distributed circuit.

Sophia’s transform $U_{\mathbf{s}}$ is based on the scheme $U_{\mathbf{s}}:|y\rangle |\mathbf{x}\rangle$→$|y\oplus \left(\mathbf{s}•\mathbf{x}\right)\rangle |\mathbf{x}\rangle$, which, for the particular circuit $Q{C}_i$, becomes

$$\begin{array}{c}{U}_{\mathbf{s}}:{|-\rangle }_S{|\mathbf{x}\rangle }_S\to {(-1)}^{\mathbf{s}•\mathbf{x}}{|-\rangle }_S{|\mathbf{x}\rangle }_S.\end{array}$$

(10)

The intuition behind Alice_i’s unitary transform $U_{{\mathbf{f}}_i}$ is quite similar since it implements the scheme $U_{{\mathbf{f}}_i}:|y\rangle |\mathbf{x}\rangle$→$|y\oplus \left({\mathbf{f}}_i•\mathbf{x}\right)\rangle |\mathbf{x}\rangle$, which, for our circuit $Q{C}_i$, assumes the following explicit form:

$$\begin{array}{c}{U}_{{\mathbf{f}}_i}:{|-\rangle }_i{|\mathbf{x}\rangle }_i\to {(-1)}^{{\mathbf{f}}_i•\mathbf{x}}{|-\rangle }_i{|\mathbf{x}\rangle }_i.\end{array}$$

(11)

The cumulative effect of both unitary transforms sends the quantum circuit into the next state $|{\psi }_1\rangle$:

$$\begin{array}{cc}\hfill |{\psi }_1\rangle & ={\displaystyle \frac{1}{\sqrt{2^m}}}{\displaystyle \sum _{\mathbf{x}\in {\mathbb{B}}^m}}{|\mathbf{x}\rangle }_T\left(U_{\mathbf{s}}{|-\rangle }_S{|\mathbf{x}\rangle }_S\right)\left(U_{{\mathbf{f}}_i}{|-\rangle }_i{|\mathbf{x}\rangle }_i\right)\hfill \\ & \stackrel{\left(10\right),\left(11\right)}{=}{\displaystyle \frac{1}{\sqrt{2^m}}}{\displaystyle \sum _{\mathbf{x}\in {\mathbb{B}}^m}}{|\mathbf{x}\rangle }_T{(-1)}^{\mathbf{s}•\mathbf{x}}{|-\rangle }_S{|\mathbf{x}\rangle }_S{(-1)}^{{\mathbf{f}}_i•\mathbf{x}}{|-\rangle }_i{|\mathbf{x}\rangle }_i\hfill \\ & ={\displaystyle \frac{1}{\sqrt{2^m}}}{\displaystyle \sum _{\mathbf{x}\in {\mathbb{B}}^m}}{(-1)}^{(\mathbf{s}\oplus {\mathbf{f}}_i)•\mathbf{x}}{|\mathbf{x}\rangle }_T{|-\rangle }_S{|\mathbf{x}\rangle }_S{|-\rangle }_i{|\mathbf{x}\rangle }_i.\hfill \end{array}$$

(12)

At the conclusion of Phase 1, Sophia and Alice_i have untraceably integrated their confidential numbers $\mathbf{s}$ and ${\mathbf{f}}_i$, which are known solely to them, into the state $|{\psi }_1\rangle$ of the entangled quantum system. The next step is to extract this information, enabling Trent to compare the wealth of the millionaires. To retrieve the embedded private data, Trent, Sophia, and Alice_i perform the m-fold Hadamard transform on their input registers, as illustrated in Figure 3. As a result, by the end of Phase 2, the system’s state has transitioned to $|{\psi }_2\rangle$:

$$|{\psi }_2\rangle \stackrel{\left(12\right)}{=}{\displaystyle \frac{1}{\sqrt{2^m}}}\sum _{\mathbf{x}\in {\mathbb{B}}^m}{(-1)}^{(\mathbf{s}\oplus {\mathbf{f}}_i)•\mathbf{x}}{H}^{\otimes m}{|\mathbf{x}\rangle }_T{|-\rangle }_S{H}^{\otimes m}{|\mathbf{x}\rangle }_S{|-\rangle }_i{H}^{\otimes m}{|\mathbf{x}\rangle }_i.$$

(13)

