Challenges
Datasets
Workspaces
Papers
Discussions
Leaderboard
Log inSign up
Challenges
Datasets
Workspaces
Papers
Discussions
Leaderboard
Blog
Job Board
Q3AS

© 2026 Aqora Quantum S.A.S.

TermsPrivacyLegal Notice

Quantum Information and Computation

An adaptive attack on Wiesner's quantum money

Daniel Nagaj, Or Sattath, Aharon Brodutch, Dominique Unruh

Published Sep 1, 2016• 12 citations
Publisher

Abstract

Unlike classical money, which is hard to forge for practical reasons (e.g. producing paper with a certain property), quantum money is attractive because its security might be based on the no-cloning theorem. The first quantum money scheme was introduced by Wiesner circa 1970. Although more sophisticated quantum money schemes were proposed, Wiesner’s scheme remained appealing because it is both conceptually clean as well as relatively easy to implement. We show efficient adaptive attacks on Wiesner’s quantum money scheme [1] (and its variant by Bennett et al. [2]), when valid money is accepted and passed on, while invalid money is destroyed. We propose two attacks, the first is inspired by the Elitzur-Vaidman bomb testing problem [3, 4], while the second is based on the idea of protective measurements [5]. It allows us to break Wiesner’s scheme with 4 possible states per qubit, and generalizations which use more than 4 states per qubit. The attack shows that Wiesner’s scheme can only be safe if the bank replaces valid notes after validation.

DOI
10.26421/qic16.11-12-7

Related papers

An adaptive attack on Wiesner's quantum money

Aharon Brodutch, Daniel Nagaj, Or Sattath +1 more

Unlike classical money, which is hard to forge for practical reasons (e.g. producing paper with a certain property), quantum money is attractive because its security might be based on the no-cloning theorem. The first quantum money scheme was introduced by Wiesner circa 1970. Although more sophisticated quantum money schemes were proposed, Wiesner's scheme remained appealing because it is both conceptually clean and relatively easy to implement. We show efficient adaptive attacks on Wiesner's quantum money scheme [Wie83] (and its variant by Bennett et al. [BBBW83]), when valid money is accepted and passed on, while invalid money is destroyed. We propose two attacks, the first is inspired by the Elitzur-Vaidman bomb testing problem [EV93, KWH+95], while the second is based on the idea of protective measurements [AAV93]. It allows us to break Wiesner's scheme with 4 possible states per qubit, and generalizations which use more than 4 states per qubit.

arXiv:1404.1507•Apr 5, 2014•7 citations

An adaptive attack on Wiesner's quantum money based on interaction-free measurement

Daniel Nagaj, Or Sattath

Unlike classical money, which is hard to forge for practical reasons (e.g. producing paper with a certain property), quantum money is attractive because its security might be based on the no-cloning theorem. The first quantum money scheme was introduced by Wiesner circa 1970. Although more sophisticated quantum money schemes were proposed, Wiesner's scheme remained appealing because it is both conceptually clean and relatively easy to implement. We show efficient adaptive attacks on Wiesner's quantum money scheme [Wie83] (and its variant by Bennett et al. [BBBW83]), when valid money is accepted and passed on, while invalid money is destroyed. We propose two attacks, the first is inspired by the Elitzur-Vaidman bomb testing problem [EV93, KWH+95], while the second is based on the idea of protective measurements [AAV93]. It allows us to break Wiesner's scheme with 4 possible states per qubit, and generalizations which use more than 4 states per qubit.

•Apr 5, 2014•0 citations

An adaptive attack on wiesner's quantum money

NagajDaniel, SattathOr, BrodutchAharon +1 more

Unlike classical money, which is hard to forge for practical reasons (e.g. producing paper with a certain property), quantum money is attractive because its security might be based on the no-clonin...

