{"id":"9704760f-6ec5-42b7-8182-03f8b6ebec5e","arxiv_id":"1908.08143","paper_version":2,"verdict":"CONDITIONAL","confidence":"MODERATE","novelty_score":5.0,"correctness_risk":"medium","formal_verification":"none","parameter_count":0,"one_line_summary":"A two-stage S-money scheme lets users precommit a random string and later choose the token's presentation point with a classical one-time-padded message, improving flexibility and transferability.","lead":"This paper refines S-money, a type of virtual token for networks with relativistic trust constraints, so the final choice of where a token can be spent can be made late and over classical messages only. The refinement also lets tokens be transferred between users while keeping the holder's spending location private from the issuer.","discovery_kind":"extension","skeptic_critique":{"model":"deepseek-v4-flash","headline":"Unforgeability proof assumes a unique m; multi-m double-spend attack is not excluded, so the reduction to binding fails.","rationale":"The reader correctly identifies the reliance on external BB84 security analyses and flags the transfer double-spend in the rationale. My stress-test found a more fundamental gap in the unforgeability reduction that precedes transfer. Section II.D.1's proof implicitly assumes a single m is associated with the token at all presentation points. The protocol of Section II.C does not state or prove that a user cannot cause two different m values to be accepted. Since a user can choose x and send m1 = x xor i1 and m2 = x xor i2 at two decision points in the common causal past of all Qi, the same unveiling y is valid at both Qi1 and Qi2, and binding is not violated because the same x is unveiled. Thus the reduction to binding is incomplete. This is not a disagreement with the cited binding/hiding analyses; it is an omitted protocol rule and proof step. It also explains the transfer double-spend: a signed transfer message is just classical data and can be duplicated to different bank agents before synchronization. Because the fix (requiring bank agents to reject any token for which multiple m's or multiple transfers are received, and proving this with the spacetime constraints) is straightforward and does not undermine the basic idea, I do not change the reader's conditional verdict, but the condition should explicitly include this rule and proof.","tokens_in":9934,"tokens_out":20675,"duration_ms":211764,"concrete_test":"Formalize or simulate the Section II.C protocol with a dishonest user who (i) precommits to x, (ii) at two spacelike-separated decision points PD1, PD2 in the intersection of causal pasts of all Qi sends m1 = x xor i1 and m2 = x xor i2 to two bank local agents, and (iii) presents the same measurement outcome y at Qi1 and Qi2. Determine whether the stated validation rule accepts both presentations. If yes, single-user unforgeability fails as written; if the intended protocol requires bank agents to reject tokens for which more than one m is ever received, that rule is missing and should be added and included in the proof before the binding reduction can be applied.","verdict_should_be":"UNCHANGED","load_bearing_attack":"Section II.D.1 reduces unforgeability to binding by assuming that a double-spending user must unveil two different bit strings x1 and x2. This is only true if the same classical message m is associated with the token at every presentation point. The protocol as specified in Section II.C does not enforce or prove this. A malicious user can pick her committed string x at the initial stage, choose two presentation labels i1 != i2, and at two decision points PD1, PD2 in the common causal past send m1 = x xor i1 to one bank local agent and m2 = x xor i2 to another. Since both PD1 and PD2 lie in the causal past of every Qi, both messages reach the bank agents at Qi1 and Qi2. At Qi1 the bank verifies that y is plausible for M_{m1 xor i1}=M_x; at Qi2 it verifies y for M_{m2 xor i2}=M_x. The same token data y is accepted at both points, and the binding property is not violated because the user never unveils a second string x'. The proof in Section II.D.1 therefore does not go through; it silently assumes a single-m ownership rule that is not stated or proven. The same lacuna is what makes the Section III transfer protocol vulnerable to a malicious holder signing the same token to multiple users at spacelike-separated transfer points before bank agents can synchronize.","agreement_with_reader":"partial"},"referee_report":{"model":"deepseek-v4-flash","summary":"The paper refines the S-money scheme of Kent so that the computationally heavy or quantum part of token preparation can be done far in advance, while the later choice of presentation point is