Multi-Party Semi-Quantum Simultaneous Ascending Auction Protocol Based on Single-Particle States

TL;DR

This paper introduces a semi-quantum auction protocol that allows multiple parties to bid on items simultaneously using simple quantum resources.

Contribution

The protocol enables multi-item simultaneous ascending auctions with minimal quantum capabilities and ensures security through a trusted third party.

Findings

The protocol supports multi-item simultaneous ascending auctions using single-particle quantum states.

Quantum circuit simulations confirm the protocol's feasibility and security with current technology.

The solution satisfies anonymity, verifiability, non-repudiation, and privacy preservation.

Abstract

Simultaneous ascending auctions find extensive applications in spectrum licensing and advertising space allocation. However, existing quantum sealed-bid auction protocols suffer from dual limitations: they cannot support multi-item simultaneous bidding scenarios, and their reliance on complex quantum resources along with requiring full quantum operational capabilities from bidders fails to accommodate practical constraints of quantum resource-limited users. To address these challenges, this paper proposes a multi-party semi-quantum simultaneous ascending auction protocol based on single-particle states. The protocol employs a trusted honest third party (HTP) responsible for quantum state generation, distribution, and security verification. Bidders determine their groups through quantum measurements and privately encode their bid vectors. Upon successful HTP authentication, each bidder obtains a unique identity code. During the bidding phase, HTP dynamically updates quantum sequences, allowing bidders to submit bids for multiple items by performing only simple unitary operations. HTP announces the highest bid for each item in real time and iteratively generates auction sequences until no new highest bid emerges, thereby achieving simultaneous ascending auctions for multiple items. It acts as a quantum-secured signaling layer, ensuring unconditional security for bid transmission and identity verification while maintaining classical auction logic. Quantum circuit simulations validate the protocol’s feasibility with current technology while satisfying critical security requirements, including anonymity, verifiability, non-repudiation, and privacy preservation. It provides a scalable semi-quantum auction solution for resource-constrained scenarios.

Figures

Full text

1. Introduction

Quantum cryptography, a key subfield of quantum information science, combines quantum-mechanical principles with classical cryptography. It has achieved major advances in protocol design and implementation, including Quantum Key Distribution (QKD) [1,2], Quantum Secure Direct Communication (QSDC) [3,4], and Quantum Secret Sharing (QSS) [5,6]. These technologies are increasingly deployed in practice, such as quantum voting systems [7] and quantum transaction platforms, offering new models for secure applications.

Auctions are fundamental mechanisms for resource allocation and trading [8,9,10]. By information transparency and bidding rules, they can be categorized into open-cry and sealed-bid formats [11]. English and Dutch auctions are open-cry, with real-time price discovery. Sealed-bid auctions require bidders to submit offers independently and confidentially, which better preserves strategy privacy and suits anonymity-sensitive scenarios.

However, conventional sealed-bid mechanisms rely on computational assumptions in classical cryptography (e.g., integer factorization and discrete logarithms). With rapid progress in quantum computing [12,13], Shor’s algorithm solves these problems in polynomial time [14] and Grover’s algorithm speeds up search [15], exposing sealed-bid systems to quantum attacks [16]. This motivates security protocols grounded in physical principles.

Unlike classical schemes that offer computational security, quantum cryptographic protocols provide information-theoretic security (or unconditional security). This ensures that encrypted data remains secure even against adversaries with unlimited computing power, guaranteeing forward secrecy. In the context of auctions, this prevents historical bid data from being decrypted retroactively once powerful quantum computers become available. It is important to clarify that our proposed protocol serves as a quantum-secured signaling layer. It utilizes quantum mechanics to secure the transmission of bids and verify identities, while the underlying auction allocation logic (comparing bids and determining winners) follows the classical simultaneous ascending auction mechanism.

Against this backdrop, research on quantum sealed-bid auction (QSA) protocols has grown rapidly. The goal is to design quantum-resilient mechanisms that ensure fairness, preserve privacy, and enhance security.

The conceptual framework of quantum auctions was introduced in 2008 [17]. In 2009, Naseri [18] proposed a GHZ-based QSA enabling secure multi-party bid transmission. That scheme resisted only external attacks and was vulnerable internally. Follow-up work refined designs and security analyses. Qin et al. [19] and Yang et al. [20] exposed attacks via double CNOT and pseudo-entangled states; their fixes did not consider a dishonest auction center. In 2010, Zhao et al. [21] added post-confirmation to mitigate collusion, later refined for partial collusion. In 2014, Liu et al. [22] integrated QKD for bid encryption and hash-based confirmation. In 2016, they proposed a single-particle QSBA [23], reducing quantum resources, but Zhang et al. [24] showed coordinated attacks remained. Recent advances include QFT- and d-dimensional-state protocols [25], an anonymous QSA via the Chinese Remainder Theorem [26], and an auctioneer-free scheme with Bell-state swapping [27]. Semi-quantum secure multi-party summation (SQSMS) [28,29,30,31,32,33] has also gained attention due to its compatibility with users of varying quantum capabilities.

