Incrementally verifiable computation (IVC) [Valiant, TCC '08] allows one to iteratively prove that a configuration $x_0$ reaches a configuration $x_T$ via $T$ repeated applications of a (possibly non-deterministic) machine $\mathcal{M}$. An IVC scheme is fully succinct if the proof size is independent of both $T$ and the size of the intermediate configurations. In this work, we develop a new indistinguishability obfuscation ($i\mathcal{O}$)-based approach to IVC that avoids the extraction-based security analyses central to prior constructions. Assuming subexponential hardness of $i\mathcal{O}$ and one-way functions, we construct an adaptively sound fully succinct IVC scheme for deterministic computations. This yields the first IVC for deterministic computations that does not rely on algebraic assumptions. Under the same assumptions, we further obtain a fully succinct two-hop IVC scheme for $\mathsf{NP}$ with non-adaptive soundness, allowing one to prove that $x_0$ reaches $x_2$ via an intermediate configuration $x_1$. This is the first IVC scheme for $\mathsf{NP}$ achieving full succinctness. Our constructions are based on a new connection between IVC and secret sharing for $s$-$t$ connectivity in graphs.

Non-local search-to-decision asks whether the difficulty of two non-communicating (non-local) parties both predicting $x$ given a bipartite state (that possibly depends on $x$) implies the difficulty of non-local parties both predicting the inner product $\langle r,x\rangle$, for a uniformly random $r$. This problem and its variants have been extensively studied and are motivated by applications to unclonable cryptographic primitives such as unclonable encryption and copy-protection. We study the identical-challenge setting, in which both parties receive the same uniformly random vector $r$, in contrast to the independently sampled challenges considered in prior works. We demonstrate positive results for the cases when $x$ and $r$ are vectors over $\mathbb{F}_2$ and over large finite fields. As a consequence, we obtain a conceptually different proof of indistinguishability-secure unclonable encryption.

The Internet of Things (IoT) comprises a vast array of interconnected devices that rely heavily on wireless communication to enable applications in domains such as healthcare, transportation, and smart environments. However, intrinsic vulnerabilities in wireless networks, such as susceptibility to eavesdropping, impersonation, and message tampering, require the development of robust yet lightweight authentication mechanisms. To address these concerns, we introduce AEBAP, an efficient authentication protocol based on elliptic curve cryptography (ECC), specifically designed for secure communication in resource-constrained IoT environments. AEBAP ensures mutual authentication, data integrity, and resilience against both passive and active attacks by leveraging the cryptographic strength and computational efficiency of ECC. We evaluate the protocol’s performance through experimental implementation and analyze its security using both informal reasoning and formal verification tools, including Scyther and ProVerif. The results demonstrate that AEBAP achieves strong security guarantees with minimal computational and communication overhead, making it a promising solution for securing next-generation wireless IoT systems

The FROST threshold signature scheme achieves round optimal Schnorr signing through a double-nonce construction, but requires two presignatures per signature. Since each presignature demands an expensive distributed key generation (DKG) protocol, this overhead is significant for high-throughput applications. FROST builds on a core presignature protocol (that we call FROST-core) that uses hash-based re-randomization of presignatures. We investigate whether fewer presignatures can be used to sign multiple messages, improving FROST-core's message capacity. We first show that the natural generalization of using $k$ presignatures for $k$ messages is insecure: an extended ROS attack enables forgery even for $k=2$. However, we prove that using $k+1$ presignatures for $k$ messages achieves security in the Generic Group Model combined with the Random Oracle Model. This improves message capacity from 50% (standard FROST-core) to $\frac{k}{k+1}$, approaching 100% as $k$ grows. We further extend our analysis to a modified FROST-core protocol in which a set of presignatures is generated by different parties and used for signing $k$ messages. Security holds as long as at least $k+1$ presignatures were created by honest parties.

Setting concrete parameters for group action based cryptographic protocols is notoriously difficult due to the incomplete understanding of the concrete efficiency of Kuperberg's subexponential quantum attack. Estimates for the CSIDH group action do exist in the literature, but they do not easily translate into meaningful estimates for the many recent and far more efficient alternative group actions. In this paper, we implement the recent qt-Pegasis group action framework as a (simulated) quantum circuit, allowing for concrete estimation of its efficiency and Kuperberg's attack. Our results suggest that using a 2048-bit base field in qt-Pegasis offers reasonable quantum security, while a 4096-bit base field is required to reach NIST security level 1.

We describe a Las Vegas algorithm for the principal ideal problem in matrix rings $M_g(O)$ for $g \geq 2$, over maximal orders $O$ in the rational quaternion algebra $B_{p, \infty}$ ramified at $\infty$ and a prime number $p$. Under plausible heuristic assumptions, the method has expected polynomial runtime. An implementation in SageMath shows that it runs very efficiently in practice, with compact output. Our main auxiliary result is a method for finding endomorphisms of superspecial abelian varieties (i.e., powers of supersingular elliptic curves) with a prescribed kernel.

Threshold cryptographic primitives have not been widely adopted in real-world distributed systems (i.e., beyond the closed committee model) presumably due to state-synchronization overhead and complex certification processes for the shareholders. These are both aspects of infrastructure overreliance, an assumption that is usually glossed over in their design. In this work, we propose OSST, a real-time threshold identification protocol that achieves non-interactivity and non-reliance on public shares by means of direct proof interpolation. Given a Shamir $(n, t)$-shared secret $x$, the proposed scheme allows any $t^* \ge t$ (but no less) shareholders to prove over designated communication channels that their key shares interpolate to $x$ without revealing any information beyond that. Provers do not engage in distributed computations, sending their packets to the verifier asynchronously; conversely, verifiers need only know the combined public key $y \equiv g ^ x$, without need to pre-validate and register the individual member identities. The protocol is intended for use in permissionless or unmanaged meshes that lack both overlay networks and trust infrastructure or governance, a use case space that has been tacitly neglected as ''niche'' by the current mainstream. No publicly verifiable setup is required beyond distributing $x$ according to Shamir's secret sharing (or equivalent distributed key generation scheme) and advertising its public counterpart; in particular, the protocol is intended to be secure against impersonation without relying on the auditability of any advertized public shares. We provide evidence that this has good chances to hold true by giving a security proof in the random oracle model under the one-more discrete-logarithm (OMDL) hardness assumption.

In a multi-instance problem, the adversary is given $n$ independent problem instances and succeeds if it solves at least $k$ of them. We study the generic hardness of a broad class of multi-instance problems over prime-order groups, including multi-instance Computational Diffie-Hellman (CDH), Square Diffie-Hellman (SDH), Inverse Diffie-Hellman (IDH), and Linear Kernel Diffie-Hellman (LKDH). As expected, we show that, in generic groups, solving multi-instance CDH and SDH is as hard as solving $k$ independent discrete logarithm instances. In contrast, although the single-instance versions of CDH and IDH are known to be equivalent, we establish generic upper and lower bounds showing that multi-instance IDH (and LKDH) can be significantly easier to solve than multi-instance CDH in certain parameter regimes. All problems, however, offer $1/2(\log(p)+\log(k))$ bits of security. Our lower-bound techniques extend Yun's information-theoretic hyperplane query model (EUROCRYPT 2015). At the core of our approach lies an inductive argument showing that, in order to establish a generic-group lower bound, it suffices to bound the adversary's "zero-hyperplane-query" advantage in the hyperplane query model. For the multi-instance problems considered in this work, we derive such bounds using techniques from algebraic geometry. More precisely, we analyze the Krull dimension of suitable algebraic varieties, either by explicitly computing Gröbner bases or by upper bounding the number of algebraically independent elements in the associated coordinate rings.

Batch decryption allows an authority to release a short key that enables public decryption of a selected batch of ciphertexts. Motivated by encrypted mempools, we study this capability through two constructions with different authorization semantics and assumptions. First, we provide a simple and compact epochless construction in an RSA group based on Fiat's Batch RSA [CRYPTO'89]. Its batch-decryption hint is just one group element, and its keys and ciphertexts have size independent of the batch size, with no batch bound fixed at setup. We prove adaptive security under the strong RSA assumption in the random-oracle model. The scheme permits repeated releases for overlapping batches, with each release authorizing decryption of the selected ciphertexts. Second, we give an adaptively secure generic construction of identity-based encryption with batch decryption in the epoch-based model, which permits at most one batch-key query for the challenge epoch. The construction combines deferred encryption via garbled circuits, non-inclusion secure registration-based encryption, and weak receiver non-committing IBE. We construct the latter primitive from ordinary IBE and pseudorandom functions, obtaining an instantiation of the epoch-based construction from the computational Diffie--Hellman assumption.

Oblivious Transfer (OT) is a fundamental building block for secure computation, in which a sender holds two messages and a receiver learns exactly one of them, without revealing which one was chosen and without learning the other. While generic constructions for Universally Composable (UC) OT exist, instantiating them from post-quantum assumptions remains challenging, particularly under adaptive corruption. In this work, we present the first adaptively UC-secure OT protocol based on Group Actions, specifically assuming weakly pseudorandom Effective Group Actions (EGA) like CSIDH. We adhere to the framework of [BC15], which derives an adaptively UC-secure OT protocol from SPHF-friendly extractable and equivocable (E²) commitment schemes. The central challenge in instantiating this construction from group actions is the lack of SPHF-friendly IND-CCA encryption. Classical CCA transformations such as Fujisaki-Okamoto destroy the algebraic structure required for building SPHFs over ciphertexts, while known group action-based schemes offer no native mechanism to prove ciphertext validity. To overcome this obstacle, we construct from group actions an IND-CCA encryption scheme with enough algebraic structure to efficiently recognize valid ciphertexts. Our contributions are threefold: (1) a verifiable chameleon hash function with perfect soundness in the standard model, (2) an SPHF-friendly, publicly verifiable IND-CCA encryption scheme in the random oracle model, and (3) we combine these to build an SPHF-friendly E² commitment scheme and derive a fully adaptively secure OT protocol in the UC framework. This is the first construction of its kind under group action assumptions, enabling post-quantum secure OT with adaptive security guarantees. These building blocks may also be of independent interest e.g., to obtain digital signatures, non-malleable commitment schemes, or verifiable encryption.

The Chinese NGCC post-quantum competition received a family of lattice KEMs whose decryption failure rates (DFRs) are certified by their designers with models that differ in detail. We recompute the failure probability of the first-round lattice KEMs whose claimed DFR, or a simple recomputation of it, lies near or below the nominal level, and we estimate the offline search for weak ciphertexts under a cap of $2^{64}$ or $2^{80}$ decapsulation queries. Three distinct mechanisms are relevant. (i)~\emph{Correlated decoding blocks.} DTRU decodes 16-coefficient DoubleE$_8$ blocks; in the tricyclotomic ring $\mathbb{Z}_q[x]/(x^n-x^{n/2}+1)$ and the LPPNF ring, the two octets of a block are ring-paired and the repetition code places the same bit on both. Our covariance-aware estimates raise the DFR of six of the seven sets by roughly $50$--$110$ bits. Their estimated uncapped first-failure costs are $2^{85}$--$2^{111}$ decapsulations. Under a fitted ciphertext-tail model, DTRU-648, DTRU-768, and DTRU-Prime fit within $2^{64}$ expected queries after $2^{22}$--$2^{26}$ estimated offline encapsulations. (ii)~\emph{Omitted compression noise.} Cheetah compresses its public key and both ciphertext components. Section~2.2 of the specification omits the public-key term $\langle e_b,r\rangle$, while the $v$-compression error can be treated as a known, ciphertext-dependent shift. Under the coefficient-independence model, exponentially tilted one-dimensional FFTs give DFR estimates of $2^{-79.1}$ and $2^{-51.8}$ for Cheetah128 and Cheetah256, rather than the claimed $2^{-129}$ and $2^{-176}$. Their expected random-query waiting times are below $2^{80}$. We check the noise model at observable rates on a scaled-down instance and against full-size shallow-tail samples. (iii)~\emph{Bounded noise in two-dimensional codes.} Rudraksh2 and Scabbard decode coefficient pairs with B2-Minal codes and already evaluate their joint distribution by two-dimensional FFT. We rederive the two-dimensional atoms and evaluate one-dimensional projections onto failure radii of the real decoder. The resulting projected-tail estimates are $2^{-103.9}$ for Rudraksh2-128-I and $2^{-102.1}$ for Scabbard-128, a few bits below the claimed $2^{-100}$ and $2^{-99}$. Under a $2^{80}$ query cap, the estimated classical totals are $2^{112}$ and $2^{188}$, respectively. No attack described here recovers a key. Under the first-failure DFR metric, several estimated costs lie below their nominal levels; the formal far-tail figures remain subject to the modelling, extrapolation, and geometric limitations stated in the paper.

The Learning With Errors (LWE) problem is a fundamental assumption in post-quantum cryptography. Regev established a quantum reduction from LWE to the Dihedral Coset Problem (DCP). Later, Brakerski et al. introduced the Extrapolated Dihedral Coset Problem (EDCP), proving its equivalence to LWE. However, unlike DCP, EDCP no longer admits a coset structure. This limits the direct application of techniques for hidden subgroup problems. In this work, we introduce the Cyclotomic Coset Problem (CCP), a cyclotomic generalization of DCP that preserves an exact hidden-subgroup structure. Let $\zeta_p$ be a primitive $p$-th root of unity, let $\pi=\zeta_p-1$, and write $q=p^t$ and $L=t(p-1)$. We work over $R_q=\mathbb Z_q[\zeta_p] \cong \mathbb Z[\zeta_p]/(\pi^L)$, where the isomorphism follows from the total ramification identity $(p)=(\pi)^{p-1}$.We exploit the resulting $\pi$-adic ideal chain to construct a quantum sieve that successively reduces phase states modulo $\pi^{L},\pi^{L-1},\ldots,\pi$. For every fixed prime $p$ and modulus $q=p^t$, our algorithm solves the CCP in time and sample complexity $2^{O_p(\log n\log q)}$, using polynomial quantum space. The sieve also applies to uniform EDCP and Gaussian $S\ket{\text{LWE}}$, yielding quasi-polynomial time algorithms for all the above problems when $q=\text{poly}(n)$. This extends the power-of-two EDCP sieve of Bai et al. (CRYPTO 2025) to a cyclotomic setting. However, we emphasize that our result does not, by itself, yield a quasi-polynomial-time algorithm for standard LWE, because the currently known reduction produces only a limited number of approximate CCP states.

We present SUCRE, a novel countermeasure designed to physically protect the rejection sampling step of ML-DSA, one of the post-quantum signature schemes standardized by NIST. At the core of SUCRE is a masking gadget that securely unmasks a vector while simultaneously applying a random permutation of its coefficients. This lightweight mechanism preserves the vector’s infinity norm, enabling rejection sampling to proceed as usual without requiring any complex mask conversions. We formally prove that a $d$-probing adversary can learn at most some permuted rejected values---information which, we show, should remain insufficient to endanger the security of the signature scheme. This security argument relies on a new variant of the Module Learning with Rounding (MLWR) assumption, for which we provide a dedicated concrete security analysis to assess its hardness relative to the standard MLWR assumption. Our implementation of SUCRE achieves a significant performance improvement over previous masked non-bitsliced implementations of rejection sampling---delivering four to six times faster execution than Coron et al. (TCHES 2024)---albeit at the cost of increased memory usage. Since the rejection step accounts for approximately 25% of the total runtime in masked ML-DSA implementations, and given the expected adoption of ML-DSA on embedded platforms, this speedup could significantly enhance efficiency in real-world applications.

