Pith. sign in

REVIEW 3 major objections 4 minor 41 references

A Unified Approach to Quantum Key Leasing with a Classical Lessor

T0 review · 3 major / 4 minor · reviewed 2026-08-04 · deepseek-v4-flash

Challenge this review Re-run · record.json Download PDF Read on arXiv ↗

Pith's one-line read A classical lessor can lease, use, and verifiably revoke quantum keys for public-key encryption, pseudorandom functions, and digital signatures, all under the learning-with-errors assumption.

desk verdict Strong modular SKL paper with real firsts, but the DS 'under LWE' claim overreaches and the load-bearing SFE construction is deferred to a missing appendix. read the letter →

arxiv 2510.08079 v2 pith:VY3HO3FS submitted 2025-10-09 quant-ph cs.CR

Fuyuki Kitagawa , Jiahui Liu , Shota Yamada , Takashi Yamakawa This is my paper · ORCID
classification quant-phcs.CR
keywords securekeyleasingclassicallessorquantumrevocationVRAsecuritynoisytrapdoorclaw-freefunctionsdual-modefunctionevaluationwatermarkingLWEassumption
verification ladder T0 review T1 audit T2 compute T3 formal

The pith

A machine-rendered reading of the paper's core claim, the machinery that carries it, and where it could break.

The reading

The paper claims a modular framework for secure key leasing in which the lessor is entirely classical: both the leasing and the revocation of a quantum secret key happen over classical communication. It shows that any post-quantum IND-CPA public-key encryption scheme can be upgraded to a PKE-SKL scheme, and it constructs the first classical-lessor PRF-SKL and DS-SKL schemes. All three schemes are proven secure against verification-key revealing attacks (VRA security) under the LWE assumption. The central step is to make the lessee prepare the unclonable BB84-style quantum key from purely classical data, then verify deletion through the cut-and-choose adaptive hardcore bit property of NTCF functions and the parallel extractability of watermarking.

What carries the argument

The load-bearing object is a special dual-mode secure function evaluation (SFE) with five simultaneous properties: mode indistinguishability, statistical security against malicious senders in the hiding mode, state recoverability in the hiding mode, extractability in the extraction mode, and an efficient state superposition property with decomposable states. The decomposability identity c_i·(st0⊕st1) = d*_i·(a0⊕a1) is what lets the verifier convert a deletion certificate into a hardcore-bit relation, while the watermarking parallel-extraction property converts a successful decryptor into the computational-basis preimages. These two together contradict the cut-and-choose adaptive hardcore bit

What would settle it

Exhibit an explicit LWE instantiation of the special dual-mode SFE and show either that state recoverability fails for some adversarially chosen first message, or that the coherent version of Rec1 leaves entanglement with the randomness; either would break the deletion-verification step. Alternatively, construct a quantum adversary that passes deletion verification and then decrypts the PKE-SKL challenge ciphertext with non-negligible probability while LWE remains hard.

Watch

Extended reading notes

Core claim

The paper's central claim is a compiler that transforms any cryptographic primitive equipped with parallel-extractable watermarking into a classical-lessor SKL scheme, provided the primitive's functionality is preserved under parallel composition. The compiler uses a cut-and-choose split: some positions use injective-mode NTCF functions so the quantum key contains a single preimage, while others use two-to-one mode so the key contains a superposition of two preimages; a special dual-mode SFE lets the lessee build the quantum key from a claw state. Deletion verification works because a valid deletion certificate in the Hadamard basis, combined with preimages extracted from a successful decryp

Load-bearing premise

Everything rests on the LWE-based construction of the special dual-mode SFE satisfying all five required properties simultaneously, most crucially that the receiver's state decomposes bitwise and can be prepared in superposition without residual entanglement with the randomness; if this one construction fails any property, the entire compiler collapses.

Editorial extensions

If this is right

  • Any post-quantum IND-CPA PKE can be made revocable with a fully classical lessor under LWE, without changing the underlying encryption scheme.
  • The first classical-lessor PRF-SKL and DS-SKL schemes exist; for signatures, both signing key and signature size stay polynomial and independent of the number of issued signatures.
  • PKE-SKL achieves non-interactive quantum key generation with a classical lessor, a property not achieved by prior classical-lessor constructions.
  • VRA security holds for all three schemes, meaning the deletion verification key can be leaked after a valid deletion certificate without breaking revocation.
  • The framework is generic: any primitive with parallel-extractable watermarking that is closed under parallel composition can be upgraded to classical-lessor SKL via the same compiler.

