© 2026 Aqora Quantum S.A.S.

Terms Privacy Legal Notice

arXiv:1908.04114 · Cryptography

Practically Feasible Robust Quantum Money with Classical Verification

Niraj Kumar

Published Nov 20, 2019• 18 citations

Abstract

We introduce a private quantum money scheme with the note verification procedure based on sampling matching, a problem in a one-way communication complexity model. Our scheme involves a bank who produces and distributes quantum notes, noteholders who are untrusted, and trusted local verifiers of the bank to whom the holders send their notes in order to carry out transactions. The key aspects of our money scheme include: note verification procedure requiring a single round classical interaction between the local verifier and bank; fixed verification circuit that uses only passive linear optical components; re-usability of each note in our scheme which grows linearly with the size of note; and an unconditional security against any adversary trying to forge the banknote while tolerating the noise of up to 21.4%. We further describe a practical implementation technique of our money scheme using weak coherent states of light and the verification circuit involving a single 50/50 beam splitter and two single-photon threshold detectors. Previous best-known matching based money scheme proposal involves a verification circuit where the number of optical components increase proportional to the increase in desired noise tolerance (robustness). In contrast, we achieve any desired noise tolerance (up to a maximal threshold value) with only a fixed number of optical components. This considerable reduction of components in our scheme enables us to reach the robustness values that is not feasible for any existing money scheme with the current technology.

DOI: 10.3390/cryptography3040026

Related papers

Quantum money with nearly optimal error tolerance

Ryan Amiri, Juan Miguel Arrazola

We present a family of quantum money schemes with classical verification which display a number of benefits over previous proposals. Our schemes are based on hidden matching quantum retrieval games and they tolerate noise up to $23%$, which we conjecture reaches $25%$ asymptotically as the dimension of the underlying hidden matching states is increased. Furthermore, we prove that $25%$ is the maximum tolerable noise for a wide class of quantum money schemes with classical verification, meaning our schemes are almost optimally noise tolerant. We use methods in semidefinite programming to prove security in a substantially different manner to previous proposals, leading to two main advantages: first, coin verification involves only a constant number of states (with respect to coin size), thereby allowing for smaller coins; second, the reusability of coins within our scheme grows linearly with the size of the coin, which is known to be optimal. Last, we suggest methods by which the coins in our protocol could be implemented using weak coherent states and verified using existing experimental techniques, even in the presence of detector inefficiencies.

arXiv:1610.06345•Physical Review A•Jun 26, 2017•33 citations

Noise-tolerant public-key quantum money from a classical oracle

Peter Yuen

Quantum money is the task of verifying the validity of banknotes while ensuring that they cannot be counterfeited. Public-key quantum money allows anyone to perform verification, while the private-key setting restricts the ability to verify to banks, as in Wiesner's original scheme. The current state of technological progress means that errors are impossible to entirely suppress, hence the requirement for noise-tolerant schemes. We show for the first time how to achieve noise-tolerance in the public-key setting. Our techniques follow Aaronson and Christiano's oracle model, where we use the ideas of quantum error correction to extend their scheme: a valid banknote is now a subspace state possibly affected by noise, and verification is performed by using classical oracles to check for membership in "larger spaces." Additionally, a banknote in our scheme is minted by preparing conjugate coding states and applying a unitary that permutes the standard basis vectors.

arXiv:2407.06463•Quantum•Apr 7, 2025•2 citations

Semi-Quantum Money

Roy Radian, Or Sattath

Private quantum money allows a bank to mint quantum money states that it can later verify, but that no one else can forge. In classically verifiable quantum money -- introduced by Gavinsky (CCC 2012) -- the verification is done via an interactive protocol between the bank and the user, where the communication is classical, and the computational resources required of the bank are classical. In this work, we consider memoryless interactive protocols in which the minting is likewise classical, and construct a private money scheme that achieves these two notions simultaneously (i.e., classical verification and classical minting). We call such a construction a private semi-quantum money scheme, since all the requirements from the bank in terms of computation and communication are classical.

