Cryptanalysis and improvement of Wu-Cai-Wu-Zhang's quantum private comparison protocol

Guang Ping He

REVIEW 2 major objections 4 minor 23 references

Cryptanalysis and improvement of Wu-Cai-Wu-Zhang's quantum private comparison protocol

T0 review · 2 major / 4 minor · reviewed 2026-08-14 · deepseek-v4-flash

Challenge this review Re-run · record.json Download PDF Read on arXiv ↗ Review JSON

Pith's one-line read A leaner two-party quantum private comparison protocol needs no entanglement and no quantum memory, and leaks less information than the WCWZ scheme.

desk verdict The leakage calculation for the WCWZ protocol is new and sound, but the proposed improved protocol fails as written because X does not flip X-basis code qubits. read the letter →

arxiv 1908.09169 v2 pith:V272JTP7 submitted 2019-08-24 quant-ph

Guang Ping He This is my paper · ORCID

classification quant-ph PACS 03.67.Dd03.67.Ac

keywords quantumprivatecomparisoncryptanalysisinformationleakageBB84statesdecoycryptographytwo-partysecurecomputationnomemory

verification ladder T0 review T1 audit T2 compute T3 formal

The pith

A machine-rendered reading of the paper's core claim, the machinery that carries it, and where it could break.

The reading

This paper re-examines the Wu-Cai-Wu-Zhang (WCWZ) quantum private comparison protocol and calculates how much information it actually leaks to the participants. It finds that the WCWZ protocol always leaks more than the author's earlier protocol when a grouping parameter m≥14, and also leaks more for short strings at lower m. The paper then proposes an improved protocol that compares the hash values bit by bit (m=1), using only single qubits prepared in BB84 states, with no Bell pairs and no quantum memory. The claimed result is better security and much greater feasibility: the improved protocol leaks less than WCWZ for any string length, and can be implemented with current technology.

What carries the argument

The mechanism that carries the improved protocol is a decoy-protected, bit-by-bit comparison of hash values. For each bit i, Alice sends a qubit randomly chosen from |0>, |1>, |+>, or |->; Bob measures k of the qubits immediately as decoys and applies the Pauli X gate (for h_i=1) or the identity (for h_i=0) to the remaining code qubit, then returns it with fresh decoys. Alice measures all returned qubits in the same basis she used to prepare the original state, and infers the bit by checking whether the code qubit changed. The security argument is that an external eavesdropper cannot know which qubit is the code qubit and is detected by decoy checks with probability that drops as (7/8)^{$\alpha$ k}; the internal-attack argument relies on simultaneity in step v to keep the probability of h_i equal to 1/2.

What would settle it

Prepare a code qubit as |+>, set Bob's bit to 1 so he applies X, and have Alice measure in the {|+>,|->} basis: the measured state is |+>, identical to the original, so Alice infers bit 0 and the comparison of an unequal pair comes out equal. This single round contradicts the improved protocol's claimed correctness.

Watch

Extended reading notes

Core claim

The central claim is that the WCWZ protocol's information leakage, quantified in Eq. (6), is unnecessarily high and that a bit-by-bit variant removes the gap. Concretely, when Alice and Bob compare m hash bits at once, they always learn m bits of each other's data; with probability 1-$2^{{-m}}$ they abort after the first round and have leaked m bits, and with probability $2^{{-m}}$ they continue, so the expected leakage is the sum in Eq. (6). Setting m=1 gives the improved protocol's leakage, which is below the WCWZ value for every m≥2 and every string length. The paper also identifies two correctness issues in WCWZ: it compares only the first m bits unless modified, and it requires simultaneous announcement, which the author argues is an unstated assumption.

Load-bearing premise

The protocol's bit-inference rule assumes that applying X to the code qubit always flips it to the orthogonal state within the preparation basis; this holds for |0> and |1> but not for |+> and |->, so rounds with X-basis code qubits give wrong comparison results.

