For $N$ a power of $2$, the negacyclic number-theoretic transform (NTT) maps a degree $N-1$ polynomial to its evaluations at the $N$ primitive $2N$th roots of unity. In-place butterfly algorithms such as Cooley-Tukey and Gentleman-Sande compute the negacyclic NTT in $O(N\log N)$ time and output the evaluations in a specific, standard order. We give in-place butterfly algorithms for the negacyclic NTT and its inverse that instead output the evaluations in an automorphism-compatible order. These algorithms have the same structure as Cooley-Tukey and Gentleman-Sande, differing only in their precomputed twiddle factors. Our automorphism-compatible butterfly algorithms are applicable to the packed fully homomorphic encryption (FHE) schemes CKKS and BGV/BFV, where the negacyclic NTT is a major component of ciphertext arithmetic. Using our automorphism-compatible butterfly algorithms, Galois automorphisms can be applied to ciphertexts stored in double-CRT format via a simple cyclic shift or adjacent-pair swap of the data. This is contrast to butterfly algorithms currently used that output in the standard order, where applying an automorphism requires performing an arbitrary-looking permutation of the stored data. Our automorphism-compatible butterfly algorithms remove the need for a dedicated automorphism functional unit used in FHE hardware accelerators.

Explicit equations for the locus $\mathcal{L}_n$ of genus-two curves with a maximal degree-$n$ elliptic subcover have been computed only for $n \le 5$, and by elimination, whose cost is not predictable in advance. The degree formula of [22] changes this. It gives $\deg_w F_n = k(H_{n^2}) - 10\,\nu(n)$ in closed form, and with it a reduced monomial support for the associated Humbert modular form $G_{n^2}$, so that the reconstruction becomes a determined linear problem whose every dimension is known before any computation begins. We carry this out for the first new case it opens, discriminant $36$: we determine $k(H_{36}) = 720$, $\nu(6) = 12$, $\deg_w F_6 = 600$ and an admissible modular basis of size $41962$, and we compute the four Siegel generators explicitly along Kumar's rational parametrisation of $H_{36}$, obtaining in particular a complete factorisation of $\chi_{10}$ whose factors recover the degenerate loci of the family from the modular side. We then draw the consequences for isogeny-based cryptography. The equation $\overline{F}_n$ decides optimal $(n,n)$-splitting at every point of the moduli space in characteristic $p$, with no hypothesis on the Newton polygon; this is asserted but not proved in the cryptographic literature, and the available proof excluded exactly the superspecial locus where the question is asked. The weight $k(H_{n^2})$ bounds, unconditionally and with explicit constants, the number of superspecial nodes that detection at level $n$ adds to the target set of the best known attack in dimension two. And the same torsion count $\nu(n)$ that appears in the degree formula governs the cost of both known detection routes, which places a barrier on raising the level and singles out $n = 6$ as the one case where a new equation can matter in practice.

In the random oracle model (ROM), proof of work (PoW) serves two roles in the Fiat–Shamir transformation. First, in challenge grinding, the prover must solve a puzzle for each candidate challenge, which amplifies soundness and reduces proof size and verifier time. This requires a non-amortizing PoW: computing $k$ distinct accepted puzzle–solution–proof triples costs, in expectation, roughly $k$ times the work of computing one. Second, PoW can prevent diagonalization attacks, in which the statement's circuit computes its own challenge. The XFS transformation of Arnon and Yogev (CRYPTO 2025) uses a strong PoW: an adversary that does substantially less work than the honest prover solves a random puzzle with only negligible probability, even after bounded preprocessing. Can a single PoW be both strong and non-amortizing? We prove that it cannot, whenever the verifier is sufficiently cheaper than the prover. Our main technical tool converts computational uniqueness into statistical uniqueness without increasing verifier query complexity. Combined with the search bound of Guan, Riazanov, and Yuan (CRYPTO 2025), which builds on Smyth (STOC 2002), it resolves their open question. To overcome this barrier, our XFS-with-grinding transformation for relativized $\Sigma$-protocols composes a strong PoW with a non-amortizing one. The resulting non-interactive argument retains the soundness amplification of grinding and the security guarantee of XFS in the relativized ROM, with additive prover work for the two PoWs.

In this paper, we present an algorithm for solving the Lattice Isomorphism Problem between input lattices that are isometric to the Construction A lattice of a certain code C. Our algorithm is a direct extension of a method due to Ducas and Gibbons (PKC 2023). We prove that the run time of our algorithm is $2^{O(n)}$ and that its success probability is $1+o(1)$ over a random choice of C. Crucially, our method works when the hull of C has arbitrary dimension while the method of Ducas and Gibbons is restricted to the case of a trivial hull.

Cryptographic security proofs often involve an adversary interacting with a larger, keyed oracle that consists of (potentially exponentially) many independent instances of a smaller, base oracle. Examples include ideal ciphers, which provide access to an independent random permutation for each key, and random oracles, which provide an independent random bit string for each input. However, showing quantum indistinguishability between two such keyed oracles can be tricky, since a single query made by an adversary may involve a superposition that covers all instances of the base oracles simultaneously. In this paper, we establish a generic indistinguishability lifting theorem of the following form: if the two base oracles are indistinguishable under quantum queries, then their corresponding keyed oracles are too, up to an O(q^2) multiplicative loss in distinguishing advantage, where q is the number of queries made by the adversary. Our lifting theorem applies to both statistical and computational settings, and to oracles that are stateful as well. It is also optimal in that it matches the obvious Grover search attack for a certain (contrived) choice of oracles. As an immediate application, we extend Carolan's compressed permutation oracle to an efficiently implementable compressed ideal cipher, and use it to prove preimage resistance of the Davies-Meyer compression function in the quantum ideal cipher model. Thanks to our lifting theorem, the soundness of our compressed ideal cipher reduces to that of Carolan's oracle, and any further improvement on the latter would automatically carry over to the former. As our second application, we give a modular construction that doubles the message length of any quantum-secure strong pseudorandom permutation. Along the way, we show that an existing two-round tweakable Feistel construction is indistinguishable from a random permutation under quantum bidirectional queries. This is done via a dedicated polynomial-method argument, which may be of independent interest.

The European Digital Identity Wallet has integrated anonymous credentials into its technical specifications, and singles out four constructions for privacy-preserving revocation, drawn from two families: positive dynamic accumulators and signed-pairs. The two families are described in the literature in substantially different terms, and no common basis for comparing them exists, which currently prevents informed and quantitative decision making. In this work, we give a unified treatment of both families, showing that signed-pairs, despite their very different presentation, can be expressed in the standard accumulator syntax. We use this to define a single revocation mechanism that any of the four constructions instantiates, which in turn allows us to compare the resulting mechanisms both at the protocol level and empirically. We measure the performance of all four across the full revocation lifecycle, on server-class hardware for the Status Manager and on a smartphone for the Holder and Verifier, with parameters taken from a live national eID scheme. No construction dominates in every aspect, and we make the resulting trade-offs explicit, showing which construction suits which deployment, and identify promising avenues for further improvement at the protocol level.

Neural differential distinguishers are usually compared at a fixed number of labeled samples. However, different input representations may require different numbers of ciphertexts per sample, making fixed-sample comparisons potentially misleading from a cryptanalytic data-complexity perspective. In this paper, we study neural differential distinguishers under a fixed ciphertext budget. We ask whether the available encryption queries should be spent on more independent plaintext bases, or on richer samples containing more ciphertext-difference rows. We introduce a shared-base multi-difference representation in which several input differences are applied around the same plaintext base, and compare it with the standard single-difference baseline and an independent-pair control representation. Experiments on GIFT-64, PRESENT-64, RECTANGLE-64, and SPECK-64/128 show that the single-difference baseline is rarely the best fixed-budget allocation. Adding more difference rows often improves the distinguisher even though it reduces the number of independent training samples. At the same time, the best tested number of rows is not universal: logistic regression often benefits from larger representations, while a multilayer perceptron frequently prefers intermediate values due to sample-starvation and overfitting. We further test several non-adaptive difference sets and observe that the main trend is not tied to a single hand-picked set. The results suggest that the number of differences per sample should be treated as an explicit design parameter in neural differential cryptanalysis, and that fixed-budget evaluation is necessary for comparing richer neural distinguisher inputs fairly.

We present $\mathsf{ATLAS}$, a lattice-based digital signature scheme built on the Fiat--Shamir with aborts paradigm, with security based on the hardness of the Module Learning with Rounding ($\mathsf{MLWR}$) problem. Unlike $\mathsf{Dilithium}$'s $\mathbf{t} = \mathbf{As}_1 + \mathbf{s}_2$ construction or $\mathsf{HAETAE}$'s bimodal, hyperball-uniform instantiation, $\mathsf{ATLAS}$ derives its public key via deterministic rounding, $\mathbf{t} = \lfloor \tfrac{p}{q}\mathbf{As}_1 \rceil$, eliminating the error term $\mathbf{s}_2$ and the explicit noise sampling it requires. This reduces key-generation cost and secret-key storage, and removes a component that both $\mathsf{Dilithium}$ and $\mathsf{HAETAE}$ would otherwise need to support, while keeping $\mathsf{ATLAS}$ structurally close to $\mathsf{Dilithium}$ to inherit its well-studied design and cryptanalytic track record. $\mathsf{ATLAS}$ targets three classical security levels, 128, 256, and 512 bits, using the smallest feasible ring degree $n$ and challenge weight $\kappa$ for each, with module dimensions $(k,l)$ tuned per level. To our knowledge, this includes the first \mlwr-based signature parameter set at the 512-bit level. $\mathsf{ATLAS}$ further adopts power-of-two moduli (e.g., $q=2^{23}$, $p=2^{18}$), replacing modular reduction with bitwise operations and removing rejection sampling from key parts of the scheme. Since such moduli preclude conventional NTT-based multiplication, we design a hierarchical Toom-Cook/Karatsuba decomposition with degree-8 schoolbook multiplication as its base case, accelerated via AVX2 vectorization and strided memory access. Finally, $\mathsf{ATLAS}$ supports both $\mathsf{SHAKE}$ and $\mathsf{KDF-SM3}$ as interchangeable symmetric back-ends, and we quantify the overhead of the $\mathsf{SM3}$-based instantiation relative to $\mathsf{SHAKE}$.

In this paper, we propose an understanding of classical Sigma protocols (as denoted by $\Sigma$-protocols in the literature) through the lens of the MPC-in-the-head (MPCitH) paradigm. We seek not to construct new schemes, but to build a formal bridge connecting these two foundational areas. While many elegant yet foundational Sigma-protocols were introduced decades ago as standalone algebraic or combinatorial interactive proofs, reconsidering them via the modern aspect of (extended) MPCitH significantly enhances our cryptographic insight into their underlying structures. We present a formal mapping that translates classical commitment-challenge-and-response into the internal views of virtual parties, communicating via private point-to-point or public broadcast channels, secret-sharing schemes, commitments, and MPC consistency/correctness checks. By deconstructing algebraic schemes as linear secret-sharing protocols over public channels and combinatorial schemes as discrete threshold MPC instances over private/public channels, we isolate the exact structural reasons why their soundness and efficiency characteristics diverge. The protocols include: - Algebraic schemes: Schnorr, Okamoto, Chaum-Pedersen, Guillou-Quisquater, GMR for QR and discrete log over an unknown-order group. - Combinatorial schemes: Stern, GMW for Graph 3-Coloring, and Graph Isomorphism, among others. Although reinterpreting these already elegant, classic proofs using a heavy-weight machinery like MPCitH might seem redundant, it deepens our understanding of their underlying design principles.

We present two seed-recovery attacks on a family of local PRGs, which map an $n$-bit random seed to an $m$-bit pseudorandom string by applying $\XorMaj$ predicates. For PRGs with large locality, we extend the Group-and-Solve (GAS, Eurocrypt 26) framework to Guess-Filter-Solve (GFS). GFS first guesses that a set of seed bits are all $1$s and then filters for outputs whose inputs to $\Maj$ contain a sufficiently large subset of the guessed bits. Then high-bias noisy equations can be collected for the correct guess and solved by specific solvers. Compared with GAS, GFS collects substantially more noisy equations with high bias and hence outperforms GAS significantly, especially when the output is short. For example, for the challenge parameter $n=256$ and $m=2^{16}$ (STOC 16), the complexity for GFS is $2^{68.78}$ while it is $2^{157.91}$ for GAS. In addition, the asymptotic complexity of GFS is $2^{0.15n+o(n)}$. Independently, inspired by the Guess-and-Decode (GADec, TIT 22), we propose the Filter-Guess-Propagate (FGP) attack. Compared with GADec, FGP introduces two speed-up techniques at each iteration of Belief Propagation (BP): a filter scheme to reduce the number of equations and a dynamic-programming technique to update the log-likelihood ratios of variables efficiently. Together, these improvements enable FGP to perform fast BP and outperform GADec significantly. For $\XorMaj_{10,64}$ with $n=256$ and $m=2^{40}$ (Eurocrypt 24), the total complexity of FGP is $2^{52.66}$, whereas even a single BP iteration of GADec costs $2^{106.42}$. We further extend FGP to $\XorMod$ predicates and experimentally evaluate the resulting attack complexity. We also apply FGP to a ZKP protocol from Eurocrypt 25 and QuietOT from Asiacrypt 24, with only a small computational overhead. For the ZKP protocol, FGP leads to an attack on witness indistinguishability, while for QuietOT, it similarly yields an attack on OT receiver privacy.

We present SCORE, a tweaked version of the SlotToCoeff operation tailored to the context of encrypted real vectors in the CKKS scheme, where SCORE stands for “SlotToCoeff Optimization for Real-Vector Encryption”. This approach accelerates CKKS bootstrapping algorithms that employ the SlotToCoeff operation as their final step, provided the inputs are encryptions of real vectors. SCORE constitutes a conceptually simple refinement of the conventional SlotToCoeff step that can be seamlessly incorporated into existing bootstrapping algorithms. Despite its minimal nature, the technique yields tangible performance improvements. We demonstrate its utility through proof-of-concept implementations for two such algorithms: the conventional bootstrapping algorithm and the SPRU algorithm, which is particularly efficient for ciphertexts containing a small number of encrypted slots. Our results indicate notable performance gains of up to $2\times$ compared to the original formulations of the algorithms.

ORAM is a fundamental cryptographic technique that permits outsourcing memory storage while probabilistically hiding memory access patterns of client programs. We use the EasyCrypt proof assistant to obtain fully mechanized proofs of correctness and security of Simple ORAM [Chung and Pass, 2013] and Path ORAM [Stefanov et al., CCS 2013]. To the best of our knowledge, these are the first machine-checked proofs that cover the correctness bound, i.e., the failure probability, of an ORAM construction. Our proofs refine, simplify, clarify and slightly improve the paper proofs, and many parts of our development can be reused to obtain similar results for other ORAM constructions. As a final contribution, we provide a general library that handles the recursive composition of ORAM constructions to reduce storage demands on the client, and apply this to Path ORAM to capture a practically-relevant instantiation.

Quantum attacks based on Simon's algorithm rely on Boolean functions with hidden XOR periods. At ASIACRYPT 2025, Liu et al. introduced a symbolic automated search model for periodic functions used in distinguishers. However, for distinguishers on target ciphers, the search mainly works with truncated differences and does not jointly constrain exact differential propagation. A separate modeling gap arises in the key-recovery setting: the model does not cover the key-dependent periodic functions used in the polynomial-time key-recovery attacks presented by Canale et al. at CRYPTO 2022. In this work, we study automated search for two classes of periodic functions: periodic functions for distinguishers and key-dependent periodic functions for polynomial-time key-recovery attacks. For the former, we refine the symbolic search model of Liu et al. by adding fixed input differences, differential propagation, and probability constraints. Based on this model, we extend the periodic distinguishers of TWINE and LBlock from 10 rounds to 12 rounds, obtain a 12-round periodic distinguisher for LBlock-S, and find a full-round periodic distinguisher for ALLPC with verified probability \(2^{-9.06}\). For key recovery, we adapt the symbolic-state tracking used for distinguishers to key-dependent values. The model tracks key-dependent shifts and checks that the periodic core is exposed through an output-computable expression. With this model, we extend the attack on MISTY L-FK from 5 to 6 rounds and obtain new polynomial-time key-recovery attacks on Type-1/2 GFS and Skipjack-B variants with FK or KF round functions.

