A practical quantum encryption protocol with varying encryption configurations

Quantum communication is an important application that derives from the burgeoning field of quantum information and quantum computation. Focusing on secure communication, quantum cryptography has two major directions of development, namely quantum key distribution and quantum encryption. In this work we propose a quantum encryption protocol that utilizes a quantum algorithm to create blocks of ciphertexts based on quantum states. The main feature of our quantum encryption protocol is that the encryption configuration of each block is determined by the previous blocks, such that additional security is provided. We then demonstrate our method by an example model encrypting the English alphabet, with numerical simulation results showing the large error rate of a mock attack by a potential adversary. With possible future improvements in mind, our quantum encryption protocol is a capable addition to the toolbox of quantum cryptography.


Introduction
Utilizing quantum technologies for communication has been a major focus of the field of quantum computation and quantum information [1,2,3,4]. In particular, with emphasis on secure communication, quantum cryptography has seen enormous progress with both theoretical and experimental advances [5,6,7]. One major direction of quantum cryptography, quantum key distribution (QKD) [7,8,9,10], enables secure key generation and distribution by exploiting the non-locality of quantum entanglement. The other major direction of quantum cryptography, quantum encryption [11,12,13], uses quantum computing techniques to create quantum states that carry the ciphertext.
The development of physical realizations of qubit systems and quantum circuits has led to a variety of breakthroughs including the success of ground-to-satellite communication [14,15], which enables reliable ultra-long-distance quantum key distribution; and electron spin state teleportation with high fidelity, which proclaims the feasibility to achieve quantum teleportation in molecular systems [16]. There also arises pioneers of quantum teleportation in various systems such as atomic ensembles [17], electron spins in quantum dots [18], trapped ions [19] and superconducting circuits [20]. With these state-of-the-art advances in experimental techniques, one can envision the near-future realization of highly complex and sophisticated quantum communication protocols protected by quantum encryption methods.
In this work, we propose a quantum communication protocol with quantum encryption. As a block cipher, the plaintexts and the corresponding ciphertexts are sent in sequential blocks encrypted by a fixed number of qubits. The main feature that makes our quantum encryption method different from others is that the encryption configuration of each block is determined by the previous blocks, such that adjacent blocks are more likely to use different encryption configurations. This makes the encryption Alice is isolated from the outside environment. Alice's friend, Bob attempts to communicate with Alice. The only connection between Alice and Bob is some shared qubits. Both Alice and Bob can apply arbitrary operations on the qubits, and Bob can apply Z measurement on every single qubit. When t = kT , where k = 0, 1, 2, 3 . . . , All qubits q 1 , q 2 , . . . , q N will be set at state |0 . Alice will start preparing the qubits at state |Φ k = |M 1 M 2 . . . M N , and X represents Pauli-x operation. Later, these qubits will be encoded into state |Ψ k via the encoding circuit (the green box). Alice needs to finish these processes before t = kT + t 1 , and t 1 < T . Then Bob will start decode the qubits, and then apply Z measurements on each qubit. Measurements are required to be done before t = kT + T , after which all qubits will be reset at state |0 .  Figure 2: Sketch of the encryption process. Binary message is divided into several blocks, each of them has the same length. Alice and Bob have set their clocks at the same time before being separated. They share the encoding operation encrypting the first block. When k > 1, the k − th ciphertext |Ψ k is generated by encrypting the plaintext |Φ k and the encoding circuit U k , |Ψ k = U k |Φ k , where the encoding operation U k = U k (|Φ k−1 ) is determined by the former plaintext |Φ k−1 and Θ 1,2 . Θ 1,2 are some parameters shared by all encoding operations, will be discussed when we demonstrate the encoding operations.
