With the rapid development of quantum computing, there is a growing concern about the security and privacy of information transmission. Securing traditional encryption methods is no longer reliable due to the emergence of quantum algorithms (Shor’s algorithm [1] and Grover’s algorithm [2]). In order to enhance the security of information transmission, quantum cryptography, whose security is based on the principles of quantum mechanics, has become a focus and attracted much attention. The basic principles of quantum mechanics, such as quantum entanglement, non-cloning, the uncertainty principle, and the superposition principle, enable quantum communication to achieve information-theoretic security. In this context, quantum cryptography protocols, including quantum key distribution (QKD) [3, 4], quantum key agreement (QKA) [5–7], quantum secure direct communication (QSDC) [8, 9], and quantum secret sharing (QSS) [10, 11], have been proposed to address various cryptographic tasks.

The millionaire problem, a primitive of secure multi-party computing (SMC), was proposed by [12] in 1982. In this scenario, two millionaires aim to determine who is wealthier without disclosing their individual wealth. On the basis of Yao’s research, the socialist millionaire problem, a variant of the millionaire problem, was proposed by [13], in which two millionaires sought to compare whether their wealth was equal. However, [14] pointed out that calculating an equality function involving only two parties in the two-party computation setting is not secure. A semi-honest third party is inevitably introduced to complete the design of a secure private comparison protocol.

Quantum private comparison (QPC) utilizes the principles of quantum mechanics to ensure the security of private information. The goal of this project is to solve the socialist millionaire problem, which aims to determine whether the private inputs of the participants are equal while keeping their inputs undisclosed. The first QPC protocol was proposed by [15], in which two users compare their secrets using EPR pairs as quantum information carriers. Decoy photons and a one-way hash function are employed to ensure the security of the protocol. [16] introduced a QPC protocol based on triplet-entangled states in which the comparison result can be obtained even if not all data are compared completely. This is because the private inputs are divided into multiple groups, which leads to an improvement in efficiency. However, [17] pointed out that [16] is susceptible to intercept resend attacks, and some suggestions are provided to enhance the security of private information. After that, some researchers focus on using different quantum states, such as single photons [18, 19], Bell states [20], multi-qubit states [21–24], and high-dimensional quantum states [25–28], and various encoding methods to develop the QPC protocol. Additionally, semi-quantum private comparison (SQPC) protocols [29–36] have been proposed to alleviate the burden on quantum resources. These protocols allow participants with limited quantum abilities to compare their secrets.

[37] proposed a QPC protocol without a classical part that utilizes quantum gates for classical calculations, resulting in improved quantum security. [38] proposed a QPC protocol without requiring a third party. [39] utilized the property of entanglement swapping of Bell states to design a QPC protocol in which each round can compare three-bit classical information. In 2022, an eight-qubit entangled state was used for designing private comparison, which utilizes decoy photons and QKD technology to ensure security [40]. [41] designed a QPC protocol to compare whether single-qubit states are equal with rotation encryption and swap test. [42] employed 4D GHZ-like states as quantum resources to design the QPC protocol.

According to the analysis of previous QPC protocols, it is evident that the bitwise XOR operation is primarily used for comparisons in the design of QPC protocols. This process will result in classical results that exist in intermediate computations and are susceptible to attacks by classical attackers. In this paper, we propose a QPC protocol to solve the socialist millionaire problem using Bell states. This approach utilizes rotation operations to replace the bitwise XOR operation. No classical results are produced, resulting in enhanced security. In addition, it is straightforward to implement with current technology. In our protocol, the private inputs are encoded as the angles of the rotation operation. They can be compared with the assistance of a semi-honest third party who may exhibit unfaithful behavior but will perform the protocol process faithfully. TP is responsible for preparing the initial Bell states at the beginning of the protocol and conducting the Bell-basis measurement to obtain the classical result at the end. The participants only need to encode their inputs as angles and perform the rotation operation on the received quantum states. Compared to the previous protocols, our protocol has the following advantages: we use rotation operations instead of the bitwise XOR operation for classical calculations, which results in improved security. Complex quantum technologies, such as high-dimensional quantum states, entanglement swapping, and joint measurements, are not necessary. Our protocol only utilizes easy-to-implement technologies such as Bell states, rotation operations, and Bell-basis measurements, making it more practical. In other words, our protocol demonstrates superior performance in terms of practicability and security.

