Experimental Quantum Message Authentication with Single Qubit Unitary Operation

Abstract

We have developed a quantum message authentication protocol that provides authentication and integrity of an original message using single qubit unitary operations. Our protocol mainly consists of two parts: quantum encryption and a correspondence check. The quantum encryption part is implemented using linear combinations of wave plates, and the correspondence check is performed using Hong–Ou–Mandel interference. By analyzing the coincidence counts of the Hong–Ou–Mandel interference, we have successfully proven the proposed protocol experimentally, and also showed its robustness against an existential forgery.

1. Introduction

Modern cryptography provides four functions, namely, confidentiality, authentication, integrity, and nonrepudiation [1,2]. Therefore, as a substitution candidate for next-level secure cryptography, quantum cryptography should also have the ability to offer these four functions. Remarkable progress has been made in the area of confidentiality because the quantum key distribution (QKD) protocol that provides confidentiality has been considerably improved [3,4,5,6]. QKD aims to enable communication partners, e.g., Alice and Bob, to share secret keys and ultimately perform a one-time pad communication. Those protocols provide unconditional confidentiality based on the principle that an arbitrary unknown quantum state cannot be copied and that quantum measurement is irreversible [7,8,9,10]. On the other hand, many researchers have also studied how to use these secret keys in quantum message authentication [11,12,13], arbitrated quantum signature [14,15,16,17,18,19], or quantum digital signature [20,21,22,23,24,25,26,27,28,29], providing authentication, integrity, and non-repudiation.

In this paper, we introduce a simple and practical quantum message authentication protocol with a quantum three-pass protocol [30,31,32,33] and a quantum encryption scheme [19,34]. This protocol is a lightweight to simplify the implementation by removing an arbitrator from our proposed quantum signature protocol [19]. Here, the quantum three-pass protocol is the quantum version of Shamir’s three-pass protocol [1,35], and quantum encryption scheme is to prevent existential forgery, called Gao’s forgery. More specifically, the core elements of the proposed protocol, such as the quantum three-pass protocol and the quantum encryption scheme, are implemented with only single qubit unitary operators. In other words, these can be implemented easily by using linear combinations of wave plates [36,37]. Additionally, the swap test that checks the correspondence of the original message and quantum message authentication code (QMAC) can be implemented using a Hong–Ou–Mandel interferometer [38,39,40]. In advance, as the Hong-Ou-Mandel interferometer is a destructive swap test [40], more resources are needed to implement a controlled swap test.

In Section 2, we briefly explain the concept of the proposed scheme. Section 3 presents a security analysis of the proposed protocol for Alice’s private key, the forgery of QMAC pair, and the origin authentication of quantum message. Section 4 describes the experimental setup and measurement results. We conducted three experiments with the proposed protocol. First, we implemented a quantum three pass protocol, which is a method of conveying information in the proposed quantum message authentication. Second, we implemented a quantum encryption scheme with a single qubit unitary operator to prevent forgery. Finally, we confirmed that the QMAC pair with the quantum encryption scheme is robust to Gao’s forgery. In Section 5, after a thorough discussion that includes the possibility of expanding the scheme to quantum signature and quantum entity authentication, we present the conclusions of this work.

2. Quantum Message Authentication Protocol

Quantum message authentication, which is similar to conventional message authentication, should provide message integrity and origin authentication. What differentiates quantum message authentication from conventional message authentication [41,42] is that the former uses quantum states $\left|0⟩\right.$ and $\left|1⟩\right.$ as a message represented by a sequence of “0” and “1” bits. In addition, using arbitrary quantum states as a message enables more information to be delivered at once [43,44]. Moreover, there is a significant difference that is described below. In modern cryptography, asymmetric key cryptography easily provides message integrity, message origin authentication, and nonrepudiation. Unfortunately, a quantum asymmetric key cryptosystem based on the quantum trapdoor one-way function do not exist, making the design of quantum authentication and quantum signature protocols difficult. To overcome this difficulty, we propose a new quantum message authentication protocol based on Shamir’s three-pass protocol [1,35]. Shamir’s three pass protocol has the advantage that two parties, e.g., Alice and Bob, can share information without exposing their own private keys. In the implementation, the central idea is that the commutative property [19] of exponential operation in Shamir’s three-pass protocol is implemented using single-qubit rotation operators consisting of linear combinations of wave plates. To our knowledge, this is the first time a quantum message authentication protocol has been proposed using the quantum three-pass protocol, though other applications of the quantum three-pass protocol, such as direct communication [32], quantum key distribution [30], and quantum signature [19], have been proposed theoretically. Figure 1 schematically shows the quantum message authentication protocol that we implemented. Our quantum message authentication protocol consists of preparation, quantum message authentication, and verification phase.

Figure 1. Basic structure of the quantum message authentication protocol based on quantum three-pass protocol. Similar to quantum three-pass protocol, which transmits bits three times, our protocol performs three quantum state transmissions. After three attempts of quantum state transmission, Bob finally acquires quantum message states ${\left|M⟩\right.}_u={\otimes }_{i=1}^N{R}_y\left(m_i\right){\left|\phi ⟩\right.}_u^i$ and ${\left|M\prime ⟩\right.}_d={\otimes }_{i=1}^N{R}_y\left(m_i\right){\left|\phi ⟩\right.}_d^i$. He then uses a swap test twice to confirm the similarity of the two arbitrary quantum states ${\left|M⟩\right.}_u$, ${\left|M\prime ⟩\right.}_d$ and bit message sequence $M$. $K_{AB}$ and $K_H$ denote the secret key sequences that Alice and Bob previously shared. $S$ is the private key sequence that only Alice knows, and $B$ is the one known only to Bob.

2.1. Preparation Phase

In the preparation phase, Alice and Bob pre-share secret key sequences $K_{AB}=\left(k_{AB}^1, k_{AB}^2, \dots , k_{AB}^N \right)$ and $K_H=\left(k_H^1, k_H^2, \dots , k_H^N \right)$ that determine which single-qubit operation is chosen. The sequences $K_{AB}=\left(k_{AB}^1, k_{AB}^2, \dots , k_{AB}^N \right)$ and $K_H=\left(k_H^1, k_H^2, \dots , k_H^N \right)$ are a classical bit sequence with the size of $2N$ and $N$ respectively, where $k_{AB}^i\in \left\{00, 01, 10, 11\right\},$ $k_H^i\in \left\{0, 1\right\}$. The secret keys $k_{AB}^i$ and $k_H^i$ correspond to the Pauli operators ${\sigma }_{k_{AB}^i}\in \left\{I, {\sigma }_x, {\sigma }_y, {\sigma }_z\right\}$ and the operator $H^{k_H^i}\in \left\{H^0=I, H^1=H\right\}$. Here, operator is a linear combination of the Pauli operators $\left\{I, {\sigma }_x, {\sigma }_y, {\sigma }_z\right\}$ and unitary operator $H^{†}H=H{H}^{†}=I$.

$$H=\left(I-i{\sigma }_x-i{\sigma }_y-i{\sigma }_z\right)/2$$

(1)