arXiv:1908.08889•ACM Conference on Advances in Financial Technologies (AFT)•Oct 21, 2019•34 citations

Experimental preparation and verification of quantum money

Jian-Yu Guan, Juan Miguel Arrazola, Ryan Amiri +6 more

A quantum money scheme enables a trusted bank to provide untrusted users with verifiable quantum banknotes that cannot be forged. In this work, we report a proof-of-principle experimental demonstration of the preparation and verification of unforgeable quantum banknotes. We employ a security analysis that takes experimental imperfections fully into account. We measure a total of $3.6\ifmmode\times\else\texttimes\fi{}{10}^{6}$ states in one verification round, limiting the forging probability to ${10}^{\ensuremath{-}7}$ based on the security analysis. Our results demonstrate the feasibility of preparing and verifying quantum banknotes using currently available experimental techniques.

arXiv:1709.05882•Physical Review A•Mar 27, 2018•31 citations

Quantum Money from Hidden Subspaces

Scott Aaronson, Paul F. Christiano

Forty years ago, Wiesner pointed out that quantum mechanics raises the striking possibility of money that cannot be counterfeited according to the laws of physics. We propose the first quantum money scheme that is (1) public-key, meaning that anyone can verify a banknote as genuine, not only the bank that printed it, and (2) cryptographically secure, under a "classical" hardness assumption that has nothing to do with quantum money. Our scheme is based on hidden subspaces, encoded as the zero-sets of random multivariate polynomials. A main technical advance is to show that the "black-box" version of our scheme, where the polynomials are replaced by classical oracles, is unconditionally secure. Previously, such a result had only been known relative to a quantum oracle (and even there, the proof was never published). Even in Wiesner's original setting -- quantum money that can only be verified by the bank -- we are able to use our techniques to patch a major security hole in Wiesner's scheme. We give the first private-key quantum money scheme that allows unlimited verifications and that remains unconditionally secure, even if the counterfeiter can interact adaptively with the bank. Our money scheme is simpler than previous public-key quantum money schemes, including a knot-based scheme of Farhi et al. The verifier needs to perform only two tests, one in the standard basis and one in the Hadamard basis -- matching the original intuition for quantum money, based on the existence of complementary observables. Our security proofs use a new variant of Ambainis's quantum adversary method, and several other tools that might be of independent interest.

arXiv:1203.4740•Electronic colloquium on computational complexity•Mar 21, 2012•49 citations

Quantum Money with Classical Verification

Dmitry Gavinsky

We propose and construct a quantum money scheme that allows verification through classical communication with a bank. This is the first demonstration that a secure quantum money scheme exists that does not require quantum communication for coin verification. Our scheme is secure against adaptive adversaries - this property is not directly related to the possibility of classical verification, nevertheless none of the earlier quantum money constructions is known to possess it.

IEEE Conference on Computational Complexity (CCC)•Jun 1, 2012•53 citations

We introduce a private quantum money scheme with the note verification procedure based on sampling matching, a problem in a one-way communication complexity model. Our scheme involves a bank who produces and distributes quantum notes, noteholders who are untrusted, and trusted local verifiers of the bank to whom the holders send their notes in order to carry out transactions. The key aspects of our money scheme include: note verification procedure requiring a single round classical interaction between the local verifier and bank; fixed verification circuit that uses only passive linear optical components; re-usability of each note in our scheme which grows linearly with the size of note; and an unconditional security against any adversary trying to forge the banknote while tolerating the noise of up to 21.4%. We further describe a practical implementation technique of our money scheme using weak coherent states of light and the verification circuit involving a single 50/50 beam splitter and two single-photon threshold detectors. Previous best-known matching based money scheme proposal involves a verification circuit where the number of optical components increase proportional to the increase in desired noise tolerance (robustness). In contrast, we achieve any desired noise tolerance (up to a maximal threshold value) with only a fixed number of optical components. This considerable reduction of components in our scheme enables us to reach the robustness values that is not feasible for any existing money scheme with the current technology.

