Flexible quantum tokens in spacetime

Adrian Kent; Dami\'an Pital\'ua-Garc\'ia

REVIEW 3 major objections 4 minor 26 references

Flexible quantum tokens in spacetime

T0 review · 3 major / 4 minor · reviewed 2026-08-14 · deepseek-v4-flash

Challenge this review Re-run · record.json Download PDF Read on arXiv ↗ Review JSON

Pith's one-line read This paper refines S-money so a user can choose the token's presentation point anywhere in the causal past of all valid presentation points using only classical communication at decision time, and can transfer tokens between users without…

desk verdict Clever two-stage S-money construction, but the unforgeability proof misses a multi-m double-spend attack; needs repair before it can be cited. read the letter →

arxiv 1908.08143 v2 pith:I7DH374Q submitted 2019-08-21 quant-ph cs.CR

Adrian Kent , Damián Pitalúa-García This is my paper · ORCID

classification quant-phcs.CR MSC 81P9494A60 PACS 03.67.Dd03.67.Hk

keywords quantummoneyS-moneytokensbit-stringcoordinationBB84bitcommitmentunforgeabilityfutureprivacytokentransfer

verification ladder T0 review T1 audit T2 compute T3 formal

The pith

A machine-rendered reading of the paper's core claim, the machinery that carries it, and where it could break.

The reading

This paper claims that S-money virtual tokens can be made far more flexible: the user can postpone the choice of where the token is valid until almost the last moment, using only classical messages at the decision point, and can hand the token to other users who then make their own choice. The trick is a two-stage structure: in an early quantum stage the user measures the four BB84 qubit states and thereby commits to a secret random string; later, a classical message $m = x \oplus b$ commits the chosen presentation point $b$ without revealing it. The issuer learns $b$ only when the user finally unveils $x$ at presentation, and the binding property of the commitment prevents the user from opening two different strings and thereby forging two tokens. A sympathetic reader would take the paper's contribution to be showing that all of the original S-money security guarantees reduce cleanly to the binding and hiding of the underlying bit-string coordination protocol.

What carries the argument

The mechanism is the bit-string coordination protocol built from a BB84 bit commitment: the issuer sends a tensor product of the four Bennett-Brassard qubit states, each in one of two conjugate bases, and the user's choice of measurement basis on each qubit commits the corresponding bit. The flexible scheme's key move is to use a secret random string $x$ and the classical message $m = x \oplus b$: the choice of presentation point $b$ is encrypted by a one-time pad whose key the user has already committed to. That object carries the argument because it simultaneously enforces the two required properties: binding makes double spending logically impossible, and hiding keeps $b$ concealed until the final unveiling, with no quantum communication needed at the decision point.

What would settle it

An explicit cheating strategy in which a no-memory user, after receiving $m = x \oplus b$, produces valid unveiling data for two different presentation points would refute unforgeability; an explicit strategy in which the issuer infers any bit of $x$ before unveiling would refute future privacy. The paper's own security reduction implies that neither is possible if the underlying BB84 bit-string coordination is binding and hiding, so either strategy is a decisive falsifier.

Watch

Extended reading notes

Core claim

The paper's central claim is that a two-stage S-money scheme can decouple the expensive, quantum part of token creation from the time-critical choice of presentation point. In the first stage, well before any token is needed, the issuer sends BB84 states and the user applies a measurement $M_x$ labelled by her own random string $x$, producing outcomes $y$; this effectively commits her to $x$. In the second stage, at any point in the causal past of all valid presentation points, she chooses $b$ and sends only $m = x \oplus b$. At $Q_b$ she unveils the commitment to $x$, and the issuer accepts the token if $y$ is a plausible outcome of measurement $M_{m \oplus b}$ and the commitment checks out. The paper argues that the user cannot present valid tokens at two distinct points unless she can open two different $x$ values, and the issuer cannot learn $b$ in advance unless he can learn $x$ before unveiling; hence unforgeability and future privacy inherit directly from the binding and hiding properties of bit-string coordination. It then describes how, using authenticated signed transfer messages, the token can be passed from user to user, with each new user using their own precommitted secret string, while the same security arguments apply.

Load-bearing premise

The load-bearing premise is that the BB84-based bit-string coordination protocol really is binding and hiding in the specific multi-user, transfer scenario; the paper imports this from prior security analyses instead of proving it, so any failure there would leave the refined scheme without the guarantees claimed here.