2.2. Quantum Message Authentication Phase

The quantum message authentication phase is composed of two stages: quantum message generation, QMAC generation, and quantum encryption. In the quantum message generation stage, Alice generates a quantum message state pair

$${\left|M⟩\right.}_u{\left|M⟩\right.}_d=\left[{\otimes }_{i=1}^N{R}_y\left(m_i\right){\left|\phi ⟩\right.}_u^{\left(i\right)}\right]\left[{\otimes }_{i=1}^N{R}_y\left(m_i\right){\left|\phi ⟩\right.}_d^{\left(i\right)}\right]$$

(2)

by applying a single qubit rotation operator

$$R_y\left(m_i\right)=\left(\begin{array}{cc}cos\frac{m_i}{2}& -sin\frac{m_i}{2}\\ sin\frac{m_i}{2}& cos\frac{m_i}{2}\end{array}\right),$$

(3)

where $M=\left(m_1,m_2, m_3, \dots , m_N\right)$ is a rotation angle sequence,$0°\le m_i\le 360°$, and ${\left|\phi ⟩\right.}_u^{\left(i\right)}{\left|\phi ⟩\right.}_d^{\left(i\right)}$ are the logical states $\left|0⟩\left|0⟩\right.\right.$ or $\left|1⟩\left|1⟩\right.\right.$, corresponding to horizontally polarized photons $\left|H⟩\left|H⟩\right.\right.$ and vertically polarized photons $\left|V⟩\left|V⟩\right.\right.$, respectively. The superscript $\left(i\right)$ denotes the $i$ th qubit, and subscripts $u$ and $d$ denote up and down, corresponding to the up-line and down-line, respectively, of the experimental setup used for our protocol. The rotation angle sequence $M=\left(m_1,m_2, m_3, \dots , m_N\right)$ is a bit message sequence, and we assume that it has already been published in public as in the case of a contract or an official document. The reason for publishing $M$ is to prevent Alice from attempting to forge using a modulated QMAC pair, which is discussed in detail in Section 3.2 impossibility of forgery.

In the QMAC generation stage, Alice encrypts the quantum message pair ${\left|M⟩\right.}_u{\left|M⟩\right.}_d$ of Equation (2) by using a single qubit rotation operator $R_y\left(s_i\right)$;

$$\begin{gathered} {\left|M⟩\right.}_u{\left|S⟩\right.}_d \\ ={\left|M⟩\right.}_u\left[{\otimes }_{i=1}^N{R}_y\left(s_i\right){\left|M⟩\right.}_d\right] \\ =\left[{\otimes }_{i=1}^N{R}_y\left(m_i\right){\left|\phi ⟩\right.}_u^{\left(i\right)}\right]\left[{\otimes }_{i=1}^N{R}_y\left(s_i\right)R_y\left(m_i\right){\left|\phi ⟩\right.}_d^{\left(i\right)}\right]. \end{gathered}$$

(4)

Here, $S=\left(s_1,s_2, s_3, \dots , s_N\right)$ is a rotation angle sequence, $0°\le s_i\le 360°$. In addition, $S$ is a private key known only to Alice. Furthermore, we call ${\left|M⟩\right.}_u{\left|S⟩\right.}_d$ to a QMAC state pair.

In the quantum encryption stage, Alice applies quantum encryption ${\sigma }_{k_{AB}^i}{H}^{k_H^i}$ to the QMAC state pair ${\left|M⟩\right.}_u{\left|S⟩\right.}_d$ of Equation (4);

$${\left|M⟩\right.}_u\left[{\otimes }_{i=1}^N{\sigma }_{k_{AB}^i}{H}^{k_H^i}{\left|S⟩\right.}_d\right].$$

(5)

Here, ${\left|M⟩\right.}_u\left[{\otimes }_{i=1}^N{\sigma }_{k_{AB}^i}{H}^{k_H^i}{\left|S⟩\right.}_d\right]$ is an encrypted QMAC state pair, and then she sends it to Bob. This quantum encryption is an essential function for verifying that the entity sending the QMAC pair is Alice and for protecting against forgery.

The rotation angles $m_i$ and $s_1$ are the elements of the finite discrete variable set. For applying them to real protocols, Alice and Bob must preset the range of the finite discrete variable set and pre-decide how to divide the set range. For example, if Alice and Bob split the rotation angle from $0° \mathrm{to} 360°$ in intervals of $10°$, then the finite discrete variable set becomes $\left\{0°,10°, 20°, \dots , 350°\right\}$. Here, the size of the discrete variable set is determined by the performance of the experimental apparatus. Therefore, as the performance of experimental apparatus improves, the size of the discrete variable set increases. Increasing the size of the discrete variable set means that the rotation angle can be subdivided, and this can lead to authenticating more information compared with using the four states of the BB84 protocol. On the other hand, If the performance of the experimental apparatus is poor, the size of the discrete variable set decreases. Then, the rotation angle cannot be subdivided, and information that can be authenticated decreases. Additionally, in this situation, if the communication members use the subdivided rotation angles to such an extent that the experimental apparatus cannot distinguish, detecting the malicious behavior of Eve is impossible.

2.3. Verification Phase

The verification phase is divided into five stages: “quantum decryption”, “Bob’s encryption”, “QMAC recovery”, “Bob’s decryption”, and “swap test”. In Stage 1, for quantum decryption, Bob uses secret key sequences $K_{AB}$ and $K_H$, which were pre-shared with Alice to decrypt the encrypted QMAC state pair ${\left|M⟩\right.}_u\left[{\otimes }_{i=1}^N{\sigma }_{k_{AB}^i}{H}^{k_H^i}{\left|S⟩\right.}_d\right]$ in Equation $\left(5\right)$, received from Alice to obtain the QMAC state pair ${\left|M⟩\right.}_u{\left|S⟩\right.}_d$ of Equation $\left(4\right)$. In Stage 2, Bob’s encryption, Bob generates his own private key sequence $B=\left(b_1, b_2, \dots , b_N\right)$ and re-encrypts quantum state ${\left|S⟩\right.}_d={\otimes }_{i=1}^N{R}_y\left(s_i\right){\left|M⟩\right.}_d$ with it to obtain quantum state ${\left|S\prime ⟩\right.}_d={\otimes }_{i=1}^N{R}_y\left(b_i\right){\left|S⟩\right.}_d$. Then, he sends ${\left|S\prime ⟩\right.}_d$ to Alice while keeping the other quantum message state ${\left|M⟩\right.}_u$. In Stage 3, QMAC recovery, Alice uses her own private key sequence $S$ to apply rotation operator ${\otimes }_{i=1}^N{R}_y\left(-s_i\right)$ to quantum state ${\left|S\prime ⟩\right.}_d$ and sends quantum state ${\left|S\prime \prime ⟩\right.}_d={\otimes }_{i=1}^N{R}_y\left(-s_i\right){\left|S\prime \right.}_d$ to Bob. In Stage 4, Bob’s decryption, Bob uses his own private key sequence $B$ and applies rotation operator ${\otimes }_{i=1}^N{R}_y\left(-b_i\right)$ to quantum state ${\left|S\prime \prime ⟩\right.}_d$ to obtain quantum message state ${\left|M\prime ⟩\right.}_d={\otimes }_{i=1}^N{R}_y\left(-b_i\right){\left|S\prime \prime ⟩\right.}_d$. Because the proposed quantum message authentication based on the quantum three-pass protocol operates Alice’s private key $s_i$, there is a need for a method to verify the encrypted QMAC pair described thus far. This is an important element that the proposed protocol can guarantee the origin of quantum message. In addition, to avoid counterfeiting, it is assumed that quantum encryption such as ${\sigma }_{k_{AB}^i}{H}^{k_H^i}$ in Equation $\left(5\right)$ is applied to Alice and Bob in every process of exchanging quantum states.

