Pith. sign in

REVIEW 4 major objections 6 minor 49 references

Public-Key Quantum Authentication and Digital Signature Schemes Based on the QMA-Complete Problem

T0 review · 4 major / 6 minor · reviewed 2026-08-15 · deepseek-v4-flash

Challenge this review Re-run · record.json Download PDF Read on arXiv ↗ Review JSON

Pith's one-line read This paper claims that a public-key quantum signature and authentication scheme, built on the QMA-completeness of the quantum marginal problem, is existentially unforgeable under adaptive chosen-message attacks, assuming $BQP \neq QMA$.

desk verdict The central security theorem is false: one signing query yields universal forgery via public conjugation, so the claimed EUF-qCMA security collapses. read the letter →

arxiv 2506.16904 v1 pith:DUR7XJJS submitted 2025-06-20 quant-ph

Le-Ran Liu , Min-Quan He , Dan-Bo Zhang , Z. D. Wang This is my paper · ORCID
classification quant-ph MSC 81P9481P68 PACS 03.67.Dd03.67.Lx
keywords quantumpublic-keycryptographydigitalsignaturesauthenticationQMA-completenessmarginalproblemconsistencyoflocaldensitymatricesexistentialunforgeabilityadaptivechosen-messageattack
verification ladder T0 review T1 audit T2 compute T3 formal

The pith

A machine-rendered reading of the paper's core claim, the machinery that carries it, and where it could break.

The reading

The paper proposes a public-key quantum authentication and digital signature protocol in which each user's private key is a quantum circuit that prepares a highly entangled global state, and the public key is the set of all $k$-qubit reduced density matrices of that state. It claims that a forger who can produce a valid signature for an unqueried message would be able to construct a quantum witness solving the QMA-complete Consistency of Local Density Matrices (CLDM) problem, and therefore the scheme is existentially unforgeable under adaptive chosen-message attacks assuming $BQP \neq QMA$. If true, this would be the first quantum public-key scheme needing no trusted third parties, no pre-shared secrets, and no authenticated classical channel, which is why a sympathetic reader would care.

What carries the argument

The central object is the Consistency of Local Density Matrices (CLDM) problem, the QMA-complete decision problem of whether a set of local density matrices is compatible with some global quantum state. The construction hinges on three pieces: (1) the private key is an $N$-qubit state $\rho_A$ with published $k$-qubit marginals as the public key; (2) a challenge-response step in which Bob demands an $M$-qubit fragment with $k < M < N$ and verifies its $k$-qubit marginals; (3) a message-dependent unitary $U_m$, publicly specified and efficiently invertible, that maps a fragment $\rho_M$ to the signature $\sigma_m = U_m \rho_M$. Verification applies $U_m^{-1}$ and checks the local marginals against the public key. The QMA-completeness of CLDM is what is supposed to make reconstruction of the global state from the marginals intractable.

What would settle it

Prepare a legitimate signature $\sigma_m = U_m \rho_M$ for a message $m$ using the scheme's Sign algorithm, then compute $\sigma_{m'} = U_{m'} U_m^{-1} \sigma_m$ for a new message $m'$ and feed $(m', \sigma_{m'})$ to Verify($pk_A$, $m'$, $\cdot$). If Verification accepts, the Theorem is false, and the experiment requires solving no QMA problem.

Watch

Extended reading notes

Core claim

On its own terms, the central claim is the theorem: the digital signature scheme built from a global private state and its published local marginals is existentially unforgeable against quantum adaptive chosen-message adversaries, provided $BQP \neq QMA$. The proof proceeds by reduction: a successful forger outputs a state $\sigma_E$ for a new message $m_E$; applying the inverse message-dependent unitary $U_{m_E}^{-1}$ yields a state whose marginals match the public key, exactly a valid witness for the CLDM instance given to the reduction. Since CLDM is QMA-complete, a convincing witness for a NO instance is impossible by soundness, and the existence of such a witness for a YES instance would let the reduction distinguish the cases, contradicting $BQP \neq QMA$. The paper further argues that the protocol achieves authentication, non-repudiation, and transferability, and that verification can be done efficiently via partial quantum state tomography when $k$ is fixed.

