<p>There are proposals for quantum money where it appears that not even the bank can produce two copies of a quantum money state with the same serial number. See </p>

<ul>
<li><p>Farhi et al's paper <a href="https://arxiv.org/abs/1004.5127" rel="noreferrer">Quantum Money from Knots</a>, </p></li>
<li><p>Mark Zhandry's paper <a href="https://arxiv.org/abs/1711.02276" rel="noreferrer">Quantum Lightning Never Strikes the Same State Twice</a>,  </p></li>
<li><p>Daniel Kane's paper <a href="https://arxiv.org/abs/1809.05925" rel="noreferrer">Quantum Money from Modular Forms</a>.</p></li>
</ul>

<p>In order to make sure that the bank can only produce <span class="math-container">$k$</span> banknotes, one would need to have the bank publish the serial numbers of exactly <span class="math-container">$k$</span> banknotes in some secure location. Otherwise it could make as many bank notes as it wants (although they would all have different serial numbers).</p>

CC BY-SA 4.0
2019-12-21T23:33:18.530Z
2019-12-21T23:39:21.447Z
2019-12-21T23:39:21.447Z
Peter Shor 
<p>The Quantum Money system proposed in "Quantum Copy-Protection and Quantum Money" has the following properties:</p>

<ol>
<li>The bank can produce bank notes in the form of quantum states.</li>
<li>Anyone can verify that one of these quantum states is a valid bank note without destroying the quantum state.</li>
<li>No one except the bank can produce more bank notes, even if they already have some.</li>
</ol>

<p>All assuming that the actors only have polynomial time quantum computers.</p>

<p>My question is if you can take this step further and make it so that even the <em>bank</em> is unable to forge bills.</p>

<p>What do I mean by this? The quantum money protocol I am looking for would have an integer parameter <span class="math-container">$k$</span>, and the bank could only create <span class="math-container">$k$</span> valid bank notes.</p>

<p>(This might seem impossible since the bank could just run the protocol again to get <span class="math-container">$k$</span> more bank notes. A way to prevent this would be to require it to produce a random classical string <span class="math-container">$s$</span> of bits that it releases publicly, such that it can not run the protocol again and produce the same <span class="math-container">$s$</span> with non-negligible probability.)</p>

<cc.complexity-theory><quantum-computing><quantum-information><physics><ce.computational-finance>
Quantum Money where not even the Bank can counterfeit
Christopher King
# Quantum Money where not even the Bank can counterfeit

(Asked by: username_0 on 2019-12-21)

The Quantum Money system proposed in "Quantum Copy-Protection and Quantum Money" has the following properties:

1. The bank can produce bank notes in the form of quantum states.
2. Anyone can verify that one of these quantum states is a valid bank note without destroying the quantum state.
3. No one except the bank can produce more bank notes, even if they already have some.

All assuming that the actors only have polynomial time quantum computers.

My question is if you can take this step further and make it so that even the *bank* is unable to forge bills.

What do I mean by this? The quantum money protocol I am looking for would have an integer parameter $k$, and the bank could only create $k$ valid bank notes.

(This might seem impossible since the bank could just run the protocol again to get $k$ more bank notes. A way to prevent this would be to require it to produce a random classical string $s$ of bits that it releases publicly, such that it can not run the protocol again and produce the same $s$ with non-negligible probability.)

**Tags:** cc.complexity-theory, quantum-computing, quantum-information, physics, ce.computational-finance


---

## 1 answers

### Answer by username_1 on 2019-12-21. Score: 8 | Accepted answer

There are proposals for quantum money where it appears that not even the bank can produce two copies of a quantum money state with the same serial number. See

* Farhi et al's paper [Quantum Money from Knots](https://arxiv.org/abs/1004.5127),
* Mark Zhandry's paper [Quantum Lightning Never Strikes the Same State Twice](https://arxiv.org/abs/1711.02276),
* Daniel Kane's paper [Quantum Money from Modular Forms](https://arxiv.org/abs/1809.05925).

In order to make sure that the bank can only produce $k$ banknotes, one would need to have the bank publish the serial numbers of exactly $k$ banknotes in some secure location. Otherwise it could make as many bank notes as it wants (although they would all have different serial numbers).


---

