← Blog/Thesis
Thesis 001 / Vision and research

Photonic Cash for the Next Era of Compute

Building post-quantum money.
Exploring photonic proof of work.

17 min read
Two technological betsThree research generationsOne public record
Contents

IThe inheritance problem

Every monetary network carries the physics of the era that built it. Bitcoin's two deepest dependencies, the elliptic-curve signatures ordinarily used to authorize spending and the SHA-256 hashing that secures every block, were the right choices in 2009. They were also choices, and a network cannot easily revisit its physics once value rests on them.

Seventeen years later, both dependencies answer to forces outside the network's control. The first is cryptographic. A sufficiently large quantum computer running Shor's algorithm breaks elliptic-curve signatures. According to BIP-361, more than 34% of bitcoin had an exposed on-chain public key as of March 1, 2026.

The incumbent's own community is debating what to do about it. That 2026 draft proposes a phased sunset of legacy signature use after activation, with later spending subject to quantum-safe rescue conditions. Funds that are neither migrated nor recoverable under those conditions could become unspendable; the proposal leaves the extent of rescue coverage unresolved. It remains a draft, not an adopted policy. A cryptographers' council convened by Coinbase examined the abandoned-coins question without recommending a single policy. Whatever the outcome, every chain built on the same curves inherits the same dilemma: once a signature scheme is forgeable, the network's original test for ownership no longer distinguishes the rightful owner from an attacker, and the protocol must decide which old authorizations to keep honoring and on what evidence.

The second force is industrial. Proof-of-work security is purchased with hardware, and Bitcoin mining has developed a specialized industry around SHA-256. A new computational substrate has to compete on that existing workload to mine Bitcoin. Changing the workload itself would require a change to consensus rules. The choice of function therefore shapes which future hardware can compete, even though it cannot determine which hardware will win.

These are not criticisms of Bitcoin. They are observations about inheritance. A monetary network has three promises to keep: that only you can authorize spending your money, that the network agrees on whether it has already been spent, and that changes to the system preserve your ability to use it under the conditions you accepted. Signatures protect the first, proof of work the second, and upgrade rules the third. A network can succeed at one and fail at another, and a network designed today can choose its physics for all three. Laser is an attempt to do that: a proof-of-work currency whose account layer uses the post-quantum signature standard from its first transactions, whose mining function is shaped around matrix computation that both electronic and photonic hardware can perform, and whose protocol plans for the replacement of its own cryptography rather than pretending that day never comes.

The canon is small and fixed. 137,000,000 LASER, never more, the number a nod to the fine-structure constant. One LASER is a billion photons. Issuance decays smoothly with a four-year half-life rather than stepping down at halvings. The genesis block is inscribed fiat lux. Everything else is an engineering decision, and most of what follows is an account of those decisions and what we have measured about them.

IIThe two bets

A project that says "quantum computers are coming" and "photonics is the future" has said nothing falsifiable. Laser's two bets are narrower than that, and we think they are more persuasive for being narrow.

The quantum bet is about timing, not cryptography. Post-quantum signature standards exist, and the incumbent's governance debate shows the migration question is live. What is not agreed is when the transition becomes urgent, and whether a chain that never had a curve-based account layer earns a durable premium over chains that retrofit one. There is an earlier precedent: QRL launched with post-quantum signatures in 2018. That precedent gives us no basis to assume automatic adoption.

So the bet is this: that quantum urgency arrives in a window where having no elliptic-curve accounts to migrate is worth something to the people choosing where to hold value. Laser's account authorization uses ML-DSA-65, the lattice-based signature standardized by NIST as FIPS 204 and believed to resist attack by large quantum computers, from its first transactions. Its account layer begins without elliptic-curve signatures. That standardization is a statement about the algorithm family, not a guarantee that any implementation or system built on it cannot fail. The protocol also plans for its own eventual scheme retirement through a signature-agility specification, because no algorithm is permanent and a design that pretends otherwise is making the same mistake it set out to avoid.

The photonic bet is about energy, not about photonics in general. Photonic computing may succeed broadly, in AI inference, interconnects, and telecommunications, without this bet paying off. Those applications have reasons to develop optical hardware regardless of anything a monetary network does. What Laser needs is narrower. It needs a complete photonic miner, measured end to end across modulation, detection, conversion, control, hashing, and rechecking, to produce valid proof-of-work at lower total system energy per correctly evaluated attempt than the best electronic alternative. That is a claim about one workload, measured one way, against silicon that improves continuously on someone else's money. We have not demonstrated it, and the public PhotonHash record contains no such end-to-end result. The rest of this thesis describes what we have measured instead.