Editorial extensions

If this is right

The user can decide the valid presentation point at any spacetime point in the intersection of the causal pasts of all valid presentation points, with only classical communication needed after the initial quantum phase.
Tokens can be transferred between users classically and quickly; each recipient can then choose a new valid presentation point and keeps her own presentation choice private from the issuer.
The choice of presentation point can be made through a sequence of decisions at different spacetime points, each narrowing the set of possible presentation points, while still guaranteeing at most one valid presentation.
Unforgeability and future privacy for every user follow directly if the underlying bit-string coordination protocol is binding and hiding, so any improvement or weakening of that primitive changes the whole scheme.
Because the quantum part can be done long in advance, S-money becomes usable in time-critical relativistic settings where token acquisition and presentation decisions are separated by only classical communication.

Reading between the lines

Editorial extensions of the paper, not claims the author makes directly.

Editorial extension: the late-commitment trick $m = x \oplus b$ is a general way to separate 'choose later' from 'commit now', and could in principle be reused in other spacetime-constrained protocols such as position-based tasks or timed commitments, not just token presentation.
Editorial extension: with transfer via signed classical messages, the token behaves like a bearer instrument in a relativistic network; practical deployment would still need the credential, authentication, and secure-site infrastructure the paper assumes.
Editorial extension: the paper's security statements are unconditional only at the ideal, error-free level; a practical implementation with imperfect channels would need quantitative parameter estimates, and the clean reduction would then carry over only to whatever error-tolerant commitment is used.
Editorial extension: since the second stage and presentation touch only classical communications, the decision and transfer steps could be tested on existing photonic hardware without waiting for long-lived quantum memories.

Share X Bluesky LinkedIn Reddit HN

Signed reviews

No signed human review yet.

Editorial analysis

A structured set of objections, weighed in public.

Desk editor's note, referee report, and a circularity audit.

Desk Editor's Note

read the letter

Worth a look if you care about relativistic quantum tokens, but the main proof has a hole. The two-stage trick — register a random x via quantum exchange, then choose the presentation point by sending m = x XOR b classically — is genuinely useful and makes S-money much more practical. The paper also correctly identifies the trade-off in previous schemes (fixed presentation vs. fresh quantum exchange) and the transfer idea is natural.

The bad news: the unforgeability proof in Section II.D.1 only covers the case where the same m is used at every presentation point. Nothing in the protocol forces that. A malicious user can send m1 to one bank agent and m2 to another, from two different decision points in the common causal past of the Qi's. At Qi1 the bank checks y against M_{m1 XOR i1} = M_x; at Qi2 it checks M_{m2 XOR i2} = M_x. Same y passes both, and the binding property is never violated because x never changes. So the reduction to binding fails, and the transfer section inherits the same problem — a malicious holder can sign the same token to multiple users before the bank syncs.

This is load-bearing, not a typo. The scheme may be repairable (e.g., commit to m as well, or require a single signed decision point), but the current text doesn't have that. The paper also relies on an unpublished ref [16] for some of the underlying coordination analysis, though the core BB84 results are in published papers.

Credit where due: the exposition is clear, the delayed-decision generalization in Section IV is a nice extension, and the underlying idea of precommitted secrets plus classical masking is worth exploring. The gap is specific and fixable.

Who should read it: anyone working on quantum money or position-based cryptography. It deserves referee time — the idea is solid enough that the proof should be repaired, not the paper rejected outright. But I wouldn't cite it as-is, and I'd want the multi-m attack addressed before recommending acceptance.

Referee Report

3 major / 4 minor

Summary. The paper refines the S-money scheme of Kent so that the computationally heavy or quantum part of token preparation can be done far in advance, while the later choice of presentation point is made by purely classical communication. The user first engages in a bit-string coordination protocol that commits her to a long secret string x. Later, to acquire a token, she classically agrees with the bank on a set S of valid presentation points and on which segment of x is attached to the token. To decide the actual presentation point Q_b, she sends m = x XOR b from a decision point in the causal past of all Qi, and at Q_b she unveils x. The paper claims that unforgeability follows from the binding property of the bit-string coordination protocol and that future privacy follows from its hiding property, and it extends the scheme to transfer between users and to multi-step decisions. The paper is clearly written and the figures are helpful, but the central security claim is not established as stated.

