Pith. sign in

REVIEW 3 major objections 5 minor 47 references

Statistically-Secure Bit Commitment and Coin Flipping Protocols Based on Quantum Hardware Assumptions

T0 review · 3 major / 5 minor · reviewed 2026-08-12 · deepseek-v4-flash

Challenge this review Re-run · record.json Download PDF Read on arXiv ↗ Review JSON

Pith's one-line read The paper claims to construct statistically secure bit commitment and coin flipping from hybrid locked physical unclonable functions, a hardware primitive that evades the quantum no-go theorem under hardware assumptions.

desk verdict A genuinely new hardware-token commitment protocol whose hiding proof is clean, but the binding proof rests on a false acceptance-relation assumption and the central result does not hold as written. read the letter →

arxiv 2608.11187 v1 pith:Q5RWMQQQ submitted 2026-08-11 quant-ph cs.CR

Roo Dunnill , Mina Doosti This is my paper · ORCID
classification quant-phcs.CR MSC 81P9494A60 PACS 03.67.Dd03.67.Hk
keywords bitcommitmentcoinflippinghybridlockedPUFphysicalunclonablefunctionquantumcryptographystatisticalsecurityBB84encodinghardware
verification ladder T0 review T1 audit T2 compute T3 formal

The pith

A machine-rendered reading of the paper's core claim, the machinery that carries it, and where it could break.

The reading

The paper claims to construct the first statistically secure bit-commitment scheme that does not restrict the adversary's quantum memory or computing power, by relying instead on a hardware assumption: a classically unclonable device locked behind a quantum verification interface. The protocol makes Alice's commitment state depend on a challenge–response pair of an asymmetric hybrid locked PUF, with the bit concealed in the choice of BB84 basis pattern generated by a careful alternative-challenge algorithm. The authors prove statistical hiding by bounding the trace distance between the two commit ensembles by the PUF's unforgeability parameter, and statistical binding by an operator-norm bound on the sum of the acceptance projectors. They then build a strong coin-flipping protocol on top of the commitment in a black-box way. If correct, the result opens a new route to mistrustful two-party cryptography in quantum networks using off-the-shelf hardware.

What carries the argument

The load-bearing object is the asymmetric hybrid locked PUF: a classical PUF whose output is split into a verifier part $f_1(x)$ of length $s$ and a payload part $f_2(x)$ of length $t$, with only the payload encoded into BB84 states and released through a locked interface only after the verifier state $|\psi^{f_1(x)}\rangle$ is supplied. The commitment state is $\rho_b = |f_2(x_0)_J\rangle\langle f_2(x_0)_J|_{\beta(x_b)}$, where $J$ is an ordered set of $\ell_{\min}$ indices chosen by Algorithm 1, which flips bits of the base challenge $x_0$ to produce an alternative challenge $x_1$ with balanced values and bases and verifier states of small overlap. The security proofs use two mechanisms: the intrinsic ensemble symmetry of the generated challenges to prove perfect hiding of the honest ensembles, and an operator-norm bound $\|P+Q\|_\infty \le 1+2^{(2s-\ell_{\min})/2}$ on the sum of acceptance projectors to prove binding against arbitrary coherent cheating strategies.

What would settle it

Fix a public challenge pair and a verifier string $a$, then enumerate the payload strings $z$ that pass the Step-10 projective test with non-negligible probability; if more than one such $z$ exists for a single $a$, the $|S|\le 2^s$ count used in the binding proof does not follow and the claimed $\epsilon_{\rm bind}$ would need a different argument.

Watch

Extended reading notes

Core claim

The central claim is that Protocol 1 is an $\epsilon_{\rm hide}$-hiding and $\epsilon_{\rm bind}$-binding bit-commitment protocol, with $\epsilon_{\rm hide}\le \epsilon_{\rm forge}$ (Theorem 5) and $\epsilon_{\rm bind}\le 2^{(2s-\ell_{\min})/2}$ (Theorem 6), where $s$ is the length of the verifier part of the hardware response, $\ell_{\min}$ is the length of the committed payload substring, and $\epsilon_{\rm forge}$ is the unforgeability of the asymmetric hybrid locked PUF. Under Assumptions 1–3, this gives statistical security with no bound on the adversary's storage. The paper further derives a coin-flipping protocol with bias at most $\frac{1}{2}\max\{\epsilon_{\rm forge}, 2^{-\ell_{\min}/4}\}$. This is, to the authors' knowledge, the first mistrustful two-party protocol built from hybrid hardware modules.