At this point, the use of Equation (4) allows us to expand $H^{\otimes m}{|\mathbf{x}\rangle }_T$, $H^{\otimes m}{|\mathbf{x}\rangle }_S$, and $H^{\otimes m}{|\mathbf{x}\rangle }_i$, as shown below:

$$\begin{array}{c}{H}^{\otimes m}{|\mathbf{x}\rangle }_T={\displaystyle \frac{1}{\sqrt{2^m}}}\sum _{{\mathbf{z}}_2\in {\mathbb{B}}^m}{(-1)}^{{\mathbf{z}}_2•\mathbf{x}}{|{\mathbf{z}}_2\rangle }_T\\ H^{\otimes m}{|\mathbf{x}\rangle }_S={\displaystyle \frac{1}{\sqrt{2^m}}}\sum _{{\mathbf{z}}_1\in {\mathbb{B}}^m}{(-1)}^{{\mathbf{z}}_1•\mathbf{x}}{|{\mathbf{z}}_1\rangle }_S\\ H^{\otimes m}{|\mathbf{x}\rangle }_i={\displaystyle \frac{1}{\sqrt{2^m}}}\sum _{{\mathbf{z}}_0\in {\mathbb{B}}^m}{(-1)}^{{\mathbf{z}}_0•\mathbf{x}}{|{\mathbf{z}}_0\rangle }_i\end{array}$$

By substituting the previous relations, we may rewrite $|{\psi }_2\rangle$ as

$$|{\psi }_2\rangle ={\displaystyle \frac{1}{2^{2m}}}\sum _{{\mathbf{z}}_2\in {\mathbb{B}}^m}\sum _{{\mathbf{z}}_1\in {\mathbb{B}}^m}\sum _{{\mathbf{z}}_0\in {\mathbb{B}}^m}\sum _{\mathbf{x}\in {\mathbb{B}}^m}{(-1)}^{(\mathbf{s}\oplus {\mathbf{f}}_i\oplus {\mathbf{z}}_2\oplus {\mathbf{z}}_1\oplus {\mathbf{z}}_0)•\mathbf{x}}{|{\mathbf{z}}_2\rangle }_T{|-\rangle }_S{|{\mathbf{z}}_1\rangle }_S{|-\rangle }_i{|{\mathbf{z}}_0\rangle }_i.$$

(14)

This last formula can be written in a more readable form in view of the CIP property for bit vectors (recall Formulae (5) and (6)). In this specific setting, the application of these properties leads to the following reasoning:

• If $\mathbf{s}\oplus {\mathbf{f}}_i\oplus {\mathbf{z}}_2\oplus {\mathbf{z}}_1\oplus {\mathbf{z}}_0\ne \mathbf{0}$, or, equivalently, ${\mathbf{z}}_2\oplus {\mathbf{z}}_1\oplus {\mathbf{z}}_0$≠$\mathbf{s}\oplus {\mathbf{f}}_i$, the sum

  $$\begin{array}{c}\hfill \sum _{\mathbf{x}\in {\mathbb{B}}^m}{(-1)}^{(\mathbf{s}\oplus {\mathbf{f}}_i\oplus {\mathbf{z}}_2\oplus {\mathbf{z}}_1\oplus {\mathbf{z}}_0)•\mathbf{x}}{|{\mathbf{z}}_2\rangle }_T{|-\rangle }_S{|{\mathbf{z}}_1\rangle }_S{|-\rangle }_i{|{\mathbf{z}}_0\rangle }_i\end{array}$$

  appearing in (14) becomes just 0.
• If $\mathbf{s}\oplus {\mathbf{f}}_i\oplus {\mathbf{z}}_2\oplus {\mathbf{z}}_1\oplus {\mathbf{z}}_0=\mathbf{0}$, or, equivalently, ${\mathbf{z}}_2\oplus {\mathbf{z}}_1\oplus {\mathbf{z}}_0$=$\mathbf{s}\oplus {\mathbf{f}}_i$, the sum

  $$\begin{array}{c}\hfill \sum _{\mathbf{x}\in {\mathbb{B}}^m}{(-1)}^{(\mathbf{s}\oplus {\mathbf{f}}_i\oplus {\mathbf{z}}_2\oplus {\mathbf{z}}_1\oplus {\mathbf{z}}_0)•\mathbf{x}}{|{\mathbf{z}}_2\rangle }_T{|-\rangle }_S{|{\mathbf{z}}_1\rangle }_S{|-\rangle }_i{|{\mathbf{z}}_0\rangle }_i\end{array}$$

  becomes

  $$2^m{|{\mathbf{z}}_2\rangle }_T{|-\rangle }_S{|{\mathbf{z}}_1\rangle }_S{|-\rangle }_i{|{\mathbf{z}}_0\rangle }_i.$$

  (15)

Thus, $|{\psi }_2\rangle$ can be written in the simpler form given below:

$$|{\psi }_2\rangle ={\displaystyle \frac{1}{2^m}}\sum _{{\mathbf{z}}_2\in {\mathbb{B}}^m}\sum _{{\mathbf{z}}_1\in {\mathbb{B}}^m}\sum _{{\mathbf{z}}_0\in {\mathbb{B}}^m}{|{\mathbf{z}}_2\rangle }_T{|-\rangle }_S{|{\mathbf{z}}_1\rangle }_S{|-\rangle }_i{|{\mathbf{z}}_0\rangle }_i,$$

