Quantum Spectral Authentication (QSA)

• Quantum Spectral Authentication is a family of protocols that authenticate secret resources through quantum-limited, spectral challenge–response methods, applicable to both physical keys and hidden quantum states.
• Optical and continuous-variable QSA methods use few-photon challenges and coherent state measurements, achieving strong security metrics such as false positive rates as low as 10⁻⁴ to 10⁻⁹.
• Public-unitary QSA verifies possession of planted quantum states by extracting spectral fingerprints from unitary challenges, relying on planted state unpredictability and transcript-bound confirmation for robustness.

Searching arXiv for recent and foundational papers on Quantum Spectral Authentication and related quantum authentication work. Quantum Spectral Authentication (QSA) denotes a family of quantum authentication ideas in which authentication is derived from a quantum-limited interaction with a secret resource rather than from a readable classical challenge alone. In the literature represented here, the name has two distinct usages. In the earlier usage, QSA abbreviates “Quantum-Secure Authentication” of a classical physical key, typically a physical unclonable function (PUF) or physical unclonable key (PUK), by interrogating it with few-photon optical challenges that are too information-poor to be emulated reliably (Goorden et al., 2013). In the more recent usage, QSA names a post-provisioning primitive for authenticating possession of a hidden quantum state or state-preparation capability by means of fresh public unitary challenges and short spectral fingerprints extracted from that hidden resource (Kish et al., 25 Mar 2026). This suggests that QSA is best understood not as a single protocol but as a technical lineage spanning optical challenge–response systems, continuous-variable realizations, and planted-state spectral authentication, situated alongside the broader theory of quantum data authentication.

1. Terminology, scope, and conceptual placement

The earliest explicit QSA label in this corpus appears in “Quantum-Secure Authentication with a Classical Key,” which authenticates a classical physical key by probing it with a quantum state of light whose high-dimensional wavefront contains too few photons for an adversary to infer the full challenge (Goorden et al., 2013). The protocol is aimed at defeating digital emulation of a physically unclonable object even if the challenge–response database is known. By contrast, “Quantum Spectral Authentication under Public Unitary Challenges” introduces QSA as a primitive for verifying that a remote endpoint still possesses a previously installed hidden quantum resource, such as a planted state or secret state-preparation capability, without revealing that resource (Kish et al., 25 Mar 2026).

Between these endpoints lies a continuous-variable branch of physical-key authentication. “Continuous-variable quantum authentication of physical unclonable keys” and its security analysis against emulation attacks retain the PUK setting but replace discrete photon-counting logic by coherent-state probes, wavefront shaping, and coarse-grained homodyne verification of quadratures (Nikolopoulos et al., 2017, Nikolopoulos, 2018). In that branch, the “spectral” aspect is embodied in random probe phases and the quadrature statistics of the scattered optical response.

QSA is distinct from quantum message authentication and quantum ciphertext authentication. The latter concern integrity of transmitted quantum data under keyed encoding and verification maps, often with composable real/ideal security definitions, key recycling, and simulator-based proofs (Garg et al., 2016, Dulek et al., 2018). The difference is structural: QSA authenticates possession or authenticity of a resource or endpoint, whereas message-authentication schemes authenticate communicated quantum states. A common misconception is to collapse these tasks into a single notion of “quantum authentication.” The literature instead treats them as adjacent but non-identical problem classes.

2. Optical and continuous-variable QSA for physical unclonable keys

The 2013 QSA protocol authenticates a random scattering medium using a spatial light modulator, few-photon coherent pulses, and a verifier-side optical decoder (Goorden et al., 2013). The challenge is a high-dimensional optical wavefront, described experimentally as a $50 \times 50$ binary phase matrix, sent to a scattering key whose response is transformed by a second SLM into a focal spot only when the response matches the enrolled one. The security parameter is

$S=\frac{K}{n},$

where $K$ is the number of controlled optical modes and $n$ is the mean photon number in the challenge pulse. The paper states that security becomes strong when $S>1$, and reports operation at about $S \approx 5$. It further reports $K=1100\pm 200$, pulse length $500\text{ ns}$, and $n=230\pm 40$. For the true key, the detection counts have mean about $4.3$; for random incorrect responses, the mean is about $S=\frac{K}{n},$0. With an acceptance threshold of at least $S=\frac{K}{n},$1 detections, the paper reports false positive and false negative probabilities of about $S=\frac{K}{n},$2 after $S=\frac{K}{n},$3 repetitions and about $S=\frac{K}{n},$4 after $S=\frac{K}{n},$5 repetitions (Goorden et al., 2013).