Editorial extensions

If this is right

If the improved protocol is correct, two-party quantum private comparison no longer requires Bell states or long-term quantum memory; only single-qubit preparation and immediate measurement are needed.
The leakage formula Eq. (6) implies that grouping hash bits (m≥2) never helps: the minimal leakage for the WCWZ-style approach is at m=1.
For m≥14 the WCWZ protocol is strictly worse than the author's 2017 protocol for any string length; for short strings the same is true even for m=2 and m=13.
With bit-by-bit comparison, the average information leaked saturates at about 2 bits, independent of the string length n.
The protocol still requires simultaneous announcement in step v; if simultaneity is unavailable, the leakage increases, as the author notes.

Reading between the lines

Editorial extensions of the paper, not claims the author makes directly.

The correctness of the improved protocol depends on the encoding being basis-dependent: applying X to |+> or |-> does not flip the state to its orthogonal partner, so for code qubits prepared in the X basis Alice would infer the wrong bit. Restricting code qubits to the Z basis would restore correctness at the cost of discarding half the rounds.
The same X-flip assumption is already implicit in the WCWZ protocol's steps 6 and 8; any security or leakage comparison between the two protocols should be re-run after fixing this encoding issue.
The leakage formula assumes hash bits are independent and uniformly random; for real secrets with structure, the expected leakage could differ, though the rank order of the protocols may persist.
If simultaneity is truly available, the appendix's coin-flipping argument suggests the no-go theorems would be violated, so the practical availability of the protocol's step v is itself a nontrivial physical assumption.

Share X Bluesky LinkedIn Reddit HN

Signed reviews

No signed human review yet.

Editorial analysis

A structured set of objections, weighed in public.

Desk editor's note, referee report, and a circularity audit.

Desk Editor's Note

read the letter

Colleague,

Here's the short version: the paper's real contribution is the information-leakage analysis of the WCWZ protocol, and that part is sound. The improved protocol it advertises is broken as written.

The new result is Eq. (6), a closed-form average leakage under a random-hash model, which the original WCWZ paper did not provide. The derivation is straightforward and convincing; it also correctly shows that the WCWZ protocol leaks more for m≥14 than the author's earlier bit-by-bit protocol, and that for short strings it does worse even for m=2. The paper also correctly flags that the WCWZ protocol's step 3 only exchanges m Bell states while the hash strings are n bits, so the protocol as originally stated only compares the first m bits. That's a genuine, if trivial, flaw.

The soft spot is load-bearing. The improved protocol encodes hB_i by applying X or I to a qubit that Alice prepared in one of the four BB84 states. In step ii-5, rounds are kept only if Alice's measurement basis equals the preparation basis. For Z-basis qubits, X flips the bit and the encoding works. For X-basis qubits, X|+⟩=|+⟩ and X|−⟩=−|−⟩, so the state is unchanged up to a global phase. The receiver therefore sees the same measurement outcome whether Bob applied X or I, and will read hB_i=0 even when Bob sent 1. Since roughly half of the kept rounds have X-basis code qubits, the protocol fails as a correctness matter, not a subtle security leak. The same problem appears in the reverse direction for hA_i. Neither the security analysis in Section V nor the comparison in Section VI addresses this; they both assume the encoding is recoverable.

A fix exists: restrict code qubits to the Z basis (or use a basis-independent encoding) and keep the decoy states as the only basis-randomized elements. That would be a modest revision. But as submitted, the central claim of the paper—that the improved protocol is both more secure and more feasible—is false.

The cryptanalysis of WCWZ stands independently and is worth preserving. The paper deserves a serious referee, because the leakage result is real and the protocol flaw is fixable, but I would not cite the improved protocol in its present form. If you work on quantum private comparison, the Eq. (6) analysis is worth knowing.

Recommendation: send to peer review, with the expectation of substantial revision to the protocol section.

Referee Report

2 major / 4 minor

Summary. The manuscript presents a cryptanalysis of the Wu-Cai-Wu-Zhang (WCWZ) quantum private comparison protocol and proposes an improved protocol that avoids entanglement and quantum memory. The cryptanalysis derives an average information-leakage formula (Eq. (6)) for the WCWZ protocol and argues that it leaks more than the author's earlier protocol in certain regimes. The proposed improved protocol encodes each hash bit by applying X or I to a qubit randomly prepared in one of the four BB84 states, with the receiver measuring in the same basis and inferring the bit from whether the state changed. The central claim is that the improved protocol is more secure and more feasible than WCWZ. However, the encoding step is incorrect for X-basis states: X acts as the identity (up to a global phase) on |+> and |->, so the receiver cannot distinguish X from I for those states. As a result, the improved protocol fails to recover the encoded bits in roughly half of the retained rounds, invalidating the proposed protocol and the security analysis built upon it.

