Communication is the exchange and transmission of information between people in a certain way. With the development of communication technology, people pay more attention to the privacy and security of data. In the present communication networks, RSA public key scheme is widely used for secure communication since it depends on the mathematical problem of large integer decomposition. However, the famous quantum factorization algorithm proposed by Shor [1] shows that this scheme is no longer safe. To ensure the security of communication, the research of quantum cryptography attracts people’s attention. In contrast to the security of classical cryptography that are based on the assumption of computational complexity, the security of quantum cryptography relies on quantum-mechanics principles, which makes it unconditionally secure in theory. Since the first quantum key distribution protocol (BB84 protocol) was proposed [2], people try to solve some secure communication tasks with quantum cryptography, including quantum key distribution(QKD) [2–4], and quantum secure direct communication (QSDC) [5–7].

In addition to key distribution, key agreement (KA) is another major method of key establishment and plays a key role in the field of cryptography. In a key agreement protocol, two or more users in communication networks can agree on temporary session keys to achieve secure communication. As a significant cryptographic primitive, key agreement is flexibly used in multiparty secure computing, access control, electronic auctions, and so on. However, as the concept of quantum computer was put forward, classical key agreement was found to be as vulnerable to quantum computation as classical key distribution. Therefore, quantum key agreement (QKA) has been naturally proposed and has recently become a new research hotspot.

In 2004, [8] proposed the first two-party QKA protocol, which was designed based on the correlation of measurement results of EPR pairs. Unfortunately, this protocol is insecure, as shown in Ref. [9]. That same year, [10] proposed a fair and secure two-party QKA protocol based on BB84. Afterwards, researchers expands the number of negotiators from two to multiple parties to fit the actual scenarios. [11] proposed the first multi-party QKA (MQKA) protocol with Bell states and entanglement exchange in 2013. But in the same year, [12] pointed out that the protocol was unfair, then proposed a new MQKA protocol with single photons. Later [13] introduced two unitary operations and proposed the circle-type MQKA to improve the execution efficiency. Since then, many scholars have used various properties of quantum mechanics to design a few subtle MQKA protocols [14,15].

Actually, these protocols are only theoretically secure. Once they are used in practice, they will inevitably encounter the same problem as classical key agreement, namely, the impersonation attack. That is, an attacker may impersonate a legal user to participant in the protocol. Moreover, in classical key agreement protocols [16–19], the authentication of users is usually considered to protect against this particular attack. However, this is often overlooked in QKA. Although in some MQKA protocols, authentication of classical channels has been required to prevent classical messages from being tampered, message authentication is different from identity authentication. Therefore, in designing a secure QKA protocol, the authentication of users should be considered as in other authenticated quantum cryptographic protocols [20–24].

In this paper, an authenticated MQKA protocol for optical-ring quantum networks is proposed. The result shows that when all users perform the protocol honestly, they can get the correct negotiation key simultaneously. According to our analysis, the protocol in the network is secure against both common attacks and impersonation attacks.

Now, let us describe the proposed quantum key agreement protocol for optical-ring quantum communication networks, which can realize the key negotiation between arbitrary N users in the networks. In this network, a third party P ₀ is semi-trusted, who can perform the operation U _mn . Suppose there are M users in the network and any N of them perform the quantum key agreement. That is, the switches for N users are turned on at the proper time, while the switches for the remaining M − N users are constantly off.

Without loss of generality, assume that the first N users participant in the negotiation, denoted as P ₁, P ₂, …, P _N . They can not only perform the operations U _mn and V _xy , but also have the ability to prepare and measure single particles. They want to negotiate a session key K with the help of P ₀, where K = S ₁ ⊕ S ₂ ⊕⋯ ⊕ S _N , and S _i is P _i ’s private input with length of 2n. Furthermore, each user has an identity information ID _i of length l. In order to ensure the legitimacy of these users’ identity, it is necessary for P _i (i = 1, 2, …, N) to complete the identity authentication with P ₀, who shares master key k ̄ i with P _i . It should be noted that the switches for P _N , …, P _M are always closed, i.e., photons can be transmitted directly from P _N to P ₀. The general process of this protocol is shown in Figure 2.

In this quantum communication network, multi parties are connected by a quantum channel and a classical public channel. The quantum channel consists usually of an optical fiber. The classical channel, however, can be any communication link. Users and the third party can send classical messages via the classical channel, and these messages cannot be tampered with by anyone. That is, this transmitted classical message is required to be authenticated. Typically, the public classical channel can be achieved by broadcasting. However, it is worth noting that message authentication is different from identity authentication. So, we still need to verify the identity of each user. In the following, a description of the procedure for the protocol is given.