The two bets are distinct technological contingencies. Either one being realized would make Laser a network built in advance for that event. Neither is required for the network to function, and Section IV is about what the network is for while both clocks run.

IIIWhat we've been working on

PhotonHash is a family of proof-of-work constructions designed to concentrate cost in matrix multiplication. The idea is not ours. The 2019 Optical Proof of Work paper introduced HeavyHash as a hash-matrix-hash construction for optical mining. LightHash, first posted in 2022 and published in Optica in 2023, demonstrated a low-bit photonic hashing prototype on programmable silicon photonics. Stanford's licensing record lists an issued US patent associated with it. PhotonHash is a distinct pipeline within that lineage. What we think we have added is not the construction but the record of testing it.

The design logic is simple to state. A matrix-vector product is one operation photonic hardware can perform natively: in a suitable optical architecture, configured elements weight and mix light that encodes the input, and the output signals represent the product. That is an intuition about a computational primitive, not a claim that a complete matrix bank fits economically into one practical device. It is also an operation the AI industry has spent the better part of a decade optimizing silicon for. Electronic and optical hardware can compete on the same frozen function without changing consensus; adopting a different function, such as LF2-K8 in place of the active profile, would require a separate consensus decision. The matrices are derived from the parent block, so a miner can reuse them across many nonce attempts. The arithmetic is exact low-bit integer math, requantized and hashed, so every implementation, electronic or optical, must reproduce the same digital result.

Generation one: the hypothesis fails. Our original profile, v0.2, set a target that the matrix stage should account for at least 90% of a miner's work, on the reasoning that a photonic accelerator can only speed up the part of the pipeline it runs. In July 2026 we built a CUDA implementation and measured it across five parent-derived matrices, three batch sizes, and five repeats, with at least one hundred million attempts per sample. Before timing, reference checks covered the sequential path and all eight pipeline slots: 10,800 complete trace comparisons across the sweep. All seventy-five samples passed those checks. The matrix stage accounted for 11 to 12% of device time on an RTX 5090. The hash stages dominated. The hypothesis had failed by its own stated criterion. The baseline report records the procedure and results.

We also examined 1,000 parent-derived matrices and tested approximation methods on 1,280 vectors, including low-rank approximations and column skipping. None of the tested approximations reproduced a complete exact output in that corpus. These finite tests do not establish cryptographic security. The measured failure was the headroom target. Increasing matrix dimension changes the balance between the digital stages and matrix work, but the published scaling analysis did not establish a practical way to restore the 90% target by dimension alone. We published the result as a negative baseline. PhotonHash v0.2.2 remains the active consensus profile on the experimental network; what it lost was the claim to the targeted photonic headroom. We attach no demonstrated photonic advantage to it.

Generation two: the fix that worked, and why we archived it. The obvious repair was to chain matrix rounds, applying an exact nonlinear transition between products without fresh hashing between rounds. A fused electronic implementation reached roughly 93 to 94% conditional photonic-accelerable share, including that transition. But the tested boundary models did not establish a physically grounded route through our conservative 3× complete-system admission gate after exactness, correction, conversion, and control were counted. Full optical-to-electrical conversion between rounds was one route we evaluated; alternatives faced their own regeneration and error costs. Some modeled paths retained a smaller advantage, but fell short of the admission threshold. We archived R1 on that evidence. The lesson is narrower than "serial is bad": that particular way of manufacturing matrix dominance moved the difficulty into interfaces we had not shown how to implement economically. The boundary decision separates electronic measurements, physical models, and missing evidence.

Generation three: the current candidate. LF2-K8 takes one nonce-derived vector and multiplies it against eight independent 4096×4096 matrices in parallel, with no pass feeding the next. The results are requantized exactly, folded, and hashed once. That is 134,217,728 multiply-accumulates per attempt, a count that describes the mathematical workload rather than a floor on what any implementation must spend; finding cheaper equivalent evaluations is part of the adversarial program. The matrix bank is 128 MiB with one byte per value and 64 MiB packed, and miners batch many nonces against the same bank, so its size alone does not establish where an optimized electronic miner's bottleneck sits. Measured on the same hardware: roughly 62% of execution time in the matrix stage. It is frozen as a non-consensus candidate under a public qualification list covering pass omission, approximate outputs, precomputation, batching, fusion, matrix-bank amortization, FPGA implementations, and ASIC cost models. The honest research question is not whether the bank is large; it is whether, after electronics exploits every practical form of reuse, an optical implementation retains an advantage big enough to survive its own conversion, precision, and support costs.