In the final stage, Bob performs the swap test [42,45] twice to verify the QMAC state pair. In the first swap test, Bob verifies whether quantum message state ${\left|M⟩\right.}_u$ and quantum message state ${\left|M\prime ⟩\right.}_d$ are the same. If the test result reveals that ${\left|M⟩\right.}_u$ and ${\left|M\prime ⟩\right.}_d$ agree, Bob accepts QMAC state pair ${\left|M⟩\right.}_u{\left|S⟩\right.}_d$ sent by Alice. Otherwise, he does not accept it. In the second swap test, Bob generates quantum state $\left|M\prime \prime ⟩\right.$ corresponding to the public bit message sequence $M$ and verifies that it matches quantum message state ${\left|M⟩\right.}_u$ or ${\left|M\prime ⟩\right.}_d$. If the test result reveals that ($\left|M\prime \prime ⟩\right.$, ${\left|M⟩\right.}_u$) or ($\left|M\prime \prime ⟩\right.$, ${\left|M\prime ⟩\right.}_d$) agree, then the integrity of QMAC state pair ${\left|M⟩\right.}_u{\left|S⟩\right.}_d$ is verified completely. For the second swap test, it is noted that the first swap test requires a non-demolition swap test. Figure 2 shows the swap test in the circuit, and the result of inputting

$${\left|m_i⟩\right.}_u=R_y\left(m_i\right){\left|\phi ⟩\right.}_u^{\left(i\right)}$$

(6)

and

$${\left|m_i^{\prime }⟩\right.}_d=R_y\left(m_i^{\prime }\right){\left|\phi ⟩\right.}_d^{\left(i\right)}$$

(7)

in the second and third lines of the circuit is expressed as follows:

$$\frac{1}{\sqrt{2}}{\left|0⟩\right.}_{ancilla}\left[\frac{1}{\sqrt{2}}\left({\left|m_i⟩\right.}_u{\left|m_i^{\prime }⟩\right.}_d+{\left|m_i^{\prime }⟩\right.}_u{\left|m_i⟩\right.}_d\right)\right]+\frac{1}{\sqrt{2}}{\left|1⟩\right.}_{ancilla}\left[\frac{1}{\sqrt{2}}\left({\left|m_i⟩\right.}_u{\left|m_i^{\prime }⟩\right.}_d-{\left|m_i^{\prime }\right.}_u{\left|m_i⟩\right.}_d\right)\right].$$

(8)

Figure 2. Circuit of the quantum swap test. “SWAP” indicates a swap gate, and $U_H$ represents a Hadamard gate. “MS” represents quantum measurement, and the single lines and the double line represent the quantum channel and classical channel, respectively.

If ${\left|m_i⟩\right.}_u$ and ${\left|m_i^{\prime }⟩\right.}_d$ agree, the above equation becomes ${\left|0⟩\right.}_{ancilla}\left[\frac{1}{\sqrt{2}}\left({\left|m_i⟩\right.}_u{\left|m_i^{\prime }⟩\right.}_d+{\left|m_i^{\prime }⟩\right.}_u{\left|m_i⟩\right.}_d\right)\right]$, which makes the measurement outcome of the ancilla state to always be $\left|0⟩\right.$. However, if ${\left|m_i⟩\right.}_u$ and ${\left|m_i^{\prime }⟩\right.}_d$ do not agree, the measurement outcome becomes $\left|0⟩\right.$ with a probability $\left(1+{\epsilon }^2\right)/2$ or becomes $\left|1⟩\right.$ with a probability $\left(1+{\epsilon }^2\right)/2$, where $\epsilon ={|}_d⟨m_i^{\prime }\left|m_i{⟩}_u\right|$ and $0\le \epsilon \le 1$. Therefore, if the swap test result of the measurement is $\left|1⟩\right.$, we know that ${\left|m_i⟩\right.}_u$ and ${\left|m_i^{\prime }⟩\right.}_d$ are different. If the result is $\left|1⟩\right.$, we cannot guarantee that ${\left|m_i⟩\right.}_u$ and ${\left|m_i^{\prime }⟩\right.}_d$ are the same. The parameter $\epsilon$ is determined by the arbitrary quantum state components ${\left|m_i⟩\right.}_u$ of Equation $\left(6\right)$ and ${\left|m_i^{\prime }⟩\right.}_d$ of Equation $\left(7\right)$. If the two rotation angles $m_i$ and $m_i^{\prime }$ are the same, i.e., $m_i=m_i^{\prime }$, then the value of parameter $\epsilon$ is $1$. On the other hand, if the difference between $m_i$ and $m_i^{\prime }$ is $180°$, i.e., $m_i=m_i^{\prime }\pm 180°$, then the parameter $\epsilon$ is $0$. As a result, according to rotation angles $m_i$ and $m_i^{\prime }$, the parameter $\epsilon$ has a value between 0 and 1, $0\le \epsilon \le 1$. Further, the probability of failure in the verification phase is the total error probability $P_e$ for $N$ qubits as follows:

$$P_e\le {\otimes }_{i=1}^N\left[\left(1+{{|}_d⟨m_i^{\prime }\left|m_i{⟩}_u\right|}^2\right)/2\right]$$

(9)

Therefore, it is expected that the swap test will work well even though the quantum state sequence is finite. Hence, the probability of failure in the verification phase becomes lower, approaching $P_e$ as the size of the quantum state sequence $N$ becomes considerably larger [42,45]. For an arbitrary ${\left|m_i⟩\right.}_u$, a random choice for ${\left|m_i^{\prime }⟩\right.}_d$ on the $R_y\left(m_i^{\prime }\right)$—rotation circle, the average of ${\epsilon }^2$ is $1/2$. In this case, the upper bound of the total error probability $P_e$ is ${\left(3/4\right)}^N$. If the size of the quantum state sequence is $15$, then the upper bound of the total error probability $P_e$ is only approximately $1.3\%$. Therefore, it is expected that the swap test will work well even though the quantum state sequence is finite.

3. Security Analysis

3.1. Security of Alice’s Private Key

Eve, including Bob, may try to obtain Alice’s private key. Especially, as described in Section 2.3, malicious Bob may try to know Alice’s private key sequence $S=\left(s_1,s_2, s_3, \dots , s_N\right)$, which consists of the degrees of rotation about $\widehat{y}$-axis from ${\left|S⟩\right.}_d={\otimes }_{i=1}^N{R}_y\left(s_i\right){\left|M⟩\right.}_d$ in Equation $\left(4\right)$. However, the security of Alice’s private key sequence $S$ is guaranteed by Holevo’s theorem, as follows [19,32]:

$$I\left(x,S\right)\le V\left(\rho \right)\le H\left(S\right)$$

(10)

Here, $H\left(S\right)$ is the Shannon entropy of the sequence of arbitrary rotation angle $s_i$, $V\left(\rho \right)$ is the von Neumann entropy of mixed state $\rho$ that Eve can acquire through the arbitrary measurement of the quantum state ${\left|S⟩\right.}_d={\otimes }_{i=1}^N{R}_y\left(s_i\right){\left|M⟩\right.}_d$, and $I\left(x,S\right)$ is the mutual information between arbitrary rotation $s_i$ and measurement outcomes $x$. As we can see in Equation $\left(10\right)$, the amount of mutual information about the arbitrary rotation angle sequence $S$ that Bob acquires using measurement outcomes $x$ is limited, and thus, it is impossible for Eve to obtain the information of $S$. Based on the same principle, the security of Bob’s private key sequence $B=\left(b_1,b_2, b_3, \dots , b_N\right)$ is guaranteed.

