We propose definitions and implementations of "S-money" -virtual tokens designed for high value fast transactions on networks with relativistic or other trusted signalling constraints, defined by inputs that in general are made at many network points, some or all of which may be space-like separated. We argue that one significant way of characterising types of money in space-time is via the "summoning" tasks they can solve: that is, how flexibly the money can be propagated to a desired space-time point in response to relevant information received at various space-time points. We show that S-money is more flexible than standard quantum or classical money in the sense that it can solve deterministic summoning tasks that they cannot. It requires the issuer and user to have networks of agents with classical data storage and communication, but no long term quantum state storage, and is feasible with current technology. User privacy can be incorporated by secure bit commitment and zero knowledge proof protocols. The level of privacy feasible in given scenarios depends on efficiency and composable security questions that remain to be systematically addressed.
NETWORKS AND AGENTSWe are interested in token schemes that allow some form of access -for example to goods, services, data, physical objects or environments. Depending on the context, such tokens might for example play the role of money, passwords, keys or passcards. They may be used by parties with many possible relationships. The parties may be individuals or may be networks of collaborating agents who trust one another.For illustration, we suppose that the scheme involves money issued by one agency, B (Bob, the Bank, or issuer) to another A (Alice, the Acquirer, or user). We suppose that A and B have pre-equipped themselves to carry out communications and transactions at a pre-agreed finite set of space-time points defining a network.A network point P here represents a small pre-agreed local space-time region around the point P , which can contain separate secure sites for user and issuer agents, and authenticated classical and/or quantum channels between these sites. All communications associated with a given network point must take place within the associated space-time region. Typically, when there is a natural fixed frame choice to describe the network, we assume that the spatial diameter of these regions is significantly smaller than the spatial separation between any pair of network points.Unless otherwise stated, we assume below that the only signalling constraint is the impossibility of superluminal communication, and that both A and B can send secure classical signals (for instance using one-time pads maintained by quantum key distribution) from any network point to any other network point within its future light cone.As usual in relativistic cryptography [9], we assume that each agency may be represented by a set of agents who are completely trusted and whose actions are coordinated, so that they can be identified as effectively a single party. The par...