# Experimental Quantum Message Authentication with Single Qubit Unitary Operation
## 4 Experiment Setup and Measurement Results
As another example, if \(k_{AB}^{i}=01,k_{H}^{i}=1\), an encrypted QMAC state pair is  
\[\left|\,M\,\right\rangle_{u}\!\left[\sigma_{01}H^{1}\!\left|\,S\,\right\rangle_{ d}\right]\!\!=\left|\,M\,\right\rangle_{u}\!\left[\sigma_{\mathrm{x}}H\!\left|\,S \,\right\rangle_{d}\right]\!. \tag{15}\]  
The forged QMAC state pair by [PERSON]'s Pauli operator \(\sigma_{10}\!\left(=\sigma_{y}\right)\) is  
\[\sigma_{10}\!\left|\,M\,\right\rangle_{u}\!\left[\sigma_{10}\sigma_{01}H^{1} \!\left|\,S\,\right\rangle_{d}\right]\!\!=\left.\sigma_{\mathrm{y}}\!\left|\, M\,\right\rangle_{u}\!\left[\sigma_{\mathrm{y}}\sigma_{\mathrm{x}}H\!\left|\,S\, \right\rangle_{d}\right]\!. \tag{16}\]  
Figure 5: \(P_{c}\) is the coincidence probability of the quantum encryption scheme with a single qubit unitary operator for quantum message authentication. \(\overline{P}_{c}=1-P_{c}\) represents the probability of two quantum message states being matched. In (**a**), \(\overline{P}_{c}\) corresponds to the quantum encryption scheme with a single qubit unitary operator that [PERSON] and [PERSON] can select when secret key \(k_{H}^{i}\) of [PERSON] and [PERSON] is zero. In (**b**), \(\overline{P}_{c}\) corresponds to every type of quantum encryption with single qubit unitary operator that [PERSON] and [PERSON] can select when secret key \(k_{H}^{i}\) of [PERSON] and [PERSON] is one. In this experiment, message \(m_{i}\) was set to \(135\lx@math@degree\). The forged QMAC state pair transforms into the following state after a decryption process:  
Figure 3:0  
Despite the assumption that \(\ket{M}_{u}\) and \(\ket{S}_{d}\) of Equation (17) are the same, [PERSON]'s attack is unsuccessful. The reason is that the Pauli operators \(\sigma_{y}\) and \(\sigma_{x}\) remained in the first and second qubits of Equation (17), respectively. This is the (I, H)-type quantum encryption proposed to overcome [PERSON]'s forgery [47]. [PERSON] et al., however, showed that the (I, H)-type quantum encryption is not secure for improved [PERSON]'s forgery [49; 50]. We [19; 34] overcome the original [PERSON]'s forgery [46] or the improved [PERSON]'s forgery [49; 50] with quantum encryption \(\sigma_{k^{i}_{AB}}H^{k^{i}_{H}}\), which randomly uses operator \(H\). Here, the number of all possible cases of quantum encryption \(\sigma_{k^{i}_{AB}}H^{k^{i}_{H}}\in\{I,\ \sigma_{x},\ \sigma_{y},\ \sigma_{z},\ H,\ \sigma_{x}H,\ \sigma_{y}H,\ \sigma_{z}H\}\) is 8. Furthermore, except \(\sigma_{\sigma_{i}}=I\), there are three possible ways that [PERSON] can attack with \(\sigma_{\sigma_{i}}\). Therefore, there are a total of 24 forgery cases using the Pauli operator \(\sigma_{\sigma_{i}}\) in the encrypted QMAC state pair \(\ket{M}_{u}\!\left[\sigma_{k^{i}_{AB}}H^{k^{i}_{H}}\ket{S}_{d}\right]\) of Equation (5) in the manuscript, Table 1 lists these 24 cases, and Figure 6 shows the results of the experiment with the existential forgery using the Pauli operator for 12 cases in Figure 3:1  
\begin{table}
\begin{tabular}{c c c c c} \hline \hline \(H^{k}\!H\) & \(\sigma_{k^{i}_{AB}}\) & \(\sigma_{\sigma_{i}}\) & **Up(u) Qubit** & **Down(d) Qubit** \\ \hline \multirow{7}{*}{\(H^{0}=I\)} & \(\sigma_{00}=1\) & \(\sigma_{x}\) & \(\sigma_{\mathrm{s}}\ket{M}_{u}\) & \(\sigma_{\mathrm{s}}\ket{S}_{d}\) \\ \cline{2-5}  & \(\sigma_{10}=\sigma_{y}\) & \(\sigma_{\mathrm{y}}\ket{M}_{u}\) & \(\sigma_{\mathrm{y}}\ket{