Noise-tolerant public-key quantum money from a classical oracle

Peter Yuen

doi:10.22331/q-2025-04-07-1691

Noise-tolerant public-key quantum money from a classical oracle

Peter Yuen

University of Ottawa, Department of Mathematics and Statistics

Published:	2025-04-07, volume 9, page 1691
Editor:	Petros Wallden
Eprint:	arXiv:2407.06463v2
Doi:	https://doi.org/10.22331/q-2025-04-07-1691
Citation:	Quantum 9, 1691 (2025).

Find this paper interesting or want to discuss? Scite or leave a comment on SciRate.

Abstract

Quantum money is the task of verifying the validity of banknotes while ensuring that they cannot be counterfeited. Public-key quantum money allows anyone to perform verification, while the private-key setting restricts the ability to verify to banks, as in Wiesner's original scheme. The current state of technological progress means that errors are impossible to entirely suppress, hence the requirement for noise-tolerant schemes. We show for the first time how to achieve noise-tolerance in the public-key setting. Our techniques follow Aaronson and Christiano's oracle model, where we use the ideas of quantum error correction to extend their scheme: a valid banknote is now a subspace state possibly affected by noise, and verification is performed by using classical oracles to check for membership in "larger spaces." Additionally, a banknote in our scheme is minted by preparing conjugate coding states and applying a unitary that permutes the standard basis vectors.

Popular summary

Quantum states are highly sensitive to their environment; factors like heat and vibrations can alter them in unexpected, undesirable ways. When this occurs, we say that the quantum state has been affected by noise (that is, the state has incurred some errors). In the context of quantum money, where the goal is to produce verifiable, unforgeable banknotes, noise-tolerance is especially relevant because in any practical real-world version of quantum money, a banknote would need to be stored for some period of time (like how money sits in an account). But with a quantum state acting as a banknote, it is natural that errors will occur as time is spent in storage. With enough errors, a valid banknote would fail a verification check, resulting in a loss of value. Thus, a noise-tolerant scheme is a necessity.

In this work, we present the first noise-tolerant public-key quantum money scheme (public in the sense that anybody can verify a banknote, as opposed to the private setting where only banks have the capability to verify). Our approach is to use the foundational framework developed by Aaronson and Christiano, and build upon the fact that their scheme resembles a well-known quantum error correcting code. This results in a scheme for public-key quantum money that is inherently noise-tolerant, as opposed to applying a layer of quantum error correction on top of an existing scheme.

► BibTeX data

@article{Yuen2025noisetolerantpublic,
  doi = {10.22331/q-2025-04-07-1691},
  url = {https://doi.org/10.22331/q-2025-04-07-1691},
  title = {Noise-tolerant public-key quantum money from a classical oracle},
  author = {Yuen, Peter},
  journal = {{Quantum}},
  issn = {2521-327X},
  publisher = {{Verein zur F{\"{o}}rderung des Open Access Publizierens in den Quantenwissenschaften}},
  volume = {9},
  pages = {1691},
  month = apr,
  year = {2025}
}

► References

[1] R. Amiri and J. M. Arrazola. Quantum money with nearly optimal error tolerance. Physical Review A, 95(6): 062334, 2017. DOI: 10.1103/PhysRevA.95.062334.
https://doi.org/10.1103/PhysRevA.95.062334

[2] S. Aaronson. Quantum copy-protection and quantum money. In 24th Annual Conference on Computational Complexity (CCC 2009), pages 229–242, 2009. DOI: 10.1109/CCC.2009.42.
https://doi.org/10.1109/CCC.2009.42

[3] S. Aaronson and P. Christiano. Quantum money from hidden subspaces. In STOC '12: Proceedings of the fourty-fourth ACM symposium on Theory of computing, pages 41–60, 2012. DOI: 10.1145/2213977.2213983.
https://doi.org/10.1145/2213977.2213983

