High-Efficiency Lightweight Quantum Key Agreement Scheme Based on Bell State Entanglement

Abstract

To address the low qubit efficiency and high user-side operational complexity in existing quantum key agreement schemes, this paper proposes a high-efficiency and lightweight quantum key agreement scheme based on Bell states. The scheme is constructed upon a time-reversed EPR architecture, in which a quantum server performs entangled-state preparation and Bell state measurement. Furthermore, a bidirectional decoy photon mechanism is incorporated into the architecture to achieve eavesdropping detection. By exploiting the completeness and orthogonality of the Bell basis, the scheme introduces an encoding mechanism based on local Pauli operations, enabling a single Bell state to carry 2 bits of key information and thereby realizing dense coding, which improves qubit efficiency. Meanwhile, users are only required to perform single-qubit operations, which reduces the quantum operational requirements on the user side. Based on the properties of Bell states, this paper derives the mapping relationship between local Pauli operations and Bell state measurement outcomes. Experimental results on the SpinQ Gemini quantum computing platform are consistent with the theoretical analysis, verifying the feasibility of the proposed scheme. In addition, security analysis shows that, owing to the bidirectional decoy photon mechanism, the scheme can resist various quantum attacks. The proposed scheme combines high efficiency with a lightweight implementation, reducing quantum hardware requirements on the user side and network deployment costs, thereby providing a cost-effective solution for practical quantum key agreement.

1. Introduction

In modern cryptographic systems, the key is the core element of secure communication, and its confidentiality directly determines the security of the entire system. According to Kerckhoffs’ principle [1,2], the security of a cryptosystem should rely on the secrecy of the key rather than the algorithm itself. However, with the development of quantum computing, classical cryptographic schemes based on mathematical hardness assumptions are facing fundamental challenges. Grover’s algorithm [3] poses an accelerated threat to symmetric cryptography, while Shor’s algorithm [4] can solve integer factorization and discrete logarithm problems in polynomial time, thereby undermining the security foundation of mainstream public-key cryptosystems. Recent studies further indicate that approximately ${10}^4$ reconfigurable atomic qubits are sufficient to support the execution of Shor’s algorithm at a cryptographically relevant scale [5], thereby accelerating the transition of this theoretical threat toward practical relevance. These advances suggest that traditional cryptosystems relying on assumptions about computational complexity are unlikely to provide long-term security in a quantum computing environment. In contrast, quantum cryptography, grounded in the fundamental principles of quantum mechanics, offers a new approach to addressing this security challenge [6]. On the one hand, the quantum no-cloning theorem [7] ensures information-theoretic security in key distribution, as any eavesdropping attempt inevitably introduces detectable disturbances. On the other hand, the nonlocal properties of quantum entanglement [8,9] enable a new paradigm for secure communication, allowing communicating parties to establish strongly correlated keys without pre-shared secrets.

Since Bennett and Brassard proposed the first quantum key distribution (QKD) protocol, BB84 [10], in 1984, quantum cryptography has developed rapidly and given rise to various secure communication models, including quantum secret sharing (QSS) [11], quantum secure direct communication (QSDC) [12] and quantum key agreement (QKA) [13]. Subsequently, driven by theories of quantum entanglement and non-local correlations, a framework for entanglement-based QKA schemes gradually emerged. QKA represents a significant extension of QKD, emphasizing that both communication parties jointly generate a shared key on the basis of equal participation [13], thereby making the key generation process more interactive. Despite these theoretical advantages, existing QKA schemes still face dual limitations in practical applications, namely efficiency and user-side implementation complexity.

Existing QKA schemes still have room for improvement in terms of efficiency, which is mainly reflected in two aspects. First, with respect to qubit efficiency, in most schemes [14,15,16] each quantum carrier can typically convey only one bit of effective key information, resulting in limited qubit efficiency. Second, in terms of quantum resource utilization, many schemes [14,17,18] require sacrificing a certain proportion of entangled resources or increasing transmission rounds to perform eavesdropping detection, resulting in a relatively low proportion of quantum resources being used for actual key generation.

The implementation complexity at the user side is also a key factor restricting the practical deployment of QKA schemes. Most existing schemes [15,16,18] assume that users possess relatively complete quantum operation capabilities, such as entangled-state preparation, Bell state measurement (BSM), and multi-qubit gate operations. These operations impose high requirements on device stability, coherence time, and control precision, significantly increasing system cost and engineering complexity. It is also worth noting that, with recent experimental advances, including high-fidelity collinear transmission over 30 km commercial optical fiber achieved by Northwestern University in 2024 [19], as well as the classical-decision-based quantum internet architecture proposed and implemented by Chinese research teams [20], future quantum networks are showing a structural trend of centralized quantum nodes and lightweight user terminals, where complex quantum operations are concentrated at high-stability core nodes, while end users only need to perform limited and relatively simple single-qubit operations.

Based on the above background, this paper proposes a high-efficiency and lightweight QKA scheme based on Bell state entanglement. The main contributions of this paper are as follows:

1.

By fully exploiting the completeness and orthogonality of Bell states, an encoding mechanism based on local Pauli operations is designed, enabling a single Bell state to carry 2 bits of effective key information and realizing dense coding, thereby significantly improving qubit efficiency and quantum resource utilization.

2.

Inspired by the basic idea of semi-quantum cryptography [21], a quantum server (QS) is introduced to decouple complex quantum operations from the user side. Legitimate users, Alice and Bob, are only required to perform basic single-qubit operations such as Pauli operations, which significantly reduces the quantum capability requirements on the user side and enhances the practical deployment potential of the scheme.

3.

Based on the completeness and orthogonality of Bell states, the evolution of Bell states as well as the mapping relationship between local Pauli operations and BSM outcomes are derived. Meanwhile, a bidirectional decoy photon mechanism is introduced for eavesdropping detection, and a complete information-isolation mechanism is designed. Security analysis shows that the proposed scheme can resist a series of typical quantum attacks, including intercept-resend attacks and entanglement attacks. In addition, experimental results on the SpinQ Gemini quantum computing platform are consistent with the theoretical analysis, verifying the feasibility of the proposed scheme.