We present a family of quantum money schemes with classical verification which display a number of benefits over previous proposals. Our schemes are based on hidden matching quantum retrieval games and they tolerate noise up to

23%

, which we conjecture reaches

25%

asymptotically as the dimension of the underlying hidden matching states is increased. Furthermore, we prove that

25%

is the maximum tolerable noise for a wide class of quantum money schemes with classical verification, meaning our schemes are almost optimally noise tolerant. We use methods in semidefinite programming to prove security in a substantially different manner to previous proposals, leading to two main advantages: first, coin verification involves only a constant number of states (with respect to coin size), thereby allowing for smaller coins; second, the reusability of coins within our scheme grows linearly with the size of the coin, which is known to be optimal. Last, we suggest methods by which the coins in our protocol could be implemented using weak coherent states and verified using existing experimental techniques, even in the presence of detector inefficiencies.

Quantum money is the task of verifying the validity of banknotes while ensuring that they cannot be counterfeited. Public-key quantum money allows anyone to perform verification, while the private-key setting restricts the ability to verify to banks, as in Wiesner's original scheme. The current state of technological progress means that errors are impossible to entirely suppress, hence the requirement for noise-tolerant schemes. We show for the first time how to achieve noise-tolerance in the public-key setting. Our techniques follow Aaronson and Christiano's oracle model, where we use the ideas of quantum error correction to extend their scheme: a valid banknote is now a subspace state possibly affected by noise, and verification is performed by using classical oracles to check for membership in "larger spaces." Additionally, a banknote in our scheme is minted by preparing conjugate coding states and applying a unitary that permutes the standard basis vectors.

Private quantum money allows a bank to mint quantum money states that it can later verify, but that no one else can forge. In classically verifiable quantum money -- introduced by Gavinsky (CCC 2012) -- the verification is done via an interactive protocol between the bank and the user, where the communication is classical, and the computational resources required of the bank are classical. In this work, we consider memoryless interactive protocols in which the minting is likewise classical, and construct a private money scheme that achieves these two notions simultaneously (i.e., classical verification and classical minting). We call such a construction a private semi-quantum money scheme, since all the requirements from the bank in terms of computation and communication are classical.

A quantum money scheme enables a trusted bank to provide untrusted users with verifiable quantum banknotes that cannot be forged. In this work, we report a proof-of-principle experimental demonstration of the preparation and verification of unforgeable quantum banknotes. We employ a security analysis that takes experimental imperfections fully into account. We measure a total of $3.6\ifmmode\times\else\texttimes\fi{}{10}^{6}$ states in one verification round, limiting the forging probability to ${10}^{\ensuremath{-}7}$ based on the security analysis. Our results demonstrate the feasibility of preparing and verifying quantum banknotes using currently available experimental techniques.

Forty years ago, Wiesner pointed out that quantum mechanics raises the striking possibility of money that cannot be counterfeited according to the laws of physics. We propose the first quantum money scheme that is (1) public-key, meaning that anyone can verify a banknote as genuine, not only the bank that printed it, and (2) cryptographically secure, under a "classical" hardness assumption that has nothing to do with quantum money. Our scheme is based on hidden subspaces, encoded as the zero-sets of random multivariate polynomials. A main technical advance is to show that the "black-box" version of our scheme, where the polynomials are replaced by classical oracles, is unconditionally secure. Previously, such a result had only been known relative to a quantum oracle (and even there, the proof was never published). Even in Wiesner's original setting -- quantum money that can only be verified by the bank -- we are able to use our techniques to patch a major security hole in Wiesner's scheme. We give the first private-key quantum money scheme that allows unlimited verifications and that remains unconditionally secure, even if the counterfeiter can interact adaptively with the bank. Our money scheme is simpler than previous public-key quantum money schemes, including a knot-based scheme of Farhi et al. The verifier needs to perform only two tests, one in the standard basis and one in the Hadamard basis -- matching the original intuition for quantum money, based on the existence of complementary observables. Our security proofs use a new variant of Ambainis's quantum adversary method, and several other tools that might be of independent interest.