# Do we have to trust the bank in “Quantum Money from Hidden Subspaces?”

What level of trust in the bank is needed in "Quantum Money from Hidden Subspaces" of Aaronson and Christiano?

The bank's mint works by first generating a uniformly random classical secret string $r$, and then generating a banknote $\$_r=(S_r,\rho_r)$. The authors state that the bank can generate many identical banknotes by simply reusing the secret$r$. • But after the currency is distributed, is$r$needed, either by the bank or by the users, ever again? If so, does the bank need to keep it safe and secure? If not, should the bank "forget" or destroy the secret$r$used in the mini-scheme, lest it fall into a forger's hand? • Can the mint use$r$to produce many coins with a specific serial number$S_r$, potentially targeting a specific holder of currency for devaluation? • Can the users of the currency know how many coins are actively in circulation, without having to trust the mint? The authors of Hidden Subspaces note that in "Quantum Money from Knots" of Farhi, Gosset, Hassidim, Lutomirski, and Shor, not even the mint is likely able to generate two identical banknotes. But I think that the inability of banks to copy their own currency is a feature, not a bug, of "Quantum Money from Knots", because the actions of the mint are public and known. The total amount of currency is known; no secret$r$is needed to be kept safe or destroyed; the mint can "destroy" a coin by removing it from the public list of serial numbers (Alexander polynomials,) but cannot target a coin for devaluation by minting many copies. • Aside: Have you seen this question I asked about time entangled quantum blockchains? – meowzz Jul 13 '18 at 3:56 • @meowzz, yes thanks - this is helpful. Is your question more along the engineering challenges vs. the theoretical challenges? Also, the "Quantum Bitcoin" paper of Jorgenson does a good job of summarizing the state of the art, but I think I would disagree that FGHLS requires a "centralized" bank. Any mint in FGHLS can publish, in the open, the list of serial numbers. Such a mint cannot overproduce without having to update the list of serial numbers. But because, as far as I can tell, the mint in Aaronson and Chistiano "hides" the secret$r\$... – Mark S Jul 13 '18 at 12:01
• as such, we need to trust this mint? (I'll be honest, I understand FGHLS better than Aaronson and Christiano at the moment.) – Mark S Jul 13 '18 at 12:03
• While this is somewhat orthogonal to the question, the Aaronson-Christiano quantum money protocol has been broken. And Daniel Kane has a new quantum money protocol based on modular forms. – Peter Shor Nov 11 at 0:49