Reading between the lines

Editorial extensions of the paper, not claims the author makes directly.

  • The compiler suggests a general recipe for classical-client quantum delegation: if a functionality has a watermarkable key and parallel composition, it can be leased and revoked with a classical lessor, so analogous schemes for ABE, FHE, or functional encryption may follow once watermarkable variants exist.
  • The special dual-mode SFE properties, especially efficient state superposition and decomposable states, could be reused to build classical-client blind state preparation with negligible security, bypassing the inverse-polynomial barrier of generic RSP protocols.
  • The cut-and-choose structure might be adaptable to collusion-resistant leasing: if parallel mark extraction can tolerate multiple copies per position, the same framework may yield schemes that support an a-priori bounded number of leased keys.
  • The reliance on LWE is partly structural (NTCF and special SFE) and partly for the watermarkable signatures; replacing the signature watermarking with a post-quantum OWF-based construction would still require SIS for the coherently-signable constrained signatures, so a fully OWF-based DS variant seems unlikely.
Share X Bluesky LinkedIn Reddit HN

Editorial analysis

A structured set of objections, weighed in public.

Desk editor's note, referee report, and a circularity audit.

Referee Report

3 major / 4 minor

Summary. The paper proposes a modular framework for constructing secure key leasing (SKL) with a fully classical lessor. The key idea is to compile any parallel-extractable watermarkable cryptographic functionality (PKE, UPF/PRF, or digital signature) into a classical-lessor SKL scheme using two lattice-based tools: noisy trapdoor claw-free functions (NTCF) and a non-standard 'special dual-mode secure function evaluation' (SFE), together with a cut-and-choose adaptive hardcore bit lemma. The authors claim PKE-SKL, PRF-SKL, and DS-SKL, all satisfying VRA security, under LWE. The PKE construction is given with a detailed hybrid proof; the PRF and DS constructions are presented in the body, and the LWE realization of the special SFE is deferred to Appendix A. A non-interactive key-generation variant of PKE-SKL is also given.

Significance. If the claims are correct, this is a substantial contribution: it unifies several ad hoc SKL constructions, gives the first classical-lessor PRF-SKL and DS-SKL schemes, achieves VRA security, and obtains non-interactive key generation for PKE-SKL. The modular watermarking-based compiler is elegant and the explicit use of parallel mark extractability is a genuine technical simplification over prior preimage-extraction arguments. The paper also credits and cleanly reuses known building blocks (NTCF, TEPRF, constrained signatures), and the PKE-SKL security proof is detailed. The main caveats are that the central SFE tool is non-standard and its LWE realization is not verifiable from the submitted text, and that the DS scheme actually rests on SIS rather than a pure LWE assumption.