[4] P. Ananth, Z. Hu, and H. Yuen. On the (im)plausibility of public-key quantum money from collision-resistant hash functions. In Advances in Cryptology — ASIACRYPT 2023, pages 39–72, 2023. DOI: 10.1007/978-981-99-8742-9_2.
https://doi.org/10.1007/978-981-99-8742-9_2

[5] A. Ambainis. Quantum lower bounds by quantum arguments. Journal of Computer and System Sciences, 64(4): 750–767, 2002. DOI: 10.1006/jcss.2002.1826.
https://doi.org/10.1006/jcss.2002.1826

[6] C. H. Bennett, E. Bernstein, G. Brassard, and U. Vazirani. Strengths and weaknesses of quantum computing. SIAM Journal on Computing, 26(5): 1510–1523, 1997. DOI: 10.1137/S0097539796300933.
https://doi.org/10.1137/S0097539796300933

[7] A. Bilyk, J. Doliskani, and Z. Gong. Cryptanalysis of three quantum money schemes. Quantum Information Processing, 22(4): 177:1–177:27, 2023. DOI: 10.1007/s11128-023-03919-0.
https://doi.org/10.1007/s11128-023-03919-0

[8] S. Ben-David and O. Sattah. Quantum tokens for digital signatures. Quantum, 7: 901, 2023. DOI: 10.22331/q-2023-01-19-901.
https://doi.org/10.22331/q-2023-01-19-901

[9] B. Barak, O. Goldreich, R. Impagliazzo, S. Rudich, A. Sahai, S. Vadhan, and K. Yang. On the (im)possibility of obfuscating programs. Journal of the ACM, 59(2): 6, 2012. DOI: 10.1145/2160158.2160159.
https://doi.org/10.1145/2160158.2160159

[10] J. Bartusek, J. Guan, F. Ma, and M. Zhandry. Return of GGH15: Provable security against zeroizing attacks. In Theory of Cryptography (TCC 2018), volume 2, pages 544–574, 2018. DOI: 10.1007/978-3-030-03810-6_20.
https://doi.org/10.1007/978-3-030-03810-6_20

[11] A. Behera, O. Sattath, and U. Shinar. Noise-tolerant quantum tokens for MAC. E-print arXiv:2105.05016 [quant-ph], 2021. arXiv: 2105.05016.
arXiv:2105.05016

[12] A. Coladangelo, J. Liu, Q. Liu, and M. Zhandry. Hidden cosets and applications to unclonable cryptography. In Advances in Cryptology — CRYPTO 2021, volume 1, pages 556–584, 2021. DOI: 10.1007/978-3-030-84242-0_20.
https://doi.org/10.1007/978-3-030-84242-0_20

[13] M. Conde Pena, R. Durán Díaz, J.-C. Faugère, L. Hernández Encinas, and L. Perret. Non-quantum cryptanalysis of the noisy version of Aaronson-Christiano's quantum money scheme. IET Information Security, 13(4): 362–366, 2019. DOI: 10.1049/iet-ifs.2018.5307.
https://doi.org/10.1049/iet-ifs.2018.5307

[14] M. Conde Pena, J.-C. Faugère, and L. Perret. Algebraic cryptanalysis of a quantum money scheme: the noise-free case. In Public-Key Cryptography – PKC 2015, pages 194–213, 2015. DOI: 10.1007/978-3-662-46447-2_9.
https://doi.org/10.1007/978-3-662-46447-2_9

[15] E. Culf and T. Vidick. A monogamy-of-entanglement game for subspace coset states. Quantum, 6: 791, 2022. DOI: 10.22331/q-2022-09-01-791.
https://doi.org/10.22331/q-2022-09-01-791

[16] J. Flum and M. Grohe. Parametrized Complexity Theory. Springer, 2006.

