  Post-quantum cryptography studies the security of classical, i.e. non-quantum
cryptographic protocols against quantum attacks. Until recently, the considered
adversaries were assumed to use quantum computers and behave like classical
adversaries otherwise. A more conservative approach is to assume that also the
communication between the honest parties and the adversary is (partly) quantum.
We discuss several options to define secure encryption and authentication
against these stronger adversaries who can carry out 'superposition attacks'.
We re-prove a recent result of Boneh and Zhandry, stating that a uniformly
random function (and hence also a quantum-secure pseudorandom function) can
serve as a message-authentication code which is secure, even if the adversary
can evaluate this function in superposition.