Load-bearing premise

The security proof assumes that a forger can be run even when the reduction does not answer signing queries, and that a single valid signature does not enable the adversary to sign fresh messages; under the protocol's own public, invertible $U_m$, the latter fails.

Editorial extensions

If this is right

  • If the theorem holds, quantum public-key authentication and signatures can in principle be built without a trusted third party, pre-shared secrets, or an authenticated classical channel.
  • The scheme offers non-repudiation and transferability: any party with the public key can independently verify a signature and pass it on.
  • For fixed subsystem size $k$, verification is efficient, requiring $O(4^k/\epsilon^2)$ copies per subsystem for partial quantum state tomography.
  • A successful forgery would imply an efficient quantum algorithm for the QMA-complete CLDM problem, so the scheme's security rests on the assumption $BQP \neq QMA$.

Reading between the lines

Editorial extensions of the paper, not claims the author makes directly.

  • Because $U_m$ is public, known, and invertible, one valid signature $\sigma_m = U_m \rho_M$ immediately yields a valid signature for any other message $m'$ by computing $U_{m'} U_m^{-1} \sigma_m$; this does not require solving any hard problem and appears to break unforgeability as soon as a single signing query is answered.
  • The reduction's assertion that the challenger 'does not require B to answer the queries correctly' (Security Analysis, proof of unforgeability) is a step the argument would need to justify; if signing queries are not actually answered, the forger's success is no longer guaranteed, so the implication from forgery to CLDM witness may be empty.
  • The paper's own Lemma 1 shows that revealing the entire $N$-qubit state destroys security; the observation in the first inference indicates that even a single $M$-qubit signature fragment is enough, a stronger form of the same key-extraction vulnerability that the paper does not address.
Share X Bluesky LinkedIn Reddit HN

Signed reviews

No signed human review yet.

Editorial analysis

A structured set of objections, weighed in public.

Desk editor's note, referee report, and a circularity audit.

Referee Report

4 major / 6 minor

Summary. The manuscript proposes a public-key quantum authentication and digital signature scheme whose security is claimed to be based on the QMA-completeness of the Consistency of Local Density Matrices (CLDM) problem. In the scheme, Alice's private key is an efficiently preparable N-qubit state, her public key is the collection of its k-qubit marginals, and authentication proceeds by Bob challenging an M-qubit subsystem that Alice returns. To sign a message m, Alice applies a public, efficiently invertible message-dependent unitary U_m to the challenged subsystem, producing σ_m = U_m ρ_M. Verification applies U_m^{-1} and checks the resulting local marginals against the public key. The main theorem claims existential unforgeability under adaptive quantum chosen-message attacks (EUF-qCMA) assuming BQP≠QMA. The paper also sketches authentication security, non-repudiation, transferability, and verification costs via partial quantum state tomography.

Significance. If the central claim were correct, the protocol would be a notable conceptual contribution: a public-key quantum signature scheme with no trusted third parties, no pre-shared secrets, and no authenticated classical channel, built on a natural QMA-complete problem. The manuscript is clearly written, gives explicit algorithms, and includes a useful discussion of verification resources and an explicit limitation (Lemma 1) about exposing the full private state. However, the central security theorem is invalid as stated: the scheme is publicly malleable, so a single valid signature for one message immediately yields valid signatures for every other message. The reduction in the proof also fails to instantiate the EUF-qCMA game because it explicitly declines to answer signing queries. These are not presentation issues but load-bearing errors that invalidate the main claim.