(16)

where

$$\begin{array}{c}\hfill {\mathbf{z}}_2\oplus {\mathbf{z}}_1\oplus {\mathbf{z}}_0=\mathbf{s}\oplus {\mathbf{f}}_i.\end{array}$$

(17)

The relationship expressed by (17) is identified as the Hadamard Entanglement Property, which connects the input registers of Trent, Sophia, and Alice_i. This relationship emerges as a consequence of the initial entanglement present among these input registers. By the time Phase 2 is concluded, Sophia and Alice_i have encoded their private values, $\mathbf{s}$ and ${\mathbf{f}}_i$, as the modulo 2 sum $\mathbf{s}\oplus {\mathbf{f}}_i$ within the state of the system, thereby imposing this correlation on the contents of the input registers.

The GHZ₃MQPEC protocol’s quantum portion is completed when Trent, Sophia, and Alice_i perform measurements on their input registers with respect to the computational basis. Through this process, the composite system’s state collapses to $|{\psi }_f\rangle$:

$$|{\psi }_f\rangle =\left|{\mathbf{y}}_2{\rangle }_T\right|-{\rangle }_S\left|{\mathbf{y}}_1{\rangle }_S\right|-{\rangle }_i|{\mathbf{y}}_0{\rangle }_i,\text{where}$$

(18)

$${\mathbf{y}}_2\oplus {\mathbf{y}}_1\oplus {\mathbf{y}}_0=\mathbf{s}\oplus {\mathbf{f}}_i.$$

(19)

We note that both output registers $SO{R}_i$ and $AO{R}_i$ remain in their initial state $|-\rangle$ throughout the execution of the protocol. In that sense, they could be ignored and removed from (18). It is expedient to point out that our reasoning is valid no matter whether the private circuits of the players are in the same locality or are spatially distributed. This is because the previous equations derive their validity from the fact that the input registers are entangled in the first place. In the presence of entanglement, the distance among the players is irrelevant.

From now on, the GHZ₃MQPEC protocol uses only classical authenticated communication channels. The following actions allow Trent to complete the multiparty equality comparison among the n millionaires and announce his decision in the form of a single bit for every pair of Alice_i and Alice_j, $0\le i<j\le n-1$; namely, YES_i,j if ${\mathbf{f}}_i={\mathbf{f}}_j$ or NO_i,j if ${\mathbf{f}}_i\ne {\mathbf{f}}_j$.

(D₁)

Sophia and Alice_i send to Trent the measured contents of their input registers ${\mathbf{y}}_1$ and ${\mathbf{y}}_0$, respectively. The communication takes place via authenticated classical channels, which means that the transmitted messages become public knowledge but cannot be modified by an adversary.

(D₂)

Trent, as was stipulated in (A₄) of Section 3.1, never divulges the measured contents of his input register ${\mathbf{y}}_2$ to any other in-game player or outside eavesdropper. This implies that only Trent has the complete information to compute the modulo 2 sum $\mathbf{s}\oplus {\mathbf{f}}_i$ according to (19).

(D₃)

The same procedure is repeated for every millionaire Alice₀, …, Alice_n−1. This enables Trent to calculate the sequence of n modulo 2 sums $\mathbf{s}\oplus {\mathbf{f}}_0$, …, $\mathbf{s}\oplus {\mathbf{f}}_{n-1}$. We note that Trent, as was ordained in (A₄), never reveals the aforementioned sequence to any other in-game player or outside eavesdropper. The following obvious identity

$$\mathbf{s}\oplus {\mathbf{f}}_i=\mathbf{s}\oplus {\mathbf{f}}_j\Rightarrow {\mathbf{f}}_i={\mathbf{f}}_j$$

(20)

is the key to determine whether two fortunes ${\mathbf{f}}_i$ and ${\mathbf{f}}_j$, $0\le i<j\le n-1$, are equal or not. Finally, Trent broadcasts through classical channels a sequence of ${\displaystyle \frac{n(n-1)}{2}}$ of bits that carry the information YES_i,j or NO_i,j, $0\le i<j\le n-1$, depending on whether ${\mathbf{f}}_i={\mathbf{f}}_j$ or ${\mathbf{f}}_i\ne {\mathbf{f}}_j$.

To obtain a better feeling for the inner workings of the GHZ₃MQPEC protocol, we present an illustrative example in the next section.