Significance. The information-leakage calculation for the WCWZ protocol in Section III.C is a self-contained analytic derivation with no fitted parameters, and the identification of the grouping typo and the simultaneity issue are useful observations. If the improved protocol were correct, it would indeed offer a practical two-party quantum private comparison without a third party, entanglement, or quantum memory. However, the fatal X-basis encoding error means the central contribution of the paper is not achieved. The cryptanalysis alone, while reasonably sound, is incremental and does not by itself support the paper's headline claims. The manuscript as submitted is therefore not acceptable for publication.

major comments (2)

[Section IV, Step ii-2 and Step vi] The encoding of hB_i (and symmetrically hA_i) is invalid for X-basis code qubits. Since X|+> = |+> and X|-> = -|->, applying X or I to a code qubit prepared in the X basis leaves the qubit in the same basis state up to a global phase. In Step vi, Alice compares her measurement result with the original state of SA to decide whether hB_i = 0 or 1; for an X-basis code qubit, this comparison always yields 'unchanged' and therefore hB_i = 0, regardless of Bob's actual bit. Step ii-1 randomly prepares all qubits in one of the four BB84 states, and Step ii-5 retains exactly the rounds in which the preparation basis equals the measurement basis beta_A. Among those retained rounds, the code qubit is equally likely to be in the Z or X basis, so about half of all successful rounds produce a wrong hB_i (and similarly for hA_i). The statement in Step ii-5 that the measurement basis is 'also the eigenbasis for S_A'' after Bob applied his unitary transformation X or I' is only correct for Z-basis code qubits. Consequently, the improved protocol does not perform private comparison, and the security analysis in Sections V.A and V.B, which presumes that the encoded bit is recoverable, does not apply.
[Section VI.A and Fig. 2] The comparison of information leakage between the improved protocol (and the WCWZ protocol) and the author's previous protocol [5] is not rigorous because the former are exact average values computed from Eq. (6), while the latter are called 'loose upper bounds' in the text (Eqs. (7)-(8) of [5]). Showing that a loose upper bound lies above an exact average does not establish that the actual leakage of [5] is lower; the true leakage could be well below the bound. Therefore, the conclusion that the WCWZ protocol is 'always less secure' for n <= 10, and the statement that the criticism in [12] is 'obviously wrong', are not supported by the presented calculations.

minor comments (4)

[Section IV, overall] The step numbering is inconsistent: after Steps i-iii, the text introduces 'Step vi' (announcing the states of D''_A/D''_B), then 'Step v' (announcing the code-qubit positions), then another 'Step vi' (comparing measurement results). The first of these should be Step iv, and the subsequent labels should be adjusted accordingly.
[Section V.A] The security analysis against external eavesdropping considers only a specific intercept-and-resend strategy and computes a detection probability for that strategy. It does not provide a general security proof against arbitrary coherent attacks. For a protocol that aims to achieve security against external eavesdropping, a more rigorous treatment is needed.
[Section III.A] The proposed 'trivial fix' for the grouping typo—repeating the protocol for each m-bit block—is not described with enough detail to verify that the repeated rounds are independent. In particular, the protocol should specify whether the hash values H(a) and H(b) are recomputed or the same blocks are reused, and how the abort decisions carry over between rounds.
[Abstract and Introduction] The phrase '1-to-1 classical hash function H : {0,1}^n -> {0,1}^n' is better described as a permutation or bijection; the term 'hash function' usually implies a many-to-one mapping. This terminology could confuse readers about the security properties of the comparison.