Generally, it requires a number of repeating measurements to get a quite accurate estimation of a certain quantum state, as an example, the widely used quantum tomography [21] requires exponential measurements to pin a quantum state. In addition, Alice's special communication strategy makes it extremely difficult to extract the information from the N qubits. As no copy is offered, Bob needs to ensure that n(k) can be derived after only one single measurement (Here we ignored the noises and errors, strategies against noises in the circuit are discussed later). Besides, the encoding operator U k is determined by the former plaintext n, so that all following results can no longer be convincing if we make a wrong estimation for even one single n. However, next we show that knowing the first encoding operator and the way how the following encoding operators depend on the previous plaintexts, concequently Bob can indeed obtain n(k) with ease. The difficulty created by the communication strategy therefore falls to Eve, the potential adversary that does not know the encoding operators.
Here, we will demonstrate the whole process of encryption and decryption. For simplicity, we assume that 6 qubits {q 1 , q 2 , · · · , q 6 } are used by Alice to communicate with Bob. Generally, 10 numbers, 26 capital letters and 26 small ones, a mark to divide words (blank space) and a mark to divide sentence (like , or .) are required in communication, so that in total 64 states |Ψ are needed. As 2 6 = 64, 6 qubits are already enough to encode the English alphabet together with numbers and marks. Sometimes special characters might be required in the communication, and methods to design encoding circuits for more qubits are presented in the supplementary materials. In the following example model, all U k can be decomposed into 2-qubit control gates u ij where i, j ∈ {1, 2, 3, 4, 5, 6}, i = j. q j is controlled by q i . R(Θ) is single qubit rotation gate, and . For example, in the simplest situation, U k has only two possible choices, and these two encoding circuit are as following: Encoding circuit 1: 3-qubit-loop. q 1 , q 2 , q 3 form one loop of control rotation gates and q 4 , q 5 , q 6 form another. Initially, q 1 , q 2 , · · · , q 6 are prepared at state |n , and n = 0, 1, 2, . . . , 2 N − 1, where there are N qubits used in their communication. Then Alice can use the circuit shown in fig.(3(a)) to encode information into |Ψ in k . We note this circuit as U tri , and one can use U −1 tri to extract information encoded by U tri . q1 q2 q3 q4 q5 q6 Figure 3: Sketch of encoding circuit. Initially, q 1 , q 2 , · · · , q 6 are prepared at state |n , then Alice can use these circuit to encode information into |Ψ k . (a.)The encoding circuit based on 3 qubits control gates loop. q 1 , q 2 , q 3 form one loop and q 4 , q 5 , q 6 form another. We note this encoding circuit as U tri , and one can use U −1 tri to extract information encoded by U tri . (b.)The encoding circuit based on 2 qubits control gates loop. q 1 , q 2 form one loop, and q 3 , q 4 ; q 5 , q 6 form two other loops respectively. We would like to note this circuit as U bin , and one can apply U −1 bin as well to extract information encoded by U bin . Here we only show two simple encryption operations as example. There are in fact more choices, which will be discussed later.
Encoding circuit 2: 2-qubit-loop. As shown in fig.(3(b)), q 1 , q 2 form one loop, and q 3 , q 4 ; q 5 , q 6 form two other loops respectively. Initially, q 1 , q 2 , · · · , q 6 are prepared at state |n , then Alice can use this circuit to encode information into |Ψ in k . We would like to note this circuit as U bin , and one can apply U −1 bin as well to extract information encoded by U bin . If n(k − 1) is odd, then Alice will use circuit 1 to encode n(k); otherwise, she will choose circuit 2 to encode n(k). Obviously, the encoding strategy is determined by the bit stored in q 6 , as when q 6 represents 1 then Alice will use circuit 1 for encoding, otherwise circuit 2 will be chosen. Bob knows the parameters Θ 1 , Θ 2 , then as shown in fig.(4), he can combine the inverse of circuit 1 and 2 together as the decoding circuit, where R 1 and R 2 represent R −1 (Θ 1 ) and R −1 (Θ 2 ) respectively. One auxiliary qubit q aux is introduced to represent the previous measurement result to q 6 . In fact, such a circuit is not the only possible solution to decode information from Alice's special communication strategy. If we prefer to make it more difficult to decode, it is also a choice to design more different encoding operations for every state |n , yet more auxiliary qubits will be required for such complicated strategies. Figure 4: A possible circuit to decode Alice's information q aux is an auxiliary qubit, and in each period it is preset at state |0 . m is the previous measurement results of q 6 . As Alice and Bob make an agreement that the first block is encrypted by U 0 = U 0 (|0 ), Bob will set m = 0 initially. Alice only performs operations on q 1 q 6 . For simplicity, here we use R 1 and R 2 to represent R −1 (Θ 1 ) and R −1 (Θ 2 ) respectively.