Significance. If the scheme worked as claimed, it would be a practically valuable refinement: the quantum communication and measurement phase could be moved well before the time-critical decision, and the decision phase would require only classical communications. The reduction of future privacy to the hiding property of the underlying bit-string coordination protocol is sound and is a strength of the paper. However, the unforgeability proof has a genuine gap: it silently assumes that a single classical message m is attached to each token, whereas the protocol as specified does not enforce this. As a result, the claimed unforgeability does not follow from binding, and the transfer protocol inherits the problem. The paper also relies partly on an unpublished reference for a security-critical property. The core idea is plausible and the flaw is likely repairable, but the present manuscript does not establish its main claim.

major comments (3)

[Section II.D.1] The reduction of unforgeability to binding assumes that a user presenting at two different points Qi1 and Qi2 must open two different strings x1 and x2. This assumption is false as the protocol is specified in Section II.C. A dishonest user can choose two distinct labels i1 and i2, send m1 = x XOR i1 at one decision point and m2 = x XOR i2 at another decision point in the common causal past of all Qi, and later present the same token data y at both Qi1 and Qi2. At Qi1 the bank verifies y against M_{m1 XOR i1} = M_x, and at Qi2 it verifies y against M_{m2 XOR i2} = M_x; both checks pass. The user never unveils a second string x', so the binding property is not violated. The sentence 'Since i1 ≠ i2, x1 ≠ x2' is valid only if m is unique, and the protocol neither enforces nor proves uniqueness of m. The manuscript also does not specify how a bank agent at Qi should behave if it receives two different values of m for the same token. Thus the claimed unforgeability does not follow from binding, and the scheme as written permits double-spending with a single committed string.
[Section III] The transfer protocol does not analyze double-transfer by a malicious holder. A dishonest first user A1 can issue authenticated signed transfer messages to two different users A2 and A3 at two transfer points, possibly spacelike separated, and both A2 and A3 can register the same token with bank agents using their own precommitted strings x2 and x3. Each can then present the token at a different Qi. The paper gives no mechanism, such as a unique-ownership rule, an ordering of transfer registrations, or cancellation of earlier transfer messages, that would prevent this. The unforgeability argument of Section II.D.1 does not cover this case because it assumes a single token owner and a single decision message. This is a load-bearing gap for the advertised transferability: without an explicit uniqueness mechanism, a malicious holder can duplicate the token.
[Section IV] The multi-step decision protocol inherits the same flaw. Each decision step sends a classical message derived from the same secret string x, but nothing prevents an adversary from making two inconsistent decision paths using the same x, leading to two valid presentation points. For example, the user could at D1 send one message restricting the presentation point to one subset, and at a later or spacelike-separated point send another message that is inconsistent with the first, while still unveiling the same x at the final presentation point. The paper does not specify how the bank's agents reconcile multiple, inconsistent decision messages, so the claimed guarantee that 'there can be no more than one valid presentation point' is not established by the arguments given.

minor comments (4)

[References] Reference [16] is cited as 'in preparation' yet is used as part of the security foundation for the bit-string coordination protocol; the text should cite a published version or should not rely on an unpublished manuscript for a load-bearing security property.
[Section II.A] There is a typo in the sentence 'This technique was used also used in practical protocols'; it should read 'was also used'.
[References [7] and [8]] References [7] and [8] both list the same patent application number WO2017001850A1; this appears to be an error and should be corrected.
[Section II.C] The notation PA for the token-acquisition point and P for the initial start point is easy to confuse; consider using more distinct symbols.

Circularity Check

0 steps flagged · score 2.0 of 10

No significant circularity: security claims reduce to independently established bit-string coordination properties; self-citations are contextual, not load-bearing.

full rationale

The paper's central security claims are reductions: unforgeability is reduced to binding of the underlying BB84 bit-string coordination protocol (Section II.D.1), and future privacy to hiding plus a one-time-pad argument (Section II.D.2). The binding and hiding properties are cited to Refs [10-13,16]; of these, [10,11] are self-citations and [16] is an in-preparation self-citation, but [12] and [13] are independent published security analyses, so the load-bearing primitive does not reduce to this paper's own assertions. The novel content of the scheme, precommitment to a random string x followed by classical transmission of m = x xor b and validation via m xor x = b, is a genuine construction rather than a definition of the desired conclusion. No equation in the paper equals its input by construction, and no fitted parameter is renamed as a prediction. There is a possible proof gap if a malicious user could send different m values to different bank agents, since the unforgeability proof silently assumes a single m, but that is a correctness concern rather than circularity. The self-citations to Kent's earlier S-money work and patent supply context and notation; they do not carry the derivation. Score 2 reflects the minor self-citation cluster, not substantive circularity.

