Worst-case to average-case reductions from lattice problems such as GapSVP and Bounded Distance Decoding (BDD) to the Learning with Errors (LWE) problem form the backbone of the security guarantees for lattice-based cryptography. However, these classic reductions are notoriously lossy: even assuming exponential hardness for worst-case lattice problems, they yield only subexponential lower bounds on the hardness of LWE. Recent work by Aggarwal, Leong, and Veliche (AMV, TCC'24) proposed a new perspective, quantifying hardness in terms of the \emph{maximum success probability} achievable by any efficient (PPT) algorithm, and provided nearly tight reductions for LWE in the polynomial-time regime. Nevertheless, their framework is inherently limited to polynomial-time adversaries, leaving open the question of how the tradeoff between running time and success probability for lattice problems governs the concrete security of LWE and SIS against powerful, time-rich adversaries. In this work, we address this gap by systematically analyzing and tightly characterizing the time-success probability tradeoff for SVP and BDD, focusing on algorithms that exploit the fine-grained structure of slide-reduced bases. We present new blockwise guessing algorithms for SVP and BDD that utilize small-dimension SVP and CVP oracles; by leveraging the consecutive-product properties of Slide Reduction, we obtain the tightest known lower bounds on the success probability as a function of time. Assuming that we cannot do much better than this, we conjecture that no algorithm can outperform this tradeoff---for any subexponential time bound $T(n)=2^{o(n)}$, the success probability of solving worst-case SVP or BDD cannot exceed $2^{-\frac{n^2\log\log T(n)}{c\log T(n)}}$ for some constant $c>1$, up to polynomial factors. Applying this conjecture, we derive sharply improved, modular worst-case to average-case reductions for LWE and SIS that are robust against all time-bounded adversaries, not just those restricted to polynomial time. Our results provide the first fine-grained, quantitative foundation for the bit-security of lattice-based cryptography across the full spectrum of adversarial resources, closing a key gap in both the theory and practice of cryptographic security reductions.

FrodoKEM, a key encapsulation mechanism based on the standard (unstructured) LWE assumption, is recommended as a conservative choice for post-quantum key exchange by agencies like BSI and ANSSI. As such, it has garnered substantial attention from an implementation security standpoint. In particular, several papers have looked into masking FrodoKEM, and, like for various other lattice-based cryptosystems, identified the Gaussian sampling operation as a major bottleneck. In FrodoKEM, it is carried out using a CDT-based sampler, which compares a uniformly random value in [0,1) (with fixed precision) to each of the probabilities in the cumulative distribution table of the target distribution. Two recent works proposed masked gadgets at arbitrary order for that operation: one by Gérard and Guerreau (CASCADE 2026), which simply masks each of the comparisons with the table elements (using a ripple carry adder as the Boolean comparison circuit), and another by Eid et al. (TCHES 2026), that uses a novel approach based on a binary search tree, significantly reducing the number of masked comparisons for larger tables. Eid et al. also choose the Kogge-Stone adder as the basis for their comparison circuit. In this paper, we provide an extensive analysis of the choices and trade-offs involved in masked CDT-based sampling, and propose several optimizations that further improve upon these previous works by a considerable margin. In particular, since FrodoKEM, like almost all the schemes that rely Gaussian sampling, generates hundreds of samples at a time, we find it beneficial to utilize approaches that lend themselves to a high degree of parallelization. This includes bitslicing (with which, importantly, the ripple carry adder has been proved optimal for comparisons), as well as techniques such as the use of algebraic normal form in masked multiplexers. As a result, on an ARM Cortex-M4 STM32F4 target board, our companion implementation in pure C outperforms the hand-crafted assembly of Eid et al. (resp. Gérard-Guerreau) by a factor of around 2 (resp. 7 to 9) at masking order 1. The gap is even larger at higher order: we outperform the higher-order code of Eid et al. (in C with assembly for expensive gadgets) by a factor ranging from 5 at masking order 2 to 9 as masking order 8.