5. The GHZ₃MQPEC Protocol in Action

This section contains an example that demonstrates and explains the operation of the GHZ₃MQPEC protocol. For practical reasons, this is a small-scale example utilizing 24 qubits. A bigger example, involving more qubits, would result in unintelligible figures that would obstruct the readability and understanding of the quantum circuit. This example, which faithfully follows the abstract quantum circuit of Figure 3, was implemented in Qiskit [70], and the resulting quantum circuit is shown in Figure 6.

We assume that $n=3$ millionaires Alice₀, Alice₁, and Alice₂ with private fortunes ${\mathbf{f}}_0=11$, ${\mathbf{f}}_1=11$, and ${\mathbf{f}}_2=01$ want to compare their fortunes in one go with the mediation of Sophia, whose secret number is $\mathbf{s}=10$, and Trent. To keep the qubit count low, we opted for input registers that have two qubits, i.e., $m=2$. So, we employ a parallel array of three circuits $Q{C}_0$, $Q{C}_1$, and $Q{C}_2$, corresponding to Alice₀, Alice₁, and Alice₂, respectively. Below we explain the acronyms used in Figure 6.

Alice₀, Alice₁, Alice₂, and Sophia embed their private numbers in the global state of the entangled system. The embedding is trivially implemented using exclusively CNOT gates. When they measure their input registers, Alice₀, Alice₁, Alice₂, Sophia, and Trent obtain one of the $2^{24}$ = 16,777,216 outcomes, all with equal probability. Due to evident technical constraints, it is not feasible to present all these outcomes, as doing so would lead to a figure that is difficult to interpret. Therefore, we illustrate only 16 of them in Figure 7.

$Q{C}_0$ consists of the following components:

• Alice₀’s input register alice’s_0_IR containing two qubits.
• Alice₀’s single-qubit output register alice’s_0_OR initialized at $|-\rangle$.
• Sophia’s input register sophia’s_0_IR containing two qubits.
• Sophia’s single-qubit output register sophia’s_0_OR initialized at $|-\rangle$.
• Trent’s input register trent’s_0_IR containing two qubits.
• trent’s_0_IR, sophia’s_0_IR, and alice’s_0_IR are initialized in the entangled state ${|GH{Z}_3\rangle }^{\otimes 2}$.
• The three classical registers (each containing two bits) used by Alice₀, Sophia, and Trent to store their measurements, are collectively referred to as the classicalRegister0 with a total capacity of six bits.

$Q{C}_1$ consists of the following components:

• Alice₁’s input register alice’s_1_IR containing two qubits.
• Alice₁’s single-qubit output register alice’s_1_OR initialized at $|-\rangle$.
• Sophia’s input register sophia’s_1_IR containing two qubits.
• Sophia’s single-qubit output register sophia’s_1_OR initialized at $|-\rangle$.
• Trent’s input register trent’s_1_IR containing two qubits.
• trent’s_1_IR, sophia’s_1_IR, and alice’s_1_IR are initialized in the entangled state ${|GH{Z}_3\rangle }^{\otimes 2}$.
• The three classical registers (each containing two bits) used by Alice₁, Sophia, and Trent to store their measurements, are collectively referred to as the classicalRegister1 with a total capacity of six bits.

$Q{C}_2$ consists of the following components:

• Alice₂’s input register alice’s_2_IR containing two qubits.
• Alice₂’s single-qubit output register alice’s_2_OR initialized at $|-\rangle$.
• Sophia’s input register sophia’s_2_IR containing two qubits.
• Sophia’s single-qubit output register sophia’s_2_OR initialized at $|-\rangle$.
• Trent’s input register trent’s_2_IR containing two qubits.
• trent’s_0_IR, sophia’s_2_IR, and alice’s_2_IR are initialized in the entangled state ${|GH{Z}_3\rangle }^{\otimes 2}$.
• The three classical registers (each containing two bits) used by Alice₂, Sophia, and Trent to store their measurements are collectively referred to as the classicalRegister2 with a total capacity of six bits.

It is straightforward to verify that all outcomes satisfy the Hadamard Entanglement Property, as quantified by (19). To explain this point beyond any doubt, let us focus on the histogram of Figure 7 and, specifically, on the value of the label of the first bar, which is . The label consists of three parts: , corresponding to the contents of classicalRegister2; , corresponding to the contents of the classicalRegister1; and , corresponding to the contents of the classicalRegister0. This ordering is a direct consequence of the way the quantum circuit in Figure 6 was constructed, i.e., the bits of classicalRegister2 are more significant than those of classicalRegister1, which in turn are more significant than those of classicalRegister0.