[17] E. Farhi, D. Gosset, A. Hassidimand, A. Lutomirski, D. Nagaj, and P. Shor. Quantum state restoration and single-copy tomography for ground states of hamiltonians. Physical Review Letters, 105(19): 190503, 2010. DOI: 10.1103/physrevlett.105.190503.
https://doi.org/10.1103/physrevlett.105.190503

[18] E. Farhi, D. Gosset, A. Hassidim, A. Lutomirski, and P. W. Shor. Quantum money from knots. In 3rd Conference on Innovations in Theoretical Computer Science—ITCS 2012, pages 276–289, 2012. DOI: 10.1145/2090236.2090260.
https://doi.org/10.1145/2090236.2090260

[19] K. Fujii. Quantum computation with topological codes: from qubit to topological fault-tolerance. Springer, 2015. DOI: 10.1007/978-981-287-996-7.
https://doi.org/10.1007/978-981-287-996-7

[20] S. Garg, C. Gentry, S. Halevi, M. Raykova, A. Sahai, and B. Waters. Candidate indistinguishability obfuscation and functional encryption for all circuits. In 2013 54th Annual IEEE Symposium on Foundations of Computer Science (FOCS 2013), pages 40–49, 2013. DOI: 10.1109/FOCS.2013.13.
https://doi.org/10.1109/FOCS.2013.13

[21] D. Gottesman. Stabilizer Codes and Quantum Error Correction. PhD thesis, California Institute of Technology, 1997. DOI: 10.7907/rzr7-dt72.
https://doi.org/10.7907/rzr7-dt72

[22] R. Gay and R. Pass. Indistinguishability obfuscation from circular security. In STOC 2021: Proceedings of the 53rd ACM SIGACT Symposium on Theory of Computing, pages 736–749, 2021. DOI: 10.1145/3406325.3451070.
https://doi.org/10.1145/3406325.3451070

[23] K. Heshami, D. G. England, P. C. Humphreys, P. J. Bustard, V. M. Acosta, and B. J. Sussman. Quantum memories: emerging applications and recent advances. Journal of Modern Optics, 63(20): 2005–2028, 2016. DOI: 10.1080/09500340.2016.1148212.
https://doi.org/10.1080/09500340.2016.1148212

[24] S. Hopkins, A. Jain, and H. Lin. Counterexamples to new circular security assumptions underlying iO. In Advances in Cryptology — CRYPTO 2021, volume 2, pages 673–700, 2021. DOI: 10.1007/978-3-030-84245-1_23.
https://doi.org/10.1007/978-3-030-84245-1_23

[25] D. M. Kane. Quantum money from modular forms. E-print arXiv:1809.05925 [quant-ph], 2018. arXiv: 1809.05925.
arXiv:1809.05925

[26] D. M. Kane, S. Sharif, and A. Silverberg. Quantum money from quaternion algebras. E-print arXiv:2109.12643 [quant-ph], 2021. arXiv: 2109.12643.
arXiv:2109.12643

[27] N. Kumar. Practically feasible robust quantum money with classical verification. Cryptography, 3(4): 26:1–26:24, 2019. DOI: 10.3390/cryptography3040026.
https://doi.org/10.3390/cryptography3040026

[28] A. Lutomirski, S. Aaronson, E. Farhi, D. Gosset, J. A. Kelner, A. Hassidim, and P. W. Shor. Breaking and making quantum money: Toward a new quantum cryptographic protocol. In Innovations in Computer Science—ICS 2010, pages 20–31, 2010. Online: https://arxiv.org/abs/0912.3825.
arXiv:0912.3825

[29] J. Liu, H. Montgomery, and M. Zhandry. Another round of breaking and making quantum money: How to not build it from lattices, and more. In Advances in Cryptology — EUROCRYPT 2023, pages 611–638, 2023. DOI: 10.1007/978-3-031-30545-0_21.
https://doi.org/10.1007/978-3-031-30545-0_21

[30] A. Lutomirski. An online attack against Wiesner's quantum money. E-print arXiv:1010.0256 [quant-ph], 2010. arXiv: 1010.0256.
arXiv:1010.0256