Multivariate interpolation arises in a wide range, including computer graphics, multi-secret sharing and secure multiparty computation. But its general representation is rarely discussed. In this note, a general representation for univariate interpolation and multivariate interpolation is formulated, which is helpful for multi-secret sharing illustrations and security arguments. The finding offers a new glimpse into the relation between Cramer rule and Lagrange interpolation formula.

Idempotent functions are an important class of Boolean functions, related to cryptography and coding theory.} This paper investigates $k$-idempotent functions, a natural generalization of {idempotent} functions. Based on two classes of Dillon-type bent functions proposed in {the paper ``New characterizations of Dillon-like hyperbent functions via Dickson polynomials", by Z. Tu, C. Li, X. Zeng, T. Helleseth and N. Li, 02 October 2025, Volume 38, article number 35, in Journal of Cryptology}, we establish the existence of $k$-idempotent bent functions {(that are not $l$-idempotents for $l<k$)} from the finite field $\mathbb{F}_{2^n}$ to $\mathbb{F}_2$ in the partial spread class. More precisely, for any divisor $k$ of $n$ with $k\ge3$, it is demonstrated that there are $k$-idempotent bent functions. For $k=1,2$, complete characterizations on the $k$-idempotent bent conditions are provided via the $2$-adic orders of integers. The key problem reduces to solving a specific linear equation and {computing certain values of the trace function associated with its solutions}, which is closely connected to computing the Walsh transform of the Gold functions. By reformulating the target equation into a system of two linear equations and applying trace map properties, the trace is explicitly computed and thus the $k$-idempotent property is verified.

The main objective of this paper is to acceler ate the post-processing of Quantum Key Distribution (QKD) using an energy-efficient pipelined architecture implemented on a Field-Programmable Gate Array (FPGA). The proposed architecture aims to improve processing speed while efficiently utilizing hardware resources. In addition, this work compares the proposed approach with existing approaches to demonstrate its performance and resource efficiency.

Du et al. (Security and Communication Networks, 2022) proposed a public-key authenticated searchable encryption scheme that employs Bloom filters and blockchain. In their scheme, Bloom filters are used to search encrypted keywords, while blockchain is used to ensure the integrity of search results that guarantees the search result is correct. In this paper, we demonstrate that Du et al.'s scheme leaks keyword information from ciphertexts. Our analysis focuses on the fact that the Bloom filter is uniquely determined by the keyword to be encrypted and is directly embedded in each ciphertext. We show that the proposed attack succeeds with the probability that no false positives occur in the Bloom filter, and we evaluate the false-positive probability to confirm that the attack achieves a sufficiently high success rate. Furthermore, we examine Du et al.'s security model and their assumed usage scenarios, and we discuss the validity of our attack under those conditions. We also consider a simple modification intended to prevent our attack and demonstrate that our attack, with a slight adaptation, remains effective against the modified scheme. In addition, we show that even when the search results differ, previously generated ciphertexts can still pass verification, indicating that the integrity verification mechanism based on blockchain is insufficient.

Private set operations (PSOs) let two parties compute set-theoretic functionalities on private inputs while revealing nothing beyond the prescribed output. While private set intersection (PSI) has become highly efficient, many other PSOs remain significantly more expensive. The most effective general framework for such tasks is based on reverse private membership test (RPMT), but even state-of-the-art RPMT constructions rely on heavy elliptic-curve-based primitives. In this work, we propose a substantially faster RPMT protocol by replacing the elliptic-curve core with RLWE-based one. Our starting point is the Oblivious Key-Value Store (OKVS) based RPMT framework, whose direct adaptation to RLWE is obstructed by the batching structure of RLWE encryption. To address this, we introduce a batching-friendly variant of OKVS together with a homomorphic batched decoding procedure. We believe that this batching-friendly OKVS and its homomorphic decoding process may be of independent interest. For a set size $2^{20}$, our RPMT-based PSO protocols take only about $3$ seconds over LAN network and $120$-$138$MB communication, whose running time is comparable to state-of-the-art PSI. Compared to state-of-the-art PSI-Cardinality and PSI-Card-SUM, this is up to \(13.0\times\) speedups. Compared to state-of-the-art PSU, this is up to \(3.0\times\) smaller communication while achieving comparable computational cost, which results in up to $3.9\times$ faster running time over WAN.

