⚛️ quantum physics

A Note on Publicly Verifiable Quantum Money with Low Quantum Computational Resources

This paper presents a publicly verifiable quantum money protocol that requires minimal quantum computational resources by leveraging one-time memories and conjugate coding to prevent double spending while also enabling quantum tokens for digital signatures.

Original authors: Fabrizio Genovese, Lev Stambler

Published 2026-03-16

📖 6 min read🧠 Deep dive

CC BY 4.0

Original authors: Fabrizio Genovese, Lev Stambler

Original paper licensed under CC BY 4.0 (http://creativecommons.org/licenses/by/4.0/). ✨ This is an AI-generated explanation of the paper below. It is not written or endorsed by the authors. For technical accuracy, refer to the original paper. Read full disclaimer

The Big Idea: Digital Cash That Can't Be Copied

Imagine you have a magical banknote. In the real world, if you try to photocopy a $20 bill, the machine jams or the copy looks fake. In the digital world, copying a file is as easy as pressing "Ctrl+C" and "Ctrl+V." This is why digital money usually needs a central bank (like a server) to check if you've spent it twice.

Quantum money solves this using the laws of physics. It relies on a rule called the No-Cloning Theorem: You cannot make a perfect copy of a mysterious quantum object. If you try to look at it too closely to copy it, you accidentally break it.

This paper introduces a new way to make this quantum money that is:

Publicly Verifiable: Anyone can check if it's real (like checking a serial number), not just the bank.
Low-Tech: It doesn't need a super-powerful quantum computer. It only needs simple equipment similar to what is already used for secure internet connections (Quantum Key Distribution).

The Core Ingredients

To build this money, the authors use three main tools:

1. The "Conjugate Coding" (The Two-Faced Coin)

Imagine a special coin that can be either Heads/Tails (Z-basis) or Red/Blue (X-basis).

If you know the coin is "Heads/Tails," you can check it easily.
If you check a "Red/Blue" coin using a "Heads/Tails" detector, you get a random result (50/50 chance).
The Magic: You cannot know both the Heads/Tails state and the Red/Blue state at the same time. If you try to measure one, you destroy the information about the other.

2. The "One-Time Memory" (The Tamper-Proof Box)

This is a small, secure hardware device (like a high-tech safe or a specialized chip).

Inside the box, the bank stores two secret passwords: Password A and Password B.
The box has a rule: You can ask for either A or B, but never both.
Once you ask for A, the box "forgets" B forever. It's a one-time use.
Note: The paper assumes these boxes are physically secure (like a bank vault) so no one can break them open to steal both passwords.

3. The "Hash Function" (The Digital Fingerprint)

This is a mathematical machine that turns a long, complex password into a short, unique code (like a fingerprint).

It is easy to turn a password into a fingerprint.
It is impossible to turn the fingerprint back into the password.

How the Money Works (The Recipe)

Step 1: Minting (Creating the Bill)

The Bank creates a quantum banknote. It's not just a piece of paper; it's a bundle of:

Classical Data: A list of "fingerprints" (hashes) of two secret passwords for every single "One-Time Memory" (OTM) on the bill. The bank signs this list to prove it's real.
Quantum Data: A series of quantum states (the "magic coins") sent to the OTMs. These states are linked to the passwords.

Think of the banknote as a lucky draw ticket with 100 little boxes (OTMs) attached to it. Each box contains a secret, and the bank has printed the "fingerprint" of what's inside on the back of the ticket.

Step 2: Spending (Transferring the Bill)

You want to buy a coffee. You hand the banknote to the shop.

You send the classical data (the fingerprints) to the shop.
You send the quantum data (the magic coins/OTMs) to the shop via a quantum channel.
Crucial Point: Because of the "No-Cloning" rule, you cannot keep a copy of the quantum data. Once you send it, you lose it. You can't spend the same bill twice.

Step 3: Verification (Checking the Bill)

The shop doesn't trust you. They need to check if the bill is real. They can't check everything (because that would destroy the bill), so they play a game of "Cut and Choose":

The shop picks a random handful of the 100 boxes (OTMs) to open.
They ask the box: "Give me the password for option A (or B)."
The box gives them the password.
The shop takes that password, runs it through the "Fingerprint Machine" (Hash), and checks if it matches the fingerprint printed on the back of the bill.
If it matches: The bill is likely real.
If it doesn't match: The bill is fake.