3.2. Impossibility of Forgery

Many quantum message authentication and signature protocols use quantum encryption implemented by Pauli operators to ensure message integrity and message origin authentication. A QMAC pair (or quantum signature pair), which is composed of a quantum message and an encrypted quantum message, checks the forgery and modulation of the QMAC pair (or quantum signature pair) using a swap test [34]. As described in Section 2.3, Bob validates the original quantum message state ${\left|M⟩\right.}_u$ and the recovered quantum message state ${\left|M\prime ⟩\right.}_d$ from the QMAC state pair of Equation $\left(4\right)$ using the swap test. Bob can be sure that ${\left|M⟩\right.}_u$ and ${\left|M\prime ⟩\right.}_d$ are the same quantum state from the outcomes of the swap test. However, it is not known whether they match the original message $M$. Because of the limitations of this swap test, the proposed protocol can be falsified in two ways.

The first falsification method is that Alice creates a modulated QMAC pair

$$I\left(x,S\right)\le V\left(\rho \right)\le H\left(S\right)$$

(11)

with the two same quantum states ${\left|\tilde{M}⟩\right.}_u$ and ${\left|\widetilde{M\prime }⟩\right.}_d$ that do not correspond to the original message $M$ and sends it to Bob. In this case, Bob cannot detect Alice’s malicious behaviour even if he verifies that the two quantum states ${\left|\tilde{M}⟩\right.}_u$ and ${\left|\widetilde{M\prime }⟩\right.}_d$ are the same from the QMAC pair by using the swap test. To prevent this, Alice must disclose message $M$. Additionally, Bob needs an additional process to validate $\left|M\prime \prime ⟩\right.$, which is converted to a quantum state, and ${\left|M⟩\right.}_u$ or ${\left|M\prime ⟩\right.}_d$ by using the swap test.

Second, Eve can try Gao’s forgery to apply Pauli operators to a QMAC pair [34,46]. Recently, Gao et al. showed that even if an adversary applies the arbitrary Pauli operator to the QMAC pair (or quantum signature pair), the swap test could not detect it because of the commutation relation of Pauli operators [46]. This is called Gao’s forgery, and it can be considered as an existential forgery [34] of modern cryptosystems because it randomly forges QMAC pairs (or quantum signature pairs), which are arbitrary quantum states. The posing of this security problem by Gao et al. was a major turning point in the study of quantum message authentication (or quantum signature) protocols. In 2011, Choi et al. proposed the (I, H)- or (U, V)-type quantum encryption scheme to cope with Gao’s forgery [47,48]. In 2013, Zhang et al. pointed out that the encryption scheme of Choi et al. was still insecure against Gao’s forgery, and instead they proposed the key-controlled-"I" quantum one-time pad or key-controlled-"T" quantum one-time pad [49,50] as an alternative. The four unitary operators of the controlled-I quantum one-time pad are $W_{00}=\left({\sigma }_x+{\sigma }_z\right)/\sqrt{2}$, $W_{01}=\left({\sigma }_y+{\sigma }_z\right)/\sqrt{2}$, $W_{10}=\left(I+i{\sigma }_x-i{\sigma }_y+i{\sigma }_z\right)/\sqrt{2}$, and $W_{10}=\left(I+i{\sigma }_x+i{\sigma }_y+i{\sigma }_z\right)/\sqrt{2}$. However, the encryption scheme of Zhang et al. is not easy to implement with simple hardware. In contrast, we propose a quantum encryption scheme with a single qubit unitary operation by randomly using unitary operator $H$, which can be easily implemented by controlling wave plates and an authentication protocol. Therefore, the proposed protocol is robust against an existential forgery. Section 4.3 in Ref. [22] shows that unitary operators can be used randomly to prevent Gao’s forgery. The detailed implementation of our experimental setup and the testing results of the quantum three-pass protocol and security against Gao’s forgery are described in Section 4. Finally, to prevent Gao’s forgery in the proposed protocol, the quantum encryption scheme should be applied to all processes in which Alice and Bob exchange quantum states.

3.3. Origin Authentication of Quantum Message

To clarify the origin of the quantum message, the proposed quantum message authentication operates by using not only the secret key pre-shared by Alice and Bob but also Alice’s private key. In general, message authentication guarantees the origin of message authentication by using a secret key previously shared by Alice and Bob. At this time, as the user who can create a message authentication code (MAC) pair can be Alice or Bob, the origin of the message may become unclear. On the other hand, in the proposed protocol, Alice generates a QMAC pair ${\left|M⟩\right.}_u{\left|S⟩\right.}_d$ of Equation $\left(4\right)$ by using a private key sequence $S=\left(s_1,s_2, s_3, \dots , s_N\right)$ known only to her; thus, the possibility of such a dispute is very low.

4. Experiment Setup and Measurement Results

Figure 3a shows the implementation setup of our proposed quantum message authentication protocol. With this setup, we have experimentally proved that the proposed QMAC is robust against existential forgery. Each stage is implemented with a linear combination of wave plates; that is, the y-axis rotation operator $R_y\left(\theta \right)$, the unitary operator $H$, and the Pauli operators are implemented by combinations of half-wave plates (HWPs) and quarter-wave plates (QWPs). Figure 3b schematically shows a possible forgery attack that Eve can try. Eve can attempt a forgery attack using the same Pauli operators ${\sigma }_{e_i}={\sigma }_{e_i^{\prime }}$ [46], or she can attempt a forgery attack using different Pauli operators ${\sigma }_{e_i}\ne {\sigma }_{e_i^{\prime }}$ [49,50]. We define these two approaches as an original and improved Gao’s Forgeries, respectively. To prevent Gao’s forgeries, we need to choose unitary operator $H$ randomly. We explain this in detail at the end of this section.

Figure 3. Schematic representation of the experimental setup for the quantum message authentication protocol and an existential forgery. (a) Quantum message authentication protocol: the blue box represents Alice’s operation, and the green box represents Bob’s operation. $m_i$ is the rotation angle that indicates message. $k_{AB}^i$, $k_H^i$, $s_i$, and $b_i$ are the same as in Figure 1. (b) Existential forgery: Eve can attempt forgery on the quantum message authentication code (QMAC) state pair using Pauli operators when Alice transmits the encrypted QMAC state pair to Bob.