Load-bearing premise

The proof assumes that for every verifier string supplied to the locked device, the acceptance test in effect permits only one output string to open successfully, which is what keeps the set of accepted openings small enough for the operator-norm bound.

Editorial extensions

If this is right

  • If the construction is sound, statistically secure bit commitment becomes achievable in a non-relativistic, non-storage-restricted setting, provided a tamper-proof locked PUF can be manufactured and the stated assumptions hold.
  • The coin-flipping protocol inherits the hiding and binding parameters, giving a bias bound $\delta_{\rm CF} \le \frac{1}{2}\max\{\epsilon_{\rm forge}, 2^{-\ell_{\min}/4}\}$.
  • The challenge-generation algorithm runs in expected $2+e^{-\Omega(s)}$ queries, so the scheme has a concrete and efficient implementation route rather than being merely existential.
  • A variant with early measurement by Bob removes the need for quantum memory during the protocol, at the cost of a weaker security parameter, as the authors note for future work.
  • The asymmetric split between verifier and payload suggests a generic template for converting device-based authentication primitives into mistrustful two-party primitives, potentially extending to string commitment and oblivious transfer.

Reading between the lines

Editorial extensions of the paper, not claims the author makes directly.

  • A natural next step is to formalise and prove the early-measurement variant; if it retains statistical security, the protocol becomes implementable with only classical storage at the receiver.
  • The modular operator-norm proof technique could be adapted to other hardware assumptions, such as quantum-secure classical PUFs or trusted platform modules, as long as the acceptance relation keeps the same counting structure.
  • The binding bound improves as the verifier length $s$ grows relative to the committed payload length $\ell_{\min}$; a concrete parameter optimisation would trade this against the expected query complexity of the challenge-generation algorithm.
  • If the HLPUF unforgeability parameter is negligible in practice, the coin-flip bias is dominated by $2^{-\ell_{\min}/4}$, so choosing $\ell_{\min}$ large enough yields near-ideal coin flipping under the same hardware assumptions.
Share X Bluesky LinkedIn Reddit HN

Editorial analysis

A structured set of objections, weighed in public.

Desk editor's note, referee report, and a circularity audit.

Referee Report

3 major / 5 minor

Summary. The paper proposes a statistically secure bit-commitment protocol (Protocol 1) built from an asymmetric Hybrid Locked PUF. Alice commits to a bit by BB84-encoding a substring f2(x0)_J of an HLPUF response, with the encoding basis chosen from one of two challenges produced by Algorithm 1. The hiding claim rests on an intrinsic ensemble-symmetry argument (Lemma 2, Theorem 5), and the binding claim rests on an operator-norm bound for the sum of acceptance projectors (Lemma 3, Theorem 6), giving eps_bind <= 2^{(2s-l_min)/2} = 2^{-l_min/4} with s = l_min/4. The paper also gives a black-box coin-flipping protocol (Protocol CF) with bias bounded by max{eps_forge, 2^{-l_min/4}}. The constructive Algorithm 1 and the explicit feasibility and query-complexity analysis are useful, but the central binding proof is not sound.

Significance. If the security proofs were correct, this would be a significant result: it would supply the first mistrustful two-party cryptographic primitive from hybrid hardware assumptions, avoiding bounded- or noisy-storage restrictions and offering a concrete implementation route. The paper's constructive challenge-generation subroutine, with its high-probability feasibility and query-complexity bounds, and the black-box coin-flipping reduction, are genuine contributions. However, the advertised statistical binding guarantee is unsupported because the main proof assumes a one-to-one acceptance relation that the protocol's own verification step does not satisfy. Since binding is the central technical claim, the significance of the paper as it stands is substantially reduced.

major comments (3)
  1. [Section IV, Lemma 3 (Eqs. (54)-(63)); Protocol 1, Step 10]
  2. [Section IV, Lemma 2 and Proposition 1(iv)]
  3. [Section III A, Assumption 3]
minor comments (5)
  1. [Section II B, Definitions 1-2]
  2. [Section II A, Eq. (3)]
  3. [Section III B]
  4. [Protocol 1]
  5. [Proposition 1 and Lemma 1]

Circularity Check

1 steps flagged · score 3.0 of 10

One load-bearing self-citation for asymmetric HLPUF unforgeability; no derived equation reduces to its input by construction.