Despite these advancements, existing QSA research faces two primary “shortages”: (1) Capability Shortage—most protocols require fully quantum-capable participants, which is impractical for general users. (2) Functional Shortage: Most studies focus on single-item sealed-bid auctions, failing to address the complexity of simultaneous ascending auctions for multiple items. To address this, we combine Milgrom’s simultaneous ascending auction theory [34] with a semi-quantum design and propose a quantum simultaneous ascending auction (QSAA) framework that supports users with diverse capabilities. Under capability constraints, semi-quantum bidders obtain unique identity codes from an honest, fully quantum third party (HTP) and submit bids using simple unitary operations. The protocol preserves anonymity, privacy, fairness, verifiability, and non-repudiation: only HTP learns bids; sealed bids are disclosed simultaneously; bidders cannot repudiate submitted bids and HTP cannot deny receipts.

The remainder of this paper is organized as follows: Section 2 introduces the fundamental concepts of simultaneous ascending auction mechanisms and semi-quantum protocols. Section 3 elaborates on a multi-party semi-quantum simultaneous ascending auction protocol in detail. Section 4 presents simulation analyses. Section 5 provides performance evaluations. Finally, Section 6 concludes the paper.

2. Preliminaries

Our protocol enables anonymous auctions for users with limited quantum capabilities. The semi-quantum simultaneous ascending auction (SQSAA) assigns each bidder a unique identity code. Bidders apply unitary operations to encode bid prices onto quantum sequences, implementing a simultaneous ascending-price auction. We first introduce the auction mechanism and the semi-quantum model used in this paper.

2.1. Simultaneous Ascending Auction Mechanism

The simultaneous ascending-price auction is a multi-item dynamic mechanism widely used in spectrum licensing and advertisement allocation. Its core characteristics include simultaneous bidding for multiple items, round-by-round price increments, and a public bidding process. In each round, bidders may raise bids on any items. After each round, each item’s price updates to the highest bid received. The process repeats until no further bids are submitted, and items are allocated to the highest bidders at their final prices.

2.2. Semi-Quantum Protocol Architecture and Trust Model

The semi-quantum architecture involves two types of users:

Quantum Users (HTP)—the honest third party (HTP) possesses full quantum capabilities (preparation, manipulation, and measurement). Assumption: In this semi-quantum model, the HTP is assumed to be a trusted authority. The HTP generates and measures states correctly and does not collude with bidders to reveal bids to others, although the HTP itself learns the bid values.

Semi-Quantum Users (Bidders): Participants with constrained quantum capabilities, typically limited to Z-basis or X-basis measurements (computational or Fourier bases), applying simple unitary operations, and reflecting received quantum states. This design reduces hardware complexity and cost.

2.3. Protocol Characteristics

The semi-quantum design offers two practical advantages [30]:

System compatibility—basic quantum operations can be implemented using low-cost optical components. When devices malfunction, systems can fall back to a semi-quantum mode, enhancing robustness and easing the transition from classical to quantum infrastructures.

Cost efficiency: Limiting some users’ quantum capabilities reduces dependence on expensive quantum resources and large-scale quantum memory processing, enabling economically viable deployment during the current transitional phase.

3. Multi-Party Semi-Quantum Simultaneous Ascending Auction Protocol

Assume an honest third party (HTP) with full quantum capability acts as the auction coordinator and never colludes with bidders. There are n semi-quantum participants $[eqn]$ who serve as bidders with restricted capabilities: computational-basis or Fourier-basis measurement, simple unitary operations, and reflection. Each bidder $[eqn]$ independently generates a private randomized identity vector $[eqn]$ satisfying $[eqn]$ These vectors serve as cryptographic identity anchors, dynamically integrated into quantum state manipulations through controlled unitary operations.

The protocol has four phases: initialization, identity encoding distribution, bidding, and result announcement. In initialization, HTP constructs differentiated quantum sequences for each bidder and collaborates with $[eqn]$ to validate channel security. In identity encoding distribution, each bidder generates a private identity vector, applies unitary operations to assigned particles, HTP constructs a verification matrix, and validates integrity against predefined rules. In bidding, each bidder applies unitary operations to encode bids and computes a commitment. In the result announcement, HTP determines the highest bid and bidder per item, and others verify using commitments. The schematic diagram of the protocol is shown in Figure 1.

3.1. Initialization Phase

Step 1: HTP and each authorized bidder pre-share an authenticated key sequence $[eqn]$ . * Note: These keys are distributed via a secure classical channel or a prior standard QKD session before the auction begins. If keys are compromised, the authentication fails; thus, key refreshment is recommended for subsequent sessions. * HTP randomly prepares $[eqn]$ rotation-basis particles $[eqn]$ and m decoy particles $[eqn]$ for each bidder. According to $[eqn]$ , HTP determines the embedding order of decoy and rotation particles in the quantum sequence, using (1) if $[eqn]$ = 0, a rotational particle $[eqn]$ is inserted into the sequence. (2) If $[eqn]$ = 1, a decoy particle $[eqn]$ is embedded instead. HTP then produces a quantum sequence $[eqn]$ of length $[eqn]$ . Repeating this for all bidders yields n sequences $[eqn]$ , which HTP sends over authenticated quantum channels.

