⚛️ quantum physics

Authentication in Quantum Networks

This review paper surveys and compares various quantum authentication protocols for classical messages, quantum messages, and entity authentication, emphasizing that while authentication is a prerequisite for secure quantum communication rather than an intrinsic limitation, existing schemes can effectively support diverse applications when carefully matched to specific functional requirements and security assumptions.

Original authors: Christopher Battarbee, Suchetana Goswami, Elham Kashefi, Mina Doosti

Published 2026-06-30

📖 5 min read🧠 Deep dive

CC BY 4.0

Original authors: Christopher Battarbee, Suchetana Goswami, Elham Kashefi, Mina Doosti

Original paper licensed under CC BY 4.0 (http://creativecommons.org/licenses/by/4.0/). ✨ This is an AI-generated explanation of the paper below. It is not written or endorsed by the authors. For technical accuracy, refer to the original paper. Read full disclaimer

Imagine you are trying to send a secret letter to a friend across a crowded, noisy room where a thief is listening to everything and can swap your letters with fake ones. In the world of Quantum Networks, this is the daily challenge. Scientists use the weird laws of quantum physics (like particles that change when you look at them) to send super-secure messages. But there's a catch: to make sure the message actually comes from your friend and not the thief, you need Authentication.

This paper is a guidebook that sorts out the different "locks and keys" used to verify identity in these high-tech networks. The authors argue that you can't just say "we have quantum security" and stop there; you must first prove who is talking to whom.

Here is a breakdown of their findings using simple analogies:

1. The Three Types of "ID Checks"

The authors say "authentication" is often used as one big word, but it actually means three very different things. Think of them like different types of security guards:

Guarding the Message (Classical Message Authentication):
- The Job: Making sure the text on a piece of paper hasn't been scribbled over or swapped.
- The Analogy: Imagine sending a sealed envelope with a wax seal. If the seal is broken, you know someone tampered with it. This is for regular data (like the instructions telling a quantum computer what to do).
Guarding the Ghost (Quantum Message Authentication):
- The Job: Making sure a fragile, invisible quantum particle hasn't been swapped for a fake one.
- The Analogy: Imagine sending a soap bubble. If you touch it, it pops. You can't just look at it to see if it's real; you have to have a special way to check it without popping it. The paper says this is very hard to do and requires a lot of resources, like having a "magic shield" around the bubble.
Guarding the Person (Entity Authentication):
- The Job: Proving that the person holding the device is actually who they say they are, not an imposter.
- The Analogy: This is like a bouncer checking your ID at a club. It's not about the message you're carrying; it's about proving you are the real you.

2. The "Setup Cost" (The Price of Trust)

The paper explains that you can't get security for free. Every security method requires some initial "setup cost" or trust.

The Pre-Shared Key (The Secret Handshake):
- How it works: You and your friend meet in secret before you start talking and agree on a secret code.
- The Catch: If you have 100 friends, you need 100 different secret codes. It gets messy and expensive very quickly.
The Public Key (The Open Lock):
- How it works: Everyone has a public lock they can give out. Only you have the key to open it.
- The Catch: You have to trust that the lock you picked up actually belongs to your friend and wasn't swapped by the thief. This usually requires a "Certificate Authority" (a trusted notary) to vouch for the locks.
The Hardware Token (The Unfakeable Badge):
- How it works: Instead of a secret code, you give your friend a physical device (like a special chip) that reacts in a unique way when you poke it.
- The Catch: You have to physically deliver this device. But the cool part is that even if the thief steals the device, they can't easily copy its "fingerprint" because it relies on tiny, random manufacturing flaws (like a snowflake).

3. The "Quantum Advantage" and the "QKD Trap"

The paper tackles a famous debate about Quantum Key Distribution (QKD).

