{"id":"9aaf4514-0852-4480-b595-b5c5914ce54b","arxiv_id":"1908.08889","paper_version":6,"verdict":"ACCEPT","confidence":"MODERATE","novelty_score":6.0,"correctness_risk":"medium","formal_verification":"none","parameter_count":0,"one_line_summary":"The paper introduces semi-quantum money, shows a public scheme from quantum lightning with bolt-to-certificate and a private scheme from NTCF and LWE, and proves a perfect parallel repetition theorem for NTCF-based 1-of-2 puzzles.","lead":"Semi-quantum money is a new form of quantum money in which the bank is fully classical and all communication with the bank is classical, while users hold quantum states. The paper gives two conditional constructions and proves that classical minting requires computational assumptions.","discovery_kind":"new_method","skeptic_critique":{"model":"deepseek-v4-flash","headline":"No significant objection identified; the private scheme's proof chain is plausible, with the quantum parallel-repetition extension being the only point needing fuller rigor.","rationale":"The reader's ACCEPT verdict is well supported. The private scheme's security is conditional on LWE, a standard assumption, and the proof chain is mostly modular and checkable. My only hesitation is the quantum extension of the CHS05 parallel repetition theorem, which the paper asserts but does not prove in detail. This is a real gap in rigor, but not an identified flaw: the reduction appears to be rewind-free and the resampling argument is efficient when the relevant success probability is non-negligible. Since no concrete counterexample or known obstruction exists, I do not consider this concern load-bearing enough to change the verdict. The public scheme's reliance on quantum lightning is fully disclosed and does not affect the existence claim for semi-quantum money, which the private scheme already establishes under LWE. Therefore I recommend keeping the reader's verdict unchanged.","tokens_in":45121,"tokens_out":35902,"duration_ms":364583,"concrete_test":"Formalize the reduction in Theorem 20 for QPT solvers: write a rigorous proof that the CHS05 black-box reduction does not use rewinding and that the resampling step runs in polynomial time when the solver's success probability is h^n + 1/poly(λ). If such a proof cannot be provided, re-evaluate Proposition 27 and Corollary 21.","verdict_should_be":"UNCHANGED","load_bearing_attack":"After a careful review, I do not find a load-bearing concern that would invalidate the central claim. The private scheme is a conditional result: if LWE with the specified parameters is hard for BQP, then Theorem 2 follows via the known NTCF construction, the 1-of-2 puzzle hardness reduction (Theorem 13), the parallel repetition theorem (Theorem 15), and the mini-scheme-to-full-scheme lifting. The only point that deserves more rigor is the claim in Section 4.3 that the Canetti-Halevi-Steiner parallel repetition theorem for weakly verifiable puzzles extends to QPT solvers because the reduction is black-box and rewind-free. This is a plausible assertion, and the attached sketch supports it, but it is not a formal proof. A failure of this extension would collapse Corollary 21 and with it the private scheme; however, no counterexample or known obstruction is identified, and the argument is likely correct. The public scheme is explicitly based on an uninstantiated primitive (quantum lightning with bolt-to-certificate), which the authors disclose; thus it does not undermine the claimed contribution, which is the concept of semi-quantum money and its LWE-based instantiation.","agreement_with_reader":"partial"},"referee_report":{"model":"deepseek-v4-flash","summary":"The paper introduces semi-quantum money, defined as quantum money in which both minting and verification are interactive protocols between a quantum user and a classical bank, with classical communication only. The central claim is that this is the first quantum money model allowing transactions with completely classical communication and an entirely classical bank. Two constructions are given: a public memory-dependent scheme (Theorem 1) built from quantum lightning with bolt-to-certificate and a post-quantum EU-CMA digital signature scheme, and a private memoryless scheme (Theorem 2) built from LWE via NTCF, 1-of-2 puzzles, a perfect parallel repetition theorem, and a mini-scheme-to-full-scheme lifting. The main technical contribution is a perfect parallel repetition theorem for 1-of-2 puzzles (Theorem 15), proved via a reduction to the CHS05 weakly verifiable puzzles theorem. The paper also proves that no classical-minting quantum money scheme can be information-theoretically secure (Theorem 31).","tokens_in":45323,"tokens_out":15932,"duration_ms":167164,"significance":"The significance is high if the claims hold. The paper identifies a meaningful new point in the design space of quantum money and provides a concrete conditional instantiation from LWE. The assumption handling is honest: the public scheme is explicitly based on an uninstantiated primitive and the authors flag the shaky status of quantum lightning candidates. The private-scheme proof chain is detailed and modular, with explicit reductions and sequence-of-games arguments, and the parallel repetition theorem is a potentially reusable tool. The