made by purely classical communication. The user first engages in a bit-string coordination protocol that commits her to a long secret string x. Later, to acquire a token, she classically agrees with the bank on a set S of valid presentation points and on which segment of x is attached to the token. To decide the actual presentation point Q_b, she sends m = x XOR b from a decision point in the causal past of all Qi, and at Q_b she unveils x. The paper claims that unforgeability follows from the binding property of the bit-string coordination protocol and that future privacy follows from its hiding property, and it extends the scheme to transfer between users and to multi-step decisions. The paper is clearly written and the figures are helpful, but the central security claim is not established as stated.","tokens_in":10128,"tokens_out":13424,"duration_ms":145854,"significance":"If the scheme worked as claimed, it would be a practically valuable refinement: the quantum communication and measurement phase could be moved well before the time-critical decision, and the decision phase would require only classical communications. The reduction of future privacy to the hiding property of the underlying bit-string coordination protocol is sound and is a strength of the paper. However, the unforgeability proof has a genuine gap: it silently assumes that a single classical message m is attached to each token, whereas the protocol as specified does not enforce this. As a result, the claimed unforgeability does not follow from binding, and the transfer protocol inherits the problem. The paper also relies partly on an unpublished reference for a security-critical property. The core idea is plausible and the flaw is likely repairable, but the present manuscript does not establish its main claim.","major_comments":[{"comment":"The reduction of unforgeability to binding assumes that a user presenting at two different points Qi1 and Qi2 must open two different strings x1 and x2. This assumption is false as the protocol is specified in Section II.C. A dishonest user can choose two distinct labels i1 and i2, send m1 = x XOR i1 at one decision point and m2 = x XOR i2 at another decision point in the common causal past of all Qi, and later present the same token data y at both Qi1 and Qi2. At Qi1 the bank verifies y against M_{m1 XOR i1} = M_x, and at Qi2 it verifies y against M_{m2 XOR i2} = M_x; both checks pass. The user never unveils a second string x', so the binding property is not violated. The sentence 'Since i1 ≠ i2, x1 ≠ x2' is valid only if m is unique, and the protocol neither enforces nor proves uniqueness of m. The manuscript also does not specify how a bank agent at Qi should behave if it receives two different values of m for the same token. Thus the claimed unforgeability does not follow from binding, and the scheme as written permits double-spending with a single committed string.","section":"Section II.D.1"},{"comment":"The transfer protocol does not analyze double-transfer by a malicious holder. A dishonest first user A1 can issue authenticated signed transfer messages to two different users A2 and A3 at two transfer points, possibly spacelike separated, and both A2 and A3 can register the same token with bank agents using their own precommitted strings x2 and x3. Each can then present the token at a different Qi. The paper gives no mechanism, such as a unique-ownership rule, an ordering of transfer registrations, or cancellation of earlier transfer messages, that would prevent this. The unforgeability argument of Section II.D.1 does not cover this case because it assumes a single token owner and a single decision message. This is a load-bearing gap for the advertised transferability: without an explicit uniqueness mechanism, a malicious holder can duplicate the token.","section":"Section III"},{"comment":"The multi-step decision protocol inherits the same flaw. Each decision step sends a classical message derived from the same secret string x, but nothing prevents an adversary from making two inconsistent decision paths using the same x, leading to two valid presentation points. For example, the user could at D1 send one message restricting the presentation point to one subset, and at a later or spacelike-separated point send another message that is inconsistent with the first, while still unveiling the same x at the final presentation point. The paper does not specify how the bank's agents reconcile multiple, inconsistent decision messages, so the claimed guarantee that 'there can be no more than one valid presentation point' is not established by the arguments given.","section":"Section IV"}],"minor_comments":[{"comment":"Reference [16] is cited as 'in preparation' yet