Quantum dialogue by nonselective measurements

Unlike classical measurements, quantum measurements may be useful even without reading the outcome. Such so called nonselective measurements are exploited in this paper to design a quantum dialogue protocol that allows exchanging secret data without prior key distributions. The relevant data to be exchanged are in terms of the high-dimensional mutually unbiased bases of quantum measurements. Appropriate modes of bidirectional controlling are devised to ensure the protocol security which is asymptotic.

In existing quantum dialogue protocols signals to be exchanged are encoded in type of states (e.g., by means of m, n in Einstein-Podolsky-Rosen states [24] |Ψ mn = 1 √ 2 1 j=0 (−1) mj | j, j ⊕ n , with ⊕ denoting addition modulo 2) and choice of operators (e.g., by means of k, l in Pauli operators σ k z σ l x ). In this work, we shall encode signals in the measurement bases. Also, nonselective measurements (i.e., measurements without reading the outcome) play an important role in executing the dialogue. This is somewhat surprising in comparison with classical situations. In classical world, making a measurement but disregarding its outcome is nothing else but doing nothing because this provides no information at all. However, in quantum world, the nature of measurement is totally different. Besides resulting probabilistic outcomes and disturbing the measured system, quantum measurement carried out in a specific basis inevitably leaves its trace behind, even without caring about its outcome. Therefore, nonselective measurements can be exploited for signalling [25]. The bases of measurement we are concerned with are mutually unbiased whose properties are briefly mentioned in section 2. Section 3 presents our quantum dialogue protocol with measurement bases as signals and nonselective measurement as a tool. We then analyse security of the proto col against typical eavesdropping attacks in section 4 and conclude in the last section 5.

Preliminaries
Consider a quNit in an N -dimensional Hilbert space spanned in the computational basis by N orthonormal basic states {|l ; l = 0, 1, ..., N − 1; N 1}. Let the N -dimensional Heisenberg-Weyl operators, which are natural generalization of Pauli operators σ x and σ z , be with '+' inside the ket denoting addition modulo N and Ω = exp(2πi/N) the complex N th root of unity. It can be proved [26] that if N is an odd prime, then there exists a complete set of N + 1 mutually unbiased bases (MUBs), each is composed of N orthonormal states which are eigenstates of the N + 1 unitary operators {XZ β ; β = 0, 1, ..., N − 1} and Z . Namely, a kth state (k = 0, 1, ..., N − 1) of a βth basis can be found to be and a kth state (k = 0, 1, ..., N − 1) of the (N + 1)th basis (which is the computational basis whose states are the eigenstates of the operator Z ) is Thus, there are N(N + 1) states in total which are grouped into N + 1 bases (labelled by β = 0, 1, . . . , N − 1 for the first N bases and by N for the (N + 1)th basis) each has N orthonormal states (labeled by k = 0, 1, . . . , N − 1). In this paper, for our convenience, we make use of the Fourier-Gauss structure and adopt the form which are equivalent to (3) up to the indexing of bases. It can be shown that the N + 1 bases (5) and (6) mentioned above obey the mutual unbiasedness conditions for any k, k and β = β , as must be due to definition of MUSs [27,28]. We can generate any state |β; k from a state in the computational basis |k ≡ |N; k as follows. To generate the state |0; k , we apply on |k the unitary operator which is the discrete quantum Fourier transformation [29]. In fact, where the last equality holds thanks to equation (6). As for the N − 1 other states |β; k with β = 1, ..., N − 1, we apply the unitary operator [28] β times on the previously generated state |0; k to obtain Ω βm 2 +kl |m m|l where the last equality holds thanks to equation (6) too.
Adv. Nat. Sci.: Nanosci. Nanotechnol. 9 (2018) 025001 We now deal with bipartite entanglement in MUSs. Consider two quNits 1 and 2. QuNit 1 is prepared in the state |β; k 1 with fixed β and k, while quNit 2 in the state |N; q 2 ≡ |q 2 with a fixed q. Let CS 12 and CS + 12 , CS 12 |m 1 |n 2 = |m 1 |n + m 2 (12) and with algebra inside the kets modulo N and |−l ≡ |N − l , be two-quNit controlled-shift-forward and controlled-shift-backward gates, with quNit 1 the control quNit and quNit 2 the target one. Then, |β; k, q 12 = CS 12 |β; Ω βl 2 +kl |l 1 |q + l 2 (14) is a two-quNit entangled state. The entanglement of state (14) is ensured by the property that if quNit 1 and quNit 2 are measured separately in their computational bases then the outcome a corresponding to finding |a 1 and the outcome b corresponding to finding |b 2 satisfy the equality independent of concrete sequence of the two measurements, revealing a nonclassical correlation (entanglement) between the two quNits. In total there are N 3 entangled states of the form (14) which are characterized by three parameters On the other hand, having two quNits of such a state in the same place with unknown k, q and known β we can easily identify it by first performing CS + 12 on it and then measuring the first quNit in the basis β and the second quNit in the computational basis (i.e., basis N ). Namely, because the subsequent single-quNit measurements will determine the values of k and q, thus identifying the two-quNit entangled state under question. Yet, if the two quNits are separated spatially so that the two-quNit gate CS + 12 cannot be performed, then a unknown two-quNit entangled state remains unknown. In passing we note a couple of formulae, namely and which prove to be useful later.

