# In quantum money schemes, how is the list of serial numbers provided?

Public key quantum currency generally includes $$k$$ pairs ($$S_\psi,\vert \psi\rangle)$$ of classical information (bits) $$S_\psi$$ and quantum information (qubits) $$\vert \psi\rangle$$.

In many examples, $$\vert \psi\rangle$$ is an eigenstate of some publicly known verification procedure $$M$$, and $$S_\psi$$ is some (efficiently computable) invariant of $$M$$. A bank mints $$k$$ different coins by initially preparing qubits in a uniform superposition over the entire vector space of $$M$$, calculating (in ancillas) the invariant $$S$$, and measuring and recording the ancilla qubits as the serial number $$S_\psi$$. That is, the eigenstates $$\vert\psi\rangle$$ are indexed by the serial number $$S_\psi$$.

The answer given in this question provides examples of quantum currencies, where not even the bank can produce counterfeit quantum money qubit states $$\vert\psi\rangle$$. However, it's not been clear to me how the serial numbers themselves are stored - were they originally meant to be digitally signed?

Is there a risk in having the bank publish a distributed list amongst users of the currency, in plaintext, of each of the $$k$$ serial numbers?

There might be an advantage in having a distributed database of plaintext serial numbers. Users of the currency would know, or at least upper bound, precisely how much currency has been produced, and I don't think that the bank could overproduce without causing a devaluation. If the bank were to mint more money, they would have to update their plaintext database, and users of the currency would recognize that the money they hold is deprecated.

• The quantum money protocols don't specify exactly how the list of names is provided. Knowing the list shouldn't help anybody counterfeit the money, so I don't see any risk in having the bank publish a distributed list. Jan 2, 2020 at 16:45