major comments (3)
  1. [Section 4, Definition 4.1 and Theorem 4.2] Definition 4.1 is the linchpin of the entire framework. The compiler (Section 6.1, IntKeyGen) requires SFE.Rec1 to be applied coherently to an NTCF superposition with no residual entanglement with the receiver's randomness, and later requires the unique-state and state-recoverability properties in the hiding mode. These are not standard properties of dual-mode OT/SFE and cannot be taken for granted. The only support is Theorem 4.2, whose proof is deferred to Appendix A. In the reviewed manuscript, Appendix A is listed in the table of contents but is not included in the supplied text, so the construction and proof of these properties cannot be checked. Since every scheme (PKE-SKL, PRF-SKL, DS-SKL) and every security proof (Theorems 6.2, 7.2, 8.2) imports this SFE, this is a load-bearing omission. Please provide the full appendix, or an explicit construction and proof in the main text.
  2. [Abstract and Section 3.3 / Lemma 2.9] The abstract states that all three schemes are proven under LWE. However, the DS-SKL construction uses watermarkable digital signatures whose construction (Section 3.3) relies on coherently-signable constrained signatures. Lemma 2.9, cited from [KMY25], assumes SIS with a subexponential modulus-to-target-norm-bound ratio. No LWE-to-SIS implication is stated or proved. Thus, as written, the DS result is at best under SIS (together with LWE for the NTCF/SFE), not under LWE alone. The same applies to Table 3. This is a load-bearing overclaim and should be corrected in the abstract, introduction, and theorem statements.
  3. [Lemma 2.12 and Lemma 6.4] As typeset, the cut-and-choose experiment in Lemma 2.12 sends the adversary the trapdoors {td_i}_{i∈S} for the injective-mode positions S in Step 5, while Step 6 asks for preimages x_i for exactly those positions. With the trapdoors in hand, the adversary can trivially run Invert(pp_i,td_i,y_i) and win with probability 1, making the stated lemma false. Moreover, the reduction in Lemma 6.4 needs the trapdoors for the two-to-one positions S̄ in order to form the deletion verification key dvk. I suspect this is a typesetting/OCR inconsistency and the intended set is {td_i}_{i∈S̄}, but as written the lemma is internally inconsistent. Please fix the notation and check all subsequent applications.
minor comments (4)
  1. [Definition 5.1] The algorithm tuple is written as '(IntKeyGen,Enc,Dec,Dec,Del,DelVrfy)' with 'Dec' appearing twice. This should be cleaned up to distinguish the lessor's decryption algorithm from the lessee's quantum decryption algorithm.
  2. [Section 3.1, Theorem 3.1 proof] The proof uses 'Exppar-pre' and 'Exppar-ow' inconsistently when referring to the parallel one-way inversion game. This is a naming typo but should be harmonized for readability.
  3. [Section 7.2, Lemma 7.3] In the reduction's Step 4, the text refers to 'WPKE.dk_i(x_i)' and 'WPKE.msk_i' in a WUPF context; these should be WUPF.key_i(x_i) and WUPF.msk_i. The proof is understandable, but the notation is confusing.
  4. [Section 6.1, ingredient list] The special SFE is introduced as 'SFE=SFE.(Rec1,Send,Rec2)' but Definition 4.1 includes CRSGen as a fourth algorithm. The ingredient list should include CRSGen to avoid ambiguity.

Circularity Check

0 steps flagged · score 2.0 of 10

No significant circularity: central proofs are new reductions over cited external building blocks.

full rationale

The derivation chain is not circular in the sense of the rubric. The VRA security notion is adopted from the authors' [KMY25], but as a definition, not as a proof of the present theorems. The cut-and-choose adaptive hardcore property is imported as Lemma 2.12 from [HMNY21] (with overlapping author Yamakawa), and the coherently-signable constrained signatures are imported as Lemma 2.9 from [KMY25]; these are external, peer-reviewed results that do not state the target theorem or assume the final SKL schemes. The main work—Theorems 6.2, 7.2, and 8.2—is a series of explicit hybrid reductions in this paper (e.g., Hyb0-Hyb8 in Section 6.2) that reduce OW-VRA/UPF-VRA/RUF-VRA security to the cut-and-choose NTCF property, special dual-mode SFE, and parallel mark extractability. The parallel mark extractability is itself proved from IND-CPA/OWF/TEPRF in Section 3. No fitted parameter is renamed as a prediction, and no target equation is reused as an assumption. The two genuine weaknesses are correctness risks, not circularities: (1) Theorem 4.2 asserting special dual-mode SFE from LWE is deferred to Appendix A, which is not present in the supplied text, so its non-standard 'unique state', 'state recoverability', and 'efficient state superposition' properties are asserted here and not exhibited; (2) the abstract's 'under LWE' overstates the DS scheme, which additionally uses SIS-based coherently-signable constrained signatures (Lemma 2.9). Neither weakness makes the derivation equivalent to its inputs.

Assumptions & free parameters 0 free parameters · 7 assumptions · 1 invented entities

The central constructions rest on standard hard lattice problems (LWE and, for the signature path, an SIS-derived constrained-signature building block), plus a set of cryptographic building blocks that the paper either cites (TEPRF, constrained signatures from [KMY25]) or proves from LWE (NTCF, special SFE). No fitted parameters appear; only standard asymptotic choices such as ℓ=ω(logλ), w=ω(logλ), n=ω(logλ) are used. The new primitive is a formal definition rather than an empirical entity; its only evidence is the construction given in the text/appendix.