Quantum dialogue by nonselective measurements
In this section we shall show in detail how Alice and Bob can 'talk' with each other in a quantum manner. Before that let us describe a simpler task of how Alice and Bob can exchange a pair of secret numbers. Let Alice have a number which is either β ∈ {0, 1, ..., N − 1} or N with N being a large prime and Bob a number β ∈ {0, 1, ..., N − 1}. Suppose they wish to exchange their numbers securely. Since classical communication is insecure they must do this quantumly. A way to do this is as follows.
To start with, Bob prepares a state |β; k, q AB , with known β, k, q, then sends quNit A to Alice but keeps quNit B with himself. Alice, upon receiving A, measures it either in the basis β (if she wishes to send number β to Bob) or in the computational basis (if she wishes to send number N to Bob). After her measurement she returns A back to Bob without recording the outcome (that is, Alice's measurement is nonselective).
For Alice's measurement in basis β , she uses the projectors There are N measurement outcomes corresponding to finding A in state |β ; p A with p ∈ {0, 1, ..., N − 1}, each occurs with some probability. For whatever the outcome, if Alice records it then quNit A will be disentangled from quNit B. This scenario is not of our interest. Here, we are concerned with nonselective measurement so no outcomes are to be recorded: quNits A and B are not projected on a pure product state but become in a mixed state of the form where Evidently, ρ AB (β, β , k, q) depends explicitly not only on β, k, q but also on β which is the very point of nonselective measurement that we exploit for our quantum dialogue protocol. Bob, upon getting back from Alice the quNit A, measures the two quNits A and B in the bases in which he prepared the initial two-quNit entangled state (14). Technically, this means that he makes use of CS + AB defined in equation (13) to transform (20) to CS + AB ρ AB (β, β , k, q)CS AB then measures quNit A in the basis β and quNit B in the computational basis. In other words, we can say that Bob uses the following projectors Putting the right-hand-side of equation (20) into the righthand-side of equation (22) and taking into account equation (17) yields Adv. Nat. Sci.: Nanosci. Nanotechnol. 9 (2018) 025001 with δ a,b the Kronecker delta equal to 1 if a = b and to 0 if a = b. As for Alice's measurement in the computational basis, the projectors to be used are (24) with p = 0, 1, ..., N − 1. Alice would probabilistically obtain one of the N outcomes corresponding to finding A in state |p A with p ∈ {0, 1, ..., N − 1}. Without reading the outcomes the two quNits A and B after Alice's measurement are described by the density matrix with ρ AB (β, k, q) given by equation (21). Bob, in possession of both the quNits A and B at hand, measures them in the bases {|β; k , q AB ; k , q = 0, 1, ..., N − 1}, as in the case of Alice's measurement in basis β . The probability of finding state |β; k , q AB can be calculated by virtue of equations (18) and (24) as The expressions (23) and (25) indicate the following.
(i) If q = q and k = k, then P AB (β, β , k, q, k , q ) = P AB (β, N, k, q, k , q ) = 1/N . So we are not able to know with certainty in which basis Alice measured her quNit A, as it may equally be in basis β or in the computational basis N . (ii) If q = q and k = k, then P AB (β, β , k, q, k , q ) = 0, but P AB (β, N, k, q, k , q ) = 1/N . So we know with certainty that Alice measured her quNit A in the computational basis, the basis N . (iii) If q = q, then P AB (β, N, k, q, k , q ) = 0, but P AB (β, β , k, q, k , q ) = 1/N. So we know with certainty that Alice measured her quNit A in the basis Particularly in this case, if k = k, we know β with certainty β = β. Thus, almost always Bob is able to know Alice's secret number, β or N . Bob fails just in the only case (i) with probability 1/N which is vanishing in the large-N limit. Now, to let Alice know his secret number β, Bob sends Alice (in fact, just public announcement suffices) the number γ = β + β or γ = β + N depending on whether his outcome is q = q or q = q and k = k. Obviously, Alice is able to determine with certainty what is β by correspondingly substracting β or N from γ. Because here N is large it is highly hard for anyone, who does not know β or N , to obtain the right value of β from the announced value of γ.
