CTRL/SHIFT - 13 06 2026 CHAPEL STAGE - FABRIZIO ROMANO GENOVESE - PUBLIC KEY QUANTUM MONEY

Okay. Yep. So, uh we heard a lot about, uh you know, quantum threats and quantum panic. Let's say, my talk is a bit different because, uh what I'm doing [clears throat] is quantum optimism. So, a lot of people told you that quantum is a threat to cryptography.

They are completely right. Uh but, the kind of question that, uh we asked was, "Okay, quantum computers are bad, but what do they bring to the table? What is that they give you that you cannot do classically?" So, this is a presentation of the work that me and Lex Sandler, um one of my colleagues, uh did. And, what we are doing in particular is called quantum money.

So, what is quantum money? Quantum money is currency that is impossible to counterfeit because of physical properties. This is not a new idea. Uh this was proposed in the '70s by Wiesner in the beginning. Uh and it's been iterated a lot.

So, the cool thing about quantum money is that it is really the end game of blockchain. Uh it it really works like cash, but it can be remotely exchanged. So, you know, with Bitcoin, with Ethereum, uh you are not fully peer-to-peer because you have a network of validators or miners you have to rely upon. You have consensus protocols that require fees to be run and economic incentives. With quantum money, you don't have any of that.

It really works like cash. Um So, what are the desiderata the desiderata for quantum money? Uh you want uh these quantum bills to be exchangeable remotely. Uh you want them to require low computational resources. By the way, quantum money, as the name suggests, is impossible to realize classically.

So, you need quantum resources. They are expensive. You want to minimize them as much as possible. You want these money to be verifiable. If I give you a quantum bill, you should be able to test that it's authentic.

Otherwise, there's no purpose. Um and at the moment very few proposed schemes uh satisfy all of these desiderata. So, what we built is a quantum money protocol where everyone can verify that a bank note is authentic. And they only need very minimal quantum hardware, basically QKD hardware, which is the only form of quantum hardware which is widely commercialized and available today. You don't need quantum computers to do this.

Uh again, it is publicly verifiable. Basically, if I give you a bank note, you can verify that it is minted by a central bank or whoever is that mints the coins. It's forgery-proof. Uh it's basically cryptographically unfeasible to forge this currency. And runs on practical practical hardware, at least for quantum standards today.

So, how does this work? Well, the main idea here is using quantum information. So, uh quantum behaves fundamentally differently from classical data. If I tell you something like I ate an apple today, you can reuse this information as much as you want. You can copy at will this information.

You can tell all your friends about this. If I give you an apple instead, you can operate on it. You can eat it. You can throw it in the bin. But, you cannot duplicate it.

So, the difference is that an apple is not data. It's a resource. And the cool thing about quantum information is that it behaves exactly like an apple. We have something called the no-cloning theorem that basically tells you that quantum states cannot be cloned, cannot be copied at will. Uh so, the idea Wizner in the '70s was, "Okay, I have this thing, you know what?

If I manage to put monetary value in quantum states, I can rely on the no cloning theorem to make sure that these banknotes are not counterfeitable, not duplicable. Okay. So, the way we do this is by using and building one-time memories. So, what is a one-time memory? Basically, you have to imagine it as a black box where you have two pieces of information and you can decide to read only one of them.

So, you say, "I want information A or I want information B." But, as soon as you decide which one to read, the other piece of information is completely destroyed. These primitives are impossible to build classically and by the way, are also impossible to build in the fully ideal quantum computing case, but there are some caveats to make it work on the quantum technologies we have today, which are not perfectly noise tolerant. So, the way it works is like this. I have some quantum states in the one-time memory.

And basically, using the insights of Wiesner, each one of these quantum states is encoded in a way so that if I want to read the first string in the memory, I have to measure all of them in the same measurement basis, which is the kind of like measurement thing that I have to choose when I operate on qubits. Now, the insight is that basically, I didn't I don't tell to the user in which way I encoded these classical strings in the quantum states. So, you don't know. But, basically, if you measure in one basis, you erase the information that was encoded in the other basis. So, the idea is I don't tell you anything.