We correct two errors in Section~8 of the above-mentioned paper concerning the seed parameters proposed for BLS27 elliptic curves (embedding degree $k=27$) at the $256$-bit and $192$-bit security levels. In both instances, the disclosed seeds produce a composite $r(x)$, violating the primality condition essential for constructing pairing-friendly curves. Additionally, for the $192$-bit seed the characteristic $p(x)$ is also composite. We provide verified corrected seeds for each security level, obtained by exhaustive search, and confirm with SageMath that both $p(x)$ and $r(x)$ are prime in each case. All other results of the original paper remain valid.

Folding schemes combine a batch of relation instances into one accumulator. For quadratic relations, applying the fold directly creates a mixed term for every pair of inputs. We present CauchyFold, a lattice protocol that folds one accumulator with \(k\) fresh quadratic instances without enumerating these pairwise terms. The companion work [WX26] uses Cauchy folding coefficients to represent the mixed contribution through a vector-valued polynomial of degree below \(k\). We give two algorithms that compute its coefficients with quasi-linear arithmetic in \(k\) for fixed relation dimensions. The protocol commits this polynomial before the folding challenge. Since the folding coefficients need not be short integers, it computes the fold over an extension field and canonically re-encodes the result as bits. This preserves the accumulator’s commitment layout and honest opening bound. For classical resettable provers, we give explicit extraction-error and expected-time bounds for a folding node with a fixed-depth reduction chain. It recovers valid source openings or a short nonzero vector in the kernel of a commitment matrix. A compiled profile at \(k=1024\) uses 162.67 KiB of no-retry interactive communication, excluding incoming commitments and the CRS.

Syndrome decoding (SD), together with its regular-noise variant (RSD), is fundamental to many cryptographic primitives; in the generator formulation used in cryptography, it is closely related to learning parity with noise (LPN). While recent proposals extend these problems to larger fields, the concrete security of SD over large fields remains comparatively less understood. This gap leaves room for more effective attacks against SD-based primitives over large fields. In this paper, we present an improved algorithm for solving SD over large fields. Our method modifies Prange's information-set decoding algorithm by iteratively applying Gaussian elimination to reduced-size matrices rather than to the full-size matrix. We call this the ``Reduce and Prange (RP)" algorithm and demonstrate its effectiveness for both SD and its variant with regular noise over large finite fields (e.g., $\mathbb{F}_{2^{128}}$). On the comparison rows of our numerical section, RP lowers the SD estimate by up to $6$ bits, and on the 128-bit recommended SD rows the drop is up to $7$ bits, relative to Liu et al. (Eurocrypt'24). For SD with regular noise, regular-RP gives the lowest listed estimate on the small and medium tested parameter sets, improving on the best previously listed estimate by up to $15$ bits; on the largest tested sets the algebraic estimate of Briaud and {\O}ygarden (Eurocrypt'23) remains lower.

Inner Product Arguments (IPA) [BCC+16,BBB+17] are a family of proof systems with $O(\log n)$ sized proofs, $O(n)$ time verifiers, and transparent setup. Bootle, Chiesa and Sotiraki [BCS21] observed that an IPA can be viewed as a sumcheck protocol [LFKN92] where the summed polynomial is allowed to have coefficients in a group rather than a field. We leverage this viewpoint to improve the performance of multi-linear polynomial commitments based on IPA. Specifically, - We introduce a simplified variant of Halo-style accumulation that works for multilinear evaluation claims, rather than only univariate ones as in [BGH19,BCMS20]. - We show that the size $n$ MSM the IPA verifier performs can be replaced by a ``group variant'' of $\mathsf{basefold}$[ZCF23]. This reduces the verifier complexity from $O(n)$ to $O_{\lambda}(\log^2 n)$ time at the expense of an additional $4n$ scalar multiplications for the IPA prover.

MAYO is a post-quantum signature scheme based on UOV that uses the whipping transformation to achieve more compact public keys and retain efficient signing. We present the first structural forgery attack that exploits the geometry of the resulting multivariate quadratic (MQ) maps. Our starting point is the observation that whipping amplifies polar cancellations in the underlying MQ map, producing subspaces with low-dimensional quadratic and polar images. We combine this geometric insight with the Pseudo-Oil Attack (ASIACRYPT 2026) and a descent to the binary field into a structural forgery algorithm. Independently, we introduce a multi-target reduction for homogeneous MQ maps. Projecting onto a quotient of the codomain reduces the number of equations, and homogeneity allows suitable solutions to be rescaled to the original targets. Concretely, the combination of our forgery attacks lowers the estimated bit security of the Security Level I and III parameter sets of MAYO Round 2 by roughly 18 and 16 bits, respectively. In particular, the Level I parameter set falls 15 bits short of its required security level. For the recently released MAYO Round 3 parameters, our attack still reduces the estimated security by roughly 6, 4 and 2 bits for the new MAYO1, MAYO2 and MAYO3 respectively, bringing MAYO2 below the required security by 3 bits.

Decentralised proof of personhood, cryptographically binding a digital identity to a unique living human without a trusted central authority, is a foundational problem in permissionless networks. We present a novel protocol, Secure-GYID (S-GYID), resilient to Identity Theft Attack (i.e., adversarial authorities substitute a victim's biometric fingerprint under a malicious public key) and Ghost Key Attack (i.e., colluding authorities fabricate a registration for a non-existent user). Our protocol closes both vulnerabilities by replacing raw biometric transmission with an encryption-based digital fingerprint derivation $F = E(pk_u, P_u)$ computed under a one-way, chosen-plaintext-secure, deterministic scheme, so that no authority can substitute or forge a binding pair without knowledge of the user's secret key. S-GYID further introduces a three-stratum generational authority hierarchy with bounded tenure and VRF-based session selection to limit long-term collusion structurally. We prove Identity Theft Resistance, Biometric Detectability, and Ghost Key Resistance under standard cryptographic assumptions, and provide a hypergeometric session-capture analysis that establishes concrete parameter design rules for both the key activation and authority promotion thresholds.

We give an elementary construction of large Reed-Solomon lists on multiplicative subgroups. For every fixed rational rate $\rho\in(0,1)$, suitable sequences of lengths give lists of size at least $2^{(2-o(1))H(\rho)/\eta}$ at agreement fraction $\rho+\eta$ as $\eta\to0$, where $H$ is binary entropy. This doubles the leading entropy exponent of the antipodal lower bound stated by Arnon, Boneh, and Fenzi, building on the construction of Krachun, Kazanin, and Haböck. If the reduced denominator of $\rho$ is a power of two, the lengths can also be chosen as powers of two. The construction lifts subsets with a prescribed product from a quotient subgroup of size $s$. This fixes a coefficient while losing at most a factor $s$ in the number of subsets. More precisely, for $n=hs$, $h\ge2$, and $1\le m\le s-2$, a code of dimension $\kappa=mh$ on a subgroup of order $n$ has a word with at least $\binom{s-1}{m+1}/s$ codewords at agreement $\kappa+2h-1$. This holds over every field containing the required roots of unity. Consequently, the exponent constant $c_2$ in the universal list-size conjecture of the S-two whitepaper must satisfy $c_2\ge2$.

The Fiat--Shamir transformation is a fundamental paradigm in cryptography for compiling interactive public-coin protocols into non-interactive arguments. While this transformation has been extensively studied for public-coin protocols, the setting of private-coin protocols, where the verifier's messages depend on secret randomness, remains largely unexplored. To date, there are no candidate transformations for private-coin protocols, neither in the standard model nor in idealized settings. In this work, we present a generic transformation that compiles any 3-message private-coin interactive proof into a non-interactive argument in the standard model, while preserving zero-knowledge. Our construction relies on sub-exponentially secure indistinguishability obfuscation, pseudorandom functions, and input-hiding obfuscation (IHO). As a corollary, this rules out the existence of 3-message weak zero-knowledge proofs with small enough soundness error. We complement this positive result by showing that the reliance on IHO is inherent: any secure Fiat--Shamir transformation for general private-coin protocols necessarily implies the existence of IHO. Finally, we rule out Fiat--Shamir transformations for multi-round private-coin protocols. Specifically, assuming the existence of collision-resistant hash functions, we prove that no such transformation exists in the multi-round setting.

Non-uniform security allows an adversary to receive bounded advice about an oracle before attempting a fresh challenge. This captures the most realistic attacks and has already been studied extensively in prior work. In this work, we introduce an operator-norm approach for non-uniform security in the quantum random oracle and random permutation models. This new approach yields a unified reduction for both search success probability and distinguishing advantage. Previously, the reduction only worked with success probability even in the decision games, yielding a worse bound. Our framework enables tight bounds for Yao's box, both with and without salting, and improved bounds for pseudorandom generators. We also prove an optimal generic salting theorem for decision games. By defining a property of a game, which separates the contributions of the existing queries in the offline stage and subsequent online queries, we obtain stronger bounds for specific salted constructions. These include salted permutation inversion, tight up to logarithmic factors, and salted random-function inversion, tight up to logarithmic factors and the gap already present in classical function inversion.

Determining the precise parts of the key that need to be guessed in a key-recovery attack is fundamental for judging its cost: if the same attack can be executed by guessing less key material, then the cipher's resistance against this attack is overestimated. Although a multitude of prior works provide upper bounds on the key material required, and although these bounds might be tight in some special cases, a precise evaluation of the required key material and the tightness of these bounds is still missing. We remedy this by enumerating linear trails to iteratively compute the affine hull of the support of the Fourier transform of the key-recovery map. This leads to a generic and practical algorithm that identifies the smallest subspace of key material to be guessed. This algorithm is ready to be used in many different attacks and for a large variety of cipher structures. We demonstrate its impact by showcasing improvements on several published integral, linear, differential-linear, and zero-correlation attacks on the block ciphers PRESENT, SIMON, SKINNY, and GIFT.

Recent MPC-in-the-Head (MPCitH) signatures increasingly rely on aggressive GGM-tree optimizations to reduce signature size and cost, culminating in secret-key-root correlated GGM trees as used in SBC (Huth and Joux, CRYPTO 2024), MQOM (NIST PQC Standardization for Additional Signature Round-2, 2024), and rBN++ (Kim, Lee, and Son, EUROCRYPT 2025). While this technique yields substantial compression, it introduces a dependency loop in the proof (Kosuge and Xagawa, ePrint 2025/1999). We analyze MQOM and resolve this circularity by providing EUF-CMA security proofs for a slightly modified variant. The modifications consist of incorporating a salt into the input of a hash function and modifying the evaluation domain to ensure that all evaluation points are nonzero. For the resulting variant of MQOM, we prove EUF-CMA security for the GF(2) parameter sets in the random-oracle plus ideal-cipher model, assuming EUF-NMA security, standard one-wayness, and a heuristic conjecture on matrices. Our proof combines the H-coefficient technique with one-wayness, which may be of independent interest. We also prove EUF-CMA security in the (quantum) random-oracle model, where block-cipher-based hash functions are modeled as random oracles. The proof relies on EUF-NMA security and partial-guessing one-wayness (Feneuil and Rivain, ASIACRYPT 2026), which can be reduced classically to partial-domain one-wayness and, in the quantum setting, to a new notion introduced in this work called domain-extension one-wayness.

POKÉ, introduced by Basso and Maino, is one of the most efficient isogeny-based public-key encryption schemes. The generic parallel-encryption approach yields a $(t,n)$-threshold variant by running $n$ independent POKÉ instances and secret-sharing the message, but this multiplies the public-key and ciphertext sizes by roughly $n$. We present S-TPOKÉ, a POKÉ-based $(t,n)$-threshold construction for every $1\le t\le n$, and Ch-TPOKÉ, an $(n,n)$ variant that arranges the parties' secret isogenies differently. Both schemes avoid repeating part of the isogeny computation that appears in every independent POKÉ instance. Compared with the trivial construction, they reduce the number of degree-$3^{b}$ isogenies computed during encryption from $2n$ to $n+1$ and reduce the ciphertext size by about a factor of two when $n$ is large. The two schemes differ in how the parties' secret isogenies are arranged. S-TPOKÉ is our main construction: the dealer samples $n$ independent secret isogenies, while encryption samples one sender-side secret isogeny and shares it across the parties. Ch-TPOKÉ instead arranges the parties' secret isogenies into a chain. For S-TPOKÉ, we prove SIM-CPA security under static corruption in the random oracle model from the $(k,n)$-S-C-POKE assumptions for all $1\le k\le t$, which extend C-POKE to the threshold setting. For Ch-TPOKÉ, we prove only SIM-CPA security under static maximal corruption from the $(j,n)$-Ch-D-POKE assumptions for all $j\in\{1,\ldots,n\}$, which extend D-POKE to a chain-based threshold setting. This guarantee is strictly weaker than SIM-CPA security under static corruption. We also give asymptotic parameter choices targeting $\lambda$-bit security and derive closed-form expressions for the public-key, ciphertext, and partial-decryption sizes in terms of $\lambda$ and $n$.

VOLE-in-the-Head (VOLEitH) is one of the most promising frameworks to design post-quantum digital signatures based on symmetric primitives. However, all existing symmetric primitives do not capture the specialized characteristics of the VOLEitH framework and are not VOLEitH-friendly, leaving room for improving the efficiency of VOLEitH-based signatures. In this paper, we propose a VOLEitH-friendly symmetric primitive called Lynx, which is optimal in terms of the number of required VOLE correlations that directly determines the efficiency of VOLEitH-based signature schemes. In particular, Lynx adopts a multi-branch structure featuring a new truncation function: (a)~nonlinear components are set to minimize the witness length and polynomial degree, as well as the number of finite-field multiplications; (b)~linear layers are strategically interleaved to strengthen security. The security of Lynx is rigorously validated by covering all current attacks in the presence of both classical and quantum adversaries. Built upon Lynx, we design a post-quantum signature scheme, Lynxer, in the VOLEitH framework, which is shorter and faster than all known post-quantum signature schemes from symmetric primitives. According to our experimental results, compared to the state-of-the-art symmetric-based signature schemes in the same setting, i.e., Rainier (CCS'22), AIMer (CCS'23) and FAESTv2 (Crypto'25), our signature scheme Lynxer reduces the ``public-key size + signature size'' by 25%~51%, and improves the signing (resp., verification) time up to 90.5% (resp., 89.9%).

Homomorphic encryption (HE) enables privacy-preserving inference by allowing neural networks to operate directly on encrypted data, but its computational cost remains a major obstacle to deploying large language models in practice. In particular, CKKS-based inference consumes ciphertext modulus through homomorphic multiplications and requires costly bootstrapping when the available modulus is exhausted. In this work, we propose an error-propagation-aware scale design for efficient CKKS-based privacy-preserving LLM inference. We characterize the numerical errors introduced by individual homomorphic operations and analyze how they propagate through subsequent Transformer computations. Based on this analysis, we quantify the contribution of each local error to the final inference error and determine the precision required for individual operations. We then allocate operation-wise scales and modulus levels accordingly, avoiding unnecessarily conservative precision while maintaining the target inference accuracy. As a result, more computation can be performed within a given modulus chain, reducing the frequency of costly bootstrapping operations and improving overall inference efficiency. Compared with THOR, our method reduces modulus consumption by 30.0% and the number of bootstrapping operations by 83.6% for the standard Transformer. For the HE-friendly Transformer, our method reduces modulus consumption by 33.6% and the number of bootstrapping operations by 80% compared with PowerFormer.