The Trap: Many people think QKD is magic because it uses quantum physics to create unbreakable codes. However, the paper points out a fatal flaw: QKD cannot authenticate itself.
The Analogy: Imagine QKD is a super-secure, invisible tunnel. But the door to the tunnel is unlocked. If a thief stands at the door and pretends to be your friend, they can trick you into sending your secret into their tunnel, not yours.
The Solution: To use QKD, you must first use one of the other methods (like a pre-shared key or a public key) to prove who is at the door. You can't just rely on the quantum tunnel alone.

4. The "Hardware" Future

The authors are excited about Hybrid Protocols.

The Idea: Combine a weak, cheap physical device (like a standard computer chip) with quantum magic.
The Analogy: Imagine a cheap lock that a thief could easily pick. But, you put that lock inside a glass box that shatters if you try to pick it. The quantum part acts as the "glass box," protecting the weak hardware. This allows for security that is cheaper and easier to scale than pure quantum methods, while still being safe against future quantum computers.

The Big Takeaway

The main message of the paper is: There is no such thing as "trust-free" security.

Every secure system, whether it's a quantum network or a regular email, relies on a "root of trust."

If you use a pre-shared key, your trust is in the person who handed you the key.
If you use a public key, your trust is in the notary who signed the certificate.
If you use hardware, your trust is in the factory that made the chip.

The paper concludes that we shouldn't just say "Quantum is secure." Instead, we must be very specific: "This quantum protocol is secure because we have verified the sender using [Specific Method]." If you don't check the ID of the person at the door, the fancy quantum tunnel behind them doesn't matter.

Technical Summary: Authentication in Quantum Networks

Problem Statement
The paper addresses a fundamental tension in quantum communication: while quantum mechanics offers security properties unattainable with classical information (such as information-theoretic secrecy), the establishment of these security guarantees often relies on classical communication channels. These channels must be authenticated to prevent man-in-the-middle attacks. However, the literature often conflates distinct cryptographic tasks under the single label of "authentication," leading to ambiguity regarding the necessary setup assumptions, security guarantees, and scalability of quantum protocols. Specifically, the authors note that national security agencies (e.g., NSA) have critiqued Quantum Key Distribution (QKD) for lacking intrinsic source authentication, requiring external asymmetric cryptography or pre-shared keys. The core problem is the lack of a unified framework to distinguish between the different types of authentication required by quantum networks and to evaluate the suitability of various mechanisms based on their specific security assumptions and resource requirements.

Methodology
The authors conduct a comprehensive review and comparative analysis of authentication mechanisms, categorizing them into three distinct functionalities:

Authentication of Classical Messages: Verifying that a classical message has not been tampered with and originates from a specific source.
Authentication of Quantum Messages: Verifying the integrity and origin of a quantum state, which implies encryption due to the no-cloning theorem and the inability to measure without disturbance.
Entity Authentication: Verifying the identity of a communicating party or device, often in real-time.

The evaluation framework utilizes specific "figures of merit":

Security Level: Distinguishing between unconditional (information-theoretic) security and conditional (computational) security, including resistance to quantum adversaries (post-quantum security).
Setup Requirements: Analyzing the necessity of pre-shared keys (classical or quantum), pre-shared hardware, or trusted authorities (PKI, KDC).
Composability: Assessing whether the authentication mechanism remains secure when composed with other cryptographic protocols, utilizing frameworks like Constructive Cryptography (CC) and Universal Composability (UC).
Scalability: Evaluating the "joining cost" for new participants in a network, particularly regarding the number of keys or tokens required ( $O(n^2)$ vs. $O(n)$ ).

The paper systematically surveys established classical schemes (e.g., Universal Hash Functions, MACs, Digital Signatures, KEMs) and quantum-specific schemes (e.g., Quantum Authentication, Quantum PUFs, Hybrid protocols), comparing their theoretical properties and practical deployment status, with a specific focus on QKD implementations.