assumptions (7)
  • domain assumption Hardness of LWE against QPT adversaries
    Root assumption for NTCF (Lemma 2.11), special SFE (Thm 4.2), and ultimately all three constructions.
  • domain assumption Existence of one-way functions / TEPRFs
    Used for watermarkable UPF (Thm 2.4); OWF is implied by or subsumed by lattice assumptions, but the paper states it as a separate assumption.
  • domain assumption SIS hardness for coherently-signable constrained signatures
    Lemma 2.9 gives CS from SIS; used in DS-SKL and watermarkable DS (§3.3). The relation to LWE is not stated in the theorem summary.
  • domain assumption Coherent-signability, function privacy, and selective single-key security of the CS construction
    Taken from [KMY25] (Lemma 2.9); not re-proved in this paper.
  • standard math Quantum Goldreich-Levin lemma
    Upgrades OW/UP security to IND/PR security (Lemmas 5.8, 5.10, 5.18).
  • domain assumption Cut-and-choose adaptive hardcore property of NTCF
    Lemma 2.12 adapts [HMNY21]; the reduction from LWE to NTCF (Lemma 2.11) is external.
  • standard math Gentle measurement lemma
    Justifies reusability of quantum keys (Remarks 5.4, 5.14).
invented entities (1)
  • Special dual-mode SFE with efficient state superposition and state decomposability
    purpose: Lets the classical lessor cause the quantum lessee to prepare a watermarked unclonable key state from classical communication, while preserving the superposition needed for deletion.
    This is a new definition (§4), not an empirical entity; the evidence is the LWE-based construction in Appendix A, which I could not fully verify from the truncated text.

how reviews work

0 comments
Cite this review

Pith. "Pith review of A Unified Approach to Quantum Key Leasing with a Classical Lessor." pith.science (2026). https://pith.science/paper/VY3HO3FS

@misc{pith2026251008079,
  author       = {Pith},
  title        = {Pith review of: A Unified Approach to Quantum Key Leasing with a Classical Lessor},
  year         = {2026},
  howpublished = {\url{https://pith.science/paper/VY3HO3FS}},
  note         = {Machine review of arXiv:2510.08079}
}
read the original abstract

Secure key leasing allows a cryptographic key to be leased as a quantum state in such a way that the key can later be revoked in a verifiable manner. In this work, we propose a modular framework for constructing secure key leasing with a classical-lessor, where the lessor is entirely classical and, in particular, the quantum secret key can be both leased and revoked using only classical communication. Based on this framework, we obtain classical-lessor secure key leasing schemes for public-key encryption (PKE), pseudorandom function (PRF), and digital signature. We adopt the strong security notion known as security against verification key revealing attacks (VRA security) proposed by Kitagawa et al. (Eurocrypt 2025) into the classical-lessor setting, and we prove that all three of our schemes satisfy this notion under the learning with errors assumption. Our PKE scheme improves upon the previous construction by Goyal et al. (Eurocrypt 2025), and our PRF and digital signature schemes are respectively the first PRF and digital signature with classical-lessor secure key leasing property.

Discussion (0). Continue with ORCID to comment.

Reference graph

Works this paper leans on

41 extracted references · 2 linked inside Pith

  1. [1]

    A quantum goldreich-levin theorem with cryptographic applications

    Mark Adcock and Richard Cleve. A quantum goldreich-levin theorem with cryptographic applications. In Helmut Alt and Afonso Ferreira, editors, STACS 2002, 19th Annual Symposium on Theoretical Aspects of Computer Science, Antibes - Juan les Pins, France, March 14-16, 2002, Proceedings , volume 2285 of Lecture Notes in Computer Science , pages 323--334. Spri...

    2002

  2. [2]

    Quantum key-revocable dual-regev encryption, revisited

    Prabhanjan Ananth, Zihan Hu, and Zikuan Huang. Quantum key-revocable dual-regev encryption, revisited. In Elette Boyle and Mohammad Mahmoody, editors, TCC 2024, Part III , volume 15366 of LNCS , pages 257--288. Springer, Cham, December 2024

    2024

  3. [3]

    Public key encryption with secure key leasing

    Shweta Agrawal, Fuyuki Kitagawa, Ryo Nishimaki, Shota Yamada, and Takashi Yamakawa. Public key encryption with secure key leasing. In Carmit Hazay and Martijn Stam, editors, EUROCRYPT 2023, Part I , volume 14004 of LNCS , pages 581--610. Springer, Cham, April 2023

    2023

  4. [4]