Note that even in the simplest examples displayed above, we still apply control rotation gates instead of standalone single qubit gates. The existence of multi qubit gates in encryption ensures that the change of a single qubit in the plaintext could have influence on more than one qubit in the cipher, which corresponds to the concept of diffusion in classical cryptography [22].

Application in quantum communication
In this section, we will study a more complicated situation. Assume that Eve attempts to eavesdrop the communication between Alice and Bob. As shown in fig.(5), Still we design a scenario where Alice is nearly isolated from the outside environment, and the only connection between Alice and people outside is some qubits. Alice attempts to communicate with Bob, her friend via these qubits. However, to wiretap the communication, Eve Eve has prepared her own group of qubits to impersonate Bob. Now there are two groups of qubits: q 1 , q 2 , . . . , q N and q 1 , q 2 , . . . , q N . Bob has access to operate and measure q 1 , q 2 , . . . , q N , while Eve has the access to apply operation or measurement on q 1 , q 2 , . . . , q N . However, Alice does not know which group is under Bob's control. Consequently, she has to prepare two identical groups of ciphertext states. Alice(mid) is locked in a 'black room', and the only connection between Alice and the outside environment is some qubits. Alice attempts to communicate with her friend Bob(right) via the qubits. However, there are two groups of qubits: q 1 , q 2 , . . . , q N and q 1 , q 2 , . . . , q N . Bob has access to operate and measure q 1 , q 2 , . . . , q N , while Eve has the access to apply operation or measurement on q 1 , q 2 , . . . , q N . However, Alice does not know which group is under Bob's control. Consequently, Alice has to prepare two groups as same state.

Alice
In section I, we have used two encoding operations: U tri = (u 31 · u 23 · u 12 ) ⊗ (u 64 · u 56 · u 45 ) (the 3-qubit encoding operations, shown in fig.(3(a))), and U bi = (u 21 · u 12 ) ⊗ (u 43 · u 34 ) ⊗ (u 65 · u 56 ) (the 2-qubit encoding operations, shown in fig.(3(b))), where u ij is described by eq.(2). And we use U tri to encode the new state |n(k) if the previous n(k − 1) is odd, and use U bi otherwise. Generally speaking, if Eve does not know the encoding strategy, or she can not apply operations on the qubits, then it will be quite safe for Alice and Bob to communicate via this strategy (For more details see the first section in the supplementary materials).
Review the information shared between Alice and Bob as following. S1. Alice will start to prepare qubits at certain states for communication since t = 0. Before t = 0 she will produce some random state. Alice and Bob have set their clock at same time before they are separated.
S2. Six qubits are used in the communication. Note the eigenstates under Z measurements can be written as |n , where n is an integer from 0 to 63. State |0 represents the blank space, used as word divider. |1 to |26 represent capital letters 'A' to 'Z', |27 to |52 represent lower-case letters 'a' to 'z', and |53 to |62 represent numbers '0' to '9'. The last eigenstate |63 represents ',', '.', or other marks to divide sentences.
S3. Alice will prepare state Even if we assume that Eve knows the general strategy that the encoding operation of each block is determined by the plaintext of the previous block, without knowing the particular selection of encoding operations from the total set, and without knowing the plaintext of the previous block, the chance of her guessing the correct decoding operation and obtaining the plaintext is very low.
