Adrian Kent

Unforgeable quantum money tokens were the rst invention of quantum information science, but remain technologically challenging as they require quantum memories and/or long distance quantum communication. More recently, virtual "S-money" tokens were introduced. These are generated by quantum cryptography, do not require quantum memories or long distance quantum communication, and yet in principle guarantee many of the security advantages of quantum money. Here, we describe implementations of S-money schemes with o -the-shelf quantum key distribution technology, and analyse security in the presence of noise, losses, and experimental imperfection. Our schemes satisfy near instant validation without cross-checking. We show that, given standard assumptions in mistrustful quantum cryptographic implementations, unforgeability and user privacy could be guaranteed with attainable re nements of our off-the-shelf setup. We discuss the possibilities for unconditionally secure (assumption-free) implementations.

Quantum money is the first invention in quantum information science, promising advantages over classical money by simultaneously achieving unforgeability, user privacy, and instant validation. However, standard quantum money relies on quantum memories and long-distance quantum communication, which are technologically extremely challenging. Quantum "S-money" tokens eliminate these technological requirements while preserving unforgeability, user privacy, and instant validation. Here, we report the first full experimental demonstration of quantum S-tokens, proven secure despite errors, losses and experimental imperfections. The heralded single-photon source with a high system efficiency of 88.24% protects against arbitrary multi-photon attacks arising from losses in the quantum token generation. Following short-range quantum communication, the token is stored, transacted, and verified using classical bits. We demonstrate a transaction time advantage over intra-city 2.77 km and inter-city 60.54 km optical fibre networks, compared with optimal classical cross-checking schemes. Our implementation demonstrates the practicality of quantum S-tokens for applications requiring high security, privacy and minimal transaction times, like financial trading and network control. It is also the first demonstration of a quantitative quantum time advantage in relativistic cryptography, showing the enhanced cryptographic power of simultaneously considering quantum and relativistic physics.

Mistrustful cryptography includes important tasks like bit commitment, oblivious transfer, coin flipping, secure computations, position authentication, digital signatures and secure unforgeable tokens. Practical quantum implementations presently use photonic setups. In many such implementations, Alice sends photon pulses encoding quantum states and Bob chooses measurements on these states. In practice, Bob generally uses single photon threshold detectors, which cannot distinguish the number of photons in detected pulses. Also, losses and other imperfections require Bob to report the detected pulses. Thus, malicious Alice can send and track multi-photon pulses and thereby gain information about Bob's measurement choices, violating the protocols' security. Here, we provide a theoretical framework for analysing such multi-photon attacks, and present known and new attacks. We illustrate the power of these attacks with an experiment, and study their application to earlier experimental demonstrations of mistrustful quantum cryptography. We analyse countermeasures based on selective reporting and prove them inadequate. We also discuss side-channel attacks where Alice controls further degrees of freedom or sends other physical systems.