The core security argument is that an adversary who intercepts the challenge cannot determine the challenge wavefront well enough to synthesize the correct response. The paper states that under challenge-estimation attacks the expected squared inner product between the attacker’s best estimate and the true challenge is approximately

$S=\frac{K}{n},$6

and the detected photon fraction under attack obeys

$S=\frac{K}{n},$7

In the conservative bound $S=\frac{K}{n},$8, the attacker obtains only about one-fifth of the genuine signal, which places the forged response well below the acceptance threshold (Goorden et al., 2013).

The continuous-variable PUK protocols preserve the challenge–response structure but use coherent-state alphabets and homodyne statistics rather than photon-count thresholds (Nikolopoulos et al., 2017, Nikolopoulos, 2018). The challenge alphabet is

$S=\frac{K}{n},$9

and verification is based on whether measured quadrature values fall inside bins centered on the enrolled response. Over $K$0 sessions, the verifier computes

$K$1

or, in the later security analysis,

$K$2

and accepts when the observed frequency is within tolerance of the ideal in-bin probability. The required sample size obeys

$K$3

which ensures

$K$4

The 2018 security analysis states that with $K$5, one can reach $K$6 at $K$7 confidence (Nikolopoulos, 2018).

Security against emulation in the continuous-variable setting is explicitly information-theoretic. The adversary is assumed to know the user’s PIN, the full set of challenge–response pairs, the public setup parameters, and to have access to the probe during verification. The limiting factor is the inability to identify the random coherent-state challenge perfectly because the states are non-orthogonal. The security analysis combines Holevo’s bound and Fano’s inequality to derive a sufficient security condition,

$K$8

thereby translating unavoidable state-identification error into a detectable shift in binned homodyne statistics (Nikolopoulos, 2018). A plausible implication is that the optical and continuous-variable branches of QSA share the same cryptographic logic: public challenge descriptions may be available, but the physically realized quantum probe cannot be inferred with sufficient fidelity for real-time emulation.

3. Public-unitary Quantum Spectral Authentication

The 2026 formulation of QSA addresses a different task: authenticating that a remote endpoint still possesses a previously installed secret quantum resource after provisioning (Kish et al., 25 Mar 2026). The secret is a planted state

$K$9

defined by a hidden planting circuit $n$0. The verifier issues fresh public unitary challenges $n$1. For each challenge, the honest party extracts a short spectral feature, typically a dominant eigenphase bucket,

$n$2

forming the feature vector

$n$3

This vector is then compressed into session material by a classical KDF such as HKDF: $n$4 where $n$5 binds the output to the session transcript (Kish et al., 25 Mar 2026).

The spectral content arises from the autocorrelation or moment sequence

$n$6

If $n$7 has eigenbasis $n$8 with eigenphases $n$9 and

$S>1$0

then

$S>1$1

A classical evaluation regime uses the periodogram

$S>1$2

and chooses $S>1$3, followed by $S>1$4-bit quantization (Kish et al., 25 Mar 2026).

The paper distinguishes three implementation regimes. QSA-M uses explicit dense $S>1$5 matrices and eigendecomposition, with cost $S>1$6 per unitary. QSA-C uses public circuits and classically estimated moments $S>1$7, with state-vector simulation cost roughly $S>1$8 per unitary. QSA-Q evaluates the public circuits on a QPU using low-depth quantum phase estimation (LDQPE) or QPE, and is the paper’s practical focus (Kish et al., 25 Mar 2026).

The central implementation idea is a symmetric verifier-driven compiler,

$S>1$9

with

$S \approx 5$0

and a hidden computational basis string $S \approx 5$1 such that $S \approx 5$2. The signal eigenvector is

$S \approx 5$3

and the corresponding phase can be read off in closed form,

$S \approx 5$4

Because

$S \approx 5$5

the powered unitary preserves structure and avoids the depth blow-up of generic repeated powering (Kish et al., 25 Mar 2026). This is the architectural reason the symmetric construction is substantially more noise tolerant than the asymmetric alternative $S \approx 5$6.

The hardware-oriented evaluation uses LDQPE moments

$S \approx 5$7

estimated by Hadamard tests and unwrapped into an $S \approx 5$8-bit phase bucket (Kish et al., 25 Mar 2026). In simulation with $S \approx 5$9, $K=1100\pm 200$0, two-qubit depolarizing noise $K=1100\pm 200$1, $K=1100\pm 200$2 trials per noise point, and $K=1100\pm 200$3 shots per circuit, the symmetric construction remains near-perfect up to a few $K=1100\pm 200$4, retains about $K=1100\pm 200$5 accuracy around $K=1100\pm 200$6, falls to around $K=1100\pm 200$7 near $K=1100\pm 200$8, and is essentially zero beyond $K=1100\pm 200$9. The asymmetric construction degrades significantly already around $500\text{ ns}$0–$500\text{ ns}$1 and is essentially zero by $500\text{ ns}$2. The largest-moment circuits differ sharply in gate counts: symmetric $500\text{ ns}$3 versus asymmetric $500\text{ ns}$4 (Kish et al., 25 Mar 2026). Small-instance executions on IBM’s ibm_fez backend yielded $500\text{ ns}$5 correct buckets for $500\text{ ns}$6, $500\text{ ns}$7 for $500\text{ ns}$8, and $500\text{ ns}$9 for $n=230\pm 40$0, which the paper treats as a hardware sanity check rather than a full deployment demonstration.