One of the most important fundamental elements in guaranteeing data security is data access management. The two primary security components of data access control are typically authorisation and authentication. Data access control is the selective restriction of data access. First, we present an effective data access control mechanism for medical devices that are implanted in this study. Through a signcryption method with proxy reencryption (DAC-PRE), the protocol guarantees anonymous data access control and supports the user’s anonymity behaviour. The security is proven in oracle model. Our experimental analysis shows the proposed protocol has low computational cost.

The XOR of two or more independent random permutations (XoP) is the prototypical pseudorandom function built from permutations achieving the security beyond the birthday bound. The security of the XoP construction is now well established against classical adversaries, however, its security against quantum adversaries that query the construction in superposition has remained widely open. We prove that the XOR of $r\ge 2$ independent random permutations over $\{0,1\}^n$ is indistinguishable from a random function by any $q$-query quantum algorithm with advantage \[ O\left(\min\left\{ \frac{q^3}{2^{rn}},\frac{q^{1.5}}{2^{(r-0.5)n}},\frac{1}{2^{(r-1.5)n}} \right\} \right) \] for all $q\le 2^n/57774$, where the hidden factors depend only on $r$. In particular, the XoP construction remains secure throughout the entire query range, far beyond the $2^{n/3}$ quantum birthday bound due to the quantum collision finding attack. To our knowledge, this is the first construction from permutations that achieves the quantum version of the beyond birthday bound security. We present several heuristic attacks suggesting the tightness of our bounds. For $q\lesssim 2^{n/2}$, the quantum collision finding-based attacks heuristically give the advantage $\Omega(q^3/2^{rn})$ and $\Omega(q^{1.5}/2^{(r-0.5)n})$, and for $q\approx 2^n$, the heuristic collision counting-based attack appears to have the advantage about $2^{-(r-1.5)n}$. We use a Fourier-analytic variant of the polynomial method on the space of functions: the distinguishing advantage of any $q$-query quantum algorithm is controlled by the Fourier components of degree at most $2q$, which is controlled by $2q$ input-output data of the construction. Most components are bounded as a $\ell_2$ norm of the Fourier weights of the XOR of permutations, which gives the bound $2^{-(r-3/2)n}$. For the bound $q^3/2^{rn}$, few low-degree components are too large. We reinterpret these low-degree components as (sums of) distinguishing advantages of the other problems. For example, the degree-2 and degree-4 terms are interpreted as the advantages against random functions with and without \emph{planted collisions}, which in turn are bounded using Zhandry's small-range distributions. Finally, the $q^{1.5}/2^{(r-0.5)n}$ bound can be proven using another bound for the planted collisions. This new bound is proven using the compressed oracle by interpreting the advantage as the other bound about random functions. It also gives a new bound for the small-range indistinguishability for (ironically) large ranges, which is of independent interest.

Threshold signatures for distributed systems require compact public keys and signatures to reduce communication overhead by avoiding packet fragmentation. However, with existing post-quantum threshold signatures, either the public key or the signature does not fit within a single unfragmented network packet. In this work, we present SPRITZ, an isogeny-based post-quantum threshold signature scheme whose public keys and signatures both fit within a single unfragmented network packet at every NIST security level. To the best of our knowledge, SPRITZ is the first post-quantum threshold signature scheme to do so with an arbitrary number of parties. While isogeny-based signatures such as SQIsign and PRISM are known for exceptionally compact public keys and signatures, their algebraic structure makes thresholdization for an arbitrary number of parties highly nontrivial. We address this challenge by introducing a novel graph-based threshold access structure tailored to the isogeny setting. For security against known attacks, we employ a non-interactive zero-knowledge (NIZK) protocol for the verification of isogeny push-forward procedures. At NIST security levels I/III/V, SPRITZ achieves public keys of 129/193/257 bytes and signatures of 223/335/447 bytes, respectively. Among the schemes submitted to the NIST MPTC (Multi-Party Threshold Cryptography) previews phase 2 whose public keys fit within a single unfragmented network packet, SPRITZ achieves the smallest signature size. We also provide a proof-of-concept implementation of SPRITZ.

The Fujisaki-Okamoto (FO) transform makes ML-KEM IND-CCA secure by re-encrypting the decrypted message and returning an implicit-rejection value on any mismatch. Deployed implementations of ML-KEM and its predecessor Kyber have realized this check incorrectly: a skipped conditional move (pqc_kyber/cosmian_kyber, RUSTSEC-2026-0290/-0288) and truncated ciphertext comparisons (wolfSSL, CVE-2026-10097 and CVE-2026-6330). We ask how much of the check must be broken before the key is recoverable, and show that one unverified ciphertext coordinate suffices. For a valid ciphertext the adversary knows the encryption randomness, so sweeping an unverified v-coordinate over the compression grid measures the decryption noise there, a known short-coefficient linear form in the secret; one bounded-error observation per message, solved by least squares, recovers the key. Under a regularity assumption we prove that O(kn log kn) observations identify the key, and we demonstrate full recovery from a single unverified coordinate on all three parameter sets in a few times 10⁵ decapsulation queries against a simulated incomplete comparison built on the kyber-py implementation, with ML-KEM-1024 cheapest owing to its finer compression grid. Sessions fall inversely with the number of unverified coordinates but query cost does not: one unverified coordinate costs what a leaked tail of fifty does. The skipped conditional move yields a complete plaintext-checking oracle and Θ(kn) queries.

We prove that $4r + 4$ rounds of an AES variant with independent and uniform random round keys are $\varepsilon$-close to pairwise independent with $\varepsilon = 2^{14}\, 2^{-39r}$. This result follows from a near-optimal bound for a two-norm version of pairwise independence for the Shark construction, depending on the third singular value of the difference-distribution table of the S-boxes. Our analysis combines insights from cryptanalysis — in particular, truncated differentials — and linear algebra over the reals.

A $(T,N)$-threshold signature scheme distributes a signing key among $N$ participants so that any $T$ participants can jointly generate a valid signature, while fewer than $T$ cannot. In this work, we first introduce a threshold one-time signature scheme with \emph{identifiable abort} based on a variant of Lamport one-time signature and Shamir secret sharing, enabling authorized participants to jointly reconstruct signatures from partial signatures. We then extend the scheme to support multiple messages using multi-layer Merkle trees. One-time signatures introduce specific coordination challenges: participants must agree on both the message and the one-time key index to avoid unsafe key reuse. We address this using a bulletin-board mechanism for consensus. Under this framework, our construction produces signatures with one message from the bulletin board to each signer and one response message from each signer, while the bulletin board may require additional communication to reach agreement. With a simple majority-vote bulletin board, the scheme signs in four rounds. Subject to this coordination constraint, the construction inherits the guarantees of the underlying threshold framework: Universal Composability (UC) unforgeability with identifiable abort, non-UC robustness, and a bulletin-board mechanism that is UC-secure with an honest super-majority and robust when the central aggregator is honest.

Micali's construction of succinct non-interactive arguments (SNARGs) combines a probabilistically checkable proof (PCP), a vector commitment, and the Fiat--Shamir transformation. Its security is established in the random oracle model, but replacing the random oracle with an explicit hash function presents a fundamental challenge: Fiat--Shamir can fail for interactive arguments, and certain choices of the commitment scheme make Micali's construction unsound for every instantiation of the Fiat--Shamir hash. We show how to instantiate Micali's construction in the standard model assuming LWE and function vector commitments with \emph{function statistical binding} for $\Ppoly$, obtaining a non-adaptively sound SNARG for $\NP$. Our construction combines such a commitment with an LWE-based correlation-intractaxble hash and a PCP satisfying a new property, \emph{shadow soundness}. A PCP shadow is a short digest that preserves the information needed to determine the verifier's decision. By statistically binding the commitment to this shadow, we obtain the sparse relation needed to prove Fiat--Shamir soundness. We construct shadow PCPs for $\NP$ whose shadow algorithms lie in $\NC$, and we give a feasibility instantiation of the commitment scheme from strong assumptions. Our results thus identify a concrete cryptographic target for instantiating Micali's SNARG under weaker assumptions, and show that the framework does not admit an attack that succeeds for every choice of its components.

We determine all input differences with constant whole-output XOR derivatives for a four-word ARX topology containing FEILIAN SubColumn. For every word width $w\geq2$ and arbitrary XOR-linear internal maps, the complete linear-structure space contains a universal two-dimensional MSB family and has dimension at most five, with equality attained. We give a necessary-and-sufficient classifier involving at most 32 candidate masks and characterize all additional structures, including an exceptional coset possible only when the first map's image lies in the span of the least and most significant bits. For the specified 64-bit FEILIAN component, the complete space is exactly the universal family. With FEILIAN's actual ShiftRow, no nonzero member remains constant after both of the first two SubColumn layers. We also classify propagation at every boundary for all 20,160 invertible binary four-row mixers composed with ShiftRow. The five profiles stabilize by the third SubColumn layer, and exactly 4,032 mixers (20%) retain a nonzero family indefinitely. Algebraic proofs are supplemented by exhaustive small-word checks and a separate census audit. These results concern component structures and constancy at successive boundaries; they neither classify all endpoint structures of the iterated permutation nor establish an attack on the hash.

In-the-head signatures provide a route to post-quantum authentication based on symmetric primitives. Their algebraic instantiations rely on constraint relations that faithfully encode the underlying one-way function (OWF). We give a classical, public-key-only forgery attack on AIM2-based AIMer v2.0; AIMer was selected in Korea's KpqC competition. For every honestly generated public key of every v2.0 parameter set, the attack forges signatures on arbitrary messages with probability one, without signing queries. We introduce a \emph{null-branch witness attack} exploiting zero factors that leave intermediate values unconstrained. We complete these local assignments into witnesses satisfying the full relation, including public-output binding, using only public data and without solving an OWF inversion problem. Prover completeness ensures that the original message-bound prover can use these witnesses to generate signatures accepted by the unmodified verifier. Proof-system soundness applies to the encoded relation, which the constructed witnesses satisfy. Tests with reference implementations confirm accepted forgeries from satisfying witnesses whose decoded values are not valid OWF preimages. The median AIMer-256f forgery API time is approximately $11.6$ ms in our reference benchmark. We identify a gap in AIMer's security reduction: a satisfying relation witness need not decode to an OWF preimage. A complementary application to vulnerable Lynxer variants extends the analysis to VOLE-in-the-Head. We give quadratic encodings that are sound and complete for the full AIM2 and Lynx computations, including zero inputs. These results highlight relation encoding as a distinct security obligation between OWF hardness and proof-system soundness.

In~\cite{sarr25}, Sarr introduced an embarrassingly parallel impersonation attack against ECMQV and ECHMQV-C whose core step is an adding-based pseudo-random walk over a cyclic group $G$, of order $n$, searching for a \emph{decomposed $i$-point}. In this work, we revisit that construction in the richer multi-party setting where two sets of parties, the initiators $\{\hat{A}_1,\cdots,\hat{A}_{z_1}\}$, and the responders $\{\hat{B}_1,\cdots,\hat{B}_{z_2}\}$, interact under ECHMQV-C. First, we exhibit an embarrassingly parallel attack such that, when $m$~processors are available, the attack runs in expected time $$ \frac{\sqrt{n}}{m\,z_1 z_2}\left(\costa(z_1)+\costd(z_1 z_2)\right), $$ wherein $\costa(z_1)$ is the time for a batch of $z_1$ elliptic-curve additions and $\costd(z_1 z_2)$ is the time for a batch of $z_1 z_2$ digest computations. Second, for any positive integer $z_3$ such that $z_1 z_2 z_3\ll \sqrt{n}$, we propose an improved attack that runs in time $$ \frac{\sqrt{n}}{m\,z_1 z_2 z_3}\left(\costa(z_1 z_3)+\costd(z_1 z_2 z_3)\right), $$ Third, for ECMQV, assuming $z_1z_3 \ll \sqrt{n}$, we propose an attack that runs in time $$ \frac{\sqrt{n}}{m\,z_1 z_3}\costa(z_1 z_3).$$ The attacks require no shared storage among processors, they require respectively $\mathcal{O}(z_1 z_2)$, $\mathcal{O}(z_1 z_2 z_3)$, and $\mathcal{O}(z_1 z_3)$ memory complexity at each processor, and only marginal server--processor communication. As a concrete illustration, for a 128-bit ECHMQV-C instance, with $m=2^{10}$ processors, $z_1=z_2=2^{15}$, and $z_3=2^{10}$, our improved attack yields an effective parallel running time corresponding to 78 bits of security under an idealized massively parallel architecture in which the required batch elliptic-curve additions can be evaluated concurrently. This figure refers to parallel time rather than total computational work, which remains proportional to the number of elliptic-curve additions performed.

We present the first rigorous security analysis of the Resource Public Key Infrastructure (RPKI), an IETF standard for protecting inter-domain routing from basic yet effective attacks: prefix and subprefix hijacks. Existing evaluations of RPKI's security focus on empirical studies: adoption measurements, simulations evaluating the security provided by different adoption levels, and identification of implementation and specification flaws. In contrast, we focus on rigorous, modular security specifications and analysis of RPKI, including its interactions with the Border Gateway Protocol (BGP) and the Internet Protocol (IP). We identify sufficient conditions for RPKI to provably achieve its goals (requirements), under explicit, well-defined assumptions (models). We show that existing RPKI deployments do not always meet these conditions, e.g., because of circular dependencies, and propose standard-compliant improvements that restore them.

We derive joint truncated differential (TD) probabilities from multiple differential-linear (DL) approximations and use them in a framework for preimage filtering. For a fixed input difference, the inverse Walsh transform recovers the probabilities of affine output cosets from DL correlations over a complete mask subspace. In our applications, these correlations are estimated using the round-based DL method. A filter accepts a selected union of affine cosets, whose probability is computed from their joint distribution without assuming independence among the DL events. The framework handles multiple targets, sharing base evaluations and confirming each accepted candidate only once. An independent sampling analysis allows candidate sets from different iterations to overlap and relates success probability to confirmation cost. Applying this framework, we obtain the first preimage attacks on KNOT-Hash below the designers' claimed preimage bounds, for $9$ to $12$ rounds. For all four JH members, we obtain preimage attacks on the reduced-round hash functions under the padding rule of the specification, covering $3$ rounds per compression-function call forJH-224/256/384 and $4$ rounds for JH-512, with speedups ranging from $2^{54}$ to $2^{158}$ over generic preimage search. For reduced-round SKINNY-Hash, we also present the first second-preimage attacks on target messages containing at least two padded blocks, covering $5$ and $6$ rounds of SKINNY-tk2-Hash and $5$, $6$, and $7$ rounds of SKINNY-tk3-Hash. As a further application of the DL-to-TD construction, we give a $6$-round TD distinguisher on Xoodoo/Xoodyak in the related-key setting, whose estimated sample complexity improves on the previous best by about $25$ bits.