The remainder of this paper is organized as follows. Section 2 reviews the development of quantum cryptography and QKA; Section 3 presents the implementation of the proposed QKA scheme; Section 4 analyzes its correctness, security, and efficiency, and provides comparisons with representative QKA schemes; Section 5 reports experimental results; and Section 6 concludes the paper and discusses future research directions.

2. Related Work

2.1. From Classical Key Agreement to Quantum Cryptography

In classical cryptography, the Diffie–Hellman (DH) protocol [22] and the Rivest–Shamir–Adleman (RSA) algorithm [23] provide the foundation for public-key key agreement and transmission, enabling two parties to establish secure communication without pre-shared secrets. However, with the development of quantum computing theory, results such as Shor’s algorithm [4] and Grover’s algorithm [3] have demonstrated that classical cryptographic schemes based on computational hardness assumptions are no longer secure under the quantum computing model. In contrast, quantum cryptography does not rely on computational complexity assumptions; instead, it derives security directly from the fundamental laws of quantum mechanics, thereby providing information-theoretic security and offering a new paradigm for constructing long-term secure key systems.

QKD is one of the earliest and most extensively studied branches of quantum cryptography. Since the introduction of the BB84 protocol [10] based on single photons in 1984, several improved schemes have been proposed, including decoy-state BB84 [24] and the six-state protocol [25,26], aiming to enhance security and practicality under realistic channel conditions. Subsequently, in 1991, Ekert proposed the E91 protocol [17] based on quantum entanglement, which to some extent overcomes the asymmetry inherent in prepare-and-measure (P&M) frameworks, reduces the reliance on a single trusted sender, and provides a basis for extensions to networked scenarios. Later, Biham proposed the time-reversed EPR scheme [27], in which a central node performs Bell state projection or joint measurements on quantum states transmitted from different users. By establishing quantum correlations among users within a measurement-driven framework, the scheme further provided a new topological approach for the construction of quantum cryptographic networks.

2.2. Development and Challenges of Quantum Key Agreement

Although QKD enables information-theoretically secure key distribution, the generated key is typically dominated by a single party, and the two communicating parties do not have symmetric control over the key. In application scenarios such as multiparty collaborative computation and decentralized networks, this asymmetry may lead to issues related to fairness and controllability. To address this limitation, QKA [13], as a cryptographic primitive distinct from QKD, has attracted increasing attention since its introduction. QKA requires that all legitimate participants contribute to the final shared key, and that no single party can independently determine or predict the key outcome [13].

Existing QKA schemes can be broadly classified into three categories according to the type of quantum resources employed. Schemes based on single-particle states [28,29] are relatively simple in structure; however, they typically require multiple rounds of quantum communication, and the amount of effective key information carried by each quantum state is limited, thereby restricting overall efficiency. Schemes based on multipartite entangled states (e.g., GHZ states) [15] exhibit favorable symmetry and consistency in theory, but impose stringent requirements on the preparation, distribution, and preservation of multipartite entanglement, leading to increased implementation complexity and experimental difficulty. In contrast, Bell-state-based QKA schemes [14,16,18] achieve a relative balance among communication rounds, efficiency, and implementation complexity, and have therefore become one of the main directions in current research.

Nevertheless, existing Bell-state-based QKA schemes still face several limitations in practical applications. First, due to limited encoding efficiency, a single Bell state can typically carry only 1 bit of effective key information. In addition, part of the entangled resources must be allocated to the eavesdropping detection process, thereby reducing both qubit efficiency and quantum resource utilization. Second, most schemes require end users to perform BSM or other multi-qubit operations, imposing relatively high demands on the capabilities of user-side quantum devices.

3. Proposed QKA Scheme

3.1. Preliminaries

This subsection briefly reviews the fundamental concepts of quantum mechanics relevant to the proposed scheme, providing the necessary mathematical descriptions for the subsequent design and analysis.

The two-qubit Bell states (EPR pairs) are defined as follows:

$$\begin{array}{cc}\hfill |{\Phi }^{+}{\rangle }_{AB}={\displaystyle \frac{1}{\sqrt{2}}}\left(\right|00\rangle +{|11\rangle )}_{AB},& |{\Phi }^{-}{\rangle }_{AB}={\displaystyle \frac{1}{\sqrt{2}}}\left(\right|00\rangle -{|11\rangle )}_{AB},\hfill \\ \hfill |{\Psi }^{+}{\rangle }_{AB}={\displaystyle \frac{1}{\sqrt{2}}}\left(\right|01\rangle +{|10\rangle )}_{AB},& |{\Psi }^{-}{\rangle }_{AB}={\displaystyle \frac{1}{\sqrt{2}}}\left(\right|01\rangle -{|10\rangle )}_{AB}.\hfill \end{array}$$

(1)

The four unitary Pauli operations used for encoding are described as follows:

$$\begin{array}{cc}\hfill U_{00}& =\left(\begin{array}{cc}1& 0\\ 0& 1\end{array}\right),U_{01}=\left(\begin{array}{cc}0& 1\\ 1& 0\end{array}\right),U_{10}=\left(\begin{array}{cc}1& 0\\ 0& -1\end{array}\right),U_{11}=\left(\begin{array}{cc}0& -1\\ 1& 0\end{array}\right).\hfill \end{array}$$

(2)

When local unitary operations $U_i$ are performed on each of the two particles of the initial state $|{\Phi }^{+}{\rangle }_{AB}$, the resulting BSM outcomes are summarized in

Table 1. BSM results after applying $U_i$ to each particle of $|{\Phi }^{+}{\rangle }_{AB}$.

