Challenges
Datasets
Workspaces
Papers
Discussions
Leaderboard
Log inSign up
Challenges
Datasets
Workspaces
Papers
Discussions
Leaderboard
Blog
Job Board
Q3AS

© 2026 Aqora Quantum S.A.S.

TermsPrivacyLegal Notice

arXiv:1607.07759

New security notions and feasibility results for authentication of quantum data

Sumegha Garg, Henry Yuen, Mark Zhandry

Published Jul 26, 2016• 6 citations
arXivHTMLPDF

Abstract

We give a new class of security definitions for authentication in the quantum setting. These definitions capture and strengthen existing definitions of security against quantum adversaries for both classical message authentication codes (MACs) and well as full quantum state authentication schemes. The main feature of our definitions is that they precisely characterize the effective behavior of any adversary when the authentication protocol accepts, including correlations with the key. Our definitions readily yield a host of desirable properties and interesting consequences; for example, our security definition for full quantum state authentication implies that the entire secret key can be re-used if the authentication protocol succeeds. Next, we present several protocols satisfying our security definitions. We show that the classical Wegman-Carter authentication scheme with 3-universal hashing is secure against superposition attacks, as well as adversaries with quantum side information. We then present conceptually simple constructions of full quantum state authentication. Finally, we prove a lifting theorem which shows that, as long as a protocol can securely authenticate the maximally entangled state, it can securely authenticate any state, even those that are entangled with the adversary. Thus, this shows that protocols satisfying a fairly weak form of authentication security automatically satisfy a stronger notion of security (in particular, the definition of Dupuis, et al (2012)).

DOI
10.48550/arxiv.1607.07759

Related papers

Quantum-Secure Message Authentication Codes.

Dan Boneh, Mark Zhandry

We construct the first Message Authentication Codes (MACs) that are existentially unforgeable against a quantum chosen message attack. These chosen message attacks model a quantum adversary’s ability to obtain the MAC on a superposition of messages of its choice. We begin by showing that a quantum secure PRF is sufficient for constructing a quantum secure MAC, a fact that is considerably harder to prove than its classical analogue. Next, we show that a variant of Carter-Wegman MACs can be proven to be quantum secure. Unlike the classical settings, we present an attack showing that a pair-wise independent hash family is insufficient to construct a quantum secure one-time MAC, but we prove that a four-wise independent family is sufficient for one-time security. Keywords: Quantum computing, MAC,chosen message attacks, post-quantum security 1

Electronic colloquium on computational complexity•Jan 1, 2012•3 citations

Authentication of quantum messages

Howard Barnum, Claude Crépeau, Daniel Gottesman +2 more

Authentication is a well-studied area of classical cryptography: a sender A and a receiver B sharing a classical secret key want to exchange a classical message with the guarantee that the message has not been modified or replaced by a dishonest party with control of the communication line. In this paper we study the authentication of messages composed of quantum states. We give a formal definition of authentication in the quantum setting. Assuming A and B have access to an insecure quantum channel and share a secret, classical random key, we provide a non-interactive scheme that enables A to both encrypt and authenticate an m qubit message by encoding it into m+s qubits, where the error probability decreases exponentially in the security parameter s. The scheme requires a secret key of size 2m+O(s). To achieve this, we give a highly efficient protocol for testing the purity of shared EPR pairs. It has long been known that learning information about a general quantum state will necessarily disturb it. We refine this result to show that such a disturbance can be done with few side effects, allowing it to circumvent cryptographic protections. Consequently, any scheme to authenticate quantum messages must also encrypt them. In contrast, no such constraint exists classically. This reasoning has two important consequences: It allows us to give a lower bound of 2m key bits for authenticating m qubits, which makes our protocol asymptotically optimal. Moreover, we use it to show that digitally signing quantum states is impossible.

arXiv:quant-ph/0205128•Annual Symposium on Foundations of Computer Science•Jun 26, 2003•282 citations

Authentication in Security Proofs for Quantum Key Distribution

Devashish Tupkary, Shlok Nahar, Ernest Y. -Z. Tan

Quantum Key Distribution (QKD) protocols rely on authenticated classical communication. Typical QKD security proofs are carried out in an idealized setting where authentication is assumed to behave honestly: it never aborts, and all classical messages are delivered faithfully with their original timing preserved. Authenticated channels that can be constructed in practice have different properties. Most critically, such channels may abort asymmetrically, such that only the receiving party may detect an authentication failure while the sending party remains unaware. Furthermore, an adversary may delay, reorder, or block classical messages. This discrepancy means that existing security proofs under honest authentication do not directly establish security in the practical authentication setting. We address this gap using an existing security definition from the literature that permits asymmetric aborts while retaining secrecy of any key produced and agreement of the keys whenever both parties accept. Our main result is a reduction theorem showing that, under mild and easily satisfied protocol conditions, any QKD protocol proven secure under the honest authentication setting, for the standard security definition with symmetric aborts, remains secure under a practical authentication setting, for the weaker security definition that allows for asymmetric aborts. This result allows all existing QKD proofs to be retroactively lifted to the practical authentication setting (with asymmetric aborts) with a minor protocol tweak.