4. Security models, attack surfaces, and common misunderstandings

In the public-unitary formulation, the adversary sees full public descriptions of the unitaries $n=230\pm 40$1, any public seed schedule or metadata, and possibly controlled access in some attack models, but does not possess the planting secret $n=230\pm 40$2, the planted state itself, copy access to that state, or the hidden selector that determines the honest eigenphase bucket (Kish et al., 25 Mar 2026). Security is cast through a Planted State Problem: given only the public unitaries, a successful adversary would have to output either a preparation circuit for a state $n=230\pm 40$3 with fidelity at least $n=230\pm 40$4 to the planted state, or an eigenphase vector $n=230\pm 40$5 that approximates the honest one to inverse-polynomial precision. The paper does not claim a tight worst-case reduction; instead it postulates planted-state unpredictability and studies concrete attack strategies.

The first analyzed family is chained QPE or eigenstate propagation. The attacker runs QPE on $n=230\pm 40$6, obtains a measured phase and a post-measurement eigenstate, and reuses that eigenstate on $n=230\pm 40$7, continuing across challenges. The paper bounds the chained success probability by

$n=230\pm 40$8

If successive signal eigenvectors behave like Haar-random vectors, then

$n=230\pm 40$9

yielding the pessimistic bound

$4.3$0

The conclusion is that diversified public challenges suppress cross-instance propagation (Kish et al., 25 Mar 2026).

The second family is repeated-session leakage. If the same planted state is reused across many sessions, the paper notes that small transcript leakage may accumulate and approach a tomography-style reconstruction path. Its mitigation is renewal or diversification: QSA-Q derives per-instance planted states from a seed $4.3$1 via HKDF and a PRG, so that leakage becomes per-session rather than long-horizon. This is one of the main operational caveats of the protocol (Kish et al., 25 Mar 2026).

The third family is direct online forgery against the confirmation wrapper. Once $4.3$2 has been compressed into a transcript-bound token, a generic one-shot forger succeeds with probability at most $4.3$3 per attempt, up to negligible bias from extraction and leakage. The paper explicitly remarks that if one unrealistically grants a repeated verification oracle, Grover search reduces the work to roughly $4.3$4, which is why confirmation must be transcript-bound and rate-limited (Kish et al., 25 Mar 2026).

These attacks clarify a recurrent misunderstanding: public unitary challenges are not meant to hide the challenge itself. Their role is freshness and transcript binding. Security is supposed to come from the adversary’s inability to infer the hidden state-dependent spectral response. This is closely analogous to older physical-key QSA, where the adversary may know the challenge–response table but still cannot identify the actual optical challenge well enough to emulate the response in real time (Goorden et al., 2013, Nikolopoulos, 2018).

5. Relation to quantum data authentication, key recycling, and adjacent paradigms

The broader quantum-authentication literature supplies the conceptual backdrop against which QSA should be read. “New security notions and feasibility results for authentication of quantum data” introduces a real/ideal simulation-based framework for quantum authentication in which the joint state including the secret key is compared, rather than averaging security only over the key (Garg et al., 2016). In that framework an authentication scheme is a pair of keyed superoperators $4.3$5 and $4.3$6, correctness requires

$4.3$7

and security requires that every real attack be simulatable by an ideal adversary while preserving correlations with the key. For classical messages, the ideal class is basis-respecting adversaries; for full quantum data, the strongest notion is total authentication, i.e. reduction to oblivious adversaries. A notable consequence is that the entire secret key can be re-used if the authentication protocol succeeds (Garg et al., 2016).

That line continues in quantum ciphertext authentication. “Quantum ciphertext authentication and key recycling with the trap code” shows that encode-and-encrypt constructions based on quantum error-correcting codes satisfy stronger ciphertext-integrity notions when the code family is purity testing, and allow key recycling when the code is strong purity testing (Dulek et al., 2018). The paper formulates strong purity testing as

$4.3$8

for every non-identity Pauli $4.3$9, and proves that strong purity testing implies QCA-R, with full key reuse on accept and partial reuse on reject. This line of work is not called QSA, but it gives the modern security vocabulary for “authentication of quantum data.”

