Public key quantum currency generally includes $k$ pairs ($S_\psi,\vert \psi\rangle)$ of classical information (bits) $S_\psi$ and quantum information (qubits) $\vert \psi\rangle$.

In many examples, $\vert \psi\rangle$ is an eigenstate of some publicly known verification procedure $M$, and $S_\psi$ is some (efficiently computable) invariant of $M$. A bank mints $k$ different coins by initially preparing qubits in a uniform superposition over the entire vector space of $M$, calculating (in ancillas) the invariant $S$, and measuring and recording the ancilla qubits as the serial number $S_\psi$. That is, the eigenstates $\vert\psi\rangle$ are indexed by the serial number $S_\psi$.

The answer given in this question provides examples of quantum currencies, where not even the bank can produce counterfeit quantum money qubit states $\vert\psi\rangle$. However, it's not been clear to me how the serial numbers themselves are stored - were they originally meant to be digitally signed?

Is there a risk in having the bank publish a distributed list amongst users of the currency, in plaintext, of each of the $k$ serial numbers?

There might be an advantage in having a distributed database of plaintext serial numbers. Users of the currency would know, or at least upper bound, precisely how much currency has been produced, and I don't think that the bank could overproduce without causing a devaluation. If the bank were to mint more money, they would have to update their plaintext database, and users of the currency would recognize that the money they hold is deprecated.

  • 1
    $\begingroup$ The quantum money protocols don't specify exactly how the list of names is provided. Knowing the list shouldn't help anybody counterfeit the money, so I don't see any risk in having the bank publish a distributed list. $\endgroup$ Jan 2, 2020 at 16:45


Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Browse other questions tagged or ask your own question.