You just So, you you know, some of these will be encoded in basis X, some of them in basis Y. You don't know which is which. So, basically, if you want to extract uh the string you want to read, you are forced to measure all of them in the same basis, and you can prove mathematically that is the only thing you can do. If you try to be smart about it, you destroy basically all the information completely. And then we have a piece of classical uh cryptography called conjunction of friskation.

The way this works is Suppose that I want to read the first string in the one-time memory. I measure everything in the X basis, for instance, in in in those quantum states. What happens is that I will obtain what I want to read plus some noise, which are where the things measured in you know, encoded in the other basis that get destroyed permanently when I measure in the wrong thing. The pieces of classical cryptography back there clean up the noise and give me the final string. So, this is the one-time memory.

And the way I use this is like this. [clears throat] I have a party that means the bill, for instance, um a a central bank. So, what the central bank does is First of all, you draw n pairs, where n is a parameter, of random data. So, you have n couples of thing. Now, you put each one of these couples into a one-time memory.

So, again, uh each one of those one-time memory contains a pair, but you can only read one of the two things of the of the of the two strings in the OTM. Uh the bank also hashes uh each string, and those are the hashes up there. Um and signs the hashes. So, you can verify that this was minted by uh a reputable source. Back there, you have the secrets.

So, these are the thing that basically the the the pairs that the bank draws, which stay private. So, basically, I have this quantum bill now, and if I want to give it to someone, the way I do it is I copy all the classical information. So, for instance, all the hashes up there, those are classical strings. I can make a copy and give them to you together with uh the signatures. The OTMs, they contain that quantum part.

And that quantum part, I can give it to you via quantum teleportation. Uh which again, you know, I cannot duplicate this thing because of the no-cloning theorem. So, either I give them to you or I don't, or I make them up and I give you quantum data. So, the verification procedure is the one that now allows you, the receiver of this bill, to verify that I gave you real quantum things, the thing that, you know, the bank created, and not um quantum data. So, how does the verification work?

It works like this. To spend a coin, I send you everything, as I said, and to verify that it's good, I pick randomly one of these one-time memories, and I decide to decide to randomly read one of the two strings in the one-time memory. I hash the string, and I verify that the hash matches the hashes that were provided by the bank. Again, remember that when I read one of these things, I lose the other one, because that's what the one-time memory does. So, what happens now is suppose that I read one of these, and I I want to, you know, I give you this banknote, and I want to fake that I didn't verify anything, or I want to double spend it, basically.

What happens is imagine it like this. If I open that memory, I know X now. So, I can re-prepare the quantum state that I encoded X. That's no problem. I can do it.

But, I lost Y permanently. So, if I want to double-spend this coin now, I have to make up Y. But then, you know, if I just draw Y at random, there is a certain probability that the verifying party will pick exactly the same OTM and decide to read Y, and will get something that doesn't match the hash up there. And so, you can say, "Okay, something is fishy here." And the point is, every time you you receive some of these banknotes, you can see which memories were open.

Uh and you can decide to measure how many you want of the memories that are left and verify that, you know, uh the banknote is authentic. Again, you can prove that with overwhelming probability, if something is making these OTMs up, the hashes won't match. So, what are the limitations of this scheme at the moment? Well, the main limitation is that you can verify these bills a finite number of times, because every time I verify, I open some of these one-time memories, and the quantum information, you know, gets read, becomes classical, and eventually, when I open all of them, there is no quantum information anymore to, you know, to ensure to to allow you to verify. So, you can verify a limited number of time.

In a way, this is similar to happens with real banknotes. Like, with a real banknote, you can use it, you can give it to people, and it wears down. At some point, you know, the banknote needs to be exchanged with a bank and returned, and they give you a fresh one. In a way, this is similar to what happens here. Again, this only works in the NISQ regime, which is the current regime of quantum computation.