    La Placa

    Prabhanjan Ananth and Rolando L. La Placa . Secure software leasing. In Anne Canteaut and Fran c ois-Xavier Standaert, editors, EUROCRYPT 2021, Part II , volume 12697 of LNCS , pages 501--530. Springer, Cham, October 2021

    2021

  5. [5]

    Revocable cryptography from learning with errors

    Prabhanjan Ananth, Alexander Poremba, and Vinod Vaikuntanathan. Revocable cryptography from learning with errors. In Guy N. Rothblum and Hoeteck Wee, editors, TCC 2023, Part IV , volume 14372 of LNCS , pages 93--122. Springer, Cham, November / December 2023

    2023

  6. [6]

    Quantum cryptography: Public key distribution and coin tossing

    Charles H Bennett and Gilles Brassard. Quantum cryptography: Public key distribution and coin tossing. arXiv preprint arXiv:2003.06557 , 2020

    arXiv 2003

  7. [7]

    Vazirani, and Thomas Vidick

    Zvika Brakerski, Paul Christiano, Urmila Mahadev, Umesh V. Vazirani, and Thomas Vidick. A cryptographic test of quantumness and certifiable randomness from a single quantum device. In Mikkel Thorup, editor, 59th FOCS , pages 320--331. IEEE Computer Society Press, October 2018

    2018

  8. [8]

    Christiano, Urmila Mahadev, Umesh V

    Zvika Brakerski, Paul F. Christiano, Urmila Mahadev, Umesh V. Vazirani, and Thomas Vidick. A cryptographic test of quantumness and certifiable randomness from a single quantum device. J. ACM , 68(5):31:1--31:47, 2021

    2021

Show all 41 references
  1. [9]

    Software with certified deletion

    James Bartusek, Vipul Goyal, Dakshita Khurana, Giulio Malavolta, Justin Raizes, and Bhaskar Roberts. Software with certified deletion. In Marc Joye and Gregor Leander, editors, EUROCRYPT 2024, Part IV , volume 14654 of LNCS , pages 85--111. Springer, Cham, May 2024

    2024

  2. [10]

    Quantum encryption with certified deletion

    Anne Broadbent and Rabib Islam. Quantum encryption with certified deletion. In Rafael Pass and Krzysztof Pietrzak, editors, TCC 2020, Part III , volume 12552 of LNCS , pages 92--122. Springer, Cham, November 2020

    2020

  3. [11]

    Secure software leasing without assumptions

    Anne Broadbent, Stacey Jeffery, S \'e bastien Lord, Supartha Podder, and Aarthi Sundaram. Secure software leasing without assumptions. In Kobbi Nissim and Brent Waters, editors, TCC 2021, Part I , volume 13042 of LNCS , pages 90--120. Springer, Cham, November 2021

    2021

  4. [12]

    Cryptography with certified deletion

    James Bartusek and Dakshita Khurana. Cryptography with certified deletion. In Helena Handschuh and Anna Lysyanskaya, editors, CRYPTO 2023, Part V , volume 14085 of LNCS , pages 192--223. Springer, Cham, August 2023

    2023

  5. [13]

    Weakening assumptions for publicly-verifiable deletion

    James Bartusek, Dakshita Khurana, Giulio Malavolta, Alexander Poremba, and Michael Walter. Weakening assumptions for publicly-verifiable deletion. In Guy N. Rothblum and Hoeteck Wee, editors, TCC 2023, Part IV , volume 14372 of LNCS , pages 183--197. Springer, Cham, November /...

    2023

  6. [14]

    Noise-tolerant quantum tokens for MAC

    Amit Behera, Or Sattath, and Uriel Shinar. Noise-tolerant quantum tokens for MAC . Cryptology ePrint Archive, Report 2021/1353, 2021

    2021

  7. [15]

    Quantum key leasing for pke and fhe with a classical lessor

    Orestis Chardouvelis, Vipul Goyal, Aayush Jain, and Jiahui Liu. Quantum key leasing for pke and fhe with a classical lessor. In Annual International Conference on the Theory and Applications of Cryptographic Techniques , pages 248--277. Springer, 2025

    2025

  8. [16]

    Hidden cosets and applications to unclonable cryptography

    Andrea Coladangelo, Jiahui Liu, Qipeng Liu, and Mark Zhandry. Hidden cosets and applications to unclonable cryptography. In Tal Malkin and Chris Peikert, editors, CRYPTO 2021, Part I , volume 12825 of LNCS , pages 556--584, Virtual Event, August 2021. Springer, Cham

    2021

  9. [17]

    Quantum cryptography with classical communication: Parallel remote state preparation for copy-protection, verification, and more

    Alexandru Gheorghiu, Tony Metger, and Alexander Poremba. Quantum cryptography with classical communication: Parallel remote state preparation for copy-protection, verification, and more. In Kousha Etessami, Uriel Feige, and Gabriele Puppis, editors, ICALP 2023 , volume 261 of ...

