**Tl;dr:** En kvantealgoritme for å sample $(A, As + e)$ uten å kjenne $s$! Paper: [Quantum Oblivious LWE Sampling and Insecurity of Standard Model Lattice-Based SNARKs](https://eprint.iacr.org/2024/030), publisert på STOC'24. **From the abstract:** *Our main result is a quantum polynomial-time algorithm that samples well-distributed LWE instances while provably not knowing the solution, under the assumption that LWE is hard.* **In my own words:** sampling from the distribution of LWE samples without first sampling $\vec{s}$ (i.e., so that you end up with a real sample without knowing the corresponding secret), seems classically hard, which was apparently used as a hardness assumption in building certain SNARKs. These guys then show that such SNARKs cannot be PQ-secure, as there is a *quantum* sampling algorithm. This is of course interesting on its own just because any novel quantum algorithm is a rare event, but also because speedups in sampling algorithms is something I would like to understand better, *and* because it might have potential application in stuff like [[Klassisk verifisering av kvanteberegninger]]. Also can probably be used to construct [[Message samplers]] that do not have efficient conditional [[Message re-samplers]] classically, but *do* have them quantumly. How strange!