As described by the above quantum procedure, the two people can at the same time exchange two numbers: β ∈ {0, 1, ..., N − 1} or N from Alice to Bob and β ∈ {0, 1, ..., N − 1} from Bob to Alice. It is alright if no eavesdropper, Eve, exists. In practical real-life conditions Eve is supposed to exist and, as a powerful person capable of doing anything allowed by Nature, she can devise wise strategies of attack to steal partial or even full information if Alice and Bob ignore proper methods of control. In the rest part of this paper, we suggest a full protocol with suitable controls for Alice and Bob to 'talk' with each other in front of Eve's nose.
Let Alice have a set of secret numbers {α 1 , α 2 , ..., α L } while Bob a set of other secret numbers {β 1 , β 2 , ..., β L }, where L 1, α j ∈ {0, 1, ..., N} and β j ∈ {0, 1, ..., N − 1}. Suppose that they want to securely exchange their numbers sequentially like in a conversation, i.e., for each j, from j = 1 until j = L, Alice 'asks' α j and Bob 'answers' β j . For that purpose they are suggested to proceed as follows (see figure 1). S1. j = 0. S2. j = j + 1. Bob entangles quNits A j and B j into state |β j ; k j , q j AjBj of equation (14), then sends A j to Alice and keeps B j in his lab. S3. After receiving quNit A j , Alice with probability v 1 performs a control mode of type 1 (CM1) or with probability 1 − v 1 executes a message mode of type 1 (MM1). CM1. Alice measures quNit A j in the computational basis and publicly publishes the measurement outcome a j which with a probability of 1/N takes on a value equal to 0, 1, 2, . . . or N − 1 corresponding to finding |0 Aj , |1 Aj , |2 Aj , ... or |N − 1 Aj , respectively. She also informs Bob of her choice and asks him to measure quNit B j in the computational basis. The outcome b j of Bob's measurement corre sponding to finding |b j Bj also with a probability of 1/N takes on a value equal to 0, 1, 2, . . . or N − 1. Then Bob checks the equality (15) which here reads b j = q j + a j . If the equality holds, then he sets j = j − 1 and goes back to S2 to continue. Otherwise, i.e., the equality is violated, then proto col should be restarted from S1. MM1. Alice encodes her number α j by measuring quNit A j in the basis α j then sends it (i.e., the measured quNit A j ) back to Bob without reading the measurement outcome. S4. Bob uses the bases, in which the jth entangled state was prepared in S2, to jointly measure quNits A j and B j . Let his measurement outcome be a pair of numbers k j , q j ∈ {0, 1, ..., N − 1} corresponding to finding β j ; k j , q j AjBj .
S5. Bob compares k j with k j and q j with q j . If k j = k j and q j = q j , Bob sets j = j − 1 and returns to S2 to continue. Otherwise, he with probability v 2 performs a control mode of type 2 (CM2) or with probability 1 − v 2 executes a message mode of type 2 (MM2). CM2. Bob informs Alice of his choice and asks her to reveal α j , then checks whether Nδ q j ,qj + (1 − δ q j ,qj ) β j + 1 2 k j − k j / q j = q j − α j = 0 or not. If it is, then Bob sets j = j − 1 and returns to S2 to continue. Otherwise, the protocol should be restarted from S1. MM2. Bob decodes Alice's number as α j = Nδ q j ,qj + (1 − δ q j ,qj ) β j + 1 2 k j − k j / q j = q j . S6. Bob publicly announces γ j = α j + β j . S7. Hearing γ j from the public announcement, Alice decodes Bob's number as β j = γ j − α j . S8. If j < L, the protocol returns to S2 to continue.
If S9 is reached, Alice and Bob succeeds their dialogue with a security level proportional to the length L of the dialogue. More about security will be analyzed in the next section.