• classicalRegister0 is the collective name for the three classical registers (each containing two bits) used by Trent, Sophia, and Alice₀ to store their measurements. Therefore, the contents of are analyzed as shown below:

  (21)

  This means that ${\mathbf{y}}_2=11$, ${\mathbf{y}}_1=00$, and ${\mathbf{y}}_0=10$. Sophia and Alice₀ send to Trent ${\mathbf{y}}_1$ and ${\mathbf{y}}_0$ via authenticated classical channels. So, Trent has the complete information to compute the modulo 2 sum of ${\mathbf{y}}_2$, ${\mathbf{y}}_1$, and ${\mathbf{y}}_0$ and conclude that

  $$\begin{array}{c}\hfill \mathbf{s}\oplus {\mathbf{f}}_0=01,\end{array}$$

  (22)

  according to (19).
• Reasoning in exactly the same way for classicalRegister1 and classicalRegister2, it is straightforward to see that Trent arrives at the additional conclusions

  $$\begin{array}{c}\mathbf{s}\oplus {\mathbf{f}}_1=01,\mathrm{and}\end{array}$$

  (23)

  $$\begin{array}{c}\hfill \mathbf{s}\oplus {\mathbf{f}}_2=11.\end{array}$$

  (24)

Ergo, Trent ascertains that Alice₀ and Alice₁’s fortunes are equal but different from Alice₂’s fortune. We emphasize that Sophia, as stipulated in (A₃), never reveals her secret number $\mathbf{s}$, so Trent cannot infer ${\mathbf{f}}_i$ from $\mathbf{s}\oplus {\mathbf{f}}_i$. Likewise, Trent never divulges ${\mathbf{y}}_2$ or the modulo 2 sum ${\mathbf{y}}_2\oplus {\mathbf{y}}_1\oplus {\mathbf{y}}_0$ to any other in-game player or outside eavesdropper, as ordained by (A₄) and (D₃). Thus, no entity can gain any information about the millionaires’ fortunes. Hopefully, our in-depth analysis demonstrates that it is very easy to extend the present example either by increasing the capacity m of the registers or by increasing the number of millionaires n.

6. Efficiency and Security Analysis

We proceed now to examine the efficiency and security aspects of the GHZ₃MQPEC protocol. Its efficiency is, we believe, one of the strong points, as we demonstrate in the next Section 6.1.

6.1. Efficiency

A common metric for quantifying the qubit efficiency of quantum protocols is the ratio $\eta$, which compares the total number of transmitted “useful” classical bits to the total number of qubits employed [71,72]. For multiparty quantum private comparison protocols, this measure must be suitably adjusted and defined as follows (see, for instance, [36,73]):

$$\eta ={\displaystyle \frac{{\eta }_{cb}}{{\eta }_{tq}}},$$

(25)

where ${\eta }_{cb}$ stands for the number of classical bits required to represent the fortunes of the millionaires, and ${\eta }_{tq}$ is the number of qubits the protocol uses. At this point, we must clarify that the measure ${\eta }_{tq}$ does not include the decoys, as is the norm in the literature.

In the case of the GHZ₃MQPEC protocol, we assumed that each millionaire requires m bits to store her fortune. Taking into account the fact that there are n millionaires, we see that

$${\eta }_{cb}=nm.$$

(26)

To accomplish this task, our protocol requires $3m+2$ qubits for each millionaire, which means that for n millionaires, it requires

$${\eta }_{tq}=3nm+2n$$

(27)

qubits in total. Therefore, the efficiency $\eta$ of the GHZ₃MQPEC protocol is

$$\eta ={\displaystyle \frac{nm}{3nm+2n}}={\displaystyle \frac{m}{3m+2}}\approx {\displaystyle \frac{m}{3m}}={\displaystyle \frac{1}{3}}=33.33\%.$$

(28)

In the derivation of the above result, we used the fact that for large values of m, a realistic assumption in a real-life scenario, it holds that $3m+2\approx 3m$. These efficiency results are what is to be expected in multiparty quantum private comparison protocols based on GHZ entanglement. This fact can be verified by consulting the relevant literature [36,73,74,75,76].

Let us emphasize that the quantum resources required by our GHZ₃MQPEC protocol, as given by Formula (27), grow linearly in both parameters n, expressing the number of millionaires, and m, quantifying the number of qubits that suffice to represent in binary any of the millionaires’ fortunes. This can be more formally stated as follows:

$${\eta }_{tq}=\Theta (n+m).$$

(29)

This proves the ability of the GHZ₃MQPEC protocol to scale in the most efficient way possible with both parameters n and m and thus be amenable to practical implementation.

It should be noted though that, given the modest number of qubits in modern quantum computers, there are practical limitations to scaling. For instance, higher m values may prove challenging. We should point out that as m increases, it becomes increasingly difficult to ensure the desired entanglement states and to maintain control over the entire composite system. This could potentially restrict the practical application of our protocol on today’s quantum computers.