  1. self citation load bearing [Section III A, Assumption 3 paragraph (after Eq. (17))]
    "We rely on the general unforgeability of HLPUFs established in [22], and we assume that this property is satisfied by the construction we use here. Since the proof in our setting follows as a subset of the arguments already given in [22], we do not repeat it here."

    The protocol's hiding guarantee is Theorem 5, epsilon_hide <= epsilon_forge, and the coin-flipping bias in Theorem 8 inherits that bound. Both therefore rest entirely on Assumption 3, which is not proved in this paper but imported from [22], a paper whose author set overlaps with the present one (M. Doosti). The asymmetric HLPUF introduced here is not literally the object proved unforgeable in [22]; the assertion that its proof 'follows as a subset' is made without derivation. Thus the hiding half of the central claim reduces, by self-citation, to an unverified extension of prior work. The binding proof is independent of this citation, so the circularity is partial.

full rationale

No equation in the paper is shown to be equivalent to its own input by construction, and no parameter is fitted to data and then renamed a prediction. Algorithm 1 deliberately forces the payload substring to a uniformly random r; using that uniformity in Lemma 2 is a design consequence, not a circular step. The hiding theorem is a standard reduction to the explicitly stated unforgeability assumption. The most serious flaw in the paper is Lemma 3's treatment of R_x as containing at most one accepted output string per verifier string; this is an unproved and likely false premise about Protocol 1's Step 10 measurement, but it is a correctness/soundness gap rather than a circular derivation. The only genuine circularity-adjacent issue is the load-bearing self-citation for Assumption 3, which carries hiding and hence coin flipping; because the binding argument has independent content and the cited [22] is a published external result, the overall circularity is limited.

Assumptions & free parameters 1 free parameters · 4 assumptions · 1 invented entities

The protocol's security rests on three hardware assumptions (black-box locked mode, i.i.d. bias, unforgeability) and on a fourth ad hoc premise in the binding proof that is not supported and appears false. The paper introduces no data-fitted parameters.

free parameters (1)
  • s = l_min / 4 = s = l_min / 4
    Chosen by hand to make the claimed binding parameter 2^((2s - l_min)/2) = 2^(-l_min/4) negligible; not fitted to data, but this choice is load-bearing for the operator-norm bound.
assumptions (4)
  • domain assumption Assumption 1: Locked-mode black-box property and irreversibility
    Needed so Bob cannot obtain f2(x) classically and cannot unlock; assumed without experimental evidence.
  • domain assumption Assumption 2: cPUF output bits are i.i.d. with bias delta_r
    Needed for Algorithm 1's feasibility and query complexity theorems; real PUFs may be correlated.
  • domain assumption Assumption 3: Asymmetric HLPUF is epsilon_forge-unforgeable, inherited from [22]
    Self-cited prior result; paper says proof follows as a subset of [22] without repeating.
  • ad hoc to paper In Lemma 3, R_x contains at most one accepted z per verifier string a
    This premise is false under probabilistic acceptance and is not justified; it is introduced solely to bound |S| <= 2^s.
invented entities (1)
  • Asymmetric HLPUF variant
    purpose: Hardware token that verifies a k-qubit state and outputs an l-qubit response; used to enforce binding in bit commitment.
    No physical implementation or independent falsifiable handle is provided; security rests on Assumptions 1-3.

how reviews work

0 comments
Cite this review

Pith. "Pith review of Statistically-Secure Bit Commitment and Coin Flipping Protocols Based on Quantum Hardware Assumptions." pith.science (2026). https://pith.science/paper/Q5RWMQQQ

@misc{pith2026260811187,
  author       = {Pith},
  title        = {Pith review of: Statistically-Secure Bit Commitment and Coin Flipping Protocols Based on Quantum Hardware Assumptions},
  year         = {2026},
  howpublished = {\url{https://pith.science/paper/Q5RWMQQQ}},
  note         = {Machine review of arXiv:2608.11187}
}
read the original abstract

Bit commitment is impossible to achieve with unconditional security, even in quantum cryptogra- phy. We show that statistically secure bit commitment, satisfying both hiding and binding, can be constructed from hybrid locked physical unclonable functions (HLPUFs), a hardware primitive that combines classical hardware tokens and quantum communication. Our protocol uses these hardware assumptions in a novel and non-trivial way to achieve the first mistrustful two-party cryptographic protocol based on hybrid hardware modules. We prove statistical hiding and binding under natu- ral assumptions on the HLPUF and using a carefully designed challenge generation algorithm as a subroutine of our bit-commitment protocol. The construction also yields the first hardware-based coin-flipping protocol. Our results suggest a new paradigm for secure two-party cryptography in quantum networks, combining rigorous security guarantees with a concrete route toward practical implementation.