Then consider the worst situation where Eve also knows the selection of encryption operations and parameters Θ 1,2 . Besides, we assume that Eve has the authority to apply arbitrary operations on the qubits q 1 , q 2 , . . . , q N . In other words, Eve knows almost all information that Alice and Bob share, with only one exception, the clock, which obstructs Eve from applying correct decryption operation on the first block. In order to miss the least information, by large chance Eve will start wiretapping as early as possible. According to the first communication strategy, before t = 0, Alice produces states randomly. On the other hand, Eve has no idea about the exact 't = 0'. Consequently, at t = 0, Eve might apply the decoding operation U bi , or U tri . Once Eve applies U tri , she can hardly decode the first state |Ψ(t = 0) correctly, then she will get less information comparing to Bob.
Though we have shown that there is possibility to avoid Alice from getting all information, we need to note that it is nearly impossible to prohibit Eve from getting 'much information' under such communication strategies. Even though Eve might decode state |n as |n by mistake, once both n, n are odd or even, the following states will all be decoded correctly.
Take the above consideration into account, Alice and Bob can change the third strategy as the following: S3.Alice will prepare state |Ψ(k) = U (n(k − 1))|n . Instead of having only two encoding options determined by the parity of the previous plaintext, Alice and Bob can pick up a total number of n different encoding options, determined by all n different possibilities of the previous block of plaintext. All U (n) can be decomposed as combination of u ij = u ij (Θ 1 , Θ 2 ) described by eq.(2).
In the supplementary materials, we will provide one encoding operations set as example for S.3, which is also used in the following numerical simulations. For instance, Alice attempts to transport the famous quotation of Alexandre Dumas, All human wisdom is contained in these words: Wait and hope.
The Count of Monte Cristo, Chap 117.
As in the encoding process, all marks such as , . : will be recognized as . , and since there is no character representing 'line break' or 'new line', the quotation will be converted into, All human wisdom is contained in these words. Wait and hope. The Count of Monte Cristo. Chap 117.
Alice and Bob arrange that the |Ψ(t = 0) is encoded by V 0 , and encoding operation V m will be applied for the k − th block t if n(k − 1) = m. For simplicity, definition of the encoding operations are presented in the supplementary materials. At t = 0(according to Alice and Bob's clock), Alice will start to prepare the 6 qubits at state where |1 is the plaintext, representing the first character A in the quotation. Before t = t 1 , Alice should finish the preparation, and then Bob will start his decoding process. Bob will apply decoding operation V −1 0 , as he already knows that |Ψ(t = 0) is encoded by V 0 . For simplicity, here we ignore the noise and errors in the whole process (New rules shall be introduced into the communication strategy against noise, and we will give a brief discussion later). After Z measurement on each qubit, and Bob will derive that |Φ(t = 0) = |1 . Bob finishes his measurement before t = T , and at t = T all qubits are reset at state |0 . The next character is l , corresponding to state |38 (or |100110 as binary). Now Alice should prepare state Alice and Bob can keep communicating in this way. Ignoring the errors and noise, Bob can always receive the correct information theoretically. On the other hand, Eve finds it impossible to find t = 0 accurately for the absence of shared clock. Additionally, Alice have already noticed her existence and will produce random states before t = 0. Here we can safely assume that Eve applies random decoding operations at t = 0. Assume that Alice has no bias when generating the random states before t < 0, Eve applies each decoding operation with the same possibility, 1/64. Fig.(6(a)) shows the numerical simulation results of Eve's decoding process when the encoding operation of each block is determined by only the previous plaintext. There are 97 characters in the sentence. From the histogram, one may notice that by a quite large chance, Eve will decode the whole sentence with fewer than 20 total mistakes. Obviously now the communication strategy is not safe enough, when the encoding operation of each block is determined by only one previous plaintext. In the following section, we will provide improvement to increase the security in communication.  Assume that Eve starts decoding before t = 0, and at t = 0 she has uniform probability to apply each decoding operation. 'Err' represents the total errs that Eve makes when decoding the sentence. 'Count' represents the frequency of certain total mistakes. A rectangle that locates at Error = x with Count = y infers that in the whole simulation, there are y times that Eve makes x times mistakes. 1000 times simulation are carried in total, Θ 1 = (0, 0.15π, 0.72π, 0.32π), Θ 2 = (0, 0.45π, 0.17π, 1.64π). (a.) Only one previous state has contribution to the encoding operation. (b.)Two previous states are included to decide the next encoding operation.