is used as part of the security foundation for the bit-string coordination protocol; the text should cite a published version or should not rely on an unpublished manuscript for a load-bearing security property.","section":"References"},{"comment":"There is a typo in the sentence 'This technique was used also used in practical protocols'; it should read 'was also used'.","section":"Section II.A"},{"comment":"References [7] and [8] both list the same patent application number WO2017001850A1; this appears to be an error and should be corrected.","section":"References [7] and [8]"},{"comment":"The notation PA for the token-acquisition point and P for the initial start point is easy to confuse; consider using more distinct symbols.","section":"Section II.C"}],"recommendation":"major_revision","confidential_remarks":"The main technical flaw identified in the report is genuine and load-bearing: the unforgeability proof assumes a unique classical message m per token, which the protocol does not enforce. This is not a disagreement with the broader S-money consensus; it is an internal gap in the reduction. I believe the flaw is repairable by adding an explicit uniqueness or consistency rule for decision messages and ownership transfer, but the current manuscript does not contain such a rule, and the central claim of unforgeability is therefore not established. I recommend major revision rather than rejection because the underlying approach is promising and the fix appears to be within the scope of a revised paper."},"author_rebuttal":null,"desk_editor":{"model":"deepseek-v4-flash","letter":"Worth a look if you care about relativistic quantum tokens, but the main proof has a hole. The two-stage trick — register a random x via quantum exchange, then choose the presentation point by sending m = x XOR b classically — is genuinely useful and makes S-money much more practical. The paper also correctly identifies the trade-off in previous schemes (fixed presentation vs. fresh quantum exchange) and the transfer idea is natural.\n\nThe bad news: the unforgeability proof in Section II.D.1 only covers the case where the same m is used at every presentation point. Nothing in the protocol forces that. A malicious user can send m1 to one bank agent and m2 to another, from two different decision points in the common causal past of the Qi's. At Qi1 the bank checks y against M_{m1 XOR i1} = M_x; at Qi2 it checks M_{m2 XOR i2} = M_x. Same y passes both, and the binding property is never violated because x never changes. So the reduction to binding fails, and the transfer section inherits the same problem — a malicious holder can sign the same token to multiple users before the bank syncs.\n\nThis is load-bearing, not a typo. The scheme may be repairable (e.g., commit to m as well, or require a single signed decision point), but the current text doesn't have that. The paper also relies on an unpublished ref [16] for some of the underlying coordination analysis, though the core BB84 results are in published papers.\n\nCredit where due: the exposition is clear, the delayed-decision generalization in Section IV is a nice extension, and the underlying idea of precommitted secrets plus classical masking is worth exploring. The gap is specific and fixable.\n\nWho should read it: anyone working on quantum money or position-based cryptography. It deserves referee time — the idea is solid enough that the proof should be repaired, not the paper rejected outright. But I wouldn't cite it as-is, and I'd want the multi-m attack addressed before recommending acceptance.","headline":"Clever two-stage S-money construction, but the unforgeability proof misses a multi-m double-spend attack; needs repair before it can be cited.","tokens_in":10697,"tokens_out":4617,"would_cite":false,"duration_ms":44380,"reading_group":"maybe","serious_thinker":"yes","would_accept_peer_review":true},"rs_alignment":null,"lean_confirmation":null,"pith_extraction":{"msc":["81P94","94A60"],"pacs":["03.67.Dd","03.67.Hk"],"model":"deepseek-v4-flash","headline":"This paper refines S-money so a user can choose the token's presentation point anywhere in the causal past of all valid presentation points using only classical communication at decision time, and can transfer tokens between users without…","keywords":["quantum money","S-money","quantum tokens","bit-string coordination","BB84 bit commitment","unforgeability","future privacy","token transfer"],"falsifier":"An explicit cheating strategy in which a no-memory user, after receiving $m = x \\oplus b$, produces valid unveiling data for two different presentation points would refute unforgeability; an explicit strategy in which the issuer infers any bit of $x$ before unveiling