Cryptanalysis of Three Quantum Money Schemes

Abstract

We investigate the security assumptions behind three public-key quantum money schemes. Aaronson and Christiano proposed a scheme based on hidden subspaces of the vector space F n 2 in 2012. It was conjectured by Pena et al in 2015 that the hard problem underlying the scheme can be solved in quasi-polynomial time. We confirm this conjecture by giving a polynomial time quantum algorithm for the underlying problem. Our algorithm is based on computing the Zariski tangent space of a random point in the hidden subspace. Zhandry proposed a scheme based on multivariate hash functions in 2017. We give a polynomial time quantum algorithm for cloning a money state with high probability. Our algorithm uses the verification circuit of the scheme to produce a banknote from a given serial number. Kane proposed a scheme based on modular forms in 2018. The underlying hard problem in Kane's scheme is cloning a quantum state that represents an eigenvector of a set of Hecke operators. We give a polynomial time quantum reduction from this hard problem to a linear algebra problem. The latter problem is much easier to understand, and we hope that our reduction opens new avenues to future cryptanalyses of this scheme.

On the (Im)plausibility of Public-Key Quantum Money from Collision-Resistant Hash Functions

“…• In the first category, we have constructions borrowing sophisticated tools from different areas of mathematics, such as knot theory [FGH+12], quaternion algebras [KSS21] and lattices [Zha21;KLS22]. The constructions in this category have been susceptible to cryptanalytic attacks as demonstrated by a couple of recent works [Rob21;BDG22]. We are still in the nascent stages of understanding the security of these candidates.…”