The Trap Code is a non-interactive scheme for quantum authentication. It appends two additional trap registers in a fixed state, on which a Pauli twirl or a permutation is acted on. It furthermore makes use of error correction codes for encoding the quantum message.

acheck

The trap code requires a shared pair of secret classical keys. It makes use of an error correction code to encode the quantum message. Consequently, two so-called trap registers in the fixed states $|0\rangle \langle 0|$ and $ |+\rangle \langle +|$ are appended. The total register is then encrypted by applying a permutation and a Pauli twirl, each according to the classical keys. The receiver then applies the inverse Pauli twirl and permutation and consequently measures the two trap registers in the computational or Hadamard basis respectively to decide whether to accept or abort the process.

• The sender and receiver share a secret classical pair of keys.
• The sender and receiver have agreed on an $[[n,k,d]]$ error correction code.

• ${\mathcal {S}}$: suppliant (sender)
• ${\mathcal {A}}$: authenticator (prover)
• $\rho$: 1-qubit input state
• $[[n,k,d]]$: an error correction code that corrects up to $t$ errors by encoding $k$ logical qubits in $n$ physical qubits, where $d = 2t + 1$
• ${\pi_i}$: a set of permutations indexed by $i$
• ${P_i}$: a set of Pauli operations indexed by $i$

acheck

Input: $\rho$, pair of secret classical keys $k = (k_1, k_2)$.

Output: Quantum state $\rho’$ if the protocol accepts; fixed quantum state $\Omega$ if the protocol aborts.

Encoding:

1. $\mathcal{S}$ applies an $[[n,1,d]]$ error correction code;
2. $\mathcal{S}$ appends an additional trap register of $n$ qubits in state $|0\rangle \langle 0|^{\otimes n}$;
3. $\mathcal{S}$ appends a second additional trap register of $n$ qubits in state $|+\rangle \langle +|^{\otimes n}$;
4. $\mathcal{S}$ permutes the total $3n$-qubit register by $\pi_{k_1}$ according to the key $k_1$;
5. $\mathcal{S}$ applies a Pauli encryption $P_{k_2}$ according to key $k_2$.

Mathematical Encoding Description:
Mathematically, the encoding process is given by
$$\mathcal{E}_k : \rho \mapsto P_{k_2} \pi_{k_1} \left( \text{Enc}(\rho) \otimes |0\rangle \langle 0|^{\otimes n} \otimes |+\rangle \langle +|^{\otimes n} \right) \pi_{k_1}^\dagger P_{k_2}.$$
In the above, $\text{Enc}(\rho)$ denotes the quantum message $\rho$ after applying the error correction code for encoding (see step 1).

Decoding:

1. $\mathcal{A}$ applies $P_{k_2}$ according to key $k_2$
2. $\mathcal{A}$ applies inverse permutation $\pi_{k_1}^\dagger$ according to the key $k_1$
3. $\mathcal{A}$ measures the last $n$ qubits in the Hadamard basis $\{|+\rangle, |-\rangle\}$
4. $\mathcal{A}$ measures the second last $n$ qubits in the computational basis $\{|0\rangle, |1\rangle\}$
   1. If the two measurements in step 3 and 4 result in $|+\rangle \langle +|$ and $|0\rangle \langle 0|$, an additional flag qubit in state $|\mathrm{ACC}\rangle \langle \mathrm{ACC}|$ is appended and the quantum message is decoded according to the error correction code.
   2. Otherwise, an additional flag qubit in state $|\mathrm{REJ}\rangle \langle \mathrm{REJ}|$ is appended and the (disturbed) encoded quantum message is replaced by a fixed state $\Omega$.

Mathematical Decoding Description:
Mathematically, the decoding process is given by
$$\mathcal{D}_k : \rho’ \mapsto \text{Dec} \, \mathrm{tr}_{0,+} \left( \mathcal{P}_{\text{acc}} \pi_{k_1}^\dagger P_{k_2}(\rho’) P_{k_2} \pi_{k_1} \mathcal{P}_{\text{acc}}^\dagger \right) \otimes |\mathrm{acc}\rangle \langle \mathrm{acc}| + \mathrm{tr}_{0,+} \left( \mathcal{P}_{\text{rej}} \pi_{k_1}^\dagger P_{k_2}(\rho’) P_{k_2} \pi_{k_1} \mathcal{P}_{\text{acc}}^\dagger \right) \Omega \otimes |\mathrm{rej}\rangle \langle \mathrm{rej}|. $$
In the above, $\text{Dec}$ refers to decoding of the error correction code (see step 4a) and $\mathrm{tr}_{0,+}$ denotes the trace over the two trap registers. Moreover, $\mathcal{P}_{\text{acc}}$ and $\mathcal{P}_{\text{rej}}$ refer to the measurement projectors that determine whether the protocol accepts or aborts the received quantum message. It is
$$\mathcal{P}_{\text{acc}} = I^{\otimes n} \otimes |0\rangle \langle 0|^{\otimes n} \otimes |+\rangle \langle +|^{\otimes n} \text{     and     } \mathcal{P}_{\text{rej}} = I^{\otimes 3n} – \mathcal{P}_{\text{acc}}. $$

1. Broadbent, Anne, Gus Gutoski, and Douglas Stebila. “Quantum one-time programs.” In Annual Cryptology Conference, pp. 344-360. Berlin, Heidelberg: Springer Berlin Heidelberg, 2013.
2. Broadbent, Anne, and Evelyn Wainewright. “Efficient simulation for quantum message authentication.” In Information Theoretic Security: 9th International Conference, ICITS 2016, Tacoma, WA, USA, August 9-12, 2016, Revised Selected Papers 9, pp. 72-91. Springer International Publishing, 2016.