Quantum authentication

Quantum authentication is the sub-field of quantum cryptography that aims to apply quantum information theory for the purpose of authentication of quantum messages, users or devices.^[1] Counterintuitively, it refers to a different problem from the authentication of the classical channel assumed in QKD protocols, which doesn't natively require quantum resources.^[2]

A number of authentication protocols have been proposed since the advent of quantum cryptography, often inspired by quantum key distribution counterparts.^[3] Ongoing research aims to both design new schemes and experimentally implement already proposed ones, as the technologies needed are mostly still under development.^[4]

The first quantum authentication protocol was proposed in 1995, based on oblivious transfer.^[5] Subsequent results in quantum cryptography showed that unconditionally secure two-party oblivious transfer in the quantum setting is impossible, limiting the feasibility of such constructions.^[6]

Early work also addressed the broader problem of quantum message authentication. It was proposed that quantum states can be authenticated against tampering using symmetric-key techniques, but that general quantum public-key authentication is not achievable without additional assumptions or restricted adversarial models.^[7] These results also influenced following work on quantum digital signatures, using pre-distributed quantum states and restricted security assumptions.^[8]

Limited activity on quantum identity authentication (QIA) continued in the late 1990s, followed by a marked increase in proposals from the early 2000s onward.^[4] Many of these early QIA protocols were motivated by developments in quantum key distribution and typically assumed pre-shared entanglement or conjugate coding techniques; research on quantum message authentication and digital signatures also continued, focusing on reducing costs and formalizing security.^[9] More technologies were explored, such as entanglement swapping, multipartite entanglement and trusted third-party schemes.^[10] Security analyses narrowed down the results by clarifying limitations related to key reuse, composability and adversarial assumptions.^[11]

Quantum authentication includes several related research areas that can be distinguished according to what is being authenticated: while some protocols authenticate the identity of a user or communicating party, others authenticate the integrity of transmitted quantum information or provide signature-like security. Although these areas share common cryptographic techniques, they address different security objectives and are often studied independently.^[12]

Quantum identity authentication (QIA) aims to authenticate a user, device or other communicating party by exploiting quantum-mechanical properties.^[1] Unlike classical authentication, these protocols use quantum states during the authentication process, allowing eavesdropping or impersonation attempts to be detected through the disturbance introduced by quantum measurements.^[13]

QIA protocols may provide one-way authentication, in which one party authenticates the other, or mutual authentication, where both parties verify each other's identity. Many schemes are inspired by classical challenge-response authentication, adapting them to quantum communication channels. They can also be classified as interactive or non-interactive depending on whether both parties must actively exchange information during the authentication phase.^[4]

In quantum message authentication (QMA), the aim is to authenticate the integrity and origin of quantum information sent over a quantum channel. Unlike classical message authentication, the message itself is a quantum state, which cannot generally be copied because of the no-cloning theorem.^[14] Quantum message authentication schemes therefore combine quantum encoding with a shared secret key, allowing the receiver to detect any modification or tampering of the transmitted state.^[3] If authentication fails, the receiver rejects the message rather than attempting to recover it.^[15]

A foundational result by Barnum et al. showed that authentication of arbitrary quantum states necessarily implies their encryption, meaning that a protocol capable of detecting tampering must also conceal the quantum information from an adversary; the same work also argued that unrestricted digital signatures for unknown quantum states are impossible without additional assumptions.^[7]

Quantum digital signatures (QDS) are the quantum counterpart of classical digital signatures; they are intended to provide authenticity, integrity and non-repudiation while offering security based on quantum theory rather than computational assumptions.^[16] Most QDS protocols authenticate classical messages using quantum states distributed during a setup phase, instead of attempting to sign arbitrary quantum states directly: this distinguishes them from QMA.^[7]

A QDS scheme consists of three probabilistic polynomial-time quantum Turing machines (${\displaystyle G}$, ${\displaystyle S}$, ${\displaystyle V}$), where ${\displaystyle G}$ is a key-generation algorithm that, on input ${\displaystyle 1^{n}}$, outputs a pair (s, v) consisting of a secret signing key and a public verification key. ${\displaystyle S}$ is a signing algorithm, ${\displaystyle V}$ is a verification algorithm such that for all messages ${\displaystyle m\in \{0,1\}^{n}}$ and all sufficiently large ${\displaystyle n}$,

