Quantum Money (Overview)

Quantum money was, historically, the first idea in quantum information — Wiesner conceived it around 1970, before quantum key distribution. The premise is simple and striking: use the no-cloning theorem to make banknotes that are physically impossible to counterfeit, in a way no classical token (which can always be photocopied) can match.

Wiesner's scheme

A bank issues a banknote consisting of:

a classical serial number $s$ , and
a sequence of $n$ qubits, each independently prepared in one of the four BB84 states $\{|0\rangle, |1\rangle, |+\rangle, |-\rangle\}$ .

The bank keeps a secret table recording, for serial $s$ , the basis and bit of every qubit. To verify a note, the holder returns it to the bank; the bank looks up the table, measures each qubit in its known preparation basis, and checks that every outcome matches. A legitimate note passes with certainty; the table is the bank's private key.

Why it cannot be forged

A counterfeiter wanting two valid notes must duplicate the quantum state. But the qubits are prepared in conjugate bases unknown to the forger, so by the no-cloning theorem they cannot be copied. The best the forger can do is guess a basis and measure. For each qubit, guessing the wrong basis (probability $\tfrac12$ ) and resending randomizes it. The probability that a single forged qubit then passes the bank's check works out to $\tfrac34$ per qubit:

\Pr[\text{one forged qubit passes}] = \tfrac34,

so a forged $n$ -qubit note passes with probability only

\left(\tfrac34\right)^{n},

which is exponentially small. (The $\tfrac34$ is the same information–disturbance arithmetic as intercept-resend: correct-basis guess passes with probability $1$ weighted $\tfrac12$ , wrong-basis guess passes with probability $\tfrac12$ weighted $\tfrac12$ , giving $\tfrac12 + \tfrac14 = \tfrac34$ .) Choosing $n$ in the hundreds makes forgery astronomically unlikely.

Public-key quantum money

The grand goal is public-key quantum money: anyone can verify a note using a public algorithm, yet no one (without the mint's secret) can forge one — the quantum analog of a publicly checkable banknote. This is far harder, because the public verification procedure itself must not leak enough to let a forger build a passing state. Aaronson and Christiano's hidden-subspace construction (2012) gave a candidate: the money state is a uniform superposition over a secret subspace $A \subseteq \mathbb{F}_2^n$ , and verification projects onto $A$ and its dual $A^\perp$ using public obfuscated descriptions. Its unforgeability rests on computational assumptions, not on no-cloning alone — trading information-theoretic security for public verifiability.

The two ingredients, and their tension

Quantum money sits on two pillars that pull against each other:

No-cloning (information-theoretic) gives unforgeability for free, but only with secret verification.
Public verifiability seems to require computational hardness, since a public check is itself information a forger can study.

No scheme is known that is simultaneously publicly verifiable and information-theoretically unforgeable, and there are reasons to believe the combination is impossible without computational assumptions. This is an active research area linking quantum money to obfuscation, lattice cryptography, and complexity theory.

Beyond money: the broader family

The same no-cloning leverage powers a family of "unclonable" cryptographic objects: quantum tokens (one-time-use credentials that self-destruct on spending), quantum copy-protection (programs that run but cannot be duplicated), and certified deletion (proof that ciphertext was irrecoverably erased). All exploit the impossibility of copying unknown quantum information — the same physical fact that makes QKD secure — turned into a positive cryptographic primitive rather than a defensive guarantee.