Circularity Check

0 steps flagged · score 1.0 of 10

No significant circularity; the leakage analysis is self-contained and the self-citations to the author's earlier protocol are not load-bearing.

full rationale

The core cryptanalytic result, the information-leakage formula for the WCWZ protocol in Eq. (6), is derived from an explicit random-hash model with no fitted parameters: the probability that m hash bits coincide is taken as (1/2)^m, and the expectation is summed directly. This derivation does not presuppose the paper's conclusions. The comparisons with the author's earlier protocol [5] do cite Eqs. (7) and (8) of that prior paper, but those are parameter-free published analytic bounds about a different protocol, not quantities fitted to the present data or defined in terms of the target result; hence the self-citation is not circular in the sense of importing an unverified conclusion. Similarly, the security analysis of the improved protocol is an independent decoy-state and internal-attack probability argument, not a restatement of an assumption. I did note that the improved protocol's step vi has a genuine correctness issue for X-basis code qubits, since X flips |0> and |1> but leaves |+> and |-> unchanged up to a global phase, so about half of the retained rounds would be misdecoded; however, that is a technical flaw in the proposed protocol, not a circularity of the derivation, because the derivation does not define its conclusion into its inputs. Accordingly, the circularity burden is low.

Assumptions & free parameters 2 free parameters · 4 assumptions · 0 invented entities

The central cryptanalysis assumes a random hash model. The proposed protocol additionally assumes simultaneity and, implicitly, that the X gate flips any qubit in its preparation basis; the latter assumption is false. No new physical entities are introduced.

free parameters (2)

k
Number of decoy qubits per sequence in the improved protocol. It is a security parameter chosen by hand; larger k makes eavesdropping detection more likely, but no optimal value is derived.
error threshold
Predetermined threshold for aborting in decoy checks. The paper does not specify a concrete value.

assumptions (4)

domain assumption H is a random mapping between x and H(x).
Assumed in Section III.C and V.B to give each hash bit a 1/2 probability of equality; standard in QPC security proofs.
domain assumption Existence of practical simultaneity.
The author explicitly assumes simultaneity is available in Section III.B and uses it in step v; without it the leakage increases.
domain assumption Ideal single-qubit operations and measurements, no hardware noise.
Standard assumption in theoretical QPC; the security proofs in Section V treat all operations as perfect.
ad hoc to paper X flips any code qubit to the orthogonal state in its preparation basis.
Needed for the bit encoding in steps ii-2 and iii-2; it is false for X-basis states, which breaks the protocol.

how reviews work

0 comments

Cite this review

Pith. "Pith review of Cryptanalysis and improvement of Wu-Cai-Wu-Zhang's quantum private comparison protocol." pith.science (2026). https://pith.science/paper/V272JTP7

@misc{pith2026190809169,
  author       = {Pith},
  title        = {Pith review of: Cryptanalysis and improvement of Wu-Cai-Wu-Zhang's quantum private comparison protocol},
  year         = {2026},
  howpublished = {\url{https://pith.science/paper/V272JTP7}},
  note         = {Machine review of arXiv:1908.09169}
}

read the original abstract

In a recent paper (Int. J. Quantum Inf. 17 (2019) 1950026), the authors discussed the shortcomings in the security of a quantum private comparison protocol that we previously proposed (Int. J. Quantum Inf. 15 (2017) 1750014). They also proposed a new protocol aimed to avoid these problems. Here we analysis the information leaked in their protocol, and find that it is even less secure than our protocol in certain cases. We further propose an improved version which has the following advantages: (1) no entanglement needed, (2) quantum memory is no longer required, and (3) less information leaked. Therefore, better security and great feasibility are both achieved.

Figures

Figures reproduced from arXiv: 1908.09169 by the authors.

**Figure 2.** FIG. 2: The average amount of information leaked [PITH_FULL_IMAGE:figures/full_fig_p007_2.png] view at source ↗

Discussion (0). Continue with ORCID to comment.

Reference graph

Works this paper leans on

23 extracted references · 23 canonical work pages

[5]

G. P. He, Int. J. Quantum Inf. 15, 1750014 (2017). Quan- tum private comparison protocol without a third party

work page 2017
[12]

Kent, Phys

A. Kent, Phys. Rev. Lett. 83, 1447 (1999). Uncondition- ally secure bit commitment

work page 1999
[1]

Jakobsson and M

M. Jakobsson and M. Yung, in Advances in Cryptology: CRYPTO ’96, Lecture Notes in Computer Science, Vol. 1109 (Springer-Verlag, 1996) , p. 186. Proving without knowing: On oblivious, agnostic and blindfolded provers

work page 1996
[2]

