What role do Hecke operators and ideal classes perform in “Quantum Money from Modular Forms?”

Question

Cross-posted on MO

The original ideas from the 70's/80's - that begat the [BB84] quantum key distribution - concerned quantum money that is unforgeable by virtue of the no-cloning theorem. A limitation was that the quantum money required the bank to verify each transaction. Quantum money based on knots and hidden subspaces have been explored to provide a "public key" quantum distribution.

I find the knots paper, aided by Farhi's exposition, to be quite accessible.

Enter the recent paper "Quantum Money from Modular Forms," by Daniel Kane.

For me modular forms are much more intimidating than knots; my knowledge is mostly limited to an excellent series of lectures by Keith Conrad and friends. However, Kane's exposition is very good and I can see some general relation to the previous work on knots.

Nonetheless, I'm getting hung up on section 3.2 onward. I'm wondering how much of a dictionary we can have between the knots work and modular forms.

That is, I know we can say something like there are $d!\times[\frac{d!}{e}]$ grid diagrams of grid dimension $d$, and a uniform superposition of grid diagrams all with the same Alexander polynomial is an eigenstate of a Markov chain of Cromwell moves; not only that, the Markov chain can be made doubly stochastic and easy to apply, and the Alexander polynomial is efficient to calculate.

Does it even make sense to say something roughly as in "there are $\lfloor N/12\rfloor$ cusp modular forms of weight $2$ and level $N$, and a uniform superposition of modular forms all with a same number of ideal classes is an eigenstate of a Hecke operator; not only that, the Hecke operator is Hermitian and easy to apply and the number of ideal classes is efficient to calculate?"

Have I gotten off track?

Answer 1

CW from self-answer

Reviewing Farhi et al. on quantum money from knots, one can say that the Markov chain applied by the verification algorithm that walks along the Reidemeister graph is far from ergodic, as the graph includes many individual connected components corresponding to separate knots. Each bill corresponds to a uniform superposition over individual knots; however, although each bill is an eigenstate of the Markov chain, the eigenvalue $\lambda$ of each eigenstate must be $1$. Up to some technicalities, the Alexander polynomial serves to index each connected component of the Reidemeister graph.

Similarly the putative quantum money from graphs considered by Farhi et al. includes bills corresponding to eigenstates of a Markov chain of a walk along the Cayley graph of permutations of adjacency matrices, with the graph spectrum of the adjacency matrix serving to index the eigenstate; nonetheless the eigenvalue $\lambda$ of each eigenstate is also $1$.

Turning now to quantum money from modular forms considered by Kane, the Hecke operators used therein are all commuting, and although they share an eigenbasis (because they commute), individual Hecke operators and individual bills must have different eigenvalues; indeed for security purposes Kane requires a sufficient separation of eigenvalues of the Hecke operators. These eigenvalues of the Hecke operators are what serve to index the quantum money (as opposed to the knot invariants/graph invariants considered above).

Kane constructs a Hermitian matrix based on the number of ideal classes to correspond to the Hecke operators; this Hermitian matrix is easy enough to work with so that he can perform Hamiltonian simulation thereon (to create his commuting unitary operators), and he applies quantum phase estimation with his operators $U_p$ and samples therefrom to determine the specific eigenvalues $\lambda_1,\lambda_2,\cdots$ for the different Hecke operators/various primes $p$.

(I still only have a limited/next-to-nil understanding of modular forms/Hecke operators, and only rarely have a fleeting sense of their beauty!)