We assume that Alice and Bob have already pre-shared the secret key sequences in the preparation phase. For the message authentication phase, we implemented message generation, QMAC generation, and quantum encryption using wave plates on Alice’s side. To create correlated photon pairs, Type-I spontaneous parametric down-conversion (SPDC) photon pairs were generated in a beta barium borate (BBO) crystal pumped by a multimode diode laser with a 408-nm wavelength. The SPDC photon pairs have the same H-polarization and an 816-nm wavelength. The photon pairs are emitted with a noncollinear angle of $3.3°$. One of the photons goes through only the rotation operator for message generation, and the other experiences the sequence of operations from message generation through the quantum encryption scheme with a single qubit unitary operator. Then, they are delivered to Bob. For the verification phase, one photon is kept on Bob’s side, and the other photon experiences quantum decryption and Bob’s encryption implemented by the wave plate, after which Bob sends it to Alice. Alice then decrypts it by using QMAC recovery. In our experiment, we installed the QMAC recovery stage between Bob’s encryption and Bob’s decryption for convenience of implementation; it is marked by yellow shading in Figure 3a. Finally, after Bob’s decryption, the swap test that verifies the agreement of the two photon sequences is performed using the Hong–Ou–Mandel interferometer. The Hong–Ou–Mandel dip confirms the similarity between the two photons, which is the last step of the implementation of the proposed quantum message authentication protocol.

In other words, the realization of the quantum three-pass protocol, quantum encryption scheme, and the robustness of Gao’s forgery can be confirmed by the Hong–Ou–Mandel Dip. Hong–Ou–Mandel interference is the same as the destructive swap test [40]. Because the destructive swap test does not have an ancilla qubit unlike the controlled swap test, the two quantum states that are compared are directly measured and collapsed. For this reason, we performed only the first swap test in the two swap tests shown in Figure 1. To implement the second swap test in Figure 1 using Hong–Ou–Mandel interference, there is a need for more resources (e.g., single photons and wave plates) than the current experimental setup. There are other ways to implement a second swap test by using an experimental controlled swap gate that was recently implemented [51].

We tested the feasibility of our protocol with the experimental setup for the case without Gao’s forgery. First, we verified that the quantum three-pass protocol (Figure 3) was working correctly. As shown in Figure 4a, when the half-wave plate $\mathrm{H}1\prime$s angle $s_i/4$ is $-{120}^{°}$, the coincidence count reaches its minimum at the half-wave plate $\mathrm{H}3\prime$s angles $-s_i/4={30}^{°}, {120}^{°}$ as expected. This indicates that Alice generates the QMAC state by applying rotation operator $R_y\left(-{120}^{°}\right)$ and then uses rotation operator $R_y\left(-{120}^{°}\pm \pi n/2\right)$ to recover the QMAC state, where $n$ is an integer, because the period of the half-wave plate is $\pi /2$. The red plots represent the averages of the coincidence counts over one second. In Figure 4b, we recognize that Bob’s encryption and decryption also work well. When the half-wave plate $\mathrm{H}2\prime$s angle $b_i/4$ is $-{60}^{°}$, the Hong–Ou–Mandel dip occurs at the half-wave plate $\mathrm{H}4\prime$s angles $-b_i/4={60}^{°}, {150}^{°}$. Bob uses rotation operator $R_y\left(-{60}^{°}\right)$ to re-encrypt the QMAC state, and then he decrypts the re-encrypted QMAC state by applying rotation operator $R_y\left({60}^{°}\pm \pi n/2\right)$, where $n$ is an integer. In Figure 4, the experimental data are the average of $10$ measurements per $10$ s.

Figure 4. Coincidence counts of the quantum three-pass protocol. The red plots indicate the average of the coincidence counts for one second. The red bars indicate the standard deviation of the coincidence counts for each point. The blue solid line indicates the sine curve fitted to the data. (a) Test for QMAC generation and recovery. (b) Test for Bob’s encryption and decryption.

During this time, the averages of single counts were $27,000$ and $27,000$, respectively, and coincidence windows are $5$ ns; the maximum value of the coincidence counts after accidental coincidences were removed was $127$, and the minimum value was $2$.

Second, we tested the quantum encryption and decryption. If Alice and Bob are proper users who previously shared secret key sequences $K_{AB}$ and $K_H$ then the quantum message states ${\left|M⟩\right.}_u$ and ${\left|M\prime ⟩\right.}_d$ should be identical. Bob can check the correspondence of these states using the Hong–Ou–Mandel interferometer [38,39]. Figure 4 shows the experimental results for Alice’s quantum encryption and Bob’s quantum decryption. $P_c$ is the coincidence probability of Hong–Ou–Mandel interference, and ${\overline{P}}_c=1-P_c$ represents the probability of two quantum message states matching. Figure 5a,b represents whether operator $H$ exists or not, respectively. Although theoretically, the red blocks on the diagonal in both cases should be $100\%$, experimentally they are greater than $82\%$ and $76\%$, respectively. On the other hand, the blue blocks off the diagonal, when Alice and Bob share different secret keys $k_{AB}^i$ and $k_H^i$, ${\left|M⟩\right.}_u$ and ${\left|M\prime ⟩\right.}_d$ have different quantum states, and the respective probabilities are less than $41\%$ and less than $46\%$. Considering that theoretically ${\overline{P}}_c$ can only have less than $50\%$, the measurement results prove that our scheme works well. From these results, we can conclude that the encryption operates properly because ${\overline{P}}_c$ is greater than $76\%$ in the case of the same operators and ${\overline{P}}_c$ is less than $46\%$ in the case of different operators regardless of the existence of operator $H$. The above theoretical values are derived from the success probability ${ϵ}^2={{|}_d⟨{\psi }_i^{\prime }\left|{\psi }_i{⟩}_u\right|}^2$ of the swap test, with ${\left|{\psi }_i⟩\right.}_u=U_i{R}_y\left(m_i\right){\left|0⟩\right.}_u^{\left(i\right)}$, ${\left|{\psi }_i^{\prime }⟩\right.}_d=U_i^{\prime }{R}_y\left(m_i\right){\left|0⟩\right.}_d^{\left(i\right)}$, $U_i,U_i^{\prime }\in \left\{I, {\sigma }_x,{\sigma }_y,{\sigma }_z, H, {\sigma }_{x}H,{\sigma }_{y}H,{\sigma }_{z}H\right\}$, and $m_i={135}^{°}$. Errors in the experiment shown in Figure 5 could be due to an inherent error of the swap test, birefringence in the beam splitter, and/or systematic errors in the wave-plate setting [38,39,42,45].

Figure 5. $P_c$ is the coincidence probability of the quantum encryption scheme with a single qubit unitary operator for quantum message authentication. ${\overline{P}}_c=1-P_c$ represents the probability of two quantum message states being matched. In (a), ${\overline{P}}_c$ corresponds to the quantum encryption scheme with a single qubit unitary operator that Alice and Bob can select when secret key $k_H^i$ of Alice and Bob is zero. In (b), ${\overline{P}}_c$ corresponds to every type of quantum encryption with single qubit unitary operator that Alice and Bob can select when secret key $k_H^i$ of Alice and Bob is one. In this experiment, message $m_i$ was set to ${135}^{°}$.

From the measurement results given in Figure 4 and Figure 5, we have demonstrated that our implementation succeeds in realizing the proposed protocol. Although there are some errors due to unavoidable imperfections of the realization, our practical implementation still performs message integrity and message origin authentication successfully only if our protocol is applied to multiple bits sequentially and analyzed statistically.

