Together with our parent company BTQ Technologies, we have recently published A quantum algorithm for one-shot signatures (arXiv:2606.23612): the first circuit-level implementation of a new kind of cryptographic primitive, one whose single-use security is enforced not by trust or consensus but by the laws of quantum mechanics.
Digital signature schemes
For many people, the first cryptographic idea they encounter is encryption. Alice transforms or scrambles a message so that only its intended recipient, Bob, can read it. But cryptography is a much broader subject than just the study of keeping information secret. Classical cryptography also includes digital signatures, hash functions, message-authentication codes and key-exchange protocols, tools that allow us to verify identity, detect whether data has been changed and establish shared secret keys over an insecure network. The security of these and many other cryptographic protocols often rests on computational hardness assumptions; the belief that certain mathematical problems, such as factoring very large integers, cannot be solved efficiently. While Shor discovered ways to use quantum computers to factor large numbers and break commonly used elliptic curve digital signatures, new post-quantum cryptography makes protocols secure against even quantum computers.
Digital signature schemes are one of the most familiar and useful examples of a cryptographic primitive and the focus of the present blog post. In a digital signature scheme, Alice generates two mathematically related keys. Her secret key is used to sign messages and must be kept private. Her public key is shared freely. When Alice signs a message m, her secret key is used to produce a digital signature σ on that message. Anyone who knows Alice’s public key can then run a verification algorithm on the public key, the message, and the signature. If verification succeeds, it shows that the signature was produced by someone possessing the corresponding secret key and that the message has not been altered. In this sense, a digital signature plays a role similar to a handwritten signature on a letter or contract, but its authenticity and integrity are guaranteed by mathematics rather than by simply the uniqueness of someone’s handwriting.
Digital signatures are critical to the secure functioning of much of the modern internet. They are used, for example, to authenticate software updates and financial transactions. In software code signing, a valid signature allows a device to verify that an update came from the expected publisher and that its code has not been modified, potentially maliciously, since it was signed.
An ordinary signing key is clearly reusable. Alice can use the same secret key and public key pair to sign as many messages as she likes. This is often exactly the desired functionality, but, as we will see below, there are situations where this is undesirable.
Delegating signatures
Suppose now that Alice wants to give a second party, Bob, the authority to sign a message approving exactly one action on her behalf. Perhaps Alice is responsible for signing software releases, but she will be unavailable during a critical maintenance period. She wants Bob to be able to approve and publish one (or some finite number) emergency update if a vulnerability is discovered. Alice cannot decide in advance what that update will contain, because Bob may need to respond to bugs as they appear. At the same time, she does not want to give him unrestricted power to sign any number of future releases.
One obvious solution would be to give Bob her secret signing key. But this would give him unlimited authority. Before returning or deleting the key, Bob could secretly make a copy and later use it to approve a second, potentially malicious update. Alice has no way to know whether every copy of her secret key has truly been destroyed. Another approach to enforce one time use is to keep a public ledger recording signature use but this approach is potentially vulnerable to alteration by an adversary or accidental corruption.
Ideally, Alice would like something stronger. A signing key that allows Bob to choose and sign one message, but then provably self-destructs, making it impossible to sign a different second message. This is the central idea behind a one-shot signature scheme. A self-destructing secret key sounds like science fiction, but the laws of quantum mechanics make such a key possible.
Where one-shot signatures come from
The idea of one-shot signatures was introduced by quantum cryptographers Ryan Amos, Marios Georgiou, Aggelos Kiayias and Mark Zhandry in 2020 [1]. Their work defined the primitive and explored its applications.
A quantum signing key
Quantum mechanics makes a one-shot signing key possible by replacing the usual classical secret key, a bit string stored on an ordinary computer, with a quantum state held on a quantum processor.
Key generation now produces a classical public key pk together with a quantum signing key, which we write as a quantum state |sk⟩. To sign a message m, Bob processes and measures this quantum state, producing an ordinary classical signature σ. Anyone can then validate the signature using (pk, m, σ) and a classical verification algorithm. The crucial security property is that nobody should be able to produce valid signatures for two different messages corresponding to the same public key.