Alice	Bob
	${\mathbf{U}}_{\mathbf{00}}$	${\mathbf{U}}_{\mathbf{01}}$	${\mathbf{U}}_{\mathbf{10}}$	${\mathbf{U}}_{\mathbf{11}}$
$U_{00}$	$|{\Phi }^{+}\rangle$	$|{\Psi }^{+}\rangle$	$|{\Phi }^{-}\rangle$	$|{\Psi }^{-}\rangle$
$U_{01}$	$|{\Psi }^{+}\rangle$	$|{\Phi }^{+}\rangle$	$|{\Psi }^{-}\rangle$	$|{\Phi }^{-}\rangle$
$U_{10}$	$|{\Phi }^{-}\rangle$	$|{\Psi }^{-}\rangle$	$|{\Phi }^{+}\rangle$	$|{\Psi }^{+}\rangle$
$U_{11}$	$|{\Psi }^{-}\rangle$	$|{\Phi }^{-}\rangle$	$|{\Psi }^{+}\rangle$	$|{\Phi }^{+}\rangle$

.

3.2. Participants and Adversary Model

To facilitate an accurate description of the execution procedure and a rigorous security analysis, this subsection first specifies the roles of the entities involved in the proposed scheme, and then establishes the corresponding adversary model [30,31] and security assumptions.

The communication framework of the proposed scheme consists of the following three types of entities:

• QS: Responsible for preparing and distributing maximally entangled Bell state pairs; generating and inserting decoy photons (with preparation bases randomly chosen from the Z- and X-bases); performing eavesdropping detection; conducting BSM on the returned quantum states; and publicly announcing the BSM outcomes.
• Legitimate users Alice and Bob: Act as symmetric participants in the communication process; perform eavesdropping detection; apply local Pauli operations to the received quantum states; prepare and insert decoy photons (with preparation bases randomly chosen from the Z- and X-bases); return the updated quantum sequence to the QS; and complete the key agreement process by combining their local operations with the measurement results announced by the QS.
• Eavesdropper Eve: Does not participate in the schemes execution but is assumed to possess full quantum capabilities. Eve may perform passive eavesdropping or active attacks on both the quantum and classical channels, attempting to recover the shared key by acquiring or inferring intermediate information.

The proposed scheme adopts a semi-trusted QS adversary model. Specifically, the QS is assumed to be honest-but-curious, meaning that it follows the prescribed scheme steps without deviation, does not interrupt the key agreement process, and does not collude with the external eavesdropper Eve. However, it may attempt to infer partial information about the shared key from the data available to it. Eve is regarded as an active attacker, and the corresponding attack strategies or attack models considered in this paper will be further specified in the relevant subsections. To resist the above potential threats, a bidirectional decoy photon mechanism is introduced for eavesdropping detection, and the security of the quantum channel is evaluated by calculating the quantum bit error rate ($Q_{\mathrm{BER}}$).

In addition, it is assumed that all classical information exchanged during the scheme (including quantum state receipt acknowledgments, the positions and preparation bases of decoy photons, and the announcement of BSM outcomes) is transmitted over an authenticated public channel. This effectively prevents man-in-the-middle attacks, message forgery, and tampering.

3.3. High-Efficiency Lightweight Quantum Key Agreement Scheme Based on Bell State Entanglement

Under the aforementioned adversary model and security assumptions, the specific execution flow of the proposed QKA scheme is outlined as follows:

Step 1

QS distributes quantum pairs: The QS prepares n pairs of maximally entangled Bell states $|{\Phi }^{+}{\rangle }_{AB}^{\otimes n}$. The first qubits of each Bell state form an ordered sequence $S_A$, while the second qubits form sequence $S_B$. Subsequently, the QS randomly inserts decoy photons (with preparation bases randomly chosen from the Z- and X-bases) into both sequences, and transmits $S_A$ to Alice and $S_B$ to Bob through quantum channels.

Step 2

First eavesdropping detection: Upon receiving the sequences, Alice and Bob send arrival acknowledgments to the QS via a classical broadcast channel. The QS then publicly announces the positions and preparation bases of the decoy photons. Alice and Bob measure the corresponding qubits using the announced bases and compare the outcomes with the initial states. $Q_{\mathrm{BER}}$ is then evaluated. If $Q_{\mathrm{BER}}$ is below a predefined threshold determined by channel noise characteristics [32], the key agreement proceeds; otherwise, it is aborted immediately.

Step 3

User operations: Alice and Bob discard all decoy photons. Alice randomly selects n unitary operations $U_i$ ($i\in \{00,01,10,11\}$) to apply to the remaining particles in $S_A$, records her choices, and generates a new sequence $S_A^{\prime }$. Similarly, Bob independently and randomly selects n operations $U_j$ to process $S_B$, obtaining sequence $S_B^{\prime }$. Alice and Bob then independently insert new decoy photons (with preparation bases randomly chosen from the Z- and X-bases) into their respective sequences $S_A^{\prime }$ and $S_B^{\prime }$ at random positions and send them back to the QS.

Step 4

Second eavesdropping detection: Similar to the first eavesdropping detection process, QS performs a second eavesdropping detection based on the respective decoy photon positions and preparation bases published by the users. If the detection passes, the key agreement continues; otherwise, it terminates immediately.

Step 5

BSM: The QS discards the decoy photons and performs BSM on the particles at corresponding positions in $S_A^{\prime }$ and $S_B^{\prime }$, then records the measurement results as an ordered sequence R, and announces them via the broadcast channel, as shown in Table 1, $R={\left\{r_i\right\}}_{i=1}^n$ ($r_i\in \left\{\right|{\Phi }^{+}\rangle ,|{\Phi }^{-}\rangle ,|{\Psi }^{+}\rangle ,|{\Psi }^{-}\rangle \}$).

Step 6

Key extraction and recovery: According to the encoding rules outlined in

Table 2. Mapping between Pauli operations and key bits.