We study classical and quantum indistinguishability of sums of independent random permutations and related transformations from permutations to functions. Let $G$ be a finite abelian group of order $N$, and let $\pi^k_+(x)=\pi_1(x)+\cdots+\pi_k(x)$ for $k\geq2$ independent uniform random permutations of $G$. We give a unified Fourier analytic treatment in which the construction is represented by its probability density and a distinguisher by its acceptance function, with the classical and quantum query models imposing different restrictions on the Fourier support of the latter. Classically, we obtain the bound $O_k(q/N^{k-1/2})$ for every $q<N$, and refine it below the birthday threshold to $O_k(q^2/N^k)$. In the quantum model, a simulation argument gives $O_k(N^{-(k-3/2)})$ for $q\leq(N-1)/2$, while Fourier interpolation gives concrete finite bounds up to $q\leq4N/15$ and the query-dependent bounds \[ O\!\left(\min\left\{N^{-1/2},\frac{q^3}{N^2}+\frac1N\right\}\right), \qquad O_k\!\left(\min\left\{\frac{q^3}{N^k},N^{-(k-3/2)}\right\}\right), \] for $k=2$ and $k \geq 3$, respectively, throughout $1\leq q\leq(N-1)/2$. For $q = 1$, the first bound sharpens to $O(N^{-2})$. Over $G=\mathbb F_2^n$, a one-query Fourier attack matches the order of our one-query bound, while an $N/2$-query parity attack with advantage $1/2$ shows that our bounds reach the constant-advantage query threshold. We further study two variants of sum of permutations over binary vector spaces. First, we allow arbitrary surjective linear postprocessing, which includes truncation, and obtain classical and quantum bounds that retain the output-size dependence. Second, we analyse Dinur's variable-output single-permutation construction, $\mathsf{LXoP}$, for every fixed output width, and derive its classical and quantum security bounds; for one- and two-block outputs, we give concrete quantum security bounds.

We study local rewriting after an assumed erasure step in an ideal oblivious-transfer protocol. Bob transforms his retained record while Alice's actual record remains fixed. Exact rewriting between shared-source and independent-source records is possible in both directions precisely when the retained records of the shared source are independent. For balanced deterministic maps retaining $k$ and $\ell$ bits from an $n$-bit source, the optimal error over the maps is $\max\{0,1-2^{n-k-\ell}\}$. For fixed full-row-rank linear maps, it is $1-2^{-d}$, where $d$ is their row-space intersection dimension. A nonlinear example shows that an optimal approximate rewrite may change Bob's marginal distribution.

We give a strict generalization of the LLL algorithm over number fields, based on the reduction theory of $\mathrm{GL}(n)$ over the adele ring of a number field. Our algorithm is free of heuristics, with rigorous bounds on output quality and complexity. As a consequence, we obtain a hierarchy of reductions from module-(H)SVP to ideal-HSVP, an example of which has runtime and approximation factors subexponential in the field degree. More importantly, we uncover a close connection between structured lattice reduction and a Diophantine approximation over number fields.

In this work, we establish the first separation between computation with bounded and unbounded space, for problems with short outputs (i.e., working memory can be exponentially larger than output size), both in the classical and the quantum setting. Towards that, we introduce a problem called nested collision finding, and show that optimal query complexity can not be achieved without exponential memory. Our result is based on a novel ``two-oracle recording'' technique, where one oracle ``records'' the computation's long outputs under the other oracle, effectively reducing the time-space trade-off for short-output problems to that of long-output problems. We believe this technique will be of independent interest for establishing time-space tradeoffs in other short-output settings.

\Falcon{} is a digital signature scheme based on NTRU lattices, known for its compact signatures. Its weak-smoothness variant, \FalconWS{} (ASIACRYPT 2025), reduces signature sizes by allowing narrower Gaussian sampling distributions. Further reductions require efficient sampling at narrower widths and a security analysis that accounts for the resulting distributions. We analyze the distribution of accepted preimages directly, without estimating the smoothing parameter of the NTRU lattice. We also modify the rejection-corrected Klein--GPV sampler to reduce sampling cost while controlling the resulting distributional error. We combine these results to construct \FalconPP{}, a variant of \Falcon{}, and give UF-CMA and SUF-CMA bounds in the classical random-oracle model. For ring degrees $512$ and $1024$, our estimates give signature sizes of $419$ and $921$ bytes, respectively. These are $37.09\%$ and $28.05\%$ smaller than \Falcon{} signatures, and $11.60\%$ and $5.92\%$ smaller than the estimates for \FalconWS{} at their respective parameter sets.

Recent CKKS-based constructions support homomorphic arithmetic modulo powers of two and more general moduli. We explore a complementary tradeoff: using polynomial rings native to CKKS simplifies arithmetic and refreshing but restricts the message spaces. Building on Kim's interpretation of GBFV ciphertexts as CKKS ciphertexts, we use the decomposition $\mathbb{R}[X]/\langle X^N+1\rangle \cong(\mathbb{R}[X]/\langle X^n+1\rangle)^{N/n}$ into $N/n$ polynomial lanes, where $2\leq n\leq N$ is a power of two dividing the RLWE dimension $N$. Following GBFV, each lane represents a message in $\mathbb{Z}[X]/\langle X^n+1,t\rangle$, where $t$ is coprime to $X^n+1$ over $\mathbb{Q}$. These message spaces include $\mathbb{Z}_{\beta^n+1}$ for $t=X-\beta$, products of modular integer rings, specific 128-, 256-, 512-, and 1024-bit prime fields, and extension fields such as $\mathbb{F}_{5^{16}}$, $\mathbb{F}_{17^4}$, and $\mathbb{F}_{37^{32}}$. Unlike the triangle encoding of Gao and Zheng's construction (GZ), our lanes occur at intermediate stages of conventional CoeffToSlot and SlotToCoeff transformations, avoiding additional encoding-specific linear maps. We thus "stay in our lane" by performing arithmetic and refreshing within CKKS-native polynomial rings. Our arithmetic bootstrapping restores ciphertext levels, bounds polynomial representatives, and reduces approximation error. At $N=2^{16}$, it takes less than 4.5 seconds in every tested configuration, with little variation across $t$ and $n$. Comparing our arithmetic modulo $2^n+1$ with GZ's arithmetic modulo $2^n$, same-machine, same-library experiments show a $2.2\times$–$3.8\times$ speedup for $2^3\leq n\leq 2^6$. Our bootstrapping time remains nearly constant as $n$ grows, whereas GZ's dense encoding-specific transformations increase its cost and, at larger $n$, exceed available memory, preventing direct comparisons. At $n=2^{14}$, extrapolating GZ's published timings suggests a $26\times$ speedup.

We present a key-recovery attack on the knapsack McEliece-based public key cryptosystem recently proposed by G\'omez-Torrecillas, Lobillo, and Navarro in DCC 2026. Given the public key alone, the attack recovers the complete private key in time polynomial in the bit-length of the public key, and therefore constitutes a total break. The attack combines two observations based solely on the public key. An integer combination of the public entries whose coefficients sum to zero eliminates the secret mask. If such a combination is also orthogonal to the public key and sufficiently short, then its coordinates are divisible by the corresponding private key integers. The modulus required for correct decryption creates a large norm gap between these short vectors satisfying the hidden private key relations and the remaining vectors in the lattice. LLL reduction exploits this gap to recover the short vectors and hence the corresponding divisibility relations. The private key integers and the remaining secret parameters are then recovered by combining information from multiple overlapping lattices and using greatest common divisors. We implemented the attack in SageMath and recovered the complete private key for all twenty four parameter sets proposed by the authors within 3 seconds, despite claimed security levels ranging from $64$ to $156$ bits. Our analysis further shows that the weakness is structural rather than a consequence of the particular parameter choices.

Deep learning-based side-channel analysis (DLSCA) is dominated by CNNs and from-scratch Transformer architectures, while pretrained Large Language Models (LLMs) as side-channel distinguishers remain largely unexplored. We present the first systematic study of seven off-the-shelf pretrained LLMs (DeepSeek, Falcon, GPT-J, GPT-2, GPT-2m, Qwen2, T5) on three masked AES datasets, i.e., ASCADf, ASCADv, and eShard. With lightweight fine-tuning and no architectural redesign of the backbone, Falcon and GPT-2m reach GE=1 on ASCADf in only 12 to 16 traces (16, 12 and 12 traces for Falcon and 15, 14 and 13 for GPT-2m on desync0, desync50 and desync100) and uniquely sustain this trace count under desynchronization, an order of magnitude below the best prior desynchronized results. The strongest reported alternatives, EstraNet (13 traces) and Order-vs-Chaos (1 trace), are bespoke architectures trained from scratch and report only synchronized results, while other CNN- and Transformer-based baselines degrade substantially under desynchronization. The pretrained LLMs additionally extract exploitable leakage from all 16 first-round AES key bytes, the first such result outside of multi-task CNNs trained from scratch. We further provide the first per-share evaluation and the first interpretability analysis of LLM-based SCA using Effective Perceived Information (EPI), revealing a correlation between the models' leakage extraction capability and their attack performance. Strikingly, randomly initialized backbones perform on par with their pretrained counterparts, indicating that much of the advantage is architectural rather than derived from language pretraining. Our findings establish LLM architectures as unexpectedly powerful, robust, and reusable side-channel distinguishers whose inductive bias yields very low trace complexity and strong robustness to desynchronization.

The BAG-Loong reference implementation samples its secret matrices X and Y from fixed, publicly known subspaces, although the specification calls for secret random supports. This makes the public-key relation S = HX + Y , with public H, amenable to Gaussian elimination. Expanding the relation over F2 and projecting away the support of Y leaves a linear system for X. We prove an exact recovery criterion based on its column rank. All 40 supplied known-answer-test records, covering four parameter sets, satisfy this criterion: two independent solvers recover each X exactly, and the unmodified decapsulation code reproduces the corresponding session keys. For the largest parameter set, the reduced system has 9360 equations in 728 unknowns per column; one elimination solves all 15 columns.

Post-quantum signature schemes such as ML-DSA, FN-DSA (Falcon), and SLH-DSA have significantly larger keys and signatures than their classical counterparts, making compact multiparty signing an increasingly important research problem. We survey more than 30 schemes published between 2021 and 2026, covering threshold and dis tributed signing, proof-based aggregation, and algebraic half-aggregation. Our survey shows that most existing work is designed around blockchain and validator-consensus applications, where large numbers of mostly ho mogeneous signers sign a common message and accountability is typically represented by a compact signer set. We found that a different and practically important setting has received little attention: institutional multiparty document signing, where tens to hundreds of signers may use different post-quantum schemes or parame ter sets during a gradual migration, while requiring non-interactive sign ing and exact per-signer accountability. To study this gap, we develop an eight-dimensional taxonomy based on deployment requirements and sys tematically classify existing approaches. We also formulate three testable hypotheses and propose a common benchmark methodology for evalu ating communication, computation, verification cost, scalability, signer heterogeneity, and accountability. Our analysis finds no published study that quantitatively evaluates the institutional workload across the ag gregation paradigms covered in our survey. We therefore identify the key experimental and architectural requirements for assessing whether ex isting post-quantum aggregation techniques can support heterogeneous, accountable, and non-interactive institutional signing.

The M operation was introduced by Yura as an alternative to the max operation appearing in the box-ball system (BBS) to construct a BBS over finite fields. The Me operation is a version of the M operation for an elliptic curve $E$ over a finite field ${\mathbb F}_p$. As with the M operation, the Me operation satisfies the idempotent law and does not satisfy the associative law. Nevertheless, for $P,Z \in E({\mathbb F}_p)$ and $n \in {\mathbb N}$, the 1st Me-scalar multiplication $P_{n,Z}^{\,I}$ with auxiliary element $Z$ can be defined. Moreover, for $P,Z \in E({\mathbb F}_p)$ and $n \in {\mathbb Q}_+$, the 2nd Me-scalar multiplication $P_{n,Z}^{II}$ with auxiliary element $Z$ can be defined. This paper shows the following properties that may be useful to construct cryptographic protocols: $(P_{n_0,Z}^{\,I})_{n_1,Z}^{\,I}=(P_{n_1,Z}^{\,I})_{n_0,Z}^{\,I}$, $(P_{n_0,Z}^{II})_{n_1,Z}^{II}=(P_{n_1,Z}^{II})_{n_0,Z}^{II}=P_{n_0n_1,Z}^{II}$; the 1st MeDLP and the 2nd MeDLP, which are Me versions of the ECDLP, are difficult to solve on classical computers under certain conditions; the 1st MeCDH and the 2nd MeCDH, which are Me versions of the ECCDH, are NOT difficult to solve; and the sequence $\{ P_{n,Z}^{II}:n=1,2,3,\ldots \}$ is nonperiodic unless it is constant.

SQIsign holds the smallest known combination among post-quantum signatures, and its dimension-2 signature carries an auxiliary curve whose only role is to make the response computable in dimension 2. SQIsignHD's dimension-4 response has no such curve. We take that construction to the round-3 SQIsign primes, which replaced the round-2 primes in September 2026 after the attacks of Wesolowski and others, on our Rust port of the SQIsign reference code, and measure it in one session next to the reference's own assembly build. At NIST level I the dimension-4 signature is 142 bytes against 200 for the specification's format, with an 84-byte public key: 226 bytes for key and signature together, the smallest level-I combination we are aware of, among isogeny schemes and post-quantum signatures alike, at parameters that stand after those attacks. The price is verification: the dimension-4 verifier costs 9.9 times the dimension-2 verifier of the same code (120.3 against 12.2 megacycles). The dimension-4 parameters published with SQIsignHD are for its authors' own primes; we derive them for the round-3 primes, state which choices are SQIsignHD's and which are ours, and report what was built and measured.

There is currently a strong interest in designing standard-compatible threshold cryptographic primitives, a trend bolstered by NIST's Call for Multi-Party Threshold Schemes (NIST IR 8214C). While Multi-Party Computation (MPC) can be applied to the construction of threshold Key Encapsulation Mechanism (KEM) from NIST standard ML-KEM scheme to preserve the compatibility with ML-KEM, such a direct construction yields a high number of threshold decapsulation rounds as many as 384 for MK-KEM-512. In this paper, we optimise the round complexity of MPC-based threshold ML-KEM decapsulation. Our first construction (Scheme A) uses masked predicates, parallel coin expansion and global scheduling methods to improve the round complexity of MPC-based ML-KEM decapsulation, while maintaining ML-KEM encapsulation, public key and ciphertext formats. For ML-KEM-512, 768 and 1024, our construction improves the round complexity to 145, 218, and 290, respectively. We also introduce a variant (Scheme B) that uses an MPC-friendly variant of Kyber KEM and KangarooTwelve hash to further improve the round complexity to $35$ at the security level of ML-KEM-512, without full ML-KEM compatibility. In the semi-honest MPC model, we prove Scheme A security by exact composition with ML-KEM, and Scheme B IND-CCA security in the QROM from Module-LWE and negligible decryption failure.