Step 2: Upon receiving $[eqn]$ , bidder $[eqn]$ routes each particle according to $[eqn]$ : If $[eqn]$ , $[eqn]$ directly reflects the particle to HTP; if $[eqn]$ , $[eqn]$ retains the particle for Step 4.

Step 3: HTP measures the reflected particles using the preparation bases indicated by $[eqn]$ and computes the quantum bit error rate (QBER) by comparing outcomes with prepared states. If QBER exceeds a threshold $[eqn]$ , the protocol aborts; otherwise it proceeds. Threshold Selection: The threshold $[eqn]$ is not arbitrary; it is selected based on standard security proofs for BB84-type protocols. To tolerate environmental noise while securely detecting intercept-resend attacks (which theoretically induce $[eqn]$ error), $[eqn]$ is typically set strictly below the coherent attack bound (approx. 11%), for example, in the range of 5–8% in practical scenarios.

3.2. Identity Encoding Distribution Phase

Step 4: After eavesdropping detection, each $[eqn]$ discards decoy particles and keeps rotation particles. HTP designates the first rotation particle as the grouping particle and publishes its measurement basis on the bulletin board. HTP records initial states and counts bidders per group. Each $[eqn]$ measures the grouping particle according to determine its group: outcomes $[eqn]$ map to groups 1–4.

Step 5: Each $[eqn]$ generates a private n-dimensional vector $[eqn]$ , then applies unitary operations to assigned particles according to: (1) if $[eqn]$ = 0, it applies the Pauli-I operation ( $[eqn]$ ) to the rotational particle. (2) If $[eqn]$ = 1, it performs the Pauli-Y operation ( $[eqn]$ ) on the rotational particle.

Afterward, $[eqn]$ sends the updated sequence $[eqn]$ to HTP.

Step 6: Upon receiving $[eqn]$ from all bidders, HTP determines each bidder’s group from $[eqn]$ and the grouping particles, then measures each particle in the corresponding basis to form a mapping $[eqn]$ (Table 1). For both computational and Fourier bases, record $[eqn]$ if the outcome flips relative to the initial state; otherwise, set $[eqn]$ .

$$[eqn]$$

After constructing the $[eqn]$ matrix from $[eqn]$ of the quantum sequences $[eqn]$ returned by bidders, HTP checks the Hamming weight of each valid column. Identity encoding distribution succeeds iff, for every valid column j,

$$[eqn]$$

and the number of bidders within each group matches HTP’s initial records. Liveness and Restart: If this condition is not met (e.g., column sum $[eqn]$ ) or if the number of bidders in a group mismatches the record (group collision), HTP broadcasts a “Restart” signal. The current round is discarded, and the Identity Encoding Phase repeats from Step 1. This ensures the protocol remains live and reaches a valid distribution state. Columns with no embedded identity encoding are excluded from verification.

3.3. Bidding Phase

Step 7: Completing these operations, each bidder obtains a unique identity code. Repeating Steps 1–3, HTP generates a new quantum sequence $[eqn]$ and new $[eqn]$ for each round r. In each sequence, the first $[eqn]$ particles encode identity (2 group particles followed by n identity particles). For item w with domain $[eqn]$ , the next $[eqn]$ particles encode the bid.

Step 8: Assuming HTP specifies that the initial bid range for the w-th auctioned item lies within $[eqn]$ . HTP broadcasts the valid bidding range and specifies the required bit-length $[eqn]$ for the bid vector. This ensures all bidders encode their bids using a consistent quantum sequence length. Each bidder $[eqn]$ converts their bid into a corresponding private bid binary sequence $[eqn]$ .

Each bidder first encodes their identity sequence. Based on the grouping of particles, the first two particles encode the group identifier, with the conventions 00, 01, 10, and 11 designating the first, second, third and fourth groups, respectively. For example, for group 2 (01), apply I to the first qubit and H to the second. The subsequent n particles encode the private identity code.

For all items, bits are encoded from most significant to least significant (left to right in the vector, applied right to left on qubits as specified in Step 9).

Step 9: The bidder applies the Hadamard, Pauli-Y and Pauli-I operations to the first two particles and encodes their identity vector. Subsequently, they encode their private bid binary sequence $[eqn]$ (where $[eqn]$ ) onto the specific bid particle sequence from right to left. If $[eqn]$ = 0, $[eqn]$ performs the $[eqn]$ operation; if $[eqn]$ = 1, $[eqn]$ applies the $[eqn]$ operation. Otherwise (if no bid is intended), the bidder performs no operations on any particles in the specific bid particle sequence. Then, $[eqn]$ returns the newly processed particle sequence $[eqn]$ to HTP, particle by particle. It is noteworthy that for multiple auction items, the initial-round bidding prices are encoded in the particle sequence following the first auctioned item. Correspondingly, the particle count of $[eqn]$ is augmented according to the same rule established for the first item.

Step 10: Concurrently, in each round, each bidder $[eqn]$ computes a binding, hiding commitment to their bid for each item using a collision-resistant hash function $[eqn]$ . Let $[eqn]$ be a per-round random nonce. Define $[eqn]$ where $[eqn]$ is the bidder’s decimal bid for item w in that round, and ∥ denotes concatenation. HTP records $[eqn]$ for each bidder and item per round. Any bid update must include a fresh commitment.

