A quantum signature is the development or extension of a digital signature. In classical cryptography schemes, the digital signature has a great importance by guaranteeing the proof of the source and the integrity and authenticity of messages. Accordingly, digital signatures have been applied in a wide variety of fields, for example, electronic government affairs, electronic medical and electronic payment. Its security is based on computational complexity. Nevertheless, in theory, any cryptography scheme on account of computational complexity can be compromised. The well-known RSA public key cryptography system has been proven to be quickly cracked via future quantum computers,^[1,2] and hence the demand for a more secure cryptography system has become even more urgent. Quantum cryptography can be a powerful solution to this problem and it is the product of the combination of the fundamentals of quantum mechanics and classical cryptography theory. Unlike the mathematics-based classical cryptography, the security of quantum cryptography is guaranteed by the quantum non-cloning theorem and Heisenberg’s uncertainty principle, which serve as the internal condition and the external protection, respectively. Designing the secure quantum cryptography protocols based on the special properties of the quantum state is an important research direction of quantum cryptography. Quantum cryptography protocols can be subdivided into QKD, quantum secret sharing (QSS), quantum secure direct communication (QSDC), quantum identity authentication (QIA), quantum signature (QS), quantum coin flipping (QCF), quantum money (QM),^[3] quantum private query (QPQ),^[4–6] and quantum secure computation (QSC),^[7,8] among which the latter four have recently become hot topics and QS is an important foundation of the secure quantum information system and quantum cryptography schemes.

So far, quantum signature schemes have been extensively researched for realizing different purposes, for instance, arbitrated quantum signature (AQS),^[9–18] quantum homomorphic signature (QHS),^[19,20] quantum blind signature (QBS),^[21–24] quantum group signature (QGS),^[25–28] quantum proxy signature (QPS),^[29] quantum digital signature (Q-DS),^[30–32] and quantum dual signature (QDS).^[33,34] Among these schemes, we focus on the AQS scheme. The frame of the AQS scheme was initially raised by Zeng and Keitel^[9] by employing three-particle entangled Greenberger–Horne–Zeilinger (GHZ) states. Curty et al.^[11] investigated and argued that the proposal^[9] was not clearly operationally defined and ambiguous. Later Zeng gave a more detailed demonstration and presentation^[12] of the previous scheme.^[9] Next, instead of GHZ triplet states, Li et al.^[13] exploited two-particle entangled Bell states to design an AQS scheme, which shows the advantages referring to a better efficiency in transmission and a low complexity in implementation. Zou and Qiu claimed that the above schemes cannot guarantee the disavowal from the receiver and presented an AQS scheme^[14] with a public board. Choi et al.^[15] also pointed out the security problem on AQS schemes. Li et al.^[16] proposed an AQS protocol replacing the quantum one-time pad with the chained CNOT operations. Yang et al. put forward an AQS protocol^[17] with cluster states, which can achieve an efficiency with 1. Note that these above-mentioned schemes are based on discrete variable (DV) quantum states.

