S-money [Proc. R. Soc. A 475, 20190170 (2019)] schemes define virtual tokens designed for networks with relativistic or other trusted signalling constraints. The tokens allow near-instant verification and guarantee unforgeability without requiring quantum state storage. We present refined two stage S-money schemes. The first stage, which may involve quantum information exchange, generates private user token data. In the second stage, which need only involve classical communications, users determine the valid presentation point, without revealing it to the issuer. This refinement allows the user to determine the presentation point anywhere in the causal past of all valid presentation points. It also allows flexible transfer of tokens among users without compromising user privacy.
S-money [Proc. R. Soc. A 475, 20190170 (2019)] schemes define virtual tokens designed for networks with relativistic or other trusted signalling constraints. The tokens allow near-instant verification and guarantee unforgeability without requiring quantum state storage. We present refined two stage S-money schemes. The first stage, which may involve quantum information exchange, generates private user token data. In the second stage, which need only involve classical communications, users determine the valid presentation point, without revealing it to the issuer. This refinement allows the user to determine the presentation point anywhere in the causal past of all valid presentation points. It also allows flexible transfer of tokens among users without compromising user privacy.
S-money [A. Kent, Proc. R. Soc. A 475, 20190170 (2019)] schemes define virtual tokens designed for networks with relativistic or other trusted signaling constraints. The tokens allow near-instant verification and guarantee unforgeability without requiring quantum state storage. We present refined two stage S-money schemes. The first stage, which may involve quantum information exchange, generates private user token data. In the second stage, which need only involve classical communications, users determine the valid presentation point, without revealing it to the issuer. This refinement allows the user to determine the presentation point anywhere in the causal past of all valid presentation points. It also allows flexible transfer of tokens among users without compromising user privacy.
We propose definitions and implementations of 'S-money'-virtual tokens designed for high-value fast transactions on networks with relativistic or other trusted signalling constraints, defined by inputs that in general are made at many network points, some or all of which may be space-like separated. We argue that one significant way of characterizing types of money in space-time is via the 'summoning' tasks they can solve: that is, how flexibly the money can be propagated to a desired space-time point in response to relevant information received at various space-time points. We show that S-money is more flexible than standard quantum or classical money in the sense that it can solve deterministic summoning tasks that they cannot. It requires the issuer and user to have networks of agents with classical data storage and communication, but no long-term quantum state storage, and is feasible with current technology. User privacy can be incorporated by secure bit commitment and zero-knowledge proof protocols. The level of privacy feasible in given scenarios depends on efficiency and composable security questions that remain to be systematically addressed.
Abstract Unforgeable quantum money tokens were the first invention of quantum information science, but remain technologically challenging as they require quantum memories and/or long-distance quantum communication. More recently, virtual “S-money” tokens were introduced. These are generated by quantum cryptography, do not require quantum memories or long-distance quantum communication, and yet in principle guarantee many of the security advantages of quantum money. Here, we describe implementations of S-money schemes with off-the-shelf quantum key distribution technology, and analyse security in the presence of noise, losses, and experimental imperfection. Our schemes satisfy near-instant validation without cross-checking. We show that, given standard assumptions in mistrustful quantum cryptographic implementations, unforgeability and user privacy could be guaranteed with attainable refinements of our off-the-shelf setup. We discuss the possibilities for unconditionally secure (assumption-free) implementations.
Quantum money is the first invention in quantum information science, promising advantages over classical money by simultaneously achieving unforgeability, user privacy, and instant validation. However, standard quantum money relies on quantum memories and long-distance quantum communication, which are technologically extremely challenging. Quantum "S-money" tokens eliminate these technological requirements while preserving unforgeability, user privacy, and instant validation. Here, we report the first full experimental demonstration of quantum S-tokens, proven secure despite errors, losses and experimental imperfections. The heralded single-photon source with a high system efficiency of 88.24% protects against arbitrary multi-photon attacks arising from losses in the quantum token generation. Following short-range quantum communication, the token is stored, transacted, and verified using classical bits. We demonstrate a transaction time advantage over intra-city 2.77 km and inter-city 60.54 km optical fibre networks, compared with optimal classical cross-checking schemes. Our implementation demonstrates the practicality of quantum S-tokens for applications requiring high security, privacy and minimal transaction times, like financial trading and network control. It is also the first demonstration of a quantitative quantum time advantage in relativistic cryptography, showing the enhanced cryptographic power of simultaneously considering quantum and relativistic physics.
Private quantum money allows a bank to mint quantum money states that it can later verify, but that no one else can forge. In classically verifiable quantum money -- introduced by Gavinsky (CCC 2012) -- the verification is done via an interactive protocol between the bank and the user, where the communication is classical, and the computational resources required of the bank are classical. In this work, we consider memoryless interactive protocols in which the minting is likewise classical, and construct a private money scheme that achieves these two notions simultaneously (i.e., classical verification and classical minting). We call such a construction a private semi-quantum money scheme, since all the requirements from the bank in terms of computation and communication are classical.
In a quantum money scheme, a bank can issue money that users cannot counterfeit. Similar to bills of paper money, most quantum money schemes assign a unique serial number to each money state, thus potentially compromising the privacy of the users of quantum money. However in a quantum coins scheme, just like the traditional currency coin scheme, all the money states are exact copies of each other, providing a better level of privacy for the users. A quantum money scheme can be private, i.e., only the bank can verify the money states, or public, meaning anyone can verify. In this work, we propose a way to lift any private quantum coin scheme -- which is known to exist based on the existence of one-way functions, due to Ji, Liu, and Song (CRYPTO'18) -- to a scheme that closely resembles a public quantum coin scheme. Verification of a new coin is done by comparing it to the coins the user already possesses, by using a projector on to the symmetric subspace. No public coin scheme was known prior to this work. It is also the first construction that is very close to a public quantum money scheme and is provably secure based on standard assumptions. Finally, the lifting technique, when instantiated with the private quantum coins scheme~\cite{MS10}, gives rise to the first construction that is close to an inefficient unconditionally secure public quantum money scheme.