3.4. Result Announcement Phase

Step 11: After receiving the quantum sequences $[eqn]$ from all bidders, HTP first constructs a mapping result matrix according to the identity encoding distribution rules and verifies each bidder’s identity encoding sequence. Subsequently, HTP measures the first two particles using the following rules. When the Pauli-I operation is applied to a qubit, the HTP measures it in the same basis as its initial state. Conversely, when the Hadamard operation is applied, measurement occurs in the conjugate basis relative to the initial state.

Taking $[eqn]$ as an example, its identity code is Group 2, Number 3. The unitary operation for its group particles consists of applying the Pauli-I operation to the first particle and the Hadamard operation to the second particle. The HTP measures the first particle using the same measurement basis as its initial state. Regardless of the initial state, if the measurement outcome matches the initial state, the HTP calculates the mapping result of the first particle as 0. For the second particle, the HTP employs the measurement basis orthogonal to the initial state: if the initial state is $[eqn]$ or $[eqn]$ , the measurement outcome will be $[eqn]$ or $[eqn]$ ; conversely, if the initial state is $[eqn]$ or $[eqn]$ , the measurement outcome will be $[eqn]$ or $[eqn]$ . In this case, the HTP calculates the mapping result of the second particle as 1, as illustrated in the diagram. Please refer to Table 2 for detailed information.

Then, HTP measures the specific bid particle sequence from right to left using the corresponding basis, recording each outcome $[eqn]$ : if the measurement result is opposite to the initial state, it is recorded as $[eqn]$ = 1; otherwise, $[eqn]$ = 0. Finally, HTP arranges all specific bid results $[eqn]$ , converts the bits to a decimal bid, selects the highest first-round bid, and publishes it on the bulletin board (or via a classical channel).

Step 12: After completing initial bidding for all auctioned items, bidders collectively negotiate the bid increment range for subsequent rounds.Specifically, suppose they determine the starting price for each new round as 10% of the previous round’s highest bid for that item, $[eqn]$ . Then, they repeat Steps 7–10 for the next round. Upon receiving quantum sequences, HTP executes Step 11.

If a bid does not exceed the current highest bid, HTP withholds updates. The auction concludes when no item receives a higher bid; HTP then publishes all final highest bids.

Step 13: Assume bidder $[eqn]$ is the highest bidder for item w. He discloses $[eqn]$ and $[eqn]$ , enabling others to recompute $[eqn]$ and check it matches the recorded commitment. If $[eqn]$ ’s commitment is validated by all bidders and HTP, he is confirmed as the highest bidder; otherwise, verification fails. If any bidder $[eqn]$ ( $[eqn]$ ) claims their bid exceeds HTP’s published highest bid or $[eqn]$ , $[eqn]$ broadcasts a complaint and discloses $[eqn]$ for verification. Successful verification mandates HTP to update the item’s highest bid; failed verification maintains the current highest bid. HTP declares $[eqn]$ the winner for item w only when no valid complaints are substantiated (Figure 2).

4. Simulation of the Proposed Protocol

The Qiskit simulation presented here aims to validate the correctness of the quantum physical layer—specifically the single-particle encoding, decoding, and noise robustness—rather than to simulate the classical arithmetic logic of the auctioneer.

We illustrate the protocol with Qiskit simulations in two phases: multi-party semi-quantum identity encoding distribution and multi-party semi-quantum simultaneous ascending auction. Consider an HTP coordinating three semi-quantum bidders $[eqn]$ . Bidders independently sample private vectors $[eqn]$ .

4.1. Multi-Party Semi-Quantum Identity Encoding Distribution

Assume at this stage, HTP allocates distinct key sequences $[eqn]$ to bidders $[eqn]$ respectively, where

$$[eqn]$$

Step 1: HTP randomly generates rotation particles $[eqn]$ and decoy particles $[eqn]$ from BB84 state $[eqn]$ . According to the rules specified in the aforementioned protocol, the quantum sequences $[eqn]$ , $[eqn]$ and $[eqn]$ are formed in Table 3. The quantum circuit diagram for $[eqn]$ is illustrated in Figure 3 according to the aforementioned conditions. In this simulation, we employ a decoy state ratio of approximately 50% (1:1 with rotation particles) to maximize statistical detection sensitivity for the case study.

Step 2: Each bidder routes particles according to $[eqn]$ . $[eqn]$ reflects decoy particles and retains rotation particles. HTP measures reflected particles in the corresponding bases and computes QBER. For example, in $[eqn]$ the particles at positions 2, 4, 6, 9, 12, 14, and 17 are reflected (Figure 4). If the error rate is below the threshold, the protocol proceeds (Figure 5).