Quantum Information and Computation•Sep 1, 2016•0 citations

Experimentally attacking quantum money schemes based on quantum retrieval games

Kateřina Jiráková, Karol Bartkiewicz, Antonín Černoch +1 more

The concept of quantum money (QM) was proposed by Wiesner in the 1970s. Its main advantage is that every attempt to copy QM unavoidably leads to imperfect counterfeits. In the Wiesner's protocol, quantum banknotes need to be delivered to the issuing bank for verification. Thus, QM requires quantum communication which range is limited by noise and losses. Recently, Bozzio et al. (2018) have demonstrated experimentally how to replace challenging quantum verification with a classical channel and a quantum retrieval game (QRG). This brings QM significantly closer to practical realisation, but still thorough analysis of the revised scheme QM is required before it can be considered secure. We address this problem by presenting a proof-of-concept attack on QRG-based QM schemes, where we show that even imperfect quantum cloning can, under some circumstances, provide enough information to break a QRG-based QM scheme.

arXiv:1811.10718•Scientific Reports•Nov 8, 2019•11 citations

Quantum Copy-Protection and Quantum Money

Scott Aaronson

Forty years ago, Wiesner proposed using quantum states to create money that is physically impossible to counterfeit, something that cannot be done in the classical world. However, Wiesner's scheme required a central bank to verify the money, and the question of whether there can be unclonable quantum money that anyone can verify has remained open since. One can also ask a related question, which seems to be new: can quantum states be used as copy-protected programs, which let the user evaluate some function f, but not create more programs for f? This paper tackles both questions using the arsenal of modern computational complexity. Our main result is that there exist quantum oracles relative to which publicly-verifiable quantum money is possible, and any family of functions that cannot be efficiently learned from its input-output behavior can be quantumly copy-protected. This provides the first formal evidence that these tasks are achievable. The technical core of our result is a "Complexity-Theoretic No-Cloning Theorem," which generalizes both the standard No-Cloning Theorem and the optimality of Grover search, and might be of independent interest. Our security argument also requires explicit constructions of quantum t-designs. Moving beyond the oracle world, we also present an explicit candidate scheme for publicly-verifiable quantum money, based on random stabilizer states; as well as two explicit schemes for copy-protecting the family of point functions. We do not know how to base the security of these schemes on any existing cryptographic assumption. (Note that without an oracle, we can only hope for security under some computational assumption).

arXiv:1110.5353•IEEE Conference on Computational Complexity (CCC)•Jul 1, 2009•180 citations

Experimental quantum forgery of quantum optical money

Karol Bartkiewicz, Antonín Černoch, Grzegorz Chimczak +3 more

Abstract Unknown quantum information cannot be perfectly copied (cloned). This statement is the bedrock of quantum technologies and quantum cryptography, including the seminal scheme of Wiesner’s quantum money, which was the first quantum-cryptographic proposal. Surprisingly, to our knowledge, quantum money has not been tested experimentally yet. Here, we experimentally revisit the Wiesner idea, assuming a banknote to be an image encoded in the polarization states of single photons. We demonstrate that it is possible to use quantum states to prepare a banknote that cannot be ideally copied without making the owner aware of only unauthorized actions. We provide the security conditions for quantum money by investigating the physically-achievable limits on the fidelity of 1-to-2 copying of arbitrary sequences of qubits. These results can be applied as a security measure in quantum digital right management.

