5

Quantum Money is an old proposal that solves the forgeability problem of traditional banknotes, by leveraging the No-Cloning Theorem.

Recently, blockchains solved the Double-Spending problem allowing them to be de facto usable as money. Indeed even though on a blockchain you can forge as many coins as you wish, the other participants will not accept your claims.

Are there any aspect which make quantum money a superior alternative to blockchain digital currencies?

Rexcirus
  • 153
  • 5

2 Answers2

6

I propose the following advantages to quantum money, over and above blockchain-based cryptocurrencies.

  1. The security of Nakomoto-style cryptocurrencies (read, Bitcoin) is based on computational assumptions, at least in that there is a assumption that inverting SHA256 hashes is likely computationally difficult. However, Wiesner-style private-key based quantum money is based on more information-theoretic assumptions, namely the no-cloning theorem/no signaling theorem/etc. Accepting that the no-cloning theorem is a better assumption than the difficulty of inverting hash functions may not be for everyone, but at least it's a difference.

  2. Nakomoto-style blockchains have a famous problem in their energy usage, which appears to grow exponentially with acceptance of the cryptocurrency. But both Wiesner-style ("private-key"), and even "public-key" quantum money schemes such as those based on knots don't appear to have a lot of similar disadvantages in energy usage; there is no "proof-of-work" at play in quantum money.

  3. Investigating schemes for quantum money may also provide schemes for digital signatures/commitment. For example, for certain public-key systems, if a scheme cannot easily be used as quantum money then it may be used for commitment. Bitcoin doesn't seem to have similar win-win opportunities.

  4. For me, quantum money is fun to think about, and proposes some interesting problems in-and-of themselves, that are orthogonal to that of bitcoin. For example, I would like to learn more about Kane's proposal on modular forms, and Shor has recently teased quantum money based on lattices. Does anyone seriously envision quantum money with valuations/market capitalization similar to that of bitcoin ($120B), say, in the next 10 years? I doubt it, but still, fun to think about.

Mark Spinelli
  • 15,789
  • 3
  • 26
  • 85
6

This work (which I'm a co-author) discusses the properties that different forms of money have. The paper discusses cryptocurrencies such as Bitcoin, and public quantum money. The following figure is taken from there, where the two relevant columns are highlighted: table

The advantages, some of which were not mentioned by others, is that public quantum money is locally verifiable (meaning, unlike Bitcoin, you don't need to be connected to the internet), there are no transaction costs, low latency, has an unbounded throughput (e.g., Bitcoin can only support <10 transactions per second, globally), provides better privacy guarantees (untraceable, at least to some extent), more fungible than Bitcoin and other cryptocurrencies which are not privacy oriented, and is energetically much more efficient (as it doesn not reuqire proof-of-work). Public quantum money could be issued by a cenral bank (similarly to cash), and in this case it would enjoy other benefits such as of it being legal tender, stable and have a better reputation.

The drawbacks of public quantum money are: it is not divisible or mergeable, does not allow proof-of-payment nor proof-of-reserves, does not provide smart contracts functionalities, and it can't be backed-up.

There are some more advnaced primitives, such as quantum lighting and one-shot signatures, which can be used to eliminate some of the drawbacks mentioned above: see here and here. Unfortunately, we currently don't have constructions which are provably secure in the plain model for these primitives. I consider constructing these primitives an important open problem.

Or Sattath
  • 61
  • 1
  • 2