major comments (4)
  1. [Digital Signature; Definition 3; Algorithms 2–3] A direct forgery breaks the central theorem. Algorithm 2 signs as σ_m = U_m ρ_M, and Definition 3 makes U_m and U_m^{-1} public and efficiently computable. Given one valid signature σ_m for a queried message m, an adversary chooses a new message m' and computes the public unitary W = U_{m'} U_m^{-1}, then outputs τ = W σ_m W† = U_{m'} ρ_M U_{m'}^†. Verification of (m', τ) applies U_{m'}^{-1} and checks exactly the same marginals that made σ_m valid, so Verify accepts with the same probability. One signing-oracle query therefore yields valid signatures for every other message, independently of BQP≠QMA. This directly contradicts the EUF-qCMA theorem stated in the Security Analysis.
  2. [Security Analysis, Proof of Unforgeability] The reduction does not instantiate the EUF-qCMA game. The proof states explicitly that 'the security proof does not require B to answer the queries correctly' and that the existence of a successful forger is assumed regardless of how oracle queries are handled. In the EUF-qCMA game, the adversary's success probability is defined after receiving valid signatures for its chosen messages; a reduction that answers queries incorrectly or not at all cannot use the adversary's output as evidence about the underlying instance. The step 'E successful forgery implies YES' is asserted rather than derived, and for a NO instance no valid signature can exist at all, so the claimed distinguishing procedure is not well defined.
  3. [Proof of Unforgeability] The proof uses a worst-case QMA-complete instance as the public key, but the security assumption needed is an average-case or distributional hardness property. The adversary in the EUF-qCMA game sees public keys generated by Algorithm 1, whereas the reduction sets pk_E to an arbitrary CLDM instance. Without a worst-case-to-average-case reduction, a forger that breaks the scheme on the key distribution does not imply a solver for arbitrary CLDM instances. The manuscript provides no argument bridging this gap.
  4. [Authentication Security] The authentication-security argument is not formal. It claims that responding to arbitrary challenges with states matching the public marginals 'is equivalent to solving the CLDM problem,' but an adversary that participates in many sessions receives M-qubit fragments of ρ_A for different challenge sets; the protocol does not analyze whether these transcripts compose into a reconstruction or impersonation attack. The restriction k<M<N and random challenges are discussed informally, and Lemma 1 addresses only the trivial full-state attack, so the authentication claim is unsupported.
minor comments (6)
  1. [Digital Signature] There is a typo in the introduction to the signature phase: 'A;ice' should read 'Alice'.
  2. [Algorithm 1] The symbol k is used both for the subsystem size and as the loop index in Algorithm 1, which is confusing; using a different loop variable such as j would improve clarity.
  3. [Proof of Unforgeability] The reduction algorithm is introduced as F and then referred to as B in the same proof; one consistent symbol should be used throughout.
  4. [Definition 3] Definition 3 describes unitaries acting on 2^n qubits, but the signing procedure applies U_m to the M-qubit subsystem ρ_M; the intended domain of U_m, and how the message length |m| relates to M, should be clarified.
  5. [Non-Repudiation and Transferability] The statement that verification is a 'mathematical proof' is overstated, since Algorithm 3 is probabilistic and threshold-based (tomography with acceptance threshold ε); the wording should be softened.
  6. [Security Analysis] There are several grammatical slips, for example 'E successful forgery by E' in the proof, and the notation for the reconstructed marginals alternates between ρ_C' and ρ_Ck without definition.

Circularity Check

0 steps flagged · score 0.0 of 10

No significant circularity: the security proof's defects are an invalid reduction and public malleability, not a derivation that assumes its own conclusion.

