Post-quantum security

Source research checked 19 Oct 2026. Teaching calculations are ideal models.

A sender can hide an arbitrary single-qubit state by applying one of four operations chosen with two secret random classical bits. An observer without the key sees a maximally mixed qubit, independent of the original state. The receiver who has the key can undo the operation. This is the quantum one-time pad. Its appeal is that secrecy comes from a precise transformation rather than a promise that the message is too complicated to understand. Its assumptions also matter: the key must be secret, appropriately random and used according to the protocol. The simple confidentiality calculation is not a complete authenticated communication system.

The four choices are the identity and the three Pauli directions, with irrelevant overall phases handled by a consistent convention. Averaging those choices cancels the components of the input Bloch vector. The resulting state is identity divided by two for every input. Someone who knows the choice does not average over it; they apply the inverse and recover the original ideal state. This is a clean example of why the observer's information belongs in a security description. The physical transmitted system can be the same while the key changes which conditional description the receiver can use.

The key is a separate classical resource. Without it, averaging over the four allowed operations produces the same maximally mixed description for every input. With the key, the authorized receiver can apply the correct inverse operation. Confidentiality and integrity remain different goals: a malicious alteration can require additional authentication even when the original message is hidden. This ideal cipher is a quantum-information example, not a consumer security recommendation. It encrypts quantum states; post-quantum public-key algorithms normally run on classical systems.

The quantum one-time pad gives a specific confidentiality statement. Averaging over the uniformly selected secret Pauli key makes the observer's ciphertext state independent of the input. The intended receiver, who knows the key, applies the appropriate inverse. That proof is valuable precisely because it states what the observer receives and what information the observer lacks.

A complete service has additional jobs. It must establish and protect the classical key, prevent unsafe key reuse under the chosen security model and decide how to handle tampering or loss. Those properties do not follow merely from the average ciphertext being maximally mixed. When assessing a proposed implementation, ask for the key assumptions and the separate mechanism supporting each claimed property. Calling a component secure should not collapse several different guarantees into one word. The four-operation calculation provides a concise example of how to make one strong statement while preserving its boundary.

Follow the complete derivation and reference calculation →

Source research checked 19 Oct 2026. Teaching calculations are ideal models.

Encrypt a qubit by choosing uniformly among I, X, Z and XZ with a secret two-bit key. An observer without the key describes the ciphertext by averaging all four possibilities. The exercise concerns confidentiality of a one-qubit state under this ideal key model; it does not include authentication or key distribution.

The useful distinction is between the state conditioned on knowing the key and the state available to an observer who lacks it. Randomization does not make the intended receiver forget the message; it changes the adversary’s available description. The security statement should therefore name the key assumptions and the information available to each party.

Figure and table scope: Compare the original and Pauli-conditioned X and Z components for illustrative input X=0.6 and Z=0.4, then the uniform four-key average. Only these two components are plotted.

Derivation step 1: Write an arbitrary qubit density matrix or its Bloch-vector form. Conjugation by each Pauli operation changes selected signs of its nonidentity components.

Derivation step 2: Average the four conjugated matrices with weight one quarter. Every Bloch-vector component cancels and the result is I/2.

Derivation step 3: A receiver with the key applies the corresponding inverse and recovers the original state in the ideal model.

Derivation step 4: Reusing a key across messages creates a different security problem. Likewise, detecting a malicious alteration requires an authentication construction beyond this averaging argument.

Separate challenge: If the randomizer uses only I and Z on a zero-state input, what does a keyless observer see? Is that enough to hide every qubit?

Worked challenge answer: Both operations leave zero unchanged, so the average is still the zero projector. The two-operation scheme does not hide arbitrary inputs. The full four-Pauli average removes all three Bloch components.

Compare the input regimes

Each case uses invented inputs. The results follow from this model and do not describe measured hardware.

Try the reasoning: If the randomizer uses only I and Z on a zero-state input, what does a keyless observer see? Is that enough to hide every qubit?