# Experimental Quantum Message Authentication with Single Qubit Unitary Operation
## 4 Experiment Setup and Measurement Results  
Figure 3a shows the implementation setup of our proposed quantum message authentication protocol. With this setup, we have experimentally proved that the proposed QMAC is robust against existential forgery. Each stage is implemented with a linear combination of wave plates; that is, the \(y\)-axis rotation operator \(R_{y}(\theta)\), the unitary operator \(H\), and the Pauli operators are implemented by combinations of half-wave plates (HWPs) and quarter-wave plates (QWPs). Figure 3b schematically shows a possible forgery attack that [PERSON] can try. [PERSON] can attempt a forgery attack using the same Pauli operators \(\sigma_{c_{i}}=\sigma_{c_{i}^{\prime}}\)[46], or she can attempt a forgery attack using different Pauli operators \(\sigma_{c_{i}}\
eq\sigma_{c_{i}^{\prime}}\)[49; 50]. We define these two approaches as an original and improved Gao's Forgeries, respectively. To prevent [PERSON]'s forgeries, we need to choose unitary operator \(H\) randomly. We explain this in detail at the end of this section. We assume that [PERSON] and [PERSON] have already pre-shared the secret key sequences in the preparation phase. For the message authentication phase, we implemented message generation, QMAC generation, and quantum encryption using wave plates on [PERSON]'s side. To create correlated photon pairs, Type-I spontaneous parametric down-conversion (SPDC) photon pairs were generated in a beta barium borate (BBO) crystal pumped by a multimode diode laser with a 408-nm wavelength. The SPDC photon pairs have the same H-polarization and an 816-nm wavelength. The photon pairs are emitted with a noncollinear angle of 3.3\({}^{\circ}\). One of the photons goes through only the rotation operator for message generation, and the other experiences the sequence of operations from message generation through the quantum encryption scheme with a single qubit unitary operator. Then, they are delivered to [PERSON]. For the verification phase, one photon is kept on [PERSON]'s side, and the other photon experiences quantum decryption and [PERSON]'s encryption implemented by the wave plate, after which [PERSON] sends it to [PERSON]. [PERSON] then decrypts it by using QMAC recovery. In our experiment, we installed the QMAC recovery stage between [PERSON]'s encryption and [PERSON]'s decryption for convenience of implementation; it is marked by yellow shading in Figure 3a. Finally, after [PERSON]'s decryption, the swap test that verifies the agreement of the two photon sequences is performed using the Hong-Ou-Mandel interferometer. The Hong-Ou-Mandel dip confirms the similarity between the two photons, which is the last step of the implementation of the proposed quantum message authentication protocol. In other words, the realization of the quantum three-pass protocol, quantum encryption scheme, and the robustness of [PERSON]'s forgery can be confirmed by the Hong-Ou-Mandel Dip. Hong-Ou-Mandel interference is the same as the destructive swap test [40]. Because the destructive swap test does not have an ancilla qubit unlike the controlled swap test, the two quantum states that are compared are directly measured and collapsed. For this reason, we performed only the first swap test in the two swap tests shown in Figure 1. To implement the second swap test in Figure 1 using Hong-Ou-Mandel interference, there is a need for more resources (e.g., single photons and wave plates) than the current experimental setup. There are other ways to implement a second swap test by using an experimental controlled swap gate that was recently implemented [51]. We tested the feasibility of our protocol with the experimental setup for the case without [PERSON]'s forgery. First, we verified that the quantum three-pass protocol (Figure 3) was working correctly. As shown in Figure 4a, when the half-wave plate H1/s angle \(s_{i}/4\) is \(-120^{\circ}\), the coincidence count reaches its minimum at the half-wave plate H3/s angles \(-s_{i}/4=30^{\circ}\), \(120^{\circ}\) as expected.