full rationale

The paper's load-bearing external input is the QMA-completeness of CLDM (ref. [41], Y.-K. Liu), an external mathematical result not authored by the present authors; it is cited as independent support, not defined in terms of the scheme's security. The statement that a valid forgery yields a CLDM witness is a definitional consequence of the Verify algorithm, since verification checks that U_m^{-1}-transformed marginals match the public key, but this is a tautology about the verification predicate, not a circular derivation of unforgeability. The serious flaws are correctness flaws, not circularity: (i) the reduction explicitly declines to answer signing queries, stating 'The security proof does not require B to answer the queries correctly. The existence of a successful forger is assumed regardless of how oracle queries are handled', so it does not run the EUF-qCMA game it claims to reduce from; and (ii) the scheme is publicly malleable, since from one signature sigma_m = U_m rho_M U_m^dagger and the public unitaries, any new m' yields tau = U_{m'} U_m^{-1} sigma_m U_m U_{m'}^{-1} = U_{m'} rho_M U_{m'}^dagger, which verifies. These are invalid-reduction and broken-scheme issues, not cases where the paper's conclusion is equivalent to its inputs by construction. No self-citation is load-bearing. Therefore the circularity score is 0.

Assumptions & free parameters 4 free parameters · 4 assumptions · 0 invented entities

The central security claim rests on the QMA-completeness of CLDM plus the unproven assumption that the published marginals act as a one-way function against quantum adversaries. The reduction also makes an ad hoc assumption that signing queries need not be answered. Protocol parameters k, M, and epsilon are left unspecified, so no concrete security level is derived.

free parameters (4)
  • k (marginal subsystem size) = unspecified constant
    Chosen by Alice; controls tomography cost and security; no concrete value or security analysis is given.
  • M (challenge subsystem size) = unspecified, k<M<N
    Chosen by the verifier; the proof assumes revealing M-qubit slices is safe, but this is the source of the forgery attack.
  • epsilon (acceptance threshold) = unspecified
    Must balance noise tolerance and forgery detection; no quantitative calibration is provided.
  • N (number of qubits) = poly(lambda)
    Scale of the private state; no specific distribution over circuits is supplied, so the hardness of key generation cannot be evaluated.
assumptions (4)
  • standard math CLDM is QMA-complete (Liu 2006)
    External theorem cited as [41]; accepted as a background result.
  • domain assumption BQP != QMA
    Standard computational complexity assumption stated in the theorem; if false the security argument collapses.
  • domain assumption Consistent k-local marginals form a one-way function
    The protocol requires that publishing marginals of a poly-size circuit state does not allow efficient reconstruction; the paper asserts this from QMA-completeness, but QMA-completeness is a worst-case statement and no average-case reduction is given.
  • ad hoc to paper Reduction may leave signing queries unanswered
    The proof states 'The security proof does not require B to answer the queries correctly', which is not a valid simulation of the EUF-qCMA game and is specific to this proof.

how reviews work

0 comments
Cite this review

Pith. "Pith review of Public-Key Quantum Authentication and Digital Signature Schemes Based on the QMA-Complete Problem." pith.science (2026). https://pith.science/paper/DUR7XJJS

@misc{pith2026250616904,
  author       = {Pith},
  title        = {Pith review of: Public-Key Quantum Authentication and Digital Signature Schemes Based on the QMA-Complete Problem},
  year         = {2026},
  howpublished = {\url{https://pith.science/paper/DUR7XJJS}},
  note         = {Machine review of arXiv:2506.16904}
}
read the original abstract

We propose a quantum authentication and digital signature protocol whose security is founded on the Quantum Merlin Arthur~(QMA)-completeness of the consistency of local density matrices. The protocol functions as a true public-key cryptography system, where the public key is a set of local density matrices generated from the private key, a global quantum state. This construction uniquely eliminates the need for trusted third parties, pre-shared secrets, or authenticated classical channels for public key distribution, making a significant departure from symmetric protocols like quantum key distribution. We provide a rigorous security analysis, proving the scheme's unforgeability against adaptive chosen-message attacks by quantum adversaries. The proof proceeds by a formal reduction, demonstrating that a successful forgery would imply an efficient quantum algorithm for the QMA-complete Consistency of Quantum Marginal Problem~(QMP). We further analyze the efficiency of verification using partial quantum state tomography, establishing the protocol's theoretical robustness and outlining a path towards practical implementation

Review history (2 revisions) →

Discussion (0). Continue with ORCID to comment.