To improve the security against wiretapping, consider the following encoding operation, where operation V are still the 64 encrytion operations presented in the supplementary materials. Now the encoding operation at time t is decided by the two former blocks n(t − T ) and n(t − 2T ). In our example, at t = 0, Alice attempts to send the letter A , n(t = 0) = 1, and at t = T Alice attempts to send l , n(t = T ) = 38. (1 + 38)mod64 = 39, so Alice will encode the third character (still l ) as Still, Alice and Bob make an agreement that the first block is encrypted by V 0 . Even though Alice will generate states randomly before t = 0, Bob does not need to measure them, and these random states will not effect their communication. In fig.(6(b)), we show the numerical simulation results of Eve's decoding process under the improved communication strategy. Now we Eve can find it extremely difficult to decode the communication. She might decode one character accidentally, yet which does little help for the following block, unless she can decode two characters simultaneously. Comparing with fig.(6(a)), there is greater chances for Eve to make more mistakes, and the information transfer is safer than using only one block to determine the encoding operation. Note that here we only introduced the former two states into encoding operation. Theoretically, one can expand eq.(5) into Hence, one can include arbitrary number of previous states into the determination of the encoding process. Till now, the key in our design contains three parts. The first one is the selection of the encoding configurations from all possible configurations that can be applied on the plaintexts to create ciphertexts. These define the controls and targets of the control-unitary gates, and examples of the encoding configurations can be found in Figure 3 and the supplementary materials. Second part of the key contains the parameters Θ 1,2 . These define the actual actions of the control-unitary gates and small differences difference of them will lead to extremely different encrytion operations. In this paper only the simplest situation is discussed, where Θ 1,2 are used multi times in the encryption circuit. To introduce more potential choices for the key, one can replace the repeated Θ 1,2 as independent parameters. Generally the more parameters there are in the encryption circuits, there will be more potential choices for the key and the communication will be more safe. The last part is the ways that the encoding configurations are selected by the plaintext of the previous blocks. Numerical simulation shows that the communication is still reliable even when the second and third parts of the key is released. More theoretical discussions about quantum encryption can be found in our recent work [13].
Noise and errors are all ignored in the above discussion, while the noise might lead to some mistakes in real experiments. Here we provide a 4th strategy against noise and errors with error-detecting auxiliary characters: S4. At time t = klT , where k = 1, 2 . . . , and l is a constant positive integer, Alice will prepare the qubits at some certain states, which depend on previous states. After decoding state |Ψ(t = klT ) , Bob will make out if he made any mistakes during [(k − 1)lT, klT ]. To make up the mistake, they need one more wire that Bob is able to use it to send messages back to Alice. Once Bob find the state |Ψ(t = klT ) out of expectation, he can send Alice a message, and then Alice will restart communication from the state |Ψ(t = (k − 1)lT + T ) .
Strategy 4 works on the plaintexts, instead of the encoding process. Here we would provide one example to demonstrate how it works. To make it possible for Bob to self check the encoding process, Alice rewrites the message by adding one auxiliary character every 9 characters (So that auxiliary characters will be the 10k − th character). She sets the auxiliary character at position 10k to be the same value as the [10(k − 1) − 1] − th one. The message now will be All human' ' wisdom i'n's contain'i'ed in the'n'se words.'e' Wait and'.' hope. Th'd'e Count o'h'f Monte C'o'risto. Ch'C'ap 117.
Characters embraced by apostrophes are auxiliary characters (Please note that the apostrophes are included to mark the auxiliary characters, but they themselves are not part of the message). Here Alice and Bob set the first auxiliary character as blank space. The second auxiliary character is 'n', same as the 9 th character. The third auxiliary character is 'i', same as the 19 th character. Other auxiliary characters are generated similarly.