Up to now, quantum signatures can be categorized into two forms, i.e., a DV-based quantum signature and a CV-based quantum signature. The DV-based quantum signature schemes have achieved a great deal of success, which belong to quantum cryptography schemes. Undeniably, the DV-based quantum cryptography schemes have also lots of limitations and difficulties and they are facing more and more challenges.^[35] For one thing, the production and the detection of a single photon are tricky and the generation of entangled photon pairs is also very troublesome. The production efficiency of a single photon is very low and it may suffer from the potential photon number splitting attack.^[36] Furthermore, the detection of a single photon is confronted with severe limitations. Correspondingly, in practical experiments, weak laser is applied to replace single photon.^[37] For another, the communication rate of DV-based quantum cryptography is relatively low. Under such a circumstance, the CV-based quantum cryptography, which uses strong light replacing the single photon or entangled photon pairs, comes out. Compared to the DV-based quantum cryptography, the CV-based quantum cryptography has the strengths^[35] referring to simple preparation, superior transmission rate, high detection efficiency and repetition rate and easy implementation in the experiments. In the CV-based quantum communication protocols, the messages are encoded onto the amplitude and phase of CV-based quantum states and can be transmitted with a greater communication rate, such as CV-based quantum teleportation.^[38] The required manipulations and measurements can be realized in quantum optics in a simple and efficient way, and the shift amount in the quadrature phase space can be measured by homodyne detection. Therefore, investigations into the CV-based quantum cryptography are of great significance. In the last couple of years, Zeng et al.^[39] initially researched the CV quantum signature algorithm with CV entangled states in 2007, which is a true quantum signature algorithm using a key-pair, i.e., public verification key and private signature key, and exploits a quantum circuit to compare the original states and the decoded states. It provides a fresh idea and a more efficient method to explore quantum signatures. In 2016, we proposed an AQS scheme based on CV coherent states,^[18] which serve as the carrier of the signing messages. Its security is guaranteed by the CV-QKD and the CV-based quantum teleportation, which show a potential high-speed AQS algorithm with high communication rate and detection efficiency. In the same year, Huang et al.^[40] raised CV-based QIA with a two-mode squeezed vacuum state and coherent state. It is worth mentioning that an AQS scheme is of a better application when compared with a true signature scheme, especially with the reduced requirements on the trustworthiness of the arbitrator.^[9]

Motivated by the structure of the AQS with CV-based coherent states, we suggest an AQS scheme with CV-based squeezed vacuum states, which are the simplest squeezed states. The proposed scheme makes the following contributions.

(i) Compared to the above-mentioned DV-based quantum signature schemes, the primary advantage is that the amount of information contained in CV-based quantum states is much larger. Moreover, the CV-based squeezed vacuum states, the carrier of the transmitted messages, are easy to generate and convenient to use. Most importantly, the essential operations, preparation (degenerate parametric process), transmission, manipulation and measurement can be efficiently executed in quantum optics.

(ii) Compared to the existing CV-based quantum signature schemes,^[18,39] the proposed AQS scheme is of a better application than a true quantum signature scheme. Additionally, the effect of squeezed states is in principle better than that of coherent states in terms of the encoding efficiency and the communication quality.

(iii) The proposed scheme can be implemented by using sources of an optical parametric oscillator (OPO), beam splitter (BS), amplitude (AM), and phase modulators (PM), which are compatible with standard telecommunication technology.

The rest of this paper is arranged as follows. Section 2 introduces the CV-based quantum signature algorithm with three phases. Section 3 analyzes the security of the proposed CV-based quantum signature scheme. Finally, the discussions and the conclusions are presented in Section 4.

For a secure quantum signature scheme, there are a few rules^[9] to be expected to be accomplished.

i) No disavowals On one hand, the signer cannot disavow the signed message and the yielded signature. On the other hand, the recipient cannot deny the received message and the homologous signature.

ii) No forgeries and no modifications Anyone cannot forge or modify the signed message or the generated signature derived from the sender successfully.

iii) Fixed assignments Each message corresponds to a specified signature.

To simplify the scheme design and the subsequent security analyses, the classical communication is assumed to be performed in the authenticated channel, and the quantum channel from the sender to the recipient is also authenticated. Note that the current error correction and privacy amplification techniques^[41] may be employed to realize the authenticated channels and the former can be achieved by communicating bit messages, where is the error rate. If this assumption does not hold, the process of transferring data will suffer from the potential eavesdropping attack, tampering attack, individual attack, collective attack, and coherent attack, among which the latter three attacks are widely studied in CV-QKD. Three participants, i.e., the sender Alice, the recipient Bob and the third party Charlie, are contained in the suggested scheme, which is composed of three phases, i.e., an initializing phase, a signing phase and a verifying phase. As depicted in Fig. 1, in the initializing phase, the secret keys K_a and K_b and the CV-based Einstein–Podolsky–Rosen (CV-EPR) pairs are generated and distributed. For example, K_a and K_b are prepared over the CV-QKD protocol and then separately assigned to Alice and Bob. The CV-EPR pairs can be obtained by coupling two squeezed states in a 50:50 BS. In the signing phase, the signature of the message is created by using the appropriate CV-based encryption algorithm with K_a by Alice, who then sends the message-signature pair ( , ) to Bob. In the verifying phase, Bob encrypts the performed phase and amplitude modulation M^b and the received parameters and with K_b and gets , which is dispatched to Charlie. Next, Charlie designs a verification parameter t for the comparison with and then transmits the value of t to Bob who makes a judgement whether the protocol should continue certifying the original message and the teleported message . The labels I and II in Fig. 1 denote the initial verification for the comparison of and , and the second verification for the comparison of and , respectively. Note that the encryption key K_s and the decryption key K_v can be symmetrical or asymmetric. We consider that K_s and K_v are symmetrical and call the possible external attacker Eve. In what follows, we formulate the three phases and the concrete steps of each phase in detail.