Reference graph

Works this paper leans on

49 extracted references · 37 canonical work pages

  1. [1]

    P. W. Shor, Algorithms for quantum computation: Dis- crete logarithms and factoring, inProceedings of the 35th Annual Symposium on Foundations of Computer Science (IEEE, 1994) pp. 124–134

    1994

  2. [2]

    Mosca, Cybersecurity in an era with quantum com- puters: Will we be ready?, IEEE Security & Privacy16, 38 (2018)

    M. Mosca, Cybersecurity in an era with quantum com- puters: Will we be ready?, IEEE Security & Privacy16, 38 (2018)

    work page 2018

  3. [3]

    R. L. Rivest, A. Shamir, and L. Adleman, A method for obtaining digital signatures and public-key cryptosys- tems, Communications of the ACM21, 120 (1978)

    work page 1978

  4. [4]

    V. S. Miller, Use of elliptic curves in cryptography, in Advances in Cryptology — CRYPTO ’85, Santa Bar- bara, California, USA, August 18–22, 1985, Proceedings, Lecture Notes in Computer Science, Vol. 218 (Springer,

    work page 1985

  5. [5]

    Koblitz, Elliptic curve cryptosystems, Mathematics of Computation48, 203 (1987)

    N. Koblitz, Elliptic curve cryptosystems, Mathematics of Computation48, 203 (1987)

    1987

  6. [6]

    L. K. Grover, A fast quantum mechanical algorithm for database search, inProceedings of the 28th Annual ACM Symposium on Theory of Computing(ACM, 1996) pp. 212–219

    work page 1996

  7. [7]

    D. J. Bernstein and T. Lange,Post-Quantum Cryptogra- phy: Dealing with the Fallout of Physics Success, Tech. Rep. 2017/314 (IACR Cryptology ePrint Archive, 2017). 8

    work page 2017

  8. [8]

    D. J. Bernstein and T. Lange, Post-quantum cryptogra- phy: dealing with the fallout of physics success, IACR Cryptology ePrint Archive (2017), preprint, minor revi- sion. Received 2017-04-14

    work page 2017

Show all 49 references
  1. [9]

    Micciancio and O

    D. Micciancio and O. Regev, Lattice-based cryptography, inEncyclopedia of Cryptography and Security(Springer,

  2. [10]

    Overbeck and N

    R. Overbeck and N. Sendrier, Code-based cryptography, inPost-quantum cryptography(Springer, 2009) pp. 95– 145

    2009

  3. [11]

    Sakumoto, T

    K. Sakumoto, T. Shirai, and H. Hiwatari, Public-key identification schemes based on multivariate quadratic polynomials, inAdvances in Cryptology–CRYPTO 2011: 31st Annual Cryptology Conference, Santa Barbara, CA, USA, August 14-18, 2011. Proceedings 31(Springer,

    2011

  4. [12]

    Gisin, G

    N. Gisin, G. Ribordy, W. Tittel, and H. Zbinden, Quan- tum cryptography, Reviews of Modern Physics74, 145 (2002)

    2002

  5. [13]

    Portmann and R

    C. Portmann and R. Renner, Security in quantum cryp- tography, Reviews of Modern Physics94, 025008 (2022)

    2022

  6. [14]

    C. H. Bennett and G. Brassard, Quantum cryptography: Public key distribution and coin tossing, inProceedings of the IEEE International Conference on Computers, Sys- tems and Signal Processing(IEEE, 1984) pp. 175–179

    1984

  7. [15]

    Scarani, H

    V. Scarani, H. Bechmann-Pasquinucci, N. J. Cerf, M. Duˇ sek, N. L¨ utkenhaus, and M. Peev, The security of practical quantum key distribution, Reviews of Modern Physics81, 1301 (2009)

    2009

  8. [16]