Step 1: P ₀ and P _i (i = 1, 2, …, N) generate a random sequence r ₀ and r _i respectively and declare them through the classical channel. Then P ₀ selects a hash function f: 2^∗ → 2 ⁿ and declares it. P ₀ and each user calculate their authenticated message h i = f k ̄ i ( I D i ∥ r i ∥ r 0 ) , where ∥ denotes string concatenation.

Step 2: Each user P _i (i = 1, 2, …, N) generates a random bit sequence L _i = (l _i,1, l _i,2, …, l _i,2n ) and B _i = (b _i,1, b _i,2, …, b _i,2n ) with length of 2n. In the process with P _i as an initiator, an ordered sequence T _i of n two-qubit states is prepared by P _i according to L _i : T i = | φ ̃ l i , 1 , l i , 2 〉 , | φ ̃ l i , 3 , l i , 4 〉 , … , | φ ̃ l i , 2 n − 1 , l i , 2 n 〉 , (5) where, the tth quantum state is | φ ̃ l i , 2 t − 1 , l i , 2 t 〉 ∈ { | φ ̃ 00 〉 , | φ ̃ 01 〉 , | φ ̃ 10 〉 , | φ ̃ 11 〉 } .

Step 3: P _i performs the identity encoding operation on the tth quantum state of the sequence T _i according to the values of h _i,t and b _i,2t−1. Concretely, when h _i,t ⊕ b _i,2t−1 = 0, P _i performs U ₀₀; otherwise, he performs U ₀₁ U ₁₀. Then the encoded sequence is denoted as T ̃ i , i ⊞ 1 , which is sent to the next user P _i⊞1 over the quantum channel, where ⊞ (⊟) represents addition (subtraction) module N + 1.

Step 4: At this point, P _i⊞1 opens his switch to receive the photons emitted by P _i . When P _i⊞1 receives the sequence T ̃ i , i ⊞ 1 , he will perform corresponding operation to encode his own private input s _i⊞1,2t−1, s _i⊞1,2t . Namely, P _i⊞1 performs the unitary operation U s i ⊞ 1,2 t − 1 , s i ⊞ 1,2 t on the tth quantum state. After that, P _i⊞1 performs his identity encoding similar to Step 3, and sends the encoded particle string T ̃ i , i ⊞ 2 to the user P _i⊞2.

Step (g + 3) (g = 2, 3, …, N): Similar to Steps 4 and 3, P _i⊞g encodes his private input and identity information. After that, he sends the encoded sequence T ̃ i , i ⊞ ( g + 1 ) to P _i⊞(g+1). Notice that P ₀ knows the hash values of all users. When the sequence of particles is transmitted to P ₀, he calculate h 0 , t = ⊕ i = 1 N h i , t . Based on the result, P ₀ performs his identity encoding on the sequence. That is, if h _0,t is 0, he performs U ₀₀; Otherwise, he performs U ₀₁ U ₁₀.

Step (N + 4): When all users P _i (i = 1, 2, …, N) receive the sequence T ̃ i , i from P _i⊟1, they publish the random bit string B _i in random order. Then, P _i calculates B 2 t − 1 = ⊕ i = 1 N b i , 2 t − 1 ( t = 1,2 , … , n ) and performs different operations as shown in follows.

1) When B ^2t−1 is 0, P _i measures the single photon with basis MB _X directly to get the measurement result | φ ̃ w i , 2 t − 1 , w i , 2 t 〉 , then he can extract the session key:

Obviously, each user P _i can obtain the agreement keys K _i = (k _i,1, k _i,2, k _i,3, k _i,4, …, k _i,2N−1, k _i,2N ).

Step (N + 5): The eavesdropping detection process is executed. Namely, all users choose δn samples to detect whether malicious or forged users exist. Specifically, each user P _i randomly selects ⌊ δ n N ⌋ samples from K _i , and declares these samples’ positions. Then, he requires the other users P _j (j ≠ i) to announce the corresponding part of K _j . Since only legitimate users know the correct hash values and make the hash values satisfy h 0 ⊕ ( ⊕ i = 1 N h i , t ) = 0 , the users can get a consistent negotiation key by step (N + 4). Afterwards, P _i calculates the error rate according to his k _i,m and the other users’ k _j,m . That is, the number of inconsistencies in the sample as a proportion of the total sample size. If the error rate exceeds a certain threshold, the protocol is abandoned. Otherwise, the other users P _j (j ≠ i) perform similar actions. It should be noted that there are no common elements in the samples selected by all users. Finally, the remaining particles form their session key.

To illustrate the negotiation process more clearly, we give an example with (N = 3, M = 5). Similarly, we assume that P ₁, P ₂ and P ₃ are involved in key negotiation and the switches for P ₄ and P ₅ are always off. In this case, P ₁, P ₂ and P ₃ respectively hold secret inputs with length of 8 (i.e. n = 4), S ₁ = 01,101,011, S ₂ = 01,000,100, and S ₃ = 10,110,001 and identity information with length of 6, ID ₁ = 010,110, ID ₂ = 001,101, ID ₃ = 100,011. By the following steps, they can agree on a session key, K = S ₁ ⊕ S ₂ ⊕ S ₃.