No expert believes, you know, that the fully fault-tolerant regime will come tomorrow. So, this is basically usable probably for a decade if not more. Uh and another problem is that money here cannot be aggregated. So, if I give you two 5 euro quantum bills, I would be able to I would like to be able to aggregate them into a 10 euro quantum bill. This is not possible at the moment, so we need to work on that.

So, uh yes, open directions as you see, uh we want to, you know, increase the verification budget without increasing the size of the bill. We want to allow for noisy quantum communication because at this at the moment this protocol supposes that your quantum communication is perfect, but that is not what happens in practice. Uh quantum channels today are quite noisy, so we need to work on that. And uh we want to, you know, partner with universities or research institutions to implement these on a testbed on a quantum testbed in a lab and test it practically. So, again, why this matters, the bigger picture is that the blockchain is becoming increasingly centralized.

You know, if you follow the space, you know, the like Bitcoin network for instance uh is owned by basically a very few validator niches. It's the same with Ethereum. A lot of like validators are, you know, it was Lido once. Now I don't know who he is, but basically there is there are centralization issues. Uh there is a problem with state national state actors that try to eject these coins.

So, we want a really genuine private peer-to-peer secure form of digital currency. Uh and yeah, this is basically what this changes in practice. It would give the possibility to banks or whoever to emit this kind of tokens using commonly available quantum hardware. Again, people that need to use this, they can just use QKD hardware and they don't need fully flagged quantum computers. And yeah, they would basically use this thing as they use digital cash.

So yeah, that is that is it and I'm open for questions.

So you mentioned that before when a bank issues a quantum bill, the quantum bill will stay for a couple of seconds, something like that. How do you make that possible because I know that first of all quantum mechanics requires very low temperatures. So how do you make How do you make that happen?

So this is a very good question. At the moment indeed one of the bottlenecks that we have are quantum memories. Um basically the temperature thing depends on the mean you use to encode quantum information. So for a QKD equipment, you mainly exchange photons which do not require, you know, low temperatures but are very hard to store. So then what you need to do is convert that quantum information into like neutral atoms or something and store it.

Uh and yeah, you need cryogenic temperatures but the way we are actually using this at the moment is mainly for uh super high frequency uh high time frequency applications. So for instance, you can use the same idea to encode uh one shot multi-party computation algorithms and the idea there is that you just reduce the latency between parties and you do not need a quantum memory at all. You measure the stuff as soon as you receive it basically. And what that gives you is the possibility of um lowering the rounds of interaction between parties into, you know, um an MPC protocol. But you are totally right, for fully flagged quantum money, yeah, you need, you know, uh memories that are much better.

Uh luckily, you know, some of these technologies are progressing at three three orders of magnitude in time duration per per year, which is very good. So, you know, we'll we'll see where it get where we get from.

Yeah. And and also when when let's say you send a quantum bit to me, I I need to have a sort of device for let's say measuring the superposition. So, what what sort of device is this? And

So, if you use QKD equipment, it is just like you choose a polarization basis and you measure. And the idea is I encode the Z and the X basis into two different polarizations like vertical and horizontal. And basically if you measure in the wrong one, you get noise and you get a random bit. If you measure in the right one, you get the

Yeah, and and do they cost a lot these devices or

For retail, yes. Like we are probably around 60-70k, but again, it is nothing comparable to like the 50 million dollars you need for a quantum computer. So,

we expect these things to become way less expensive. So,

Otherwise, I cannot be used. Otherwise, I cannot be used.

you know, this is a kind of like moonshot kind of thing. Obviously, we are betting that this technology will become more available and cheaper in the future. But yes, absolutely valid concerns.

Thank you.

Cheers. Anyone else? No? Then let's have lunch. Thank you very much, guys.

[applause]