${\displaystyle \Pr \left[V(m,S(m,s),v)=1\right]\geq 1-{\frac {1}{\mathrm {poly} (n)}}}$,

where the probability is taken over the internal randomness (classical and quantum) of (${\displaystyle G}$, ${\displaystyle S}$, ${\displaystyle V}$).^[8]

Quantum authentication protocols can be classified along multiple independent dimensions, including the quantum resources they employ or the underlying cryptographic primitive; these classification schemes are not mutually exclusive but highlight different aspects of protocol design, ranging from theoretical foundations to practical implementation constraints.^[17]

Quantum authentication protocols can be categorized according to the classical or quantum cryptographic primitive they are built on.^[17] Many schemes are derived from QKD, reusing conjugate coding or BB84-like states: in these constructions, authentication is often achieved as an additional layer on top of key establishment, or by embedding authentication information directly into quantum states exchanged during the protocol.^[18]

Other approaches are based on alternative primitives, including quantum secure direct communication (QSDC), quantum teleportation-based schemes, quantum secret sharing, quantum private comparison, and quantum oblivious transfer.^[19] Each of these primitives introduces different structural assumptions and communication patterns. For instance, QSDC-based authentication protocols often aim to transmit authenticated messages directly through quantum states without first establishing a shared secret key, while secret-sharing-based constructions distribute authentication information across multiple parties to prevent unilateral forgery or impersonation.^[20]

These different foundations lead to distinct trade-offs in terms of communication complexity, quantum channel usage, and trust assumptions: for example, protocols built on teleportation or entanglement distribution may offer stronger theoretical guarantees or richer functionality, but typically require more demanding infrastructure, such as reliable entanglement distribution and synchronization between participants.^[21]

Another classification considers the physical quantum resources required for protocol execution.^[17] Early quantum authentication proposals frequently relied on pre-shared entanglement, especially Bell pairs, as a fundamental resource for establishing correlations that cannot be classically replicated: these entangled-pair-based schemes often assume that entanglement is distributed in advance between legitimate parties and later consumed during authentication.^[22]

Following research extended these ideas to multipartite entanglement structures, such as Greenberger–Horne–Zeilinger (GHZ) states, which allow authentication schemes involving multiple participants or distributed verification processes.^[21] More sophisticated constructions also incorporate entanglement swapping, enabling to dynamically entangle parties that have never directly interacted.^[23]

In contrast, a large family of more practical protocols avoids entanglement, instead relying on single-photon or weak coherent pulse implementations, which are significantly easier to realize experimentally using existing optical technologies. These schemes are often closer to QKD implementations and are more compatible with current fiber-optic infrastructure.^[24]

More recent developments include semi-quantum authentication models, in which only one party (typically the sender or trusted authority) requires full quantum capabilities, while other participants are restricted to classical operations such as reflection, measurement in a fixed basis, or classical communication. This approach reduces hardware requirements and broadens potential deployment scenarios.^[25]

Moreover, newer research directions explore a quantum counterpart of physical unclonable functions (PUFs), where inherently noisy or complex quantum systems serve as device-specific fingerprints.^[26] These quantum PUF-based approaches aim to provide lightweight authentication mechanisms rooted in physical uniqueness rather than cryptographic computation.^[27]

Finally, quantum position verification is being explored as a tool for identity authentication.^[28]

The security of quantum authentication protocols derives from fundamental properties of quantum mechanics instead of computational assumptions.^[29] The no-cloning theorem prevents an attacker from creating copies of unknown quantum states, and any measurement disturbs the measured system: any eavesdropping or tampering attempts are detected. This prevents adversaries from perfectly replicating authentication tokens encoded in quantum information.^[14]

Another key property is the disturbance caused by measurement: any attempt to extract information from a quantum system generally introduces detectable disturbances. This ensures that eavesdropping or tampering during transmission can be identified with non-zero probability.^[29] In addition, many protocols rely on the impossibility of perfectly distinguishing non-orthogonal quantum states, which limits an adversary's ability to infer encoded information without introducing errors.^[30]

