What role do Hecke operators and ideal classes perform in "Quantum Money from Modular Forms?"

Question

Cross-posted on QCSE

An interesting application of the no-cloning theorem of quantum mechanics/quantum computing is embodied in so-called quantum money - qubits in theoretically unforgeable states. The initial ideas from the landmark work in the '70s/'80s require a bank to verify each transaction. Accordingly public key quantum money was introduced in the late 2000's.

One of the early proposals of a public key quantum money was based on knots. Here, the qubits for the quantum money are in eigenstates corresponding to knot (grid) diagrams. The eigenstates are indexed by Alexander polynomials, which, in addition to being efficiently calculable, are invariant under Reidemeister (Cromwell) moves. Thus, after confirming that the Alexander polynomial of the quantum money is in the mint's publicly accessible list of minted currencies, vendors can verify that the quantum money is legitimate by running a Markov chain $M$ of Reidemeister moves on the money state $\vert\$\rangle$, and confirming

$$M\vert\$\rangle=\vert\$\rangle$$

Although I find the knots paper, aided by Farhi's exposition, to be quite accessible, enter the recent paper "Quantum Money from Modular Forms," by Daniel Kane. For me modular forms are much more intimidating than knots; however Kane's exposition is very good and I can see some general relation to the previous work on knots.

Nonetheless, I'm getting hung up on section 3.2 onward. I'm wondering how much of a dictionary we can have between the knots work and modular forms.

That is, I know we can say something like there are $d!\times[\frac{d!}{e}]$ grid diagrams of grid dimension $d$, and a uniform superposition of grid diagrams all with the same Alexander polynomial is an eigenstate of a Markov chain of Cromwell moves; not only that, the Markov chain can be made doubly stochastic and easy to apply, and the Alexander polynomial is efficient to calculate.

Does it even make sense to say something roughly as in "there are $\lfloor N/12\rfloor$ cusp modular forms of weight $2$ and level $N$, and a uniform superposition of modular forms all with a same number of ideal classes is an eigenstate of a Hecke operator; not only that, the Hecke operator is Hermitian and easy to apply and the number of ideal classes is efficient to calculate?"

Have I gotten off track?

Answer 1

CW from self-answer

Reviewing Farhi et al. on quantum money from knots, one can say that the Markov chain applied by the verification algorithm that walks along the Reidemeister graph is far from ergodic, as the graph includes many individual connected components corresponding to separate knots. Each bill corresponds to a uniform superposition over individual knots; however, although each bill is an eigenstate of the Markov chain, the eigenvalue $\lambda$ of each eigenstate must be $1$. Up to some technicalities, the Alexander polynomial serves to index each connected component of the Reidemeister graph.

Similarly the putative quantum money from graphs considered by Farhi et al. includes bills corresponding to eigenstates of a Markov chain of a walk along the Cayley graph of permutations of adjacency matrices, with the graph spectrum of the adjacency matrix serving to index the eigenstate; nonetheless the eigenvalue $\lambda$ of each eigenstate is also $1$.

Turning now to quantum money from modular forms considered by Kane, the Hecke operators used therein are all commuting, and although they share an eigenbasis (because they commute), individual Hecke operators and individual bills must have different eigenvalues; indeed for security purposes Kane requires a sufficient separation of eigenvalues of the Hecke operators. These eigenvalues of the Hecke operators are what serve to index the quantum money (as opposed to the knot invariants/graph invariants considered above).

Kane constructs a Hermitian matrix based on the number of ideal classes to correspond to the Hecke operators; this Hermitian matrix is easy enough to work with so that he can perform Hamiltonian simulation thereon (to create his commuting unitary operators), and he applies quantum phase estimation with his operators $U_p$ and samples therefrom to determine the specific eigenvalues $\lambda_1,\lambda_2,\cdots$ for the different Hecke operators/various primes $p$.