6.2. Security

This subsection analyzes the security aspects of the GHZ₃MQPEC protocol and proves that it is information-theoretically secure. Our proof is given in a format that is pretty much the norm in the relevant literature. It is expedient to distinguish between external and participants’ attacks. By external attack, we refer to an attack by an outside eavesdropper, namely Eve, whereas by participants’ attack, we mean an attack by any of the $n+2$ players that participate in the protocol.

6.2.1. External Attack

Before we lay out the formal analysis regarding the possible actions undertaken by Eve in her effort to breach the security of the GHZ₃MQPEC protocol and obtain some useful information, it is essential to recall two standard detection techniques that are among the first line of defense against malicious adversaries.

(DT₁)

Eavesdropping detection. A typical scheme for the detection of a possible eavesdropper is to have the source responsible for the generation and distribution of the entangled particles, the $|GH{Z}_3\rangle$ triplets in our case, also produce decoy photons randomly chosen from one of the $|0\rangle ,|1\rangle ,|+\rangle ,|-\rangle$ states, which are randomly embedded into the transmission sequences. Eve, by meddling with the transmission sequences, and unaware of the positions of the decoys, will invariably cause errors that are easily detectable by the legitimate players upon a typical verification check. This technique, which is referred to as the decoy technique, has been extensively studied in the literature [20,26,36,41,43,44,47,69].

(DT₂)

Entanglement validation. The effective execution of any protocol based on entanglement relies fundamentally on the presence of entanglement itself. In the absence of assured entanglement, the operational integrity of the protocol is jeopardized. The process of validating entanglement may yield two possible results. Should entanglement be confirmed, the protocol is then able to advance and successfully fulfill its designated purpose. The inability to confirm entanglement suggests a lack of the essential entanglement itself. This situation may arise due to either the presence of noisy quantum channels or intentional disruption by an adversary. No matter what the underlying reason might be, the only appropriate course of action is to cease the current execution and restart the entire process, ensuring that corrective measures are put in place. Given its importance, the validation of entanglement has been extensively examined by numerous researchers. The GHZ₃MQPEC protocol follows the advanced techniques described in previous studies, and in particular [77,78,79,80,81,82].

We shall now examine the most prominent tactics that the external eavesdropper Eve might utilize.

(Attack₁)

Measure and Resend. Eve intercepts the $|GH{Z}_3\rangle$ qubits as they are being transmitted from Trent to Sophia, and Alice_i, $0\le i\le n-1$, measures them and then returns them to the intended recipients in this kind of attack. However, there is no information encoded in the $|GH{Z}_3\rangle$ triplets. Therefore, Eve will be unable to find any information by doing this. Additionally, the legitimate players will be able to identify a malicious presence with ease if they use the decoy technique. As a result, the protocol is immune to attacks of this kind.

(Attack₂)

Intercept and Resend. Eve’s approach in this scenario involves intercepting the $|GH{Z}_3\rangle$ particles while they are being transmitted from Trent to Sophia and Alice_i, where $0\le i\le n-1$. Due to the no-cloning theorem, she is unable to create copies of these particles. Consequently, she opts to prepare and send new qubits to the designated recipients. Eve does not learn anything by measuring the $|GH{Z}_3\rangle$ triplets because, as we have already mentioned, they carry no information at all during the protocol’s transmission phase. Additionally, the legitimate players can deduce the existence of an eavesdropper thanks to the decoy technique. So, the GHZ₃MQPEC protocol is also safe from such an attack.

(Attack₃)

Entangle and Measure. Eve starts this kind of attack by intercepting the qubits of the $|GH{Z}_3\rangle$ triplets during their transmission. In contrast to the previous types of attack, in this case, Eve refrains from measuring these qubits; instead, she entangles them with her ancilla state before forwarding the relevant qubits to Sophia and Alice_i. Following this, Eve remains inactive until the protocol concludes, at which point she measures her qubits, aiming to extract valuable information. However, the result of her efforts leads to a situation where, rather than achieving an even distribution of $|GH{Z}_3\rangle$ triplets among Trent, Sophia, and Alice_i, she ends up with m$|GH{Z}_4\rangle$ quadruples distributed evenly among Trent, Sophia, Alice_i, and herself. Consequently, during the classical portion of the protocol, when Sophia and Alice_i relay their measurements to Trent via the public channel, Eve will be unable to compute the correct modulo 2 sum. This is due to her lack of access to Trent’s private bit vector ${\mathbf{y}}_2$, which Trent does not transmit through the public channel. As a result, Eve will again be unsuccessful in acquiring any information.