Zero-knowledge proofs of training (zkPoT) enable a prover to certify that a model was trained on a committed dataset under a prescribed algorithm without revealing the model or data. Proving recurrent neural network (RNN) training is challenging due to hidden-state recurrence and cross-step weight sharing, which require proofs to enforce recurrence, gradients, and nonlinear activations across time. We present SUMMER (SUMcheck and MERkle tree), a recursive zkPoT for scalable RNNs. SUMMER generates sumcheck-based proofs that backpropagation through time (BPTT) was computed correctly over a quantized finite field, while nonlinearities such as $\tanh$ and softmax are validated by lookup arguments. Per-step commitments and proofs are folded with Merkle trees, yielding a final commitment and a succinct proof whose size and verification time are independent of the number of iterations. SUMMER offers (i) the first end-to-end zkPoT for RNN training, including forward, backward, and parameter updates; (ii) the first use of LogUp for nonlinear operations with a batched interface; and (iii) efficient recursive composition of lookup and sumcheck proofs. On a Mini-Char-RNN with 12M parameters, the prover runs in 70.1 seconds per iteration, $8.5\times$ faster and $11.6\times$ more memory efficient than the IVC baseline, with 165 kilobyte proofs verified in 20 milliseconds.

In 2022, Cotan and Te{\c{s}}eleanu proposed an alternative RSA construction in which the modulus takes the form $N = pq$ and the exponents $(e,d)$ are linked through $ ed -1\equiv 0 \pmod{\psi_n(N)},\ n \geq 2, $ where $ \psi_n(N) = \frac{(p^n-1)(q^n-1)}{(p-1)(q-1)}. $ Their scheme was subsequently examined by Nitaj et al. at Africacrypt 2024, who demonstrated that the system becomes vulnerable when the secret exponent $d$ is less than $N^{0.292(n-1)}$. In the present work, we extend this line of cryptanalysis by developing a lattice-based technique targeting the same key congruence. Our approach succeeds in recovering the private parameters even for secret exponents greater than $N^{0.292(n-1)}$, thereby surpassing the previously known boundary. The factorization of $N$ is achieved in polynomial time, provided that its divisors $p$ and $q$ share a suitably portion of their least significant bits.

In a succinct proof protocol, a verifier gets assurance that an untrusted prover executed an agreed computation, without requiring the verifier to re-execute the computation itself. In little more than a decade, this area has undergone a remarkable transformation from theory to implemented systems. This activity is extremely exciting. But there is a catch. To apply succinct proofs, one needs to translate one's computation to a set of equations, or constraints. The required translation has so far completely blocked systematic support for numerical computations, namely those for which the bulk of the computation uses approximations of real numbers. This paper fills that void with the design, implementation, and evaluation of a system called Spain. The starting insight of Spain is that since numerical computations inherently have approximation error, the constraint formalism should likewise allow for approximate satisfiability. Based on this insight, Spain introduces a new proof protocol and new ways to translate computations to constraints. Spain's implementation improves over natural baselines by multiple orders of magnitude.

We revisit the question of securely compressing multiparty correlations using only symmetric cryptography. A *linear correlation* ${\cal C}$, defined by a linear subspace $C\subseteq \mathbb F^n$, samples a secret random ${\bf c}\in C$ and assigns to each party a fixed subset of the entries of ${\bf c}$. Gilboa and Ishai (Crypto 1999) and Cramer, Damgård and Ishai (TCC 2005) provide a general technique for securely compressing many independent samples from $\cal C$ by replicating independent keys of a pseudorandom function (PRF) among the parties. This implies a *pseudorandom correlation function* (PCF) for $\cal C$ from any PRF, where the PCF key size scales with the number of minimal-support codewords in $C$. We observe that the above generalizes to other types of useful target correlations ${\cal C}_T$ by using a *secret* replication pattern obtained via a random secret assignment of parties in $\cal C$ to parties in ${\cal C}_T$. We present several corollaries of this general blueprint. These include a re-derivation of two-party PCF constructions for VOLE and subfield-VOLE over small domains (Roy, Crypto 2022) as well as new multiparty PCFs for small-domain VOLE-style correlations, including scalar-vector multiplication triples and their authenticated variants. Finally, we discuss applications to secure computation.