Why is this safe?
If a hacker tried to fake the bill, they would need to know both passwords for the boxes they didn't open. But because of the "One-Time Memory" rule and the laws of quantum physics, they can only get one password per box. To fake the bill, they would have to guess the missing passwords. Since the passwords are long and complex, guessing them is like winning the lottery every single time—it's statistically impossible.

The "Consumable" Nature of the Bill

Here is the catch: Every time you verify the bill, you use up a few of the boxes.

If you check 10 boxes, those 10 boxes are now "used."
The bill still works, but it has fewer boxes left for future checks.
Eventually, the bill runs out of boxes. At that point, you take the "used" bill back to the bank. The bank sees the remaining fingerprints, verifies them, and gives you a brand new bill with fresh boxes.

This is similar to how physical cash gets worn out. You can't use a shredded $20 bill, so you take it to the bank to get a new one.

Why is this a Big Deal?

No Central Server Needed: Unlike Bitcoin, which needs a massive network of computers to agree on who owns what, this money works peer-to-peer. You and the shop can verify it instantly without asking the bank.
Privacy: Since there is no central ledger, no one can track your spending history. It's as private as handing cash to a friend.
Realistic Tech: Previous ideas for quantum money required giant, futuristic quantum computers. This paper says, "We can do this with simple, existing quantum tech (like fiber optics for secure internet) and a secure hardware chip."

Summary Analogy

Imagine a Magic Ticket with 100 sealed envelopes attached to it.

The Bank writes a secret code inside each envelope.
The Bank prints the scrambled version of the code on the outside of the ticket.
To verify the ticket, the shop tears open 5 random envelopes, checks if the code inside matches the scrambled version outside, and then throws those envelopes away.
If the codes match, the ticket is real.
Because of physics, a forger cannot peek inside all the envelopes without destroying the ticket.
Once you've checked enough envelopes, the ticket is "spent," and you trade it in for a fresh one.

This paper proves that we can build this system today using technology that is just around the corner, making "un-copyable" digital cash a reality.

1. Problem Statement

The paper addresses the long-standing challenge of creating Publicly Verifiable Quantum Money.

Historical Context: Since Wiesner's 1970 proposal, quantum money has relied on the No-Cloning Theorem to prevent double-spending. However, original schemes were private-key, meaning only the issuer (the mint) could verify authenticity, requiring constant contact with the issuer for every transaction.
The Gap: While public-key quantum money (where anyone can verify without the mint) is desirable for a usable currency, existing proposals typically require heavy quantum computational resources (general-purpose Quantum Processing Units) that do not yet exist.
The Goal: To design a publicly verifiable quantum money scheme that:
1. Requires minimal quantum computational capabilities (only single-qubit preparation, transmission, and measurement in conjugate bases).
2. Does not rely on a consensus protocol (unlike blockchain).
3. Prevents double-spending.
4. Allows for a limited number of verifications before redemption.

2. Methodology

The authors propose a hybrid cryptographic scheme combining Quantum Conjugate Coding, One-Time Memories (OTMs), and Classical Cryptography (hash functions and digital signatures).

A. Core Components

Conjugate Coding: Based on Wiesner's work, this involves encoding bits into qubits using two conjugate bases (e.g., Z-basis $|0\rangle, |1\rangle$ and X-basis $|+\rangle, |-\rangle$ ). Measuring in the wrong basis yields random noise.
One-Time Memories (OTMs): A cryptographic primitive where a device holds two secrets ( $s_0, s_1$ $s_{0}, s_{1}$ ) but allows the user to retrieve exactly one, but not both.
- Implementation: The paper constructs OTMs using conjugate coding states combined with Trusted Hardware (e.g., TEEs like Intel SGX). The hardware stores the basis choice ( $\theta$ ) and the secrets, verifying that the user measured the quantum states correctly before releasing the secret.
Cut-and-Choose Verification: Instead of verifying every component of a banknote (which would destroy it), the verifier randomly selects a subset of components to "challenge" (open and verify).