A separate extension reaches continuous-variable messages. “Authentication of Continuous-Variable Quantum Messages” presents the first quantum authentication scheme for continuous-variable states, adapting the trap-code paradigm with squeezed $S=\frac{K}{n},$00- and $S=\frac{K}{n},$01-trap states, a secret permutation, Gaussian displacement one-time pads, homodyne verification, and a simulation-based proof based on a continuous-variable analogue of the Pauli twirl (Temel et al., 30 Jun 2025). Its main bound is

$S=\frac{K}{n},$02

with decoding correctness governed by

$S=\frac{K}{n},$03

This is relevant because it shows that the move from discrete to continuous variables, already present in continuous-variable PUK authentication, also exists for genuine quantum-message authentication (Temel et al., 30 Jun 2025).

The computational and public-key flank of the field now includes proposals that move beyond information-theoretic authentication. “Public-Key Quantum Authentication and Digital Signature Schemes Based on the QMA-Complete Problem” publishes local reduced density matrices of a private global state and bases security on the QMA-completeness of the Consistency of Local Density Matrices or Quantum Marginal Problem (Liu et al., 20 Jun 2025). “Pseudorandom quantum authentication” instead builds a private-key encryption-and-authentication scheme from pseudorandom unitaries, with ciphertexts computationally indistinguishable from maximally mixed states and asymptotically unit-fidelity recovery upon accepted verification (Haug et al., 1 Jan 2025). These schemes are not spectral in the QSA sense, but they show that the contemporary authentication landscape now spans information-theoretic, code-based, computational, and public-key models.

Historically, there is also an earlier precursor focused on avalanche-style tamper detection rather than composable security. “Quantum Secret Authentication Code” proposes a keyed entangling CNOT network over message and check qubits to make even local interference propagate widely after decoding, thereby replacing BB84-style random sample checking by one-way communication and key-derived verification (Wei et al., 2011). The paper is conceptually related to QSA as an attempt to strengthen authentication of quantum states, but it does not provide a modern composable proof.

6. Limitations, assumptions, and current research directions

The 2026 public-unitary QSA proposal is explicit about its caveats (Kish et al., 25 Mar 2026). It does not solve initial provisioning; it assumes that the hidden state or state-preparation capability has already been installed, perhaps by teleportation, commissioning, or seed-based enrollment. Its security rests on planted-state unpredictability rather than on a tight reduction. Its attack analysis covers chained QPE, repeated-session leakage, and direct online forgery, but not every adaptive or collusive strategy. Its practical viability is NISQ-limited: the symmetric $S=\frac{K}{n},$04 route is the only compelling near-term path, while the asymmetric alternative is too deep and too noise-sensitive. Its confirmation layer must be transcript-bound and rate-limited.

The optical and continuous-variable physical-key branch carries a different assumption stack. It presumes a physically unclonable scattering medium, trusted or tamper-resistant verifier apparatus during enrollment and verification, and enough optical stability for wavefront shaping and quadrature statistics to remain discriminative (Nikolopoulos et al., 2017, Nikolopoulos, 2018). In the continuous-variable emulation analysis, large sample sizes such as $S=\frac{K}{n},$05 are practical only because each session is assumed to be very fast. The 2017 paper also separates false-key rejection, collision resistance, and cloning resistance, indicating that “authentication” in this branch is partly a problem of physical distinguishability rather than solely one of cryptographic transcript security (Nikolopoulos et al., 2017).

Theoretical proposals on the computational side also remain provisional in different ways. The QMA-based public-key construction is presented as a theoretical framework rather than a deployment-ready system; its reduction is described as more of a proof sketch than a cryptographically tight reduction, and efficient verification depends on small fixed subsystem size $S=\frac{K}{n},$06 (Liu et al., 20 Jun 2025). Pseudorandom quantum authentication offers low-depth implementations and key reuse under weaker computational assumptions than semantic classical cryptography, but it is not a spectral method and therefore addresses a different design point (Haug et al., 1 Jan 2025).

A reasonable synthesis is that QSA currently names two active frontiers rather than one settled primitive. One frontier authenticates physical objects by quantum-limited challenge–response; the other authenticates hidden quantum resources by public unitary probes and spectral fingerprints. Both frontiers exploit the same asymmetry: the verifier can generate fresh tests cheaply, while an adversary cannot infer the hidden quantum information required to answer them correctly. Whether these strands converge into a unified theory of possession authentication for quantum networks remains open, but the available literature already supplies the main ingredients: physically unclonable substrates, simulator-based authentication notions, ciphertext integrity with key recycling, continuous-variable trap constructions, and transcript-bound spectral extraction (Goorden et al., 2013, Kish et al., 25 Mar 2026).