quant-pharXiv:2601.17960•Jan 27, 2026•1 citation

Classical Encryption and Authentication under Quantum Attacks

Maria Velema

Post-quantum cryptography studies the security of classical, i.e. non-quantum cryptographic protocols against quantum attacks. Until recently, the considered adversaries were assumed to use quantum computers and behave like classical adversaries otherwise. A more conservative approach is to assume that also the communication between the honest parties and the adversary is (partly) quantum. We discuss several options to define secure encryption and authentication against these stronger adversaries who can carry out 'superposition attacks'. We re-prove a recent result of Boneh and Zhandry, stating that a uniformly random function (and hence also a quantum-secure pseudorandom function) can serve as a message-authentication code which is secure, even if the adversary can evaluate this function in superposition.

arXiv:1307.3753•Jul 14, 2013•1 citation

Quantum Enabled Data Authentication Without Classical Control Interaction

Piotr Zawadzki, Grzegorz Dziwoki, Marcin Kucharczyk +9 more

We present a quantum-assisted data authentication protocol that integrates classical information-theoretic security with quantum communication techniques. We assume only that the participants have access to open classical and quantum channels, and share a random static key material. Building on the Wegman–Carter paradigm, our scheme employs universal hashing for message authentication and leverages quantum channels to securely transmit random nonces, eliminating the need for key recycling. The protocol utilizes polar codes within Wyner’s wiretap channel model to ensure confidentiality and reliability, even in the presence of an all-powerful adversary. Security analysis demonstrates that the protocol inherits strong guarantees from both classical and quantum frameworks, provided the quantum channel maintains low loss and noise.

Electronics•Oct 14, 2025•1 citation

Quantum Authentication Protocol for Classical Messages Based on Bell states and Hash Function

Xiangjun Xin, Xiaolin Hua, Jianpo Song +1 more

Quantum authentication protocols can be used to authenticate both quantum messages and classical messages.In this paper, a new quantum authentication protocol of classical messages is proposed.In our protocol, a sequence of Bell states is shared by the message sender and the corresponding receiver.This sequence is used as the authentication key.Four different unitary operations U 0 , U 1 , U 2 and U 3 are used to encode a classical message m and its hash value h(m) into a sequence of Bell states.To authenticate the classical message, the message receiver extracts m and h(m) from the qubits owned by himself/herself, and verifies whether h(m) matches m.The adversary's disturbance to the quantum channel can be detected by checking whether h(m) matches m.The transmitted message has the properties of both secrecy and authentication.Our quantum authentication protocol is secure against message attack and no-message attack.