Discussion (0). Continue with ORCID to comment.

Reference graph

Works this paper leans on

47 extracted references · 44 canonical work pages

  1. [22]

    Vidick and S

    T. Vidick and S. Wehner,Introduction to Quantum Cryptography(Cambridge University Press, 2024)

    work page 2024

  2. [1]

    An HLPUF is a hybrid device that combines a cPUF with quantum encoding and verification

    Hybrid and Hybrid-locked PUFs The main hardware module we use for our protocol is a specific type of Hybrid Locked PUF (HLPUF) introduced in [22]. An HLPUF is a hybrid device that combines a cPUF with quantum encoding and verification. Given the vulnerabilities of most existing cPUFs against modelling and machine learning attacks, HLPUFs are designed to b...

    work page

  3. [2]

    For each enrolled challengex∈ U, she also runs Algorithm 1 to produce an associated challengex 1 and retains the corresponding ordered listJ

    Alice queries the HLPUF inmode 0on enough challenges to obtain a database of challenge-response pairs DB={(x, f 1(x), f2(x)) :x∈ U }. For each enrolled challengex∈ U, she also runs Algorithm 1 to produce an associated challengex 1 and retains the corresponding ordered listJ

    work page

  4. [3]

    Commit phase:The commitment is a bitb∈ {0,1}

    Alice locks the HLPUF, switches it tomode 1, and sends it to Bob. Commit phase:The commitment is a bitb∈ {0,1}

    work page

  5. [4]

    Alice samples a challengex 0 ∈ U, together with its associated challengex 1 and ordered listJ

    work page

  6. [5]

    Alice sends Bob the pair(x 0, x1)together with the orderingJ

    work page

  7. [6]

    Wheref 2(x0)J corresponds to the indices off 2(x0)that are inJ:={j∈[t] : (x 0)j ̸= (x1)j}and|J|=ℓ min

    Alice prepares theℓ min-qubit state ρb := ( |f2(x0)J ⟩⟨f2(x0)J |β(x0) ifb= 0, |f2(x0)J ⟩⟨f2(x0)J |β(x1) ifb= 1. Wheref 2(x0)J corresponds to the indices off 2(x0)that are inJ:={j∈[t] : (x 0)j ̸= (x1)j}and|J|=ℓ min

    work page

  8. [7]

    Alice sends the register containingρ b to Bob

    work page

Show all 47 references
  1. [8]

    Bob checks that∀j∈J,(x 0)j ⊕(x 1)j = 1, otherwise he rejects Open phase:

  2. [9]

    Verification phase:

    Alice sends the triple(b, a, z), where a=f 1(x0), z=f 2(x0). Verification phase:

  3. [10]

    Bob prepares the verifier state|ψ a v ⟩from the revealed classical stringa

  4. [11]

    If the token outputs⊥, he rejects

    Bob queries the HLPUF on(x 0,|ψ a v ⟩). If the token outputs⊥, he rejects. Otherwise he receives al-qubit stateσ

  5. [12]

    If this test rejects, he rejects the opening

    Bob measuresσwith the two-outcome test {|ψz c ⟩⟨ψz c |,I− |ψz c ⟩⟨ψz c |}. If this test rejects, he rejects the opening

  6. [13]

    obtaining a stringz ′ ∈ {0,1}ℓmin

    Bob measures the stored commitment register in basis γb := ( β(x0)ifb= 0, β(x1)ifb= 1. obtaining a stringz ′ ∈ {0,1}ℓmin . Ifz ′ ̸=z J , he rejects. Otherwise, he accepts bitb. 11 C. F ormal protocol description Our hardware-based bit-commitment protocol works as follows: In t...