In real-world applications of SNARKs, non-native arithmetic, the emulation of computation outside of the specified SNARK field, is a key bottleneck. It introduces large overheads, and proof system designers often resort to non-standard SNARK-friendly hash-functions or other means like elliptic curve cycles to mitigate its costs. Besides performance concerns, non-native circuit arithmetization is also a major cause of implementation errors. In a collection of 27 critical bugs in real world ZK systems (0xPARC/zkbugtracker), 9 were related to non-native arithmetization. We tackle these challenges by constructing a minimal overhead SNARK for integer computation that generically handles non-native arithmetic. We follow the recipe of Zaratan (PKC 26), which proves an integer relation such as $a\cdot b = c + u\cdot m$ by fingerprinting---reducing it to the same relation but over a randomly sampled prime field. Realizing this recipe requires an integer mod-PCS that commits to integer polynomials and opens their evaluations modulo a random prime, which is crucially chosen after the underlying PCS's setup and commitment phases. Our central contribution is Limber, the first practical integer mod-PCS construction that asymptotically has $o(1)$ multiplicative commitment overhead and can be instantiated with any standard field polynomial commitment scheme, including ones over small fields. Combining Limber with a PIOP for integer R1CS over the random prime yields our SNARK. We demonstrate its practicality by implementing our scheme and showing that we can prove an RSA accumulator benchmark $15$-$30\times$ faster than circuit-based approaches, and non-native Poseidon2 hashing $24\times$ faster.

Binary codes used in correlation generation and proof systems need strong distance, fast ordinary and transposed encoding, and regular memory access. We introduce Single-Permutation INterleaved (SPIN) codes, combining a blockwise outer encoder, one global interleaver, and a recursive inner. Our main result is a Structured SPIN family with rate $1/2$ and $O(N)$ bit operations for ordinary and transposed encoding at its native output lengths $N$. With probability $1-o(1)$ over the random choice of the code, its minimum distance exceeds $0.11N$. The proof combines outer spectrum bounds with an analysis of structured support spreading and recursive state mixing. We formally verify these distance and rate guarantees in Lean. For finite lengths, a BCH-derived outer constituent and a fixed recursive inner give rate $1/2$ and relative distance greater than $0.10$, with setup-failure probability below $2^{-40}$. We certify this bound at message lengths $2^{16}$, $2^{18}$, $2^{20}$, $2^{22}$, and $2^{24}$ using rigorous spectrum inequalities, without assuming the constituent's exact weight spectrum. For pseudorandom correlation generators (PCGs), SPIN's transposed encoder computes $2^{20}$ $128$-bit correlation blocks in about $9.3$\,ms on one Ryzen 9 7950X thread after precomputation. This is approximately $3.4\times$ faster than the original rate-$1/2$ BAA codes of Kolesnikov et al.\ (CRYPTO 2026). Ordinary encoding has similar cost. With a precomputed code, libOTe's regular-noise Silent OT sender achieves $89.0$ million hashed OTs per second on one core, in batches of $2^{18}$. Timings exclude initial setup, base-correlation generation, and network transport. We also use SPIN in a Brakedown-style polynomial commitment scheme and integrate it into Flock. Commitment and one opening of $512$\,MiB take $509$\,ms on one core, with a 100-bit interactive fixed-matrix testing target; this excludes code-setup failure, extraction, and Fiat-shamir reductions. Within an optimized Flock implementation, replacing Ligerito with SPIN--Brakedown improves prover throughput by $1.63$--$2.29\times$ at the measured workloads, with larger proofs and slower verification. The comparison gives both backends the applicable shared implementation optimizations.

We construct fast linear codes over large fields using addition-only encoders and variants with small integer coefficients. A local precode is followed by rounds of a random permutation and a scan, a linear recurrence with a short feedback window. At dimension $2^{20}$, rate $1/2$, and $p=2^{128}-159$, two plain accumulators (unweighted prefix sums) give relative distance above $11.7\%$, except with probability below $2^{-49.64}$ over the sampling of the encoder. A binary subset-sum precode instead gives distance above $12.56\%$, except with probability below $2^{-22.05}$. These addition-only encoders use fewer than $6.8125n$ and $3.3125n$ field additions, respectively, for output length $n$. Both exceed the binary rate-$1/2$ Gilbert--Varshamov benchmark. The proof counts the supports and ranks of the zero equations a codeword must satisfy, retaining the dependence between cancellations. Coefficient size and scan width extend the tradeoff. On one core, with a common implementation and setup failure below $2^{-40}$, encoding time ranges from $12.171$ ms at proved distance above $11.7\%$ to $32.342$ ms above $42.987\%$. A coefficient-independent upper bound limits every encoder with two width-one scans after the Newton precode to $39.6855\%$. The distance and setup-failure bounds hold over $\mathbb F_p$ and every finite extension, covering all nonzero messages after setup. Timings are for $\mathbb F_p$. Extension preserves distance exactly because the encoder coefficients lie in the prime subfield. Changing characteristic requires a separate argument; we give field-transfer results in both directions, including counterexamples.

We prove that Expand--Accumulate (EA) codes approach the Gilbert--Varshamov (GV) distance as the code length grows. The result holds over the binary field and every fixed finite field. At fixed rate, encoding uses $O(n\log n)$ expected field operations, with a tunable inverse-polynomial probability of sampling a bad code. Fixed-memory wrapped binary Expand--Convolute (EC) codes satisfy the same guarantee. Allowing $O(n\log^2 n)$ expected field operations makes sampling failure negligible in the code length. These codes combine a sparse random linear map with an invertible recursive map. Our analysis uses exact input--output weight enumerators in place of the earlier concentration bounds. It also gives tighter constants in the logarithmic expected degree. For EA-based pseudorandom correlation functions, these bounds improve the degree--distance tradeoff that controls local evaluation cost. Separately, we obtain finite-length bounds at small degrees by replacing independent incidence with regional regularity. At rate one half, a two-sided regular EC ensemble with left/right degrees $10/5$ and memory $15$ reaches $99.99\%$ of the binary GV distance. The probability of sampling a generator below this distance is less than $2^{-32.49}$. We extend the construction to finite fields using independent nonzero edge labels and full-field convolution coefficients. These coefficients mix field components; scalar extension of a binary matrix does not. Over $\F_{2^{128}}$, degrees $24/12$ with memory $5$ reach $98.41\%$ of the rate-one-half GV distance with sampling failure below $2^{-45.03}$; degrees $26/13$ with memory $4$ reach the same distance with failure below $2^{-135.20}$. Every finite claim is certified with outward-rounded interval arithmetic. The results concern minimum distance of sampled ensembles; they do not provide a decoder or a complete protocol-security proof.

We give fully distributed multi-point function (DMPF) constructions that share a sparse map over a domain of size $N$. Setup takes secret-shared indices; each later expansion takes new payloads for those indices and returns shares of the map. Our main construction, Waterfall Cuckoo, samples public hashes before assigning the inputs to bins. An occupancy scan followed by bounded repair finds the assignment; a hidden permutation conceals it during routing. Sparse DPFs then provide $4N$ or $3N$ leaf work per expansion, replacing the $tN$ work of $t$ independent DPFs. We prove correctness and semi-honest simulation in the ideal-subprotocol model, with an explicit routing-error bound. For the random sparse supports in Ring-LPN PCGs, we also give Reverse Cuckoo, a $2N$-expansion specialization. It programs hashes around a hidden placement and leaks information about the support: in the ideal hash model, outputs are weighted by their number of valid placements. We characterize the idealized leakage, state the additional decisional Ring-LPN assumption, and evaluate leakage-aware decoding attacks. A separate analysis bounds the concrete hash evaluator's batch correctness error below $2^{-40}$ at ring degree $2^{20}$ with the support-rejection filter specified in the analysis. Our measurements use a variant of this specialized Reverse-Cuckoo pipeline without support rejection or AES rekeying, and with different mask, permutation, and evaluator-seed sampling rules. At degree $2^{20}$ it produces 1.81 million Goldilocks-field OLEs per second, with 12.99 MB communicated per expansion. Against the reported FHE baseline at the same field and degree, these figures give $6.57\times$ higher throughput and $13.60\times$ lower expansion communication. Setup costs and comparisons with the sum-of-DPFs baseline are reported separately. Waterfall's costs are modeled; gains for other fields, rings, and PCG constructions remain application-dependent.

Secure computation often hashes high-entropy fixed-length values in inner loops. A public permutation with terminal Davies--Meyer feed-forward can expose the permutation value when an application applies another feed-forward step. We study an input-fed alternative that injects the input after every AES round. The base construction, $H_{128}:\{0,1\}^{128}\to\{0,1\}^{128}$, uses ten full AESENC-style rounds with keys $x+c_i$ and no AES key expansion. Its concrete analysis adapts differential, collision, linear, integral, and meet-in-he-middle (MITM) methods to this shared-input round-key interface. We prove a three-round integral distinguisher and give a five-round anchored MITM attack candidate with estimated time $2^{120}$; the remaining results provide reduced-round evidence rather than a proof of random-function behavior. On an AMD Ryzen 9 7950X, measured scalar and eight-lane AES-NI costs are within one percent of fixed-key AES-128; a sixteen-block VAES kernel is 2.3\% slower. Two extensions use the same input-fed principle. The tweakable construction $H_{128}^{\mathsf{tw}}$ splits a 72-bit public counter into an eight-bit tweak and a 64-bit epoch. One public schedule serves 256 consecutive positions, and consecutive fixed-key AES outputs under a published key supply the epoch schedules. Within one epoch, a pair with different tweaks can cancel at most one complete boundary injection. The construction also admits an exact 256-query two-round integral distinguisher. The wide construction $H_{256}$ maps 256 bits to 256 bits. It uses two AES lanes and adopts the column permutation and round constants of Haraka-256 v2 [KLMR16]. We analyze the differential, integral, collision, slide, rebound, and MITM mechanisms introduced by these extensions. A supporting ideal-permutation analysis shows that affine wrappers with one or two permutation calls fail generically. For three calls with independently uniform public constants, it gives a birthday-order bound when the distinguisher completes its primitive queries before querying the target. Finally, we define checkable punctured vectors and prove a GM-style protocol secure against static semi-honest corruptions in the ideal-OT and random-oracle model.

In this work, we verify, using the Lean 4 proof assistant, that the Jolt zk-VM's expanded programs faithfully emulate a RISC-V CPU. Prior work translated the official Sail specification of RISC-V into Lean. We extend this model to define the Jolt ISA in Lean. We build a generator that runs Jolt's Rust bytecode expander and renders its output as Lean programs. Finally, for 51 out of 58 such programs, we prove these expansions are equivalent to their corresponding RISC-V instructions. This lays the groundwork for proving completeness and soundness of further stages of Jolt's proving pipeline.

In this paper, we present a novel power analysis attack targeting a Falcon implementation protected by a masked preimage computation. By analyzing the ratio between the real and imaginary parts of the public hash polynomial, we demonstrate that the leakage during the share recombination phase can be exploited to recover the secret key. We propose two attack variants: a chosen-message attack, where the adversary controls input messages to force extreme coefficient ratios, and a non-chosen-message attack that filters for naturally occurring vulnerable hashes. Through experimental evaluations using the ELMO leakage simulator for an ARM Cortex-M0 architecture, our experiments achieve a 98.3% success rate with 4,000 traces. Finally, while a fully masked implementation of Falcon prevents our attack, we propose a practical countermeasure based on rejection sampling to avoid the prohibitive computational overhead of a fully masked Gaussian sampler.

Verifiable Secret Sharing (VSS) allows a dealer to distribute a secret among $n$ parties so that each can verify their share's validity, and any qualified subset can reconstruct the secret. Publicly Verifiable Secret Sharing (PVSS) extends VSS by enabling anyone to verify the correctness of distributed shares. Both VSS and PVSS schemes are core building blocks in many cryptographic applications. We introduce a $k$-batched and $l$-packed extension of $\Pi$, a unified framework from PKC 2025 for Shamir-based computational VSS in the synchronous setting with optimal resilience. Our framework enables the sharing and verification of $l\times k$ secrets in a single protocol execution, offering a tunable trade-off between efficiency and robustness: the $k$-batched, non-packed variant ($l=1$) improves performance while maintaining optimal resilience, whereas the $k$-batched, $l$-packed variant achieves even greater efficiency at the cost of slightly reduced fault tolerance. Using this framework, we construct several Batched and Packed (BP) VSS and PVSS schemes that significantly reduce both computational and communication costs for the dealer and parties. When sharing many secrets, two of our VSS schemes and our PVSS scheme perform almost as efficiently as plain Shamir sharing. For example, when sharing more than 100 secrets, the overhead of our hash-based BP-VSS is below 3%, for our BP-VSS with information-theoretic privacy it remains around 8%, and for our BP-PVSS it is under 1%. These results show that verifiability in Shamir secret sharing can be achieved in post-quantum and large-scale settings with negligible overhead for the dealer. Our proposed BP-PVSS scheme is the first that can achieve these properties and outperforms existing state-of-the-art protocols. We discuss several applications and, as a concrete case study, use our BP-PVSS scheme to revisit the ALBATROSS randomness generation protocol from ASIACRYPT 2020, yielding a more efficient variant.

Secure multi-party computation (MPC) considers the problem of securely computing a function across $n$ parties such that no adversary controlling $t$ corrupted parties may learn any additional information beyond the function output. For information-theoretic security in the honest majority setting, recent works have made tremendous progress in reducing the MPC communication costs for large circuits obtaining as low as $\tilde{O}(|C|)$ total communication. To date, all information-theoretic MPC protocols require an additive $\tilde{\Omega}(n^2)$ communication independent of the circuit size that becomes the dominant cost for small circuits. In this work, we consider the problem of building more efficient information-theoretic MPC protocols with $o(n^2)$ communication for small circuits. For corruption threshold $t< (1/2-\epsilon)\cdot n$, we present an information-theoretic MPC protocol secure against adaptive and malicious adversaries with subquadratic communication for a wide range of circuits, including those in which the number of input parties $I$ satisfies $|I| = o(n)$, circuit size $|C| = o(n^{1.5}/|I|)$, and circuit depth $\mathsf{depth}(C) = o(n)$; for example, $|C| = o(n^{3/4})$ and $|I| = o(n^{3/4})$ input parties. To our knowledge, this is the first information-theoretic MPC protocol with $o(n^2)$ communication for a wide-range of circuit classes. Furthermore, we note the requirement of sublinear input parties $|I| = o(n)$ is necessary to obtain $o(n^2)$ communication due to the $\Omega(|I| \cdot n)$ lower bound by Damgård {\em et al.} [EUROCRYPT'16]. To obtain our new MPC protocol, we develop new techniques for key MPC subroutines including randomness generation, player virtualization and output reconstruction with $o(n^2)$ communication leveraging the sublinear number of input parties, $|I| = o(n)$, and randomized output distribution with unpredictable communication patterns. Finally, we also prove a separation showing that $o(n^2)$ communication MPC is impossible for adversaries with stronger than standard adaptive rushing capabilities even for constant-size circuits.

Programmable bootstrapping is a central procedure in the FHEW and TFHE families of fully homomorphic encryption schemes, but its computational cost remains a major performance bottleneck. Multi-value bootstrapping amortizes this cost by sharing a blind rotation among several functions evaluated on the same encrypted input. However, the standard choice of common factor for multi-value bootstrapping can produce unnecessarily large noise amplification for many collections of lookup tables, thereby reducing the practical benefits of sharing the blind rotation. The main contribution of this work is a log-unit lattice search for selecting common factors that substantially reduce this amplification. This search is complemented with LUT shifting, which generates alternative function-preserving test-polynomial representations and further enlarges the search space. Both optimizations are performed offline and leave the online procedure of multi-value bootstrapping essentially unchanged. The proposed construction is evaluated in TFHE at failure probability $2^{-128}$. For example, on 256-bit homomorphic integer multiplication, it achieves a latency speed-up of $1.47\times$ and a throughput improvement of $1.59\times$ relative to a baseline that evaluates each output with a separate programmable bootstrapping.

This paper considers the problem of building blind signatures in pairing-free groups. We provide the first three-move blind signature which is provably one-more unforgeable, in the random-oracle model, under the minimal assumption that the discrete logarithm (DL) problem is hard. Our construction in fact achieves one-more strong unforgeability, and also supports partial blindness. Blindness is statistical, also in the ROM. Our construction makes black-box use of the underlying group and does not rely on non-black-box techniques. For most such constructions, three moves are necessary by a recent result of Dietz, Kastner, and Tessaro (CRYPTO '26). We build on recent work by Chairattana-Apirom, Reichle, and Tessaro (CRYPTO '26), which achieved the same combination of round complexity and security guarantees, but under the stronger decisional Diffie--Hellman (DDH) assumption. In particular, we follow the same paradigm of boosting the security of a weakly secure scheme (namely, the Okamoto--Schnorr blind signature) to a fully secure one by authenticating the initial nonce. We provide, however, a substantially different instantiation of this paradigm that dispenses with the use of DDH and establishes security from DL alone.

