Skip to content
Static snapshot of QMint (git 5b73a0bb93c1) — live experiments run locally

QMint / Quantum security research

Security, down to the state.

Design, attack and verify quantum payment protocols. Every number comes from a reproducible experiment and says what kind of evidence it is.

Launch the Lab Explore the research
Below
Results precomputed by the research API (static snapshot). Pick an attack on a Wiesner note and read what each verifier sees.
Not
Money, a payment service or deployable quantum currency.

Instrument · game W1 · Wiesner note

Number of qubits n
Attack scenario

Molina–Vidick–Watrous 2012 optimal counterfeiting channel. It meets the W1 bound exactly.

W1 note · n = 4 · seed 42 · states secret????MVW channel Φ1 → 2 channelV₁ · verifyP(pass) 0.482253V₂ · verifyP(pass) 0.482253both pass0.316406

Both pass · n = 4

0.316406

SIMULATOR-IDEAL: Noiseless circuit/statevector simulationexact enumeration

Exact model value for this one attack: a lower bound on the worst case · (0.75)ⁿ

Both pass · per qubit
0.75
SIMULATOR-IDEAL: Noiseless circuit/statevector simulation
One copy passes
0.482253
SIMULATOR-IDEAL: Noiseless circuit/statevector simulation
W1 bound · any counterfeiter
0.316406
THEOREM: Bound transcribed from a peer-reviewed proof
seed 42 · git 5b73a0b
Full parameters in the attack lab

MVW optimal channel, n = 4: both verifications pass with probability 0.316406 (exact model value). W1 bound 0.316406.

The problem

01. Copying is free. Spending twice is the attack.

Digital value is a string of bits, and bits copy perfectly. Classical payment systems don't stop the copy. They make the second spend fail, and the way they do that decides whom you have to trust.

Copy

Duplicating a token is undetectable: both copies are identical down to the last bit. Nothing about the data says which one is the original.

Double spend

The same value is presented at two places at once. If the sites are far enough apart, no signal can reach one from the other in time, so something must already have been arranged.

Where classical systems put the trust

  1. H1Online ledgerEvery payment waits for a coordinator round trip, and the coordinator sees where you pay.
  2. H5Secure hardwareSpending twice is blocked only while the tamper-resistance assumption holds.
  3. H6Offline e-cashBoth merchants accept. The double spender is identified later, at deposit.
  4. Classical comparators from lane H (qmint/classical). Section 04 matches them against S-money.
The quantum primitive

02. A note made of states nobody can read without disturbing them.

In Wiesner's scheme the bank prepares each qubit in one of four states and keeps the choice secret. To verify, it measures each qubit in the basis it chose. An unknown quantum state cannot be copied exactly, and a measurement in the wrong basis randomises the answer.

|0⟩basis Z
|1⟩basis Z
|+⟩basis X
|−⟩basis X
The four BB84 states, drawn as polarisation axes. States in the same basis are orthogonal; across bases they overlap with probability 1/2. That overlap is what a counterfeiter cannot avoid.

What no-cloning alone does not give you

  1. a.

    Imperfect copies still pass sometimes.

    The best counterfeiting channel passes both checks with probability 3/4 per qubit. Security is the exponent, (3/4)ⁿ, which reaches 10⁻⁹ only at n = 73.

    THEOREM: Bound transcribed from a peer-reviewed proof
  2. b.

    The secret is the security.

    If the bank's bases and bits leak, a forger prepares two genuine notes and passes both checks with probability 1. QMint runs this as a control (CTRL_secret_leak).

    OUT-OF-MODEL: Request violates the proof's trust/physical model
  3. c.

    Real channels lose and flip photons.

    A verifier that tolerates errors and loss plays a different game (W2), with no closed-form bound here. Against a toy verifier that allows half the qubits to be lost, an attack that splits the note and reports losses wins every time.

    MONTE-CARLO (lower bound): Sampled attack success: a LOWER bound on worst-case attack success, never an upper bound
  4. d.

    A simulator copies freely.

    A simulated state vector is classical data. Nothing on this site demonstrates physical no-cloning; it computes what the model predicts.

    SIMULATOR-IDEAL: Noiseless circuit/statevector simulation

Sources: MVW 2012 (arXiv:1202.4010); GET /api/v1/games (W1 per-qubit bound); POST /api/v1/lab/attack (CTRL_secret_leak); lane C handoffs/C-C1-evidence.json (a06_toy_w2).

The interactive laboratory

03. Four instruments, one evidence trail.

Every result in the lab comes from the research API with its evidence kind, method, seed and git revision attached. You can reproduce any number from the command line.

Quantum vs classical

04. Under matched assumptions, the difference is the adversary model, not speed.

S-money is not coordination-free. Before presentation, the bit c = b ⊕ z must be relayed to both sites. A classical late-commit escrow with private commitment has the same causal structure and the same latency.