Pauli Matrix	${\mathit{U}}_{00}$	${\mathit{U}}_{01}$	${\mathit{U}}_{10}$	${\mathit{U}}_{11}$
$\{{\mathit{x}}_{\mathbf{2}\mathit{i}-\mathbf{1}},{\mathit{x}}_{\mathbf{2}\mathit{i}}\}$	00	01	10	11

, each Pauli operation corresponds to a 2-bit initial key. Alice and Bob derive their respective initial keys $K_A=\{a_1,a_2,\dots ,a_{2n}\}$ and $K_B=\{b_1,b_2,\dots ,b_{2n}\}$ based on the Pauli operations recorded in Step 3. Subsequently, based on the BSM results $r_i$ broadcast by the QS, Alice or Bob corrects the i-th group of bits in $K_A$ or $K_B$ as follows:

• If $r_i=|{\Phi }^{+}\rangle$, Alice and Bob perform no operation;
• If $r_i=|{\Phi }^{-}\rangle$, Bob performs no operation, and Alice flips the first bit of this group: $a_{2i-1}^{\prime }=\overline{a_{2i-1}}$;
• If $r_i=|{\Psi }^{+}\rangle$, Alice performs no operation, and Bob flips the second bit of this group: $b_{2i}^{\prime }=\overline{b_{2i}}$;
• If $r_i=|{\Psi }^{-}\rangle$, Alice flips the first bit of this group: $a_{2i-1}^{\prime }=\overline{a_{2i-1}}$; simultaneously, Bob flips the second bit of this group: $b_{2i}^{\prime }=\overline{b_{2i}}$.

After these corrections, $K_A^{\prime }=K_B^{\prime }$, meaning both parties successfully negotiate an identical $2n$-bit shared key K.

4. Analysis

4.1. Correctness Analysis

The main key agreement process of the proposed scheme is illustrated in Figure 1. After the first eavesdropping detection is successfully completed, Alice and Bob randomly select Pauli operations and apply them to the quantum sequences $S_A$ and $S_B$, respectively, thereby generating the updated sequences $S_A^{\prime }$ and $S_B^{\prime }$, while recording their corresponding operation choices. Subsequently, the QS performs BSM on $S_A^{\prime }$ and $S_B^{\prime }$ and publicly announces the measurement outcomes. All possible combinations of operations and their corresponding results are summarized in Table 1.

According to the encoding rule shown in Table 2, both parties then map each measurement outcome $r_i$ to their respective initial keys $K_A$ and $K_B$. Finally, both parties correct the corresponding bits in $K_A$ and $K_B$ according to $r_i$, such that $K_A^{\prime }=K_B^{\prime }$. In this way, Alice and Bob negotiate an identical shared key K.

Table 3. Key agreement process under the 16 combinations of Pauli operations.

Alice’s Pauli	${\mathit{U}}_{00}$	${\mathit{U}}_{01}$	${\mathit{U}}_{10}$	${\mathit{U}}_{11}$	${\mathit{U}}_{00}$	${\mathit{U}}_{01}$	${\mathit{U}}_{10}$	${\mathit{U}}_{11}$	${\mathit{U}}_{00}$	${\mathit{U}}_{01}$	${\mathit{U}}_{10}$	${\mathit{U}}_{11}$	${\mathit{U}}_{00}$	${\mathit{U}}_{01}$	${\mathit{U}}_{10}$	${\mathit{U}}_{11}$
${\mathit{K}}_{\mathit{A}}$	00	01	10	11	00	01	10	11	00	01	10	11	00	B	10	11
Bob’s Pauli	$U_{00}$	$U_{00}$	$U_{00}$	$U_{00}$	$U_{01}$	$U_{01}$	$U_{01}$	$U_{01}$	$U_{10}$	$U_{10}$	$U_{10}$	$U_{10}$	$U_{11}$	$U_{11}$	$U_{11}$	$U_{11}$
${\mathit{K}}_{\mathit{B}}$	00	00	00	00	01	01	01	01	10	10	10	10	11	11	11	11
BSM result	${\Phi }^{+}$	${\Psi }^{+}$	${\Phi }^{-}$	${\Psi }^{-}$	${\Psi }^{+}$	${\Phi }^{+}$	${\Psi }^{-}$	${\Phi }^{-}$	${\Phi }^{-}$	${\Psi }^{-}$	${\Phi }^{+}$	${\Psi }^{+}$	${\Psi }^{-}$	${\Phi }^{-}$	${\Psi }^{+}$	${\Phi }^{+}$
Alice corrects  ${\mathit{K}}_{\mathit{A}}$			$\overline{1}0$	$\overline{1}1$			$\overline{1}0$	$\overline{1}1$	$\overline{0}0$	$\overline{0}1$			$\overline{0}0$	$\overline{0}1$
${\mathit{K}}_{\mathit{A}}^{\prime }$	00	01	00	01	00	01	00	01	10	11	10	11	10	11	10	11
Bob corrects  ${\mathit{K}}_{\mathit{B}}$		$0\overline{0}$		$0\overline{0}$	$0\overline{1}$		$0\overline{1}$			$1\overline{0}$		$1\overline{0}$	$1\overline{1}$		$1\overline{1}$
${\mathit{K}}_{\mathit{B}}^{\prime }$	00	01	00	01	00	01	00	01	10	11	10	11	10	11	10	11

Note: For the sake of brevity, the Dirac notation (e.g., |Φ⁺〉) is omitted for the BSM results.

exhaustively enumerates the Bell state evolution results under all sixteen possible combinations of Pauli operations performed by Alice and Bob. It further presents the corresponding key mapping and correction procedures, thereby verifying the completeness of the encoding and correction processes in the proposed scheme.

4.2. Security Analysis

Under the adversary model and security assumptions described above, this section provides a rigorous security analysis of the proposed QKA scheme. The security of the scheme is grounded in the fundamental principles of quantum mechanics. By incorporating an information isolation mechanism and two rounds of eavesdropping detection, the scheme can effectively resist various potential attacks launched by both the honest-but-curious QS and an external eavesdropper Eve with full quantum capabilities. Under the established security assumptions, the analysis is carried out from multiple perspectives, including information leakage, external attacks, and potential threats related to the QS. This demonstrates that the proposed scheme remains secure within the defined adversary model.