Step 3: HTP publishes (or broadcasts via classical channel) the measurement basis for the first rotation particle on the bulletin board while recording the number of bidders in each group. Bidders $[eqn]$ measure the first particle in their respective rotation particle sequences $[eqn]$ , $[eqn]$ and $[eqn]$ using the announced basis. Taking $[eqn]$ as an example: when the first particle in its rotation sequence is ∣0〉 (Figure 6) and the computational basis measurement yields 0, $[eqn]$ is assigned to Group 1. Similarly, $[eqn]$ and $[eqn]$ are assigned to Group 2 and Group 3, respectively. These grouping results are consistent with the HTP’s recorded data. Then, Bidder $[eqn]$ performs unitary operations on positions 2–4 of its rotation particle sequence: specifically applying the $[eqn]$ operation to the 3rd position and the $[eqn]$ operation to positions 2 and 4, while leaving other particles unchanged (Figure 7). Afterward, $[eqn]$ sends $[eqn]$ to HTP. Following the same rules, $[eqn]$ and $[eqn]$ execute their designated unitary operations and send their sequences $[eqn]$ and $[eqn]$ to HTP.

Step 4: Upon receiving the modified quantum sequences $[eqn]$ , $[eqn]$ and $[eqn]$ from bidders $[eqn]$ , $[eqn]$ and $[eqn]$ , HTP performs sequential measurements on each qubit of the sequences using the measurement basis corresponding to each bidder’s group assignment. The mapping results are organized into a $[eqn]$ matrix M, where each row represents a bidder’s sequence and each column corresponds to a specific qubit position.

The per-column Hamming weights (column sums) are (0, 1, 0, 0, 1, 1, 1, 0, 1, 0, 0, 0). For every valid column, the sum equals 1; therefore, bidders $[eqn]$ , $[eqn]$ and $[eqn]$ are assigned the identity designations Group 1 Member 2, Group 2 Member 3, and Group 3 Member 5, respectively, satisfying the predefined condition. Thus, the identity code distribution is successful without repetition (see Figure 8).

4.2. Multi-Party Semi-Quantum Simultaneous Ascending Auction

In this stage, all bidders simultaneously place bids on both auction items, A and B (though the protocol permits optional single-item bidding). For demonstration clarity, we assume single-round auction completion. Suppose the initial price ranges for items A and B in the first-round auction are [0, 8] and [0, 10], respectively, with a bid increment benchmark of 10% per round. In the first round, bidders $[eqn]$ , $[eqn]$ and $[eqn]$ submit their initial bids for item A as (4, 7, 5) and for item B as (7, 7, 9). All bidders reveal their true maximum willingness-to-pay (i.e., their psychological reserve prices) in the first round, implying that no bidders will revise their bids in subsequent auction rounds.

Step 1: HTP initializes the protocol by assigning distinct key sequences $[eqn]$ to bidders $[eqn]$ respectively, where

$$[eqn]$$

Then, HTP randomly generates quantum sequences $[eqn]$ , $[eqn]$ and $[eqn]$ according to the rules of Step 1,where

$$[eqn]$$

Step 2: Following the aforementioned rules, we conduct channel security eavesdropping detection by referencing the case study from Simulation Experiment 4.1.

Step 3: According to the established rules, bidders $[eqn]$ , $[eqn]$ and $[eqn]$ perform group encoding operations on particles located at the first and second positions of the sequence, simultaneously executing identity encoding utilizing private vectors at positions 3 through 5.

As demonstrated in Simulation Experiment 4.1, the bidder $[eqn]$ was assigned the identity code “Group 1, Member 2” (with group encoding 00). Given $[eqn]$ ’s private vector (0, 1, 0), the identity encoding is implemented on qubits 1–5 through quantum operations: $[eqn]$ implements $[eqn]$ operations on the first and second particles within their respective rotational particle; the $[eqn]$ operation is applied to the 4th qubit and $[eqn]$ operations are maintained on qubits 3 and 5. Following the same rules, bidders $[eqn]$ and $[eqn]$ subsequently execute their respective unitary operations in accordance with their allocated group codes and private vectors.

Step 4: $[eqn]$ , $[eqn]$ and $[eqn]$ convert the decimal bid value of item A into corresponding binary sequences (0, 1, 0, 0), (0, 1, 1, 1) and (0, 1, 0, 1). Concurrently, specific bid particle encoding is implemented at positions 6–9 to comprehensively embed auction information.

Taking bidder $[eqn]$ as an example, $[eqn]$ implement unitary operations on the rotational particle. Specifically, the $[eqn]$ operation is applied at positions 7, 11, 12, and 13, while the $[eqn]$ operation is performed at positions 6, 8, 9, and 10. Then, $[eqn]$ sends $[eqn]$ to HTP. Following the same procedure, bidders $[eqn]$ and $[eqn]$ perform their corresponding quantum operations and return $[eqn]$ and $[eqn]$ to HTP.

Step 5: In accordance with the established rules, HTP constructs a $[eqn]$ identity verification matrix (0, 0, 0, 1, 0), which matches the identity encoding assigned in Simulation Experiment 4.1. Subsequently, HTP conducts the following operations: (1) Using the same measurement basis as the initial state, HTP measures qubits 6–13 of $[eqn]$ , obtaining a $[eqn]$ matrix (0, 1, 0, 0, 0, 1, 1, 1) (Figure 9). The auction prices for items A and B are derived from their respective quantum sequences. When converted to decimal notation, these sequences yield the values 4 for A and 7 for B. The same verification procedure is applied to $[eqn]$ and $[eqn]$ , revealing bids of (7, 7) and (5, 9) from $[eqn]$ and $[eqn]$ , respectively, for item A and B.