The Internet of Medical Things (IoMT) is revolutionizing healthcare through real-time monitoring and personalized care, yet existing security solutions for resource-constrained IoMT devices often compromise between robust protection and computational efficiency. Additionally, various IoMT systems utilize different sets of encryption schemes, ranging from classical to post-quantum algorithms, tailored to their computational resources, operational constraints, and specific privacy challenges. This diversity highlights an urgent need for an adaptive and efficient, quantum-resistant security protocol applicable to these systems. We propose the Privacy-Preserving Hybrid Data Sharing ($P^2HDS$) framework, which integrates multiple classical and post-quantum encryption schemes to achieve strong security with enhanced efficiency. $P^2HDS$ formalizes a generalized hybrid encryption protocol that enables adaptive configuration based on security requirements and computational constraints. We employ game-theoretic analysis to model interactions between data owners and adversaries, determining the optimal combination of encryption schemes for data outsourcing to mitigate adversarial threats. Rigorous security analysis proves that $P^2HDS$ achieves indistinguishability under chosen-plaintext attack (IND-CPA) security in the random oracle model, provided at least one constituent scheme is IND-CPA-secure. Experimental results demonstrate that $P^2HDS$ delivers performance approximating the average of its constituent schemes while maintaining security comparable to the most secure component, making it a scalable, quantum-resistant, and adaptive solution for privacy-preserving IoMT edge applications.

Post-Compromise Security (PCS) expresses that even after a party has been compromised, it may be able to recover (or "heal") security afterwards. PCS has been extensively studied, and many end-to-end secure messaging applications include mechanisms, such as the double ratchet, to achieve it. However, current approaches only work partially, and their healing effects are extremely limited. For example, recent work showed that due to real-world constraints such as resilience against state loss, even highly secure messengers such as Signal may not achieve it in practice. Moreover, since healing is session-specific, healing effects do not carry over to newly spawned sessions, different groups, or different services that use the same identity. In this work, we tackle these issues by designing the first protocol that can provide PCS as a Service for identities through a third party. The major challenge is privacy: achieving PCS requires regular updates among participants, and involving a third party can lead to significant privacy concerns. Moreover, the type of update that PCS requires (updating a user's secret, but only once) seems to require servers to verify the users' identities in a way that contradicts the unlinkability required for privacy: the server should not learn anything about the users' activities. We develop the 3PaaS protocol, including the first efficient zero-knowledge proofs for blind signatures, to achieve our goals, and even allow for revocation, without revealing the identity to the server. We formally analyze our protocol for high assurance, provide an implementation of our novel ZK building blocks, and show how our protocol could be used with a messaging application.