impossibility result for information-theoretic security sharpens the boundary of the model. I see no circularity or hidden assumptions beyond those stated.","major_comments":[{"comment":"The soundness proof of Theorem 15 applies the Canetti-Halevi-Steiner parallel repetition theorem, [CHS05, Theorem 1], to quantum polynomial-time solvers, but the original theorem is stated for classical PPT solvers. The text argues that the CHS05 reduction is black-box and rewind-free, and Appendix F provides a sketch; this is plausible, but it is the one load-bearing step in the private-scheme chain (leading to Theorem 2) that is not a complete formal proof. I request a formal lemma for the QPT version, with a precise adversary model and a proof that repeated fresh runs of a quantum solver on the same classical input can be used to estimate the conditional probabilities required by the CHS05 argument; alternatively, a published theorem covering QPT solvers should be cited.","section":"Section 4.3 (Theorem 15 and Corollary 21)"}],"minor_comments":[{"comment":"The symbol Vn is used both for the n-fold repetition algorithm and for the verification algorithm of the base puzzle; please use a different name for one of them to avoid confusion.","section":"Section 4.3, Definition 14"},{"comment":"In line 3 of OZ, 'obtain an o ∈ Y' should read 'obtain a value o ∈ Y'.","section":"Algorithm 2, OZ description"},{"comment":"The expression 'Pr[QL.qverifypk(|ψ⟩) = 0]' should refer to the scheme $P's qverify rather than to QL directly.","section":"Proposition 10 proof"},{"comment":"The proof relies on the adversary replaying the original minting transcript, but the theorem statement only gives A the money state |$⟩; the statement should clarify that A, as the user in the mint protocol, may retain the classical transcript and measurement records.","section":"Theorem 31"}],"recommendation":"major_revision","confidential_remarks":"The paper is well within the journal's scope and the authors are transparent about the conditional nature of the constructions. The only substantive issue is the formalization of the QPT version of the parallel repetition theorem; I believe it is fixable."},"author_rebuttal":null,"desk_editor":{"model":"deepseek-v4-flash","letter":"Bottom line: this is the paper that makes quantum money usable with a classical bank and classical communication, and the private construction is a real result. The authors define semi-quantum money via classical minting plus Gavinsky-style classical verification, then give two constructions. The private scheme from NTCF/LWE is the substantive part: 1-of-2 puzzles from NTCF, perfect parallel repetition, mini-scheme, then full scheme with MAC and encryption. The reduction chain is honest, each step is stated as conditional on LWE, and the sequence-of-games proofs in Section 5 are careful. The public scheme is a clean composition of quantum lightning with bolt-to-certificate and a PQ signature, but it rests on an uninstantiated primitive; the authors say so openly in Section 1, so the paper is not overselling.\n\nThe genuinely new technical item is the perfect parallel repetition theorem for NTCF-based 1-of-2 puzzles. It is presented honestly as an application of CHS05 via equivalence to weakly verifiable puzzles. The only real rigor gap I see is that the CHS05 proof is black-box and rewind-free, so it should carry over to QPT solvers, but the paper gives a sketch (Section 4.3 and Appendix F) rather than a full formal proof. If that extension failed, Corollary 21 would collapse, and with it the private scheme. I have no counterexample or obstruction; the argument looks right. It just deserves a formal write-up.\n\nThe impossibility result (Theorem 31) is straightforward but worth having, and the discussion of memory-dependence versus memoryless is sensible. The related work is thorough, and the reuse of BS16a and CS20 is legitimate prior work, not hidden circularity.\n\nBottom line: private semi-quantum money from LWE is a solid conditional result, and the model is likely to be used by others. The public scheme is more speculative by design. This deserves serious peer review; the main request should be a fully formal treatment of the quantum parallel repetition step.","headline":"Semi-quantum money with a classical bank is a genuine new model, and the LWE-based private scheme holds up; the public scheme is honestly conditional and the parallel-repetition step needs a formal proof.","tokens_in":45843,"tokens_out":1476,"would_cite":true,"duration_ms":15655,"reading_group":"yes","serious_thinker":"yes","would_accept_peer_review":true},"rs_alignment":null,"lean_confirmation":null,"pith_extraction":{"msc":[],"pacs":[],"model":"deepseek-v4-flash","headline":"This paper introduces semi-quantum money, the first quantum money whose minting and verification run over classical communication with a classical bank.","keywords":["semi-quantum money","quantum money","classical minting","classical verification","learning with errors","noisy trapdoor claw-free functions","parallel repetition","quantum lightning"],"falsifier":"A concrete refutation would be a quantum algorithm that solves LWE at the dimensions and noise parameters used in the NTCF instantiation of [BCM+18, Theorem 26]; that would let a counterfeiter recover