(2) HTP announces the highest bid for item A in the first auction round as 7 on the public bulletin board. Item B yields respective bids of 7, 7 and 9 from $[eqn]$ , $[eqn]$ and $[eqn]$ , with the highest bid of 9 being similarly published. (3) Bidders $[eqn]$ , $[eqn]$ and $[eqn]$ each generate hash commitments for their bids on items A and B according to Step 10. For example, for item A with bid 7, bidder $[eqn]$ samples a random nonce $[eqn]$ and computes which is recorded by HTP.

$$[eqn]$$

Step 6: According to the auction rules, the starting prices for items A and B in the second round are set to 7.7 and 9.9, respectively, calculated as $[eqn]$ . Subsequently, HTP and bidders $[eqn]$ , $[eqn]$ and $[eqn]$ repeat Steps 1–5 of the protocol. During Step 5, the bid matrices derived from the quantum sequences returned by the bidders to HTP are all (0, 0, 0, 0), indicating no new highest bids for either item. Next, the highest bidders for items A and B disclose their random numbers and commitment values to HTP and other bidders. Other bidders validate the commitment values, and HTP verifies both the commitment values and identity encodings.

If all verifications pass and no complaints are raised, HTP officially declares the highest bids for items A and B are 7 and 9, respectively. The winning bidders are Group 2 Member 3 for item A and Group 3 Member 5 for item B. The auction concludes upon this announcement.

5. Performance Analysis

We evaluate the proposed SQSAA protocol in terms of security, anonymity, verifiability, non-repudiation, and secrecy capacity.

5.1. External Attacks on Security

To obtain bidders’ secrets, an eavesdropper Eve may attempt intercept–resend, measure–resend, or Trojan-horse attacks.

5.1.1. Intercept-Resend Attack

In Step 1 or Step 7, Eve may intercept the quantum sequence $[eqn]$ or $[eqn]$ transmitted from HTP to $[eqn]$ , insert an equivalent number of single particles, and subsequently forward the altered quantum sequence to $[eqn]$ . Through this method, $[eqn]$ might encode the confidential information (identity codes or bidding information) onto these tampered particles. Eve then intercepts again the quantum sequence $[eqn]$ or $[eqn]$ sent from $[eqn]$ to HTP and obtains the identity codes or bidding information. It is noteworthy that the intercepted sequences $[eqn]$ or $[eqn]$ contain decoy particles, with the probability of Eve’s fake particles matching the decoy particles being $[eqn]$ . Without loss of generality, assuming the decoy particles prepared by HTP are in the ∣0〉 state, the detection probabilities for Eve’s fake particles are presented in Table 4.

Therefore, if the decoy particle is in the ∣+〉 state and HTP measures in the Fourier basis, the probability of detecting Eve is

$$[eqn]$$

Similarly, we can compute that the non-detection probabilities for ∣−〉, ∣0〉, and ∣1〉 are all $[eqn]$ .

In summary, the probability that HTP detects Eve’s attack is given by

$$[eqn]$$

where w represents the number of decoy particles (see Figure 10).

Consequently, Eve’s intercept-resend attack introduces an error rate in the eavesdropping detection phase that exceeds the threshold. Particularly when the number of decoy particles is sufficiently large, the probability of detecting the attack approaches 1, thereby effectively countering this attack.

5.1.2. Measure-Resend Attack

In Step 1 or Step 7, Eve intercepts and measures the quantum sequences $[eqn]$ or $[eqn]$ transmitted from HTP to $[eqn]$ . Based on the measurement outcomes, she generates counterfeit quantum sequences $[eqn]$ or $[eqn]$ and transmits them to $[eqn]$ . Through this approach, $[eqn]$ may encode the secret information onto the tampered photons. Eve subsequently intercepts and measures the quantum sequences $[eqn]$ or $[eqn]$ sent from $[eqn]$ to HTP, thereby obtaining the secret information while simultaneously generating fake quantum sequences $[eqn]$ or $[eqn]$ to forward to HTP.

However, Eve possesses no prior knowledge regarding either the positions or preparation bases of the decoy particles. For each decoy particle, Eve has a statistical probability of 50% to select the correct measurement basis. If Eve chooses the correct measurement basis, she can successfully pass the eavesdropping detection. Conversely, if an incorrect basis is selected, Eve will be detected with a probability of $[eqn]$ statistically. Without loss of generality, assuming the decoy particles prepared by HTP are in the ∣+〉 state, the detection probabilities for Eve’s modified particles are presented in Table 5.

Similarly, we can compute that the detection probabilities for ∣−〉, ∣0〉, and ∣1〉 are all $[eqn]$ . Therefore, if the decoy particle is in the ∣+〉 state, the probability of detecting Eve is

$$[eqn]$$

In summary, the probability that HTP detects Eve’s attack is given by

$$[eqn]$$

where w represents the number of decoy particles (see Figure 11).

