The research behind the aim.

What if the hard puzzles turn out to be easy?

Nobody knows whether every problem whose answer is quick to check is also quick to solve. This is the famous "P versus NP" question, and it is still open. Today's digital locks quietly bet that the answer is no. Russell Impagliazzo described five possible "worlds" depending on how this turns out. In some of them, almost every digital lock in use today could be picked.

Why it matters here. A lock that is safe only while a puzzle stays hard is a bet. This project looks for locks that don't make that bet.

Impagliazzo, R. (1995). A personal view of average-case complexity. Proceedings of the 10th IEEE Structure in Complexity Theory Conference. doi.org/10.1109/SCT.1995.514853

Quantum computers.

In 1994 Peter Shor showed that a large enough quantum computer could quickly undo the two kinds of maths that protect most crypto wallets and secure websites today. Machines that big don't exist yet. Many people are working to build them.

Why it matters here. Methods that never relied on a hard puzzle give a quantum computer nothing to solve.

Shor, P. W. (1997). Polynomial-time algorithms for prime factorization and discrete logarithms on a quantum computer. SIAM Journal on Computing, 26(5). doi.org/10.1137/S0097539795293172. Free version: arxiv.org/abs/quant-ph/9508027

Codes used once.

In 1949 Claude Shannon proved that a message scrambled with a truly random key, as long as the message and never used again, cannot be broken. Not by guessing, not by any computer, ever. This is the "one-time pad". The catch is that the keys are long and must be handed over in advance.

What it could do here. Keep payment messages private with a guarantee instead of a bet.

Shannon, C. E. (1949). Communication theory of secrecy systems. Bell System Technical Journal, 28(4). doi.org/10.1002/j.1538-7305.1949.tb00928.x

Secrets cut into pieces.

Adi Shamir showed how to split a secret into many pieces so that any agreed number of them can rebuild it, while fewer pieces reveal nothing at all. Not "a little", nothing.

What it could do here. Spread the keys to your money across many guardians, so no single theft or single bad actor is enough.

Shamir, A. (1979). How to share a secret. Communications of the ACM, 22(11). doi.org/10.1145/359168.359176

A seal that shows tampering.

Mark Wegman and Larry Carter found a way to stamp a message so that anyone who changes it gets caught, using a short key shared in advance. The guarantee holds however powerful the attacker's computer is.

What it could do here. Prove a payment really came from you, without a puzzle-based signature.

Wegman, M. N., & Carter, J. L. (1981). New hash functions and their use in authentication and set equality. Journal of Computer and System Sciences, 22(3). doi.org/10.1016/0022-0000(81)90033-7

Signatures without puzzles.

Researchers have built digital signatures whose safety doesn't depend on any hard puzzle. They cost more: bigger keys, more setup, and each person who checks a signature holds a key of their own. A new 2026 paper adapts the idea for shared ledgers run by many guardians.

What it could do here. Sign payments in a way a quantum computer, or a solved puzzle, cannot forge.

Chaum, D., & Roijakkers, S. (1991). Unconditionally-secure digital signatures. Advances in Cryptology, CRYPTO '90. doi.org/10.1007/3-540-38424-3_15
Hanaoka, G., Shikata, J., Zheng, Y., & Imai, H. (2000). Unconditionally secure digital signature schemes admitting transferability. ASIACRYPT 2000. doi.org/10.1007/3-540-44448-3_11
Bagheri, K., Khodaiemehr, H., & Feng, C. (2026). SILMARILS-MV: information-theoretically secure multi-verifier signatures for permissioned blockchains. arxiv.org/abs/2610.31814

Agreeing when some members cheat.

Leslie Lamport and colleagues proved that a group can still agree on one record when some members lie, as long as fewer than a third of them do. They also proved that a third is the best anyone can do without signatures. They called it the "Byzantine generals" problem.

What it could do here. Keep one honest record of who owns what, with no single keeper and no puzzles.