Quantum authentication protocols are designed to resist a number of attacks, including impersonation, message forgery, replay attacks and man-in-the-middle attacks. Replay attacks involve re-transmitting previously valid quantum or classical authentication transcripts to gain access, while man-in-the-middle attacks attempt to intercept and modify quantum transmissions while impersonating both legitimate parties to each other. Depending on the specific protocol, attackers may also attempt state replacement attacks, where transmitted quantum states are substituted with dishonestly prepared ones designed to not be detected.^[31]

Security analyses typically distinguish between external adversaries and dishonest insiders. In the second case, even legitimate participants could deviate from the protocol in an attempt to cheat, which significantly complicates security proofs. Formal guarantees therefore depend strongly on the chosen adversarial model and assumptions about participant behavior.^[11]

Despite relying on quantum-mechanical principles, most quantum authentication protocols require additional assumptions beyond the laws of physics alone. A common requirement is the existence of an authenticated classical channel, which ensures that classical messages exchanged during the protocol cannot be tampered with without being detected. This assumption is also standard in quantum key distribution and is typically enforced using classical authentication codes or pre-shared keys.^[2]

Other assumptions include the availability of pre-shared secret keys or quantum states, trusted initialization phases, or the presence of a trusted third party responsible for distributing or verifying authentication material. Some protocols also assume limited quantum capabilities for adversaries or restricted access to quantum memory, although such assumptions are generally considered stronger. These assumptions vary widely across protocols, and reducing them while maintaining strong security guarantees remains an active area of research, particularly in the context of composable security.^[11]

Experimental realizations of quantum authentication protocols have so far been primarily implemented using optical fiber systems, which remain the most mature and practical platform for quantum communication. These implementations often adapt existing QKD infrastructure, leveraging similar hardware such as photon sources, beam splitters, and single-photon detectors.^[13] Practical implementations have also been developed for quantum PUFs.^[27]

In many cases, quantum authentication mechanisms have been integrated into existing QKD testbeds, allowing researchers to evaluate authentication performance alongside key distribution functionality.^[32] Ongoing experimental work focuses on extending transmission distances, improving noise tolerance, increasing key and state efficiency, and ensuring compatibility with emerging quantum network architectures, including early-stage quantum internet prototypes.^[20]

Quantum authentication has been proposed as a building block for secure quantum communication infrastructures. By providing authentication of users, devices or quantum messages, it complements confidentiality mechanisms such as quantum key distribution.^[32]

In QKD networks, authentication ensures that legitimate parties can securely establish keys without interference during initial communication. In a broader quantum internet context, authentication mechanisms are expected to play a central role in securing routing, entanglement distribution, and inter-network communication between heterogeneous quantum devices.^[12]

Additional proposed applications include distributed quantum computing environments, where authentication is necessary to verify participating nodes and ensure integrity of distributed quantum operations. Similar considerations arise in internet of things systems incorporating quantum or optical devices, where lightweight authentication mechanisms may be required for large-scale deployment.^[21]

Despite significant theoretical progress, quantum authentication protocols face several open technical and practical challenges. A major limitation is the lack of practical quantum memory, which restricts protocols that require long-term storage of quantum states or delayed verification procedures. Most current implementations must therefore operate in real time or rely on immediate measurement, limiting design flexibility.^[33]

Quantum noise and decoherence in communication channels also remain as significant obstacles, particularly over long distances or in non-ideal environmental conditions. These effects can increase error rates and complicate the reliable detection of malicious interference versus natural noise.^[20]

Scalability is another key challenge, as many protocols that work well in small-scale laboratory settings become difficult to extend to large networks with many users and devices. Issues such as synchronization, resource distribution, and network management become increasingly complex as system size grows.^[12]

Finally, composable security for quantum authentication protocols is still an active research area. While many schemes are proven secure in isolated models, ensuring that they remain secure when composed with other cryptographic primitives (such as QKD or quantum signatures) remains non-trivial and is essential for building fully secure quantum networks.^[11]

• Quantum cryptography
• Quantum key distribution
• Quantum digital signature
• Quantum Internet
• Quantum secret sharing
• Authentication
• Post-quantum cryptography

• How could quantum cryptography authenticate that the sender of a message is who they say they are?
• What is quantum-safe cryptography?