International Journal of Security and Its Applications•Jul 31, 2015•5 citations
We give a new class of security definitions for authentication in the quantum setting. These definitions capture and strengthen existing definitions of security against quantum adversaries for both classical message authentication codes (MACs) and well as full quantum state authentication schemes. The main feature of our definitions is that they precisely characterize the effective behavior of any adversary when the authentication protocol accepts, including correlations with the key. Our definitions readily yield a host of desirable properties and interesting consequences; for example, our security definition for full quantum state authentication implies that the entire secret key can be re-used if the authentication protocol succeeds. Next, we present several protocols satisfying our security definitions. We show that the classical Wegman-Carter authentication scheme with 3-universal hashing is secure against superposition attacks, as well as adversaries with quantum side information. We then present conceptually simple constructions of full quantum state authentication. Finally, we prove a lifting theorem which shows that, as long as a protocol can securely authenticate the maximally entangled state, it can securely authenticate any state, even those that are entangled with the adversary. Thus, this shows that protocols satisfying a fairly weak form of authentication security automatically satisfy a stronger notion of security (in particular, the definition of Dupuis, et al (2012)).
We construct the first Message Authentication Codes (MACs) that are existentially unforgeable against a quantum chosen message attack. These chosen message attacks model a quantum adversary’s ability to obtain the MAC on a superposition of messages of its choice. We begin by showing that a quantum secure PRF is sufficient for constructing a quantum secure MAC, a fact that is considerably harder to prove than its classical analogue. Next, we show that a variant of Carter-Wegman MACs can be proven to be quantum secure. Unlike the classical settings, we present an attack showing that a pair-wise independent hash family is insufficient to construct a quantum secure one-time MAC, but we prove that a four-wise independent family is sufficient for one-time security. Keywords: Quantum computing, MAC,chosen message attacks, post-quantum security 1
Authentication is a well-studied area of classical cryptography: a sender A and a receiver B sharing a classical secret key want to exchange a classical message with the guarantee that the message has not been modified or replaced by a dishonest party with control of the communication line. In this paper we study the authentication of messages composed of quantum states. We give a formal definition of authentication in the quantum setting. Assuming A and B have access to an insecure quantum channel and share a secret, classical random key, we provide a non-interactive scheme that enables A to both encrypt and authenticate an m qubit message by encoding it into m+s qubits, where the error probability decreases exponentially in the security parameter s. The scheme requires a secret key of size 2m+O(s). To achieve this, we give a highly efficient protocol for testing the purity of shared EPR pairs. It has long been known that learning information about a general quantum state will necessarily disturb it. We refine this result to show that such a disturbance can be done with few side effects, allowing it to circumvent cryptographic protections. Consequently, any scheme to authenticate quantum messages must also encrypt them. In contrast, no such constraint exists classically. This reasoning has two important consequences: It allows us to give a lower bound of 2m key bits for authenticating m qubits, which makes our protocol asymptotically optimal. Moreover, we use it to show that digitally signing quantum states is impossible.
Quantum Key Distribution (QKD) protocols rely on authenticated classical communication. Typical QKD security proofs are carried out in an idealized setting where authentication is assumed to behave honestly: it never aborts, and all classical messages are delivered faithfully with their original timing preserved. Authenticated channels that can be constructed in practice have different properties. Most critically, such channels may abort asymmetrically, such that only the receiving party may detect an authentication failure while the sending party remains unaware. Furthermore, an adversary may delay, reorder, or block classical messages. This discrepancy means that existing security proofs under honest authentication do not directly establish security in the practical authentication setting. We address this gap using an existing security definition from the literature that permits asymmetric aborts while retaining secrecy of any key produced and agreement of the keys whenever both parties accept. Our main result is a reduction theorem showing that, under mild and easily satisfied protocol conditions, any QKD protocol proven secure under the honest authentication setting, for the standard security definition with symmetric aborts, remains secure under a practical authentication setting, for the weaker security definition that allows for asymmetric aborts. This result allows all existing QKD proofs to be retroactively lifted to the practical authentication setting (with asymmetric aborts) with a minor protocol tweak.
Post-quantum cryptography studies the security of classical, i.e. non-quantum cryptographic protocols against quantum attacks. Until recently, the considered adversaries were assumed to use quantum computers and behave like classical adversaries otherwise. A more conservative approach is to assume that also the communication between the honest parties and the adversary is (partly) quantum. We discuss several options to define secure encryption and authentication against these stronger adversaries who can carry out 'superposition attacks'. We re-prove a recent result of Boneh and Zhandry, stating that a uniformly random function (and hence also a quantum-secure pseudorandom function) can serve as a message-authentication code which is secure, even if the adversary can evaluate this function in superposition.
We present a quantum-assisted data authentication protocol that integrates classical information-theoretic security with quantum communication techniques. We assume only that the participants have access to open classical and quantum channels, and share a random static key material. Building on the Wegman–Carter paradigm, our scheme employs universal hashing for message authentication and leverages quantum channels to securely transmit random nonces, eliminating the need for key recycling. The protocol utilizes polar codes within Wyner’s wiretap channel model to ensure confidentiality and reliability, even in the presence of an all-powerful adversary. Security analysis demonstrates that the protocol inherits strong guarantees from both classical and quantum frameworks, provided the quantum channel maintains low loss and noise.
Quantum authentication protocols can be used to authenticate both quantum messages and classical messages.In this paper, a new quantum authentication protocol of classical messages is proposed.In our protocol, a sequence of Bell states is shared by the message sender and the corresponding receiver.This sequence is used as the authentication key.Four different unitary operations U 0 , U 1 , U 2 and U 3 are used to encode a classical message m and its hash value h(m) into a sequence of Bell states.To authenticate the classical message, the message receiver extracts m and h(m) from the qubits owned by himself/herself, and verifies whether h(m) matches m.The adversary's disturbance to the quantum channel can be detected by checking whether h(m) matches m.The transmitted message has the properties of both secrecy and authentication.Our quantum authentication protocol is secure against message attack and no-message attack.