Pease, M., Shostak, R., & Lamport, L. (1980). Reaching agreement in the presence of faults. Journal of the ACM, 27(2). doi.org/10.1145/322186.322188
Lamport, L., Shostak, R., & Pease, M. (1982). The Byzantine generals problem. ACM Transactions on Programming Languages and Systems, 4(3). doi.org/10.1145/357172.357176

Working together without seeing each other's secrets.

In 1988 two research teams showed that a group can jointly compute any result, such as checking a balance or issuing a new key, without any member seeing the others' secrets. It works as long as enough of them are honest.

What it could do here. Hand out keys and check payments with no single trusted dealer.

Ben-Or, M., Goldwasser, S., & Wigderson, A. (1988). Completeness theorems for non-cryptographic fault-tolerant distributed computation. STOC '88. doi.org/10.1145/62212.62213
Chaum, D., Crépeau, C., & Damgård, I. (1988). Multiparty unconditionally secure protocols. STOC '88. doi.org/10.1145/62212.62214
Rabin, T., & Ben-Or, M. (1989). Verifiable secret sharing and multiparty protocols with honest majority. STOC '89. doi.org/10.1145/73007.73014

Keys carried by light.

Charles Bennett and Gilles Brassard showed how to send a key on single particles of light. Anyone who listens in disturbs the light and can be detected. It needs special equipment, works over limited distances, and still needs a small shared secret to start.

What it could do here. Refill the guardians' secret keys safely, even in a world where every puzzle is solved.

Bennett, C. H., & Brassard, G. (1984, reprinted 2014). Quantum cryptography: public key distribution and coin tossing. Theoretical Computer Science, 560. doi.org/10.1016/j.tcs.2014.05.025

Money that physics won't let you copy.

Stephen Wiesner imagined banknotes made of quantum states, which the laws of physics forbid anyone from copying. The catch: only the bank can check them, and keeping quantum states stable is still very hard today.

What it could do here. A long-term path to cash that can't be counterfeited.

Wiesner, S. (1983, written around 1970). Conjugate coding. ACM SIGACT News, 15(1). doi.org/10.1145/1008908.1008920

Safety from limited memory.

Ueli Maurer showed that a secret can be kept safe from an attacker who cannot store a huge stream of random data, however fast their computer is. The bet moves from "the puzzle is hard" to "the attacker's storage is limited".

What it could do here. A way to agree on fresh keys without meeting in person.

Maurer, U. M. (1992). Conditionally-perfect secrecy and a provably-secure randomized cipher. Journal of Cryptology, 5(1). doi.org/10.1007/BF00191321

A quantum-secured shared ledger.

A 2019 design for a ledger run by a known group, using quantum-secured signatures and voting instead of mining.

Sun, X., Sopek, M., Wang, Q., & Kulicki, P. (2019). Towards quantum-secured permissioned blockchain: signature, consensus, and logic. Entropy, 21(9). doi.org/10.3390/e21090887

A quantum-secured payment, for real.

In 2023 a research team made a payment protected by single particles of light over a real city fibre network. It was a test, not a currency.

Schiansky, P., et al. (2023). Demonstration of quantum-digital payments. Nature Communications, 14. doi.org/10.1038/s41467-023-39519-w

An open network can be flooded with fakes.

John Douceur showed that in a network anyone can join, one person can pretend to be many unless something scarce, or an authority that checks identities, stops them. Bitcoin uses computing work as that scarce thing, and that work is itself a puzzle.

What it means here. A puzzle-free coin would most likely start with a known set of guardians, rather than being open to anyone from day one.

Douceur, J. R. (2002). The Sybil attack. Peer-to-Peer Systems, IPTPS 2002. doi.org/10.1007/3-540-45748-8_24

Paying when the power is out.

David Chaum, Amos Fiat and Moni Naor designed electronic cash you can spend without a connection: anyone who spends the same coin twice is exposed once the coins are handed in later. Their version relies on puzzle-based maths. A version that works offline with no puzzles at all has not been found yet.

What it means here. Of our three aims, working without power is the least solved. That is exactly why we are naming it.

Chaum, D., Fiat, A., & Naor, M. (1990). Untraceable electronic cash. Advances in Cryptology, CRYPTO '88. doi.org/10.1007/0-387-34799-2_25