Comment on “quantum identity authentication with single photon”

A few years ago Hong et al.  (Quantum Inf Process 16:236, 2017) proposed a quantum identity authentication protocol using single photons and executable on currently available quantum hardware. Zawadzki later published two attacks on this protocol, and suggested a mitigation in the same work. In this comment we point out an additional vulnerability that causes the prover Alice to leak a percentage of her secret key at every authentication attempt. The latter is due to a problematic policy in the generation and management of decoy states. We conclude by showing a simple mitigation that addresses the issue.