Key Contributions

Taxonomy of Authentication: The paper rigorously disentangles three conflated functionalities (classical message, quantum message, and entity authentication), clarifying that they require different resources and offer different guarantees.
Comparative Analysis and Decision Framework: The authors provide a detailed comparison of representative protocols for each functionality. A central contribution is Figure 1, a decision tree that guides practitioners in selecting the appropriate classical message authentication mechanism based on specific constraints (e.g., network scaling, key pre-sharing capabilities, and trust assumptions).
Clarification of QKD Authentication: The paper debunks the notion that QKD is uniquely flawed regarding authentication. It argues that all secure communication, including QKD, relies on an initial authentication resource. The authors review the literature to show that QKD deployments often implicitly assume authenticated channels or rely on pre-shared keys, and they analyze the trade-offs of using symmetric vs. public-key authentication in QKD.
Hardware-Assisted Approaches: The review highlights recent advances in hardware-based authentication, specifically Physically Unclonable Functions (PUFs) and their quantum/hybrid variants (qPUFs, HLPUFs). It details how hybrid protocols can leverage quantum communication to boost the security of imperfect classical hardware against quantum adversaries.
Extension Beyond QKD: The paper extends the analysis to advanced quantum functionalities, such as secure multi-party computation, verifiable blind quantum computation, and quantum digital signatures, identifying where specific authentication resources are required as inputs.

Results

Classical Message Authentication: Unconditional security (e.g., Wegman-Carter UHFs) requires one-time pre-shared keys and suffers from poor scalability ( $O(n^2)$ key distribution). Computational security (e.g., MACs, Digital Signatures) allows key reuse and better scalability via Public Key Infrastructure (PKI) but relies on computational assumptions (e.g., one-way functions or trapdoor functions). Post-quantum signatures (e.g., ML-DSA) offer quantum resistance but often at the cost of larger key/signature sizes compared to pre-quantum schemes.
Quantum Message Authentication: Unlike classical authentication, authenticating a quantum message necessitates encryption. Schemes based on unitary 2-designs provide unconditional security and key recycling but require pre-shared classical keys and do not support public verifiability or transferable signatures for unknown quantum states.
Entity Authentication: Hardware-based approaches, particularly Hybrid Locked PUFs (HLPUFs), offer a path to exponential soundness amplification against quantum adversaries. These protocols can achieve information-theoretic security during the authentication phase even if the underlying hardware is imperfect, provided the setup phase is secure. However, scalability remains a challenge, often limited to star-network topologies with a central verifier.
QKD Deployment: A review of QKD literature reveals that many practical deployments omit explicit discussion of authentication mechanisms. When addressed, they often rely on pre-shared keys or, increasingly, post-quantum public-key cryptography. The paper notes that "quantum key expansion" (deriving more keys than initially shared) is theoretically possible with UHFs but practically limited by error rates.

Significance and Claims
The paper's primary claim is that authentication is not an intrinsic limitation of quantum networks but a prerequisite resource. The security of any quantum protocol is only as strong as the authentication assumption it relies upon. The authors argue that the "fatal flaw" critique of QKD applies equally to all secure communication; the solution is not to abandon quantum protocols but to explicitly match the authentication mechanism to the specific functionality, assumptions, and security guarantees required.

The authors emphasize that:

There is no "perfect" solution; trade-offs between security strength, setup complexity, and scalability are inevitable.
Existing classical and quantum literature offers a range of "quantum-secure" authentication schemes suitable for different applications if carefully matched to the use case.
Future research and deployment must move beyond implicit assumptions. As quantum infrastructure scales from point-to-point links to networks, the central task is to precisely state the authentication assumptions of each protocol and verify their realizability in practice.
Composability is a critical but often under-studied metric; while many classical schemes are understood in this regard, the composability of quantum-specific authentication (especially hardware-based) remains an open question.

The paper concludes by positioning authentication as the "root of trust" for distributed quantum protocols, asserting that clarifying the gap between theoretical security proofs and practical deployment assumptions is a precondition for trustworthy quantum infrastructure.