both preimages of a claw and pass two verifications of a single minted note, refuting Theorem 2. For the public scheme, the falsifier is a procedure that outputs two bolts accepted under the same serial number for any candidate quantum lightning scheme, which would refute Theorem 1.","tokens_in":44913,"feed_emoji":"💰","tokens_out":23685,"duration_ms":204213,"temperature":0.7,"pith_summary":"This paper introduces semi-quantum money: quantum banknotes whose minting and verification both run as interactive protocols in which the bank is entirely classical. The money state is generated by the user, who prepares a superposition over a trapdoor function supplied by the bank, measures one register, and reports the result; this classical minting is what removes the need for a quantum bank and for quantum channels. The paper constructs a private, memoryless scheme whose security reduces to the hardness of Learning With Errors for quantum computers (Theorem 2), and a public, memory-dependent scheme based on quantum lightning with bolt-to-certificate (Theorem 1). Its main technical contribution is a perfect parallel repetition theorem for 1-of-2 puzzles, which amplifies a puzzle that a forger can solve with probability $\\frac{1}{2}$ into one with negligible forging probability. The paper also proves that no quantum money scheme with classical minting can be information-theoretically secure, so computational assumptions are unavoidable.","feed_headline":"Quantum money gets a fully classical bank","feed_subtitle":"No quantum communication infrastructure needed: users hold quantum states, banks stay classical.","key_machinery":"The carrying object is the 1-of-2 puzzle built from a Noisy Trapdoor Claw-Free Function (NTCF) — a two-to-one function family with a trapdoor and an adaptive hardcore bit property — together with a perfect parallel repetition theorem for such puzzles. Minting leaves the user holding a superposition $\\frac{1}{\\sqrt{2}}(|0\\rangle|x_0\\rangle + |1\\rangle|x_1\\rangle)$ over the two preimages of a measured image; verification is a random challenge asking either for a preimage $x_i$ with $f(x_i)=y$, or for a non-zero string $d$ and bit $i$ satisfying $d\\cdot(J(x_0)\\oplus J(x_1)) = i$, with $d$ in a specified good set. The adaptive hardcore bit property guarantees that any quantum adversary can pass both challenges of a single puzzle with probability at most $\\frac{1}{2} + \\mathrm{negl}(\\lambda)$. Repeating $n$ puzzles in parallel under a single challenge bit preserves this guarantee with the success probability raised to the $n$-th power: the paper's Theorem 15 proves the repetition is perfect, by reducing to the black-box, rewinding-free parallel repetition theorem for weakly verifiable puzzles of [CHS05]. This is the main technical contribution, and it is what makes the money unforgeable: double-spending a note requires solving a 2-of-2 puzzle in at least one coordinate, an event driven to negligible probability.","core_discovery":"The paper's central discovery is that quantum money can be moved off quantum communication infrastructure: minting and verification can both be classical protocols for the bank, as long as the user holds a quantum computer. It defines semi-quantum money as an interactive scheme in which the bank is classical in both minting and verification, and it gives the first constructions. In the private, memoryless scheme (Theorem 2), the bank sends $n$ functions from a Noisy Trapdoor Claw-Free Function family together with a MAC key; the user prepares superpositions of the form $\\frac{1}{\\sqrt{2}}(|0\\rangle|x_0\\rangle + |1\\rangle|x_1\\rangle)$, measures the function-output registers, and sends the measured values back as signed obligations. Verification is a single classical round in which the bank chooses random pre-image or equation challenges, and passing two verifications of one note forces the adversary to answer both challenges of at least one puzzle, which the perfect parallel repetition theorem makes negligibly likely. In the public, memory-dependent scheme (Theorem 1), the user generates a quantum lightning bolt, the bank signs its serial number, and spending converts the bolt into a classical certificate — checked against a database of spent serial numbers — that proves the bolt was destroyed. The paper further shows this is the natural extreme: a classical user backed by a quantum bank is inherently flawed, and Theorem 31 proves computational assumptions are unavoidable for any classical-minting scheme. The authors flag in Section 1 that the public construction sits on shaky ground: one quantum lightning candidate has been attacked, another relies on a hash function with no known instantiation, and the yet-unbroken knot-based candidate lacks bolt-to-certificate capability.","pith_inferences":["Because the parallel-repetition reduction is black-box and rewinding-free, the same amplification should transfer to other quantum protocols with 1-of-2 structure; the certifiable-randomness protocol built on the same NTCF tests could plausibly be compressed from a linear number of rounds to a constant.","The user-side minting pattern — a classical issuer supplies trapdoor functions, the user prepares a superposition and reports a measurement — is a general template that could mint