Conclusion
In this work we have proposed a protocol of quantum encryption with varying encryption configurations. The plaintext is divided into blocks with the same length, and represented by the eigenstates under Z-measurements. Operation encrypting each single block is determined by one or more previous blocks of the plaintexts. Thus, successful decryption of the former block is required when attempting to extract information from a new one. Key in the protocol contains several parts, the selection of configurations of the encryption operations, the parameters that determine the encryption operations and the ways the encoding operations are determined by the previous plaintext blocks. All parts are essential for successful encryption and decryption. Further, we studied the protection against wiretapping. Simulation results show that it is still difficult to decode the communication between Alice and Bob even when part of the key is released. Finally, we also discussed an error-correction method against noises in the encryption and decryption circuits.

Optimization of parameters-When Eve can only measure qubits
In this section we will offer one way to optimise the 6-qubit model for communication application by adjusting parameters Θ 1 , Θ 2 . For simplicity, here Alice encodes the qubits only with operations shown in fig.(3,4). On one hand, our circuit should be robust, as we need to make sure that Bob, who is to receive information via the qubits, can still make correct decision when the quantum gates are imperfect or when there are environmental noises. In real experiments, the control gates can not always be perfect as we designed. When one sets a R z (θ) rotation gate, often a R z (θ + ∆θ) gate is set, and generally we have |∆θ| θ. On the other hand, we need to make sure that Eve, who attempts to wiretap the communication, can not get too much information. Further, if we know that Alice has little chance to get any information after t = N A T , then we can use the first N A quantum states to transport some trivial information, so that Eve can get nothing useful. Here, we note P B (k|Θ 1 , Θ 2 ) as the probability of Bob to get all information correctly before t = kT , and P A (k|Θ 1 , Θ 2 ) for Alice. Aim of the optimisation process is to find suitable parameters Θ 1 , Θ 2 so that for a given constant c > 1, there exists an integer N T > 0, P B (cN T |Θ 1 , Θ 2 ) is significantly larger than P A (N T |Θ 1 , Θ 2 ), after which we can ensure that the 6-qubit model can be used to transport 6(c − 1)N T bits information during time period N T T .
At t = 0, the initial quantum state is |0 , so that |Ψ in 1 is certainly encoded by the 2-qubit loop shown in fig.(3(b)). Consider the minimum unit of 2-qubit loop, qubits q 1 and q 2 . After the encoding process they will be prepared at state Then we can define a new function f (M 1 , M 2 |Θ 1 , Θ 2 ) to describe how good the measurements M 1 , M 2 is for Eve, and Theoretically, for given Θ 1 , Θ 2 , the maximum of f (M 1 , M 2 |Θ 1 , Θ 2 ) only depends on M 1 , M 2 , so that we can define function g(Θ 1 , Θ 2 ) as the maximum result. By adjusting Θ 1 , Θ 2 , Alice and Bob can decide the optimal parameters that ensure least possibility for Eve to derive correct information.
In fact, if Eve can only measure each qubits instead of applying arbitrary operations on the qubits, then Alice and Bob do not need to spend time optimizing the parameters.