Gao et al. demonstrated the possibility of existential forgery in the case of quantum message authentication that includes a swap test [34,46,48]. In other words, if the QMAC state pair that Alice generates is not encrypted, Alice cannot detect Eve’s intervention. In the quantum encryption ${\sigma }_{k_{AB}^i}{H}^{k_H^i}$ in Equation $\left(5\right)$, the secret key $k_{AB}^i\in \left\{00, 01, 10, 11\right\}$ and $k_H^i\in \left\{0, 1\right\}$ correspond to the Pauli operator ${\sigma }_{k_{AB}^i}\in \left\{I, {\sigma }_x, {\sigma }_y, {\sigma }_z\right\}$ and the operator $H^{k_{AB}^i}\in \left\{I, H\right\}$ of quantum encryption with a single qubit unitary operator, respectively. The two bits information $e_i\in \left\{00, 01, 10, 11\right\}$ corresponds to the Pauli operator ${\sigma }_{e_i}\in \left\{I, {\sigma }_x, {\sigma }_y, {\sigma }_z\right\}$ for Gao’s Attack. For example, if $k_{AB}^i=01$, $k_H^i=0$, an encrypted QMAC state pair is

$${\left|M⟩\right.}_u\left[{\mathsf{\sigma }}_{01}{H}^0{\left|S⟩\right.}_d\left]={\left|M⟩\right.}_u\right[{\mathsf{\sigma }}_{\mathrm{x}}{\left|S⟩\right.}_d\right]$$

(12)

In addition, the forged QMAC state pair by Eve’s Pauli operator ${\mathsf{\sigma }}_{10}\left(={\mathsf{\sigma }}_{\mathrm{y}}\right)$ is

$${\mathsf{\sigma }}_{10}{\left|M⟩\right.}_u\left[{\mathsf{\sigma }}_{10}{\mathsf{\sigma }}_{01}{H}^0{\left|S⟩\right.}_d\right]={\mathsf{\sigma }}_{\mathrm{y}}{\left|M⟩\right.}_u\left[{\mathsf{\sigma }}_{\mathrm{y}}{\mathsf{\sigma }}_{\mathrm{x}}{\left|S⟩\right.}_d\right]$$

(13)

The forged QMAC state pair of Equation $\left(13\right)$ transforms into the following state after a decryption process:

$${\mathsf{\sigma }}_{10}{\left|M⟩\right.}_u\left[{\left(H^{†}\right)}^0{\mathsf{\sigma }}_{01}{\mathsf{\sigma }}_{10}{\mathsf{\sigma }}_{01}{H}^0{\left|S⟩\right.}_d\right]={\mathsf{\sigma }}_{\mathrm{y}}{\left|M⟩\right.}_u\left[{\mathsf{\sigma }}_{\mathrm{x}}{\mathsf{\sigma }}_{\mathrm{y}}{\mathsf{\sigma }}_{\mathrm{x}}{\left|S⟩\right.}_d\right]={\mathsf{\sigma }}_{\mathrm{y}}{\left|M⟩\right.}_u\left[-{\mathsf{\sigma }}_{\mathrm{y}}{\left|S⟩\right.}_d\right].$$

(14)

Assuming that ${\left|M⟩\right.}_u$ and ${\left|S⟩\right.}_d$ of Equation $\left(14\right)$ are the same, Eve succeeded in attacking because the Pauli operator ${\mathsf{\sigma }}_{\mathrm{y}}$ remained in the first and second qubits of Equation $\left(14\right)$. This is the first method to forge the quantum message code or quantum signature pair proposed by Gao et al. [34,46,48].

As another example, if $k_{AB}^i=01,k_H^i=1$, an encrypted QMAC state pair is

$${\left|M⟩\right.}_u\left[{\mathsf{\sigma }}_{01}{H}^1{\left|S⟩\right.}_d\left]={\left|M⟩\right.}_u\right[{\mathsf{\sigma }}_{\mathrm{x}}H{\left|S⟩\right.}_d\right].$$

(15)

The forged QMAC state pair by Eve’s Pauli operator ${\mathsf{\sigma }}_{10}\left(={\mathsf{\sigma }}_{\mathrm{y}}\right)$ is

$${\mathsf{\sigma }}_{10}{\left|M⟩\right.}_u\left[{\mathsf{\sigma }}_{10}{\mathsf{\sigma }}_{01}{H}^1{\left|S⟩\right.}_d\left]={\mathsf{\sigma }}_{\mathrm{y}}{\left|M⟩\right.}_u\right[{\mathsf{\sigma }}_{\mathrm{y}}{\mathsf{\sigma }}_{\mathrm{x}}H{\left|S⟩\right.}_d\right].$$

(16)

The forged QMAC state pair transforms into the following state after a decryption process:

$${\mathsf{\sigma }}_{10}{\left|M⟩\right.}_{\mathrm{u}}\left[{\left(H^{†}\right)}^1{\mathsf{\sigma }}_{01}{\mathsf{\sigma }}_{10}{\mathsf{\sigma }}_{01}{H}^1{\left|S⟩\right.}_{\mathrm{d}}\right]={\mathsf{\sigma }}_{\mathrm{y}}{\left|M⟩\right.}_u\left[H^{†}{\mathsf{\sigma }}_{\mathrm{x}}{\mathsf{\sigma }}_{\mathrm{y}}{\mathsf{\sigma }}_{\mathrm{x}}H{\left|S⟩\right.}_d\left]={\mathsf{\sigma }}_{\mathrm{y}}{\left|M⟩\right.}_1\right[-{\mathsf{\sigma }}_{\mathrm{x}}{\left|S⟩\right.}_2\right]$$

(17)

Despite the assumption that ${\left|M⟩\right.}_u$ and ${\left|S⟩\right.}_d$ of Equation $\left(17\right)$ are the same, Eve’s attack is unsuccessful. The reason is that the Pauli operators ${\mathsf{\sigma }}_{\mathrm{y}}$ and ${\mathsf{\sigma }}_{\mathrm{x}}$ remained in the first and second qubits of Equation $\left(17\right)$, respectively. This is the (I, H)-type quantum encryption proposed to overcome Gao’s forgery [47]. Zhang et al., however, showed that the (I, H)-type quantum encryption is not secure for improved Gao’s forgery [49,50]. We [19,34] overcome the original Gao’s forgery [46] or the improved Gao’s forgery [49,50] with quantum encryption ${\mathsf{\sigma }}_{k_{AB}^i}{H}^{k_H^i}$, which randomly uses operator $H.$ Here, the number of all possible cases of quantum encryption ${\mathsf{\sigma }}_{k_{AB}^i}{H}^{k_H^i}\in \left\{I,{ \mathsf{\sigma }}_{\mathrm{x}},{ \mathsf{\sigma }}_{\mathrm{y}},{ \mathsf{\sigma }}_{\mathrm{z}}, H,{ \mathsf{\sigma }}_{\mathrm{x}}H,{ \mathsf{\sigma }}_{\mathrm{y}}H,{ \mathsf{\sigma }}_{\mathrm{z}}H\right\}$ is 8. Furthermore, except ${\mathsf{\sigma }}_{e_i}=I$, there are three possible ways that Eve can attack with ${\mathsf{\sigma }}_{e_i}$. Therefore, there are a total of 24 forgery cases using the Pauli operator ${\mathsf{\sigma }}_{e_i}$ in the encrypted QMAC state pair ${\left|M⟩\right.}_u\left[{\mathsf{\sigma }}_{k_{AB}^i}{H}^{k_H^i}{\left|S⟩\right.}_d\right]$ of Equation $\left(5\right)$ in the manuscript, Table 1 lists these 24 cases, and Figure 6 shows the results of the experiment with the existential forgery using the Pauli operator for 12 cases in Table 1.