The remainder of this paper is organized as follows. Section 2 introduces the core method of rotation operation. The details of the proposed rotation operation-based quantum solution for the socialist millionaire problem are provided in Section 3. Two simulation experiments and the analysis of the proposed protocol are presented in Sections 4, 5, respectively. Finally, the conclusion is provided in Section 6.

The rotation operation can be represented by the following matrix: R y θ = cos θ 2 − ⁡ sin θ 2 sin θ 2 cos θ 2 . (1)

Eq. 1 can be considered a unitary matrix rotated around the y-axis with an angle θ on the Bloch sphere. When performing the rotation operation R y θ on the quantum state ψ = 1 , we have ψ ′ = R y θ ψ = cos θ 2 − ⁡ sin θ 2 sin θ 2 cos θ 2 0 1 = − ⁡ sin θ 2 cos θ 2 = − ⁡ sin θ 2 0 + ⁡ cos θ 2 1 .

In order to obtain ψ , we can only perform the rotation operation R y − θ on ψ ′ . Thus, we have ψ = R y − θ ψ ′ = cos − θ 2 − ⁡ sin − θ 2 sin − θ 2 cos − θ 2 − ⁡ sin θ 2 cos θ 2 = 0 1 = 1 .

Four types of Bell states can be represented as follows: Φ + = 1 2 00 + 11 , Φ − = 1 2 00 − 11 , Ψ + = 1 2 01 + 10 , Ψ − = 1 2 01 − 10 .

When performing rotation operations on Bell states, we observe the following special features:

Lemma 1

R y − θ 1 ⊗ R y − θ 2 R y θ 1 ⊗ R y θ 2 G = G holds for G ∈ Φ + , Φ − , Ψ + , Ψ − .

Proof. Without the loss of generality, let us consider Φ + as an example. We have R y − θ 1 ⊗ R y − θ 2 R y θ 1 ⊗ R y θ 2 Φ + = 1 2 R y − θ 1 ⊗ R y − θ 2 R y θ 1 0 ⊗ R y θ 2 0 + R y θ 1 1 ⊗ R y θ 2 1 = 1 2 R y − θ 1 + θ 1 0 ⊗ R y − θ 2 + θ 2 0 + R y − θ 1 + θ 1 1 ⊗ R y − θ 2 + θ 2 1 = 1 2 R y 0 0 ⊗ R y 0 0 + R y 0 1 ⊗ R y 0 1 = 1 2 0 0 + 1 1 = Φ + .

In the same way, we can prove that R y − θ 1 ⊗ R y − θ 2 R y θ 1 ⊗ R y θ 2 Φ − = Φ − , R y − θ 1 ⊗ R y − θ 2 R y θ 1 ⊗ R y θ 2 Ψ + = Ψ + , R y − θ 1 ⊗ R y − θ 2 R y θ 1 ⊗ R y θ 2 Ψ − = Ψ − .

Thus, R y − θ 1 ⊗ R y − θ 2 R y θ 1 ⊗ R y θ 2 G = G .

Lemma 1 holds.

Lemma 2

R y π ⊗ R y π G = R y 0 ⊗ R y 0 G = G holds for G ∈ Φ + , Φ − , Ψ + , Ψ − .

Proof: Without the loss of generality, let us consider Ψ + as an example. We have R y π ⊗ R y π Ψ + = 1 2 R y π 0 ⊗ R y π 1 + R y π 1 ⊗ R y π 0 = 1 2 − 10 − 01 = − Ψ + , R y 0 ⊗ R y 0 Ψ + = 1 2 R y 0 0 ⊗ R y 0 1 + R y 0 1 ⊗ R y 0 0 = 1 2 01 + 10 = Ψ + .

Since the global phase has no observable effect, we can easily infer that R y π ⊗ R y π Ψ + = R y 0 ⊗ R y 0 Ψ + = Ψ + .

In the same way, we can prove that R y π ⊗ R y π Φ − = R y 0 ⊗ R y 0 Φ − = Φ − , R y π ⊗ R y π Ψ + = R y 0 ⊗ R y 0 Ψ + = Ψ + , R y π ⊗ R y π Ψ − = R y 0 ⊗ R y 0 Ψ − = Ψ − .

Thus, R y π ⊗ R y π G = R y 0 ⊗ R y 0 G = G .

Lemma 2 holds.

