Hi Andy! It's Or. We report on this attack in Section 7.2, and propose how to fix it in Section 7.3. We prove security based on some strong form of Virtual Bla

Hi Andy! It's Or. We report on this attack in Section 7.2, and propose how to fix it in Section 7.3. We prove security based on some strong form of Virtual Black Box (VBB) obfuscation, and conjecture that it is secure (and provide some supporting arguments) under the assumption of indisitnguishability obfuscation. Regarding your second comment: we definitely tried to base it on the "money from knots" scheme, and more generally, assuming arbitrary public QM scheme. We failed. "In essence, you'd be proving both possession and consumption of a token that has a completely known state that happens to be very difficult to generate." The procedure should depend on the document's content. There seems nothing that can be done other than "measuring in the standard basis" which is not document dependent, and furthermore, unclear whether it reveals any "hard to generate" information (given a public key - an Alexander polynomial - it's probably easy to find a knot with that polynomial. This is not the case in Aaronson & Christiano's construction). I hope this comment makes sense. If you have some ideas, I'll be more than happy to hear them.