Homomorphic secret sharing (HSS) enables non-interactive distributed evaluation of functions on secret-shared inputs. While two-party HSS is well understood, multiparty constructions remain limited in expressiveness and efficiency. We present a general framework for constructing multiparty HSS from two-party semi-private HSS (which in turn can be instantiated using distributed discrete logarithms) via a new party virtualization paradigm. In a semi-private HSS, some designated inputs may be fully known to specific servers, while the remaining inputs remain hidden. Starting from two-party semi-private schemes, we obtain $N$-party semi-private HSS supporting compositions of polynomial computations and restricted multiplication straight-line programs, for $N = O(\log \lambda / \log \log \lambda)$. We further upgrade semi-private HSS to fully private HSS for functions of polynomial degree and polynomially bounded Waring rank. As a consequence, we obtain multiparty distributed point functions with key size polynomial in $\lambda$ and $\log |D|$, for a domain $D$ of superpolynomial size. When the underlying two-party scheme supports offline/online sharing, the resulting multiparty DPFs are programmable. Our framework admits instantiations under standard assumptions including DCR and class-group assumptions.

Training machine learning models in untrusted clouds requires strong guarantees of confidentiality, integrity, and correctness, while remaining scalable and resilient to node churn. These challenges are further amplified in emerging agentic AI systems, where autonomous and distributed learning components require trustworthy coordination and secure state management across heterogeneous cloud environments. Existing Trusted Execution Environments (TEEs) lack scalability and remain vulnerable to side-channel attacks for large workloads, while pure secure multi-party computation (MPC) approaches incur prohibitive overhead in practice. SENTRA (Secure ENclave-based TRaining Architecture) addresses these challenges through a hybrid architecture that combines TEEs, secret sharing, and communication-efficient MPC with system level mechanisms that secure the entire training lifecycle. SENTRA introduces a scalable collective attestation protocol that verifies all participating enclaves and enforces hardware exclusivity before any node may store or process secret shares. Training data and model parameters are stored as secret shares in a versioned enclave-backed key–value store (KVS), providing rollback protection and consistent state under adversarial conditions. SENTRA further supports dynamic, fault tolerant membership through Dynamic Proactive Secret Sharing (DPSS)-based resharing, safe packed-MPC computation under degree bounds, and adaptive handling of node failures. Evaluation of a prototype implementation shows that SENTRA achieves up to 8.89 samples/s throughput and 1.29× faster training than the CrypTen baseline in software-only mode. In hardware-enclave mode, SENTRA incurs only an 8.3% performance overhead while providing memory-isolated confidentiality, fault-tolerant membership management, rollback protection, and recovery from node failures in approximately 8 seconds.

We present the first formal verification results for the highly optimized additive Fast Fourier Transforms (FFTs) in two different code-based post-quantum cryptosystems: Classic McEliece and Hamming Quasi-Cyclic. Since Classic McEliece is already a standard and HQC is being standardized, they may both see wide adoption in the future. The Gao-Mateer and Frobenius additive FFTs during decoding are clearly the most intricate, error-prone components in the two cryptosystems respectively. They are not only complicated and mathematically intricate, but also aggressively optimized in practical implementations. A main problem of this verification is the $>2^{14}$ independent bit-variables in each multiplicand. Aside from adding a vector syntax and improving various syntactic transformations to the open-source tool CryptoLine, we also formulate additive FFTs as Chinese Remainder Theorem decompositions which factors the verification problem into local checks feasible for computer algebra systems like Singular. The workload was also tractable: the calendar time for the formal verification in this paper was less than three months for our very limited workforce.

Threshold signature schemes play a vital role in securing digital assets within blockchain and distributed systems. $\textsf{FROST2}$ stands out as a practical threshold Schnorr signature scheme, noted for its efficiency and compatibility with standard verification processes. However, under the one-more discrete logarithm assumption, with static corruption and centralized key generation settings, $\textsf{FROST2}$ has been shown by Bellare et al. (in CRYPTO 2022) to achieve only $\textsf{TS-SUF-2}$ security, which is a consequence of its vulnerability to $\textsf{TS-UF-3}$ attacks. In this paper, we address this security limitation by presenting an enhanced variant of $\textsf{FROST2}$, namely, $\textsf{FROST2}\texttt{+}$ which achieves the $\textsf{TS-SUF-4}$ security level under the same computational assumptions as the original $\textsf{FROST2}$. $\textsf{FROST2}\texttt{+}$ strengthens $\textsf{FROST2}$ by integrating additional pre-processing token verifications that help mitigate $\textsf{TS-UF-3}$ and $\textsf{TS-UF-4}$ vulnerabilities while maintaining practical efficiency. We show that $\textsf{FROST2}\texttt{+}$ can achieve $\textsf{TS-SUF-4}$ security not only under the same conditions as the original $\textsf{FROST2}$ analysis, but also when initialized with a distributed key generation protocol such as $\textsf{PedPoP}$. Our benchmark using ZCash's $\textsf{FROST}$ library shows that the performance of $\textsf{FROST2}\texttt{+}$ is comparable to $\textsf{FROST2}$ and about $64-79\%$ faster than \textsf{FROST} when precomputation is enabled

We introduce Output-Adaptive Security, a new intermediate security notion for Attribute-Based Encryption (ABE) that bridges the gap between selective and full adaptive security. In our model, the adversary selectively commits to a policy function structure $f$ but adaptively chooses a long target output value $y$ during the challenge phase. We construct the first Output-Adaptive ABE scheme for general circuits from the standard Learning With Errors (LWE) assumption by revisiting classical partitioning techniques and applying them to the output space of circuit evaluation. Our result demonstrates that adaptivity for expressive policies can be achieved from standard lattices without complexity leveraging or heavy tools like witness encryption and indistinguishability obfuscation. Furthermore, we show that output-adaptivity is sufficient for many real-world applications, including biometric matching, weighted thresholds, and wildcard search, where system architecture is static while policy targets remain dynamic.

We prove that $4k+4$ rounds of AES with independent uniform round keys are $2^{-14-61k}$-close to pairwise independent, improving on Hurst's announced bound of $2^{-3.82-48.03k}$. Here, closeness is measured by the total variation distance between the outputs on any two distinct plaintexts and those of a uniform random permutation, with the round keys sampled once and retained across evaluations. Consequently, 12, 16, and 20 rounds suffice for statistical accuracy $2^{-128}$, $2^{-192}$, and $2^{-256}$, respectively. Our bound also holds for the complete view of any algorithm making at most two adaptive classical forward queries. We develop a general bound for local difference channels acting on additive MDS codes, expressed through the second moment of a Gram matrix. This bound controls the dependencies created by diffusion and refines the activity-space analysis of previous work. Combining the resulting contraction estimate with a sharper analysis of the initial difference distributions yields the stated mixing bound.

The Walsh-Hadamard transform (WHT) computes the correlation of a Boolean function with every linear function at once. Cryptanalytic workflows transform large arrays repeatedly, in batches. However, available tools specialize in particular data types, platforms, or ecosystems. We present LibFWHT, an open-source C library for dense WHTs, with Python bindings and a command-line interface. It includes vectorized, multicore, and graphics processing unit (GPU) backends, batch operations, and routines for Boolean functions and substitution boxes (S-boxes). With one central processing unit (CPU) core, LibFWHT is 2.5 to 3.3 times faster than FFTW; on batched Boolean spectra with eight threads, it is up to 3.7 times faster than sboxU. On an NVIDIA H200, its device-resident GPU backend reaches 1.8 trillion operations per second and runs the same Boolean workload about 600 times faster than the CPU-only sboxU. We demonstrate LibFWHT in linear and differential-linear cryptanalysis of reduced-round SIMON-32, KATAN-32, BEANIE, KeeLoq, and RC5-16, all with 32-bit blocks. To the best of our knowledge, we report the first exact differential-linear distinguishers for KATAN-32, BEANIE, KeeLoq, and RC5-16. We measure these correlations over many sampled keys and ask which key bits make them vary. Using the geometric approach to cryptanalysis, we search for key-dependent trails to propose candidate round-key bits. The search alone does not show how much these bits affect the correlation, because contributions from trails that depend on the same bits can cancel. For an 84-round KATAN-32 distinguisher, the lowest-weight key-dependent trails we enumerated have contributions that sum to exactly zero. We therefore check the proposed bits using exact correlations on independently sampled master keys, with round keys derived by the cipher's key schedule. For a 13-round differential-linear distinguisher of SIMON-32, two round-key bits explain 93.1% of the variance in the measured signed correlations. They identify a low-correlation class containing about a quarter of the sampled keys. A single root-mean-square (RMS) correlation over all sampled keys hides this difference. For the low-correlation group, the usual data estimate is about 40 times the estimate based on the overall RMS. This compares group estimates and does not guarantee success for each key. Key dependence therefore belongs in the analysis, and we report distributions over keys rather than single numbers.

Accordion modes have experienced a surge in popularity, partially motivated by the recent NIST Accordion modes project. None of the existing practical constructions is leakage-resilient by default. In this work, we design a leakage-resilient Accordion mode. We start by presenting a generic analysis of the Encode-then-Encipher (EtE) framework in the leakage-resilient setting, assuming the enciphering is a leakage-resilient STPRP (STPRPl2). We show that the resulting security, while strong, suffers from some limitations. Next, we introduce Motte-and-Bailey, a general framework for building leakage-resilient accordion modes, in the spirit of the PIV construction. Motte-and-Bailey, or MaB for short, is a leveled construction, requiring light assumptions on most of its components to guarantee good STPRPl2, CIML2 and CCAMl2 security. In particular, we require two fully protected calls to a TBC, a collision-resistant hash function (with unbounded or light leakage), and an ideal leakage-resilient PRG, secure against single-trace attacks. Additionally, we present particular instantiations, Qaitbay and Alicante. In Qaitbay the PRG and the hash function are replaced by the Sponge function, while an independent TBC is used for the leak-free calls. Alicante makes use of an ideal cipher, and uses the MDPH hash function and the 2PRG construction, while the leak-free calls are implemented using independent calls to the ideal cipher. We also give three flavours of how to instantiate the TBC inside Qaitbay. Last but not least, we show how to strengthen MaB, Qaitbay and Alicante to also achieve CCAmL2.

Can simple processes appear highly complex? Gowers (Comb. Prob. Comp. '96) conjectured that repeatedly composing local random reversible operations can yield global permutations that are indistinguishable from random. In this work, we study the unitary quantum analog of this question, in an attempt to make new progress on this longstanding conjecture. Our first result shows that statistical moment matching in the form of unitary designs does not generically lead to pseudorandomness---even for the simplest quantum processes: for every fixed $t$, we give an efficiently samplable family $\{\nu_n\}_n$ of distributions on one- and two-qubit gates such that, after $T=O_t(n^2\log^2 n)$ independent steps, the resulting $n$-qubit ensemble is an approximate unitary $t$-design with negligible error $\exp(-\Omega(\log^2 n))$, yet an efficient quantum algorithm distinguishes it from random using only $O_t(\log^2 n)$ queries. This refutes the unitary analog of the Hoory--Magen--Myers--Rackoff conjecture (ICALP '04) for permutations. Our second result is a stronger separation between unitary designs and pseudorandom unitaries at polynomially bounded moments; our counterexample, however, requires highly structured ensembles, in contrast with the simple local walks from before. This suggests caution when using unitary designs to model information scrambling in black-hole physics, as even maximally scrambled systems can exhibit structure which is accessible to efficient experiments. Motivated by these findings, we then propose new conjectures for how pseudorandomness can plausibly emerge within simple quantum processes, such as random quantum circuits.

Position verification, introduced by Chandran et al. (SIAM J. Computing 2014), allows verifiers to test a prover's claimed position by an interactive protocol. Classical position verification is impossible. Even for Quantum Position Verification (QPV), there always exists an LOCC (Local Operations and Classical Communication) attack if the adversary can hold an exponentially large amount of preshared entanglement. Somewhat surprisingly, we show that we can circumvent this barrier in the idealized continuous-time model, where time is represented by a real-valued parameter and challenge messages can be sent at a time sampled uniformly from a real interval. In this model, we give a BB84-based protocol that remains secure against any finite coalition of LOCC adversaries with arbitrary finite (possibly exponential) quantum storage and entanglement. Our construction can also be instantiated in the discrete-time model. Even though the previous impossibility results apply, we are able to obtain an information-theoretic QPV protocol in which the honest parties' total resources (communication and storage) can be significantly smaller than the adversarial resource bound. In fact, we can achieve any desired polynomial gap between honest parties and adversarial resources. To our knowledge, all previous protocols in the literature required resources of the honest parties to be at least as large as the adversarial entanglement. Interestingly, the resource gap between the honest and adversarial party resources in our protocol depends on how precisely time can be measured. As the precision of the best-known clock improves with further research, the resource gap in our protocol keeps increasing. In particular, the adversarial resource bound keeps increasing while the honest parties' resources remain largely the same. We call this the "I sleep, you work" paradigm.

BIP39 is a Bitcoin standard that turns a wallet's random seed of size between 128 and 256 bits into a human-readable sequence of 12 to 24 words, taken from a fixed 2048-word list. Each word corresponds to an index in that list. DuraShare allows the holder of this sequence to split it among $n$ Sharekeepers, each of whom receives one share. Any subset of $k$ Sharekeepers can combine their shares and reconstruct the original sequence, whereas $k-1$ colluding Sharekeepers obtain no (Shannon) information. For everyday convenience we adopt a software-assisted model, while ensuring that a full manual fallback remains feasible for recovery, requiring nothing beyond paper, a calculator, and specific instructions. This matters because Sharekeepers may be family members or lawyers unfamiliar with crypto-technology, called upon only decades later, when no specific vendor, software, or hardware can be assumed to still exist. DuraShare combines three existing, well-established cryptographic techniques: (1) Shamir Secret Sharing over $\mathbb{F}_{2053}$, the smallest prime larger than 2048; (2) 2D error detection, applying row and column checksums to each share to protect the data against transcription errors and physical damage; and (3) a simple affine inner-product MAC over $\mathbb{F}_{2053}$ to authenticate each share, preventing a Sharekeeper from tampering without being detected.

AI systems increasingly produce outputs from confidential data, such as a fitness-for-duty assessment from medical records or the predicted properties of a drug candidate from its secret structure. It is important to verify that such outputs are correct without revealing the underlying data. A recent line of work studies verification of AI outputs via interactive proofs and debate for oracle-aided computation, where correctness may depend on an oracle such as human judgment, a physical experiment, or the web. These works focus on verification by a verifier that runs much faster than the computation. However, such efficient verification is impossible for general oracle-aided computation, and these works therefore rely on additional assumptions. We focus instead on privacy: allowing the verifier to run in time polynomial in the computation, we ask whether interactive arguments for oracle-aided computation can be zero knowledge, so that the verifier learns nothing about the confidential data beyond the correctness of the output. We prove that, in general, they cannot. In the random oracle model, there are no zero-knowledge proofs for all oracle-aided computations, even if both the prover and the verifier are allowed to run much longer than the computation itself. The impossibility extends to debate, a canonical model for scalable oversight. On the positive side, we show that if the oracle attaches a cryptographic signature to each of its answers, then every oracle-aided computation can be verified in zero knowledge with an efficient prover and verifier, assuming only collision-resistant hash functions. Beyond privacy, this also gives an alternative approach to scalable oversight that relies neither on an honest opponent, as in debate, nor on the robustness of the computation, as in prior single-prover protocols.

We introduce new pseudorandom correlation generators (PCGs) for matrix triples: shares of triples $(A,B,A\cdot B)$ where $A,B$ are random matrices over $\mathbb{F}^{n\times n}$ for a field $\mathbb{F}$ and an integer $n$. Matrix triples are consumed in a wide variety of secure computation protocols that involve matrix arithmetic, which occurs commonly in settings such as privacy-preserving machine-learning and statistics, threshold cryptography, secure linear algebra, and more. Previous PCGs for matrix triples are inefficient: their seed grows at least linearly in the matrix dimension, and their expansion is slow. In this work, we introduce two new PCGs with improved performances: 1. Our first construction, inspired by the recent work of (Gentry and Lee, Crypto 2026) on FHE for matrix arithmetic, relies on the quasi-abelian syndrome decoding (QASD) assumption introduced in (Bombar et al., Crypto 2023), an assumption which has since received a significant amount of attention. Our PCG generates $N$ matrix triples over $\mathbb{F}^{n\times n}$ from a seed of size $poly(\lambda,\log n,\log N)$ using $\Theta(n^3\log(n^3N))$ field operations per triple, removing the linear dependency on $n$ from the seed compared to previous works. 2. Our second construction is more mathematically involved, and builds upon an elegant and surprising connection with the Weyl-Pauli twisted algebra, a mathematical structure originally studied in (Weyl, Zeitschrift für Physik, 1927) in the context of quantum kinematics. Our PCG relies on a new variant of the QASD assumption over the Weyl-Pauli twisted group algebra and exhibits impressive performances: it has the same seed size as our first construction and generates $N$ matrix triples at a cost only a small constant time larger than the cost of computing $N$ matrix triples in the clear. We complement our results with an in-depth study of our new twisted QASD assumption and demonstrate the benefits of our PCGs in concrete applications such as privacy-preserving machine learning and threshold MAYO.