In practical implementations, the sequence length N is finite. Asymptotic security bounds do not strictly apply. Statistical fluctuations in the estimated error rate must be considered. Let $[eqn]$ be the number of decoy bits. The probability that an attacker’s induced error deviates from the expected value by a margin $[eqn]$ is bounded by Hoeffding’s inequality. To guarantee a security failure probability $[eqn]$ , the threshold $[eqn]$ must be adjusted (lowered) as the sequence length decreases, ensuring that any malicious intervention is statistically distinguishable from channel noise with high confidence.

5.1.3. Trojan Horse Attack

Since the proposed protocol employs symmetric channels, it is vulnerable to Trojan horse attacks. A potential attacker, Eve, could exploit such attacks to intercept the private information of $[eqn]$ . There are two primary types of Trojan horse attacks: delayed-photon attacks and invisible-photon attacks. To counter these attacks, each bidder $[eqn]$ needs to be equipped with both a wavelength quantum filter and a photon-number discriminator. The wavelength filter provides protection against invisible-photon attacks, while the photon-number splitter offers defense against delayed-photon attacks. These two devices have been demonstrated to exhibit strong resistance against Trojan horse attacks. Consequently, our protocol can effectively thwart Trojan horse attacks through the implementation of these devices.

5.2. Internal Attacks on Security

We focus on investigating an extreme case where $[eqn]$ dishonest users collaborate to attack the remaining single honest user. Without loss of generality, assume $[eqn]$ is the honest bidder while $[eqn]$ are dishonest bidders conspiring to attack $[eqn]$ , with the objective of obtaining $[eqn]$ ’s secret information.

In the SQSAA protocol, since each $[eqn]$ and HTP communicate through star-shaped symmetric channels, the dishonest bidders would attempt to intercept particles transmitted between HTP and $[eqn]$ to acquire secret information. In this scenario, the dishonest bidders will be detected as external attackers. According to the protocol specifications, each bidder shares a private key with HTP, and the private key determines the positions of both decoy particles and rotation particles. Since dishonest bidders possess neither the private key shared between HTP and $[eqn]$ nor the information about quantum states prepared by HTP, any attack strategy they employ will inevitably cause quantum state disturbance and transmission errors and ultimately lead to an error rate exceeding the predetermined threshold. That is to say, our protocol can resist attacks from dishonest users.

5.3. Secrecy Capacity Analysis

Generally speaking, any secure communication protocol can be analyzed using the wiretap channel model, wherein the SQSAA protocol the quantum channel serving as the main channel transmits secret information while Eve’s eavesdropping is modeled as the wiretap channel, whose specific model is illustrated in Figure 12.

The secrecy capacity, serving as a fundamental metric for evaluating protocol security in quantum communications, represents the maximum secure information transmission rate between legitimate communicating parties (HTP and $[eqn]$ ) in the presence of eavesdropper Eve, which constitutes a critical parameter in SQSAA protocol analysis [35] and is expressed as $[eqn]$ according to Wyner’s wiretap channel theory.

$$[eqn]$$

where I(X:Y) characterizes the mutual information between random variables X and Y. Since the particles prepared by HTP have equal probabilities of being in $[eqn]$ states, the system exhibits a completely mixed state $[eqn]$ . Under collective attack scenarios, Eve may perform joint operations on both the transmitted qubits and the ancillary qubits she prepares.

$$[eqn]$$

where $[eqn]$ denotes the state of Eve’s prepared ancillary qubit, and U is a unitary operator acting on the joint space of the qubit and ancillary qubit. Eve transmits the qubit to bidder $[eqn]$ while retaining her ancillary qubit until $[eqn]$ forwards the qubit to HTP. Upon reception, $[eqn]$ applies the $[eqn]$ operator with probability p or the $[eqn]$ operator with probability (1 − p) based on secret information, evolving the qubit state to

$$[eqn]$$

where $[eqn]$ and $[eqn]$ . To obtain the secret information, Eve performs coherent measurements on an arbitrary number of qubits and ancillary qubits to distinguish between the quantum states $[eqn]$ and $[eqn]$ encoded by bidder $[eqn]$ , where based on the Holevo bound (whose distinguishing capability is bounded by the Holevo information quantity) we obtain

$$[eqn]$$

where S( $[eqn]$ ) denotes the von Neumann entropy. The von Neumann entropy of the original quantum state $[eqn]$ is $[eqn]$ . Therefore, the maximum mutual information between bidder $[eqn]$ and eavesdropper Eve is

$$[eqn]$$

where $[eqn]$ is the binary Shannon entropy of $[eqn]$ .

$$[eqn]$$

where $[eqn]$ and $[eqn]$ are the detection bit error rate (DBER) in the X-basis and the Z-basis, respectively. Taking into account channel losses, when denoting the maximum accessible qubit rate for Eve as $[eqn]$ , the maximum mutual information between bidder $[eqn]$ and Eve consequently becomes

$$[eqn]$$

Similarly, we denote the reception rate at HTP as $[eqn]$ and calculate the mutual information between the bidder $[eqn]$ and HTP.

$$[eqn]$$

Thus, the secrecy capacity $[eqn]$ becomes

$$[eqn]$$

where g represents the discrepancy rate between $[eqn]$ and $[eqn]$ , which depends on both channel loss and detector efficiency, reaching its maximum value at $[eqn]$ .