Lemma 3

R y π ⊗ R y 0 Φ + = R y 0 ⊗ R y π Φ + = Ψ − R y π ⊗ R y 0 Φ − = R y 0 ⊗ R y π Φ − = Ψ + R y π ⊗ R y 0 Ψ + = R y 0 ⊗ R y π Ψ + = Φ − R y π ⊗ R y 0 Ψ − = R y 0 ⊗ R y π Ψ − = Φ + holds.

Proof: Without the loss of generality, let us consider R y π ⊗ R y 0 Φ + = R y 0 ⊗ R y π Φ + = Ψ − as an example. We have R y π ⊗ R y 0 Φ + = 1 2 R y π 0 ⊗ R y 0 0 + R y π 1 ⊗ R y 0 1 = 1 2 10 − 01 = − Ψ − , R y 0 ⊗ R y π Φ + = 1 2 R y 0 0 ⊗ R y π 0 + R y 0 1 ⊗ R y π 1 = 1 2 01 − 10 = Ψ − .

Since the global phase has no observable effect, we can easily infer that R y π ⊗ R y 0 Φ + = R y 0 ⊗ R y π Φ + = Ψ − .

In the same way, we can prove that R y π ⊗ R y 0 Φ − = R y 0 ⊗ R y π Φ − = Ψ + , R y π ⊗ R y 0 Ψ + = R y 0 ⊗ R y π Ψ + = Φ − , R y π ⊗ R y 0 Ψ − = R y 0 ⊗ R y π Ψ − = Φ + .

Thus, R y π ⊗ R y 0 Φ + = R y 0 ⊗ R y π Φ + = Ψ − R y π ⊗ R y 0 Φ − = R y 0 ⊗ R y π Φ − = Ψ + R y π ⊗ R y 0 Ψ + = R y 0 ⊗ R y π Ψ + = Φ − R y π ⊗ R y 0 Ψ − = R y 0 ⊗ R y π Ψ − = Φ + .

Lemma 3 holds.

In the description of the socialist millionaire problem, there are two users, Alice and Bob, each having their own secrets X and Y, respectively. They sought to compare whether X = Y while keeping X and Y undisclosed to each other, and they learn nothing if X ≠ Y .

The binary representations of X and Y are X = x n − 1 x n − 2 ⋯ x 1 x 0 and Y = y n − 1 y n − 2 ⋯ y 1 y 0 , respectively, where x j , y j ∈ 0 , 1 , j ∈ 0 , 1 , 2 , ⋯ , n − 1 , and 2 n − 1 ≤ X , Y < 2 n . Since the proposed protocol is designed for the two-party computation setting, a semi-honest third party named Charlie is involved in performing the comparison. Before the protocol begins, Alice and Bob share a secret key K A B = k n − 1 k n − 2 ⋯ k 1 k 0 k j ∈ 0 , 1 , j ∈ 0 , 1 , 2 , ⋯ , n − 1 via a QKD protocol. The details of the proposed rotation operation-based quantum solution for the socialist millionaire problem are depicted as follows:

Step 1: Charlie prepares a 2n-length quantum sequence S = ⊗ j = 0 n − 1 G , where G is randomly chosen from four kinds of Bell states. He records their states and takes the first and second particles of all Bell states to generate two ordered n-length quantum sequences S 1 and S 2 , respectively.

Step 2: Charlie generates 2m decoy photons randomly chosen from 0 , 1 , + , − . Next, he inserts the same number of decoy photons into S 1 and S 2 at random positions to generate two new (m + n)-length quantum sequences S 1 ′ and S 2 ′ , respectively. Then, he records the positions and states of each decoy photon. Finally, he sends S 2 ′ S 2 ′ to Alice (Bob).

Step 3: When receiving S 2 ′ S 2 ′ , Alice (Bob) sends a message to Charlie, who will then announce the positions and measurement basis to Alice (Bob). If the decoy photon is in 0 , 1 , the measurement basis is Z-basis; otherwise, the measurement basis is X-basis. If an eavesdropper exists, the measurement outcome will not be consistent with the initially prepared decoy photons, and Charlie and Alice (Bob) will abort the protocol. Otherwise, Alice (Bob) discards the decoy photons to get S 1 and S 2 and performs the following steps:

Step 4: Alice performs rotation operations R y π X and R y π K A B on S 1 to get S A . For Bob, he performs rotation operations R y π Y and R y π K A B on S 2 to get S B .