What 62% means. It establishes headroom, not an advantage. If the matrix stage were made free and everything else in that measured, serialized pipeline stayed unchanged, the attempt would run about 2.6 times faster. That is a bound on replacing one stage in one pipeline, not a ceiling on every future architecture, and it says nothing about energy: a stage that takes 62% of execution time need not account for 62% of total system energy. The measurement that matters is total system energy divided by the number of correctly evaluated attempts, where failed optical outputs count against the machine that produced them.

In a hypothetical comparison, an optical system spending 100 microjoules per attempt at 20% correctness costs 500 microjoules per correct attempt, and loses to electronics at 250 microjoules per correct attempt.

Exactness is where this gets hard: each LF2 output sums thousands of products and is then assigned to a precisely defined bucket, so an analog error that nudges a sum across a boundary changes the symbol and the final digest. The optical machine does not have to reproduce every internal quantity, but it has to produce the correct digital result, with every recheck and rejection inside its energy bill. That is the experiment the construction now makes runnable. We built the instrument. The measurement belongs to whoever brings the hardware.

A June 2026 preprint by Abhinaba Basu reported pool-accepted Pearl shares from a miner using random matrices without AI inference, illustrating the distinction between verifying computation and establishing useful work. That is a different claim from PhotonHash's photonic-headroom hypothesis. Our own failed headroom target is documented in the public baseline, alongside the experiments that followed it. Publishing a negative result makes the claim inspectable. It does not replace independent reproduction.

IVMoney that can be held while the clocks run

A network whose entire value depends on two unscheduled events is a position on clocks its builders do not control, and a careful observer discounts it accordingly. We take that seriously. The design question is what Laser is for in the years before either clock strikes, and our answer is a single quality we are designing toward rather than a list of features.

That quality is permanence, understood correctly. Not the permanence of a fossil, which is frozen, but the permanence of a thing that survives change. The post-quantum account layer is intended to preserve ownership across a cryptographic transition. The intended monetary launch, with no premine, no sale, and founders mining under the same rules as everyone, aims at permanence of legitimacy: no privileged original allocation whose provenance can later be contested. Today's Shadownet is an experimental, resettable network, not that monetary launch. The signature-agility specification plans for the day its own signature scheme is retired instead of pretending that day never comes. Each of these choices concerns how money could survive change; none guarantees that it will.

The work in progress follows the same discipline. We are specifying a mechanism we call Amber: a bounded, account-level lock that commits funds until a future block height while allowing the authorization protecting them to be upgraded. Think of replacing the lock on a timed safe without opening the safe or changing its release date.

The existing signature-agility rules do not solve this; they migrate funds by an ordinary transfer between typed addresses while both schemes are live, and an account's scheme does not change in place, so a lock that outlasts a scheme's retirement is exactly the case they cannot handle. Amber needs an additional, precisely defined mechanism, and the hard part is not the lock. It is answering what proves a migration was authorized, how the original lock is preserved, whether migration can quietly transfer control to someone else, how fees are paid without eroding locked principal, what an owner must do through a retirement, and which cases are unrecoverable.

One boundary is fixed before design begins: if the only accepted proof of ownership is already forgeable, an attacker can submit an apparently valid migration too, and no mechanism recovers the distinction without evidence established beforehand. Prior work exists, in Zcash's quantum-recoverability proposal, which prepares future ownership evidence in advance, and in Bitcoin's migration debate. Amber's contribution, if it has one, has to emerge from precise design and comparison with that work.

And a lock is useful only to someone who already has a reason to commit; locking coins does not by itself create demand, and an on-chain release condition is narrower than preventing every way of transferring economic exposure to them.

