Quantum authentication is the sub-field of quantum cryptography that aims to apply quantum information theory for the purpose of authentication of quantum messages, users or devices. Counterintuitively, it refers to a different problem from the authentication of the classical channel assumed in QKD protocols, which doesn't natively require quantum resources.
A number of authentication protocols have been proposed since the advent of quantum cryptography, often inspired by quantum key distribution counterparts. Ongoing research aims to both design new schemes and experimentally implement already proposed ones, as the technologies needed are mostly still under development.
History The first quantum authentication protocol was proposed in 1995, based on oblivious transfer. Subsequent results in quantum cryptography showed that unconditionally secure two-party oblivious transfer in the quantum setting is impossible, limiting the feasibility of such constructions.
Early work also addressed the broader problem of quantum message authentication. It was proposed that quantum states can be authenticated against tampering using symmetric-key techniques, but that general quantum public-key authentication is not achievable without additional assumptions or restricted adversarial models. These results also influenced following work on quantum digital signatures, using pre-distributed quantum states and restricted security assumptions.
Limited activity on quantum identity authentication (QIA) continued in the late 1990s, followed by a marked increase in proposals from the early 2000s onward. Many of these early QIA protocols were motivated by developments in quantum key distribution and typically assumed pre-shared entanglement or conjugate coding techniques; research on quantum message authentication and digital signatures also continued, focusing on reducing costs and formalizing security. More technologies were explored, such as entanglement swapping, multipartite entanglement and trusted third-party schemes. Security analyses narrowed down the results by clarifying limitations related to key reuse, composability and adversarial assumptions.
Types of quantum authentication Quantum authentication includes several related research areas that can be distinguished according to what is being authenticated: while some protocols authenticate the identity of a user or communicating party, others authenticate the integrity of transmitted quantum information or provide signature-like security. Although these areas share common cryptographic techniques, they address different security objectives and are often studied independently.
Quantum identity authentication Quantum identity authentication (QIA) aims to authenticate a user, device or other communicating party by exploiting quantum-mechanical properties. Unlike classical authentication, these protocols use quantum states during the authentication process, allowing eavesdropping or impersonation attempts to be detected through the disturbance introduced by quantum measurements.
QIA protocols may provide one-way authentication, in which one party authenticates the other, or mutual authentication, where both parties verify each other's identity. Many schemes are inspired by classical challenge-response authentication, adapting them to quantum communication channels. They can also be classified as interactive or non-interactive depending on whether both parties must actively exchange information during the authentication phase.
Quantum message authentication In quantum message authentication (QMA), the aim is to authenticate the integrity and origin of quantum information sent over a quantum channel. Unlike classical message authentication, the message itself is a quantum state, which cannot generally be copied because of the no-cloning theorem. Quantum message authentication schemes therefore combine quantum encoding with a shared secret key, allowing the receiver to detect any modification or tampering of the transmitted state. If authentication fails, the receiver rejects the message rather than attempting to recover it.
A foundational result by Barnum et al. showed that authentication of arbitrary quantum states necessarily implies their encryption, meaning that a protocol capable of detecting tampering must also conceal the quantum information from an adversary; the same work also argued that unrestricted digital signatures for unknown quantum states are impossible without additional assumptions.
Quantum digital signatures
Quantum digital signatures (QDS) are the quantum counterpart of classical digital signatures; they are intended to provide authenticity, integrity and non-repudiation while offering security based on quantum theory rather than computational assumptions. Most QDS protocols authenticate classical messages using quantum states distributed during a setup phase, instead of attempting to sign arbitrary quantum states directly: this distinguishes them from QMA.
A QDS scheme consists of three probabilistic polynomial-time quantum Turing machines (, , ), where is a key-generation algorithm that, on input , outputs a pair (s, v) consisting of a secret signing key and a public verification key. is a signing algorithm, is a verification algorithm such that for all messages and all sufficiently large ,,where the probability is taken over the internal randomness (classical and quantum) of (, , ).
Protocol classification Quantum authentication protocols can be classified along multiple independent dimensions, including the quantum resources they employ or the underlying cryptographic primitive; these classification schemes are not mutually exclusive but highlight different aspects of protocol design, ranging from theoretical foundations to practical implementation constraints.