would refute future privacy. The paper's own security reduction implies that neither is possible if the underlying BB84 bit-string coordination is binding and hiding, so either strategy is a decisive falsifier.","tokens_in":9691,"feed_emoji":"🎫","tokens_out":10255,"duration_ms":99499,"temperature":0.7,"pith_summary":"This paper claims that S-money virtual tokens can be made far more flexible: the user can postpone the choice of where the token is valid until almost the last moment, using only classical messages at the decision point, and can hand the token to other users who then make their own choice. The trick is a two-stage structure: in an early quantum stage the user measures the four BB84 qubit states and thereby commits to a secret random string; later, a classical message $m = x \\oplus b$ commits the chosen presentation point $b$ without revealing it. The issuer learns $b$ only when the user finally unveils $x$ at presentation, and the binding property of the commitment prevents the user from opening two different strings and thereby forging two tokens. A sympathetic reader would take the paper's contribution to be showing that all of the original S-money security guarantees reduce cleanly to the binding and hiding of the underlying bit-string coordination protocol.","feed_headline":"S-money tokens gain last-moment choice and simple transfer","feed_subtitle":"An early quantum step hides a key; the final choice of where to present the token needs only a classical message.","key_machinery":"The mechanism is the bit-string coordination protocol built from a BB84 bit commitment: the issuer sends a tensor product of the four Bennett-Brassard qubit states, each in one of two conjugate bases, and the user's choice of measurement basis on each qubit commits the corresponding bit. The flexible scheme's key move is to use a secret random string $x$ and the classical message $m = x \\oplus b$: the choice of presentation point $b$ is encrypted by a one-time pad whose key the user has already committed to. That object carries the argument because it simultaneously enforces the two required properties: binding makes double spending logically impossible, and hiding keeps $b$ concealed until the final unveiling, with no quantum communication needed at the decision point.","core_discovery":"The paper's central claim is that a two-stage S-money scheme can decouple the expensive, quantum part of token creation from the time-critical choice of presentation point. In the first stage, well before any token is needed, the issuer sends BB84 states and the user applies a measurement $M_x$ labelled by her own random string $x$, producing outcomes $y$; this effectively commits her to $x$. In the second stage, at any point in the causal past of all valid presentation points, she chooses $b$ and sends only $m = x \\oplus b$. At $Q_b$ she unveils the commitment to $x$, and the issuer accepts the token if $y$ is a plausible outcome of measurement $M_{m \\oplus b}$ and the commitment checks out. The paper argues that the user cannot present valid tokens at two distinct points unless she can open two different $x$ values, and the issuer cannot learn $b$ in advance unless he can learn $x$ before unveiling; hence unforgeability and future privacy inherit directly from the binding and hiding properties of bit-string coordination. It then describes how, using authenticated signed transfer messages, the token can be passed from user to user, with each new user using their own precommitted secret string, while the same security arguments apply.","pith_inferences":["Editorial extension: the late-commitment trick $m = x \\oplus b$ is a general way to separate 'choose later' from 'commit now', and could in principle be reused in other spacetime-constrained protocols such as position-based tasks or timed commitments, not just token presentation.","Editorial extension: with transfer via signed classical messages, the token behaves like a bearer instrument in a relativistic network; practical deployment would still need the credential, authentication, and secure-site infrastructure the paper assumes.","Editorial extension: the paper's security statements are unconditional only at the ideal, error-free level; a practical implementation with imperfect channels would need quantitative parameter estimates, and the clean reduction would then carry over only to whatever error-tolerant commitment is used.","Editorial extension: since the second stage and presentation touch only classical communications, the decision and transfer steps could be tested on existing photonic hardware without waiting for long-lived quantum memories."],"forward_implications":["The user can decide the valid presentation point