5.4. Anonymity Analysis

According to the protocol, HTP transmits the quantum sequence $[eqn]$ to each bidder $[eqn]$ respectively, where the first particle of sequence $[eqn]$ received by the j-th bidder $[eqn]$ serves as the grouping particle. Since this particle is randomly prepared by HTP from $[eqn]$ and the measurements of grouping particles among different bidders are mutually independent. Therefore, the mutual information between them can be quantitatively calculated as

$$[eqn]$$

where $[eqn]$ denotes any dishonest bidder. Any collusion attempt by dishonest bidders to obtain $[eqn]$ ’s identity encoding is bound to fail. Attackers can neither access other bidders’ measurement results nor determine honest bidders’ group affiliation through the first particle, thus failing to reconstruct complete identity encoding. Furthermore, the decoy states introduced by HTP in $[eqn]$ ensure that any external eavesdropping will be detected due to induced errors during eavesdropping detection. Consequently, except for the trusted HTP, no bidder can obtain others’ identity information, guaranteeing the protocol’s anonymity.

The protocol guarantees that bidders cannot ascertain the identities or bids of other participants. However, it is important to note the Trusted HTP Assumption: The HTP knows the mapping between identity codes and real identities. Thus, the protocol provides anonymity against peers and outsiders, but not against the HTP.

5.5. Verifiability and Non-Repudiation Analysis

In Step 10 of the protocol, each bidder computes and submits the hash value of their bid to HTP, establishing a binding commitment since the original bid cannot be deduced without the random nonce. The protocol’s security guarantees non-repudiation, as any bid modification would require finding a new nonce matching the original hash value—a computationally infeasible task even for quantum computers due to the collision-resistant hash function.

Distinction from Channel Disruption: It is crucial to distinguish between channel disruption and repudiation. High QBER (Step 3) indicates an active attack or denial-of-service, leading to a protocol abort. In contrast, Non-Repudiation (Step 13) prevents a legitimate bidder—who has successfully transmitted a valid bid without triggering high QBER—from later denying their submission.

The verification phase (Step 13) requires the highest bidder to reveal their nonce and hash value for public verification, where successful verification leads to HTP disclosing the winner’s identity number and bid amount, while failed verification triggers a complaint mechanism that either initiates a new auction round for validated complaints or maintains the current highest bid for rejected complaints. This commitment verification framework satisfies the protocol’s verifiability requirement while maintaining quantum-resistant security throughout the auction process.

6. Conclusions

We presented a multi-party semi-quantum simultaneous ascending auction protocol based on single-particle states. HTP generates, distributes, and verifies quantum states; bidders determine groups via measurements and encode private identity vectors, obtaining identity codes after HTP authentication. During bidding, HTP dynamically updates sequences, and bidders submit prices for multiple items using only simple unitary operations. HTP announces current highest bids in real time and iteratively regenerates sequences until no higher bids appear, thereby realizing simultaneous multi-item ascending auctions.

The protocol serves as a quantum-secured signaling layer, providing information-theoretic security for bid transmission and identity verification over a classical auction mechanism. The protocol offers several practical advantages over prior art. First, it accommodates heterogeneous participants by requiring only semi-quantum capabilities on the bidder side (Z/X measurements, reflections, and elementary single-qubit operations), and it relies solely on single-particle resources, substantially lowering implementation cost. Second, it scales naturally to multi-item settings: identity is encoded in the first $[eqn]$ particles, while each item uses $[eqn]$ particles for prices, enabling parallel, round-by-round price discovery. Third, the use of per-round hash commitments provides a simple, auditable path for public verification, supporting non-repudiation and complaint resolution without revealing secret randomness until the end.

From a deployment perspective, the protocol parameters are straightforward to tune. The decoy rate and QBER threshold $[eqn]$ control eavesdropping detectability and robustness; the per-item bit width $[eqn]$ balances price granularity and sequence length; and the basic operation set (I, H, $[eqn]$ , Z/X measurements) matches today’s photonic toolchains. Computational and storage complexity at bidders is minimal, and HTP’s classical processing (matrix checks and bit-to-decimal conversion) scales linearly in the number of bidders and items per round.

Finally, we must emphasize that theoretical validity does not automatically translate to immediate real-world applicability. Bridging the gap between our theoretical model and a fully operational real-world deployment remains a significant future challenge. This requires rigorous validation under realistic physical conditions, deep integration with existing technological infrastructures, and further study on practical device imperfections.

There remain limitations and opportunities for future work. The current model assumes a trusted HTP; relaxing this with distributed trust (e.g., threshold HTP, verifiable computation, or lightweight MPC among multiple centers) is an important direction. A finite-size and composable security analysis under realistic device imperfections and channel loss would strengthen the guarantees. On the systems side, building a prototype with time-bin or polarization-encoded photonics, integrating authenticated classical channels, and benchmarking end-to-end latency would support practical adoption. Finally, extending to richer auction formats (e.g., combinatorial or budget-constrained bidding), adaptive increment rules, and privacy-enhanced analytics while preserving semi-quantum feasibility are promising avenues.