Anonymous credentials enable unlinkable and privacy-preserving user authentication. To ensure non-transferability of credentials among corrupt users, they can additionally be device-bound. Therein, a credential is tied to a key protected by a secure element (SE), usually a hardware component, and any presentation of the credential requires a fresh contribution of the SE. Interestingly, despite being a fundamental aspect of user credentials, device binding for anonymous credentials is relatively unstudied. Existing constructions either require multiple calls to the SE, or need the SE to keep a credential-specific state -- violating core design principles of shielded SEs. Further, constructions that are compatible with the most mature credential scheme BBS rely on the honesty of the SE for privacy, which is hard to vet given that SEs are black-box components. In this work, we thoroughly study and solve the problem of device-bound anonymous credentials (DBACs). We model DBACs to ensure the unforgeability and non-transferability of credentials, and to guarantee user privacy at the same time. Our definitions cover a range of SE trust levels, including the case of a subverted or fully corrupted SE. We also define blind DBACs, in which the SE learns nothing about the credential presentations it helped compute. This targets the design of a remote, cloud-based SE which is a deployment model considered for the EU Digital Identity (EUDI) wallet to address the fact that most user phones are not equipped with a sufficiently secure SE. Finally, we present three simple and round-optimal constructions for device binding of BBS credentials, and prove their security in the AGM+ROM and privacy unconditionally. The SE therein is extremely lightweight: it only has to compute a BLS or Schnorr signature in a single call. We also give the BLS-based construction in a blind variant, yielding the first protocol that enables privacy-preserving device binding for anonymous credentials when being used with a remote SE.

We initiate the formal study of "dead man switch cryptography" — the problem of cryptographically enforcing the fate of a long-lived secret upon the death of its sole keeper — either by releasing it exclusively to designated nominees or by provably destroying it. Despite the natural practical demand, no prior work formalizes this primitive. We identify Dead Man's Switch (DMS) as a standalone cryptographic primitive with two modes: release and delete, capturing these dual functionalities. Our abstraction isolates the core conceptual properties of this primitive, and gives its first rigorous treatment in the UC framework. To realize the notion, we introduce Dealer-Controlled Evolving-Committee Proactive Secret Sharing (DC-EPSS), an extension of the Evolving-Committee Proactive Secret Sharing by Benhamouda et al. (TCC '20). We provide the UC formalization of DC-EPSS and instantiate it generically using the nested YOSO framework of Abraham, Chouatt, Damgard, Gilad, Stern, and Yakoubov. Building on DC-EPSS, we realize DMS-release by coupling it with a multi-recipient authorized recovery mechanism based on a PKI infrastructure, a multi-recipient PKE, a key committing SKE, and NIZK proof systems, while DMS-delete directly follows from DC-EPSS instantiated in the delete mode. We prove the security of both constructions in the UC framework under standard assumptions.

In recent years, formal verification has emerged as a crucial method for assessing security against Side-Channel attacks of masked implementations, owing to its remarkable versatility and high degree of automation. However, formal verification still faces technical bottlenecks in balancing accuracy and efficiency, thereby limiting its scalability. Former tools like maskVerif and CocoAlma are very efficient but they face accuracy issues when verifying schemes that utilize properties of Boolean functions. Later, SILVER addressed the accuracy issue, albeit at the cost of significantly reduced speed and scalability compared to maskVerif. Consequently, there is a pressing need to develop formal verification tools that are both efficient and accurate for designing secure schemes and evaluating implementations. This paper’s primary contribution lies in proposing several approaches to develop a more efficient and scalable formal verification tool called Prover, which is built upon SILVER. Firstly, inspired by the auxiliary data structures proposed by Eldib et al. and optimistic sampling rule of maskVerif, we introduce two reduction rules aimed at diminishing the size of observable sets and secret sets in statistical independence checks. These rules substantially decrease, or even eliminate, the need for repeated computation of probability distributions using Reduced Ordered Binary Decision Diagrams (ROBDDs), a time-intensive procedure in verification. Subsequently, we integrate one of these reduction rules into the uniformity check to mitigate its complexity. Secondly, we identify that variable ordering significantly impacts efficiency and optimize it for constructing ROBDDs, resulting in much smaller representations of investigated functions. Lastly, we present the algorithm of Prover, which efficiently verifies the security and uniformity of masked implementations in probing model with or without the presence of glitches. Experimental results demonstrate that our proposed tool Prover offers a better balance between efficiency and accuracy compared to other state-of-the-art tools (IronMask, CocoAlma, maskVerif, and SILVER). In our experiments, we also found an S-box that can only be verified by Prover, as IronMask cannot verify S-boxes, and both CocoAlma and maskVerif suffer from false positive issues. Additionally, SILVER runs out of time during verification.