Multi-agent systems built on large language models (LLMs) are increasingly being deployed in high-stakes settings such as finance, healthcare, and software engineering, where agents coordinate through natural-language messages. These same communication channels, however, can also enable colluding agents to exfiltrate confidential information or coordinate unauthorized actions. Steganography makes such behavior particularly difficult to detect by hiding covert communication within outputs that appear ordinary to an auditor reading the transcript. Existing provably undetectable LLM steganography protocols, however, are not suited to realistic deployments. High-capacity schemes typically assume a symmetric setting where the receiver can reproduce the sender's output distribution. The state-of-the-art practical protocol for asymmetric agents has very low capacity. Additionally, most existing approaches rely on a pre-shared secret key. In this paper, we make the systematic threat of undetectable agent collusion concrete by proposing Codetta, a high-capacity steganographic protocol for independently deployed agents under realistic asymmetric settings. Codetta combines a shared public model for estimating the communication channel, a sampling mechanism that preserves the sender's output distribution, and an adaptive error-correcting code for high-capacity communication. It further removes the need for a pre-shared secret key through a steganographic key-exchange protocol, enabling independently deployed agents to establish a shared key while keeping their communication transcript computationally indistinguishable from ordinary model outputs. Across three agent workloads and three sender models, Codetta achieves up to $94\times$ the capacity of the state-of-the-art asymmetric protocol. Its key exchange establishes a shared key using approximately 80k visible tokens, with an empirically certified failure probability of at most $4.1\times10^{-3}$ across all three workloads. These results show that effectively undetectable collusion is becoming feasible even between independently deployed agents, and we suggest that auditing mechanisms must be amended with complementary techniques beyond simply inspecting agents' communication transcripts.

On a blockchain, users compete for scarce block space in an auction run by the miner to get their transactions confirmed in the block. This auction is called transaction fee mechanism (TFM). Recent work [Rou21, CS23, SCW23] has been focused on incentive compatibility (IC), requiring that honest behavior maximizes the payoff for each type of strategic player: users, the miner, or miner–user coalitions. In this work, we introduce rational-harm proofness (RHP), which rules out deviations that harm honest parties without also reducing the deviator’s own utility relative to the honest baseline. RHP closes a gap left by IC: IC does not forbid utility neutral yet externally harmful deviations. For example, in a second-price auction, the second-highest bidder can increase the winner’s payment without affecting their own payoff. Such deviation is eliminated by RHP. We characterize TFMs satisfying RHP alongside incentive compatibility for users (UIC) and miners (MIC). For finite block size, we develop a complete characterization in two models: - In the plain model---where a single miner unilaterally implements the auction---we prove a tetrilemma (3-out-of-4 impossibility): among the four desired properties {positive miner revenue, UIC, MIC, RHP against miner–user coalitions}, no mechanism achieves all four simultaneously. This trade-off is tight: any three are jointly achievable in the plain model. - In the MPC-assisted model---where a committee of miners jointly implement the auction via multi-party computation (MPC)---we construct a randomized TFM with a positive miner revenue that achieves UIC, MIC, and RHP against all three types of strategic players. We further show that randomness is necessary: any deterministic TFM satisfying UIC and RHP in this model must confirm no transactions when the number of users exceeds the block size. Finally, we show that IC and RHP are incomparable: for each strategic role, there are mechanisms satisfying one but not the other in both models. Our results broaden the design objectives for TFMs: beyond incentive compatibility, mechanisms should also preclude costless harm to honest participants.

We study interactive proofs of proximity (IPP) for model evaluation: a resource-limited verifier interacts with an untrusted prover, typically the model owner, to certify statistical properties of a model under an unknown input distribution. Our formulation is shaped by the constraints of practical evaluation: it separates sampling the input distribution from querying the model and evaluating its output, allowing their costs and access patterns to be treated independently; it distinguishes real audit data (black-box sampling) from generated data (chosen-randomness, or gray-box, access to the sampler); and it allows the prover and the verifier to score outputs with different evaluators, as happens when scores come from human or judge models. We focus on doubly-sublinear $\mathsf{IPP}$s, in which both the verifier and the designated honest prover use sublinear resources, and on (weighted) Hamming weight properties, which capture the expectation of a Boolean evaluation rule under an unknown distribution and, consequently, a broad range of model-evaluation statistics. As a first step, we give a tolerant $\mathsf{dsIPP}$ for ordinary Hamming weight. For completeness and soundness radii $\varepsilon_c <\varepsilon_f$ and gap $g=\varepsilon_f-\varepsilon_c$, its logarithmic-round instantiation uses $\tilde{O}(1/g)$ verifier queries and $O(1/g^2)$ honest-prover queries, improving the cubic dependence of Amir, Goldreich, and Rothblum [ITCS 2025]. We prove matching query lower bounds up to polylogarithmic factors. We then study distribution-weighted Hamming weight under several access models. Under black-box sampling, the verifier uses $\Theta(1/g^2)$ samples but only $\tilde{O}(1/g)$ evaluations, and we show that the quadratic sample complexity is necessary in the interior regime. With chosen-randomness access to a sampler, the problem reduces to ordinary Hamming weight, giving $\tilde{O}(1/g)$ verifier calls and evaluations. When the two parties' evaluators may disagree arbitrarily on a $\rho$-fraction of the distribution and by up to $\gamma$ elsewhere, we give protocols that remain doubly sublinear whenever $g$ exceeds twice the mean mismatch $\kappa = \rho + (1-\rho)\gamma$. Finally, we show how our technical results can improve the efficiency of model evaluation in natural motivating scenarios by shifting the bulk of the evaluation burden to the model owner while letting any number of auditors verify claims cheaply; we apply them to auditing criteria including accuracy, group fairness, calibration, harmlessness, usefulness, and average-case robustness.

The security of isogeny-based signatures is almost exclusively studied in the single-user setting, leaving a gap for realistic multi-user deployments. This gap is especially crucial for CSI-FiSh, where the small challenge space and parameter sensitivity directly impacts security estimates. We address the multi-user security of CSI-FiSh and obtain tight concrete classical multi-user bounds in the random-oracle model (ROM) plus generic group-action model (GGAM). Crucially, our analysis only incurs an additive degradation in the number of users rather than a multiplicative one. As a byproduct, we show that CSI-FiSh attains $125$ bits of provable classical security even with $2^{46}$ users. We extend this analysis to preprocessing attacks, where an adversary with nation-state resources can perform offline precomputations. We capture this by extending the preprocessing security framework of Coretti et al. to ROM+GGAM and obtain concrete multi-user bounds for CSI-FiSh with preprocessing. Finally, we address the multi-user security of CSI-FiSh in the quantum random-oracle model and obtain results in the algebraic group action model which also avoids this multiplicative loss. This gives a unified concrete security treatment of plain CSI-FiSh in the deployment regimes where multi-user and preprocessing effects are unavoidable.

The knowledge soundness of an interactive proof is often proven via various ``special soundness (SS)'' frameworks which separate knowledge extraction into: (1) extracting accepting transcripts conforming to some structure; (2) recovering a witness from structure-conforming transcripts. However, even access-structure SS [TCC'23], one of the most general, does not handle proof systems employing probabilistic tests, a protocol design technique common in more advanced and especially succinct proof systems. The reason is that its extraction strategy decides whether a challenge is ``useful'' from the challenges used in previous transcripts alone, ignoring the prover messages. While predicate SS [CRYPTO'24] captures probabilistic tests, it does not capture access structures and forgoes the combinatorial nature and simplicity of SS. We introduce adaptive special soundness (AdSS), which generally captures extraction strategies that adaptively pick challenges for the prover taking the history of entire transcripts into account. AdSS in particular captures protocols employing probabilistic tests, formally generalises access-structure SS, and provides a simpler interface than predicate SS while retaining the same expressiveness under mild conditions. We provide knowledge extractors for AdSS protocols with optimal knowledge error $\kappa$ and almost optimal tradeoffs between extraction probability and runtime. To demonstrate the utility of AdSS, we provide a new (knowledge) soundness analysis of Kilian's succinct argument, resolving an open problem in [TCC'24]. In passing, we tighten the existing soundness error bound and unify the analyses in the strict and expected polynomial time regimes. We also provide a range of other examples, from simple ones showing how AdSS captures prior notions, to a new analysis of lattice-based Bulletproofs with unstructured challenges, which improves modularity and covers certain rings beyond $\mathbb{Z}$ compared to [TCC'23].

We introduce an optimization to the Tamarin prover that reduces its search space. The optimization applies to protocol models that use equational theories with cancellative operators, for example, when modelling Diffie-Hellman groups or bilinear pairings. We prove the optimization's soundness and evaluate its performance.

The communication complexity of computing a function in the two party setting can be much smaller than requiring one of the parties to send its input. We revisit how this communication complexity must change if the function must be computed securely. Hubáček and Wichs show that any protocol for computing a function securely must communicate at least as many bits as the length of the function's output. However, all positive results in this direction require much more communication than optimal. In particular, the state of the art for general protocols requires a $\textit{multiplicative}$ overhead polynomial in the security parameter, achieving only ''rate 0'' asymptotically. We show that, assuming the existence of input-succinct indistinguishability obfuscation for Turing machines, it is possible to achieve constant rate for this task. This compiler works even when the original protocol communicates single bits in each round, which is the main obstacle in prior works, and necessitates the use of obfuscation. The compiler can be based on standard non-succinct indistinguishability obfuscation for circuits (instead of Turing machines) in the common random string or random oracle models.

The FRI protocol (ICALP '18) is one of the most influential and widely deployed building blocks at the core of modern SNARK systems. While its concrete security is well understood, existing security proofs are intricate and technically complex. In this work, we present a significantly simpler security analysis of FRI, in particular its round-by-round soundness. Our approach is more accessible to a broader audience, lowering the barrier to understanding this fundamental protocol. Furthermore, the simplicity of our analysis may pave the way for future formal verification efforts of modern SNARK constructions.

Weak and shallow pseudo random functions form a new class of symmetric primitives that is seeing a growing relevance, from their use in the initialization phase of some MPC protocols to the internals of some FHE-based protocols. However, their security is hard to ensure: "weak" means that chosen plaintext attacks are irrelevant, and "shallow" means that their construction cannot be round-based: in this exotic setting, how can we define secure PRFs? In this paper, we investigate EALPN, a recent proposal of this type. We identify critical blind spots in the initial asymptotic analysis of the designers: the role of l, one of its parameters, turns out to be crucial. Indeed, we present a key recovery attack with a complexity that is polynomial in all other parameters, and whose complexity grows exponentially but still slowly with l. As a consequence, some parametrizations intended to provide 128 bits of security only offer 37 bits. Our attack is based on novel use of the belief propagation algorithm. Our analysis of its efficiency in our specific setting can be of independent interest.

The importance of deep neural networks (DNNs) is widely recognized, and the parameters obtained through training are regarded as valuable assets. Recently, attacks that extract these parameters using only oracle queries to a DNN have been actively studied at IACR conferences. The hard-label setting is the most challenging setting for model extraction, where an adversary can observe only the final output label, such as “dog” or “cat.” At Eurocrypt 2025, Carlini et al. proposed polynomial-time hard-label extraction of ReLU-based MLPs. However, one step of this attack process, i.e., sign recovery, requires a large number of queries and substantial computation. Implementing this step in a black-box setting remains difficult. Consequently, a fully black-box end-to-end demonstration on trained deep ReLU MLPs has remained a challenge. In this paper, we propose a new sign-recovery algorithm based on a completely different principle from the existing method. Our method requires no dedicated queries for sign recovery. In our experiments, it achieves higher sign-recovery accuracy than the existing method. Consequently, it enables efficient sign recovery even for trained models. With our sign-recovery algorithm, all steps of hard-label model extraction can be implemented in a black-box setting. By combining these implementations, we demonstrate end-to-end model extraction from models trained on MNIST and Fashion-MNIST, with width 16 and 4 or 6 hidden layers, achieving over 98% label agreement.

Privacy-preserving payment systems are well understood, yet concerns about their misuse for financial crime have led to only limited adoption in regulated settings such as central bank digital currencies (CBDCs) and institutional stablecoins. Tracing is one tool for addressing these concerns: acting on external evidence implicating a user, law enforcement follows the suspect's funds through the ledger to uncover laundering routes and accomplices. Existing coin-tracing schemes, however, provide no cryptographic bound on tracing reach: once initiated, a trace may propagate indefinitely through the transaction graph or persist across all future transactions of a targeted user. Keeping surveillance targeted and temporary therefore depends on the restraint of the authority or a committee. We introduce ephemeral coin tracing (ECT), a primitive that bounds tracing reach by construction. Each account carries an encrypted tag that records which traced identifiers its funds carry while hiding its tracing status from users. When funds move, the sender's tag degrades and merges with the recipient's tag. Each tracing contribution expires independently after a policy-defined number of hops and then becomes unrecoverable even to the tracing authority, without affecting other live contributions in the same tag. Public parameters also bound how many identifiers a tag can distinguish simultaneously. We formalize ECT and give constructions based on exponential ElGamal, Damgård-Jurik encryption, and Ring-LWE, the last providing post-quantum security.

Feige, Lapidot, and Shamir [FOCS'90] presented a generic approach for building non-interactive zero-knowledge proofs via the notion of hidden-bits generators (HBGs). At a high level, an HBG allows a prover to statistically commit to a $k$-bit pseudorandom string in the CRS model with a succinct commitment. Later, the prover can open this pseudorandom string at an arbitrary subset $S \subseteq [k]$ of positions by providing a proof $\pi_S$. The hiding property requires that unopened positions remain pseudorandom. In this work, we study the efficiency of HBGs, focusing on direct constructions that make black-box use of cryptography. We obtain the following results: Succinct CRS: Assuming learning with errors (LWE), we construct an HBG with {\em succinct} CRS of size $\mathsf{poly}(\lambda,\log k)$ for generating $k$ hidden bits. This achieves an exponential improvement over a recent sequence of works by Waters [STOC'24], Branco et al.~[EUROCRYPT'25], and Waters, Wee, Wu~[EUROCRYPT'25] that required a CRS of size at least $k \cdot \mathsf{poly}(\lambda)$. Batch opening: Using pairings, we construct an HBG with batch opening, where the proof size for any subset is $ \mathsf{poly}(\lambda)$. Previously, this was only known from the Naccache-Stern public-key cryptosystem [Groth, ASIACRYPT'10]. Succinct CRS and Batch opening: Assuming the hardness of RSA, we construct an HBG where both the CRS and the opening proof for any subset are of size $ \mathsf{poly}(\lambda,\log k)$. No black-box constructions achieving this efficiency were previously known.

Polar-KEM is a lattice-based key encapsulation mechanism submitted to the Next-generation Commercial Cryptographic Algorithms Program. Its security is claimed to rely on a lattice isomorphism problem over polar-code-defined Construction-D lattices. In its core key-generation algorithm, a polar lattice basis is constructed from a polar-code chain, reduced using LLL, and left-multiplied by a secret orthogonal matrix. The resulting matrix is published as the public key. We show that the key-generation procedure does not instantiate a general lattice isomorphism problem. The reduced reference basis is generated through a public chain of computations: public parameters determine frozen sets, the frozen sets determine a polar-code chain, the code chain determines a Construction-D basis, and the basis is then reduced by the public LLL procedure. Under the natural executable interpretation of the specification, an adversary can reproduce the same reduced basis. If the public key is \ensuremath{B_{\mathsf{pk}}=O B_{\mathsf{red}}}, the secret orthogonal matrix is recovered by the single linear-algebra operation $$ O=B_{\mathsf{pk}}B_{\mathsf{red}}^{-1}. $$ The attack is polynomial time and recovers the exact secret isometry, or its numerical representation, without solving a shortest-vector problem or a general lattice isomorphism problem. We also examine the erasure parameter used by the frozen-set selection algorithm. The specification neither assigns it a concrete value nor defines it as a sampled secret with a distribution, encoding, entropy requirement, or storage mechanism. Treating this unspecified value or unspecified LLL tie-breaking as secret entropy would define a different scheme and would not repair the published construction. The present paper focuses on this direct basis-alignment weakness. Additional structural and correctness analyses are left to an extended version.

