# Experimental Quantum Message Authentication with Single Qubit Unitary Operation
## 2 Quantum Message Authentication Protocol
### Quantum Message Authentication Phase  
The quantum message authentication phase is composed of two stages: quantum message generation, QMAC generation, and quantum encryption. In the quantum message generation stage, Alice generates a quantum message state pair  
\[\left|\left.M\right\rangle_{u}\right|M\rangle_{d}=\left[\otimes_{i=1}^{N}R_{y}(m _{i})\right|\left.\varphi\right\rangle_{u}^{(i)}\right]\left[\otimes_{i=1}^{N} R_{y}(m_{i})\right|\left.\varphi\right\rangle_{d}^{(i)}\right] \tag{2}\]  
by applying a single qubit rotation operator  
\[R_{y}(m_{i})=\left( \begin{array}{cc}cos\frac{m_{i}}{2}&-sin\frac{m_{i}}{2}\\ sin\frac{m_{i}}{2}&cos\frac{m_{i}}{2}\end{array} \right), \tag{3}\]  
where \(M=(m_{1},m_{2},\;m_{3},\;\dots,\;m_{N})\) is a rotation angle sequence, \(0^{\circ}\leq m_{i}\leq 360^{\circ}\), and \(\left|\left.\varphi\right\rangle_{u}^{(i)}\right|\left.\varphi\right\rangle_{d}^ {(i)}\) are the logical states \(\left|\left.0\right\rangle\left|\left.0\right.\right\rangle\) or \(\left|\left.1\right\rangle\left|\left.1\right\rangle\right.\right\rangle\), corresponding to horizontally polarized photons \(\left|\left.H\right\rangle\right|\left.H\right\rangle\) and vertically polarized photons \(\left|\left.V\right\rangle\right|\left.V\right\rangle\), respectively. The superscript \((i)\) denotes the \(i\) th qubit, and subscripts \(u\) and \(d\) denote up and down, corresponding to the up-line and down-line, respectively, of the experimental setup used for our protocol. The rotation angle sequence \(M=(m_{1},m_{2},\;m_{3},\;\dots,\;m_{N})\) is a bit message sequence, and we assume that it has already been published in public as in the case of a contract or an official document. The reason for publishing \(M\) is to prevent [PERSON] from attempting to forge using a modulated QMAC pair, which is discussed in detail in Section 3.2 impossibility of forgery. In the QMAC generation stage, [PERSON] encrypts the quantum message pair \(\left|\left.M\right\rangle_{u}\right|\left.M\right\rangle_{d}\) of Equation (2) by using a single qubit rotation operator \(R_{y}(s_{i})\);  
\[\left|\left.M\right\rangle_{u}\right|\left.S\right\rangle_{d}=\left|\left.M \right\rangle_{u}\right[\otimes_{i=1}^{N}R_{y}(s_{i})\right|\left.M\right\rangle _{d}]=\left[\otimes_{i=1}^{N}R_{y}(m_{i})\right|\left.\varphi\right\rangle_{u }^{(i)}]\left[\otimes_{i=1}^{N}R_{y}(s_{i})R_{y}(m_{i})\right|\left.\varphi \right\rangle_{d}^{(i)}]. \tag{4}\]  
Figure 1: Basic structure of the quantum message authentication protocol based on quantum three-pass protocol. Similar to quantum three-pass protocol, which transmits bits three times, our protocol performs three quantum state transmissions. After three attempts of quantum state transmission, [PERSON] finally acquires quantum message states \(\left|\left.M\right\rangle_{u}=\otimes_{i=1}^{N}R_{y}(m_{i})\right|\left.\varphi \right\rangle_{u}^{i}\) and \(\left|\left.M^{\prime}\right\rangle_{d}=\otimes_{i=1}^{N}R_{y}(m_{i})\right| \left.\varphi\right\rangle_{d}^{i}\). He then uses a swap test twice to confirm the similarity of the two arbitrary quantum states \(\left|\left.M\right\rangle_{u^{\prime}}\right|\left.M^{\prime}\right\rangle_{d}\) and bit message sequence \(M\). \(K_{AB}\) and \(K_{H}\) denote the secret key sequences that [PERSON] and [PERSON] previously shared. \(S\) is the private key sequence that only [PERSON] knows, and \(B\) is the one known only to [PERSON]. Here, \(S=(s_{1},s_{2},\ s_{3},\ \ldots,\ s_{N})\) is a rotation angle sequence, \(0^{\circ}\leq s_{i}\leq 360^{\circ}\). In addition, \(S\) is a private key known only to [PERSON]. Furthermore, we call \(\left|\,M\right\rangle_{u}\left|S\right\rangle_{d}\) to a QMAC state pair.