We address the problem of proving the validity of computation on ciphertexts of homomorphic encryption (HE) schemes, a feature that enables outsourcing of data and computation while ensuring both data privacy and integrity. We propose a new solution that handles computations in RingLWE-based schemes, particularly the CKKS scheme for approximate arithmetic. Our approach efficiently handles ciphertext arithmetic in the polynomial ring $R_q$ without emulation overhead and manages ciphertexts maintenance operations, such as modulus switching, key switching, and rescaling, with small cost. Our main result is a succinct argument that efficiently handles arithmetic computations and range checks over the ring $R_q$. To build this argument system, we construct new polynomial interactive oracle proofs (PIOPs) and multilinear polynomial commitments supporting polynomials over $R_q$, unlike prior work which focused on finite fields. We validate the concrete complexity of our approach through implementation and experimentation. Compared to the current state-of-the-art on verifiable HE for RNS schemes, we present similar performance for small circuits while being able to efficiently scale to larger ones, which was a major challenge for previous constructions as it requires verifying procedures such as relinearization.

Fully anonymous secret-sharing schemes ensure two properties at once: for any fixed secret, the combined shares of every unauthorized set of participants are uniformly random, and every authorized set can reconstruct the secret exactly using only the share values, without needing to know which participant holds which share or in what order the shares appear. It was previously open whether such schemes exist for nontrivial exact-threshold parameters 2 < t < n. For the smallest previously open threshold, t= 3, we give, for every n≥4, an explicit fully anonymous scheme for one-bit secrets, with 2⌈log n⌉-bit shares and a perfect reconstruction algorithm running in poly(log n) time. The next result, found by ChatGPT, shows that for every 1 ≤t ≤n there exists a fully anonymous perfect (t,n) threshold secret-sharing scheme for one-bit secrets, in which each share has length O(tlog n) bits. The proof is purely existential and does not provide an efficient construction. Moreover, ChatGPT identified a simple construction of a fully anonymous perfect scheme for every access structure A; if A contains ℓ authorized sets, then each share consists of ℓ2 bits. The authors subsequently verified and streamlined the proofs on their own and take full responsibility for their correctness.

An important open question in quantum cryptography is the construction of publicly-verifiable NIZKs for QMA. Classically, one can construct NIZKs for NP in the random oracle model (and sometimes in the standard model) by compiling an honest-verifier ZK (HVZK) $\Sigma$-protocol for NP using the Fiat–Shamir transformation. Broadbent and Grilo introduced a quantum analog of a $\Sigma$-protocol (which they call a $\Xi$-protocol) in which the prover's first message is quantum, and show that HVZK $\Xi$-protocols exist for QMA. However, it is not clear how to compile such protocols into NIZKs in the (Q)ROM, because the Fiat–Shamir transformation seems to be incompatible with quantum messages. In this work we give formal evidence that this is indeed the case: we show that if generic "Fiat–Shamir-like" compilers for quantum protocols exist in the QROM (with small completeness and soundness error) then QMA = BQP.

GCM is the leading authenticated encryption scheme. With its application in TLS alone, it finds millions of uses every day. However, in the last years, various shortcomings of GCM have been observed: mistakes in earlier proofs, non-optimal security degradation in case of shorter tags, the support for a $96$-bit nonce only (concatenated with a $32$-bit counter) for the most widely implemented variant, but most of all, the brittle resistance against nonce misuse. This latter shortcoming is particularly worrisome in applications where uniqueness of the nonce cannot be guaranteed (such as in distributed systems). In part to salvage this situation, the US National Institute of Standards and Technology (NIST) is contemplating the idea of standardizing Rijndael-256-256. Indeed, sticking to the concept of a $32$-bit counter, this would allow the support of $224$-bit nonces next to the $32$-bit counter. Nonetheless, it may be observed that nonces may still be accidentally reused due to other causes and the larger block size does not solve the fatal effects of nonce misuse, among which the possibility to perform a subkey recovery. To salvage this, we propose GCM-256. The fix is, as a matter of fact, rather simple and comes almost for free. In a nutshell: whereas a native generalization of GCM to $256$-bit blocks would mask the output of GHASH with only half of the output of the initial nonce based block cipher evaluation, we suggest to not discard the other half but use it as key to GHASH. As an effect, we demonstrate that GCM-256 does not only achieves classic confidentiality and authenticity, but as a bonus it achieves nonce misuse resilience, meaning that even if nonces are misused, the scheme still guarantees security for fresh nonces.

We significantly expand the reach of isogeny-based cryptography by constructing, for the first time, two fundamental primitives that have long remained out of reach from isogenies: identity-based encryption (IBE) and semi-honest single-server private information retrieval (PIR) with communication polylogarithmic in the database size. Our IBE additionally achieves anonymity, which means that the ciphertexts hide both the message and the recipient identity. Our results are enabled by new techniques for constructing cryptographic primitives from structured isogeny computations, centered around the first construction of blind batch encryption from isogenies. To establish its security, we introduce a new hardness assumption, CDH with Mismatched Torsion (CDHwMT), which informally captures the hardness of a CDH-like problem in the presence of structured auxiliary isogeny information. We provide evidence for its plausibility by showing that, in the Algebraic Isogeny Model, CDHwMT reduces to well-studied isogeny assumptions. The same techniques yield further cryptographic applications: the first isogeny-based hierarchical IBE, laconic oblivious transfer, and public-key encryption simultaneously achieving high-rate leakage resilience and key-dependent-message/circular security. All of our constructions can be conjectured to be post-quantum secure. Beyond these individual primitives, our results demonstrate that isogenies can support substantially richer cryptographic functionality than previously known, and provide new tools toward building advanced post-quantum cryptography.

The 2007 algorithm of Joux, Naccache, and Thomé (\textsc{jnt}) shows that, with subexponential access to an $e$-th root oracle, one can forge \textsc{rsa} signatures for \emph{odd} $e$ in time close to the special number field sieve, without factoring the modulus; a recent \textsc{jnt} implementation by Shea et al.~\cite{Forge26} carried that attack to $1024$-bit \textsc{rsa}. We revisit the \textsc{jnt} construction at $e=2$, the Rabin case, where an $e$-th root oracle is a square-root oracle. A \emph{raw} square-root oracle factors $n=pq$ in one query, so it is of no interest; the interesting object is a \emph{redundancy-constrained} (affine-padded) Rabin oracle that returns a single canonical root and thereby resists the one-query attack. We show that a one-sided number field sieve against such an oracle produces a congruence of squares $X^2\equiv Y^2\pmod n$ with $X\not\equiv\pm Y$ with probability $\tfrac12$ per dependency, and hence \emph{factors} $n$ in special-number-field-sieve time \[ L_n \left(\frac{1}{3},{\sqrt[3]{\frac{32}{9}}}\right)\simeq L_n(1/3,{1.526\ldots}), \] strictly below the general number field sieve's \[ L_n \left(\frac{1}{3},{\sqrt[3]{\frac{64}{9}}}\right)\simeq L_n(1/3,{1.923\ldots}). \] The mechanism is a pleasant inversion: the sign ambiguity that the odd-$e$ algorithm must suppress becomes, at $e=2$, the very quantity that \textsl{leaks the factorization}. We give the algorithm in full --- \textsc{lll} polynomial selection for a quadratic field, a line sieve producing prime-ideal relations, quadratic characters, $\mathbb F_2$ linear algebra, and an exact number-field square root --- prove the half-rate splitting, and analyse the complexity, including the precise reason the attack collapses when the padding is a hash rather than an affine function of an attacker-chosen message. An open-source implementation realises every step. A small toy example run of it, from the padded modulus to the recovered factors, is given in Appendix~\ref{app:example}. Our implementation confirms a clear performance improvement in factoring speed.

The ICCS Next-Generation Commercial Cryptography (NGCC) round-1 call received 84 public-key candidates for public evaluation. We present a design-level assessment that targets weaknesses no local code fix can close, identifying eight such flaws. Each recurs a pitfall already known from NIST PQC standardization: reducible-ring sub-ring projections that break IND-CPA below the claimed level; public data that fixes a value meant to remain secret, enabling public-key-only forgery or keyless decapsulation; static-key reuse without a chosen-ciphertext transform; and rejection sampling whose sign handling leaks an equivalent signing key. All findings were obtained with AI assistance. Artifacts: https://github.com/acprk/ngcc-round1-cryptanalysis.

Side-channel attacks exploiting Plaintext-Checking Oracles (PCOs) instantiated thanks to the leakage of the re-encryption step taking place during decapsulation are a well-known weakness of ML-KEM. An already wide literature investigated how to efficiently exploit such oracles, leading to easy (full) key recoveries. Somewhat surprisingly, the investigation of how to best instantiate PCOs against ML-KEM's most leaking operations is less investigated, in particular when it comes to quantitative evaluations against concrete masked implementations. In this paper, we first remedy this lack by systematically instantiating PCOs against three open source masked software implementations of the Keccak function used in ML-KEM, based on different masking techniques and programming styles. We evaluate the accuracy of PCOs for increasing number of shares using state-of-the-art profiled attacks against ARM Cortex-M4 implementations, and succeed obtaining high accuracy for up to 7 shares by leveraging the leakage of approximately 50 ML-KEM executions only. Doing so, we confirm the ``computing more implies leaking more'' adage and conclude that enforcing high security levels on such platforms will not be affordable. Next, we consolidate recent solutions for exploiting PCOs. For this purpose, we start by introducing a simple, concrete and re-usable model for PCOs targeting masked implementations of Keccak. We follow by clarifying that approaches based on hard decisions are suboptimal compared to soft (probabilistic) ones. We finally open a study of how to best exploit the adversary's computational power in a security evaluation. We show that (even naive) lattice based attacks are a promising approach for this purpose, leaving the design of a generic estimator that could efficiently leverage physical (side-channel) information as an interesting research direction.

In this article, we derive the weight distribution of linear codes stemming from a subclass of (vectorial) $p$-ary plateaued functions (for a prime $p$), which includes all the explicitly known examples of weakly and non-weakly regular plateaued functions. This construction of linear codes is referred in the literature as the first generic construction. First, we partition the class of $p$-ary plateaued functions into three classes $\mathscr{C}_1, \mathscr{C}_2,$ and $\mathscr{C}_3$, according to the behavior of their dual function $f^*$. Using these classes, we refine the results presented in a series of articles \cite{Mesnager2017, MesOzSi,Pelen2020, RodPasZhaWei, WeiWangFu}. Namely, we derive the full weight distributions of codes stemming from all $s$-plateaued functions for $n+s$ odd (parametrized by the weight of the dual $wt(f^*)$), whereas for $n+s$ even, the weight distributions are derived from the class of $s$-plateaued functions in $\mathscr{C}_1$ parametrized using two parameters (including $wt(f^*)$ and a related parameter $Z_0$). Additionally, we provide more results on the different weight distributions of codes stemming from functions in subclasses of the three different classes. The exact derivation of such distributions is achieved by using some well-known equations over finite fields to count certain dual preimages. In order to improve the dimension of these codes, we then study the vectorial case, thus providing the weight distributions of a few codes associated to known vectorial plateaued functions and obtaining codes with parameters $[p^n-1,2n, p^n-p^{n-1} - {p}^{(n+s-2)/2}(p-1)]$. For the first time, we provide the full weight distributions of codes from (a subclass of) vectorial $p$-ary plateaued functions. This class includes all known explicit examples in the literature. The obtained codes are minimal and self-orthogonal virtually in all cases. Notably, we show that this is the best one can achieve---there are no $q$-ary self-dual minimal codes for any prime power $q$, except for the ternary tetracode and the binary repetition code.

Multisignatures compress many signatures on a common message into a single aggregate. In large distributed systems, aggregation occurs over multiple hops, where partial aggregates may overlap. The recent hint-free multisignatures of Hofheinz, Reichle, and Wagner (TCC~2026) eliminate aggregation-topology hints, but verification still requires the complete set of participating public keys. This leaves open whether the signer-set information itself can be eliminated. We answer this question negatively. We introduce idempotent multisignatures to capture unrestricted aggregation of overlapping aggregates and prove that any such scheme has a signature size linear in the number of signers. To circumvent this lower bound, we introduce unique multisignatures, a sequential alternative that eliminates this metadata and retains constant-size signatures. We construct unique multisignatures using incrementally verifiable computations. Finally, replacing signature chains in authenticated Dolev-Strong Byzantine Broadcast with our primitive enables two-round termination when the sender is honest and reduces communication from $O(n^3)$ to $O(n^2)$ against $t<n$ adaptive corruptions.

Cryptographic watermarking for generative AI equips a generative model with a hidden mark that identifies its outputs as machine-generated, without affecting output quality. This study proposes a new cryptographic watermarking method with selective disclosability. Under this scheme, detection is restricted by default to the model owner, who can selectively issue a short token for any single output. This token enables any third party to verify that the specific output is watermarked, while guaranteeing that all other outputs remain undetectable, even to the token holder. This scheme is particularly useful in scenarios where a provider must certify a single controversial output without compromising the privacy of other outputs. In addition to two existing security properties, namely robustness and unforgeability, we formalize two security properties, undetectability of undisclosed data and disclosure soundness, to achieve our goal. We then propose our construction based on prior work (Lin, Shahabi, and Song, CRYPTO 2026) and prove it satisfies the four security notions. Our construction is broadly applicable to autoregressive generative AI models, including LLMs.

Threshold fully homomorphic encryption distributes decryption authority among multiple parties, but achieving strong security can significantly increase the required ciphertext modulus and the size of each decryption response. Existing parameter analyses typically focus on threshold decryption alone. In particular, the recent work of Kim et al. (KLL$^+$26) analyzes correctness and strong simulation security of partial decryption without covering distributed key generation (DKG). When the parties generate the keys themselves, the DKG and partial-decryption protocols must satisfy their respective correctness and security requirements. We revisit correctness and simulation-security requirements for threshold decryption when it is composed with DKG. We then introduce Jambon, which applies deterministic rounding to partial decryptions to further reduce the modulus used for decryption responses. The composed security bound accounts separately for setup and decryption errors. We prove exact recovery for BFV and extend the approach to CKKS under an additional condition. Under the stated temporary-HE assumptions and resource hybrids, we establish universally composable security with strong threshold privacy against static malicious corruption in the random-oracle model. We prove security for the DKG and its composition with verifiable partial decryption. Under the stated algebraic and statistical parameters, Jambon's numerical decryption responses are at least $60\%$ smaller than the native responses of the updated KLL$^+$26 strong-security construction at every threshold considered for $256$, $512$, and $1024$ parties. This comparison uses the specified sufficient bounds and excludes proof and setup traffic.

Oblivious Transfer (OT) is one of the fundamental building blocks in cryptography that enables various privacy-preserving applications. Constructing efficient OT schemes has been an active research area. This paper presents three efficient two-round pairing-free k-out-of-n oblivious transfer protocols with standard security. Our constructions follow the minimal communication pattern: the receiver sends k messages to the sender, who responds with n+k messages, achieving the lowest data transmission among pairing-free k-out-of-n OT schemes. Furthermore, our protocols support adaptivity and enable the sender to encrypt the n messages offline, independent of the receiver’s variables, offering significant performance advantages in one-sender-multiple-receiver scenarios. We provide security proofs under the Computational Diffie-Hellman (CDH) and RSA assumptions, without relying on the Random Oracle Model. Our protocols combine minimal communication rounds, adaptivity, offline encryption capability, and provable security, making them well-suited for privacy-preserving applications requiring efficient oblivious transfer.

