Quantum message authentication codes

This paper has been withdrawn because of an error in the proof of Lemma 1. Without Lemma 1, the result of the main theorem (with the same proof, but omitting the use of Lemma 1 to extend things to general attacks) only holds for attacks in which the attacker applies a tensor product of Pauli matrices (for qubits) or generalized Pauli matrices. The resulting theorem is still relevant for quantum message authentication, but the very strong result claimed in earlier versions of this paper does not hold. These matters will be addressed further in joint work with Claude Crepeau, Daniel Gottesman, Adam Smith, and Alain Tapp. Thanks to them and to Debbie Leung for spotting the error.