4.2.1. Information Leakage Analysis

This subsection analyzes and evaluates the potential impact of publicly broadcast information over classical channels on the security of the shared key. It is assumed that the Pauli operations of Alice and Bob are chosen independently and with equal probability from the set $\mathcal{P}=\{U_{00},U_{01},U_{10},U_{11}\}$, and that all publicly broadcast information is transmitted through an authenticated channel. The security analysis is presented as follows:

In Step 5 of the proposed scheme, after performing the BSMs, the QS broadcasts the measurement results $R={\left\{r_i\right\}}_{i=1}^n$ ($r_i\in \left\{\right|{\Phi }^{+}\rangle ,|{\Phi }^{-}\rangle ,|{\Psi }^{+}\rangle ,|{\Psi }^{-}\rangle \}$) to Alice and Bob. Let R denote the random variable representing the measurement results. Because the initial state is $|{\Phi }^{+}\rangle$ and the Pauli operations applied by the users map this Bell state to the four Bell states with equal probability, the values of R are uniformly distributed, which can be expressed as

$$P(R=r_i)={\displaystyle \frac{1}{4}},r_i\in R.$$

(3)

Therefore, the prior entropy of the BSM results is given by

$$H\left(R\right)=-{\displaystyle \sum _{k=1}^4}{\displaystyle \frac{1}{4}}{log}_2{\displaystyle \frac{1}{4}}=2.$$

(4)

Suppose Eve or other malicious users acquire or eavesdrop on the BSM results through certain channels. Since these results are jointly determined by the combined operations of Alice and Bob, rather than being uniquely determined by a single party’s operation, the individual Pauli operations of Alice and Bob remain uniformly distributed under this condition:

$$P(A=j\mid R=r_i)={\displaystyle \frac{1}{4}},\forall j\in \mathcal{P}.$$

(5)

Consequently, the conditional entropies are

$$H(A\mid R)=2,H(B\mid R)=2.$$

(6)

The corresponding mutual information is calculated as follows:

$$\begin{array}{cc}\hfill I(A;R)& =H\left(A\right)-H(A\mid R)=0,\hfill \end{array}$$

(7)

$$\begin{array}{cc}\hfill I(B;R)& =H\left(B\right)-H(B\mid R)=0.\hfill \end{array}$$

(8)

Because the final key K is the result of the joint mapping of both parties’ operations, it similarly holds that

$$I(K;R)=0.$$

(9)

Therefore, the BSM results broadcast by the QS via the classical channel in Step 5 do not leak any information regarding the users’ local Pauli operations or the final key.

4.2.2. Quantum Attacks

Intercept-measure attack.

This type of attack represents a typical active eavesdropping strategy. In this analysis, Eve is assumed to adopt the standard intercept–measurement attack model, in which she independently and randomly chooses the Z basis or X basis to measure each intercepted particle, attempting to infer key information from the measurement outcomes. However, quantum measurement inevitably introduces disturbances to the quantum states, and such disturbances will be detected during the two rounds of eavesdropping detection, thereby causing the key agreement process to be aborted.

Specifically, since the positions and preparation bases of the decoy photons are randomly selected and kept secret during transmission, Eve cannot distinguish decoy photons from payload particles. Consequently, her measurement behavior increases the $Q_{\mathrm{BER}}$ and can be detected by the eavesdropping detection mechanism. Furthermore, since the shared key is jointly determined by the local encoding operations of Alice and Bob, measurements performed by Eve on individual particles cannot reveal meaningful key information. Even if Eve attempts to intercept both particles at the same position, the measurement and subsequent loss of particles will reduce the number of received qubits, which can be directly detected through particle number consistency checking.

Therefore, the intercept–measure attack not only fails to provide useful information to Eve, but also leads to detectable discrepancies in $Q_{\mathrm{BER}}$ and particle counts, enabling effective detection by the proposed scheme.

Intercept-resend attack.

The intercept–resend attack is an extension of the intercept–measure attack. In this scenario, Eve intercepts quantum states, performs measurements, and then prepares and resends new quantum states according to the measurement outcomes, attempting to conceal her eavesdropping behavior. To counter this attack, the proposed scheme employs a decoy photon mechanism, whose detection principle is similar to that used in the BB84 protocol [10]. Specifically, the sender randomly inserts decoy photons into the quantum sequence, with preparation bases randomly chosen from the Z- and X-bases. Each decoy photon is therefore randomly prepared in one of the four states $\left\{\right|0\rangle ,|1\rangle ,|+\rangle ,|-\rangle \}$. After the receiver confirms the receipt of the quantum sequence, the sender announces the positions and preparation bases of the decoy photons, and the receiver performs corresponding measurements to evaluate the $Q_{\mathrm{BER}}$.

In this security analysis, Eve is assumed to adopt the standard BB84-type intercept-resend attack model, in which Eve independently and randomly chooses either the Z basis or the X basis to measure each intercepted decoy photon, and then re-prepares the corresponding quantum state according to the measurement result before sending it to the legitimate receiver. Under this attack model, Eve chooses the correct measurement basis with probability $1/2$, in which case no error is introduced; Eve chooses the wrong measurement basis with probability $1/2$, and under the wrong basis, the probability that the receiver detects an error is $1/2$. Therefore, for a single decoy photon, the probability that Eve’s attack remains undetected is given by

$$P_{\mathrm{single}-\mathrm{undetected}}=1-{\displaystyle \frac{1}{2}}\times {\displaystyle \frac{1}{2}}={\displaystyle \frac{3}{4}}.$$

(10)

For a sequence containing k decoy photons, the probability that Eve’s intercept-resend attack is completely detected is

$$P_{\mathrm{detected}}=1-{\left({\displaystyle \frac{3}{4}}\right)}^k.$$

(11)

As the number of decoy photons k increases, the probability that Eve’s attack remains undetected decreases exponentially and approaches zero. Considering practical device imperfections and channel noise, a reasonable $Q_{\mathrm{BER}}$ threshold [32] is introduced in the proposed scheme to evaluate channel security during the two rounds of eavesdropping detection. Therefore, the proposed scheme can effectively resist this type of attack.

Entanglement Attack.

