Quantum many time pad

Question

In the Quantum One Time Pad, an $n$-qubit quantum state can be perfectly encrypted (as in the classical OTP) using $2n$ classical bits.

In the classical OTP, I'm allowed to send many times the encryption of the same message $m\oplus k$ with the same key—even if I only send it once, the receiver can always copy it many times $(m\oplus k,m\oplus k,m\oplus k,m\oplus k,\dots)$. The insecure classical many time pad means sending different messages encrypted under the same key $(c_1= m_1\oplus k,c_2 = m_2\oplus k)$ because I can derive the relation $c_1\oplus c_2 = m_1 \oplus m_2$ that leaks information.

In the quantum OTP: Say the key is composed of two n-bit strings $(a,b)$, then to encrypt the message $\psi$ to the ciphertext $\phi$, $$\lvert\phi\rangle = \bigotimes_{i=0}^{n-1} X^{a_i} Z^{b_i} \lvert\psi\rangle.$$

However, in the quantum world the receiver cannot copy the encrypted state I sent (no-cloning principle). But, I can prepare the same state multiple times and encrypt the same state with the same key, and provide these copies to the adversary (since they cannot copy them locally).

Is the quantum OTP still secure if I give an adversary many copies of the ciphertext-quantum-state of the same message with the same key?

Answer 1

No, it is no longer secure. The quantum OTP is secure for a single state $|\psi\rangle$ because $$ \frac 14\sum_{a,b} X^aZ^b |\psi\rangle\langle\psi|Z^bX^a = \frac {\mathbb{I}}{2} $$ The state is no longer completely mixed if many qubits are masked with the same key $(a,b)$.

The problem lies with the possibility of measuring the copies in more than one way. As an example, consider a state $|\psi\rangle$ which is either $|0\rangle$ or $|+\rangle$, and the attacker does not know which. An attacker with multiple copies of $X^aZ^b |\psi\rangle$ can measure half of the copies in the computational basis and half in the diagonal/Hadamard basis.

• If $|\psi\rangle=|0\rangle$, then $X^aZ^b|0\rangle=X^a|0\rangle=|a\rangle$, so each computational basis measurement will return $a$ whereas diagonal basis measurements will be random.
• If $|\psi\rangle=|+\rangle$, then $X^aZ^b|+\rangle=X^aH|b\rangle=H|b\rangle$, so each diagonal basis measurement will return $b$ whereas computational basis measurements will be random.

The attacker can distinguish many encryptions of $|0\rangle$ from many encryptions of $|+\rangle$ with better probability than would be possible with a single copy (by looking at which measurement basis always returns the same outcome).