The intuition for how a quantum signing key self-destructs comes from the fragile nature of quantum information. In the familiar Schrödinger’s cat thought experiment, the unopened box represents a superposition of possibilities: the cat is described as both alive and dead. Measuring the system, opening the box, forces a definite outcome, with the cat found either alive or dead, and irreversibly changes the state. In the same way, a quantum signing key can exist in a superposition of many possible classical key states. A one-shot signing procedure exploits this fragility as measuring the key to produce one signature collapses the superposition and leaves the key unusable for signing a second, different message. Bob therefore cannot simply reset the signing key and try again.
To use such a scheme to delegate authority securely, Bob could first generate his own one-shot public key and quantum secret key. As in conventional signature schemes, the public key can be announced well before use, while the quantum secret key is retained in quantum memory until needed. This long storage requirement is particularly well suited to neutral-atom processors. Alice then uses her conventional reusable digital signature key to sign a certificate authorizing Bob’s one-shot public key. Later, Bob consumes his quantum key to sign one chosen update. Finally, Charlie verifies both Alice’s conventional signature on Bob’s public key and Bob’s one-shot signature on the update, requiring only classical computational power.
This is a genuinely new cryptographic capability that is impossible with purely classical information, but made possible by the laws of quantum mechanics and quantum computing.
Lightning does not strike twice
Quantum measurement alone does not solve the entire problem, however, since Bob might still try to copy the secret key before using it to produce a signature. The missing idea is one of the most celebrated results in quantum mechanics: the no-cloning theorem.
Classical information can be copied perfectly. Given a secret key represented by a classical bit string 0101101, we can produce as many identical copies as we like. Quantum information behaves differently. There is no universal physical procedure that takes an arbitrary unknown quantum state |ψ⟩ and produces two perfect copies |ψ⟩|ψ⟩.
However, the ordinary no-cloning theorem is still insufficient to guarantee that Bob cannot obtain two usable signing keys. It prevents him from copying an unknown quantum state already placed in his quantum computer, but it does not stop him from preparing the same state again if he knows how it was generated. If Bob has access to the key-generation procedure, what prevents him from running it twice, or potentially modifying its internal workings, to produce two valid quantum signing keys associated with the same public key?
Scott Aaronson’s work on quantum money and quantum copy protection gave an influential treatment of precisely this issue. His complexity-theoretic no-cloning theorem strengthens the physical no-cloning principle by placing computational limits on producing additional copies even when an adversary has access to a procedure that recognizes the state [3, 4].
A closely related idea is quantum lightning, introduced by Mark Zhandry [5]. The primitive consists of a storm algorithm that produces a quantum signing key, a lightning bolt, together with a corresponding public key. Anyone may run the storm and generate bolts (secret keys), but even someone who knows and controls the generation procedure is unable to produce two valid bolts with the same public key. In other words, lightning may strike anywhere, but it will never strike the same place twice.
One-shot signatures strengthen this idea yet further. Rather than merely associating a quantum state with a public serial number, they allow the state to be used to produce a classical signature on one chosen message. Security then relies on two key ideas: quantum mechanics makes the signing key fragile and impossible to copy perfectly, while computational hardness prevents an adversary from generating several equivalent keys from scratch. As a result, Bob cannot duplicate the quantum authority delegated to him, and using the key to sign one message will cause the key to self-destruct.
From theory to practice
In the construction underlying our implementation, the quantum secret key is a superposition over a hidden affine subspace. One can picture this as a hidden, shifted grid inside a large space of binary strings. The secret key is then a quantum superposition over all the points on the grid. The central operation used for signing is a reflection of this shifted grid.