In Step 1, each user P _i (i = 1, 2, 3) gets the random string r _i . In addition, P ₀ generates r ₀. Then, they can obtain the hash values h _i according to the selected hash function. In the next step, P ₁(P ₂, P ₃) generates two random 8-bit strings L ₁ and B ₁ (L ₂ and B ₂, L ₃ and B ₃). From L ₁(L ₂, L ₃), P ₁(P ₂, P ₃) prepares the single photons to obtain the two-particle sequence T ₁(T ₂, T ₃). The concrete values of these classical bit sequences are listed in Table 1.

After that, they proceed to the encoding phase of the protocol. The process with P ₁ as the initiator is described in detail, where the sequence T ₁ is back to P ₁ after being encoded by all users. Concretely, in Step 3, P ₁ performs the unitary operations U ₀₀ ⊗ U ₀₀ ⊗ U ₀₁ U ₁₀ ⊗ U ₀₁ U ₁₀ to encode his identity information. Afterwards, P ₁ transmits the encoded sequence T ̃ 1,2 to P ₂. When P ₂ receives the sequence from P ₁, he encodes his private input and identity information by performing unitary operations in Step 4, and sends to P ₃. Similarly, P ₃ also performs encoding operations. It is worth noting that the sequence T ̃ 1,0 sent from P ₃ to P ₀ passes through P ₄ and P ₅. When P ₀ receives the sequence, he calculates h ₀ = 1,000, which means his operations are U ₀₁ U ₁₀ ⊗ U ₀₀ ⊗ U ₀₀ ⊗ U ₀₀. After that, P ₀ sends the encoded sequence to P ₁. Obviously, the transmission process of particle sequences, which are prepared by P ₂ and P ₃, is similar to the above process. The variations of quantum states in three sequences are shown in Table 2. In Step 7, when all users receive the travelling particles T ̃ 1,1 , T ̃ 2,2 , T ̃ 3,3 , they make the random strings B _i public in random order. P ₁ (P ₂, P ₃) calculates B ^2t−1 = 0,010. Therefore, P ₁ (P ₂, P ₃) performs I ⊗ I ⊗ V ₁₁ ⊗ I (I ⊗ I ⊗ V ₀₁ ⊗ I, I ⊗ I ⊗ V ₁₁ ⊗ I). After that, they measure with appropriate measurement basis. By corresponding calculation, they get K ₁, K ₂, K ₃ respectively. Apparently, if there is no eavesdropping, K ₁ = K ₂ = K ₃ = 10,011,110.

For a quantum key agreement protocol, it is generally required to satisfy correctness and security, regardless of the structure of the communication network. That is, all users can get the correct session key by executing the protocol. Security, on the other hand, implies that no attacker can obtain any information about the session key without being detected. Analysis shows that it can resist not only common external and internal attacks, but also impersonation attack.

Before presenting our conclusion, we briefly discuss the hash function used in the protocol. In the protocol, we use the hash value to complete the authentication of the user. Only the legitimate user knows the correct hash value. In the absence of an impersonation attack, the hash values satisfy h 0 = ⊕ i = 1 N h i . So the selection criteria of the measurement basis is correct. Moreover, the hash values are not public. No one can obtain valid information from known information. Therefore, the introduction of classical hash function does not reduce the security of the protocol. Even if the classical hash function is corrupted by quantum computation, each user’s master key is still secure. Since the master key is only shared by the third party and users through QKD, it can achieve absolute security. In addition, the security analysis shows that no matter what kind of attacks are used, the master key cannot be obtained by attackers. In this way, the shared master key can be reused and the user’s identity can be authenticated, which greatly improves the practicability of the protocol.

In this paper, we study an authenticated quantum key agreement protocol, which is another main key establishment method in addition to quantum key distribution. This scheme enables key negotiation for any N users in optical-ring quantum networks. Each user in the protocol has his own identity information and shares a master key with a semi-trusted third party. With the help of the third party, they can simultaneously obtain the negotiated key. Security analysis shows that the protocol is secure against common attacks and impersonation attack. Furthermore, the implementation of the protocol only requires preparing and measuring single particles, which can be easily implemented with current technology. And, our method can be easily applied to other MQKA protocols with authentication in quantum networks, so that they can resist impersonation attack in practical. Since the implementation of the protocol is inevitably affected by noise, the threshold value for the error rate should be provided before implementing it. As mentioned in [34], the exact value of the threshold is determined by a variety of practical elements, such as the desired level of security, the noise level of channels, etc. Therefore, choosing an appropriate threshold is complex, which is also the case for many multi-party quantum cryptographic protocols. Combined with quantum state discrimination, we will study this issue in the future.