B. The Protocol

1. Minting (Construction 4.4):

The mint generates $\zeta$ pairs of random bitstrings ( $\kappa_{0,i}, \kappa_{1,i}$ ).
It computes hashes $H(\kappa_{b,i})$ and signs them with the mint's private key.
For each pair, it creates an OTM ( $OTM_i$ ) that encodes the pair. The OTM is backed by a quantum state $|OTM\rangle_i$ prepared in a conjugate basis determined by a random bit $\theta_i$ .
The Banknote consists of:
- The quantum states $\{|OTM\rangle_i\}$ .
- The classical data: The signed hashes $\{H(\kappa_{b,i}), \sigma_{mint}\}$ and a set of "revealed" pre-images $\{\kappa_k\}$ (initially empty).

2. Verification (Construction 4.5):

A verifier $V$ receives the banknote.
$V$ checks the validity of the mint's signatures on the hashes.
Cut-and-Choose: $V$ randomly selects a subset of indices $\mathcal{L}$ (size $\xi$ ) from the unopened OTMs.
$V$ challenges the banknote by asking for the pre-image corresponding to a random bit $b_\ell$ for each selected index.
The holder measures the quantum states to retrieve the pre-images from the OTMs.
$V$ verifies that $H(\text{retrieved } \kappa) = H(\kappa_{b,\ell})$ .
Consumption: If verification passes, the opened OTMs are removed from the banknote (added to the set of known pre-images), reducing the remaining verification capacity.

3. Transfer (Construction 4.6):

The sender transfers the classical data and the quantum states to the receiver.
Due to the No-Cloning Theorem, the sender cannot keep a copy of the quantum states to double-spend.

3. Key Contributions

Low-Resource Public Verification: The scheme achieves public verifiability using only single-qubit operations (preparation and measurement in conjugate bases), which are capabilities available in current Quantum Key Distribution (QKD) hardware, rather than requiring full-scale quantum computers.
OTM-Based Construction: The authors adapt the concept of One-Time Memories (previously theoretical or requiring complex setups) into a practical money scheme using trusted hardware and conjugate coding.
Bounded Verification Model: The paper introduces a realistic model where a banknote has a finite lifespan (approx. $\zeta/\xi$ verifications). Once exhausted, the note must be returned to the mint for redemption (similar to exchanging worn physical cash).
Extension to Quantum Tokens for Digital Signatures (QTDS): The authors demonstrate that the same infrastructure can be used to create quantum tokens that allow a holder to sign a message (e.g., a bet or a commitment) exactly once. The act of signing consumes the token's ability to sign again, preventing double-signing.
Proof-of-Concept Implementation: The authors provide a Rust library (otm_billz) implementing these concepts.

4. Results and Security Analysis

Unforgeability (Theorem 1): The security relies on two pillars:
1. Simulation-Security of OTMs: An adversary cannot extract both secrets ( $s_0$ and $s_1$ ) from a single OTM.
2. Preimage Resistance of Hash Functions: Without the OTM, an adversary cannot guess the pre-image $\kappa$ given $H(\kappa)$ .
Double-Spending Prevention: To double-spend, an adversary would need to split the quantum banknote into two valid copies. The proof shows that due to the simulation security of OTMs, the adversary can only effectively assign a specific OTM to one of the two copies. When the verifier randomly challenges the other copy, the adversary must guess the pre-image, which is computationally infeasible (probability $\approx 2^{-2\xi}$ ).
Noise Tolerance: The underlying OTM construction is robust against noise in the quantum channel up to a certain threshold.

5. Significance and Future Directions

Practicality: This work bridges the gap between theoretical quantum money and near-term hardware capabilities. It suggests that quantum money could be viable once quantum internet infrastructure and stable quantum memories (with coherence times sufficient for transaction speeds) are available.
Privacy: Unlike blockchain, this system is intrinsically peer-to-peer and private, requiring no global consensus or economic incentives to run.
Limitations & Future Work:
- Trusted Hardware: The scheme currently relies on TEEs (Trusted Execution Environments). The authors note that while side-channels exist, the security degrades gracefully (compromising one token only affects that token).
- Pre-Transfer Verification: A major open problem is allowing a receiver to verify the authenticity of the quantum states before accepting the transfer from a potentially malicious sender.
- Resource Scaling: Currently, resources scale linearly with the number of verifications. Reducing this to sub-linear growth is a future goal.
- Infinite Verifiability: The current scheme is bounded; achieving infinite verifiability without trusted hardware remains an open challenge.

In summary, Genovese and Stambler present a pragmatic, implementable framework for quantum money that leverages existing quantum communication technologies and trusted hardware to solve the double-spending problem without requiring the full power of a universal quantum computer.