Table 1. A total of 24 forgery cases using the Pauli operator $e_i\in \left\{{\sigma }_x, {\sigma }_y, {\sigma }_z\right\}$ in the encrypted QMAC state pair ${\left|M⟩\right.}_u\left[{\mathsf{\sigma }}_{k_{AB}^i}{H}^{k_H^i}{\left|S⟩\right.}_d\right]$. Here, ${\mathsf{\sigma }}_{e_i}\in \left\{{\sigma }_x, {\sigma }_y, {\sigma }_z\right\}$, ${\mathsf{\sigma }}_{k_{AB}^i}\in \left\{I, {\sigma }_x, {\sigma }_y, {\sigma }_z\right\}$, and $H^{k_H^i}\in \left\{I, H\right\}$. We assume that the quantum states ${\left|M⟩\right.}_u$ and ${\left|S⟩\right.}_d$ are the same. The yellow shade represents the case where the operator ${\sigma }_z$ is not used for quantum encryption or Gao’s forgery.

${\mathit{H}}^{{\mathit{k}}_{\mathit{H}}^{\mathit{i}}}$	${\mathit{\sigma }}_{{\mathit{k}}_{\mathit{A}\mathit{B}}^{\mathit{i}}}$	${\mathit{\sigma }}_{{\mathit{e}}_{\mathit{i}}}$	Up(u) Qubit	Down(d) Qubit
$H^0=I$	${\mathsf{\sigma }}_{00}=\mathrm{I}$	${\mathsf{\sigma }}_{01}={\mathsf{\sigma }}_x$	${\mathsf{\sigma }}_{\mathrm{x}}{\left|M⟩\right.}_u$	${\mathsf{\sigma }}_{\mathrm{x}}{\left|S⟩\right.}_d$
		${\mathsf{\sigma }}_{10}={\mathsf{\sigma }}_y$	${\mathsf{\sigma }}_{\mathrm{y}}{\left|M⟩\right.}_u$	${\mathsf{\sigma }}_{\mathrm{y}}{\left|S⟩\right.}_d$
		${\mathsf{\sigma }}_{11}={\mathsf{\sigma }}_z$	${\mathsf{\sigma }}_{\mathrm{z}}{\left|M⟩\right.}_u$	${\mathsf{\sigma }}_{\mathrm{z}}{\left|S⟩\right.}_d$
	${\mathsf{\sigma }}_{01}={\mathsf{\sigma }}_x$	${\mathsf{\sigma }}_{01}={\mathsf{\sigma }}_x$	${\mathsf{\sigma }}_{\mathrm{x}}{\left|M⟩\right.}_u$	${\mathsf{\sigma }}_{\mathrm{x}}{\mathsf{\sigma }}_{\mathrm{x}}{\mathsf{\sigma }}_{\mathrm{x}}{\left|S⟩\right.}_d={\mathsf{\sigma }}_{\mathrm{x}}{\left|S⟩\right.}_d$
		${\mathsf{\sigma }}_{10}={\mathsf{\sigma }}_y$	${\mathsf{\sigma }}_{\mathrm{y}}{\left|M⟩\right.}_u$	${\mathsf{\sigma }}_{\mathrm{x}}{\mathsf{\sigma }}_y{\mathsf{\sigma }}_{\mathrm{x}}{\left|S⟩\right.}_d=-{\mathsf{\sigma }}_y{\left|S⟩\right.}_d$
		${\mathsf{\sigma }}_{11}={\mathsf{\sigma }}_z$	${\mathsf{\sigma }}_{\mathrm{z}}{\left|M⟩\right.}_u$	${\mathsf{\sigma }}_{\mathrm{x}}{\mathsf{\sigma }}_z{\mathsf{\sigma }}_{\mathrm{x}}{\left|S⟩\right.}_d=-{\mathsf{\sigma }}_z{\left|S⟩\right.}_d$
	${\mathsf{\sigma }}_{10}={\mathsf{\sigma }}_y$	${\mathsf{\sigma }}_{01}={\mathsf{\sigma }}_x$	${\mathsf{\sigma }}_{\mathrm{x}}{\left|M⟩\right.}_u$	${\mathsf{\sigma }}_y{\mathsf{\sigma }}_{\mathrm{x}}{\mathsf{\sigma }}_y{\left|S⟩\right.}_d=-{\mathsf{\sigma }}_{\mathrm{x}}{\left|S⟩\right.}_d$
		${\mathsf{\sigma }}_{10}={\mathsf{\sigma }}_y$	${\mathsf{\sigma }}_{\mathrm{y}}{\left|M⟩\right.}_u$	${\mathsf{\sigma }}_y{\mathsf{\sigma }}_y{\mathsf{\sigma }}_y{\left|S⟩\right.}_d={\mathsf{\sigma }}_y{\left|S⟩\right.}_d$
		${\mathsf{\sigma }}_{11}={\mathsf{\sigma }}_z$	${\mathsf{\sigma }}_{\mathrm{z}}{\left|M⟩\right.}_u$	${\mathsf{\sigma }}_y{\mathsf{\sigma }}_z{\mathsf{\sigma }}_y{\left|S⟩\right.}_d=-{\mathsf{\sigma }}_z{\left|S⟩\right.}_d$
	${\mathsf{\sigma }}_{11}={\mathsf{\sigma }}_z$	${\mathsf{\sigma }}_{01}={\mathsf{\sigma }}_x$	${\mathsf{\sigma }}_{\mathrm{x}}{\left|M⟩\right.}_u$	${\mathsf{\sigma }}_z{\mathsf{\sigma }}_x{\mathsf{\sigma }}_z{\left|S⟩\right.}_d=-{\mathsf{\sigma }}_x{\left|S⟩\right.}_d$
		${\mathsf{\sigma }}_{10}={\mathsf{\sigma }}_y$	${\mathsf{\sigma }}_{\mathrm{y}}{\left|M⟩\right.}_u$	${\mathsf{\sigma }}_z{\mathsf{\sigma }}_y{\mathsf{\sigma }}_z{\left|S⟩\right.}_d=-{\mathsf{\sigma }}_y{\left|S⟩\right.}_d$
		${\mathsf{\sigma }}_{11}={\mathsf{\sigma }}_z$	${\mathsf{\sigma }}_{\mathrm{z}}{\left|M⟩\right.}_u$	${\mathsf{\sigma }}_z{\mathsf{\sigma }}_z{\mathsf{\sigma }}_z{\left|S⟩\right.}_d={\mathsf{\sigma }}_z{\left|S⟩\right.}_d$
$H^1=H$	${\mathsf{\sigma }}_{00}=\mathrm{I}$	${\mathsf{\sigma }}_{01}={\mathsf{\sigma }}_x$	${\mathsf{\sigma }}_{\mathrm{x}}{\left|M⟩\right.}_u$	$H^{†}{\mathsf{\sigma }}_{x}H{\left|S⟩\right.}_d={\mathsf{\sigma }}_{\mathrm{z}}{\left|S⟩\right.}_d$
		${\mathsf{\sigma }}_{10}={\mathsf{\sigma }}_y$	${\mathsf{\sigma }}_{\mathrm{y}}{\left|M⟩\right.}_u$	$H^{†}{\mathsf{\sigma }}_{y}H{\left|S⟩\right.}_d={\mathsf{\sigma }}_x{\left|S⟩\right.}_d$
		${\mathsf{\sigma }}_{11}={\mathsf{\sigma }}_z$	${\mathsf{\sigma }}_{\mathrm{z}}{\left|M⟩\right.}_u$	$H^{†}{\mathsf{\sigma }}_{z}H{\left|S⟩\right.}_d={\mathsf{\sigma }}_y{\left|S⟩\right.}_d$
	${\mathsf{\sigma }}_{01}={\mathsf{\sigma }}_x$	${\mathsf{\sigma }}_{01}={\mathsf{\sigma }}_x$	${\mathsf{\sigma }}_{\mathrm{x}}{\left|M⟩\right.}_u$	$H^{†}{\mathsf{\sigma }}_{\mathrm{x}}{\mathsf{\sigma }}_x{\mathsf{\sigma }}_{\mathrm{x}}H{\left|S⟩\right.}_d={\mathsf{\sigma }}_{\mathrm{z}}{\left|S⟩\right.}_d$
		${\mathsf{\sigma }}_{10}={\mathsf{\sigma }}_y$	${\mathsf{\sigma }}_{\mathrm{y}}{\left|M⟩\right.}_u$	$H^{†}{\mathsf{\sigma }}_{\mathrm{x}}{\mathsf{\sigma }}_y{\mathsf{\sigma }}_{\mathrm{x}}H{\left|S⟩\right.}_d=-{\mathsf{\sigma }}_x{\left|S⟩\right.}_d$
		${\mathsf{\sigma }}_{11}={\mathsf{\sigma }}_z$	${\mathsf{\sigma }}_{\mathrm{z}}{\left|M⟩\right.}_u$	$H^{†}{\mathsf{\sigma }}_{\mathrm{x}}{\mathsf{\sigma }}_z{\mathsf{\sigma }}_{\mathrm{x}}H{\left|S⟩\right.}_d=-{\mathsf{\sigma }}_y{\left|S⟩\right.}_d$
	${\mathsf{\sigma }}_{10}={\mathsf{\sigma }}_y$	${\mathsf{\sigma }}_{01}={\mathsf{\sigma }}_x$	${\mathsf{\sigma }}_{\mathrm{x}}{\left|M⟩\right.}_u$	$H^{†}{\mathsf{\sigma }}_y{\mathsf{\sigma }}_x{\mathsf{\sigma }}_{y}H{\left|S⟩\right.}_d=-{\mathsf{\sigma }}_{\mathrm{z}}{\left|S⟩\right.}_d$
		${\mathsf{\sigma }}_{10}={\mathsf{\sigma }}_y$	${\mathsf{\sigma }}_{\mathrm{y}}{\left|M⟩\right.}_u$	$H^{†}{\mathsf{\sigma }}_{\mathrm{y}}{\mathsf{\sigma }}_y{\mathsf{\sigma }}_{\mathrm{y}}H{\left|S⟩\right.}_d={\mathsf{\sigma }}_x{\left|S⟩\right.}_d$
		${\mathsf{\sigma }}_{11}={\mathsf{\sigma }}_z$	${\mathsf{\sigma }}_{\mathrm{z}}{\left|M⟩\right.}_u$	$H^{†}{\mathsf{\sigma }}_{\mathrm{y}}{\mathsf{\sigma }}_z{\mathsf{\sigma }}_{\mathrm{y}}H{\left|S⟩\right.}_d=-{\mathsf{\sigma }}_y{\left|S⟩\right.}_d$
	${\mathsf{\sigma }}_{11}={\mathsf{\sigma }}_z$	${\mathsf{\sigma }}_{01}={\mathsf{\sigma }}_x$	${\mathsf{\sigma }}_{\mathrm{x}}{\left|M⟩\right.}_u$	$H^{†}{\mathsf{\sigma }}_z{\mathsf{\sigma }}_x{\mathsf{\sigma }}_{z}H{\left|S⟩\right.}_d=-{\mathsf{\sigma }}_{\mathrm{z}}{\left|S⟩\right.}_d$
		${\mathsf{\sigma }}_{10}={\mathsf{\sigma }}_y$	${\mathsf{\sigma }}_{\mathrm{y}}{\left|M⟩\right.}_u$	$H^{†}{\mathsf{\sigma }}_z{\mathsf{\sigma }}_y{\mathsf{\sigma }}_{z}H{\left|S⟩\right.}_d=-{\mathsf{\sigma }}_x{\left|S⟩\right.}_d$
		${\mathsf{\sigma }}_{11}={\mathsf{\sigma }}_z$	${\mathsf{\sigma }}_{\mathrm{z}}{\left|M⟩\right.}_u$	$H^{†}{\mathsf{\sigma }}_z{\mathsf{\sigma }}_z{\mathsf{\sigma }}_{z}H{\left|S⟩\right.}_d={\mathsf{\sigma }}_y{\left|S⟩\right.}_d$