at any spacetime point in the intersection of the causal pasts of all valid presentation points, with only classical communication needed after the initial quantum phase.","Tokens can be transferred between users classically and quickly; each recipient can then choose a new valid presentation point and keeps her own presentation choice private from the issuer.","The choice of presentation point can be made through a sequence of decisions at different spacetime points, each narrowing the set of possible presentation points, while still guaranteeing at most one valid presentation.","Unforgeability and future privacy for every user follow directly if the underlying bit-string coordination protocol is binding and hiding, so any improvement or weakening of that primitive changes the whole scheme.","Because the quantum part can be done long in advance, S-money becomes usable in time-critical relativistic settings where token acquisition and presentation decisions are separated by only classical communication."],"supporting_citations":[{"why":"Defines the original S-money scheme and the bit-string coordination task whose binding and hiding properties the refined scheme inherits.","marker":"[1]"},{"why":"Supplies the earlier single-round token implementation, including the measurement $M_b$ and presentation mechanics that the refined two-stage scheme modifies.","marker":"[7]"},{"why":"Supplies the BB84 bit commitment protocol and the security analyses that establish the binding and hiding properties on which the paper's reductions explicitly rely.","marker":"[10-13]"},{"why":"Describes the practical no-quantum-memory variant of bit-string coordination whose security is cited alongside [10-13] in the paper's security argument.","marker":"[16]"}],"fun_headline_variants":["S-money: flexible presentation point, no quantum at reveal","Two-stage S-money: quantum prep, classical last-moment reveal","S-money tokens: transferable, presentation choice decoupled","Quantum token prep, classical presentation: S-money refined","S-money upgrade: choose reveal point, transfer securely"],"cache_read_input_tokens":3200,"weakest_assumption_plain":"The load-bearing premise is that the BB84-based bit-string coordination protocol really is binding and hiding in the specific multi-user, transfer scenario; the paper imports this from prior security analyses instead of proving it, so any failure there would leave the refined scheme without the guarantees claimed here.","fun_headline_variants_meta":{"raw":{"variants":["S-money: flexible presentation point, no quantum at reveal","Two-stage S-money: quantum prep, classical last-moment reveal","S-money tokens: transferable, presentation choice decoupled","Quantum token prep, classical presentation: S-money refined","S-money upgrade: choose reveal point, transfer securely"]},"model":"deepseek-v4-flash","effort":"low","cost_usd":0.000226,"raw_usage":{"total_tokens":1453,"prompt_tokens":914,"completion_tokens":539,"prompt_tokens_details":{"cached_tokens":384},"prompt_cache_hit_tokens":384,"prompt_cache_miss_tokens":530,"completion_tokens_details":{"reasoning_tokens":458}},"tokens_in":530,"tokens_out":539,"duration_ms":5852,"temperature":1.0,"reasoning_tokens":458,"cache_read_input_tokens":384,"cache_creation_input_tokens":0},"cache_creation_input_tokens":0},"created_at":"2026-08-14T11:49:19.236635+00:00","model_set":{"reader":"deepseek-v4-flash"},"falsifier":"An explicit cheating strategy in which a no-memory user, after receiving $m = x \\oplus b$, produces valid unveiling data for two different presentation points would refute unforgeability; an explicit strategy in which the issuer infers any bit of $x$ before unveiling would refute future privacy. The paper's own security reduction implies that neither is possible if the underlying BB84 bit-string coordination is binding and hiding, so either strategy is a decisive falsifier.","supporting_citations":[{"cited_title":"[7], which is based on the bit commitment protocol of Ref","cited_arxiv_id":null,"evidence_quote":"Defines the original S-money scheme and the bit-string coordination task whose binding and hiding properties the refined scheme inherits."},{"cited_title":"[7] the issuer transmits a quantum state |Ψ ⟩ to the user, chosen from a predetermined set","cited_arxiv_id":null,"evidence_quote":"Supplies the earlier single-round token implementation, including the measurement $M_b$ and presentation mechanics that the refined two-stage scheme modifies."},{"cited_title":"Quantum tokens,","cited_arxiv_id":null,"evidence_quote":"Describes the practical no-quantum-memory variant of bit-string coordination whose security is cited alongside [10-13] in the paper's security argument."}],"review_version":1}