By underlying cryptographic primitive Quantum authentication protocols can be categorized according to the classical or quantum cryptographic primitive they are built on. Many schemes are derived from QKD, reusing conjugate coding or BB84-like states: in these constructions, authentication is often achieved as an additional layer on top of key establishment, or by embedding authentication information directly into quantum states exchanged during the protocol.
Other approaches are based on alternative primitives, including quantum secure direct communication (QSDC), quantum teleportation-based schemes, quantum secret sharing, quantum private comparison, and quantum oblivious transfer. Each of these primitives introduces different structural assumptions and communication patterns. For instance, QSDC-based authentication protocols often aim to transmit authenticated messages directly through quantum states without first establishing a shared secret key, while secret-sharing-based constructions distribute authentication information across multiple parties to prevent unilateral forgery or impersonation.
These different foundations lead to distinct trade-offs in terms of communication complexity, quantum channel usage, and trust assumptions: for example, protocols built on teleportation or entanglement distribution may offer stronger theoretical guarantees or richer functionality, but typically require more demanding infrastructure, such as reliable entanglement distribution and synchronization between participants.
By quantum resources
Another classification considers the physical quantum resources required for protocol execution. Early quantum authentication proposals frequently relied on pre-shared entanglement, especially Bell pairs, as a fundamental resource for establishing correlations that cannot be classically replicated: these entangled-pair-based schemes often assume that entanglement is distributed in advance between legitimate parties and later consumed during authentication.
Following research extended these ideas to multipartite entanglement structures, such as Greenberger–Horne–Zeilinger (GHZ) states, which allow authentication schemes involving multiple participants or distributed verification processes. More sophisticated constructions also incorporate entanglement swapping, enabling to dynamically entangle parties that have never directly interacted.
In contrast, a large family of more practical protocols avoids entanglement, instead relying on single-photon or weak coherent pulse implementations, which are significantly easier to realize experimentally using existing optical technologies. These schemes are often closer to QKD implementations and are more compatible with current fiber-optic infrastructure.
More recent developments include semi-quantum authentication models, in which only one party (typically the sender or trusted authority) requires full quantum capabilities, while other participants are restricted to classical operations such as reflection, measurement in a fixed basis, or classical communication. This approach reduces hardware requirements and broadens potential deployment scenarios.
Moreover, newer research directions explore a quantum counterpart of physical unclonable functions (PUFs), where inherently noisy or complex quantum systems serve as device-specific fingerprints. These quantum PUF-based approaches aim to provide lightweight authentication mechanisms rooted in physical uniqueness rather than cryptographic computation.
Finally, quantum position verification is being explored as a tool for identity authentication.
Security The security of quantum authentication protocols derives from fundamental properties of quantum mechanics instead of computational assumptions. The no-cloning theorem prevents an attacker from creating copies of unknown quantum states, and any measurement disturbs the measured system: any eavesdropping or tampering attempts are detected. This prevents adversaries from perfectly replicating authentication tokens encoded in quantum information.
Another key property is the disturbance caused by measurement: any attempt to extract information from a quantum system generally introduces detectable disturbances. This ensures that eavesdropping or tampering during transmission can be identified with non-zero probability. In addition, many protocols rely on the impossibility of perfectly distinguishing non-orthogonal quantum states, which limits an adversary's ability to infer encoded information without introducing errors.
Threats
Quantum authentication protocols are designed to resist a number of attacks, including impersonation, message forgery, replay attacks and man-in-the-middle attacks. Replay attacks involve re-transmitting previously valid quantum or classical authentication transcripts to gain access, while man-in-the-middle attacks attempt to intercept and modify quantum transmissions while impersonating both legitimate parties to each other. Depending on the specific protocol, attackers may also attempt state replacement attacks, where transmitted quantum states are substituted with dishonestly prepared ones designed to not be detected.
Security analyses typically distinguish between external adversaries and dishonest insiders. In the second case, even legitimate participants could deviate from the protocol in an attempt to cheat, which significantly complicates security proofs. Formal guarantees therefore depend strongly on the chosen adversarial model and assumptions about participant behavior.
Security assumptions Despite relying on quantum-mechanical principles, most quantum authentication protocols require additional assumptions beyond the laws of physics alone. A common requirement is the existence of an authenticated classical channel, which ensures that classical messages exchanged during the protocol cannot be tampered with without being detected. This assumption is also standard in quantum key distribution and is typically enforced using classical authentication codes or pre-shared keys.