Here, we simulate the correct rate for different decoding strategies, as shown in fig.(7). We assume that the document is transported via binary numbers, and every time Alice will transport 6 bit information via the 6 qubits. Qubits are encoded by circuit fig.(3(b)) if the former number is odd, or by circuit fig.(3(a)) if the former number is even. R represents the correct rate, or the possibility to derive all information correctly when Alice transports totally n bits information. Z2(and Z3) represents that Eve directly apply Z measurements on every single qubit, and assume that the first state is encoded by the encoded by circuit fig.(3(b)) ( fig.(3(a))). OP 2(and OP 3) represents that Eve optimized her measurements on every single qubit, and assume that the first state is encoded by the encoded by circuit fig.(3(b)) ( fig.(3(a))). B1(and B2) shows the performance of Bob's decoding process with different noise, the self-check strategy is not introduced. One can find that if only measurements on single qubit are allowed, it is nearly impossible to wiretap the communication, even though there are only two encoding operations. In the simulation, we set Θ 1 = (0.45π, 4.04, 1.04, 0.92) and Θ 2 = [0, 0.35, 0.55π, 0.79)(Just some random numbers, not the optimal ones).  Figure 7: Simulation result of correct rate for different decoding strategies. Here, we simulate the correct rate R for different decoding strategies when transporting n bits information. Z2: Assume that all information are encoded by circuit fig.(3(b)), and one applies only Z measurement on every qubit. Z3: Assume that all information are encoded by circuit fig.(3(a)), and one applies only Z measurement on every qubit. OP2: Assume that all information are encoded by circuit fig.(3(b)), and one applies the optimal measurement on every single qubit. OP3: Assume that all information are encoded by circuit fig.(3(a)), and one applies the optimal measurement on every single qubit. B1: One can apply the decoding circuit fig.(4). Due to the environment noise, fidelity of all operations is 0.995. B2: One can apply the decoding circuit fig.(4). Due to the environment noise, fidelity of all operations is 0.9.

Find the encoding operation from a single state
Here we will provide another method to find the encoding operation from one single state, and only consider the encoding operations shown in fig.(3(a)) and fig.(3(b)) .
Assume that the first few states |Ψ(t = 0, 1, 2, · · · , k) are encoded by one same encoding circuit, which is either circuit 1 or circuit 2. All details of these two circuits are already known, then it is also possible to find the encoding method from |Ψ(t = 0, 1, 2, · · · , k) . Here we will demonstrate the basic operations. For simplicity, note that the 2 possible encoding methods as U 1 , U 2 , and one complete set of this system as {|0 , |1 , |2 , · · · , |2 N − 1 }. Then we have where n = 0, 1, 2, · · · , 2 N − 1. Though more than one quantum states are offered, they are not prepared at the same state. Still, we are provided with no copies, which is the main difficulty. For given quantum states encoded by the same circuit, the structure shown in fig.(3(a)) can be used to find the encoding circuit.
As one can notice from the figure, we need in total 3N qubits in the circuit. The first N qubits are prepared at the encoded states |ψ(t) , and the other 2N qubits are used as auxiliary qubits. Note that the rotation gates R n satisfy R n |0 = |n . Initially, the system is prepared at |Ψ in = |ψ ⊗ |0 ⊗ |0 , where every ket represents state of N qubits. The very first step is to apply two control operations S 1 , S 2 , and As these two operations commute with each other, it does not matter to change their order. Assume that the given qubits are at state |ψ 1,m , after these operations the system will be converted to where c 1 m,n = ψ 2,n |ψ 1,m . Now apply measurements on the auxiliary qubits so that the whole system will collapse. With possibility P 1,l = |c 1 m,l | 2 one will find the state at Similarly, if the given qubits are prepared at state |ψ 2,m , then after these operations and measurements one will have possibility P 2,l = |c 2 m,l | 2 to find the system at state and c 2 m,n = ψ 1,n |ψ 2,m . To distinguish |ψ 1,l and |ψ 2,l , one convenient solution is to apply operation U † 1 , and measure the final state. If the results is |l , then we can conclude that given states are encoded by U 1 , otherwise we believe that they are encoded by U 2 . Yet from one state the result might be not correct, as one might be led to wrong decision under two situations. Firstly, we could hardly move forward if l = m after the first measurement. Besides, there is still chance | ψ 1,l |l | 2 to get wrong result at the final step. As a conclusion, for a single given encoded state, possibility to derive the correct encoding circuit is Further, as Once we can make sure that 1 − | ψ 2,m |ψ 1,m | 2 1 − | ψ 2,l |l | 2 ≥ 1 2 , then it would be a choice applying this method to find the encoding circuit. However, when more encoding operations are introduced, if would be much more difficult to find the encoding operation from one single state. In other words, decode the former character by find the encoding operation can not help Eve to wiretap the communication.