(Attack₄)

PNS. One of the most potent attack methods that Eve can use against any quantum protocol at the moment is the photon number splitting attack (PNS), which was first described in [83] and subsequently examined in [84,85]. Contemporary photon sources exhibit a known flaw: at times, they might generate several identical photons rather than a single one. Consequently, Eve could intercept the pulses originating from Trent during the distribution of the $|GH{Z}_3\rangle$ triplets, retain one photon from the multiphoton pulse for her own use, and transmit the remaining photons to Sophia and Alice_i without being noticed during the transmission phase. Nonetheless, this situation resembles the Entangle and Measure attack analyzed above. Again, instead of $|GH{Z}_3\rangle$ triplets evenly distributed among the three legitimate actors, there are $|GH{Z}_4\rangle$ quadruples evenly distributed among Trent, Sophia, Alice_i, and Eve. Eve becomes an active fourth player in the game but fails to uncover any useful information for the reason explained above.

6.2.2. Participants’ Attack

In this subsection, we examine the scenario in which one of the players in this game seeks to acquire information regarding the wealth of one of the millionaires. It is useful to categorize the following situations based on the dishonest participant attempting to obtain unauthorized information:

Alice_i

Let us assume that Alice_i, $0\le i\le n-1$, intercepts the $|GH{Z}_3\rangle$ qubits during their transmission from Trent to Sophia and another Alice_j, $0\le i\ne j\le n-1$. Alice_i has the option to measure them and send them back to their intended recipients or transmit new, previously prepared qubits to their intended recipients. Taking into consideration the fact that the $|GH{Z}_3\rangle$ triplets contain no information at all, we see that, in both cases, Alice_i will fail to gain any information. Moreover, the decoy technique will allow the legitimate players to infer that someone has tampered with the transmitted sequences.

Another scenario for Alice_i is to intercept the qubits from the $|GH{Z}_3\rangle$ triplets during their transmission from Trent to Sophia and Alice_j, $i\ne j$, and, without measuring them, entangle them with her ancilla state. Then, Alice_i forwards the relevant qubits to Sophia and Alice_j and waits for the quantum part of the protocol to finish. At this point, she measures her qubits in the hope of gaining useful information. The critical flaw in Alice_i’s strategy is that her actions result in having $|GH{Z}_4\rangle$ quadruples evenly distributed among Trent, Sophia, Alice_j, and Alice_i instead of having $|GH{Z}_3\rangle$ triplets evenly distributed among Trent, Sophia, and Alice_j. Ultimately, Alice_i will fail to compute the correct modulo 2 sum as the classical portion of the protocol unfolds, the reason being that Alice_i will not know Trent’s private bit vector ${\mathbf{y}}_2$. Recall that Trent never divulges ${\mathbf{y}}_2$ or the modulo 2 sum ${\mathbf{y}}_2\oplus {\mathbf{y}}_1\oplus {\mathbf{y}}_0$ to any other in-game player or outside eavesdropper, as ordained by (A₄) and (D₃). Once again, Alice_i fails to gain any information. Therefore, the GHZ₃MQPEC protocol is immune to attacks by Alice_i, $0\le i\le n-1$.

Sophia 

Let us assume that Sophia intercepts the $|GH{Z}_3\rangle$ particles en route from Trent to Alice_i. Sophia has the option to measure these particles and subsequently return them to Alice_i, or alternatively, she may send new qubits that she has prepared in advance to Alice_i. Since the $|GH{Z}_3\rangle$ triplets carry no information, Sophia will not gain any information in any of the earlier cases. Additionally, the other legitimate players will be able to identify the tampering thanks to the use of the decoy technique.

Another possibility for Sophia is to intercept the qubits from the $|GH{Z}_3\rangle$ triplets during their transmission from Trent to Alice_i and entangle them with her ancilla state, without measuring them. Sophia sends corresponding qubits to Alice_i and waits for the protocol to finish. Then, she measures her qubits, expecting to uncover some information. The problem with this strategy is that Sophia’s tampering has resulted in having $|GH{Z}_4\rangle$ quadruples evenly distributed among Trent, Sophia, and Alice_i, instead of having $|GH{Z}_3\rangle$ triplets. Ultimately, Sophia will fail to compute the correct modulo 2 sum as the classical portion of the protocol unfolds because she will not know Trent’s private bit vector ${\mathbf{y}}_2$. We recall that Trent never divulges ${\mathbf{y}}_2$ or the modulo 2 sum ${\mathbf{y}}_2\oplus {\mathbf{y}}_1\oplus {\mathbf{y}}_0$ to any other in-game player or outside eavesdropper, as dictated by (A₄) and (D₃). Consequently, the GHZ₃MQPEC protocol is impervious to attacks by Sophia.