In this type of attack, Eve introduces an ancilla particle $|e\rangle$ and performs a unitary operation $U_E$ to entangle the ancilla with the transmitted particle $|{\phi }_{in}\rangle$. Through this interaction, Eve attempts to obtain information about the secret key without being detected. In the proposed scheme, the transmitted quantum states belong to $\left\{\right|0\rangle ,|1\rangle ,|+\rangle ,|-\rangle \}$.

The action of $U_E$ on the computational basis states can be described as follows:

$$U_E\left(\right|0\rangle |e\rangle )={ϵ}_{00}|0\rangle |e_{00}\rangle +{ϵ}_{01}|1\rangle |e_{01}\rangle ,$$

(12)

$$U_E\left(\right|1\rangle |e\rangle )={ϵ}_{10}|0\rangle |e_{10}\rangle +{ϵ}_{11}|1\rangle |e_{11}\rangle .$$

(13)

For the X-basis states $|+\rangle$ and $|-\rangle$, the corresponding linear transformations are:

$$U_E\left(\right|+\rangle |e\rangle )={\displaystyle \frac{1}{\sqrt{2}}}\left({ϵ}_{00}|0\rangle |e_{00}\rangle +{ϵ}_{01}|1\rangle |e_{01}\rangle +{ϵ}_{10}|0\rangle |e_{10}\rangle +{ϵ}_{11}|1\rangle |e_{11}\rangle \right),$$

(14)

$$U_E\left(\right|-\rangle |e\rangle )={\displaystyle \frac{1}{\sqrt{2}}}\left({ϵ}_{00}|0\rangle |e_{00}\rangle +{ϵ}_{01}|1\rangle |e_{01}\rangle -{ϵ}_{10}|0\rangle |e_{10}\rangle -{ϵ}_{11}|1\rangle |e_{11}\rangle \right).$$

(15)

Here, $|e_{i,j}\rangle$ ($i,j\in \{0,1\}$) denotes the normalized pure state of the ancillary particle after interaction, satisfying:

$$\langle e_{i,j}|e_{i,j}\rangle =1.$$

(16)

Meanwhile, according to the unitarity condition $U_E{U}_E^{†}=I$, we have:

$$|{ϵ}_{00}{|}^2+|{ϵ}_{01}{|}^2=1,|{ϵ}_{10}{|}^2+{\left|{ϵ}_{11}\right|}^2=1.$$

(17)

Therefore, if Eve attempts to measure the ancillary particle without introducing any disturbance, the final state of the composite system must remain a product state. It can then be strictly derived that

$$|{ϵ}_{00}{|}^2=|{ϵ}_{11}{|}^2,|{ϵ}_{10}{|}^2={\left|{ϵ}_{01}\right|}^2.$$

(18)

At this point, the state of the ancillary particle becomes completely independent of the signal state, implying that Eve cannot obtain any useful information. This demonstrates that the proposed scheme is resistant to entanglement attacks.

4.2.3. Security Analysis Against the QS

In the adversary model of the proposed scheme, the QS is assumed to be an honest-but-curious entity. That is, it strictly executes the scheme procedures and does not collude with external eavesdroppers or any user, but it may attempt to infer the shared key using the information available to it.

During the scheme execution, the QS is responsible for the preparation and distribution of Bell states, as well as performing BSMs. It directly obtains the measurement results $R={\left\{r_i\right\}}_{i=1}^n$ ($r_i\in \left\{\right|{\Phi }^{+}\rangle ,|{\Phi }^{-}\rangle ,|{\Psi }^{+}\rangle ,|{\Psi }^{-}\rangle \}$). Therefore, compared to external eavesdroppers, the QS can directly acquire all measurement results R, gaining an advantage through the complete observation of this random variable. However, similar to the analysis in Section 4.2.1, the QS cannot derive the specific types of Pauli operations applied by the users or the key information from the BSM results. Specifically, the BSM results R are uniformly distributed; thus, the prior entropy of the QS is given by

$$H\left(R\right)=-{\displaystyle \sum _{k=1}^4}{\displaystyle \frac{1}{4}}{log}_2{\displaystyle \frac{1}{4}}=2.$$

(19)

Even under the condition that the QS knows the measurement results R, the individual Pauli operations of Alice and Bob remain uniformly distributed from the perspective of the QS. Therefore, the conditional entropies satisfy

$$H(A\mid R)=2,H(B\mid R)=2.$$

(20)

The corresponding mutual information is calculated as follows:

$$\begin{array}{cc}\hfill I(A;R)& =H\left(A\right)-H(A\mid R)=0,\hfill \end{array}$$

(21)

$$\begin{array}{cc}\hfill I(B;R)& =H\left(B\right)-H(B\mid R)=0.\hfill \end{array}$$

(22)

Because the final key K is the result of the joint mapping of both parties’ operations, it similarly holds that

$$I(K;R)=0.$$

(23)

This theoretically proves that the QS cannot derive the users’ specific types of Pauli operations or the final key information from the BSM results. Furthermore, even in practical non-ideal systems, if the QS somehow obtains a very small fraction of the sifted key bits, subsequent classical post-processing steps, such as information reconciliation and privacy amplification, can effectively eliminate this potential security threat.

4.3. Efficiency Analysis and Comparison

To objectively evaluate the performance advantages of the proposed scheme, this section first derives its theoretical efficiency and then presents a multidimensional comparison with several representative QKD and QKA schemes.

The qubit efficiency proposed by Adán Cabello is one of the most widely used metrics for evaluating the performance of quantum key agreement schemes. It is defined as follows [33]:

$$\eta ={\displaystyle \frac{b_s}{q_t+b_t}},$$

(24)

where $b_s$ denotes the number of final key bits that are successfully generated and proven secure, $q_t$ represents the number of quantum resources consumed during the execution of the scheme (measured in qubits or entangled pairs), and $b_t$ denotes the number of classical bits exchanged for key mapping or decoding. Classical communication used for eavesdropping detection is typically not included in this term.