Security analysis
Since quNit B j remains always with Bob, Eve is only able to access quNit A j that travels back and forth between Alice and Bob. However, initially quNit A j is maximally entangled with quNit B j so its individual state, with 1 the N -dimensional unit matrix, is maximally mixed containing no information and thus manipulating A j alone is useless. Eve is surely aware of that and will intentionally attack with additional resources. Most impressive is perhaps the attack called captureand-replace one. Eve ambushes on both routes from Bob to Alice as well as from Alice to Bob. She creates her own entangled state β j ; k j , q j CjDj with β j ; k j , q chosen at her will and, when Bob releases quNit A j , captures it and stores it in a quantum memory, followed by replacing quNit A j by quNit C j to be sent to Alice. Alice would encode her number α j on the state of quNit C j as in MM1, then send quNit C j to Bob without recording the measurement outcome as designed by the protocol. Eve again captures quNit C j and, as Bob would do in S4 with quNits A j and B j , she measures quNits C j and D j in the basis β j ; k j , q j CjDj . If q j = q j and k j = k j are obtained, Eve gets no information about α j so she puts quNit C j aside but takes quNit A j intact from the quantum memory and sends it back to Bob. Bob's measurement outcome in S4 must be k j = k j , q j = q j so that the protocol returns back to S2 to continue. Otherwise, i.e., if q j = q j , k j = k j or q j = q j , Eve determines α j as in MM2. After having known α j , Eve uses the basis α j to nonselectively measure quNit A j he stored before in the memory, then sends this measured quNit A j back to Bob, who would execute S4 to obtain α j and proceeds further to broadcast γ j = α j + β j . This broadcasting provides both Alice and Eve with the value of β j . Thus, through the above described capture-and-replace attack, Eve is able to eavesdrop the whole dialogue between Alice and Bob. Unfortunately for Eve, there are control modes that help Alice and Bob to detect her presence. It is easy to observe that Eve is immune to CM2 but is not to CM1 because B j and C j are not correlated at all. Let us denote by L the total number of the protocol run. Eve would be detected by a CM1 run with a probability d = (1 − 1/N)v 1 or, in other words, she would pass with a probability 1 − d . If Eve is detected in the first run, L = 1, the detection probability is P Detect (1) = d . If Eve passes the first run but is detected in the second run, L = 2, the detection probability is P Detect (2) = (1 − d)d . If Eve passes the first two runs but is detected in the third run, L = 3, the detection probability is P Detect (3) = (1 − d) 2 d , and so on. The total detection probability for L runs is therefore As the total number of run L is related to the length L of the dialogue by L = L/(1 − v 1 − v 2 ), the total detection probability can be reexpressed in terms of L as . (29) Clearly from equation (29), P TotalDetect → 1 in the limit of large L and/or large N , for any possible values of v 1 and v 2 . We next consider another attack called measure-and-forward one. When quNit A j appears from Bob side, Eve measures it in the computational basis with an outcome |a j Aj and forwards the measured quNit to Alice. As a result of entanglement, the state of quNit B j immediately collapses into |q j + a j Bj , implying immunity of such an Eve's action to CM1. Anyway, after Eve's measurement, the state of the two quNits A j and B j , up to a global phase factor, becomes which is a superposition of N entangled states, of which only one, that with u j = k j , coincides (ignoring the weight coefficient) with the state prepared in S2. Without CM2, Eve's action is hidden, Alice executes MM1 and Bob executes MM2, as designed. But, with a probability of (N − 1)/N (for u j = k j ), they exchange totally wrong data. Unfortunately for Eve, there is CM2 that helps Alice and Bob to detect her presence. Namely, because the number Bob decodes in S4 differs from the number Alice encodes in MM1 in most of the cases, Eve' action is exposed with CM2. The total detection probability for L runs has the form of (28), but with v 1 in d replaced by v 2 . Also, to prevent anyone from pretending Bob to get Alice's secret numbers (so-called masquerading attack), it is assumed that the two parties always keep in touch with each other via phone/fax before as well as during the performance of the quantum dialogue. Such assumption is implicit in section 3.
Because both directions between Alice and Bob are controlled the protocol designed in section 3 proves to be secure against other typical attacks: Eve would be detected by CM1 or/and CM2.

Conclusion
We have designed a quantum protocol for two-way communication allowing two parties, Alice and Bob, to simultaneously exchange their data in a manner like in a dialogue. Many different protocols of this quantum dialogue kind have been proposed previously. Most of them rely on superdense coding [30]. Our protocol here, instead, makes use of nonselective measurements with choices of measurement bases as signals to exchange. Because the protocol is two-way, two-way should also be the control. In fact, our bidirectional controlling, one on the Bob-to-Alice direction and the other on the Aliceto-Bob direction, make the protocol secure against commonly encountered eavesdropping attacks. Our analysis shows that the security is not absolute but asymptotic in the sense that the eavesdropper's detection probability approaches 1 if the dimension of the quantum carrier is high or/and the size of the to-be-exchanged data is large. Because of such kind of security, this (as well as other quantum dialogue proto cols) is advised to apply only in urgent circumstances when top-secrecy is not prerequisite. Anyway, our protocol sheds some more insight into distinction between classical and quantum measurements and the idea of it may suggest novel applications based on still-less-explored features of quantum measurements.