What remains is what each side assumes. The ideal S-money bound (1/2 + 1/(2√2))ᴺ is information-theoretic. The classical constructions that match it rely on hardness assumptions or trusted setup. A claim that quantum tokens are faster needs a scenario where those assumptions are ruled out.

THEOREM: Bound transcribed from a peer-reviewed proofKent et al. 2022, Table I steps 7–9 and Lemma 1 (arXiv:2104.11717v4). Lane H reports/classical_baseline_notes/README.md.
  • Late site choice, online infrastructure acceptableH1 ledger (H2 if replicated)Validation waits a coordinator round trip; coordinator learns the site; unavailable under partition.
  • Instant local acceptance, site known at issuanceH3 preassigned, or H4 + H3 signed bindingLate-choice flexibility; the issuer learns the site at issuance.
  • Late choice, local acceptance, issuer must not learn the siteH3 late-commit escrow with oblivious transferSecurity becomes computational. The OT is an ideal functionality, not implemented.
  • No Stage-II message at allH5 secure hardwareRequires tamper resistance; if it fails, the double spend succeeds (tested, out of model).
  • Offline, payer privacyH6 Chaum–Fiat–Naor e-cashDetection, not prevention: both merchants accept, the spender is identified at deposit.
MODELLED-LATENCY: Latency from a model (light-cone, queue model); not a measurementLower bounds on synthetic light-cone networks, not measurements.7 qualified · 4 incomparable · 0 directly comparable · GET /api/v1/benchmarks
Proof, not hype

05. Three kinds of evidence, never blended.

A theorem bounds every adversary. A numerical result is only as good as its certificate. A measurement describes one apparatus. QMint labels each number with which one it is.

THEOREM: Bound transcribed from a peer-reviewed proof

(3/4)ⁿ

Upper bound on the probability that any counterfeiter turns one Wiesner note into two that both pass.

Molina, Vidick & Watrous 2012, arXiv:1202.4010 (abstract; Sec. 3.2) · game W1 · GET /api/v1/games

CERTIFIED-NUMERIC: Numeric bound with rigorous residual accounting

0.75 ≤ OPT1 ≤ 0.750000000003638

0.5625 ≤ OPT2 ≤ 0.562500000007276

QMint solves the counterfeiting SDP over every quantum channel, then certifies the dual with exact rational arithmetic, and an independent checker verifies it again. The lower end is an explicit channel. The bracket is the certificate, not a rounding.

POST /api/v1/lab/attack → sdp (live solve, n ≤ 2) · lane C certify_w1_dual · lane D sdp_exact

PHOTON-EXPERIMENT: Real recorded photon events with dataset hash
Quantum bit error rate, reproduced from the raw data vs the published paper
QBERReproducedPaper
H/V1.4491%[1.4331, 1.4650]1.45%± 0.01
D/A3.2787%[3.2557, 3.3017]3.28%± 0.01

Error rates recomputed from 8,964,878 raw photon coincidence pairs over 22 runs, using the paper's own estimator. Loss and multiphoton probability can't be observed from the archive, so no security claim follows from this.

Schiansky et al. 2023, Nat. Commun. 14, 3849 · data doi:10.5281/zenodo.7979319 · GET /api/v1/benchmarks → photon (lane E)

A fourth kind sits underneath: Monte Carlo. A sampled attack success is a lower bound on what the worst attacker achieves, so QMint always reports it with its interval and never as a ceiling.

Open research

06. Everything is in the repository.

Protocols, attacks, proofs, datasets and this website are one open codebase. Every number above can be traced to a file, a seed and a commit.

Source · MIT Licensegithub.com/udsy19/qmint

Research lanes merged 12 / 12

  • A research / prior-art matrix, merged
  • B protocol simulations, merged
  • C attack suites, merged
  • D proofs / SDP bounds, merged
  • E photonic datasets, merged
  • F BB84 circuits, noise, cloners, merged
  • G relativistic networking / latency, merged
  • H classical baselines, merged
  • I certificate compiler, merged
  • J IonQ / Qollab hardware path, merged
  • L core contracts, records, pipeline, merged
  • N evaluation / figures, merged

Live from GET /api/v1/meta. Dashed lanes are in flight.

Reproduce from the repository root

  • python -m qmint.attacks.report --out handoffs/C-C1-evidence.jsonW1 SDP, certified duals, attack lower bounds (lane C, ~110 s)
  • python -m qmint.proofs.reproduceTheorem bounds and paper reproductions, independently checked (lane D)
  • python -m qmint.photonics.schiansky2023QBER from the Zenodo archive (lane E; archive download required)
  • python -m qmint.classical.run_baselines --pqc-reps 5Classical comparators H0–H6 and the comparability matrix (lane H)

Primary sources

Datasets

Put a note under attack.

Launch the Lab Read the docs