arXiv:1604.04453•npj Quantum Information•Feb 24, 2017•50 citations
Unlike classical money, which is hard to forge for practical reasons (e.g. producing paper with a certain property), quantum money is attractive because its security might be based on the no-cloning theorem. The first quantum money scheme was introduced by Wiesner circa 1970. Although more sophisticated quantum money schemes were proposed, Wiesner’s scheme remained appealing because it is both conceptually clean as well as relatively easy to implement. We show efficient adaptive attacks on Wiesner’s quantum money scheme [1] (and its variant by Bennett et al. [2]), when valid money is accepted and passed on, while invalid money is destroyed. We propose two attacks, the first is inspired by the Elitzur-Vaidman bomb testing problem [3, 4], while the second is based on the idea of protective measurements [5]. It allows us to break Wiesner’s scheme with 4 possible states per qubit, and generalizations which use more than 4 states per qubit. The attack shows that Wiesner’s scheme can only be safe if the bank replaces valid notes after validation.
Unlike classical money, which is hard to forge for practical reasons (e.g. producing paper with a certain property), quantum money is attractive because its security might be based on the no-cloning theorem. The first quantum money scheme was introduced by Wiesner circa 1970. Although more sophisticated quantum money schemes were proposed, Wiesner's scheme remained appealing because it is both conceptually clean and relatively easy to implement. We show efficient adaptive attacks on Wiesner's quantum money scheme [Wie83] (and its variant by Bennett et al. [BBBW83]), when valid money is accepted and passed on, while invalid money is destroyed. We propose two attacks, the first is inspired by the Elitzur-Vaidman bomb testing problem [EV93, KWH+95], while the second is based on the idea of protective measurements [AAV93]. It allows us to break Wiesner's scheme with 4 possible states per qubit, and generalizations which use more than 4 states per qubit.
Unlike classical money, which is hard to forge for practical reasons (e.g. producing paper with a certain property), quantum money is attractive because its security might be based on the no-cloning theorem. The first quantum money scheme was introduced by Wiesner circa 1970. Although more sophisticated quantum money schemes were proposed, Wiesner's scheme remained appealing because it is both conceptually clean and relatively easy to implement. We show efficient adaptive attacks on Wiesner's quantum money scheme [Wie83] (and its variant by Bennett et al. [BBBW83]), when valid money is accepted and passed on, while invalid money is destroyed. We propose two attacks, the first is inspired by the Elitzur-Vaidman bomb testing problem [EV93, KWH+95], while the second is based on the idea of protective measurements [AAV93]. It allows us to break Wiesner's scheme with 4 possible states per qubit, and generalizations which use more than 4 states per qubit.
The concept of quantum money (QM) was proposed by Wiesner in the 1970s. Its main advantage is that every attempt to copy QM unavoidably leads to imperfect counterfeits. In the Wiesner's protocol, quantum banknotes need to be delivered to the issuing bank for verification. Thus, QM requires quantum communication which range is limited by noise and losses. Recently, Bozzio et al. (2018) have demonstrated experimentally how to replace challenging quantum verification with a classical channel and a quantum retrieval game (QRG). This brings QM significantly closer to practical realisation, but still thorough analysis of the revised scheme QM is required before it can be considered secure. We address this problem by presenting a proof-of-concept attack on QRG-based QM schemes, where we show that even imperfect quantum cloning can, under some circumstances, provide enough information to break a QRG-based QM scheme.
Forty years ago, Wiesner proposed using quantum states to create money that is physically impossible to counterfeit, something that cannot be done in the classical world. However, Wiesner's scheme required a central bank to verify the money, and the question of whether there can be unclonable quantum money that anyone can verify has remained open since. One can also ask a related question, which seems to be new: can quantum states be used as copy-protected programs, which let the user evaluate some function f, but not create more programs for f? This paper tackles both questions using the arsenal of modern computational complexity. Our main result is that there exist quantum oracles relative to which publicly-verifiable quantum money is possible, and any family of functions that cannot be efficiently learned from its input-output behavior can be quantumly copy-protected. This provides the first formal evidence that these tasks are achievable. The technical core of our result is a "Complexity-Theoretic No-Cloning Theorem," which generalizes both the standard No-Cloning Theorem and the optimality of Grover search, and might be of independent interest. Our security argument also requires explicit constructions of quantum t-designs. Moving beyond the oracle world, we also present an explicit candidate scheme for publicly-verifiable quantum money, based on random stabilizer states; as well as two explicit schemes for copy-protecting the family of point functions. We do not know how to base the security of these schemes on any existing cryptographic assumption. (Note that without an oracle, we can only hope for security under some computational assumption).
Abstract Unknown quantum information cannot be perfectly copied (cloned). This statement is the bedrock of quantum technologies and quantum cryptography, including the seminal scheme of Wiesner’s quantum money, which was the first quantum-cryptographic proposal. Surprisingly, to our knowledge, quantum money has not been tested experimentally yet. Here, we experimentally revisit the Wiesner idea, assuming a banknote to be an image encoded in the polarization states of single photons. We demonstrate that it is possible to use quantum states to prepare a banknote that cannot be ideally copied without making the owner aware of only unauthorized actions. We provide the security conditions for quantum money by investigating the physically-achievable limits on the fidelity of 1-to-2 copying of arbitrary sequences of qubits. These results can be applied as a security measure in quantum digital right management.