[31] A. Molina, T. Vidick, and J. Watrous. Optimal counterfeiting attacks and generalizations for Wiesner's quantum money. In Theory of Quantum Computation, Communication, and Cryptography (TQC 2012), pages 45–64, 2013. DOI: 10.1007/978-3-642-35656-8_4.
https://doi.org/10.1007/978-3-642-35656-8_4

[32] M. A. Nielsen and I. L. Chuang. Quantum Computation and Quantum Information. Cambridge University Press, 10th anniversary edition, 2010. DOI: 10.1017/CBO9780511976667.
https://doi.org/10.1017/CBO9780511976667

[33] F. Pastawski, N. Y. Yao, L. Jiang, M. D. Lukin, and J. I. Cirac. Unforgeable noise-tolerant quantum tokens. Proceedings of the National Academy of Sciences of the United States of America, 109(40): 16079–16082, 2012. DOI: 10.1073/pnas.1203552109.
https://doi.org/10.1073/pnas.1203552109

[34] B. Roberts. Security analysis of quantum lightning. In Advances in Cryptology — EUROCRYPT 2021, pages 562–567, 2021. DOI: 10.1007/978-3-030-77886-6_19.
https://doi.org/10.1007/978-3-030-77886-6_19

[35] J. Roffe. Quantum error correction: an introductory guide. Contemporary Physics, 60(3): 226–245, 2019. DOI: 10.1080/00107514.2019.1667078.
https://doi.org/10.1080/00107514.2019.1667078

[36] A. Sahai and B. Waters. How to use indistinguishability obfuscation: deniable encryption, and more. In STOC '14: Proceedings of the fourty-sixth ACM symposium on Theory of computing, pages 475–484, 2014. DOI: 10.1145/2591796.2591825.
https://doi.org/10.1145/2591796.2591825

[37] S. Wiesner. Conjugate coding. ACM SIGACT News, 15(1): 78–88, 1983. DOI: 10.1145/1008908.1008920.
https://doi.org/10.1145/1008908.1008920

[38] P. Wang, C.-Y. Luan, M. Qiao, M. Um, J. Zhang, Y. Wang, X. Yuan, M. Gu, J. Zhang, and K. Kim. Single ion qubit with estimated coherence time exceeding one hour. Nature Communications, 12(1): 233:1–233:8, 2021. DOI: 10.1038/s41467-020-20330-w.
https://doi.org/10.1038/s41467-020-20330-w

[39] H. Wee and D. Wichs. Candidate obfuscation via oblivious LWE sampling. In Advances in Cryptology — EUROCRYPT 2021, pages 127–156, 2021. DOI: 10.1007/978-3-030-77883-5_5.
https://doi.org/10.1007/978-3-030-77883-5_5

[40] M. Zhandry. Quantum lightning never strikes the same state twice. In Advances in Cryptology — EUROCRYPT 2019, volume 3, pages 408–438, 2019. DOI: 10.1007/978-3-030-17659-4_14.
https://doi.org/10.1007/978-3-030-17659-4_14

[41] M. Zhandry. Quantum lightning never strikes the same state twice. Or: Quantum money from cryptographic assumptions. Journal of Cryptology, 34(1): 6:1–6:56, 2021. DOI: 10.1007/s00145-020-09372-x.
https://doi.org/10.1007/s00145-020-09372-x

Cited by

[1] J Knörzer, X Liu, B F Schiffer, and J Tura, "Distributed quantum information processing: a review of recent progress", Reports on Progress in Physics 89 7, 074401 (2026).

[2] Mathieu Bozzio, Claude Crépeau, Petros Wallden, and Philip Walther, "Quantum cryptography beyond key distribution: Theory and experiment", Reviews of Modern Physics 97 4, 045006 (2025).

The above citations are from Crossref's cited-by service (last updated successfully 2026-08-08 18:04:23) and SAO/NASA ADS (last updated successfully 2026-08-08 18:04:24). The list may be incomplete as not all publishers provide suitable and complete citation data.

This Paper is published in Quantum under the Creative Commons Attribution 4.0 International (CC BY 4.0) license. Copyright remains with the original copyright holders such as the authors or their institutions.