    Renner, Security of quantum key distribution, Inter- national Journal of Quantum Information6, 1 (2008)

    R. Renner, Security of quantum key distribution, Inter- national Journal of Quantum Information6, 1 (2008)

    2008

  9. [17]

    P. W. Shor and J. Preskill, Simple proof of security of the bb84 quantum key distribution protocol, Physical review letters85, 441 (2000)

    2000

  10. [18]

    W. K. Wootters and W. H. Zurek, A single quantum cannot be cloned, Nature299, 802 (1982)

    1982

  11. [19]

    G. S. Vernam, Cipher printing telegraph systems: For se- cret wire and radio telegraphic communications, Journal of the A.I.E.E.45, 109 (1926)

    1926

  12. [20]

    Mayers, Unconditional security in quantum cryptog- raphy, Journal of the ACM48, 351 (1998)

    D. Mayers, Unconditional security in quantum cryptog- raphy, Journal of the ACM48, 351 (1998)

    1998

  13. [21]

    Diffie and M

    W. Diffie and M. E. Hellman, New directions in cryp- tography, IEEE Transactions on Information Theory22, 644 (1976)

    1976

  14. [22]

    Bostr¨ om and T

    K. Bostr¨ om and T. Felbinger, Deterministic secure di- rect communication using entanglement, Physical Review Letters89, 187902 (2002)

    2002

  15. [23]

    Deng and G.-L

    F.-G. Deng and G.-L. Long, Secure direct communication with a quantum one-time pad, Physical Review A69, 052319 (2004)

    2004

  16. [24]

    Long, F.-G

    G.-L. Long, F.-G. Deng, Y. Li, K.-W. Wen, and C.-Y. Wang, Quantum secure direct communication and de- terministic secure quantum communication, Frontiers of Physics in China2, 251 (2007)

    2007

  17. [25]

    Zhang, D.-S

    W. Zhang, D.-S. Ding, Y.-B. Sheng, L. Zhou, B.-S. Shi, and G.-C. Guo, Quantum secure direct communication with quantum memory, Phys. Rev. Lett.118, 220501 (2017)

    2017

  18. [26]

    Zhang, Z

    H. Zhang, Z. Sun, R. Qi, and et al., Realization of quan- tum secure direct communication over 100km fiber with time-bin and phase quantum states, Light: Science & Applications11, 83 (2022)

    2022

  19. [27]

    Z. Qi, Y. Li, Y. Huang,et al., A 15-user quantum secure direct communication network, Light: Science & Appli- cations10, 183 (2021)

    2021

  20. [28]

    Barnum, C

    H. Barnum, C. Cr´ epeau, D. Gottesman, A. Smith, and A. Tapp, Authentication of quantum messages, inPro- ceedings of the 43rd Annual IEEE Symposium on Foun- dations of Computer Science(2002) pp. 449–458

    2002

  21. [29]

    Gottesman and I

    D. Gottesman and I. L. Chuang, Quantum digital signa- tures, arXiv preprint arXiv:quant-ph/0105032 (2001)

    2001 arXiv

  22. [30]

    Wallden, V

    P. Wallden, V. Dunjko, A. Kent, and E. Andersson, Quantum digital signatures with quantum key distribu- tion components, Physical Review A91, 042304 (2015), also available at arXiv:1403.5551v2

    2015 arXiv

  23. [31]

    Zhang and Z.-x

    Z.-j. Zhang and Z.-x. Man, Multiparty quantum se- cret sharing of classical messages based on entanglement swapping, Phys. Rev. A72, 022303 (2005)

    2005

  24. [32]

    Dunjko, P

    V. Dunjko, P. Wallden, and E. Andersson, Quantum dig- ital signatures without quantum memory, Physical Re- view Letters112, 040502 (2014)

    2014

  25. [33]

    G. L. Roberts, M. Lucamarini, Z. L. Yuan,et al., Exper- imental measurement-device-independent quantum digi- tal signatures, Nature Communications8, 1098 (2017)

