Can a merchant who accepts a knot-based quantum coin mint her own knot-based coin?

Question

Referring to Farhi, Gosset, Hassidim, Lutomirski, and Shor's "Quantum Money from Knots," a mint $\mathcal{M}$ generates a run of coins, including, say, $(s,|\$\rangle)$, using a quantum computer to mint $|\$\rangle$ while publishing the public serial number $s$. A merchant $\mathcal{V}$ is able to verify that $|\$\rangle$ corresponds to $s$, and is a valid money state.

The merchant $\mathcal{V}$ is required to perform quantum operations on $|\$\rangle$ to make sure that $|\$\rangle$ corresponds to $s$ and is a valid money state.

But if the merchant $\mathcal{V}$ is capable of performing the verification, then would she not have all quantum capability to mint her own coin in the first place?

The barrier to entry to minting quantum coins does not seem that much different to verifying quantum coins. Thus, we have a situation wherein anyone with a quantum computer capable of verifying such quantum coins can mint their own coins.

If so, a question becomes, how would the market determine the value of a quantum coin, potentially from different merchants or minters? Would the "oldest" quantum coin be valued more than newer coins? Or would a coin with an interesting serial number $s$ be valued more? Or the coin used in some famous transaction?

I would imagine a number of publicly available lists of serial numbers, one for each mint/verifier. If I have a quantum computer, I would be motivated to mint my own coin and publish the serial number. The market can decide that "this coin from this mint is worth more than that coin from that mint," but how would the market decide? It seems interesting.

Answer 1

In complexity theory (quantum and classical) the distinction between construction and verification is very important, and the ability to verify certainly does not imply the ability to construct. For example, it is easy to verify that a satisfying assignment to a Boolean formula really is a satisfying assignment, but finding such an assignment given only the formula is a computationally hard problem (assuming $\text{P}\not=\text{NP}$).

Obviously, the situation with quantum money is a very different one, but there is a similar principle at work, and perhaps the Boolean formula example helps to invalidate any generic sort of intuition stating that having the capacity to verify something (in this case that a quantum money state corresponds to a particular serial number) automatically provides the capacity to construct the same thing (which in this case means constructing a money state with the given serial number).

In the case of quantum money (of the sort that the paper you referred to considers), there are some important additional constraints. One is that it should actually not be difficult for the mint to produce money. The key here is that the production of money will result in a random choice of $s$; neither the mint nor a would-be counterfeiter would be capable of first choosing $s$ and then creating the corresponding money state. The requirement is actually much stronger: even given one copy of the money state corresponding to serial number $s$, a counterfeiter should not be able to produce two or more states that are likely to pass independent verifications for that serial number.

So, anyone with a quantum computer would indeed be able to produce as much money as they want, but presumably nobody would care; people would only assign value to those money states whose serial numbers are authenticated in some way by the mint.

Addendum:

Concerning issues such as the market value of money states, over-minting, and so on, the only answer I can offer is that quantum money, as a concept in quantum information science, does not address these issues -- it simply provides a protocol whereby states can be efficiently produced and verified but not copied. Individuals and governments could choose to use a quantum money protocol as they choose, and in a situation in which this is done it is up to each participant to decide what value to assign to each state. In this regard, the issues do not seem to me to be specific to quantum money, but are shared by all forms of currency.

Answer 2

How would the market determine the value of a quantum coin, potentially from different merchants or minters?

tl;dr: by trading!

---

Disclaimer: I am working on a startup that is addressing this problem

---

I curated some thoughts on blockchain in an article entitled Tokenize Everything (& the Decentralized P2P Global Market) at the end of last year. A few relevant snippets include:

Decentralization

The technological quantum leap here is not necessarily a new type of money. Rather, it is the ability to now achieve global consensus over a decentralized and distributed network without a trusted third party. This has many potential applications for various fields of endeavour.

---

A ‘decentralised funfair’ would actually be one where anyone can participate as a ‘fun provider’ (earning Funcoins for that service) and/or ‘fun beneficiary’ (giving out Funcoins to receive it), with the economics flowing directly between the two parties. The decentralised funfair would have no employees nor middlemen, only utilitarian participants; there would actually be no end to it, as long as the economic incentives on both sides remain attractive enough.

Liquidity

Because such economies are decentralised, i.e. they have no central authority taking a toll, the most liquid tokens in any economy should in theory ultimately prevail and that would constitute the best outcome for its participants.

---

Imagine there are multiple funfairs where a fun provider or a fun beneficiary can participate: inevitably they would choose the one that provides the most attractive incentives (i.e. more fun, higher rewards). So ultimately there will only be one decentralised funfair left and its “fun token”, the most liquid one that delivers the most value to its participants

Qlout

The barrier to entry to minting quantum coins does not seem that much different to verifying quantum coins.

Precisely! Given a quantum computer (network), anyone could easily access it via 'the cloud' to mint &/or trade coins. Initially, only a few devices will be able to serve as nodes in the network. However, once advancements are made & quantum devices (QPUs) are commercially available, network size will increase accordingly (& allow for individuals to self host).

Would the "oldest" quantum coin be valued more than newer coins? Or would a coin with an interesting serial number s be valued more? Or the coin used in some famous transaction?

These are all really great ideas! Clearly (as is the case in all markets) individuals would assign value to different coins in different ways (utility, collectability, etc).

The concept of Qlout is that each coin would be given a score based on an algorithm (secret sauce). This would only serve as a 'market score'; individuals would still be free to trade at any agreeable rate.