other unforgeable quantum credentials, such as tickets, coupons, or access tokens, from a classical issuer.","If LWE were ever solved by a quantum algorithm, the private scheme would degrade to the security of a classical serial-number database; semi-quantum money is therefore a bet on post-quantum computational hardness in a way that information-theoretically secure private money is not.","The two theorems together point to the private LWE-based scheme as the practical route; a memoryless public scheme will require a new primitive, most plausibly a lattice-based quantum lightning candidate that is unbroken and equipped with bolt-to-certificate."],"forward_implications":["Semi-quantum money removes the need for a quantum communication infrastructure: banks stay classical, all transactions run over classical channels, and only users need quantum computers.","The private scheme shows that secure quantum money can rest on Learning With Errors hardness alone (together with LWE-based MACs and encryption), placing it on standard post-quantum assumptions.","The public scheme is inherently memory-dependent — the bank must keep a database of spent serial numbers — and whether a memoryless public semi-quantum scheme exists is left open.","The perfect parallel repetition theorem amplifies any $\\frac{1}{2}$-hard 1-of-2 puzzle into a strong one with negligible soundness error, giving the NTCF-based tool exponentially small forging probability.","Classical minting marks a boundary: a computationally unbounded adversary can always double-spend a note, so any semi-quantum money scheme must rely on computational assumptions (Theorem 31)."],"supporting_citations":[{"why":"Supplies the Noisy Trapdoor Claw-Free Function family with the adaptive hardcore bit property, instantiated from LWE, that the private scheme builds on.","marker":"[BCM+18]"},{"why":"Proves the parallel repetition theorem for weakly verifiable puzzles that the paper's perfect parallel repetition of 1-of-2 puzzles reduces to.","marker":"[CHS05]"},{"why":"Introduces quantum lightning, the public money primitive whose serial-number uniqueness underlies Theorem 1.","marker":"[Zha19]"},{"why":"Introduces bolt-to-certificate, the capability that turns a destroyed bolt into a classical spending certificate.","marker":"[Col19]"},{"why":"Provides the consolidated definitions of quantum lightning with bolt-to-certificate and the security-against-sabotage notion used by the public scheme.","marker":"[CS20]"},{"why":"Defines quantum money mini-schemes and the mini-scheme-to-full-scheme lift that the private construction adapts to the interactive setting.","marker":"[AC13]"},{"why":"Shows the private mini-scheme-to-full-scheme lifting template (with authenticated encryption) used in Algorithm 5.","marker":"[BS16a]"},{"why":"Constructs post-quantum message authentication codes from LWE, used to sign the user's obligations.","marker":"[BZ13]"},{"why":"Constructs post-quantum indistinguishable encryption from LWE, used to encrypt mini-scheme keys in the full scheme.","marker":"[GHS16]"},{"why":"Introduces classically verifiable quantum money, the notion that semi-quantum money extends by adding classical minting.","marker":"[Gav12]"}],"fun_headline_variants":["First quantum money with a fully classical bank","Semi-quantum money: cash that mints classically","Classical bank mints and verifies quantum cash","Quantum money without quantum banking","Semi-quantum: users quantum, banks classical"],"cache_read_input_tokens":3200,"weakest_assumption_plain":"The private scheme collapses if Learning With Errors is not hard for quantum computers at the specific parameter sets used, both for the NTCF instantiation and for the MAC and encryption building blocks, and the public scheme collapses if no quantum lightning scheme with bolt-to-certificate capability exists, which the authors themselves flag as on shaky ground.","fun_headline_variants_meta":{"raw":{"variants":["First quantum money with a fully classical bank","Semi-quantum money: cash that mints classically","Classical bank mints and verifies quantum cash","Quantum money without quantum banking","Semi-quantum: users quantum, banks classical"]},"model":"deepseek-v4-flash","effort":"low","cost_usd":0.00026,"raw_usage":{"total_tokens":1647,"prompt_tokens":1059,"completion_tokens":588,"prompt_tokens_details":{"cached_tokens":384},"prompt_cache_hit_tokens":384,"prompt_cache_miss_tokens":675,"completion_tokens_details":{"reasoning_tokens":515}},"tokens_in":675,"tokens_out":588,"duration_ms":6236,"temperature":1.0,"reasoning_tokens":515,"cache_read_input_tokens":384,"cache_creation_input_tokens":0},"cache_creation_input_tokens":0},"created_at":"2026-08-14T11:27:46.045401+00:00","model_set":{"reader":"deepseek-v4-flash"},"falsifier":"A concrete refutation would be a quantum algorithm that solves LWE at the dimensions and noise parameters used in the NTCF instantiation of [BCM+18, Theorem 26]; that would let a counterfeiter recover both preimages of a claw and pass two verifications of a single minted note, refuting Theorem 2. For the public scheme, the falsifier is a procedure that outputs two bolts accepted under the same serial number for any candidate quantum lightning scheme, which would refute Theorem 1.","supporting_citations":[],"review_version":1}