The Clifford Authentication Scheme is a non-interactive protocol for quantum authentication. It applies a random Clifford operator to the quantum message and an auxiliary register and then measures the auxiliary register to decide whether or not a eavesdropper has tampered the original quantum message.

Interactive Proofs for Quantum Computations

The Clifford code encodes a quantum message by appending an auxiliary register with each qubit in state $|0\rangle$ and then applying a random Clifford operator on all qubits. The authenticator then measures only the auxiliary register. If all qubits in the auxiliary register are still in state $|0\rangle$, the authenticator accepts and decodes the quantum message. Otherwise, the original quantum message was tampered by a third party and the authenticator aborts the process.

acheck

• $\mathcal{S}$: suppliant (sender)
• $\mathcal{A}$: authenticator (prover)
• $\rho$: $m$-qubit state to be transmitted
• $d \in \mathbb{N}$: security parameter defining the number of qubits in the auxiliary register
• $\{C_{k}\}$: set of Clifford operations on $n$ qubits labelled by a classical key $k \in \mathcal{K}$

• The Clifford code makes use of $n = m + d + 1$ qubits.
• The Clifford code is quantum authentication scheme with security $2^{-d}$.
• The qubit registers used can be divided into a message register with $m$ qubits, an auxiliary register with $d$ qubits, and a flag register with $1$ qubit.

Input: $\rho$, $d$, $k$

Output: Quantum state $\rho’$ if the protocol accepts; fixed quantum state $\Omega$ if the protocol aborts

Encoding:

1. $\mathcal{S}$ appends an auxiliary register of $d$ qubits in state $|0\rangle \langle 0|$ to the quantum message $\rho$, which results in $\rho \otimes |0\rangle \langle 0|^{\otimes d}$.
2. $\mathcal{S}$ then applies $C_k$ for a uniformly random $k \in \mathcal{K}$ on the total state.
3. $\mathcal{S}$ sends the result to $\mathcal{A}$.

Mathematical Encoding Description:
Mathematically, the encoding process can be described by $$\mathcal{E}{k} : \rho \mapsto C{k}\left(\rho \otimes |0\rangle \langle 0|^{\otimes d}\right)C_{k}^{\dagger}.$$

Decoding:

1. $\mathcal{A}$ applies the inverse Clifford $C_k^{\dagger}$ to the received state, which is denoted by $\rho’$.
2. $\mathcal{A}$ measures the auxiliary register in the computational basis.
   a. If all $d$ auxiliary qubits are 0, the state is accepted and an additional flag qubit in state $|\mathrm{ACC}\rangle \langle \mathrm{ACC}|$ is appended.
   b. Otherwise, the remaining system is traced out and replaced with a fixed $m$-qubit state $\Omega$ and an additional flag qubit in state $|\mathrm{REJ}\rangle \langle \mathrm{REJ}|$ is appended.

Mathematical Decoding Description:
Mathematically, the decoding process is described by
$$\mathcal{D}k : \rho’ \mapsto \mathrm{tr}0\left(\mathcal{P}{\mathrm{acc}} C_k^{\dagger}(\rho’) C_k \mathcal{P}{\mathrm{acc}}^{\dagger}\right) \otimes |\mathrm{ACC}\rangle \langle \mathrm{ACC}| + \mathrm{tr}\left(\mathcal{P}{\mathrm{rej}} C_k^{\dagger}(\rho’) C_k \mathcal{P}{\mathrm{rej}}^{\dagger}\right) \Omega \otimes |\mathrm{REJ}\rangle \langle \mathrm{REJ}|.$$

In the above, $\mathrm{tr}0$ is the trace over the auxiliary register only, and $\mathrm{tr}$ is the trace over the quantum message system and the auxiliary system. Furthermore, $\mathcal{P}{\mathrm{acc}}$ and $\mathcal{P}{\mathrm{rej}}$ refer to the measurement projectors that determine whether the protocol accepts or aborts the received quantum message. It is $$\mathcal{P}{\mathrm{acc}} = \mathbb{1}^{\otimes n} \otimes |0\rangle \langle 0|^{\otimes d} \text{    and     } \mathcal{P}{\mathrm{rej}} = \mathbb{1}^{\otimes (n+d)} – \mathcal{P}{\mathrm{acc}}.$$

1. Aharonov, Dorit, Michael Ben-Or, Elad Eban, and Urmila Mahadev. “Interactive proofs for quantum computations.” arXiv preprint arXiv:1704.04487 (2017).