Fig. 1.

	Figure Option ViewDownloadNew Window
	Fig. 1. (color online) The participants and phases of the signature scheme.

2.2. Signature phase

As the critical stage to the quantum signature scheme, we elaborate on how to create the signature of the transmitted message. This phase can ensure the integrality and reliability of the message and deter the possible disavowal attacks from Alice.

Fig. 2.

	Figure Option ViewDownloadNew Window
	Fig. 2. (color online) The phase space presentation of the squeezed vacuum state (b) along the quadrature x derived from the vacuum state (a).

Table 1.

Table 1.

Table 1. Encoding and phase angle transformation process. . θ Generation basis (bit) 00 0 01 10 π 11

Table 1. Encoding and phase angle transformation process. .

The variances of a vacuum state are given by

with the canonical communication relation ( ). A squeezed vacuum state is formulated as such a state with reduced variance from the vacuum variance in one quadrature at the expense of increased variance in the other, i.e., .^[38,48] The relationship is satisfied, meaning that the state is the minimum uncertainty state. Taking into account some inevitable losses in real experiments, we acquire that the squeezed states are not pure, but mixed states. The mixed squeezed vacuum state is considered to be a squeezed thermal state. If the x quadrature is squeezed, then the corresponding variances can be given bywhere denotes the variance of an initial thermal state and β is the inverse temperature with being the Boltzmann constant and T is the temperature. Such a squeezed thermal state is no longer the minimum uncertainty state, holding the inequality , as shown in Fig. 3.

Fig. 3.

	Figure Option ViewDownloadNew Window
	Fig. 3. (color online) The relationship . The squeezed vacuum states with denoted by the shaded part which is the target area of our study or and the squeezed thermal states with .

Generally, the Gaussian state can be fully characterized by parameters r, β, angle θ in the coordinates, and the displacement α₀. Setting and we perform the quantum teleportation of the squeezed vacuum state due to the fidelity as a criteria independent on θ and α₀. The Wigner function^[49] of the squeezed thermal state is expressed as

where x and p serve as the coordinate axes in the phase space. The Wigner function of a vacuum state with r = 0 and is illustrated in Fig. 4. Note that the squeezed thermal states involve the states whose squeezed variances are larger than the vacuum variance, i.e., . In this paper, we consider the squeezed vacuum state having the squeezed variance and the corresponding quantum teleportation technology.

Fig. 4.

	Figure Option ViewDownloadNew Window
	Fig. 4. (color online) The Wigner function for a vacuum state with r = 0 and .

Equation (10) plays an important role in ensuring the security of the signature, which includes two aspects. Firstly, the dishonest and hostile participants cannot falsify Alice’s signature. Secondly, Alice herself cannot deny her completed signature. To be specific, taking into account the confidentiality of the key K_a shared by Alice and Charlie, we infer that Alice cannot disavow the completed signature in the face of Charlie and Bob successfully and that Bob and the possible attacker cannot counterfeit the signature easily. We note that equation (5) reveals that is obtained by encrypting the message , and thus has a connection with .