X⌈ n m ⌉−1 = {hA ⌈ n m ⌉∗m+1, ..., h A n−1}

groups, which are X0 = {hA 1 , ..., h A m} X1 = {hA m+1, ..., h A 2m} ... X⌈ n m ⌉−1 = {hA ⌈ n m ⌉∗m+1, ..., h A n−1}. (1) Bob does the same operation as Alice and obtains Y0 = {hB 1 , ..., h B m} Y1 = {hB m+1, ..., h B 2m} ... Y⌈ n m ⌉−1 = {hB ⌈ n m ⌉∗m+1, ..., h B n−1}. (2) (While we believe that the last terms hA n−1 and hB n−1 in these two equations s...

work page
[3]

publish the positions and the measurement 3 bases of D′ A and D′ B simultaneously

Alice (Bob) records these initial states as SA (SB). The ﬁrst particles of all Bell states SA (SB) form the sequence SA1 (SB1 ), and the rest form the sequence SA2 (SB2 ). Step 4. Alice (Bob) prepares decoy states DA (DB), randomly in states |0⟩, |1⟩, (|0⟩+ |1⟩)/ √ 2, (|0⟩ − |1⟩)/ √ 2. Alice (Bob) randomly inserts DA (DB) in SA1 (SB1 ) to form a new seque...

work page
[4]

He’s original protocol is not suitable for a smaller bit-length compar- ison protocol

In this case, Alice tells Bob to keep the data of the sequence S′′′ A , and they continue with the next step. Note that at this stage, Alice still does not know which qubit in S′′′ A is the resultant code qubit S′′ A. This information will be revealed later in step v. Step iii. Alice encodes hA i using much the same way as step ii, except in the reverse d...

work page
[6]

H. -K. Lo, Phys. Rev. A 56, 1154 (1997). Insecurity of quantum secure computations 8

work page 1997
[7]

Colbeck, Phys

R. Colbeck, Phys. Rev. A 76, 062308 (2007). Impossibil- ity of secure two-party classical computation

work page 2007

Show all 23 references

[8]

G. P. He, Int. J. Quantum Inf. 11, 1350025 (2013). Sim- ple quantum protocols for the millionaire problem with a semi-honest third party

2013
[9]

Kent, New J

A. Kent, New J. Phys. 13, 113015 (2011). Uncondition- ally secure bit commitment with ﬂying qudits

2011
[10]

G. P. He, Phys. Scr. 93, 095001 (2018). Device- independent quantum private comparison protocol with- out a third party

2018
[11]

1988 ACM Annual Symposium on The- ory of Computing (ACM, New York, 1988), p

J.Kilian, in Proc. 1988 ACM Annual Symposium on The- ory of Computing (ACM, New York, 1988), p. 20. Found- ing cryptography on oblivious transfer

1988
[13]

H. -K. Lo and H. F. Chau, Physica D 120, 177 (1998). Why quantum bit commitment and ideal quantum coin tossing are impossible

1998
[14]

(6) gives that I ≃ 2

For example, when n = 6, Eq. (6) gives that I ≃ 2. 53 bits when m = 2, and I ≃ 1. 88 bits when m = 1. On the contrary, when using our protocol in [5], Eqs. (7) and (8) of [5] show that the average amount of information leaked for n = 6 is merely I ≃ 1. 43 bits for dishonest Al...
[15]

Kent, Phys

A. Kent, Phys. Rev. Lett. 109, 130501 (2012). Uncon- ditionally secure bit commitment by transmitting mea- surement outcomes

2012
[16]

Pital´ ua-Garc ´ ıa and I

D. Pital´ ua-Garc ´ ıa and I. Kerenidis, Phys. Rev. A 98, 032327 (2018). Practical and unconditionally secure spacetime-constrained oblivious transfer

2018
[17]

W. Q. Wu, Q. Y. Cai, S. M. Wu and H. G. Zhang, Int. J. Quantum Inf. 17, 1950026 (2019). Cryptanalysis of He’s quantum private comparison protocol and a new protocol

2019
[18]

Kitaev, Lecture delivered at the 2003 Annual Quantum Information Processing (QIP) Work- shop, Mathematical Sciences Research Institute, Berkeley, CA ( unpublished)

A. Kitaev, Lecture delivered at the 2003 Annual Quantum Information Processing (QIP) Work- shop, Mathematical Sciences Research Institute, Berkeley, CA ( unpublished). Available online at http://www.msri.org/publications/ln/msri/2002/qip/ kitaev/1/meta/aux/kitaev.pdf. A negati...