Appropriate length of message
Intuitively, if the message contains infinite words, no matter how many previous qubits are included in the encoding process as shown in eq.(7), Eve will always be able to derive all following information, once she decodes enough characters continuously. Generally, the shorter the message is, the more difficult it will be for Eve to decode it. Since when designing the communication strategy, it will also be important to set an appropriate length. Here, we will show some numerical simulation results as an attempt to find the appropriate message length. Fig.(8) shows the trend of average err rate when the message becomes longer. The average err rate R is defined as where M is the total times of simulation, and L is length of the message, e j is the errs Eve makes in the j-th time when decoding the message. Here L represents the length of message and R represents the average err rate. In the simulation, Alice and Bob transport message encoded by the improved strategy (As we discussed in Sec.3, two previous states contribute to the next encoding method). Eve can apply arbitrary operations on the qubits, and knows all details except the exact time t = 0.
Further, we also compare the performance of P (x) under various length of message, which is the probability that Eve makes more than xL mistakes when decoding a message with length L. Mathematically, P (x) is defined as where Gamma is used to represent the threshold function, and Gamma ( Here L represents the length of message and P(x) represents probability that Eve makes at least xL mistakes when decoding the message. In the simulation, Alice and Bob transport message encoded by the improved strategy (As we discussed in Sec.3, two previous states contribute to the next encoding method). Eve can apply arbitrary operations on the qubits, and knows all details except the exact time t = 0.
Same as in the main article, here we set Θ 1 = (0.45π, 4.04, 1.04, 0.92) and Θ 2 = [0, 0.35, 0.55π, 0.79) (Just some random numbers, not the optimal ones). Based on the simulation we suggest that when only two previous states contribute to the encoding process, it is better to transport message around 100 characters or less once, otherwise the risk of wiretapping can no more be ignored. However, it can always be a solution to divide a long message into a branch of pieces.

Encoding circuits for more qubits
Here we will expand the encoding circuits to more qubits. Generally, 6 qubits are enough for common communications based on letters and numbers. However, sometimes special characters might be required, and then more qubits should be included in the communication. Sill, the encoding operations will contain no more parameters except Θ 1 , Θ 2 . Note that there are N qubits q 1 , q 2 , . . . , q N used in communication.
Encoding operations design method I: A control gates loop that contains all qubits. Consider a permutation of the qubits, note the the location of q j as p(j), where 0 ≤ p(j) < N , and p(j) = p(k) when j = k. Then for every permutation p, there is a control gates loop as In the main article, we have defined that Encoding operations design method II: Decompose the encoding operation as a combination of U bi and U tri .
If N is even, we can always rewrite N as a sum of N/2 qubit pairs. Further if N ≥ 6, we can rewrite N as a sum of some qubit triplets and some qubit pairs. For each qubit pair we can apply U bi , and for each tripet we can apply U tri . On the other hand, if N ≥ 3 is odd, we can rewrite N = 3 + (N − 3), where N − 3 is now a even number. Consider that the N qubits are divide into a pairs and b triplets, there exists a corresponding encoding operation, where the superscript represents the j − th qubit pair or the k − th triplet. Note here the u bi is different from the U bi in the main article. Instead, u bi applies on qubit q i and q j is defined as Similarly, u tri applies on qubit triplet q i , q j , q k is defined as

Encoding operations
In this section we will offer the 64 encoding operations corresponding to different former words. To reduce confuse, here we use V n to represent the encoding operations. Subscript represents the former word, where each number represent a single letter, number or notation. As discussed in the main article, 0 represents blank space, used as word divider. 1 to 26 represent characters capital letters 'A' to 'Z', 27 to 52 represent little letters 'a' to 'z', and 53 to 62 represent numbers '0', '1' to '9'. The last eigenstate 63 represents ',', '.', or other marks to divide sentences. As an example, V 1 will be used as the encoding operation at time t, if we find out that n(t − 1) = 1, in other words the former word is A .