  7. [14]

    Alice samples a uniform random bita← {0,1}and commits toausing Protocol BC ⋆

  8. [15]

    Bob samples a uniform random bitb← {0,1}and sendsbto Alice

  9. [16]

    Alice opens the commitment

  10. [17]

    Otherwise both parties output c=a⊕b

    If Bob rejects the opening, the protocol aborts. Otherwise both parties output c=a⊕b. Theorem 7(Correctness of coin flipping).If both parties are honest, Protocol CF ⋆ outputs a uniform bit and does not abort. Proof.By Theorem 4, the underlying commitment opens correctly with ...

  11. [18]

    Katz and Y

    J. Katz and Y. Lindell,Introduction to Modern Cryptography(CRC Press, 2015)

    2015

  12. [19]

    Goldreich,Foundations of Cryptography Vol 1: Basic Tools(Cambridge University Press, 2003)

    O. Goldreich,Foundations of Cryptography Vol 1: Basic Tools(Cambridge University Press, 2003)

    2003

  13. [20]

    Mayers, Unconditionally secure quantum bit commitment is impossible, Physical Review Letters78, 3414 (1997)

    D. Mayers, Unconditionally secure quantum bit commitment is impossible, Physical Review Letters78, 3414 (1997)

    1997

  14. [21]

    Lo and H

    H.-K. Lo and H. F. Chau, Is quantum bit commitment really possible?, Physical Review Letters78, 3410 (1997)

    1997

  15. [23]

    Aharonov, A

    D. Aharonov, A. Ta-Shma, U. Vazirani, and A. Yao, Quantum bit escrow (2000), arXiv:quant-ph/0004017 [quant-ph]

    2000 arXiv

  16. [24]

    Dumais, D

    P. Dumais, D. Mayers, and L. Salvail, Perfectly concealing quantum bit commitment from any quantum one-way per- mutation, inAdvances in Cryptology — EUROCRYPT 2000, Lecture Notes in Computer Science, Vol. 1807, edited by B. Preneel (Springer, 2000) pp. 300–315

    2000

  17. [25]

    T. Koshiba, Statistically-hiding quantum bit commitment from approximable preimage-size quantum one-way function, inTheory of Quantum Computation, Communication, and Cryptography, Lecture Notes in Computer Science, Vol. 5906, edited by H. Mori, H. Imai, and M. Owari (Springer,...

    2009

  18. [26]

    Koshiba and T

    T. Koshiba and T. Odaira, Non-interactive statistically-hiding quantum bit commitment from any quantum one-way function (2011), arXiv:1102.3441 [quant-ph]

    2011 arXiv

  19. [27]

    Unruh, Computationally binding quantum commitments, inAdvances in Cryptology — EUROCRYPT 2016, Part II, Lecture Notes in Computer Science, Vol

    D. Unruh, Computationally binding quantum commitments, inAdvances in Cryptology — EUROCRYPT 2016, Part II, Lecture Notes in Computer Science, Vol. 9666, edited by M. Fischlin and J.-S. Coron (Springer, 2016) pp. 497–527

    2016

  20. [28]

    Kent, Unconditionally secure bit commitment by transmitting measurement outcomes, Physical Review Letters109, 130501 (2012)

    A. Kent, Unconditionally secure bit commitment by transmitting measurement outcomes, Physical Review Letters109, 130501 (2012)

    2012

  21. [29]

    I. B. Damg ˚ ard, S. Fehr, L. Salvail, and C. Schaffner, Cryptography in the bounded-quantum-storage model, in46th Annual IEEE Symposium on Foundations of Computer Science (FOCS’05)(IEEE Computer Society, 2005) pp. 449–458

    2005

  22. [30]

    I. B. Damg ˚ ard, S. Fehr, L. Salvail, and C. Schaffner, Cryptography in the bounded-quantum-storage model, SIAM Journal on Computing37, 1865 (2008)

    2008

  23. [31]

    Wehner, C

    S. Wehner, C. Schaffner, and B. M. Terhal, Cryptography from noisy storage, Physical Review Letters100, 220502 (2008)

    2008

  24. [32]

    N. H. Y. Ng, S. K. Joshi, C. C. Ming, C. Kurtsiefer, and S. Wehner, Experimental implementation of bit commitment in the noisy-storage model, Nature Communications3, 1326 (2012)

    2012

  25. [33]