4.3.1. Efficiency of the Proposed Scheme

In the proposed scheme, the QS distributes n pairs of Bell states to the users, from which $2n$ key bits are generated. During the key extraction phase, the QS broadcasts n groups of BSM results. Since each measurement outcome corresponds to one of four possible Bell states, each result conveys 2 classical bits. Therefore, the total classical communication overhead required for key decoding is $2n$ bits. Accordingly,

$$b_s=2n,q_t=n,b_t=2n.$$

(25)

Under these parameter settings, the performance of the proposed scheme can be analyzed as follows.

(1) Qubit efficiency. Substituting the above parameters into the efficiency formula yields

$$\eta ={\displaystyle \frac{b_s}{q_t+b_t}}={\displaystyle \frac{2n}{n+2n}}={\displaystyle \frac{2}{3}}\approx 66.7\%.$$

(26)

Although the key extraction process introduces the necessary classical communication overhead for broadcasting RSM results, the efficiency remains significantly higher than that of comparable entanglement-based QKA schemes due to the adopted encoding mechanism.

(2) Channel capacity. By exploiting the nonlocal correlations of Bell states, the proposed scheme enables each Bell pair to carry 2 classical bits through four random local Pauli operations. Therefore, the channel capacity reaches 2 bits per Bell state. From a physical perspective, this is equivalent to surpassing the single-qubit transmission bound described by the Holevo bound [34], thereby realizing quantum dense coding.

(3) Quantum resource utilization. Unlike the BB84 protocol [10], in which quantum resources are partially discarded due to basis mismatches, all transmitted Bell states in the proposed scheme—except for those used as decoy photons for channel security verification—directly contribute to valid key generation. Consequently, the qubit utilization rate reaches 100%.

In summary, by introducing a superdense coding mechanism, the proposed scheme enhances the information capacity and utilization of each quantum resource under strict security guarantees, thereby improving the overall efficiency of the scheme.

4.3.2. Comprehensive Comparison with Other Schemes

To further evaluate the performance advantages of the proposed scheme, we compare it with several representative QKD schemes, including the BB84 protocol [10] and the E91 protocol [17], as well as several recently proposed QKA schemes. The comparison results are summarized in

Table 4. Performance comparison between the proposed scheme and representative QKD and QKA schemes.

Scheme	Type	Quantum Resource	Required Usesr Quantum Capabilities	Resource Utilization	Qubit Efficiency ($\mathit{\eta }$)
BB84 [10]	QKD	Single photon	SPP, SPM	≈50%	≈25%
E91 [17]	QKD	Bell states	SPM	$22.2\%$	$22.2\%$
Ref. [18]	QKA	GHZ states	GP, SPM	≈50%	≈12.5%
Ref. [16]	QKA	Bell states	BP, BSM, SPP	$100\%$	$40\%$
Ref. [14]	QKA	Bell states	SPM, PO	≈50%	≈25%
Ref. [15]	QKA	Bell states	BP, SPM	$25\%$	$20\%$
Proposed	QKA	Bell states	SPP, SPM, PO	100%	≈66.7%

Abbreviations: SPP: Single-photon preparation; BP: Bell state preparation; GP: GHZ-state preparation; SPM: Single-photon measurement; BSM: Bell state measurement; GSM: GHZ-state measurement; PO: Pauli operation.

. The comparison dimensions include the type of quantum resources, the required quantum capabilities of users, the utilization efficiency of quantum resources, and the qubit efficiency.

To ensure comparability among different schemes under a unified information-theoretic framework, the efficiency metrics listed in Table 4 are recalculated according to the aforementioned definition. In this calculation, one Bell pair or one GHZ state is regarded as a single quantum resource unit, and the consumption of decoy photons used solely for eavesdropping detection is not included. This evaluation method highlights the influence of scheme structure on key generation efficiency; therefore, some values may differ from those presented in the original references.

The BB84 protocol [10] and E91 protocol [17] are representative QKD schemes, whose objective is secure key distribution rather than fair key agreement. As a result, their qubit efficiency and quantum resource utilization are constrained by the random selection and matching probability of measurement bases. In contrast, most existing QKA schemes exploit entanglement correlations to generate shared keys; however, the amount of information carried by each quantum resource is limited, leaving room for improvement in overall efficiency. In the proposed scheme, dense encoding is achieved by applying local Pauli operations on Bell states, enabling each entangled pair to carry 2 bits of information. Under a unified efficiency metric, the scheme attains a qubit efficiency of approximately $66.7\%$ and a quantum resource utilization of $100\%$, outperforming the related schemes in [14,15,18].

Compared with schemes based on multipartite entangled states (e.g., GHZ states) [15], the proposed scheme employs Bell states as the quantum carrier, leading to improved feasibility in state preparation and manipulation. Moreover, by delegating Bell state preparation and BSM to the QS, the user side is only required to perform single-qubit operations, thereby reducing implementation requirements and enabling a lightweight design. It should be noted that, while the introduction of the QS simplifies user-side operations, it increases the complexity on the server side and relies on a semi-trusted third-party assumption.

Overall, the proposed scheme achieves a balanced trade-off among qubit efficiency, quantum resource utilization, and implementation complexity.

5. Experiments

5.1. Experimental Environment

In this study, the Gemini nuclear magnetic resonance (NMR) quantum computing experimental system developed by SpinQ is employed as the experimental verification platform. The Gemini system is based on the principles of NMR quantum computing and provides stable radio-frequency control and high system reproducibility, enabling the execution of real quantum computing experiments. The system contains two qubits and features high gate fidelity (two-qubit gate fidelity $>99\%$) and long coherence times (average $T_1=10$ s and average $T_2=1.2$ s).

Based on the SpinQit programming framework, the key quantum operations and measurement procedures involved in the proposed quantum key agreement scheme are implemented on this experimental system. The experimentally measured quantum relaxation time is approximately $T_1\approx 6$ s, indicating that the influence of quantum decoherence on the execution of the scheme remains controllable within the experimental time scale. These results effectively demonstrate the feasibility and practical performance of the proposed scheme on real quantum hardware.