2.3. Verification phase

As the last stage to the quantum signature scheme, the purpose is to verify the validity of the signature . After receiving the message-signature pair , Bob is capable of verifying the signature and confirming the authenticity and integrity of the message. Notably, Charlie is required to participate in this phase to assist the verification in that Bob has no access to Alice’s key K_a. This phase is composed of the following steps.

To implement quantum teleportation^[38] in real experiments, the following inequalities should be satisfied

Taking x quadrature as an example, we demand , i.e., . Similarly, the inequality holds. Therefore, the squeezed variances of the squeezed vacuum state are teleported successfully and Bob receives the transmitted squeezed vacuum state followed by the signature . Otherwise, Bob quits.

The above-described procedure is the application of the quantum teleportation with the CV-based squeezed vacuum states which is generally evaluated by calculating fidelity F denoting the overlap of the input and output states. F = 0 means that the teleported state is orthogonal to the input state and F = 1 means that holds. For pure state and mixed state, the expression of the fidelity is different. If the input state is a pure state, the fidelity is given by

with the output state . For , the fidelity reaches 1, i.e., F = 1.

If an input state is a mixed state (the mixed squeezed vacuum state is regarded as a squeezed thermal state), the fidelity is expressed as

which similarly shows the match of the states and . The higher the fidelity F is, the better the receiver reconstructs. In real experiments, the fidelity for the mixed squeezed vacuum states in Eq. (19) can be calculated as^[51]where Y takes the formWe denote the squeezing parameter r_j and the inverse temperature β_j aswhere . Accordingly, the fidelity can be calculated with the measured practical variances.

In fact, the comparison of the input squeezed vacuum state ( ) and the received squeezed vacuum state ( ) can be realized with BSs and photon detectors with a high success probability in experiments.^[52] Given two squeezed vacuum states and with and , where and are the normalization constants. As shown in Fig. 5, if two creation operators and are incident on a balanced BS, the yielding output operators and are

Then, a BS transforms the two squeezed vacuum states and . We obtain

Fig. 5.

	Figure Option ViewDownloadNew Window
	Fig. 5. The BS couples the two input operators of and in a linear way.

For , we find that both output modes contain only even numbers of photons. If an odd number of photons are detected in either of the outputs with perfect photon detectors, it signifies that . Correspondingly, if an even number of photons are detected, it signifies that . In experiments, counting photons is rather cumbersome,^[52] however photon chopping implemented by using a time resolved multi-port splitter may be possible for small photon numbers. Therefore, the two squeezed vacuum states can be compared by judging the relations of the squeezing factors and with detecting the number of photons.

To begin with, we recall that Charlie serves as an important role in the proposed AQS scheme. In the initial stage, Charlie creates the CV-based EPR entangled state and the secret key K_a (K_b) shared with Alice (Bob). In the verification stage, Charlie defines the verification parameter t for comparing the secret quantum states and . In essence, Charlie plays the genuine role of the arbitrator to resolve the possible disputes between Alice and Bob. Hence, he must be absolutely trustworthy in this scheme. Subsequently, we first make the security analyses on the suggested scheme with respect to the security rules, i.e, impossibility of disavowals, impossibility of forgeries and impossibility of repudiations. Furthermore, according to the cryptanalysis in Ref. [53], we analyze the security of the proposed AQS scheme against Bob’s forgery and Alice’s disavowal under the circumstance of a known message attack.

3.1. Security against disavowals

From the expression in Eq. (10), we see that Alice generates the signature of the message with the key K_a which is of the essence for the generation of . If Alice disavows her accomplished signature giving rise to the disputes with Bob, it can be easily detected and then solved by timely transmitting the signature to Charlie. From the key K_a point of view, if contains K_a, the signature must have been created by Alice, otherwise, we infer that the signature has been forged by the internal dishonest Bob or the external attacker Eve. Furthermore, we can quantify the possibility of disavowal. Note that Alice may disavow or accept the generated signature . The probability of disavowal or acceptance from Alice is respective 1/2. We call “disavowal” and “acceptance” as dichotomous variables. It conforms to the definition of the Binomial distribution. We assume that k denotes the amount of disavowed signature from n amount of the target signature. So the probability of disavowal about the signature from Alice is