    2017

  26. [34]

    Y. Du, Y. Liu, C. Yang, X. Zheng, S. Zhu, and X.- s. Ma, Experimental measurement-device-independent quantum cryptographic conferencing, Phys. Rev. Lett. 134, 040802 (2025)

    2025

  27. [35]

    Lo and J

    H.-K. Lo and J. Preskill, Security of quantum key dis- tribution using weak coherent states with nonrandom phases (2006), submitted on 23 Oct 2006 (v1), last re- vised 2 Jan 2007 (v2), arXiv:quant-ph/0610203 [quant- ph]

    2006 arXiv

  28. [36]

    Amiri and J

    R. Amiri and J. M. Arrazola, Secure quantum signatures using insecure quantum channels, Physical Review A93, 032325 (2016)

    2016

  29. [37]

    I. V. Puthoor, R. Amiri, P. Wallden, M. Curty, and E. Andersson, Measurement-device-independent quan- tum digital signatures, Phys. Rev. A94, 022328 (2016)

    2016

  30. [38]

    A. I. Lvovsky, B. C. Sanders, and W. Tittel, Optical quantum memory, Nature Photonics3, 706 (2009)

    2009

  31. [39]

    Heshami, D

    K. Heshami, D. England, and P. C. e. a. Humphreys, Quantum memories: emerging applications and recent advances, Journal of Modern Optics63, 2005 (2016)

    2016

  32. [40]

    R. J. Collins, R. J. Donaldson, V. Dunjko, P. Wallden, P. J. Clarke, E. Andersson, J. Jeffers, and G. S. Buller, Realization of quantum digital signatures without the re- quirement of quantum memory, Phys. Rev. Lett.113, 040502 (2014)

    2014

  33. [41]

    Liu, Consistency of local density matrices is qma-complete (2006), last revised Dec 2007, version 3, arXiv:quant-ph/0604166 [quant-ph]

    Y.-K. Liu, Consistency of local density matrices is qma-complete (2006), last revised Dec 2007, version 3, arXiv:quant-ph/0604166 [quant-ph]

    2006 arXiv

  34. [42]

    A. J. Coleman, Structure of fermion density matrices, Reviews of Modern Physics35, 668 (1963)

    1963

  35. [43]

    A. A. Klyachko, Quantum marginal problem andN- representability, inProceedings of the International Sym- posium on Advanced Quantum Theory(World Scientific,

  36. [44]

    Y. Liu, M. Christandl, and F. Verstraete, Quantum com- putational complexity of theN-representability prob- lem:QMA-complete, Physical Review Letters98, 110503 (2007)

    2007

  37. [45]

    Kempe, A

    J. Kempe, A. Kitaev, and O. Regev, The complexity of the local hamiltonian problem, SIAM Journal on Com- puting35, 1070 (2006)

    2006

  38. [46]

    Preneel, Cryptographic hash functions, European Transactions on Telecommunications5, 431 (1994)

    B. Preneel, Cryptographic hash functions, European Transactions on Telecommunications5, 431 (1994)

    1994

  39. [47]

    Goldwasser, S

    S. Goldwasser, S. Micali, and R. L. Rivest, A digital sig- nature scheme secure against adaptive chosen-message attacks, SIAM Journal on Computing17, 281 (1988). 9

    1988

  40. [48]

    Boneh and M

    D. Boneh and M. Zhandry, Secure signatures and chosen ciphertext security in a quantum computing world, in Advances in Cryptology–CRYPTO 2013, Lecture Notes in Computer Science, Vol. 8042 (Springer, 2013) pp. 361– 379

    2013

  41. [49]

    M. G. A. Paris and J. Reh´ aˇ cek,Quantum State Estima- tion, Lecture Notes in Physics, Vol. 649 (Springer, 2004)

    2004

Pith tools

Reviewed August 15, 2026 · model on record in the stance chip above.