5.2. Experimental Results and Analysis

We designed and conducted a series of systematic experiments to verify the feasibility and correctness of the proposed scheme under realistic physical conditions. To illustrate the performance of the scheme under different user operation patterns, two representative cases are analyzed in detail: one in which both parties apply identical operations, and another in which they apply different operations. The corresponding experimental configurations, BSM outcomes, and key agreement processes are summarized in

Table 5. Comparison of experimental parameters and results including correction operations.

User	Case 1					Case 2
	Op. ($\mathit{U}$)	Init. (${\mathit{K}}_{\mathit{ini}}$)	BSM Res.	Corr.	Final ($\mathit{K}$)	Op. ($\mathit{U}$)	Init. (${\mathit{K}}_{\mathit{ini}}$)	BSM Res.	Corr.	Final ($\mathit{K}$)
Alice	$U_{01}$	01	$|{\Phi }^{+}\rangle$	–	01	$U_{00}$	00	$|{\Psi }^{-}\rangle$	Flip 1st	10
Bob	$U_{01}$	01		–		$U_{11}$	11		Flip 2nd

Note: Op. denotes the Pauli operation; $K_{ini}$ and K represent the initial and final shared keys, respectively.

.

Case 1.

In this experiment, both Alice and Bob apply the operation $U_{01}$, and the BSM outcome is $|{\Phi }^{+}\rangle$. To evaluate the correctness of the proposed scheme, the Bell state $|{\Phi }^{+}\rangle$ is prepared and measured in the single-qubit Z-basis, and the fidelity is used as the evaluation metric. Figure 2a illustrates the complete quantum circuit, including state initialization, entanglement preparation, and user encoding. Figure 2b presents the experimentally obtained probability distribution, where the probabilities of $|00\rangle$ and $|11\rangle$ are $0.459$ and $0.448$, respectively, while small non-ideal components $|01\rangle$ and $|10\rangle$ appear with probabilities $0.042$ and $0.051$. Figure 2c shows the theoretical density matrix of $|{\Phi }^{+}\rangle$, whose nonzero elements correspond strictly to the $|00\rangle$ and $|11\rangle$ components.

The measured fidelity between the experimental state and the ideal $|{\Phi }^{+}\rangle$ state is $0.907$, which is slightly lower than the theoretical value of 1. This deviation is mainly attributed to non-ideal factors in the experimental system, including quantum gate imperfections, limited photon detection efficiency, and decoherence effects in the quantum channel. Nevertheless, the $|00\rangle$ and $|11\rangle$ components remain dominant in the experimental data, and the probabilities of the error terms are below $5\%$, indicating good agreement with the theoretical predictions.

Case 2.

In this experiment, Alice applies the operation $U_{00}$ while Bob applies $U_{11}$, and the BSM outcome is $|{\Psi }^{-}\rangle$. To evaluate the effectiveness of the proposed scheme under asymmetric user operations, the Bell state $|{\Psi }^{-}\rangle$ is prepared and measured in the single-qubit Z-basis, and the fidelity is used as the evaluation metric. Figure 3a illustrates the corresponding quantum circuit, including state initialization, entanglement preparation, and the distinct encoding operations performed by the two users. Figure 3b shows the experimentally obtained probability distribution, where the probabilities of $|01\rangle$ and $|10\rangle$ are $0.458$ and $0.466$, respectively, while small non-ideal components $|00\rangle$ and $|11\rangle$ appear with probabilities $0.041$ and $0.035$. Figure 3c presents the theoretical density matrix of the corresponding ideal state, whose nonzero elements are concentrated on the $|01\rangle$ and $|10\rangle$ components.

The measured fidelity between the experimental state and the ideal $|{\Psi }^{-}\rangle$ state is $0.924$, which is slightly lower than the theoretical value of 1. This deviation is mainly attributed to additional phase disturbances introduced by the asymmetric encoding operations, as well as non-ideal factors in the experimental system, including quantum gate control errors and limited photon detection efficiency. Notably, despite the difference in user operations, the $|01\rangle$ and $|10\rangle$ components remain dominant, and the probabilities of the error terms are below $5\%$, indicating good agreement with theoretical expectations.

The analysis of the above two cases shows that the experimental results are consistent with the theoretical predictions. The observed deviations are mainly caused by experimental noise rather than theoretical limitations. In particular, even under asymmetric user operations, the system maintains a relatively high entanglement fidelity, thereby validating the feasibility and correctness of the proposed scheme under realistic physical conditions.

6. Conclusions

This paper proposes a high-efficiency and lightweight QKA scheme based on Bell state entanglement. The scheme reduces the quantum resources and communication rounds required for effective key generation, while also lowering the quantum operational requirements on the user side, making it more suitable for a quantum network architecture consisting of centralized quantum nodes and lightweight user terminals. Within this framework, the proposed scheme holds potential value across a variety of practical application scenarios. In metropolitan quantum communication networks and quantum IoT systems, which are currently in their early stages of development, user-side quantum capabilities are limited, whereas core nodes possess strong quantum processing capabilities. This scheme ensures negotiation efficiency while requiring users to perform only simple single-qubit operations, facilitating large-scale, low-cost access. Furthermore, in quantum-classical hybrid communication environments, this scheme can serve as a key agreement module, integrated with classical cryptographic systems to enhance the overall security and scalability of the system.

Future work will be carried out in several directions. First, under more realistic high-noise quantum channel conditions, the effects of entanglement decoherence and operational errors on the correctness and efficiency of the proposed scheme will be systematically analyzed, and corresponding performance evaluation models will be established. On this basis, the scheme will be further extended to multiparty communication scenarios by incorporating GHZ states to construct a multiparty quantum key agreement mechanism, while analyzing the resulting changes in communication complexity and fairness. Finally, considering the current scheme’s reliance on a semi-trusted QS, future research will further investigate how to resist potential attacks from malicious QS, such as preparing incorrect quantum states, retaining ancillary entangled systems, or forging BSM results. In addition, measurement-device-independent (MDI) architectures will be explored for integration into the proposed scheme, thereby gradually reducing the trust dependence on centralized quantum nodes and further enhancing the security of the scheme.