  This paper has been withdrawn because of an error in the proof of Lemma 1.
Without Lemma 1, the result of the main theorem (with the same proof, but
omitting the use of Lemma 1 to extend things to general attacks) only holds for
attacks in which the attacker applies a tensor product of Pauli matrices (for
qubits) or generalized Pauli matrices. The resulting theorem is still relevant
for quantum message authentication, but the very strong result claimed in
earlier versions of this paper does not hold. These matters will be addressed
further in joint work with Claude Crepeau, Daniel Gottesman, Adam Smith, and
Alain Tapp. Thanks to them and to Debbie Leung for spotting the error.