    2023

  10. [18]

    Trapdoors for hard lattices and new cryptographic constructions

    Craig Gentry, Chris Peikert, and Vinod Vaikuntanathan. Trapdoors for hard lattices and new cryptographic constructions. In Richard E. Ladner and Cynthia Dwork, editors, 40th ACM STOC , pages 197--206. ACM Press, May 2008

    2008

  11. [19]

    Creating superpositions that correspond to efficiently integrable probability distributions

    Lov Grover and Terry Rudolph. Creating superpositions that correspond to efficiently integrable probability distributions. arXiv, quant-ph/0208112, 2002

    2002 arXiv

  12. [20]

    Computationally-secure and composable remote state preparation

    Alexandru Gheorghiu and Thomas Vidick. Computationally-secure and composable remote state preparation. In David Zuckerman, editor, 60th FOCS , pages 1024--1033. IEEE Computer Society Press, November 2019

    2019

  13. [21]

    Leveled fully homomorphic signatures from standard lattices

    Sergey Gorbunov, Vinod Vaikuntanathan, and Daniel Wichs. Leveled fully homomorphic signatures from standard lattices. In Rocco A. Servedio and Ronitt Rubinfeld, editors, 47th ACM STOC , pages 469--477. ACM Press, June 2015

    2015

  14. [22]

    Adaptively secure garbled circuits from one-way functions

    Brett Hemenway, Zahra Jafargholi, Rafail Ostrovsky, Alessandra Scafuro, and Daniel Wichs. Adaptively secure garbled circuits from one-way functions. In Matthew Robshaw and Jonathan Katz, editors, CRYPTO 2016, Part III , volume 9816 of LNCS , pages 149--178. Springer, Berlin, H...

    2016

  15. [23]

    Certified everlasting secure collusion-resistant functional encryption, and more

    Taiga Hiroka, Fuyuki Kitagawa, Tomoyuki Morimae, Ryo Nishimaki, Tapas Pal, and Takashi Yamakawa. Certified everlasting secure collusion-resistant functional encryption, and more. In Marc Joye and Gregor Leander, editors, EUROCRYPT 2024, Part III , volume 14653 of LNCS , pages ...

    2024

  16. [24]

    Quantum encryption with certified deletion, revisited: Public key, attribute-based, and classical communication

    Taiga Hiroka, Tomoyuki Morimae, Ryo Nishimaki, and Takashi Yamakawa. Quantum encryption with certified deletion, revisited: Public key, attribute-based, and classical communication. In Mehdi Tibouchi and Huaxiong Wang, editors, ASIACRYPT 2021, Part I , volume 13090 of LNCS , p...

    2021

  17. [25]

    General linear group action on tensors: A candidate for post-quantum cryptography

    Zhengfeng Ji, Youming Qiao, Fang Song, and Aaram Yun. General linear group action on tensors: A candidate for post-quantum cryptography. In Dennis Hofheinz and Alon Rosen, editors, TCC 2019, Part I , volume 11891 of LNCS , pages 251--281. Springer, Cham, December 2019

    2019

  18. [26]

    A simple framework for secure key leasing

    Fuyuki Kitagawa, Tomoyuki Morimae, and Takashi Yamakawa. A simple framework for secure key leasing. In Annual International Conference on the Theory and Applications of Cryptographic Techniques , pages 217--247. Springer, 2025

    2025

  19. [27]

    Pke and abe with collusion-resistant secure key leasing

    Fuyuki Kitagawa, Ryo Nishimaki, and Nikhil Pappu. Pke and abe with collusion-resistant secure key leasing. In Annual International Cryptology Conference , pages 35--68. Springer, 2025

    2025

  20. [28]

    Secure software leasing from standard assumptions

    Fuyuki Kitagawa, Ryo Nishimaki, and Takashi Yamakawa. Secure software leasing from standard assumptions. In Kobbi Nissim and Brent Waters, editors, TCC 2021, Part I , volume 13042 of LNCS , pages 31--61. Springer, Cham, November 2021