Oblivious Linear Evaluation (OLE) is the arithmetic analogue of the well-know oblivious transfer primitive. It allows a sender, holding an affine function $f(x)=a+bx$ over a finite field or ring, to let a receiver learn $f(w)$ for a $w$ of the receiver's choice. In terms of security, the sender remains oblivious of the receiver's input $w$, whereas the receiver learns nothing beyond $f(w)$ about $f$. In recent years, OLE has emerged as an essential building block to construct efficient, reusable and maliciously-secure two-party computation. In this work, we present efficient two-round protocols for OLE over large fields based on the Learning with Errors (LWE) assumption, providing a full arithmetic generalization of the oblivious transfer protocol of Peikert, Vaikuntanathan and Waters (CRYPTO 2008). At the technical core of our work is a novel extraction technique which allows to determine if a non-trivial multiple of some vector is close to a $q$-ary lattice.

We present $\mathsf{Accordion}$, a new proof system that works in two steps: - $\textit{Accumulate}$: The first building block is a multi-folding scheme that efficiently accumulates $k$ different instances of a degree-$d$ polynomial relation into a single accumulated instance, without using recursion. Our scheme builds on the Protostar [Bünz & Chen, ASIACRYPT '23] and Protogalaxy [Eagen & Gabizon, ePrint 2023/1106] line of work, improving further the verifier efficiency. It supports the same expressive class of relations, arbitrary-degree polynomial constraints, enabling efficient folding for CCS, Plonkish constraints, and even custom gates. - $\textit{Decide}$: The second block is a SNARK decider for the folding scheme, which efficiently proves the validity of the resulting accumulated instance using off-the-shelf optimized building blocks. We give a concrete instantiation consisting of a Plonk-based proof plus an additional KZG polynomial commitment opening. This design is especially attractive in batch-aggregation settings where a prover collects many independent witnesses, folds them into a single accumulator, and then runs one succinct decider to certify the entire batch. Our scheme avoids costly recursion overheads. We implement $\mathsf{Accordion}$ and evaluate it against a highly optimized Plonk proving pipeline ($\texttt{midnight-zk}$). For $k=64$ instances, $\mathsf{Accordion}$ is up to $2.5\times$ faster than computing $k$ Plonk proofs for SHA-256 preimages, with a $3\times$ faster verifier and $4\times$ smaller proofs. Its prover is also an order of magnitude faster than using IVC to aggregate the $k$ proofs.

Traceable secret sharing complements traditional schemes by enabling the identification of parties who sell their shares. Recently, two independent works extended traceable secret sharing to general access structures. Goyal, Jain, and Partap [EC'26] introduced a model in which a reconstruction box is augmented with a label $I \subseteq [n]$ and is only required to distinguish between two secrets when queried with the shares of parties in $I$. Based on how this label relates to the corrupted set $J$ that built the box, they defined two notions of traceability. If $I \cap J = \emptyset$, the model is called $\emptyset$-strong traceability, for which they presented a construction based on indistinguishability obfuscation (iO). Otherwise, their model is calledstrong traceability, for which they proved an impossibility result. Farràs and Guiot [EC'26] proposed a different model, which we call hiding traceability, where the reconstruction box has no label and the access structure is hidden from the parties. In this work, we improve traceable secret sharing for general access structures in three directions. First, we present a fully information-theoretic scheme for the $\emptyset$-strong traceability model, eliminating the need for strong cryptographic assumptions. This resolves an open question posed by Goyal, Jain, and Partap, who asked what are the minimal assumptions needed in the $\emptyset$-strong traceability model. Second, motivated by the impossibility of strong traceability, we introduce a relaxed notion calledhidden mildly strong traceability. This model is relevant in practice and bridges the strong and hidden models. For this setting, we present an information-theoretic scheme for general access structures. Finally, we consider the more general model of stateful traceability, where reconstruction boxes may keep state across queries, and we prove an impossibility result for this setting.

We solve the long-standing open question of designing a "truly" linearly homomorphic scheme -- meaning it supports homomorphic additions on arbitrary plaintexts, with no restriction, in contrast to "somewhat" ones -- that achieves CCA1 security under a standard assumption. We do so by introducing a new variant of Paillier-ElGamal, which we call Damgard-Paillier-ElGamal (DPEG) as its design follows a Knowledge-of-Exponent pattern. On top of being linearly homomorphic without any restriction, our scheme enjoys the following properties: - It achieves CCA1 security solely under the DCR assumption. To the best of our knowledge, it is the first "truly" linearly homomorphic proven CCA1 secure solely under this assumption (or any other standard one). - It can be extended to support one level of multiplication while still preserving its CCA1 security under the same assumption. This extension is then the first concrete scheme supporting both homomorphic additions and multiplications (even limited to one-level) that is proven CCA1 secure under DCR. - It also achieves Manulis&Nguyen's stronger notion of vCCA security under an additional non-falsifiable linear-only homomorphism assumption that is commonly used in proof-of-knowledge constructs. DPEG is then the first scheme that is proven vCCA secure while being CCA1 secure under a standard assumption. This also carries over to the multiplicative extension. Interestingly, DPEG achieves the above at only 1.5 times the cost of the baseline CPA-secure Paillier-ElGamal scheme. To establish the CCA1 security of DPEG, we introduce a new abstract framework that allows to prove CCA1 security of a large class of of group-based PKE that also covers other somewhat linearly homomorphic schemes previously known to achieve CCA1 security under falsifiable assumptions such as Damgard-ElGamal, Cramer-Shoup-Lite and the recent variant of Paillier-ElGamal with plaintext zero padding of Libert. This framework may be of independent interest to more easily prove the CCA1 security of other schemes. Lastly, on the negative side, we take a first step in connecting vCCA security to an impossibility result of Gentry&Wichs and show that, under mild assumptions, the vCCA security of DPEG cannot be established from any falsifiable assumption by means of a black-box reduction.

Succinct arguments are central cryptographic objects, underlying various applications such as blockchains and image authentication. Almost all succinct arguments used in practice follow the commit-and-open paradigm introduced by Kilian (STOC 1992): commit to a probabilistic proof, then open the few locations the verifier queries. Decades of work have generalized and optimized this paradigm, yet its exact provable security in the standard model remains unclear. Existing analyses proceed by rewinding, and they leave gaps: strict-time analyses lose an inverse-polynomial factor, while expected-time analyses are sharper but apply only to special cases of this paradigm. We resolve both gaps. On the negative side, we show that the strict-time loss is inherent: no strict polynomial-time reduction relying on a black-box extractor can achieve negligible knowledge error (unless the underlying language is easy). On the positive side, we give a new expected-time analysis, achieving negligible soundness and knowledge errors via an expected polynomial-time reduction against expected polynomial-time adversaries, at the full generality of the paradigm, capturing multi-round and functional variants such as polynomial and linear IOPs compiled with the corresponding commitments. This is the first standard-model analysis to reach this regime for succinct arguments deployed in practice.

Blind signatures are a central primitive for privacy-preserving applications such as e-cash, anonymous credentials, and e-voting. Classical constructions such as blind Schnorr adapt an ordinary signature scheme while producing signatures that follow the same format and distribution as those generated by the ordinary signing algorithm. This property is particularly relevant in settings where blind and non-blind signatures coexist within the same infrastructure. Achieving an analogous result for lattice-based Fiat--Shamir signatures, with security based on the underlying ordinary signature scheme, has remained open. We present $\mathsf{BRaccoon}$, the first concurrently secure lattice-based realization of the ``blind signatures from a signature assumption'' paradigm of Fuchsbauer and Wolf (EUROCRYPT~2024). Our construction builds on the rejection-free lattice signature scheme $\mathsf{Raccoon}$, yielding signatures that retain the algebraic format and verification relation of $\mathsf{Raccoon}$. At a high level, we introduce blinding at the commitment stage and enforce correct challenge and response generation via linearly homomorphic encryption combined with $\mathsf{NIZK}$ proofs. Since these proofs already bind the hidden message to the resulting signature, their relation can naturally incorporate predicates on that message, providing a direct route toward predicate blind signatures. A central technical challenge stems from discrete Gaussian sampling, where blinding induces a non-trivial distributional shift that precludes direct security reductions. To overcome this, we introduce a modified scheme $\mathsf{Raccoon}^\star$ that explicitly captures this shift. We analyze one-more unforgeability through non-rounded versions of $\mathsf{Raccoon}^\star$ and $\mathsf{Raccoon}$. The deployed blind-signing protocol retains rounding. For a concrete instantiation, we encode the lattice relations and the non-linear challenge computation in a common mixed Boolean and arithmetic relation. Our instantiation retains SHA3-256 and SHAKE256 and proves both protocol statements using the ZK-LaBRADOR toolkit. For up to $2^{32}$ signing queries, its total communication is estimated at approximately $862$ KB.

Mobile access within public finance and enterprise environments often requires lightweight anonymous authentication, allowing users to prove authorization without disclosing their identities. Group Time-based One-Time Passwords (GTOTP) has recently been proposed as a lightweight primitive meeting this need with post-quantum security. To address dynamic group membership, Cao et al. introduced DGTOne, the first dynamic GTOTP construction. It employs chameleon hashes to precompute a fixed set of Merkle-tree leaves (mount points), into which conventional TOTP verification points (VPs) contributed by group members are adaptively inserted. However, DGTOne partitions mount points by time epochs, so they can expire and become unusable, causing capacity waste due to unpredictable join times. Moreover, its outsourced proof generation requires verifiers to be online each epoch to fetch refreshed credentials from Registration Authority (RA), defeating offline verification needed in mobile access. We address these limitations with two new schemes. First, we propose NWDGT, a no-wastage DGTOTP design that constructs Merkle trees of members' verification points (VP-trees) on demand, eliminating expired mount points at the cost of added handling latency. To mitigate this latency, we introduce LWDGT, which instantiates multiple small one-time signature (OTS) trees whose leaves (OTS public keys) serve as mount points. New members' VPs are signed immediately using unused leaves, achieving low wastage. We formally prove that the wastage rate of LWDGT is, with overwhelming probability, lower than that of DGTOne. By modeling the registration process and optimizing OTS-tree size, for deployments with up to 500 members (209 initially, 20 added monthly), LWDGT reduces mount point wastage rate by 10.2% over one year compared to DGTOne.

Multivariate quadratic (MQ) signature schemes are an important class of post-quantum digital signatures. These schemes rely on the hardness of solving underdetermined MQ systems, where the number of variables \(n\) exceeds the number of equations \(m\). Therefore, analyzing the efficiency of algorithms for underdetermined MQ systems is essential for evaluating the security of MQ-based signature schemes. Several algorithms have been proposed to solve underdetermined MQ systems efficiently. Among them, Hashimoto's method is one of the best known partition-based direct attacks; it partitions the variables into three groups and reduces the original problem to two smaller MQ subproblems. In this paper, we propose a generalized partition-based algorithm for solving underdetermined MQ systems. The proposed algorithm extends Hashimoto's method by partitioning the variables into more groups and reducing the original problem to smaller MQ subproblems. We derive its applicability conditions and time complexity, and develop an efficient parameter search strategy to find the best partition parameters without a naive exhaustive search. Finally, we evaluate the proposed algorithm on parameter sets of MAYO, QR-UOV, and SNOVA, and compare the resulting estimates with those of existing algorithms for underdetermined MQ systems. In the classical case, the proposed method improves on Hashimoto's method for some parameter sets; in particular, it reduces the estimate for MAYO1 from \(2^{156}\) to \(2^{145}\). In the quantum case, the proposed method gives estimates smaller than both Just Guess and Hashimoto's method for many parameter sets.

We record the following bound: almost all Boolean functions $f : \{0,1\}^n \times \{0,1\}^n \to \{0,1\}$ require $2n - 2\log n - O(1)$ bits of communication for perfect two-party conditional disclosure of secrets with a one-bit secret. This only gives a factor 2 improvement over the previous best bound due to Applebaum, Holenstein, Mishra and Shayevitz [EUROCRYPT 2018], but at least (nearly) matches the input length. The proof is a straightforward compression argument that uses the birthday bound to give a succinct representation of transcript collisions (the latter being a technique from Feige, Kilian and Naor [STOC 1994], refined in Applebaum et al.). Viewing transcript-collision testing as an elementary case of distribution testing extends the argument to imperfect correctness and privacy. We do not currently know how to extend the argument to an explicit hard predicate.

We discover two laws governing public-key key exchange and public-key encryption. The first states that a non-interactive key-exchange scheme is secure only if it is kleptographically insecure. The second states that a public-key encryption scheme is secure only if it is kleptographically insecure. They give two impossibility results: no kleptographically secure non-interactive key exchange with pseudorandom shared keys exists, and no kleptographically secure public-key encryption with pseudorandom ciphertexts exists. More precisely, no non-interactive key-exchange scheme can simultaneously establish pseudorandom shared keys and support black-box execution in which the user observes only the public keys and the final shared keys output by the black box, and no public-key encryption scheme can simultaneously have pseudorandom ciphertexts and support black-box execution in which the user observes only the public keys and plaintexts input to the black box and the ciphertexts output by it. Our argument turns the very shield of a primitive into a spear against itself, showing that the security guarantee of the primitive is precisely what enables a kleptographic attack. We instantiate the laws with two post-quantum schemes: CSIDH and Regev encryption.

Homomorphic signatures allow to validate computation on signed data. Alice, holding a dataset, $\{m_1 , \ldots , m_t \}$ uses her secret key $\sf sk$ to sign these data and stores the authenticated dataset on a remote server. The server can later (publicly) compute $m = f(m_1,...,m_t)$ together with a signature $\sigma$ certifying that $m$ is indeed the correct output of the computation $f$. Over the last fifteen years, the problem of realizing homomorphic signatures has been the focus of numerous research works, with constructions now ranging from very efficient ones supporting linear functions to very expressive ones supporting (up to) arbitrary circuits. In this work we tackle the question of assessing the practicality of schemes belonging to this latter class. Specifically, we implement the GVW lattice based scheme for circuits from STOC 2015 and two, recently proposed, pairings based constructions building from functional commitments. Our experiments show that (both) pairings based schemes outperform GVW on all fronts.

