# Experimental Quantum Message Authentication with Single Qubit Unitary Operation
## 3 Security Analysis
### Impossibility of Forgery  
Many quantum message authentication and signature protocols use quantum encryption implemented by Pauli operators to ensure message integrity and message origin authentication. A QMAC pair (or quantum signature pair), which is composed of a quantum message and an encrypted quantum message, checks the forgery and modulation of the QMAC pair (or quantum signature pair) using a swap test [34]. As described in Section 2.3, [PERSON] validates the original quantum message state \(\left|\ M\right\rangle_{u}\) and the recovered quantum message state \(\left|\ M^{\prime}\right\rangle_{d}\) from the QMAC state pair of Equation (4) using the swap test. [PERSON] can be sure that \(\left|\ M\right\rangle_{u}\) and \(\left|\ M^{\prime}\right\rangle_{d}\) are the same quantum state from the outcomes of the swap test. However, it is not known whether they match the original message \(M\). Because of the limitations of this swap test, the proposed protocol can be falsified in two ways. The first falsification method is that [PERSON] creates a modulated QMAC pair  
\[I(x,S)\leq V(\rho)\leq H(S) \tag{11}\]  
with the two same quantum states \(\left|\ \widetilde{M}\right\rangle_{u}\) and \(\left|\ \widetilde{M^{\prime}}\right\rangle_{d}\) that do not correspond to the original message \(M\) and sends it to [PERSON]. In this case, [PERSON] cannot detect [PERSON]'s malicious behaviour even if he verifies that the two quantum states \(\left|\ \widetilde{M}\right\rangle_{u}\) and \(\left|\ \widetilde{M^{\prime}}\right\rangle_{d}\) are the same from the QMAC pair by using the swap test. To prevent this, [PERSON] must disclose message \(M\). Additionally, [PERSON] needs an additional process to validate \(\left|\ M^{\prime\prime}\right\rangle\), which is converted to a quantum state, and \(\left|\ M\right\rangle_{u}\) or \(\left|\ M^{\prime}\right\rangle_{d}\) by using the swap test. Second, [PERSON] can try [PERSON]'s forgery to apply Pauli operators to a QMAC pair [34; 46]. Recently, [PERSON] et al. showed that even if an adversary applies the arbitrary Pauli operator to the QMAC pair (or quantum signature pair), the swap test could not detect it because of the commutation relation of Pauli operators [46]. This is called [PERSON]'s forgery, and it can be considered as an existential forgery [34] of modern cryptosystems because it randomly forges QMAC pairs (or quantum signature pairs), which are arbitrary quantum states. The posing of this security problem by [PERSON] et al. was a major turning point in the study of quantum message authentication (or quantum signature) protocols. In 2011, [PERSON] et al. proposed the (I, H)- or (U, V)-type quantum encryption scheme to cope with [PERSON]'s forgery [47; 48]. In 2013, [PERSON] et al. pointed out that the encryption scheme of [PERSON] et al. was still insecure against [PERSON]'s forgery, and instead they proposed the key-controlled-\"I\" quantum one-time pad or key-controlled-\"T\" quantum one-time pad [49; 50] as an alternative. The four unitary operators of the controlled-I quantum one-time padare \(W_{00}=(\sigma_{x}+\sigma_{z})/\sqrt{2}\), \(W_{01}=\left(\sigma_{y}+\sigma_{z}\right)/\sqrt{2}\), \(W_{10}=\left(I+i\sigma_{x}-i\sigma_{y}+i\sigma_{z}\right)/\sqrt{2}\), and \(W_{10}=\left(I+i\sigma_{x}+i\sigma_{y}+i\sigma_{z}\right)/\sqrt{2}\). However, the encryption scheme of [PERSON] et al. is not easy to implement with simple hardware. In contrast, we propose a quantum encryption scheme with a single qubit unitary operation by randomly using unitary operator \(H\), which can be easily implemented by controlling wave plates and an authentication protocol. Therefore, the proposed protocol is robust against an existential forgery. Section 4.3 in Ref. [22] shows that unitary operators can be used randomly to prevent [PERSON]'s forgery. The detailed implementation of our experimental setup and the testing results of the quantum three-pass protocol and security against [PERSON]'s forgery are described in Section 4.