Assumptions & free parameters 0 free parameters · 4 assumptions · 0 invented entities

No empirical data are used, so there are no fitted free parameters; the security parameters n, gamma, and M are tunable design parameters, not fitted values. The central claim rests on the security of the cited bit-string coordination protocol, the trusted network model, and the standard one-time pad property. No new physical entities are introduced.

assumptions (4)

domain assumption The BB84 bit-string coordination protocol is binding and hiding, as established in Refs [10-13,16].
Used in Section II.D to infer unforgeability and future privacy; not re-proved in this paper.
domain assumption The issuer and users operate networks with authenticated, secure communication links and a shared reference frame.
Standard S-money scenario stated in Section II; without it, the signed transfers and m messages cannot be trusted.
domain assumption A user's random string x is fresh, uniform, and unknown to the issuer before unveiling.
Needed for the one-time pad argument in Sections II.C and III; the protocol relies on the user's random choice and the hiding property.
standard math One-time pad: for uniform random x independent of b, m = x XOR b reveals no information about b.
Standard information-theoretic result used to derive future privacy.

how reviews work

0 comments

Cite this review

Pith. "Pith review of Flexible quantum tokens in spacetime." pith.science (2026). https://pith.science/paper/I7DH374Q

@misc{pith2026190808143,
  author       = {Pith},
  title        = {Pith review of: Flexible quantum tokens in spacetime},
  year         = {2026},
  howpublished = {\url{https://pith.science/paper/I7DH374Q}},
  note         = {Machine review of arXiv:1908.08143}
}

read the original abstract

S-money [Proc. R. Soc. A 475, 20190170 (2019)] schemes define virtual tokens designed for networks with relativistic or other trusted signalling constraints. The tokens allow near-instant verification and guarantee unforgeability without requiring quantum state storage. We present refined two stage S-money schemes. The first stage, which may involve quantum information exchange, generates private user token data. In the second stage, which need only involve classical communications, users determine the valid presentation point, without revealing it to the issuer. This refinement allows the user to determine the presentation point anywhere in the causal past of all valid presentation points. It also allows flexible transfer of tokens among users without compromising user privacy.

Figures

Figures reproduced from arXiv: 1908.08143 by the authors.

**Figure 2.** FIG. 2. Schematic illustration in 1 + 1-dimensional [PITH_FULL_IMAGE:figures/full_fig_p006_2.png] view at source ↗

**Figure 3.** FIG. 3. The refinement allowing Alice to delay her chosen [PITH_FULL_IMAGE:figures/full_fig_p007_3.png] view at source ↗

Discussion (0). Continue with ORCID to comment.

Reference graph

Works this paper leans on

26 extracted references · 24 canonical work pages

[16]

Quantum tokens,

A. Kent, “Quantum tokens,” International Patent Appli- cation No. WO2017001850A1. (2017)

work page 2017
[1]

[7], which is based on the bit commitment protocol of Ref

Example of a bit coordination scheme We present a simple bit coordination scheme given in Ref. [7], which is based on the bit commitment protocol of Ref. [10], to illustrate why bit-string coordination and bit-string commitment are diﬀerent tasks. Let {|0⟩, |1⟩, |+⟩, |−⟩} be the set of Bennett-Brassard 1984 (BB84) states, where |±⟩ = 1 √ 2 ( |0⟩±|1⟩ ) and...

work page 1984
[2]

Suppose that B issues a token to A1, by sending a string of quantum states within a (suitably extended) space-time region P

Transferability and Transfer time A related limitation of the S-money schemes [1, 7], as presented, is that the process of transferring tokens either lacks ﬂexibility or requires a delay to initiate a new token. Suppose that B issues a token to A1, by sending a string of quantum states within a (suitably extended) space-time region P . We assume that A1 h...

work page
[3]

This deﬁnes a simple S-money token proto- col [1, 7], in which the bit string labels the point Qi (for i ∈ {0, 1}N ) at which the token may validly be presented