We study Binary LWE with polynomial modulus in the regime of a linear number of samples. Prior work of Kirchner and Fouque and of Herold, Kirshanova, and May (CRYPTO '15, DCC '18) gives an algorithm running in time $\exp(O(n/\log\log n))$ using $O(n\log n)$ samples, leaving open whether the same complexity can be achieved with only $m=\Theta(n)$ samples. We resolve this problem by showing that the same complexity is achievable with even a sublinear number of samples. Fix any constant $a>1/2$, let $q=n^{a+o(1)}$ be an odd prime, and let $m = \left\lceil n/\log \log n \right\rceil$. We give a randomized algorithm that distinguishes $\bigl(\mathbf{A},\mathbf{A}^{\top}\mathbf{s}+\mathbf{e}\bigr) \in \mathbb{Z}_q^{n\times m}\times\mathbb{Z}_q^m$ from a uniformly random pair, for every fixed secret--error pair satisfying $\lVert\mathbf{s}\rVert_2^2+\lVert\mathbf{e}\rVert_2^2 = O(m+n)$. Its expected running time and space are $\exp\left(O( n/\log \log n )\right)$. A crucial component is a new instantiation of the auxiliary superlattices in the Gaussian--Wagner framework of Ducas, Engelberts, and Loyer (CRYPTO '25). These superlattices have sufficiently small smoothing parameters even when the approximation parameter for the entire output list is subexponentially small, while still admitting exact shifted discrete Gaussian sampling within the claimed running time. A Euclidean dual-minimum argument simultaneously controls the smoothing parameters of all projected relevant lattices. Combining the resulting short vectors with an Aharonov--Regev Fourier distinguisher yields the claimed sublinear sample LWE algorithm.

We give a Monte Carlo algorithm for exact Euclidean SVP on Haar-random lattices with arithmetic time $(3/2)^{n/2+o(n)}$ and space $(4/3)^{n/2+o(n)}$, up to polynomial factors in the logarithmic condition number of the input basis. The leading exponents match those of heuristic lattice sieving. For a set of lattices of Haar measure $1-o(1)$, the algorithm succeeds with probability $1-o(1)$ on every input basis. Our algorithm regenerates each sieve list by running a Markov chain on the nonzero lattice points in a smaller ball. The parent list supplies signed increments. Each step reports all admissible proposals and assigns each the same probability, with the remaining probability assigned to staying put. The resulting chain is symmetric and has uniform stationary distribution. Trajectories using independent transition randomness produce endpoints jointly close to independent uniform samples once the chain mixes. Matrix Chernoff bounds transfer a Laplacian gap from the full angular graph to the graph defined by the parent list. The main proof task is to establish the required graph estimates on Haar-random lattices. We do so by adapting Rogers's moment method to centered trace moments and lattice-point counts. Spherical filtering reports the complete proposal sets and the final short differences within the claimed bounds.

We revisit the three-round threshold Schnorr signature scheme Sparkle of Crites, Komlo, and Maller (CRYPTO 2023), as well as its variant Sparkle+. While Sparkle+ was accompanied by a claim of full adaptive security, subsequent work identified a gap in the analysis. The original—and simpler and more efficient—Sparkle scheme has so far lacked even a proof of static security. We resolve this by proving static security for Sparkle; our main result is then a tight proof of its full adaptive security in the pure random oracle model, i.e., without relying on the algebraic group model. The core obstacle is that, in the fully adaptive setting, rewinding arguments fundamentally break down. To address this, we base our proof on the Vandermonde circular discrete-logarithm (VCDL) assumption, an interactive strengthening of the circular discrete-logarithm assumption of Cho et al. (CRYPTO 2025), originally introduced to prove tight security of basic Schnorr signatures. Circular-style assumptions eliminate the need for rewinding. Beyond tightness, our analysis highlights circular-style assumptions as a new approach to achieving security in other settings where rewinding is problematic. We justify VCDL by reducing it to the low-dimensional vector representation (LDVR) problem of Crites et al. (CRYPTO 2025) in the elliptic-curve generic group model. Finally, we generalize VCDL (and similarly LDVR) and identify a different assumption within this framework that yields a tight proof of adaptive multi-user security for the basic Schnorr signature scheme, a result of independent interest.

Targeted hitting-set generators (HSGs) are primitives that have recently attracted attention in the study of pseudorandomness and derandomization. Recent works have shown that sufficiently strong targeted HSGs can be used to soundly instantiate the Fiat--Shamir transformation, yielding non-interactive protocols against uniform PPT adversaries in the plain model (i.e., without any setup phase for selecting a cryptographic hash function). In particular, Chen et al. (STOC 2025) combined this paradigm with the MPC-in-the-head technique to construct a non-interactive witness-indistinguishable argument for NP from a non-interactive commitment scheme and a targeted HSG. Inspired by these results, we explore other cryptographic applications of this paradigm. Our main result is a black-box construction of a non-interactive witness-indistinguishable commit-and-prove scheme against uniform PPT adversaries in the plain model. Following Chen et al., we obtain our construction by combining the MPC-in-the-head technique with the targeted-HSG-based Fiat--Shamir paradigm. The construction relies on an injective one-way function with efficiently recognizable range and a sufficiently strong targeted HSG. The latter is the same targeted HSG used by Chen et al. and can be instantiated under a very strong but plausible complexity-theoretic assumption.

We construct the first Batched Threshold Encryption scheme with a \emph{transparent} setup where public parameters are \emph{independent} of the batch size. As a result batches of arbitrary sizes can be decrypted, without imposing an a priori fixed bound. We prove security under a constant size assumption -- the decisional bilinear square Diffie--Hellman assumption. Setup is just a distributed key generation protocol to sample secret shares of a random value. Ciphertexts consist of two $\mathbb{G}_1$ elements, one $\mathbb{G}_2$ element and the encrypted message, plus a NIZK for CCA security (two $\mathbb{F}$ elements with a sigma protocol). Partial decryptions are a single $\mathbb{G}_1$ element, computed with one scalar multiplication. Decrypting a batch of $B$ ciphertexts costs $O(B)$ pairings and $O(B\log^2 B)$ group operations. In the ramp setting, with a gap between the reconstruction threshold $t$ and corruption threshold $f$ as in consensus protocols with $n\ge3f+1$, we construct a pairing-free batched threshold encryption scheme from DDH whose partial decryptions are $2B/(t-f)$ group elements, and reduce the aggregation cost of our pairing-based scheme to $O(B\log^2(B/(t-f)))$ group operations.

We consider two main classes of synchronous round-efficient Byzantine Agreement (BA) protocols: \emph{expected constant rounds} and \emph{early-stopping}. Randomized protocols can terminate in expected constant rounds, and early-stopping protocols' worst-case round complexity depends on the actual number of corrupted parties $f\le t$, with $\min(t+1, f+2)$ being optimal. In this work, we combine the benefits of both classes, proposing a protocol that has constant round-complexity in expectation and $O(f)$ in the worst case. We present our protocol in the form of a compiler that can lift a broad class of expected-constant-round BA protocols, including Feldman--Micali and Katz--Koo, to {\em also} achieve near-optimal $O(f)$ worst-case complexity. This yields the {\em first} treatment of perfectly secure BA protocols for $t<n/3$ that is both expected constant-round and near-optimal ($O(f)$) early stopping. Assuming a PKI, we show a variant of the compiler with a better round complexity, tolerating $t<n/2$ corruptions. We also extend our results to parallel broadcast, also known as interactive consistency (IC). We give a compiler that runs $N$ Byzantine agreement instances in parallel while preserving both guarantees, expected constant rounds and $O(f)$ rounds in the worst case. Parallel broadcast then follows with one extra round for $t<n/2$. To the best of our knowledge, this is the first compiler of its kind, and the first IC protocol with such expected and worse round-complexity. Finally, by combining our protocol with standard (fast) sequential composition techniques, we obtain a valid candidate to execute \emph{multi-party computation protocols} that require broadcast as their hybrid. By running existing MPC constructions using our broadcast protocol, we obtain the first MPC protocol that requires constant rounds of P2P communication in expectation and $O(f)$ rounds in the worst case.

We study two central problems in threshold cryptography from lattices: (1) threshold encryption with silent setup for general thresholds $t \geq 2$, where no post-quantum constructions were previously known, and (2) threshold fully homomorphic encryption (TFHE) with sublinear parameters, an open problem since the work of [Boneh et al.; CRYPTO'18]. We introduce $\textit{$(\alpha,\beta)$-Scaled Linear Secret Sharing Schemes}$ (LSSS), a relaxation of standard LSSS in which each authorized set $S$ reconstructs a scaled version of the secret, $\gamma_S \cdot k$, where both the reconstruction coefficients and the set-dependent scaling factor $\gamma_S$ are bounded over the integers. Unlike prior approaches based on bit decomposition, this preserves the uniform distribution of unauthorized shares. Building on this, we obtain: 1. $\textbf{Silent Threshold and Distributed monotone-policy encryption.}$ We provide the first post-quantum construction supporting: (i) threshold policies with ciphertexts growing as $\tau^{16} \cdot \mathsf{poly}(\lambda, \log N)$, where $\tau = \min(t^2,N{-}t)$, and (ii) DNF formulas with fully compact parameters. Our constructions are proven secure under the decomposed LWE assumption in the random oracle model. If we additionally rely on a common reference string, then the ciphertext size for our threshold policy scheme can be reduced to $\tau^4 \cdot \mathsf{poly}(\lambda, \log N)$ under the Succinct LWE assumption. 2. $\textbf{Decentralized TFHE with silent setup.}$ We provide the first $\textit{decentralized}$ TFHE, for threshold policies and DNFs, from the decomposed LWE assumption. Our construction supports homomorphic evaluation of arbitrary circuits, one-round distributed decryption, and silent setup. This was left as an open problem by [Boneh et al.; CRYPTO'18] and, prior to this work, we did not have any non-trivial construction for decentralized TFHE from any assumption. 3. $\textbf{Sublinear centralized TFHE from LWE.}$ We also extend our techniques to $\textit{centralized}$ TFHE. We provide a TFHE scheme under the standard LWE assumption, where all parameters are simultaneously sublinear in $N$ for any threshold $t$ as long as $\min(t^2,N{-}t)=o(N^{1/6})$. This breaks the $\omega(N)$ barrier that has persisted in the TFHE literature since 2018.

Broadcast encryption (BE) allows a sender to succinctly encrypt a message to any dynamically chosen subset of recipients. The gold-standard for BE is $\textit{optimal succinctness}$ (parameters independent of the number of users) and $\textit{adaptive security}$. Attaining both from falsifiable post-quantum assumptions has been a central open problem. Recently, Goyal and Yadugiri (GY) [Goyal-Yadugiri; CRYPTO'26] gave the first adaptively-secure and optimally-succinct slotted distributed BE under a falsifiable lattice assumption, but their techniques inherently require an a-priori bound on the number of users and a slotted user structure. Two highly-sought-after generalizations thus remained open: $\textit{flexible BE}$ (FBE), where users asynchronously sample and register their own keys and $\textit{identity-based BE}$ (IBBE), where a trusted authority issues keys for identities drawn from a super-polynomially large space. In this work, we present the first adaptively-secure FBE and IBBE schemes with all parameter sizes independent of the number of users, both under the same falsifiable lattice assumption (decomposed LWE) and in the same model (Random Oracle Model) as the prior state-of-the-art for slotted distributed BE. Our FBE additionally enjoys a $\textit{transparent setup}$, in line with the trustless ethos motivating distributed and flexible BE. At the technical heart of our results, we extend the equivocal encryption framework of GY to capture $\textit{unbounded}$ and $\textit{dynamic}$ broadcast systems, and introduce $\textit{Equivocal Matrix Commitments}$ --- a strengthening of matrix commitments that supports adaptive equivocation of the committed matrix. We expect this new abstraction to find broader applications in designing adaptively-secure trustless lattice-based encryption.

We present DAVINCI, a decentralized end-to-end verifiable voting protocol with no trusted coordinator. The protocol is structured as a zero-knowledge (ZK) rollup: the election is a ZK-verified state machine in which every transition, from ballot submission to final tallying, is encoded as a circuit constraint, so that no actor can force the protocol into an invalid state without breaking the underlying proof system. A decentralized set of sequencers handles ballot validation and aggregation off-chain, while Ethereum serves as a public bulletin board and a data-availability layer via EIP-4844 blobs. For ballot secrecy, DAVINCI uses threshold ElGamal with distributed key generation; for receipt-freeness, sequencers re-encrypt ciphertexts before storing them, and voters may revote at any time. To make revoting effective against bribery and coercion, DAVINCI introduces silent revoting on every state update, sequencers also re-randomize a random subset of stored ballots, and we quantify how well this hides overwrites among routine refreshes. Our open-source implementation shows that DAVINCI supports large-scale elections with succinct on-chain verification and ballot proofs generated on commodity devices, under the honest-device assumption shared by several deployed verifiable-voting systems.

We analyse the Lattice Isomorphism Problem framework of Ducas and van Woerden when it is instantiated with the direct sum of two rescaled integral Barnes-Wall lattices, $\Lambda_{\mathbf{S}}=gBW^{\mathbb{Z}}_{m}\oplus(g+1)BW^{\mathbb{Z}}_{m}$. All primitives of the framework share the same key pair, a public form $\mathbf{P}=\mathbf{U}^{\top}\mathbf{S}\mathbf{U}$ and a secret unimodular matrix $\mathbf{U}$, so recovering $\mathbf{U}$ from $\mathbf{P}$ breaks each of them. We take the hash-and-sign signature scheme as an example, whose security rests on distinguishing the class of $\mathbf{S}=\operatorname{diag}(g^{2}\mathbf{R},(g+1)^{2}\mathbf{R})$ from that of the auxiliary form $\mathbf{Q}^{-1}=\operatorname{diag}(\mathbf{R},g^{2}(g+1)^{2}\mathbf{R})$. We show that the $g^{2}$-hull maps each of the two classes onto the other, is computable from the public key alone, and rescales the two blocks from $(g, g+1)$ to $(1, g(g+1))$ without changing the automorphism group, so that solutions of the transformed instance lift back. The transformed instance then splits into two isomorphism problems for the public Barnes-Wall lattice in half the dimension. At $d=1024$, $g=43$ the estimated cost of key recovery drops from $220$ to $124$ classical bits.

We study bandwidth fee mechanisms (BFMs) for pricing threshold certified transaction dissemination before consensus. BFMs are analogous to transaction fee mechanisms (TFMs) introduced by Roughgarden (2021), except that they price blockchain communication rather than computation. Separately pricing this bandwidth is especially relevant when transaction dissemination is separated from consensus and execution. We model BFMs as a two-sided procurement auction between users who submit transactions and validators who receive and forward them. Any validator may be assigned as the source of a transaction and forward it to a threshold of attesters. The model accounts for the source validator's receipt of the user submitted transaction and the subsequent transfers between validators. It abstracts away unrestricted multi-hop gossip and network topology. In this work, we focus on settings where transactions must be certified/attested by a threshold of network nodes before consensus, and we develop the following results. - We characterize the limits of myopic incentive compatibility for BFMs: No non-trivial transcript-based BFM can prevent profitable collusion between two validators, and no non-trivial BFM can simultaneously satisfy incentive compatibility for individual user, individual validator, and coalition of one validator and one user. - In contrast, once we restrict attention to unilateral deviations, we present a greedy-route posted-price mechanism that is incentive compatible for every individual user and validator. \item We study how the bandwidth price should evolve across blocks. Assuming validators execute honestly, we propose an EIP-1559-style price-update rule and show that its fluid approximation has a unique fixed point, which is locally stable for small enough step sizes. In large markets, prices that start near this point stay near it with high probability over any fixed time horizon. \end{itemize}

We present the first Distributed Broadcast Encryption (DBE) scheme from falsifiable lattice assumptions that achieves adaptive security with optimal parameters (short public/secret keys and ciphertexts). Our construction enjoys transparent setup and offers flexible instantiation: we achieve a succinct CRS in the Random Oracle Model, or a long CRS in the standard model. Previously, no lattice-based DBE simultaneously achieved adaptivity and optimal parameters in either setting. To achieve this, we introduce a new methodology for proving adaptive security: $\textit{Equivocal Encryption Systems}$. This framework operates in two indistinguishable modes: a 'real' mode utilizing standard algorithms, and a 'fake' mode where keys and ciphertexts are jointly sampled with auxiliary trapdoors, enabling the dynamic equivocation of ciphertexts to arbitrary challenge values. While our approach is technically distinct from the celebrated Dual System Encryption (Waters, CRYPTO'09), we believe it could serve as a similarly powerful paradigm for realizing adaptive security across a broad class of lattice-based encryption systems.