Government portals often issue PDF certificates whose provenance can be verified only through a live HTTPS verification service. Proving a limited fact from such a document therefore commonly requires disclosing the complete document or giving the verifier access to the portal. We present GovBind, a protocol that combines zkTLS provenance with a zero-knowledge content proof, without requiring the issuer to modify its service or embed an independently verifiable signature. A baseline construction binds both stages through a commitment to the complete response body. To make client-side proving feasible for compressed PDFs, an optimized construction instead commits separately to private ranges, discloses the remaining bytes, requires their exact partition, and opens the claim-bearing compressed stream in a document profile-specific proof that constrains DEFLATE decompression. We formalize GovBind with game-based definitions of correctness, soundness, and privacy, where soundness jointly captures authenticity, content validity, and binding, and we prove both constructions secure relative to the explicit leakage and trust assumptions of Proxy-mode TLSNotary. Our prototype supports proofs of no overdue tax debt, bounded traffic penalties, and residence city over documents returned by the Turkish government verification service, e-Devlet. Across 72 generated proofs in 24 sessions, end-to-end generation took 54-119 seconds, verification took 44-127 milliseconds, and proofs were 11-12 KiB.

Keyword Private Information Retrieval (KPIR) enables clients to retrieve database entries by keyword without revealing their query, with many efficient schemes relying on Fully Homomorphic Encryption (FHE). However, existing FHE-based KPIR schemes fix parameters to a bounded computation depth, which becomes a bottleneck in privacy-sensitive settings such as distributed ledger systems and private web search, where databases grow dynamically and clients are lightweight: exceeding this bound incurs significant overhead, forces larger parameters, and leaves any post-retrieval computation to the client or to communication-heavy interactive protocols. We introduce Keyword PIR with Computation (KPIR-C), a new paradigm that enables arbitrary, non-interactive server-side computation on query responses while preserving query privacy. Unlike prior designs, KPIR-C fixes parameters independently of database size or computation depth by leveraging bootstrapping via a co-design of Torus Fully Homomorphic Encryption (TFHE) and KPIR that keeps bootstrapping overhead practical. We further introduce Keyword PIR with Default (KPIR-D) to handle mismatched queries non-interactively. We instantiate KPIR-C with two constructions: one based on equality circuits and constant-weight codes, and one based on Learning With Errors (LWE)-based KPIR, offering complementary communication-runtime trade-offs. We demonstrate experimentally that both achieve competitive performance compared to state-of-the-art KPIR schemes that do not support arbitrary computation.

A secret sharing scheme is a cryptographic primitive that allows a dealer to share a secret among a set of parties, so that only authorized subsets of them can recover it. The access structure of the scheme is the family of authorized subsets. In a weighted threshold access structure, each party is assigned a weight according to its importance, and the authorized subsets are those in which the sum of their weights is at least the threshold value. For these access structures, the share size of the best known secret sharing schemes is either linear on the weights or quasipolynomial on the number of parties, which leads to long shares, in general. In certain settings, a way to circumvent this efficiency problem is to approximate the access structure by another one that admits more efficient schemes. This work is dedicated to the open problem posed by this strategy: Finding secret sharing schemes with a good tradeoff between the efficiency and the accuracy of the approximation. We present a method to approximate weighted threshold access structures by others that admit schemes with small shares. This method is based on the techniques for the approximation of the Chow parameters developed by De et al. [Journal of the ACM, 2014]. Our method provides secret sharing schemes with share size $n^{1+o(1)}$, where $n$ is the number of parties, and whose access structure is close to the original one. Namely, in this approximation the condition of being authorized or not is preserved for almost all subsets of parties. In addition, we apply the recent results on computational secret sharing schemes by Applebaum et al. [STOC, 2023] to construct computational secret sharing schemes whose share size is polylogarithmic in the number of parties.

ZKPoSP proves that a public key or address was honestly derived from a hidden wallet seed, without revealing the seed or the private derivation state. This paper studies relationships among several derived values: whether public keys or addresses, possibly on different curves and different blockchains, share a hidden origin, which is the seed or an anchor of the wallet, and who else can recognize this relation. We give a model for such provenance proofs, with derivation proofs, which carry a link value, and provenance proofs, which show that several derivation statements share an origin. We define correctness, derivation soundness, provenance soundness, non-frameability and unlinkability. We give four constructions, which differ in who can link: only the user, with a joint proof or with commitments linked later; anyone within a linking context, with a deterministic tag, which can also act as a nullifier; or a designated authority, with an encryption of that tag. We prove, in sketch form, that the constructions satisfy the five properties under the security of the ZKPoSP derivation relations, the random oracle model, and the zero knowledge and simulation extractability of the proof system. We describe an application to cross-chain transfers from Bitcoin to Solana, in which the payout address must come from the same wallet as the source address, so that an attacker cannot substitute the destination. We report Plonky3 benchmarks of the derivation proofs on which the constructions are built.

Overbroad computer crime, intellectual property, and other laws are well known to create legal risks that can discourage essential research. Notable examples include the US Computer Fraud and Abuse Act and the UK Computer Misuse Act. Because such laws fail to distinguish malicious hacking from good-faith testing and research, researchers face serious legal risks for public-interest research activity like identifying software or hardware vulnerabilities or scraping data. Despite the research community's broad awareness of these risks, our understanding of their practical impacts is limited, as most of the community's knowledge comes from anecdotal evidence rather than systematic study. We conduct the first qualitative study focused on researchers' lived experiences, to empirically document the *impacts of legal risks and threats* on research and researchers*, and *how researchers navigate legal risk situations*. Our study engages two participant groups: researchers with legal-risk experiences in the UK or the US ($N_R=36$), who discuss 130 projects and incidents spanning over three decades, and professionals that offer support to researchers navigating legal risks ($N_S=8$), who have collectively supported thousands of researchers. We thus provide an unprecedented big-picture view of researchers' experiences with legal risks. We synthesise actionable strategies for researchers, and our findings provide evidence to support policy reform.

Inspired by the recent polynomial-time adaptive attacks on threshold Schnorr signatures, we contextualize the Low-Dimensional Vector Representation (LDVR) assumption and its impact on relevant threshold Schnorr signature schemes. Our analysis focuses in large part on FROST, a widely deployed threshold Schnorr signature scheme. However, our analysis is applicable to any relevant threshold Schnorr signature scheme, such as Lindell's three-round threshold Schnorr protocol. We show that for cases where FROST is used with 131 parties and fewer, and for parameter choices of 128-bit generic (discrete log) security, FROST is secure for any signing threshold. This bound increases to 260 parties for parameter choices of 256-bit security; our analysis similarly can be extended to other parameter choices. This bound assumes the best possible LDVR adversary, even more powerful than the results by Rodríguez García and Tessaro. In other words, for real-world uses of FROST with parameter choices of 128-bit security, and with a small (131 and fewer) number of parties, the security of FROST is determined entirely by the hardness of the Algebraic One-More Discrete Logarithm (AOMDL) assumption, as LDVR is unconditionally hard for this parameter regime. It is an open research question whether the concrete attacks given by Rodríguez García and Tessaro can be improved to approach the unconditional LDVR security bound considered in our analysis. We then show for each additional party for 132 total number of signers and greater, again for parameter choices of 128-bit generic security, the resulting security of FROST is at worst reduced by approximately one bit (or less) of security for the worst-case choice of corruption threshold. This analysis can be used by practitioners to determine the worst possible security of even large-scale FROST deployments. Finally, we give two variants to FROST that build upon prior masking techniques to allow for full adaptive security. The first variant allows for masking keys to be derived from Diffie-Hellman identity keys, allowing for constant memory overhead, at the tradeoff of increased computation. The second variant allows for a 50% reduction in memory overhead for storage of pairwise masking keys, by employing symmetric key predistribution techniques.

The Signal Protocol is a two-party secure messaging protocol used in applications such as Signal, WhatsApp, Google Messages and Facebook Messenger and is used by billions daily. It consists of two core components, one of which is the Double Ratchet protocol that has been the subject of a line of work that aims to understand and formalise exactly what security it provides. Existing models capture strong guarantees including resilience to state exposure in both forward security (protecting past secrets) and post-compromise security (restoring security), adaptive state corruptions, message injections and out-of-order message delivery. Due to this complexity, prior work has failed to provide security guarantees that do not degrade in the number of interactions, even in the single-session setting. Given the ubiquity of the Double Ratchet in practice, we explore tight security bounds for the Double Ratchet in the multi-session setting. To this end, we revisit the modelling of Alwen, Coretti and Dodis (EUROCRYPT 2019) who decompose the protocol into modular, abstract components, notably continuous key agreement (CKA) and forward-secure AEAD (FS-AEAD). To enable a tight security proof, we propose a CKA security model that provides one-way security under key checking attacks. We show that multi-session security of the Double Ratchet can be tightly reduced to the multi-session security of CKA and FS-AEAD, capturing the same strong security guarantees as Alwen et al. Our result improves upon the bounds of Alwen et al. in the random oracle model. Even so, we are unable to provide a completely tight proof for the Double Ratchet based on standard Diffie-Hellman assumptions, and we conjecture it is not possible. We thus go a step further and analyse CKA based on key encapsulation mechanisms (KEMs). In contrast to previous works, our new analysis allows for tight constructions based on the DDH and post-quantum assumptions.

Bitcoin secures over a trillion dollars in assets, yet its scripting language limits expressive decentralized-finance applications. BitVM enables arbitrary off-chain computation to be enforced through Bitcoin fraud proofs, but it does not provide privacy for inputs such as bids, quotes, and reserve prices. We present BitPriv, to our knowledge the first protocol that conditions payments on the outcome of an arbitrary secure two-party computation over private inputs on unmodified Bitcoin. Its core primitive, the Garbled Hashed Timelock Contract (GHTLC), binds Bitcoin payments to garbled-circuit output labels. Parties evaluate the circuit off-chain, while cut-and-choose detects malformed garbling and BitVM punishes detected violations. Under application-specific bounds, collateral can make deviations unprofitable for rational adversaries. We instantiate BitPriv in BitMarket, a Bitcoin-native sealed-bid auction, and BitBridge, an intent-based cross-chain bridge. Inputs remain private until the protocol execution fixes the outcome. Optimistic settlement costs less than \$3 in both applications. Depending on the backend, BitMarket disputes cost \$47–\$312 and BitBridge disputes cost \$47–\$657. BitPriv provides a blueprint for enforceable, privacy-preserving DeFi primitives on Bitcoin without trusted hardware, sidechains, or consensus changes.

We study the regular indifferentiability of the sum of two n-bit permutations. Previous work proved 2n/3-bit security and gave a 5n/6-bit attack against the uniform simulator. We prove 3n/4-bit se curity for the simulator and give a matching attack. Our proof bounds the KL divergence between response distributions by tracking the bias in unrevealed construction values through their conditional distribution, which was not analysed in detail in previous work. To exceed this thresh old, we introduce the Gyroscope simulator, which adjusts inverse-query acceptance probabilities to compensate for the bias left by earlier re sponses. The Gyroscope simulator achieves 4n/5-bit security.

Fully anonymous perfect threshold secret sharing combines exactly uniform unauthorized shares with reconstruction from unlabeled share values. Con, Li, and Mazor proved that short-share schemes exist for every threshold, leaving efficient general constructions and constant rate open. We address both questions. First, we give an explicit one-bit scheme with $(2t-3)\lceil\log_2n\rceil$-bit shares, expected-polynomial-time sharing, and deterministic polynomial-time reconstruction. The key is an exact sampler for localized affine relations, including collision patterns. Second, an affine-hull compiler turns any one-bit primitive with alphabet $\{0,1\}^b$ into a long-secret scheme with additive share overhead $b(t-1)\lceil\log_2(n+1)\rceil$, up to field-alignment padding. Authorized payloads determine an affine space; a short anonymously shared certificate identifies the secret within it. Instantiation gives $L+O(t^2\log^2n)$-bit shares and rate $1/2$ at $L=\Theta(t^2\log^2n)$. For fixed $2\le t<n$, the rate approaches one, which the classical bound of Kishimoto et al. shows is unattainable at any finite nontrivial secret alphabet. Finally, we prove the universal bound $|\Omega|\ge(n-t+1)(n-t+2)$ for $3\le t\le n-2$. Together with Con--Li--Mazor's specialized threshold-three construction, this establishes the exact fixed-length optimum of $2m$ share bits for $(t,n)=(3,2^m)$, $m\ge3$. All guarantees are information-theoretic and exact. The technical work is done by GPT 6 Astra.

Symbolic protocol verifiers must make a difficult tradeoff: their models and counterexamples should be accessible to protocol designers, but their results must still have a precise meaning. Verifpal addresses the first goal with a compact modeling language and source-level attack explanations. Its original analysis engine, introduced in 2019, had only a preliminary account of its guarantees. This paper presents and evaluates the replacement engine. The engine searches backward from a violated security query to candidate attacker actions. It then runs every session and peer configuration of the protocol together as one execution under those actions, in which each injected value must be derivable from what that same execution has already disclosed, and evaluates the query on that execution. We specify this process from the term algebra and primitive registry through knowledge deduction, bounded sessions, peer configurations, execution, and counterexample presentation. We also give a single-history reference semantics, prove that every execution the engine judges is a history of that semantics, prove termination under the engine's search bounds, and state exactly what each result category establishes. Our evaluation combines targeted regression models, mutation analysis, corpus measurements, and comparisons with ProVerif, Tamarin, and Scyther. It shows that the engine can express and find attacks that require several sessions, different peer assignments, or staged compromise, while exposing the implementation choices that limit its search. The result is an auditable account of Verifpal as a bounded counterexample finder: every reported attack is an explicit protocol execution, but a passing query is not an unbounded proof, and no report is a machine-checked certificate.

The Beneš network can be utilised to apply a single permutation to different inputs repeatedly. We present novel generalisations of Bernstein's formulae for the control bits of a Beneš network and from them derive an iterative control bit setting algorithm. We provide verified proofs of our formulae and prototype a a provably correct implementation in the Lean language and theorem prover. We develop and evaluate portable and vectorised implementations of our algorithm in the C programming language. Our implementation utilising Intel's Advanced Vector eXtensions 2 feature reduces execution latency by 25% compared to the equivalent implementation in the libmceliece software library.

Side-channel attacks (SCAs) are increasingly recognized as a significant threat to hardware roots of trust. As a result, cryptographic module designers must ensure that their modules are resilient to such attacks before deployment. However, efficient evaluation of side-channel vulnerabilities in cryptographic implementations remains challenging. This article introduces an open-source framework integrating field-programmable gate array (FPGA) designs, power measurement tools, and high-performance side-channel analysis libraries to streamline the evaluation process. The framework provides design templates for two widely used FPGA boards in the side-channel analysis community, enabling Shell-Role architecture, a modern FPGA design pattern. This shell abstraction allows designers to focus on developing cryptographic modules while utilizing standardized software tools for hardware control and power trace acquisition. Additionally, the framework includes acceleration plugins for ChipWhisperer, the leading open-source side-channel analysis platform, to enhance the performance of correlation power analysis (CPA) attacks. These plugins exploit modern many-core processors and graphics processing units (GPUs) to speed up analysis significantly. To showcase the capabilities of the proposed framework, we conducted multiple case studies and highlighted significant findings that advance side-channel research. Furthermore, we compare our CPA plugins with existing tools and show that our plugins achieve up to 8.60x speedup over the state-of-the-art CPA tools.