Initiation time The bit coordination protocol just discussed can be repeated N times, giving an N bit string coordination protocol [1]. This deﬁnes a simple S-money token proto- col [1, 7], in which the bit string labels the point Qi (for i ∈ {0, 1}N ) at which the token may validly be presented. The S-money scheme is initiated by the issuer sending a str...

work page
[4]

Pastawski, N

F. Pastawski, N. Y. Yao, L. Jiang, M. D. Lukin, and J. I. Cirac, Proceedings of the National Academy of Sciences 109, 16079 (2012)

work page 2012
[5]

A1 may give A2 the rights to a token which is valid only at her already determined presentation point, Qb. She can do this by giving A2 at Q her measurement out- comes and the number b, along with a digitally signed classical message stating that A1 relinquishes her token rights and A2 is now the owner. A2 can send this signed message to a local agent of ...

work page
[6]

She can do this by giving A2 a digitally signed message stating that she relinquishes her token rights and that the token is no longer valid

A1 may give A2 the rights to the token at Q in a way that allows A2 to choose a new valid presentation point, Qb′ ≻ Q. She can do this by giving A2 a digitally signed message stating that she relinquishes her token rights and that the token is no longer valid. A2 sends this to a local agent of B, as above. In this case, the local agents of B and A2 need t...

work page
[7]

[7] the issuer transmits a quantum state |Ψ ⟩ to the user, chosen from a predetermined set

Example In the token scheme presented in Ref. [7] the issuer transmits a quantum state |Ψ ⟩ to the user, chosen from a predetermined set. At reception of |Ψ ⟩, the user chooses the number b labeling the presentation point Qb by ap- plying on |Ψ ⟩ a quantum measurement M b that belongs to a predetermined set, obtaining a classical measure- ment outcome y.[...

work page

Show all 26 references

[8]

Unforgeability A reﬁned S-money scheme based on a bit-string coor- dination protocol that is binding satisﬁes the property of unforgeability, according to which the user cannot have two or more tokens validated at two or more presenta- tion points, as we discuss. In a cheating...
[9]

Future privacy for the user A reﬁned S-money scheme based on a bit-string coor- dination protocol that is hiding and where x is chosen randomly and securely by the user satisﬁes the property of future privacy for the user, according to which the issuer cannot obtain any inform...
[10]

Kent, Proceedings of the Royal Society A 475, 20190170 (2019)

A. Kent, Proceedings of the Royal Society A 475, 20190170 (2019)

2019
[11]

Wiesner, ACM Sigact News 15, 78 (1983)

S. Wiesner, ACM Sigact News 15, 78 (1983)

1983
[12]

Gavinsky, in Computational Complexity (CCC), 2012 IEEE 27th Annual Conference on (IEEE, 2012) pp

D. Gavinsky, in Computational Complexity (CCC), 2012 IEEE 27th Annual Conference on (IEEE, 2012) pp. 42– 52

2012
[13]

This technique was used also used in practi- cal protocols for spacetime-constrained oblivious transfer [14, 15]

with a modiﬁcation involving precommitment to a random string in order to allow practical implementa- tion without requiring long distance quantum commu- nication. This technique was used also used in practi- cal protocols for spacetime-constrained oblivious transfer [14, 15]....
[14]

Georgiou and I

M. Georgiou and I. Kerenidis, in LIPIcs-Leibniz In- ternational Proceedings in Informatics , Vol. 44 (Schloss Dagstuhl-Leibniz-Zentrum fuer Informatik, 2015)

2015
[15]

Depending on context, ‘S’ may stand for ‘summonable’ or ‘super’
[17]

Future position commitment,

A. Kent, “Future position commitment,” International Patent Application No. WO2017001850A1. (2018)

2018
[18]

Cryptographic method and system,

A. Kent, “Cryptographic method and system,” UK Patent Application No. GB1719870.6
[19]

Kent, Physical Review Letters 109, 130501 (2012)

A. Kent, Physical Review Letters 109, 130501 (2012)

2012
[20]

Croke and A

S. Croke and A. Kent, Physical Review A 86, 052309 (2012)

2012
[21]

Kaniewski, M

J. Kaniewski, M. Tomamichel, E. H¨ anggi, and S. Wehner, IEEE Transactions on Information Theory 59, 4687 (2013)

2013
[22]