    2021

  21. [29]

    Publicly verifiable deletion from minimal assumptions

    Fuyuki Kitagawa, Ryo Nishimaki, and Takashi Yamakawa. Publicly verifiable deletion from minimal assumptions. In Guy N. Rothblum and Hoeteck Wee, editors, TCC 2023, Part IV , volume 14372 of LNCS , pages 228--245. Springer, Cham, November / December 2023

    2023

  22. [30]

    Classical verification of quantum computations

    Urmila Mahadev. Classical verification of quantum computations. In Mikkel Thorup, editor, 59th FOCS , pages 259--267. IEEE Computer Society Press, October 2018

    2018

  23. [31]

    Trapdoors for lattices: Simpler, tighter, faster, smaller

    Daniele Micciancio and Chris Peikert. Trapdoors for lattices: Simpler, tighter, faster, smaller. In David Pointcheval and Thomas Johansson, editors, EUROCRYPT 2012 , volume 7237 of LNCS , pages 700--718. Springer, Berlin, Heidelberg, April 2012

    2012

  24. [32]

    Revocable quantum digital signatures

    Tomoyuki Morimae, Alexander Poremba, and Takashi Yamakawa. Revocable quantum digital signatures. In Fr \' e d \' e ric Magniez and Alex Bredariol Grilo, editors, 19th Conference on the Theory of Quantum Computation, Communication and Cryptography, TQC 2024, September 9-13, 202...

    2024

  25. [33]

    Quantum proofs of deletion for learning with errors

    Alexander Poremba. Quantum proofs of deletion for learning with errors. In Yael Tauman Kalai, editor, ITCS 2023 , volume 251, pages 90:1--90:14. LIPIcs , January 2023

    2023

  26. [34]

    A framework for efficient and composable oblivious transfer

    Chris Peikert, Vinod Vaikuntanathan, and Brent Waters. A framework for efficient and composable oblivious transfer. In David Wagner, editor, CRYPTO 2008 , volume 5157 of LNCS , pages 554--571. Springer, Berlin, Heidelberg, August 2008

    2008

  27. [35]

    Adaptive hardcore bit and quantum key leasing over classical channel from LWE with polynomial modulus

    Duong Hieu Phan, Weiqiang Wen, Xingyu Yan, and Jinwei Zheng. Adaptive hardcore bit and quantum key leasing over classical channel from LWE with polynomial modulus. In Kai-Min Chung and Yu Sasaki, editors, ASIACRYPT 2024, Part IX , volume 15492 of LNCS , pages 185--214. Springe...

    2024

  28. [36]

    On lattices, learning with errors, random linear codes, and cryptography

    Oded Regev. On lattices, learning with errors, random linear codes, and cryptography. Journal of the ACM , 56(6):34:1--34:40, 2009

    2009

  29. [37]

    An equivalence between attribute-based signatures and homomorphic signatures, and new constructions for both

    Rotem Tsabary. An equivalence between attribute-based signatures and homomorphic signatures, and new constructions for both. In Yael Kalai and Leonid Reyzin, editors, TCC 2017, Part II , volume 10678 of LNCS , pages 489--518. Springer, Cham, November 2017

    2017

  30. [38]

    Andreas J. Winter. Coding theorem and strong converse for quantum channels. IEEE Trans. Inf. Theory , 45(7):2481--2485, 1999

    1999

  31. [39]

    How to generate and exchange secrets (extended abstract)

    Andrew Chi-Chih Yao. How to generate and exchange secrets (extended abstract). In 27th FOCS , pages 162--167. IEEE Computer Society Press, October 1986

    1986

  32. [40]

    Classical verification of quantum computations in linear time

    Jiayu Zhang. Classical verification of quantum computations in linear time. In 63rd FOCS , pages 46--57. IEEE Computer Society Press, October / November 2022

    2022

  33. [41]

    Formulations and constructions of remote state preparation with verifiability, with applications

    Jiayu Zhang. Formulations and constructions of remote state preparation with verifiability, with applications. In Raghu Meka, editor, ITCS 2025 , volume 325, pages 96:1--96:19. LIPIcs , January 2025

    2025

Pith tools

Reviewed August 4, 2026 · model on record in the stance chip above.