Quantum Money from Hidden Subspaces
Name
Aaronson_Quantum money.pdf
Size
412.62 KB
Format
Adobe PDF
Checksum (MD5)
d2d90c8b6d6fa1c5df41796bc6394792
Author(s)
Aaronson, Scott
Christiano, Paul F.
Date Issued
May 2012
Journal
Proceedings of the 44th ACM Symposium on Theory of Computing, (STOC 2012)
Publisher
Association for Computing Machinery, sponsored by the ACM Special Interest Group on Algorithms and Computation Theory
Citation
Aaronson, Scott and Paul Christiano. "Quantum Money from Hidden Subspaces." in Proceedings of the 44th ACM Symposium on Theory of Computing, (STOC 2012), May 19-22, 2012, New York, NY.
Version
Author's final manuscript
Abstract
Forty years ago, Wiesner pointed out that quantum mechanics raises the striking possibility
of money that cannot be counterfeited according to the laws of physics. We propose the first
quantum money scheme that is
(1) public-key—meaning that anyone can verify a banknote as genuine, not only the bank
that printed it, and
(2) cryptographically secure, under a “classical” hardness assumption that has nothing to do
with quantum money.
Our scheme is based on hidden subspaces, encoded as the zero-sets of random multivariate
polynomials. A main technical advance is to show that the “black-box” version of our scheme,
where the polynomials are replaced by classical oracles, is unconditionally secure. Previously,
such a result had only been known relative to a quantum oracle (and even there, the proof was
never published).
Even in Wiesner’s original setting—quantum money that can only be verified by the bank—
we are able to use our techniques to patch a major security hole in Wiesner’s scheme. We
give the first private-key quantum money scheme that allows unlimited verifications and that
remains unconditionally secure, even if the counterfeiter can interact adaptively with the bank.
Our money scheme is simpler than previous public-key quantum money schemes, including
a knot-based scheme of Farhi et al. The verifier needs to perform only two tests, one in the
standard basis and one in the Hadamard basis—matching the original intuition for quantum
money, based on the existence of complementary observables.
Our security proofs use a new variant of Ambainis’s quantum adversary method, and several
other tools that might be of independent interest.
MIT Department
Massachusetts Institute of Technology. Computer Science and Artificial Intelligence Laboratory
Massachusetts Institute of Technology. Department of Electrical Engineering and Computer Science
Terms of Use
Creative Commons Attribution-Noncommercial-Share Alike 3.0
Persistent DSpace Link
DOI of Published Version
http://cs.nyu.edu/~stoc2012/accepted.htm
