The Quantum Money system proposed in "Quantum Copy-Protection and Quantum Money" has the following properties:
- The bank can produce bank notes in the form of quantum states.
- Anyone can verify that one of these quantum states is a valid bank note without destroying the quantum state.
- No one except the bank can produce more bank notes, even if they already have some.
All assuming that the actors only have polynomial time quantum computers.
My question is if you can take this step further and make it so that even the bank is unable to forge bills.
What do I mean by this? The quantum money protocol I am looking for would have an integer parameter $k$, and the bank could only create $k$ valid bank notes.
(This might seem impossible since the bank could just run the protocol again to get $k$ more bank notes. A way to prevent this would be to require it to produce a random classical string $s$ of bits that it releases publicly, such that it can not run the protocol again and produce the same $s$ with non-negligible probability.)