… (Modularity) The lifting technique used in our work lifts any private quantum coin to an almost
public quantum coin, preserving the main notions of security against forging and sabotage. …

… protocols without public coin. This raises the question … quantum communication can always
replace a public coin in the … with public coin is exponentially more efficient than quantum …

… was small, which made the dimension of 𝑆⊥ almost full, which in turn made oracle access to
… • For a PPT algorithm 𝑀, we denote by 𝑀(𝑥;𝑟) the output of 𝑀 on input 𝑥 and random coins …

… For every \({\mathsf {NP}}\) relation that can be verified in time T and space S, we construct
a public-coin zero-knowledge argument in which the prover runs in time \(T \cdot \mathrm {…

… the model of quantum protocols with classical public coins, and shows its application to
quantum … This bound is almost tight due to the following theorem. Theorem 12 For L ≥ k, the …

… of privacy for quantum money schemes. Then, we construct the first public-key quantum
money … 3Strictly speaking, [BS21] calls their model almost-public. They simply use an existing …

… For now, we focus on the setting of public key quantum money. Constructing such … old
coins invalid; with our scheme, it is impossible to distinguish coins made today with coins made …

… We propose the first quantum money scheme that is (1) public-key—meaning that anyone
… fidelity to a counterfeiter who copies $ almost perfectly. Taking the contrapositive, this will im…

… , meaning our schemes are almost optimally noise tolerant. We … been significant interest in
publickey quantum money schemes, … only that the coin is a collection of quantum states each …

… ElGamal schemes, since almost all practical public-key cryp… will lose almost all practical
public-key cryptosystems. Since … coin flips and quantum observation of G), where e is a public…