# Experimental Quantum Message Authentication with Single Qubit Unitary Operation
## 4 Experiment Setup and Measurement Results
Errors in the experiment shown in Figure 5 could be due to an inherent error of the swap test, birefringence in the beam splitter, and/or systematic errors in the wave-plate setting [38; 39; 42; 45]. From the measurement results given in Figures 4 and 5, we have demonstrated that our implementation succeeds in realizing the proposed protocol. Although there are some errors due to unavoidable imperfections of the realization, our practical implementation still performs message integrity and message origin authentication successfully only if our protocol is applied to multiple bits sequentially and analyzed statistically. Figure 4: Coincidence counts of the quantum three-pass protocol. The red plots indicate the average of the coincidence counts for one second. The red bars indicate the standard deviation of the coincidence counts for each point. The blue solid line indicates the sine curve fitted to the data. (**a**) Test for QMAC generation and recovery. (**b**) Test for [PERSON]’s encryption and decryption. [PERSON] et al. demonstrated the possibility of existential forgery in the case of quantum message authentication that includes a swap test [34; 46; 48]. In other words, if the QMAC state pair that [PERSON] generates is not encrypted, [PERSON] cannot detect [PERSON]'s intervention. In the quantum encryption \(\sigma_{k_{AB}}^{i}H^{k_{H}}\) in Equation (5), the secret key \(k_{AB}^{i}\in\{00,\ 01,\ 10,\ 11\}\) and \(k_{H}^{i}\in\{0,\ 1\}\) correspond to the Pauli operator \(\sigma_{k_{AB}^{i}}\in\{I,\ \sigma_{x},\ \sigma_{y},\ \sigma_{z}\}\) and the operator \(H^{k_{AB}^{i}}\in\{I,\ H\}\) of quantum encryption with a single qubit unitary operator, respectively. The two bits information \(e_{i}\in\{00,\ 01,\ 10,\ 11\}\) corresponds to the Pauli operator \(\sigma_{e_{i}}\in\{I,\ \sigma_{x},\ \sigma_{y},\ \sigma_{z}\}\) for [PERSON]'s Attack. For example, if \(k_{AB}^{i}=01\), \(k_{H}^{i}=0\), an encrypted QMAC state pair is  
\[\left|\,M\,\right\rangle_{u}\!\left[\sigma_{01}H^{0}\!\left|\,S\,\right\rangle _{d}\right]\!\!=\left|\,M\,\right\rangle_{u}\!\left[\sigma_{\mathrm{x}}\!\left| \,S\,\right\rangle_{d}\right] \tag{12}\]  
In addition, the forged QMAC state pair by [PERSON]'s Pauli operator \(\sigma_{10}\!\left(=\sigma_{y}\right)\) is  
\[\sigma_{10}\!\left|\,M\,\right\rangle_{u}\!\left[\sigma_{10}\sigma_{01}H^{0} \!\left|\,S\,\right\rangle_{d}\right]=\sigma_{\mathrm{y}}\!\left|\,M\,\right \rangle_{u}\!\left[\sigma_{\mathrm{y}}\sigma_{\mathrm{x}}\!\left|\,S\,\right \rangle_{d}\right] \tag{13}\]  
The forged QMAC state pair of Equation (13) transforms into the following state after a decryption process:  
\[\sigma_{10}\!\left|\,M\,\right\rangle_{u}\!\left[\left(H^{\dagger}\right)^{0 }\!\sigma_{01}\sigma_{00}\sigma_{01}H^{0}\!\left|\,S\,\right\rangle_{d}\right] =\sigma_{\mathrm{y}}\!\left|\,M\,\right\rangle_{u}\!\left[\sigma_{\mathrm{x}} \sigma_{y}\sigma_{\mathrm{x}}\!\left|\,S\,\right\rangle_{d}\right]=\sigma_{ \mathrm{y}}\!\left|\,M\,\right\rangle_{u}\!\left[-\sigma_{\mathrm{y}}\!\left| \,S\,\right\rangle_{d}\right]\!. \tag{14}\]  
Assuming that \(\left|\,M\,\right\rangle_{u}\) and \(\left|\,S\,\right\rangle_{d}\) of Equation (14) are the same, [PERSON] succeeded in attacking because the Pauli operator \(\sigma_{y}\) remained in the first and second qubits of Equation (14). This is the first method to forge the quantum message code or quantum signature pair proposed by [PERSON] et al. [34; 46; 48].