Since the SHA-3 family was standardized by NIST in 2015, its collision resistance has been extensively studied. The previous best-known collision attack on 5-round SHA3-384 is based on internal differentials and the probabilistic-linearization variant of two-block Target Internal Differential Algorithm (TIDA). Its connector replaces deterministic affine restrictions that guarantee S-box differential validity by higher-dimensional affine relaxations, reducing the number of linear constraints and preserving more degrees of freedom. The price is that solutions of the linearized system are only probabilistically valid. In particular, once the first message block fixes the inner part variables, the remaining affine solution space cannot be treated as a set of independent trials; only part of its freedom effectively contributes to the connector probability. This paper refines the probabilistic-linearization framework in two ways. We first propose SA-PIDS, a simulated-annealing-based search for affine-subspace assignments, improving the trade-off among capacity constraints, the product-density estimate, and the remaining solution-space dimension. We then give a structural evaluation of the actual connector probability, explaining how the effective remaining freedom in the solution space after fixing the first block could be used and counted. Using the same target internal differential characteristic as the previous 5-round SHA3-384 attack, our refinements reduce the theoretical complexity from $2^{170.73}$ to $2^{164.11}$.

Lookup table polynomial interactive oracle proofs (LUT PIOPs) make SNARK arithmetizations concise, yet almost all efficient constructions assume field arithmetic. We show that directly instantiating them over a composite residue ring \(\mathbb Z_Q\) can be unsound: component-wise set checks preserve the residue multiset in each CRT component but lose the alignment across components. We formalize this obstruction, which we call the CRT alignment ambiguity. To overcome this ambiguity, we present GlueLUT, a family of efficient LUT PIOPs over residue rings. GlueLUT runs the lookup over an auxiliary field while retaining the arithmetic proof over \(\mathbb Z_Q\), and then proves consistency between the two witness representations. Our first construction, GlueLUT-4Sq, introduces a cross-modulus consistency (CMC) PIOP, which proves that witnesses over two coprime moduli encode the same integer vector. We construct the CMC PIOP via a range-check PIOP over the product ring using the Lagrange four-square decompositions, structured Johnson–Lindenstrauss projections, and a GKR-style consistency check. For a witness of size \(n\), a table of size \(m\), and security parameter \(\lambda\), GlueLUT-4Sq has \(O(n+m)\) algebraic prover work after witness generation and \(O(\operatorname{poly}(\lambda,\log n,\log m))\) verifier work and proof size. Our second construction, GlueLUT-Fold, uses random rank-one folded consistency checks to achieve better concrete prover efficiency and has \(O(n+m)\) prover work, at the cost of \(O(\sqrt n+\operatorname{poly}(\lambda,\log n,\log m))\) verifier work; its proof size is \(O(\log n+\log m)\). We implement GlueLUT-4Sq and GlueLUT-Fold as stand-alone PIOPs and report prototype results that corroborate our theoretical efficiency analysis.

Fully homomorphic encryption (FHE) allows a server to run a language model directly on encrypted user prompts, but current approaches remain prohibitively slow. Ciphertexts natively support only addition, multiplication, and rotation, and multiplications may be composed only to a bounded depth before a costly bootstrapping operation is required to continue. Every nonlinearity must therefore be approximated by an iterative method; each iteration increasing the number of multiplications. A higher iteration count buys precision but exhausts the available depth more frequently and thus triggers more bootstraps, which dominate latency. We introduce Homomorphic Encryption-Aware Training (HEAT), a fine-tuning method that makes the per-nonlinearity iteration counts learnable, enabling them and the model weights to co-adapt during training. HEAT optimizes iterations with respect to the task objective, allowing the model to adapt to approximation errors encountered during inference without architectural changes or retraining from scratch. We further relate iteration count to quantization bit width and bound, at fixed weights, the gap between our objective and quantization-aware training. On encrypted GPT-2 decoding, HEAT reduces iterations by $3.1\times$, bootstraps by $1.6\times$, and end-to-end latency by $1.4\times$, while improving decode agreement over the calibrated encrypted baseline.

CROSS is a code-based signature scheme built on the Restricted Syndrome Decoding Problem and is a second-round candidate in NIST's additional digital signature standardization process. Recent work shows that its reference implementation is vulnerable to side-channel analysis, allowing an attacker to recover the long-term secret key from a single power trace. No masking countermeasure has so far been designed for CROSS's restricted-syndrome framework, leaving its practical side-channel resistance unresolved. In this work, we present a full sensitivity analysis and a gadget-based masking schedule ($G_0-G_8$) for the CROSS signing algorithm of the R-SDP(G) variant. One gadget in this schedule, the restriction-lift exponentiation, has no counterpart in prior masked multivariate- or lattice-based signatures: it masks $g^{\bar{\mathbf v}[i]}$ via table lookup, share-serial conversion, and ISW-multiplication sub-gadgets rather than via a fixed linear or bilinear map. We rigorously prove $t_{\mathrm{mask}}$-probing security for each gadget individually and for their full composition, using the NI, SNI, and NIo frameworks. We implement the resulting masked signer for an arbitrary number of shares $d$ and evaluate it on an x86-64 platform, measuring cycle overheads of $21.73\times$ at first order and $78.05\times$ at second order relative to the unmasked baseline. At first order, our masked CROSS is cheaper than a comparably masked Dilithium-2 ($38\times$), but Dilithium-2 overtakes it at second order ($70\times$). This crossover cost is driven by the $O(d^3)$ chained-ISW cost of $G_3$/$G_7$ compared to Dilithium's cheaper $O(d^2)$ scaling.

Since its introduction, Solinas' window $\tau$-NAF algorithm has been a landmark method for accelerating scalar multiplication on Koblitz curves over binary fields. A long-standing open problem has been to identify a suitable family of elliptic curves over prime fields for which the window $\tau$-NAF approach can be effectively extended. In this paper, we settle this problem by establishing such an extension for the family $E_b: y^2=x^3+b$ over $\mathbb{F}_p$ with prime $p\equiv1\pmod 3$. This family includes several practically important curves used in blockchain applications (e.g., secp256k1) and pairing-based cryptography (e.g., BN254 and BLS12-381). By considering a nonzero nonunit element of minimal norm in the ring of Eisenstein integers $\mathbb{Z}[\omega]$, we identify the endomorphism $\tau=1-\omega$ as a natural choice for $\tau$-adic scalar multiplication on $E_b/\mathbb{F}_p$. In Jacobian projective coordinates, the map $\tau P$ can be evaluated using only $6\mathbf{M}$ (where $\mathbf{M}$ denotes a field multiplication). This also yields a new point-tripling formula requiring only $10\mathbf{M}$, improving upon the previous best cost of $15\mathbf{M}$. Furthermore, we optimize the pre-computation stage by choosing a set of coefficients invariant under the unit group $U\subset\mathbb{Z}[\omega]$. Exploiting this sixfold symmetry reduces the pre-computation cost by approximately five-sixths. The $U$-invariant structure also plays an important role in further accelerating window $\tau$-NAF evaluation. Our optimized method achieves performance improvements of $16.7\%$, $17.6\%$, and $18\%$ over the current state-of-the-art GLV method for $256$-, $384$-, and $512$-bit group orders, respectively. We also develop a regular window $\tau$-NAF variant as a countermeasure against side-channel attacks. Compared with the regularized GLV method, this variant reduces the scalar multiplication cost by $17.7\%$, $19.8\%$, and $20.9\%$ for $256$-, $384$-, and $512$-bit group orders, respectively.

Hash-based signatures offer a conservative foundation for post-quantum authentication, but their large signatures impose substantial communication and storage costs. For security parameter $\lambda$, discrete-logarithm-based signatures have length $O(\lambda)$, while known hash-based constructions have quadratic signature length, up to logarithmic factors, even for one-time signing. Is this gap inherent? We prove what are, to the best of our knowledge, the first lower bounds on the length of signature schemes in the (pure) random oracle model. Our bounds apply to schemes with non-adaptive verifiers and a natural security property called salted soundness: a scheme with such security is unforgeable even against an adversary that is granted a limited ability to resample and restore oracle answers. This class essentially captures all known hash-based constructions (possibly after low-cost modifications). We show that the combined public-key and signature length of a one-time signature scheme must be $\Omega(\lambda^2/\log\lambda)$. For many-time signatures, we prove the stronger conclusion that the signature length alone must satisfy the same lower bound, irrespective of the public-key length. More precisely, if the relevant length is $o(\lambda^2/\log\lambda)$, then an adversary making $2^{o(\lambda)}$ random-oracle queries breaks salted soundness with inverse-polynomial probability. Our proof uses the high-entropy hitting lemma of Haitner, Nukrai, and Yogev (Crypto 22) to transform a short signature scheme into a scheme whose verifier makes only a few queries. We then apply the Barak and Mahmoody-Ghidary (FOCS 07) attack on one-time signatures with a low-query verifier. Balancing these two steps yields the near-quadratic lower bounds.

Atomic swaps are the prototypical application of adaptor signatures. Practical constructions settle with two ordinary on-chain signatures and require no scripting, but they need two sequential online rounds: Alice samples a hard statement and sends its pre-signature, and Bob follows with his own pre-signature using the same statement. We ask whether the protocol can be compressed into a single online round (from Bob to Alice), which we call a non-interactive atomic swap, without relying on impractical universal adaptor signatures. In particular, we require that both parties continue to use standard signature schemes with unmodified verification algorithms. Our main result is a lower bound: for statistically unlinkable adaptors with negligible faithfulness failure, Bob's valid-signature space per message must be superpolynomially larger than the relation's witness space. This (1) reaffirms the impossibility result by Erwig et al. [PKC 2021] for unique signatures as a trivial corollary, and (2) excludes non-interactive swaps using the same signature scheme on both sides. However, the bound does leave room for asymmetric instantiations. We give one in which Alice signs with BLS and Bob uses a pairing-Schnorr adaptor whose witness is Alice's BLS signature, and prove its security under the native unforgeability of BLS in the random oracle model. To support more signature schemes in our non-interactive swap framework, we introduce atomic signature swaps with preprocessing: Alice publishes message-independent public data before the messages are chosen. These data, together with her public key and the messages, later determine a statement whose witnesses assemble into her native signature. The protocol requires a single online round carrying a pre-signature by Bob and falls into our non-interactive framework. We prove a Schnorr/Schnorr instantiation under the OMDL assumption in the random oracle model, and give a conditional ECDSA/Schnorr instantiation.

We improve recent generic proof systems for isogeny knowledge by Cong, Lai, Levin based on circuit satisfiability, by using radical isogeny descriptions to prove a path in the underlying isogeny graph. We then present a new generic construction for a verifiable random function (VRF) based on a one-more type hardness assumption and zero-knowledge proofs. We argue that isogenies fit the constraints of our construction and instantiate the VRF with a CGL walk and our new proofs. As a different contribution, we also propose a new VRF in the effective group action description of isogenies. Our protocol takes a novel approach based on the polynomial-in-the-exponent technique, but without the need of a trusted setup or heavy preprocessing. We compare our protocols to the current state-of-the-art isogeny VRFs by Leroux and Lai, with a particular emphasis on computational efficiency.

We present variants of blind Schnorr and blind Okamoto-Schnorr signatures that are not susceptible to ROS-style attacks. We prove the schemes unforgeable in the algebraic group model and the random oracle model: the Okamoto-Schnorr variant under the discrete-logarithm assumption; the Schnorr variant under the algebraic one-more discrete-logarithm assumption. Our Schnorr variant improves on the communication complexity of Snowblind (CRYPTO 2023), the state-of-the-art "pairing-free" blind signature scheme, while matching its signature size. Moreover, we show that this communication complexity is optimal: any blind "Schnorr-like" scheme whose first message is a single group element is susceptible to a variant of the ROS attack by Benhamouda et al. (EUROCRYPT 2021).

Anonymous blocklisting enables services to revoke malicious users while preserving anonymity for honest users. Signature-based revocation supports revocation from past authentications, but existing systems incur substantial overhead at large scale and for users returning after long offline periods. Window-based alternatives reduce this overhead but impose restrictive revocation-timing policies. This work presents zk-BAN, a signature-based anonymous blocklisting system that reduces proof-generation and verification costs through two design improvements: constructing a carefully filtered revocation list and partially unifying PRF tags to reduce repeated zero-knowledge computations. We formalize zk-BAN and prove that it satisfies blocklistability and unlinkability. Under modeled large-scale real-world workloads, zk-BAN generates proofs in approximately 600 ms and verifies them in approximately 2 ms. We show zk-BAN displays 54.4 times faster proving than our naive baseline and 136-fold faster proving and 32-fold faster verification than prior work.

Witness encryption over blockchain state aims to release a secret on a ledger condition without a key custodian. Validators with enough stake to construct a valid fork witness can obtain the secret although the condition never holds on the canonical chain. They finalize a private fork that satisfies the condition, and keeping the fork hidden withholds the conflicting votes that slashing needs. We propose slashable secrecy to address this gap with Ethereum’s native slashing rules, without an additional key-custody committee or separate collateral. In executions where the condition never holds on the finalized canonical chain through completion, an information advantage yields evidence of those votes against keys the adversary controlled, or a solution to a designated hard problem. We give a construction from a witness KEM and prove slashable secrecy conditionally on its extraction interface. We bound the implicated historical stake under changing validator weights. For an archived Ethereum mainnet state, the historical evidence-weight floor exceeds 3.5 percent of its active stake, about 1.44 million ETH, under stated budget and coverage assumptions. Experiments on a synthetic Ethereum network confirm native processing of the evidence, without WE decryption. Two limitations remain. A witness KEM satisfying the full relation and extraction interface remains uninstantiated. Enforcement requires that the evidence is available, converted to native form and included while its signers remain eligible.

Selfish mining profits in Nakamoto consensus because difficulty adjustment mechanisms (DAMs) misinterpret uncounted orphans as hash-rate contraction. Although orphan-aware DAMs record orphaned proof-of-work, strict same-epoch inclusion rules enable an orphan exclusion attack (OEA): an adversary can race private forks near epoch boundaries to permanently exclude honest tail orphans from retargeting, restoring substantial profits in short-epoch protocols. We propose the pipelined buffer difficulty adjustment mechanism (PB-DAM), which partitions each epoch into an accountable prefix and a settlement buffer of depth $d$. Pipelining estimation windows across epochs grants honest miners a grace period to report prefix uncles while advancing buffer work to subsequent retargets, closing the boundary gap without heuristic damping. Random-walk excursion bounds demonstrate that OEA success decays exponentially with $d$ for all $\alpha \le \alpha^\star < 1/2$, reducing the time-averaged profit advantage to $O(\varepsilon)$. Under stylized dynamic scheduling models, intermittent idling is analytically shown to be unable to raise the gross reward rate above $\alpha$. Simulations confirm that buffer depths $d = 16$ neutralize selfish mining even at $L = 64$ when $\alpha = 0.40$, and systems recover from a $50\%$ hash-rate crash within $2.2 \pm 0.8$ epochs, incurring under $1\%$ block capacity overhead.

Key derivation functions can be used to derive variable-length random strings that serve as cryptographic keys. They are integral to many widely-used communication protocols such as TLS, IPsec and Signal. NIST SP 800-108 specifies several key derivation functions based on pseudorandom functions such as CMAC and HMAC, that can be used to derive additional keys from an existing cryptographic key. This standard either explicitly or implicitly requests their KDFs to be variable output length pseudorandom function, collision resistant, and preimage resistant, which are also demanded by practical applications. Yet, since the publication of this standard dating back to the year of 2008, until now, there is no formal analysis to justify these security properties of KDFs. In this work, we give the formal security analysis of key derivation functions in NIST SP 800-108. We show both positive and negative results regarding these key derivation functions. For KCTR-CMAC, KFB-CMAC, and KDPL-CMAC that are key derivation functions based on CMAC in counter mode, feedback mode, and double-pipeline mode respectively, we prove that all of them are secure variable output length pseudorandom functions and preimage resistant. We show that KFB-CMAC and KDPL-CMAC are collision resistant. While for KCTR-CMAC, we can mount constant-time collision attack against it. For KCTR-HMAC, KFB-HMAC, and KDPL-HMAC that are key derivation functions based on HMAC in modes, we show that all of them behave like variable output length pseudorandom functions. When the key of these key derivation functions is of variable length, they suffer from collision attacks. For the case when the key of these key derivation function is of fixed length and less than \(d-1\) bits where \(d\) is the input block size of the underlying compression function, we can prove that they are collision resistant and preimage resistant. Finally, we extend our analysis to the plain CMAC-based KDFs for which mitigation techniques against key-control attacks do not apply, as well as to the KMAC-based KDF.