Lunghi, J

T. Lunghi, J. Kaniewski, F. Bussieres, R. Houlmann, M. Tomamichel, A. Kent, N. Gisin, S. Wehner, and H. Zbinden, Physical Review Letters 111, 180504 (2013)

2013
[23]

Pital´ ua-Garc ´ ıa and I

D. Pital´ ua-Garc ´ ıa and I. Kerenidis, Phys. Rev. A 98, 032327 (2018)

2018
[24]

Pital´ ua-Garc ´ ıa, Phys

D. Pital´ ua-Garc ´ ıa, Phys. Rev. A100, 012302 (2019)

2019
[25]

Practical quantum tokens without quantum mem- ories: towards a proof-of-principle experimental demon- stration,

A. Kent, D. Lowndes, D. Pital´ ua-Garc ´ ıa, and J. Rar- ity, “Practical quantum tokens without quantum mem- ories: towards a proof-of-principle experimental demon- stration,” in preparation. 8
[26]

We represent these as a single state and single collective measurement to simplify the notation

In practical implementations with current technology , the transmitted state will be a sequence of (approximate) qubits, and the measurement a sequence of individual measurements on these. We represent these as a single state and single collective measurement to simplify the notation

Pith tools

Reviewed August 14, 2026 · model on record in the stance chip above.

[1] [16]

Quantum tokens,

A. Kent, “Quantum tokens,” International Patent Appli- cation No. WO2017001850A1. (2017)

work page 2017

[2] [1]

[7], which is based on the bit commitment protocol of Ref

Example of a bit coordination scheme We present a simple bit coordination scheme given in Ref. [7], which is based on the bit commitment protocol of Ref. [10], to illustrate why bit-string coordination and bit-string commitment are diﬀerent tasks. Let {|0⟩, |1⟩, |+⟩, |−⟩} be the set of Bennett-Brassard 1984 (BB84) states, where |±⟩ = 1 √ 2 ( |0⟩±|1⟩ ) and...

work page 1984

[3] [2]

Suppose that B issues a token to A1, by sending a string of quantum states within a (suitably extended) space-time region P

Transferability and Transfer time A related limitation of the S-money schemes [1, 7], as presented, is that the process of transferring tokens either lacks ﬂexibility or requires a delay to initiate a new token. Suppose that B issues a token to A1, by sending a string of quantum states within a (suitably extended) space-time region P . We assume that A1 h...

work page

[4] [3]

This deﬁnes a simple S-money token proto- col [1, 7], in which the bit string labels the point Qi (for i ∈ {0, 1}N ) at which the token may validly be presented

Initiation time The bit coordination protocol just discussed can be repeated N times, giving an N bit string coordination protocol [1]. This deﬁnes a simple S-money token proto- col [1, 7], in which the bit string labels the point Qi (for i ∈ {0, 1}N ) at which the token may validly be presented. The S-money scheme is initiated by the issuer sending a str...

work page

[5] [4]

Pastawski, N

F. Pastawski, N. Y. Yao, L. Jiang, M. D. Lukin, and J. I. Cirac, Proceedings of the National Academy of Sciences 109, 16079 (2012)

work page 2012

[6] [5]

A1 may give A2 the rights to a token which is valid only at her already determined presentation point, Qb. She can do this by giving A2 at Q her measurement out- comes and the number b, along with a digitally signed classical message stating that A1 relinquishes her token rights and A2 is now the owner. A2 can send this signed message to a local agent of ...

work page

[7] [6]

She can do this by giving A2 a digitally signed message stating that she relinquishes her token rights and that the token is no longer valid

A1 may give A2 the rights to the token at Q in a way that allows A2 to choose a new valid presentation point, Qb′ ≻ Q. She can do this by giving A2 a digitally signed message stating that she relinquishes her token rights and that the token is no longer valid. A2 sends this to a local agent of B, as above. In this case, the local agents of B and A2 need t...

work page

[8] [7]

[7] the issuer transmits a quantum state |Ψ ⟩ to the user, chosen from a predetermined set

Example In the token scheme presented in Ref. [7] the issuer transmits a quantum state |Ψ ⟩ to the user, chosen from a predetermined set. At reception of |Ψ ⟩, the user chooses the number b labeling the presentation point Qb by ap- plying on |Ψ ⟩ a quantum measurement M b that belongs to a predetermined set, obtaining a classical measure- ment outcome y.[...

work page