Trent 

Trent cannot surmise Sophia’s secret number $\mathbf{s}$ because Sophia, as stipulated in (A₃), never reveals her secret number $\mathbf{s}$. Moreover, the fundamental premise of the protocol is that Alice_i, $0\le i\le n-1$, never divulges her private fortune ${\mathbf{f}}_i$. Hence, although Trent knows the modulo 2 sum $\mathbf{s}\oplus {\mathbf{f}}_i$, he can infer neither $\mathbf{s}$ nor ${\mathbf{f}}_i$. Thus, the GHZ₃MQPEC protocol cannot be compromised by Trent.

Information theoretically, the GHZ₃MQPEC protocol is secure, as proved by the above concise security analysis.

6.3. Comparative Assessment

In this section, we present an informative comparative assessment of the GHZ₃MQPEC protocol with respect to some notable previous protocols designed to address the private equality comparison problem for an arbitrary number n of millionaires, and also for the special case of two millionaires. We gathered in

Table 2. Comparison among GHZ₃MQPEC and previous multiparty quantum private comparison protocols.

	# of Millionaires	Quantum State	Unitary Operations	Use of QKD	Qubit Efficiency
[20]	2	EPR	✔	✖	$25.00\%$
[24]	2	GHZ3	✔	✖	$33.33\%$
[44]	n	GHZn	✖	✖	${\displaystyle \frac{m}{nm}}$
[45]	n	d-level basis states	✔	✖	${\displaystyle \frac{m}{nm}}$
[49]	n	d-level states	✔	✖	${\displaystyle \frac{m}{3nm+m}}$
[50]	n	d-level Bell states	✔	✖	${\displaystyle \frac{m}{2nm+2m}}$
[48]	n	Quantum         Homomorphic Encryption	✔	✔	—
[36]	2	Single Photons	✔	✔	≥50.00%
GHZ3MQPEC	n	GHZ3	✔	✖	$33.33\%$

the most important design choices for multiparty quantum private comparison protocols, such as the choice of entanglement, the use or not of unitary operations, and the reliance on QKD schemes, the latter adding extra complexity and overhead to the protocol itself. Last, but not least, we included the important efficiency metric. The results contained in Table 2 highlight the novelties incorporated in the GHZ₃MQPEC protocol and corroborate its most important qualitative and quantitative traits.

7. Discussion and Conclusions

This paper presents the innovative GHZ₃MQPEC protocol that accomplishes a multiparty quantum private comparison leveraging maximally entangled $|GH{Z}_3\rangle$ triplets. We list below some of the most important advantages of the protocol.

• The primary aim of this protocol is to be easily executable by modern quantum computers. This is achieved by employing only $|GH{Z}_3\rangle$ triplets, regardless of the number of participants. Though high-dimensional quantum states and more intricate multiparticle entangled states are feasible, their creation is challenging given the current state of quantum technology, leading to longer preparation times, particularly in situations involving many players. By exclusively using $|GH{Z}_3\rangle$ states, which are simpler to produce than Bell states, these issues are mitigated, advancing the practical implementation of the protocol.
• A key quantitative feature of this protocol is that the number of players and the volume of data being compared determine the required quantum resources, which scale linearly, further demonstrating its practicality. Notably, the GHZ₃MQPEC protocol can be executed in both parallel and sequential modes. While the quantum operations are intended to run in parallel, sequential execution is also possible if quantum resources are insufficient, allowing the participants to be divided into smaller groups for sequential processing.
• Additionally, the protocol does not depend on a quantum signature scheme or pre-shared keys, which simplify and reduce its cost. Implementation is further streamlined as all participants use identical private quantum circuits consisting of Hadamard and CNOT gates, making it straightforward to implement on contemporary quantum computers.
• Crucially, the protocol ensures that external parties cannot access any information about the participants’ values, and participants themselves cannot learn each other’s secret numbers. The protocol is demonstrated to be information-theoretically secure.

In closing, we briefly mention the special case $n=2$, which is when there are only two millionaires, say Alice and Bob. As we mentioned in Section 3, in such a case Sophia becomes unnecessary and Trent alone suffices. The GHZ₃MQPEC protocol can be easily simplified to function without the presence of Sophia, using the quantum circuit shown in Figure 8. Obviously, the whole mathematical description of the protocol, its quantitative characteristics, and its security remain unaffected.

The current state of affairs, regarding the availability of quantum computers with a sufficient number of qubits, undoubtedly imposes certain limitations on the practical execution of any quantum protocol, including, of course, GHZ₃MQPEC. Moreover, it should be noted that measuring m triplets simultaneously can be challenging and may call for sophisticated multichannel detection systems, which raises the complexity of the implementation. Hopefully, the upcoming generation of quantum computers will address many of these practical issues and allow for increased scalability.