where is the Binomial coefficient and can be written asAssume that is the appropriate threshold of . As depicted in Fig. 6, the success disavowal probability is a function of k for the respective n = 50, n = 100, and n = 150, each of which holds a maximum probability value. Also, it becomes smaller with the larger n. Thus, we can figure out that the probability can be very small for the large enough n. If the calculated probability exceeds , it is regarded as the “disavowal” behavior. Therefore, the proposed AQS scheme can work well against the disavowal attack strategy.

Fig. 6.

	Figure Option ViewDownloadNew Window
	Fig. 6. (color online) The success disavowal probability as a function of k for the respective n = 50, n = 100, and n = 150.

3.3. Security against repudiations

From the application’s point of view, the scheme should satisfy that the receiver Bob cannot repudiate his receiving of the signature of the message . Our scheme contains this property. In Step 1 of the verification phase, we assume that Bob transmits to Alice in place of Charlie. Afterwards, Alice generates the new signature , i.e.,

and then sends it to Charlie. After receiving , Charlie transforms in Step 2 of the verification stage asWe see that the new signature contains the keys K_a and K_b. Therefore, following the security analyses against disavowals, if Bob repudiates his receiving of the signature, his action can be found by transmitting to Charlie. Note that the repudiation probability by Bob can also be calculated via the employed method of the disavowal probability by Alice and the same conclusion can be drawn.

In principle, when playing the role of information carrier, squeezed states are better than coherent states. In our scheme, the original binary-valued messages are encoded onto the CV-based squeezed vacuum states, as listed in Table 1. On one hand, the encoding efficiency has distinct advantages over that in the DV-based signature schemes due to the intrinsic CV-based spectrum. From Table 1, we see that two binary bits can be encoded with a phase transformation, which is more efficient than the quantum state conjugate coding manner in Ref. [18] where only one binary bit can be encoded. We acquire that the length of the corresponding binary-valued classical information string is the respective 2n and n for the n squeezed vacuum states and coherent states. On the other hand, the performance of the proposed signature scheme is partially evaluated using fidelity due to the application of the CV-based quantum teleportation. It is demonstrated that the fidelity of quantum teleportation based on squeezed (vacuum) states is higher than that of the quantum teleportation with coherent states.^[38,54] Therefore, our scheme has better encoding efficiency and performance. Additionally, as depicted in Fig. 7, the proposed scheme can be achieved in the experiments and the experimental setup of our scheme can be easily obtained due to the achievable CV-based quantum teleportation and CV-QKD.

Fig. 7.

	Figure Option ViewDownloadNew Window
	Fig. 7. Experimental setup for the proposed AQS scheme. OPO (i = 1,2,3): optical parametric oscillator, LO: local oscillator for x and p, D: detector for x and p, BS: 50:50 beam splitter except the marked one 99:1, AM: amplitude modulator, PM: phase modulator.

We have proposed an AQS scheme with CV-based squeezed vacuum states, which requires three participants to jointly complete the initial phase, the signature phase and the verification phase. In the initial phase, the secure keys are prepared and distributed to the legal participants. In the signature phase, the signature is finally generated by employing the unitary phase transformation and the CV-based quantum encryption algorithm. In the verification phase, the validity of the yielded signature is verified via the comparison of the transmitted messages and the recovered messages with the fidelity and the BS technology. The security of our scheme is ensured by the CV-based quantum teleportation and the CV-QKD. Security analyses demonstrate that the proposed scheme can deter the disavowal and forgery attack strategies with the shared keys. However, it is not resistant to Alice’s disavowal and Bob’s forgery strategies in the circumstance of known message attack, which will be improved in the future study. In addition, the scheme has better coding efficiency and communication performance. Therefore, the proposed AQS scheme may be practical for the general authentication system and the voting mechanism.