Secure Multi-Party Computation (MPC) enables collaborative and privacy-preserving computation over private inputs. Recent advances in Homomorphic Encryption (HE), particularly the CKKS scheme, have significantly improved the practicality of secure computation, making it suitable for real-world applications involving approximate arithmetic. However, the inherent errors introduced by CKKS pose substantial challenges in the design and analysis of CKKS-based secure computation protocols. In this work, we investigate the correctness and security of existing CKKS-based MPC protocols. Most prior constructions rely on the noise smudging technique, in which each party independently adds exponentially large noise to the output to guarantee the security of the protocol. However, we show that this approach does not achieve standard simulation-based security for MPC. To address this limitation, we apply an alternative method, called collaborative sampling, in which all participating parties jointly generate additive shares of the smudging noise. We consider both asymmetric two-party protocols between a client and a server, and symmetric multiparty protocols among mutually distrusting parties. For each setting, we present concrete protocol constructions based on collaborative sampling, explicitly define the corresponding ideal functionalities, and provide formal security proofs. We further provide concrete constructions and implementations of collaborative sampling protocols. As an alternative perspective, we show that existing protocols, despite failing to achieve standard simulation-based security, still satisfy a weaker security notion called liberal security for approximate MPC protocols.

Merz and Ran derive additional equations from divided powers of the public polar forms in characteristic two. We extend this construction to finite fields of arbitrary characteristic and apply it to the security analysis of QR-UOV.

Good-case latency, studied in early fast-consensus protocols (Martin and Alvisi, DSN 2005) and formalized by Abraham, Nayak, Ren, and Xiang (DISC 2020), captures a natural efficiency goal: when the sender is honest, agreement should be reached quickly for the honest parties. In the standard classical model, however, there exists a barrier for any $f\geq n/3$ corrupted parties. Specifically, synchronous broadcast requires good-case latency at least $\Delta+\delta$ for $f\geq n/3$, where $\delta$ is the actual, unknown message-delay bound and $\Delta \gg \delta$ is its known, conservative upper bound. Under partial synchrony, consistency and liveness cannot even both hold for $f \geq n/3$ (Dwork, Lynch, and Stockmeyer, JACM 1988). In this work we study the use of quantum information to get past these classical barriers, and specifically using one-shot signatures (OSS) (Amos et al., STOC 2020, Shmueli and Zhandry, CRYPTO 2025). OSS prevents even a corrupt signer from issuing signatures on different messages under the same verification key, which provides cryptographic non-equivocation without trusted hardware assumptions. Assuming OSS and a public-key infrastructure, we obtain two main results against quantum polynomial-time static corruptions. First, under synchrony, we construct a state-machine replication (SMR) protocol without clients, with optimal $\delta$ good-case latency, tolerating any $f<n$ corruptions among $n$ parties. Second, under partial synchrony, we obtain SMR with $2\cdot \delta$ good-case latency which is consistent under any number of corruptions and live assuming $2n>f$. Specifically, a corrupt majority may cause progress to stop, but cannot create conflicting histories. Such an always consistent protocol is impossible classically (without assumptions like trusted hardware) even if liveness is only required to hold against a single corrupt party. In both our SMR protocols, communication is entirely classical, with only local quantum computation.

Password-authenticated key exchange (PAKE) and obfuscated key exchange (OKEX) are widely used protocols, appearing in passport access control, Tor's censorship evasion, and more. As quantum threats grow nearer, there have been an increasing number of proposals for post-quantum PAKE and OKEX. All such protocols are similar in that they build on a KEM, obfuscating public keys and/or ciphertexts sent over the wire, e.g., by adding a random mask or applying an ideal cipher. Many propose instantiation with ML-KEM, a NIST-standardized lattice-based KEM. Unfortunately, ML-KEM is a poor fit for these obfuscating protocols. The algebraic structure of ML-KEM public keys and ciphertexts means that obfuscating these values requires custom procedures for hash-to-vector, matrix expansion, serialization/deserialization, and randomized ciphertext decompression. In order to be broadly useful, these procedures also must be constant-time to prevent side channels and must be standardized to permit interoperability. No such set of procedures exists today. We observe that the barriers to instantiating PAKE and OKEX disappear if some of the KEM's algebraic structure is removed, i.e., if ML-KEM is replaced with a KEM whose public keys and ciphertexts appear to be uniform as bytestrings. In this work, we specify Kopis, a Module Learning-with-Rounding (MLWR) KEM with public keys and ciphertexts that are uniform as bytestrings. Kopis is intended to be a drop-in replacement for ML-KEM, in size, speed, and security. Kopis is nearly identical to Saber, a NIST PQC finalist, and thus inherits its years of cryptanalysis. We demonstrate that Kopis bears the security properties needed for use in various PAKE and OKEX schemes and provide a formally verified Rust implementation complete with portable, AVX2, and NEON backends, and a non-formally-verified C implementation for Cortex-M4. We perform benchmarks and find that Kopis is comparable to and often outperforms the fastest known ML-KEM implementations.

Subversion attacks where the attacker aims to replace parts of a cryptographic system by manipulated parts in an undetectable manner have been shown to model both theoretical and practical attacks such as supply chain attacks. Originally proposed by Young and Yung (CRYPTO 1996), interest in them has increased dramatically after the revelations about the inner workings of intelligence agencies due to Snowden and the following paper by Bellare, Paterson, and Rogaway (CRYPTO 2014). One of the most promising countermeasures against such attacks are cryptographic reverse firewalls, proposed by Mironov and Stephens-Davidowitz (EUROCRYPT 2015), which are small devices used by the parties with the aim to rerandomize the protocol message to remove possible leakage. A wide range of protocols and corresponding firewalls have been developed based on this notion. The usage of such firewalls, however, also introduces another attack surface as an attacker might also corrupt these firewalls. In most works, this problem is either not addressed or treated as if in this case, the complete party using the firewall is compromised. However, as firewalls typically only perform rerandomization without knowledge of secret key material, this is a very coarse over-approximation, as an honest party Alice is now treated as maliciously corrupted. Instead, the main security problem comes from the fact that the firewall can impersonate Alice. In this paper, we introduce the notion of impersonation resilience, which allows us to develop protocols that are also secure against such a corrupted firewall and thus result in an honest complete party. We show a generic compiler that transforms subversion-resilient protocols for commitment or coin toss into protocols that are also impersonation resilient. Following a recent research line, our protocols and security analysis are built on the Universal Composability (UC) framework of Canetti. Of independent interest, we show that existing UC subversion models are either too strong and do not allow secure string commitments, or too weak and allow trivially secure protocols. We addressed this by developing a new, intermediate UC subversion model.

On September 20, 2026, the Chinese Institute of Commercial Cryptography Standards published the 119 first-round candidates of its Next-generation Commercial Cryptographic Algorithms (NGCC) program: 34 signature schemes, 41 key encapsulation mechanisms, 9 key exchange protocols, and 35 hash functions. The program follows the template of the open NIST competitions for AES, SHA-3, and post-quantum cryptography. It opened just after cryptographers' ``Lee Sedol moment'' in the summer of 2026, when AI analysis overtook humans in analyzing the HAWK signature scheme. During the first 7 days of the NGCC competition, according to our harvested sources, 191 active findings were published for 89 candidates, 78 of them rated Critical: universal forgeries, signing-key recovery, trivial hash collisions, broken implicit rejection, and seeds too short for the claimed security level. Our independent evaluation effort discovered, verified, and disclosed 110 of those issues (47 Critical) using the agentic workflow described in this work; outside researchers, some AI-assisted, found the rest. Early AI-assisted findings mostly concerned implementations; by the end of the week, reproduced AI-assisted attacks also included new design-level key recovery. We describe the workflow, review loop, classification ruleset, and observed failure modes. As part of the evaluation, we also benchmarked all algorithm candidates and found that NGCC hash selection may significantly affect final public-key performance, as candidate implementations spend a large share of their cycles on ``placeholder'' hashes.

We investigate an algebraic approach to the Syndrome Decoding Problem, based on a reformulation of the Hamming weight constraint and its integration with the Information Set Decoding paradigm. We begin with a systematic analysis of the Hamming variety, deriving its defining equations in terms of elementary symmetric functions. Since these equations may have high degree, we exploit convolution identities for elementary symmetric functions, together with factorizations based on Lucas' identity, to derive an equivalent formulation with auxiliary variables and equations of bounded degree. Building on this modeling, we generalize the ISD paradigm through an ISD-like decoding strategy, implemented by the GBDecode algorithm, in which only a subset of an information set is fixed. This approach reduces the size of the combinatorial search space at the cost of solving the associated multivariate nonlinear systems. To handle this algebraic component, we employ the MultiSolve algorithm, which replaces a single Grobner basis computation with a collection of computations on simpler systems, obtained by exhaustively assigning a varying number of indeterminates over the finite field. This provides a tunable balance between combinatorial search and algebraic solving. We evaluate the resulting approach experimentally on instances of the Syndrome Decoding Problem for random binary linear codes, using parameters corresponding to the NIST Security Category 1 parameter set of the Classic McEliece cryptosystem. The experiments assess the feasibility of this combinatorial-algebraic approach and provide insights into the practical behavior of Grobner basis techniques within an ISD-like decoding framework.

In this paper, we introduce a new hash algorithm in that we used the Collatz problem, focusing on its conditional branching structure, an element often overlooked despite the fame of the 3x + 1 conjecture. This hash algorithm takes an arbitrary-length input and produces a fixed length 512/384/256 bit output. The presented hash algorithm is in the category of strong one-way Hash Function (OWHF), and this hash algorithm is designed by focusing on its use in password storing and Pseudo-Random Number Generator (PRNG). Until now, quantum computers also didn’t show any speedup in the Collatz conjecture problem, so the proving and disproving of the Collatz conjecture is still a big question, so we believe that there is no structural attack on this hash algorithm.

In public blockchains, the ability to order visible transactions allows block producers to extract value from users, a problem known as Maximal Extractable Value (MEV). Proposer-Builder Separation has turned that right into a formalized auction, and the leading protocol-level mitigations answer it with payload blindness: encrypted mempools, verifiable permutations, and block delay hide or scramble transactions before the order is fixed. Every such mitigation carries a security argument that assumes an adversary who learns nothing before the order commits. Deployed systems face a different adversary, and this paper measures the cost of that difference. We evaluate the three families of mitigations against a single adversary hierarchy, using closed-form analysis and simulations calibrated to Ethereum. Against a fully blind adversary, the outcome follows from the definitions: encryption with a permutation removes the attack classes that depend on transaction content, and block delay increases extraction rather than reducing it. Once that idealization is dropped, deployment problems dominate. The unencrypted envelope identifies the sender, so past behavior restores a usable guess at hidden content. Optional encryption gives builders a reason to starve the transactions it protects, and voluntary adoption then collapses. Key rotation turns a cryptographic parameter into a source of queueing congestion. Suppressing extraction, finally, removes far more producer revenue than it returns to users in lower fees, so the cost of every mitigation falls on the party that controls its deployment. The binding obstacles to MEV-free blockchains are therefore liveness and deployment incentives rather than cryptography.

Secure Transformer inference can be made non-interactive under fully homomorphic encryption (FHE), but the computation is extremely expensive. Existing FHE-based systems reduce that cost by optimizing individual stages in isolation, each within its own component rather than against the CKKS level budget they all share. A local gain therefore may not translate into an end-to-end speedup. We present THEMIS, a co-designed system for encrypted Transformer inference organized around two design principles, one bounding the depth each kind of stage may spend and one fixing where on the modulus chain it runs. THEMIS generalizes coefficient-encoded plaintext-ciphertext matrix multiplication (PCMM) to slot-encoded ciphertexts without format conversion, retaining the same accelerated coefficient-side backend and amortizing its nearly fixed cost through multi-batch packing. Two attention ciphertext-ciphertext matrix multiplication (CCMM) kernels combine the idle imaginary lane of each slot with baby-step giant-step accumulation and hoisting, so the attention multiplications issue far fewer key switches. For softmax, THEMIS conditions the first denominator with a calibrated row-wise offset and reserves high precision for the final normalization alone, which cuts the depth the reciprocal path consumes while keeping the precision of the returned probabilities. For a single stage, THEMIS accelerates PCMM and the attention CCMMs by $21.66\times$ and up to $7.39\times$ over MOAI (ICLR'26), and by up to $23.02\times$ and $16.49\times$ over Euston (S&P'26), while THEMIS's softmax runs $2.57\times$ faster than THOR (CCS'25) at higher precision. For the complete pipeline, THEMIS serves BERT-base on a CPU in $400.06$ amortized seconds per input, with accuracy on GLUE tasks comparable to plaintext. Of that latency, the stages around bootstrapping account for only $10.83\%$, which is the lowest share among all works compared here.

Multi-key fully homomorphic encryption (MKFHE) enables computation over ciphertexts encrypted under keys independently generated by different parties. Recently, Min, Park, and Song (MPS, CRYPTO 2026) constructed the first RLWE-based MKFHE scheme in the plain model, i.e., without trusted or interactive setup. Their construction requires each local compact Gentry-Sahai-Waters (GSW) ciphertext to be extended to a joint-key GSW-like ciphertext before evaluation, incurring $O(dk^2)$ gadget products per input for $k$ parties and gadget length $d$. In this paper, we first construct an extension-free MKFHE scheme (called Levis-fast) in the plain model, eliminating the $O(dk^2)$ gadget products required for joint-key ciphertext extension before homomorphic evaluation. Our core technique is a compatibility technique, termed Cofactor Compatibility, which establishes a common projective decryption relation across ciphertexts encrypted under independently generated local keys, enabling their direct homomorphic evaluation. We further present a compact variant (named as Levis-small) that reduces the communication of each fresh ciphertext from $O(dk^2)$ to $O(d)$ ring elements with only a lightweight lifting operation. A proof-of-concept implementation shows that, compared with MPS, for $k\in\{2,4,8\}$, our construction Levis-fast achieves evaluation speedups of $67.7\times$, $52.8\times$, and $139.4\times$, respectively, while our compact variant Levis-small reduces communication by a factor of $2.5\times$, $8.7\times$ and $14.2\times$, and achieves evaluation speedups of $11.8\times$, $19.7\times$, and $54.4\times$, respectively.

The $k$-nearest neighbor ($k$NN) algorithm is a core primitive for similarity search over sensitive data, but evaluating $k$NN under fully homomorphic encryption remains expensive because it requires distance computation, encrypted ranking, and top-$k$ extraction. CKKS is attractive for this setting because it natively supports packed approximate arithmetic, yet existing CKKS-based systems such as Engorgio (USENIX Security 2025) incur high overhead when used for reranking candidate sets. We present NOMOS, an encrypted $k$NN protocol for candidate sets that targets the ranking and top-$k$ extraction bottleneck. NOMOS builds on Mazzone et al.'s matrix-based ranking method (USENIX Security 2025), but introduces a gap-amplified sign approximation that focuses precision on near-zero distance gaps, where $k$NN rank decisions are most sensitive. NOMOS integrates this primitive into a complete encrypted $k$NN pipeline, using slot-index alignment and ReLU-based top-$k$ extraction to avoid full sorting. For large databases, offline k-means preprocessing forms fixed-capacity candidate sets, allowing NOMOS to avoid global top-$k$ extraction and reduce sign-approximation calls from quadratic global growth to near-linear clustered scaling. With these techniques, NOMOS outperforms state-of-the-art encrypted ranking and top-$k$ baselines. Across the Mazzone-style ranking benchmark and candidate-set workloads compared with Engorgio, NOMOS reduces latency by nearly $8\times$ and up to $828\times$, respectively. On the real-world SIFT dataset, NOMOS achieves $100\%$ top-1 and top-8 retrieval accuracy on evaluated candidate sets, showing consistent retrieval quality on real data.

We give a randomized subexponential-time algorithm for decision Learning with Errors (LWE) in two complementary parameter regimes. For polynomial prime modulus \(q=n^{\kappa+o(1)}\) with any fixed \(\kappa>1/2\), the algorithm handles independent discrete Gaussian errors drawn from \(D_{\mathbb Z,s_e}\), with Gaussian parameter \(s_e\) satisfying \(\ln(2+s_e)=(\ln n)^{a+o(1)}\) for any fixed \(0\le a<1\). Conversely, polynomial error \(s_e=n^{\gamma+o(1)}\), for any fixed \(\gamma>0\), can be handled with a quasipolynomial prime modulus \(q=\exp\!\left((\ln n)^{1+\eta+o(1)}\right)\) for any fixed \(\eta>0\). In both regimes, for an arbitrary secret distribution, the algorithm succeeds with probability \(1-o(1)\) using \(m=n+\Theta(n/\ln\ln n)\) original samples, with expected time and space \(2^{\Theta(n/\ln\ln n)}\). Our starting point is the Wagner-style Gaussian sampler of Ducas, Engelberts, and Loyer (CRYPTO 2025). We instantiate its auxiliary extensions with random \(P\)-ary lattices whose improved smoothing bound supports the accuracy required for LWE without increasing the leading list size exponent. At the smaller Gaussian width enabled by this geometry, the basis-dependent condition of the exact sampler used in prior work is no longer available. We therefore use the statistically approximate shifted discrete Gaussian sampler of Aggarwal, Dadush, and Stephens-Davidowitz (FOCS 2015) and control its error for adaptively chosen shifts. Finally, a martingale analysis applies the Aharonov--Regev Fourier distinguisher (JACM 2005) directly to the dependent output, avoiding the loss incurred by comparison with an independent product distribution. Our analysis applies to unstructured LWE with independent uniform public vectors. In particular, it does not directly apply to ML-KEM, whose security is based on the Module-LWE problem: the algebraic dependencies arising from its module structure are not covered by our analysis.

