Quantum Digital Signatures

Overview

A digital signature lets you prove that a message came from a particular sender and was not altered, and that the sender cannot later deny having signed it. Today's signatures rely on mathematical problems, such as factoring or elliptic curves, that a large quantum computer could solve. Quantum digital signatures, or QDS, aim for signatures whose security rests on the laws of quantum mechanics instead.

In a QDS scheme the signer distributes quantum states that act as a public key. The no-cloning theorem and the limits on extracting information from quantum states prevent anyone from forging a signature or from copying the key. The security is information-theoretic, meaning it holds against an attacker with unlimited computing power.

The problem it solves

Proving that a message genuinely came from a specific sender and hasn't been tampered with, without relying on classical cryptographic assumptions that quantum computers might eventually break.

History and background

Gottesman and Chuang described the first quantum digital signature scheme in 2001. In it, the signer's public key consists of quantum fingerprint states, which the recipients must store in quantum memory, a requirement that made the scheme impractical. In 2006 Andersson, Curty, and Jex showed how recipients could compare coherent states, and in 2012 Clarke and coauthors demonstrated a QDS using phase-encoded coherent states. In 2014 Dunjko, Wallden, and Andersson, and independently Collins and colleagues, showed how to remove the need for quantum memory, which led to practical experiments.

Subsequent experiments extended the distance and removed detector side channels. Donaldson and coauthors reported kilometer-range QDS in 2016, and measurement-device-independent versions have been demonstrated over fiber networks of tens of kilometers in laboratory and field tests. Parallel work on information-theoretically secure classical signatures, such as the schemes of Chaum and Roijakkers in 1990, provides context for what QDS is competing against.

How it works

Distributes quantum states that encode signature information, exploiting the no-cloning theorem to prevent forgery, while classical verification steps confirm the message's authenticity.

A classical signature has a private key that signs and a public key that anyone can use to verify. QDS has a similar structure, but the public key is a set of quantum states, which are not copyable. The signer creates a pair of random strings for each message bit, and for each string she prepares quantum states, such as fingerprints or coherent states, that encode it in a way that reveals very little about the string.

She distributes copies of these states to the recipients. To sign a bit, she sends the corresponding classical string. A recipient checks whether the string matches the quantum states he holds, by measuring them, which gives a small number of mismatches only if the string is genuine. A forger who does not know the string cannot produce one that passes, because the quantum states do not contain enough information to reconstruct it.

To make signatures transferable, so that a recipient can forward the message to another recipient who will also accept it, schemes use two acceptance thresholds. A recipient accepts a message directly if the mismatch rate is below a low threshold, and accepts a forwarded message if it is below a higher threshold. The gap between them ensures that if one recipient accepts, others will also accept, and thus the signer cannot repudiate.

Step by step

1. Key generation: the signer chooses, for each possible message bit and each of many positions, a random string, and builds quantum states that encode each string, such as fingerprints or coherent states.
2. Distribution: the signer sends copies of the quantum states to each recipient. Recipients measure their copies in a way that stores classical data, in the memoryless versions.
3. Symmetrization: recipients exchange a random half of their measurement records with each other, so that no one can tell which records came directly from the signer.
4. Signing: to sign a message bit, the signer sends the message and the classical strings corresponding to that bit.
5. Verification: the recipient compares the received string with his measurement records and counts mismatches. He accepts if the number is below a threshold.
6. Forwarding: the recipient sends the signed message to another recipient, who checks it against a more tolerant threshold, so that a genuine forwarded message is accepted.

A worked example

Suppose Alice wants to sign a one-bit message to Bob and Charlie. She has two long random strings, one for message 0 and one for message 1, and has distributed quantum states encoding both strings to Bob and Charlie. To sign the message 1, she sends the string associated with 1.

Bob compares it with what he measured earlier and sees a mismatch fraction of about 2 percent from honest noise, below his low threshold, so he accepts. He forwards the signed message to Charlie, whose threshold is higher, say 10 percent. Charlie measures about 4 percent mismatches, which is below his threshold, so he accepts too. A forger who tries to alter the string produces a mismatch fraction well above both thresholds because she does not know the string.

Complexity and resources

What hardware it needs

• Sources of phase-encoded coherent states or single photons and detectors, similar to QKD hardware.
• Secure and authenticated channels among the participants for the symmetrization step.
• For the original Gottesman-Chuang scheme, long-lived quantum memory, which is not yet practical.

Applications

• Signing contracts, certificates, and software updates with long-term security.
• Secure multi-party protocols such as voting and secure messaging in networks with several participants.
• Research on quantum networks and applications beyond key distribution.

Limitations and caveats

• Signatures are far larger and more costly to produce than classical signatures.
• Each key can be used only once, so the key supply must be refreshed.
• Current schemes need pre-distributed secret keys or QKD links among recipients.
• Post-quantum classical signatures, such as ML-DSA and SLH-DSA, are far cheaper and are now standardized.

Common misconceptions

• QDS does not need a quantum computer. It needs quantum communication hardware similar to QKD.
• It does not replace classical signatures in practice. It is a research topic with niche potential.
• The security does not rely on the difficulty of computation, only on the laws of physics and on authenticated channels.

How it compares

• Classical RSA and elliptic-curve signatures are efficient but are breakable by Shor's algorithm.
• Post-quantum signatures such as ML-DSA and SLH-DSA offer security against quantum attackers with computational assumptions and good efficiency.
• Information-theoretically secure classical signatures need shared secret keys among many parties and have similar overheads to QDS.

Real-world impact

An active research area for ensuring long-term security of digitally signed documents and communications in a future where classical signature schemes might be vulnerable to quantum attacks.

Why it matters

QDS shows that quantum mechanics can supply cryptographic tools beyond key distribution. It addresses a different problem, authenticity and non-repudiation, with security that does not depend on unproven computational assumptions.

It is also a reminder to compare with the practical alternative: standardized post-quantum signatures already protect most use cases, so QDS is mainly valuable for research and for scenarios that demand information-theoretic guarantees.

Frequently asked questions

Keep learning

• Related algorithm: BB84 Quantum Key Distribution
• Related algorithm: Device-Independent Quantum Key Distribution
• Related algorithm: Quantum Secret Sharing
• Related algorithm: E91 Quantum Key Distribution

This page is written for educational purposes. Complexity statements describe the best known results at the time of review (September 30, 2026), and research in this area moves quickly, so check recent papers before relying on a specific bound.

← Back to Algorithms Database