Figure 6. Coincidence probability by existential forgery. Red bars denote the case where Eve attempts original Gao’s Forgery when operator $H$ is not used in the quantum encryption scheme $\left(k_H^i=0\right)$. The blue bars show the case of attempting improved Gao’s Forgery when operator $H$ is used in the quantum encryption scheme $\left(k_H^i=1\right)$. $P_c$ is the coincidence probability. The black bars indicate the standard deviation of the coincidence counts for 1 s. $k_{AB}^i$ is the same as in Figure 1. $e_i\in \left\{00, 01, 10, 11\right\}$ corresponds to the Pauli operator ${\sigma }_{e_i}\in \left\{I, {\sigma }_{\mathrm{x}}, {\sigma }_{\mathrm{y}}, {\sigma }_z\right\}$ that Eve uses to attempt Gao’s Forgery 1.

5. Conclusions and Discussion

We have proposed a new quantum message authentication protocol including quantum encryption for improving security against an existential forgery. Additionally, a practical implementation of the proposed protocol has been developed and its robustness against existential forgery has been verified experimentally. It consists of wave plates and the Hong–Ou–Mandel interferometer. The measurement results for each function—QMAC generation and recovery, Bob’s encryption and decryption, and quantum encryption and decryption—successfully show the feasibility of robustness against Gao’s forgeries.

The system loss and the optical channel loss, etc., should be considered when applying our protocol to real implementation. Let us assume that Alice and Bob use the single photon detector with 20% efficiency and are connected by 30-km single-mode fiber with 0.2 dB/km loss. In a result, the total efficiency becomes $0.08\%$ because the qubits are pass through total 100 km, and if the QMAC pairs are generated at 100 MHz, Bob can receive $8\times {10}^4 \mathrm{pairs}/\mathrm{s}$. As we mentioned in Section 2, the size of the quantum state sequence should be more than $15$. Therefore, Alice must generate at least $1.9\times {10}^4$ QMAC pairs, i.e., $\left(1.9\times {10}^4\right)\times 0.08\%=15$ that is quite implementable number, and send them to Bob to ensure this accuracy of the swap test.

Our protocol can be used as an arbitrated quantum signature protocol if a trusted center (TC) is added in the communication channel used by Alice and Bob [19]. In addition, if freshness property is added to our protocol, it can be used for quantum entity authentication as well [1,52]. In conclusion, we have proposed the base technology for a complete quantum cryptosystem that provides confidentiality, authentication, integrity, and nonrepudiation.