A quantum digital signature (QDS) lets Alice sign a classical bit so that Bob and Charlie can both verify it later, and neither one — nor an outside forger Eve — can alter it undetected, using only the impossibility of perfectly distinguishing two non-orthogonal quantum states.
Public key for bit 0: |α⟩ (coherent state, phase 0)
Public key for bit 1: |−α⟩ (coherent state, phase π)
Overlap: s = |⟨α|−α⟩| = e^(−2|α|²)
Alice sends L independent copies of the correct public key to each recipient before signing. To verify a signed bit, a recipient performs unambiguous state discrimination (USD) on each copy — a measurement that either identifies the state correctly or returns "inconclusive," but never confidently returns the wrong answer. The optimal USD failure (inconclusive) probability for two equally-likely states with overlap s is exactly s.
P(inconclusive per copy) = s = e^(−2|α|²)
P(forge all L copies) ≈ s^L = e^(−2|α|²·L)
Accept rule: mismatch fraction over L copies ≤ threshold s_a
- |α| slider — coherent-state amplitude. A larger α pushes the two phase-space clouds (|α⟩ and |−α⟩, rendered as scattered point clouds with the intrinsic quantum shot-noise radius σ=1/2) further apart, shrinking the overlap s.
- Copies L — how many quantum public-key copies back the signature. Security grows exponentially in L because Eve must fool every USD test simultaneously.
- Threshold sa — the mismatch rate a legitimate recipient tolerates (real channels are noisy, so some inconclusive results are expected even from an honest key).
- Bob verifies — samples L honest copies of the claimed public key and runs the USD test on each; the mismatch rate should sit near the theoretical overlap s.
- Eve attempts forgery — Eve has no valid key, so she must guess; each of her L guesses independently succeeds against USD with probability ≈ s, so her overall forgery only survives if her simulated mismatch rate randomly falls below s_a — increasingly unlikely as L grows.
This is the coherent-state scheme (Andersson–Curty–Jex / Clarke et al.) — one of the first quantum digital signature protocols realized experimentally without a trusted quantum memory, distinct from quantum key distribution (which shares a secret key) or quantum teleportation (which moves a state): here the security goal is unforgeable authorship of a classical message.