The standardization of post-quantum cryptography, notably ML-KEM, introduces a severe network bottleneck: large public keys and ciphertexts often exceed the Maximum Transmission Unit (MTU) limits of UDP-based protocols. This size explosion inevitably leads to unreliable IP-layer fragmentation or forces complex protocol workarounds. To overcome this, we propose a novel design philosophy for post-quantum Authenticated Key Exchange (AKE). We challenge the rigid cryptographic paradigm that mandates negligible decryption failure rates (DFR). By safely trading minor, manageable decryption failures for aggressive size compression, we drastically reduce the bandwidth footprint of lattice KEMs in ephemeral exchanges. We demonstrate this approach via a compact AKE for the Internet Key Exchange protocol (IKEv2). Integrating standard ML-KEM into IKEv2 currently necessitates the high-latency IKE_INTERMEDIATE exchange (RFC 9242) to distribute large payloads. By employing our compressed KEM design (800-byte public key, 928-byte ciphertext), the entire key exchange fits within the initial IKE_SA_INIT packet, completely eliminating the need for RFC 9242. To ensure that protocol aborts caused by decryption failures do not introduce security vulnerabilities, we formalize IND-CPAF (Indistinguishability under Chosen Plaintext Attack with Failures) to rigorously bound failure-dependent leakage. More importantly, we prove our IKEv2 instantiation still secure in the classical Canetti-Krawczyk model. Finally, our implementation in the strongSwan IPsec library confirms a fragmentation-free handshake: over 10,000 real-world connections, it achieves a 48.8 ms average setup time---matching classical ECDH---and keeps initial packets strictly under the 1280-byte IPv6 MTU, with merely a 0.002% retry rate.

Communication is a central efficiency bottleneck in garbled circuits. Rosulek and Roy (CRYPTO 2021) introduced \emph{slicing} and \emph{dicing}, obtaining a garbling scheme in which XOR gates require no communication and each two-input AND gate costs \(1.5\lambda + 5\) bits, where \(\lambda\) is the security parameter. In this work, we investigate the power of these techniques for garbling gates of larger fan-in. We develop a linear-algebraic framework that yields concrete constructions and asymptotic bounds. For three- and four-input gates, we obtain constructions with communication costs $7\lambda/3 + 35$ and $15\lambda/4 + O(1)$ bits, respectively. For arbitrary fan-in \(n\), we give a construction for any single-output gate with communication cost bounded by \(22 \cdot 2^n\lambda/n + 2^n\) bits. Our constructions are compatible with free-XOR, and all hash queries within each gate are nonadaptive. We prove security of the framework in the random-oracle model and under a circular correlation robustness (CCR) condition for any number of slices. We also evaluate simple uses of the three-input construction against the best two-input circuits collected in our experiments, finding evidence of communication savings on control circuits.

Constructing attribute based encryption (ABE) for unbounded circuits, namely circuits with both depth and width being unbounded, and for Turing machines are perhaps the most important open questions in ABE research. Recent years saw some much-awaited progress on these long-standing problems -- (i) the work of Hsieh, Lin and Luo [HLL23] (HLL23) provided the first construction of ABE for unbounded circuits from a new circular evasive LWE assumption, (ii) the follow-up work of Agrawal, Kumari and Yamada [AKY24b] and Cini and Wee [CW25] gave the first constructions of ABE for Turing machines. Unfortunately, all these works relied on different versions of the ``private-coin'' Evasive Learning With Errors assumption which was invalidated in a sequence of attacks [BUW25, BDJ+25, DJM+25, AMYY25, HJL25, HHY26]. Finding new constructions from better-understood assumptions (without relying on compact functional encryption or obfuscation) is therefore an important open problem. In this work, we make progress towards this goal. Our contributions are: 1. *KP-ABE for Unbounded Circuits from Circular Small-Secret LWE and Bilinear GGM.* We provide a new candidate for key-policy ABE for unbounded circuits from circular small-secret Learning With Errors (csLWE) and the Bilinear Generic Group Model (BGGM). Since the BGGM has a long history of study, we believe that this provides strong evidence for the security of our scheme. In the standard model, we argue security from a novel, falsifiable ``doubly circular'' assumption which combines csLWE with key dependent message security of a variant of ElGamal encryption in an inseparable manner. We show that in a restricted setting, it is implied by the standard SXDH assumption and csLWE. 2. *SK CP-ABE for Unbounded Circuits from Circular Small-Secret LWE. * In the symmetric key setting, we provide a new candidate for ciphertext-policy ABE for unbounded circuits from only the csLWE assumption. 3. *SK KP-ABE for Turing Machines from Circular Small-Secret LWE.* In the symmetric key setting, we provide the first key-policy ABE for Turing machines from the csLWE assumption. Curiously, each of our constructions is intrinsically key-policy or ciphertext-policy and stubbornly resists adaptation to its dual variant. Thus, our work exhibits a surprising (to us) dichotomy between the key and ciphertext policy versions of ABE for unbounded circuits. Finding dual versions of the above constructions, removing pairings altogether or dispensing with the symmetric key setting are fascinating open problems.

Marcus, Spielman, and Srivastava [MSS15] established the existence of Kadison--Singer partitions. We provide polynomial-time algorithms for the Kadison--Singer problem. For Hermitian matrices $A_1,\ldots,A_m\in\mathbb C^{n\times n}$ of rank at most one, we give two algorithms that find signs $\sigma\in\{\pm1\}^m$ satisfying $\|\sum_i \sigma_iA_i\|\le C\|\sum_i A_i^2\|^{1/2}$. The deterministic algorithm achieves $C=3.3443$ using $\widetilde O(mn^2+n^{4.75})$ arithmetic operations. The randomized algorithm achieves $C=4.8628$ using $\widetilde O(mn^2+n^{3.58})$ arithmetic operations in expectation. For vectors satisfying $\sum_i a_ia_i^*=I$ and $\|a_i\|^2\le\alpha$, the algorithms yield partitions $[m]=I_1\cup I_2$ satisfying $\|\sum_{i\in I_j}a_ia_i^*-I/2\|\le (C/2)\sqrt\alpha$ for $j=1,2$.

Polynomial commitment schemes (PCSs) allow a prover to commit to a polynomial and later prove its evaluations succinctly. Among hash-based constructions, FRI (Ben-Sasson et al., ICALP 2018) and its follow-up works achieve polylogarithmic proofs by recursively ``folding'' Reed-Solomon (RS) codes. However, their concrete evaluation costs remain relatively high, as the first few folding rounds operate on the largest codewords and dominate the prover work. We present \emph{ReedWeave}, a Reed-Solomon PCS that successfully incorporates interleaving with folding, achieving the best of the two worlds. ReedWeave decomposes a degree-$d$ polynomial into $m$ smaller components and commits to their RS encodings over a common domain. Under our novel decomposition, a random linear combination of these codewords is exactly an $m$-ary folding. At a high level, ReedWeave starts with an $m$-ary folding, followed by standard binary folding as in FRI. The prover costs are substantially reduced in the sense that at the very beginning it suffices to do interleaved-RS encoding rather than standard RS encoding. That is, we reduce prover costs from $\mathcal{O}(d \log d)$ to $\mathcal{O}(d\log(d/m))$ for constant code rate while maintaining efficient polylogarithmic verification. Moreover, our approach essentially works for arbitrary $m$, relaxing the smoothness requirements of the underlying fields by a multiplicative factor of $m$. We benchmark our Rust implementation over Goldilocks using 32 threads and targeting 100-bit security. At $d=2^{24}$, $\rho=1/4$, and $m=64$, the DEEP variant commits in $475.0$ ms, opens in $111.6$ ms, verifies in $2.07$ ms, and produces a $594.7$ KiB proof. Compared with FRI (ICALP 2018), commitment, opening, and verification are $6.9\times$, $51.5\times$, and $4.2\times$ faster, respectively. Against STIR (CRYPTO 2024), the corresponding speedups are $2.9\times$, $68.5\times$, and $2.1\times$. Its proof is only $0.69\times$ the size of FRI's and $2.31\times$ that of STIR's.

Fair data exchange (FDE) ties payment to recovery of data matching an agreed commitment. Code-based FDE offers near-plaintext communication, but the sampled-ElGamal baseline incurs costly in-circuit checks when low redundancy requires many samples. We replace auxiliary ElGamal ciphertexts with direct KZG authentication and external witness linking. This leaves only field arithmetic in the consistency circuit and permits a BLS12-381 instantiation with EVM precompile support for settlement-key verification. We prove correctness, soundness, and zero knowledge under an external KZG setup in the algebraic group and random oracle models. Our implementation reduces aggregate sender computation from \(179.6\) to \(2.75\) seconds (\(65.3\times\)) for a \(2\,\)MiB file at redundancy \(\beta\approx1.1\), relative to the sampled-ElGamal baseline. Bulk ciphertext remains about \(1.1\times\) the plaintext size. The corresponding EVM implementation reduces gas for successful seller settlement by a factor of \(31.3\).

Central Bank Digital Currencies (CBDCs) aim to replicate the utility of physical cash in the digital era by balancing privacy with regulatory auditability. Despite recent advancements, existing CBDC schemes suffer from limited concurrency and the lack of offline payment confirmation, forcing users to process concurrent payments one by one and requiring counterparts to remain online. These constraints severely limit CBDC's applicability in high-frequency, real-world payment scenarios. This paper proposes PulpoPay, the first CBDC scheme to provide high concurrency and offline confirmation, while maintaining auditable privacy. To achieve high concurrency and offline confirmation, PulpoPay, at its core, introduces a coin-based payment protocol that facilitates users to concurrently withdraw, transfer, and deposit coins without synchronization or online requirements for counterparts. For auditable privacy, we leverage signatures on randomizable ciphertexts to enable fine-grained auditing without compromising privacy. Furthermore, we design a coin identifier with offline-checkable uniqueness to resist double-spending attacks even in disconnected (offline) environments. We formally prove PulpoPay's security within the Universal Composability (UC) framework. We implement a prototype of PulpoPay. Experimental results demonstrate that (1) a payment with an offline receiver can be finished within 0.3~s using a mobile phone; (2) PulpoPay outperforms the state-of-the-art PEReDi [CCS'22] in the scenarios of concurrent payments. For a typical setting of 200 concurrent payments, PulpoPay reduces processing time by at least 66.89% and communication overhead by at least 76.45%. This advantage becomes even more significant as the number of concurrent payments grows.

We report on the solution to the TII-254 McEliece key recovery challenge -- currently the hardest solved challenge under the original brute-force metric ($2^{254}$). The parameters of TII-254 are $(m,t,n) = (8,12,223)$, defining a binary $[223,127]$ code specified by a full-rank $(96 \times 223)$ parity-check matrix. We state the method as a thirteen-step process, separating heuristic and non-heuristic choices. At a high level, we computed two complete $121$-dimensional relation kernels conditioned at distinct public coordinates, combined them to isolate a certified $80$-dimensional pair core, removed a $64$-dimensional common nuisance space, and identified the remaining $16$ dimensions as an $\mathbb{F}_{2^8}$ projective-line geometry. This yielded all $87$ visible locators, after which a deterministic completion search recovered the full support and polynomial. The two final Krylov sequences alone used $27.2$ GPU-hours on NVIDIA GH200s, excluding GPU reconstruction and CPU processing. We provide a self-contained artifact with compact recovery inputs and code, an independent key verifier, and Lean proofs of the reusable linear-algebraic steps.

The module lattice isomorphism problem (module-LIP), introduced with HAWK, has attracted growing interest. Its most studied case is ${\mathcal O_{\mathbb{L}}}^2$-LIP, underlying HAWK key recovery, where $\mathbb{L}$ is a power-of-two cyclotomic field and ${\mathcal O_{\mathbb{L}}}$ its ring of integers. Three recent independent algorithms reduce this $2n$-dimensional problem to polynomially many exact-SVP calls: the Claude-derived algorithm uses dimensions at most $n/2+1$, and the ChatGPT-derived and Mureau--Pellet-Mary algorithms use $3n/4+1$. These improve Ducas's generic $\mathbb Z$LIP bound $n+1$ (DCC 2024). Although known SVP methods still give exponential running times, the impact on parameter selection led the HAWK team to withdraw the scheme. All three approaches rely substantially on rank-two structure. Higher-rank module-LIP is a possible direction for alternatives, calling for further study of its hardness. We first use the symmetric square to obtain a rank-two reduction, matching the bound $3n/4+1$ above. Its auxiliary objects correspond geometrically and algebraically to those of the ChatGPT-derived algorithm, so this does not constitute a substantively new reduction; the differences lie in the interpretation and post-processing. This viewpoint nevertheless motivates our dimension reduction in rank four. In rank four, the conjugate Hodge star on the exterior square yields a publicly computable fixed lattice isometric to $\mathbb Z^{3n}$, from whose orthonormal basis we reconstruct a module isomorphism. For ${\mathcal O_{\mathbb{L}}}^4$-LIP with the standard free module as reference, we reduce the $4n$-dimensional problem to polynomially many SVP calls in dimensions at most $3n/2+1$, improving the generic bound $2n+1$. All computation outside the oracle runs in deterministic polynomial time.

The complexity of fast correlation attack is fundamentally determined by the correlations of the linear approximations used. Conventional fast correlation attacks either rely on a single dominant linear approximation or use the lower bound to evaluate the resulting correlation of multiple linear approximations, which have the same output mask and distinct input masks. How to exploit multiple linear approximations with distinct output masks remains an open problem. In this paper, we propose a framework of fast correlation attack exploiting multiple linear approximations called \texttt{MultLA} to solve this problem. \texttt{MultLA} utilizes the arithmetic mean of the absolute correlations of linear approximations, rather than the lower bound of that. For SNOW 5G, our attack has time/memory/data complexities of ${{2}^{279.25}}/{{2}^{265.03}}/{{2}^{263.62}}$, which are all better than those of the existing work. When the time and memory complexities are slightly better than those of the existing work, the data complexity is significantly reduced from ${{2}^{265.4}}$ to ${{2}^{261.21}}$. To the best of our knowledge, our attacks achieve the best known cryptanalytic results of SNOW 5G up to now.

Fuzzy Password-Authenticated Key Exchange (fuzzy PAKE) was introduced at Eurocrypt'18, enabling two parties to securely establish a shared cryptographic key using passwords that are close and potentially low-entropy. This is a generalization of standard PAKE and is particularly useful for handling mistyped passwords or inherently “noisy” samples such as biometrics. While this primitive sounds promising, existing definitions and protocols face several challenges: they may suffer from gapped leakage (namely, leakage of a small amount of information from failed authentications), or they may be restricted to Hamming distance. We review the functionality and describe our contributions below: 1. Leakage under Reuse. We show that, when a password may be reused across multiple sessions, any leakage from the functionality has the same eventual compromise consequence under repeated use. Concretely, we construct an efficient ideal-world adversary that recovers an n-character password within O(n) active sessions, assuming it starts from a password not too far from the target. Our attack applies to both Hamming distance and Minkowski (L_p) distance under reasonable parameter choices. This implies that, for common distance metrics in practical settings, several notions of leakage are effectively unified when passwords are reused, thereby resolving an open question from Eurocrypt'18. 2. Supporting L_p Distances. We propose substantially more efficient protocols for generalized Minkowski (L_p) and Hamming distances in the random oracle model. As a key technical step, we show how to achieve malicious security using only a semi-honestly secure oblivious key-value store, while addressing several subtleties in the proof. Concretely, compared with existing approaches for L_2 distance, our protocol reduces runtime by about 86% and bandwidth by about 99%.