Step 5: Alice (Bob) follows the same procedures, which involve inserting decoy photons to generate S A ′ S B ′ , sending them to Charlie, and checking the presence of an eavesdropper, similar to what Charlie and they did. If they detect the presence of an eavesdropper, they abort the protocol. Otherwise, Charlie discards the decoy photons to get S A S B and proceeds with the following steps:

Step 6: Charlie performs Bell-basis measurements on S A and S B to obtain the measurement results. If all measurement results match the initially prepared Bell states, then X = Y. Otherwise, X ≠ Y . Charlie announces the final comparison result to Alice and Bob.

Considering a case, the secrets of Alice and Bob are denoted as X = 6 and Y = 6, which can be represented in binary form as X = 110 and Y = 110 . Since the lengths of X and Y are 3, the number of Bell states is 3. We assume that the initially prepared Bell states are denoted as Ψ − , Ψ + , Φ + , and the quantum circuit and measurement outcome without considering the eavesdropping detection can be seen in Figures 1, 2. Since the quantum circuit is designed and executed on IBM Quantum Composer, which is accessible for circuits utilizing fewer than 7 qubits, and the chosen measurement basis is the Z basis, the measurement outcomes are represented in the form of 0 and 1. Suppose that the secret key shared between Alice and Bob via a QKD protocol is K A B = 001 . When Alice performs the rotation operations R y π , R y π , R y 0 and R y 0 , R y 0 , R y π on the first particles of Ψ − , Ψ + , Φ + and Bob performs the rotation operations R y π , R y π , R y 0  and  R y 0 , R y 0 , R y π on the second particles of Ψ − , Ψ + , Φ + , the corresponding quantum circuit and the final measurement outcome can be seen in Figures 3, 4, respectively. It must be noted that no Bell-basis measurement exists on the IBM Quantum Composer, and we use single-particle measurement instead of Bell-basis measurement to get the same effect. From Figure 4, we can easily observe that the measurement outcome when performing the quantum circuit in Figure 3 is the same as the measurement outcome of the initially prepared Bell states in Figure 1. This indicates that all the measurement results match the initially prepared Bell states, suggesting that the comparison result is X = Y. In a precise sense, we can conclude that X = Y due to the identical rotation operations performed by Alice and Bob. The simulation experiment further verifies the correctness and feasibility of the protocol.

Considering another case, the secrets of Alice and Bob are denoted as X ′ = 5 and Y ′ = 4 , which can be represented in binary form as X ′ = 101 and Y ′ = 100 . Since the lengths of X and Y are 3, the number of Bell states is 3. Suppose that the secret key shared between Alice and Bob via a QKD protocol is K A B = 110 . We also assume that the initially prepared Bell states are denoted as Ψ − , Ψ + , Φ + , which are the same as those in the first case. When Alice performs the rotation operations R y π , R y 0 , R y π and R y π , R y π , R y 0 on the first particles of Ψ − , Ψ + , Φ + and Bob performs the rotation operations R y π , R y 0 , R y 0 and R y π , R y π , R y 0 on the second particles of Ψ − , Ψ + , Φ + , the corresponding quantum circuit and the final measurement outcome can be seen in Figures 5, 6, respectively. From Figure 6, however, we can observe that the measurement outcome when performing the quantum circuit shown in Figure 5 is different from the measurement outcome of the initially prepared Bell states in Figure 1. This discrepancy indicates that the measurement results do not match the initially prepared Bell states, suggesting that the comparison result is X ≠ Y . Since the rotation operations performed by Alice and Bob are different, we can draw the direct conclusion that X ≠ Y . From another perspective, we can directly see that X ≠ Y .

In conclusion, these two simulations reveal the correctness and feasibility of our protocol.

To sum up, in this paper, we propose a rotation operation-based QPC protocol to solve the socialist millionaire problem. The protocol utilizes Bell states as quantum resources and rotation operations for classical calculations. The private inputs of the participants are encoded into the rotation operations, and no classical result is produced. This effectively reduces the risk of classical attacks and enhances the security of the QPC protocol. Compared with the current QPC protocols, complex quantum technologies such as high-dimensional quantum states, entangled swapping technology, and joint measurements are not required. Our protocol only utilizes easy-to-implement technologies such as Bell states, rotation operations, and Bell-basis measurements. All of these improvements could not only make our protocol more practical but also enhance its security. In other words, our protocol demonstrates superior performance in terms of practicability and security. In the future, we will focus on designing a semi-quantum private comparison to reduce the demand for quantum resources and develop a more efficient QPC protocol.