Efficient evaluation of multivariate polynomials over finite spaces is an important problem in algebraic cryptanalysis, particularly in exhaustive-search attacks on multivariate public-key cryptosystems. Existing fast exhaustive-search techniques, including those of Bouillaguet et al. (CHES 2010), Dinur (EUROCRYPT 2021), and Furue and Takagi (PQCrypto 2023), mainly target the complete space $\mathbb F_q^n$, whereas many cryptanalytic applications require evaluation only over structured subsets. Recently, Liu et al. proposed a memory-efficient algorithm for evaluating degree-$d$ polynomials over product Hamming balls \[ B(\textbf{\textit{n}},\textbf{\textit{w}})=B(n_s,w_s)\times\cdots\times B(n_1,w_1)\subseteq\mathbb F_2^n, \] where $\sum_{i=1}^{s}n_i=n$ and $B(n_i,w_i) \subseteq \mathbb F_2^{n_i} $ denotes the set of vectors of length $n_i$ and having at most $w_i$ nonzero coordinates. In this work, we extend this structured-subset paradigm by developing a unified derivative-based framework, comprising initialization and evaluation phases, first over prime fields $\mathbb F_q$ and subsequently over arbitrary finite fields $\mathbb F_{q^\rho}$ through basis expansion. We derive two initialization methods with time complexities $\mathcal O(nrM)$ and $\mathcal O(rM^2)$, where $M\leq\min\{\binom{n+d}{d},q^n\}$ and $r=\min\{d,q-1\}$. After initialization, evaluation over $B(\textbf{\textit{n}},\textbf{\textit{w}})$ requires $\mathcal O(d|B(\textbf{\textit{n}},\textbf{\textit{w}})|)$ arithmetic operations, apart from a linear setup cost. The corresponding overall memory bounds are $\mathcal O((M+r^2)\log q+n\log(nq))$ and $\mathcal O(((d+1)M+r^2)\log q+n\log(nq))$, respectively, and are independent of the number of evaluated points.

The CKKS homomorphic encryption scheme can achieve high throughput for large batches, typically of tens of thousands of inputs, whereas DM/CGGI schemes offer low latency for a single input. In existing CKKS approaches, the multiplicative depth required for nonlinear function evaluation demands a large ciphertext modulus, which forces a large ring degree regardless of the input size. Practical applications, such as encrypted MLP inference, may require only a few hundred function evaluations at a time. For these moderate batch sizes, existing CKKS-based methods requiring large multiplicative depth incur high latency without fully benefiting from their high throughput. We present $\mathsf{SWIFT}$, a CKKS functional-bootstrapping method that reduces latency by using multiple slots to lower multiplicative depth. For input $x$, $\mathsf{SWIFT}$ packs its integer multiples $\ell x$ into unused slots. Exponential bootstrapping then generates the powers $\exp(2\pi\mathrm{i}\ell x)=\exp(2\pi\mathrm{i}x)^\ell=\alpha^\ell$ in parallel. Compared to previous approaches that compute these powers through homomorphic multiplications, $\mathsf{SWIFT}$ directly generates those powers and reduces the required multiplicative depth and ciphertext modulus, allowing a smaller ring degree and lower latency. We also introduce a trigonometric approximation method for singular functions such as $1/\sqrt{x}$, whose derivative is unbounded near zero. We observe that the previous Fourier extension method of Bian et al. (EUROCRYPT'26) can produce extremely large coefficient norms for these functions when focusing solely on reducing the polynomial degree. Instead, we solve an optimization problem to find a trigonometric polynomial that minimizes the coefficient norm while satisfying the required approximation accuracy for the target function. The resulting trigonometric polynomial can be evaluated efficiently and with numerical stability using $\mathsf{SWIFT}$. Our implementation evaluates $\mathsf{ReLU}$ on $[-1,1]$ and $1/\sqrt{x}$ on $[0.0005,1]$ with 12-bit absolute and relative precision, respectively, at ring degree $\log N=15$. For batches of 512 inputs, $\mathsf{SWIFT}$ achieves speedups of $3.94\times$ and $2.86\times$ over the corresponding CKKS baselines for $\mathsf{ReLU}$ and $1/\sqrt{x}$, respectively. Compared with latency estimates of DM/CGGI-based methods, $\mathsf{SWIFT}$ achieves lower latency for $\mathsf{8\text{-}to\text{-}8\ LUT}$ and $\mathsf{12\text{-}to\text{-}12\ LUT}$ at batch sizes as small as 32 inputs.

Migrating blockchain systems to Post-Quantum Cryptography (PQC) requires not only replacing classical primitives, but also analysing transformations that change how signatures are represented and verified. We study Falcon-PKR, a public-key-recovery variant of Falcon, motivated by Zcash-like transparent transaction workflows. Falcon-PKR replaces explicit storage of the full Falcon public key with a compact stored digest and reconstructs a candidate public key from the signature during verification. In our construction, this reduces the combined representation size of public key and signature by approximately 15%, but it also introduces a distinct security case in which verification depends on a reconstructed key derived from adversarially supplied signature data. We address this with a machine-checked EasyCrypt formalisation in the Random Oracle Model (ROM). We mechanically verify an EUF-CMA reduction showing that the security of Falcon-PKR is bounded by the security of standard Falcon together with collision resistance of a domain-separated public-key hash. The analysis therefore treats both assumptions explicitly and does not claim a proof of Falcon itself. We also machine-check correctness for honest signing under an abstract Falcon signing interface. We implement Falcon-PKR for Falcon-512 and Falcon-1024 in Python and C, and evaluate runtime and size against ECDSA and selected Post-Quantum (PQ) alternatives, exposing explicit verification and storage trade-offs. As a complementary case study, we implement and analyse an extended SECUER-based Multi-Party Computation (MPC) ceremony architecture. Together, the two case studies address both transaction-signature and ceremony-infrastructure layers of PQ blockchain migration.

Seur\'e and Suvanto (ePrint 2026/1102) recently showed that, for small-characteristic primes $p$, arithmetic over $\mathbb{F}_{p^r}$ can be homomorphically evaluated in CKKS via a technique they call \emph{spectral encoding}. Their construction is, however, restricted to small characteristic: ciphertext multiplication amplifies the error by the operator norm of the multiplied plaintext. Under the spectral encoding, a field element in $\mathbb F_{p^r}$ is encoded to a plaintext with operator norm at most $O(rp)$. The error therefore grows by a factor of $rp$ in the worst case, limiting the supported size of the characteristic prime $p$. In this work, we propose \emph{bi-spectral encoding}, which decomposes the coefficients of the plaintext polynomials used in the spectral encoding of Seur\'e and Suvanto. With a decomposition parameter $d$, a field element in $\mathbb F_{p^r}$ can be encoded to a plaintext with operator norm $O(rd{p^{1/d}})$, for a suitable choice of encoding parameters. We give a comprehensive analysis of error growth and derive a bound on error amplification under multiplication. For fields with a 256-bit prime characteristic (secp256k1) and extension degrees $1$, $2$, and $4$, we provide numerical simulations of error amplification and compute the maximum multiplication counts satisfying the decoding condition under stated error bounds. We further present a bootstrapping procedure that reduces both the size of the plaintext and its noise.

Supersingular abelian surfaces are essential in isogeny-based cryptography. Despite this, we have no efficient algorithm to verify if a given abelian surface is supersingular. In this work, we initiate this research topic by giving an efficient Monte Carlo algorithm to verify if an abelian surface over $\mathbb{F}_p$ is supersingular in $O(\log p)$ with negligible failure probability, and an efficient conclusive algorithm if the order is smooth. We derive this algorithm by a careful analysis on the structure of supersingular Jacobians over $\mathbb{F}_p$. Furthermore, we derive efficient algorithms to verify if an abelian variety of any dimension is minimal or maximal, and to verify if a Jacobian of any dimension is superspecial.

In this work, we assess the security of the main signature scheme standardised by NIST, ML-DSA, and its precursor identification schemes under an extended quantum adversarial model, one in which the adversary is allowed to use quantum resources to interact with a prover/signer. We begin our analysis by developing new techniques for superposition attacks that realise a relative phase oracle for the LSBs of a classical function evaluated in a quantum computer. We then extend these techniques to enable a relative phase oracle for arbitrary bits. Leveraging these techniques, we demonstrate full key-recovery attacks on several lattice-based identification schemes, exploiting the affine structure of the output. Finally, we extend these attacks to the corresponding Fiat-Shamir signature schemes and obtain key-recovery attacks under reasonable implementation assumptions. As a result, we are able to mount full key-recovery attacks in the Q2 model against the original CRYSTALS-Dilithium scheme, as well as the corresponding NIST Standardisation Rounds 1 and 2 proposals. However modifications introduced in the scheme during the NIST process preclude our superposition attacks against the final standardised version ML-DSA. We identify and discuss the specific aspects of the algorithm's execution that affect the applicability of our techniques. Overall, our work expands the body of research on superposition attacks and represents a further step towards establishing full quantum security for cryptographic constructions.

The Internet of Things (IoT) is revolutionizing society by enabling anytime, anywhere connectivity, but its widespread deployment also makes IoT devices attractive targets for malicious activities. Over the past decade, radio-coupling based Far-field EM Side-Channel Attacks (FEM-SCAs), also known as screaming channel attacks, have emerged as a new threat to these wireless IoT edges. Unlike conventional power or near-field EM side-channel attacks, FEM-SCAs exploit the unintended coupling between digital computation and the Radio Frequency (RF) transmission chain, allowing sensitive information to be captured through radiated radio signals at long distances. Since the first screaming-channel demonstration, this field has progressed rapidly: attacks have become more efficient, DL-enabled methods have been developed, and recent studies have begun to examine more realistic wireless-protocol settings. Despite existing practical cases of remote FEM-SCA attacks, the literature remains fragmented. To systematically understand this security threat and to aid future countermeasure design, this paper presents the first systematic survey of existing screaming channel attack methodologies and case studies. We organize studies into a hierarchical framework covering leakage discovery and understanding, enhanced attack capability, attack targets and variants, and public data collections. Through a fine-grained cross-paper analysis, we compare representative works in terms of target implementation, attack distance, analysis method, profiling requirement, acquisition environment, and other factors. Building on this end-to-end review, we provide a focused discussion that distills FEM-SCA research into one central trade-off, three major limitations, and three future research roadmaps. Taken together, this survey offers a structured framework for understanding a rapidly developing far-field side-channel attack class, and provides practical guidance for evaluating its real-world threat boundaries.

We improve differential-linear distinguishers and derive key-recovery attacks on reduced-round versions of the PRFs Orthros, Gleeok, ZIP-AES, ZIP-GIFT-64, and ZIP-GIFT-128. Relative to previous differential-linear analyses, we extend the reported coverage for Orthros from 7 to 9 rounds and for Gleeok-128 from 4 to 5 rounds. For Orthros and Gleeok-128, we obtain estimated correlation magnitudes \(2^{-61.40}\) and \(2^{-31.71}\), respectively. We also obtain distinguishers for 6-round Gleeok-256, \((3,3)\)-round ZIP-AES, \((7,7)\)-round ZIP-GIFT-64, and \((10,10)\)-round ZIP-GIFT-128. For key recovery, we give a \((3,3)\)-round differential-linear attack on ZIP-AES requiring approximately \(2^{122.42}\) chosen plaintexts and \(2^{122.88}\) ZIP-AES evaluations. Our \((10,10)\)-round ZIP-GIFT-128 attack has estimated data, time, and memory complexities of \(2^{93}\) chosen plaintexts, \(2^{117}\) full PRF evaluations, and \(2^{25.01}\) bits. We further obtain weak-key attacks on 9-round Orthros, 5-round Gleeok-128, and 6-round Gleeok-256, with key-space coverages of \(2^{-2.87}\), \(2^{-3}\), and \(2^{-1}\), respectively. The Orthros key-recovery result reaches one round beyond the previous DL key-recovery coverage. These results use automated differential and linear trail search together with existing round-based correlation estimation. We enforce the compatibility constraints between branches and select input-side extensions that make their prescribed differences jointly reachable.

FESTA is an isogeny-based trapdoor function proposed as a high-performance trapdoor function in isogeny-based cryptography. Its core design principles have inspired a number of related constructions, collectively referred to as FESTA variants. The MOXZ attack is an adaptive attack that exploits malicious ciphertexts together with access to a checking oracle, aiming to compromise FESTA and its variants. This attack applies to FESTA variants whose secret keys are derived from isogenies of known degree; however, it does not extend to variants employing masked-degree isogenies. In this work, we present a novel adaptive attack that generalizes the MOXZ attack. Our attack successfully targets several FESTA variants even when their secret keys are isogenies of masked degree. We also identify POKE-4D as an exception for which our attack does not appear to be applicable.

TLA$^+$ (Temporal Logic of Actions) is a formal specification language well-suited for distributed systems. However, writing proper TLA$^+$ scripts requires high domain expertise. When it comes to modeling Byzantine behaviors for Byzantine fault-tolerant consensus protocols, the simulation of malicious behavior is a fundamental challenge: overly simplified modeling misses critical vulnerabilities, and verbose modeling leads to state-space explosion. In this paper, we present TLAssist, a large language model (LLM)-assisted tool for semi-automated TLA$^+$ generation tailored for Byzantine reliable broadcast (RBC) protocols. We provide a highly structured workflow and domain-specific data format to improve the quality of LLM prompts. Using five RBC protocols as case studies, we have some interesting findings. First, the specification generated by TLAssist outperforms many open-source TLA$^+$ scripts we are aware of, including those written by domain experts. Second, TLAssist can assist domain experts in identifying deep design flaws. Notably, our case study on the (2,3,4)-Optimistic RBC (a CCS'25 distinguished paper) captures a subtle issue that causes the violation of the totality property. Finally, TLAssist is useful for non-experts. Namely, we show that by revising the protocols slightly, the generated error traces effectively show complex corner cases that can facilitate understanding of the design.

The Institute of Commercial Cryptography Standards (ICCS) launched the Next-generation Commercial Cryptographic Algorithms Program (NGCC) and invited worldwide comments on draft submission requirements and evaluation criteria for cryptographic hash algorithms. Our analysis of seven submitted hash functions gives the following results: - Message differences that cancel in every key injection give explicit collisions for all four fixed-output variants of \textbf{MoFang} and both XOF variants at every finite output length. - Two distinct states of \textbf{Neulaser} become equal after one update, giving collisions for all three variants with the initialization used by the v2 reference and optimized implementations. - An invariant subspace of \textbf{CHIME-512} permits collision search using at most \(2^{64}\) hash evaluations when shifts act separately on 64-bit words, as in both submitted implementations. - \textbf{CHAMP}'s determinant constraint gives collision searches using at most \(2^{192}\) and \(2^{384}\) hash evaluations for its 512- and 1024-bit variants, respectively. - We exhibit explicit free-start collisions for all three \textbf{QSH} variants. In the semi-free-start setting, both messages and every tree node share one chosen complete reset. We prove upper bounds of \(2^{64},2^{128},2^{128}\) compression evaluations for finding collisions with 512-, 768-, and 1024-bit digests, respectively, plus constant preparation and finalization costs. - In both versions of \textbf{WChain}, the message expansion preserves invariant sets and admits sequences of expanded blocks with periods one, three, and six over all prescribed steps. - On a set of 256 message blocks, \textbf{Cuishen}'s message expansion acts as a cyclic shift of eight binary coordinates throughout all 64 rounds. With the same initial chaining register and counter, these blocks give XOR differences between round keys with periods dividing eight. The stated evaluation budgets for \textbf{CHIME-512} and \textbf{CHAMP} give success probabilities greater than \(0.39\).