The network architecture follows a doctrine the project adopted in July: the money chain stays minimal, and every opinionated surface lives on a child chain secured by merge-mining against the parent. Commodities, data, experiments, and anything that can fail loudly belong on children, where they can evolve or fail without changing what it means to send LASER. If that architecture matures, the parent's proof of work could become a shared security resource. Three things do not follow automatically: a child does not inherit every parent miner's work, shared proof of work does not make a bridge safe, and child-chain activity does not by itself create demand for LASER. Such demand requires a reason to acquire, hold, or spend LASER, whose economic effect must be demonstrated. Nor would a child's own authorization become post-quantum merely by sharing the parent's mining work. We state the architecture as a direction. The merge-mining program, its fee mechanism, and its bridge threat model are unwritten, and we will not describe them as more than that.

We say nothing here about privacy beyond this: we are studying post-quantum private payments as a bounded research question, and we have no specification, no claim, and no timeline. A later ownership migration cannot erase information already disclosed or make an adversary's stored copy of vulnerable ciphertext safe. That is a reason to study historical confidentiality before deployment, and a reason not to market privacy until the study is done.

The honest summary of Section IV is that Laser is a long-shot option with two distinct triggers, and a proposed foundation whose design does not depend on either: post-quantum authorization, a launch intended to withstand scrutiny, and an engineering record that has so far preferred the true number to the good one. A fixed supply gives predictability about issuance, not purchasing power. A fair launch removes an insider allocation, not criticism. A migration mechanism preserves access under specified conditions, not every lost key. These rules make the asset legible; demand still has to make it valuable, and the remaining question is the one no amount of engineering answers by itself: whether an identifiable group of people can explain why these properties make LASER worth holding before either external event becomes urgent. The research described above provides technical evidence. That question needs evidence from people, and we intend to go and get it.

VWhat would change our mind

A thesis arguing for a long bet owes its reader the conditions under which the bet is lost. A useful falsifier names the claim, the comparison, and the conditions, and a result falsifies only what it tested: one optical system losing under one set of conditions retires that system and its assumptions, not every future architecture. With that discipline, these are ours, in the order we think they are most likely to be tested.

An electronic implementation that dominates LF2-K8. The candidate's qualification list names the attacks we have not ruled out: pass omission, approximate outputs, precomputation, batching, fusion, amortization across the matrix bank, FPGA implementations, and ASIC cost models. A stronger electronic implementation can mean different things: a legitimate improvement both sides must then compete against, an unintended shortcut, or the elimination of any opportunity for the current candidate. If a specialized electronic design evaluates LF2-K8 at a cost that removes the opportunity, the photonic bet loses its lever for this candidate and the function is just another proof of work. We would say which of those outcomes it was, and redesign or retire accordingly.

A measured photonic loss. If a complete photonic system, measured across conversion, control, calibration, hashing, and rechecking, produces correct work at higher energy per correct attempt than the best electronic alternative under stated operating conditions, that system fails the energy-advantage claim under those conditions. The photonic bet would need a different, supported implementation path. We have already published one hypothesis that failed its stated criterion. We would publish this one the same way.

A structural break in the construction. The historical 1,280-vector approximation corpus concerned v0.2, not LF2-K8. None of its tested methods reproduced a complete exact output, but that does not establish security for either construction. LF2-K8 requires its own adversarial qualification. A cryptanalytic result that lets a miner bypass intended work is a different kind of failure from an economic one, and could require surgery on the construction rather than retuning.

A quantum timeline that never becomes urgent within any horizon that matters. The first bet is about timing. If large-scale quantum computers remain distant long enough for the incumbent to migrate at leisure, the premium for having been born post-quantum may never be paid. The account layer could continue to function under its security assumptions. Its head start would not by itself be a reason to hold the coin.

A failure of the foundation itself. If the mechanisms we are designing toward, long-duration custody that survives scheme retirement, a minimal money chain with children beside it, cannot be specified with failure cases and acceptance criteria that an independent reviewer accepts, then Section IV's foundation is weaker than this thesis claims, and the network is a pure option after all.

We list these because the alternative is to let someone else list them. A monetary network's credibility is the sum of the claims it has survived, and the fastest way to accumulate that record is to state what would break the claim before anyone has to find it. That is how the proof-of-work function has been developed, in three public generations, and it is how the rest of the network will be developed.

Fiat lux.

REFSources and public artifacts

The empirical figures and prior work cited here are public. The energy example is hypothetical, and the proposed mechanisms and economic case remain design intentions to be tested.

This thesis describes intent and measurement. It is not a specification, a security claim, or a prediction of market outcome. Shadownet coins are not money.