2003
[19]

Ambainis, J

A. Ambainis, J. Comput. Syst. Sci. 68, 398 (2004). A new protocol and lower bounds for quantum coin ﬂipping

2004
[20]

Ambainis, H

A. Ambainis, H. Buhrman, Y. Dodis, and H. R¨ ohrig, in CCC ’04: Proc. 19th Annual IEEE Conference on Com- putational Complexity (IEEE, 2004), p. 250. Multiparty quantum coin ﬂipping

2004
[21]

Gutoski and J

G. Gutoski and J. Watrous, in Proc. the Thirty-Ninth An- nual ACM Symposium on Theory of Computing (STOC
[23]

H¨ anggi and J

E. H¨ anggi and J. Wullschleger, in Proc. TCC 2011 (Brown University, 2011), p. 468. Tight bounds for clas- sical and quantum coin ﬂipping Appendix Here we show that if simultaneity is available, then perfectly secure coin ﬂipping (CF) a.k.a. coin tossing can be achieved. CF i...

2011
[2007]

(ACM New York, 2007), p. 565. Toward a general theory of quantum games

2007

Pith tools

Reviewed August 14, 2026 · model on record in the stance chip above.

[1] [5]

G. P. He, Int. J. Quantum Inf. 15, 1750014 (2017). Quan- tum private comparison protocol without a third party

work page 2017

[2] [12]

Kent, Phys

A. Kent, Phys. Rev. Lett. 83, 1447 (1999). Uncondition- ally secure bit commitment

work page 1999

[3] [1]

Jakobsson and M

M. Jakobsson and M. Yung, in Advances in Cryptology: CRYPTO ’96, Lecture Notes in Computer Science, Vol. 1109 (Springer-Verlag, 1996) , p. 186. Proving without knowing: On oblivious, agnostic and blindfolded provers

work page 1996

[4] [2]

X⌈ n m ⌉−1 = {hA ⌈ n m ⌉∗m+1, ..., h A n−1}

groups, which are X0 = {hA 1 , ..., h A m} X1 = {hA m+1, ..., h A 2m} ... X⌈ n m ⌉−1 = {hA ⌈ n m ⌉∗m+1, ..., h A n−1}. (1) Bob does the same operation as Alice and obtains Y0 = {hB 1 , ..., h B m} Y1 = {hB m+1, ..., h B 2m} ... Y⌈ n m ⌉−1 = {hB ⌈ n m ⌉∗m+1, ..., h B n−1}. (2) (While we believe that the last terms hA n−1 and hB n−1 in these two equations s...

work page

[5] [3]

publish the positions and the measurement 3 bases of D′ A and D′ B simultaneously

Alice (Bob) records these initial states as SA (SB). The ﬁrst particles of all Bell states SA (SB) form the sequence SA1 (SB1 ), and the rest form the sequence SA2 (SB2 ). Step 4. Alice (Bob) prepares decoy states DA (DB), randomly in states |0⟩, |1⟩, (|0⟩+ |1⟩)/ √ 2, (|0⟩ − |1⟩)/ √ 2. Alice (Bob) randomly inserts DA (DB) in SA1 (SB1 ) to form a new seque...

work page

[6] [4]

He’s original protocol is not suitable for a smaller bit-length compar- ison protocol

In this case, Alice tells Bob to keep the data of the sequence S′′′ A , and they continue with the next step. Note that at this stage, Alice still does not know which qubit in S′′′ A is the resultant code qubit S′′ A. This information will be revealed later in step v. Step iii. Alice encodes hA i using much the same way as step ii, except in the reverse d...

work page

[7] [6]

H. -K. Lo, Phys. Rev. A 56, 1154 (1997). Insecurity of quantum secure computations 8

work page 1997

[8] [7]

Colbeck, Phys

R. Colbeck, Phys. Rev. A 76, 062308 (2007). Impossibil- ity of secure two-party classical computation

work page 2007