    Pappu, B

    R. Pappu, B. Recht, J. Taylor, and N. Gershenfeld, Physical one-way functions, Science297, 2026 (2002), https://www.science.org/doi/pdf/10.1126/science.1074376

    2002 doi

  26. [34]

    Guajardo, S

    J. Guajardo, S. S. Kumar, G.-J. Schrijen, and P. Tuyls, Fpga intrinsic pufs and their use for ip protection, inCryptographic Hardware and Embedded Systems - CHES 2007, edited by P. Paillier and I. Verbauwhede (Springer Berlin Heidelberg, Berlin, Heidelberg, 2007) pp. 63–80

    2007

  27. [35]

    Ruhrmair, H

    U. Ruhrmair, H. Bisch, and S. Katzenbeisser, Strong pufs: Models, constructions and security proofs, inTowards Hardware Intrinsic Security(2010) pp. 79–96

    2010

  28. [36]

    Maes and I

    R. Maes and I. Verbauwhede, Physically uncloneable functions: A study on the state of the art and future research directions, inTowards Hardware Intrinsic Security(2010) pp. 3–38

    2010

  29. [37]

    Ruhrmair, Disorder based security hardware: An overview, inSecure System Design and Trustable Computing(2016) pp

    U. Ruhrmair, Disorder based security hardware: An overview, inSecure System Design and Trustable Computing(2016) pp. 3–37

    2016

  30. [38]

    Arapinis, M

    M. Arapinis, M. Delavar, M. Doosti, and E. Kashefi, Quantum physical unclonable functions: Possibilities and impossibil- ities, Quantum5, 475 (2021)

    2021

  31. [39]

    Chakraborty, M

    K. Chakraborty, M. Doosti, Y. Ma, C. Wadhwa, M. Arapinis, and E. Kashefi, Quantum Lock: A Provable Quantum Communication Advantage, Quantum7, 1014 (2023)

    2023

  32. [40]

    Doosti, M

    M. Doosti, M. Delavar, E. Kashefi, and M. Arapinis, A unified framework for quantum unforgeability (2021), arXiv:2103.13994 [quant-ph]

    2021 arXiv

  33. [41]

    Goswami, M

    S. Goswami, M. Doosti, and E. Kashefi, Hybrid authentication protocols for advanced quantum networks (2025), arXiv:2504.11552 [quant-ph]

    2025

  34. [42]

    Laurent-Puig, M

    N. Laurent-Puig, M. Doosti, A. Innocenzi, and E. Diamanti, Unconditional authentication in quantum key distribution via hybrid entangled physical unclonable functions, arXiv preprint arXiv:2605.04650 (2026)

    2026 arXiv

  35. [43]

    Nilesh, C

    K. Nilesh, C. Deppe, and H. Boche, Quantum puf based secret key generation and secure storage with side information, in2025 IEEE International Symposium on Information Theory (ISIT)(2025)

    2025

  36. [44]

    Mayers, Unconditionally secure quantum bit commitment is impossible, Physical Review Letters78, 3414–3417 (1997)

    D. Mayers, Unconditionally secure quantum bit commitment is impossible, Physical Review Letters78, 3414–3417 (1997)

    1997

  37. [45]

    Blum, Coin flipping by telephone a protocol for solving impossible problems, SIGACT News15, 23–27 (1983)

    M. Blum, Coin flipping by telephone a protocol for solving impossible problems, SIGACT News15, 23–27 (1983)

    1983

  38. [46]

    Galetsky, S

    V. Galetsky, S. Ghosh, C. Deppe, and R. Ferrara, Comparison of quantum puf models, in2022 IEEE Globecom Workshops (GC Wkshps)(IEEE, 2022) pp. 820–825

    2022

  39. [47]

    − (t−ℓ min +y min −µ x)2 µx +t−ℓ min +y min # .(A38) 20 Substituting the corresponding values yields Pr[X > t−ℓmin +y min]≤exp

    F. Armknecht, D. Moriyama, A.-R. Sadeghi, and M. Yung, Towards a unified security model for physically unclonable functions, inTopics in Cryptology-CT-RSA 2016: The Cryptographers’ Track at the RSA Conference 2016, San Francisco, CA, USA, February 29-March 4, 2016, Proceedings...

Pith tools

Reviewed August 12, 2026 · model on record in the stance chip above.