The original construction established that one-shot signatures are possible in principle and rigorously secure, but it was presented at a high level and did not specify the detailed quantum circuits required to implement it. In our paper, A quantum algorithm for one-shot signatures, we translate the abstract key generation and signing procedures into explicit quantum circuits [6]. We show how to prepare the affine subspace state, implement the required reflections and measurements, and estimate the number of logical qubits and quantum gates as a function of the level of security of the scheme.
An important qualification is that our implementation is pre-obfuscation. A complete cryptographic one-shot signature scheme must conceal certain parts of the published circuits, allowing them to be executed without revealing the secret structure encoded within them. Existing general-purpose obfuscation schemes introduce large overheads, so further theoretical progress on this active area of research will likely be needed before such schemes become practical. Instead, our work isolates the quantum algorithm at the heart of the construction. It provides a concrete baseline quantum circuit that can be compiled, simulated, resource-estimated and iteratively improved. This is the kind of workflow our MIMIQ™ emulator is built for: circuits like these can be simulated, tested and improved at scale, before fault-tolerant hardware is available to run them. In our work, we separate the costs of the underlying quantum computation from those introduced by the additional cryptographic obfuscation machinery.
A view on quantum cryptography
Quantum computing is often presented primarily as a threat to present-day cryptography. Indeed, sufficiently powerful quantum computers will be able to break widely deployed public-key systems (including encryption and signature schemes) based on problems such as integer factorization and discrete logarithms.
The appropriate response to this threat is post-quantum cryptography, i.e. classical cryptographic algorithms based on mathematical problems that are believed to remain difficult even for quantum computers. Strong post-quantum schemes now exist for both establishing secret encryption keys and producing digital signatures as well as many other classical cryptographic primitives and schemes.
One-shot signatures are instead an example of a different part of this story. Rather than protecting classical cryptography from quantum attacks, we can use quantum computing to create an entirely new cryptographic capability with new functionality, security, and privacy features.
This is quantum cryptography in its broadest sense. It is not only quantum key distribution, and it is not only the replacement of RSA with a quantum-resistant classical algorithm. It is the use of quantum information to accomplish tasks that are impossible using classical information alone.
The long-term question is not only how we protect today’s cryptography from quantum computers, but also what new cryptographic capabilities become possible in a world with quantum computers, and how we build them on near-term hardware.
The full paper is available on arXiv [6]. If you would like to know more about this work, or about how we use large-scale emulation to develop and validate quantum algorithms, we would be happy to hear from you.
References
- [1] Ryan Amos, Marios Georgiou, Aggelos Kiayias and Mark Zhandry, “One-Shot Signatures and Applications to Hybrid Quantum/Classical Authentication,” in Proceedings of the 52nd Annual ACM SIGACT Symposium on Theory of Computing (STOC 2020). https://doi.org/10.1145/3357713.3384304.
- [2] Omri Shmueli and Mark Zhandry, “On One-Shot Signatures, Quantum vs Classical Binding, and Obfuscating Permutations,” Annual International Cryptology Conference, 2025. https://arxiv.org/abs/2507.12456.
- [3] Scott Aaronson, “Quantum Copy-Protection and Quantum Money,” in Proceedings of the 24th Annual IEEE Conference on Computational Complexity, 2009. https://doi.org/10.1109/CCC.2009.42.
- [4] Scott Aaronson and Paul Christiano, “Quantum Money from Hidden Subspaces,” in Proceedings of the 44th Annual ACM Symposium on Theory of Computing (STOC 2012), 2012. https://arxiv.org/abs/1203.4740.
- [5] Mark Zhandry, “Quantum Lightning Never Strikes the Same State Twice,” in Journal of Cryptology, 2021. https://arxiv.org/abs/1711.02276.
- [6] Gopikrishnan Muraleedharan, Minh Thuy Truc Pham, Vir Pathak, Thomas Gardner, Chuanqi Zhang, QPerfect and Gavin K. Brennen, “A Quantum Algorithm for One-Shot Signatures,” arXiv:2606.23612, 2026. https://arxiv.org/abs/2606.23612.