This paper presents a high-performance architecture for accelerating Multi-Scalar Multiplication (MSM) on ASIC platforms, targeting cryptographic applications with high throughput and scalability demands. Current MSM accelerators on FPGA and ASIC platforms typically focus on designing efficient processing elements (PEs) to perform resource-intensive elliptic curve point operations, which require a high number of 384-bit modular multipliers. Our approach diverges from existing works by adopting a chiplet-based design, which optimally balances area, power consumption, and computational throughput. By analyzing memory requirements across window sizes, we determine an optimal mixed configuration of 12- and 13-bit windows, which allows efficient integration of multiple PEs per chiplet. Considering the single-PE case, our design achieves a 1.37x speedup and a 1.3x area reduction over prior works. Moreover, our multi-PE chiplet design outperforms monolithic designs by 2.2x in area-time product while allowing lower production costs and higher yield.

Lattice-based cryptography is one of the most promising candidates for post-quantum cryptography. Decryption Failure Rate (DFR) is a critical metric for the correctness and security of lattice-based public-key encryption (PKE) schemes. At present, most DFR evaluation methods for lattice-based PKE with message encoding rely on oversimplified assumptions, rough approximations, and fail to fully exploit the geometric structure of special encoding lattices, resulting in loose or inaccurate bounds. To address these limitations, this paper proposes a refined DFR evaluation framework for lattice-based PKE with message encoding, focusing on two mainstream decoding paradigms: Maximum Likelihood Decoding (MLD) and Bounded Distance Decoding (BDD). For MLD-based schemes, we precisely characterize the minimal vectors of Barnes-Wall (BW) lattices and derive tighter union bounds by leveraging the encoding lattice structure. For BDD-based schemes, we introduce a noncentral chi-squared distribution based method to model mixed noise composed of Gaussian and discrete components, avoiding the inaccuracy of conventional pure Gaussian approximations. Furthermore, we extend the framework to algebraic-lattice-based PKE by analyzing the variance and correlation of polynomial product coefficients, and propose a weighted chi-squared distribution with saddlepoint approximation to handle correlated coefficients. We validate the proposed methods on representative lattice-based PKEs including CNTR, \scloud, and CNTR-Prime, resulting in the DFR upper bound approximate 15 bits decreasing for CNTR, 1 bit decreasing for \scloud, and at least 84 bits increasing for CNTR-Prime. The experimental results show that our refined analysis yields significantly tighter and more accurate DFR bounds compared with traditional approaches, providing a reliable theoretical basis for parameter selection and security certification of practical lattice-based cryptosystems.

The Large Norm attacks of Ducas-Espitau-Postlethwaite (CRYPTO 2023) on the $\mathsf{ISIS}$ problem have shown that small values of $q$ can be used to recover short solutions. This was applied to Falcon and Mitaka. Two issues are left, however. First, the cost model of the attack oversimplifies the BDGL sieve; it does not account for how long vectors will be distributed and treats two dependent probabilistic events as if they were independent, which results in an overestimation of the attack cost. Secondly, the analysis only deals with the $\ell_2$ norm and has not yet been extended to $\mathsf{ISIS}^\infty$, which underlies Dilithium-type systems. This work addresses both issues. First, we extend the cost model of the Large Norm attack by including the principal sieve length distribution into our estimation of success probabilities. In addition, we use a joint probability rather than an approximate factor where possible. Since all other parts of the original $\theta$ convolution framework are reused, the extension is relatively minor. We reduce the attack cost of Large Norm on Falcon-256 by a $\approx\!11\times$ cheaper model, and successfully forge a Mitaka-512 signature in $\approx\!4.5$ seconds at a higher success rate. We additionally introduce a closed-form $\ell_\infty$ variant as a Z-shape attack against Dilithium-type $\mathsf{ISIS}^{\infty}$ at small-to-moderate modulus, which succeeds in $\le\!1.6$ seconds across three presets.

The past several years have seen a rapid rise in practical lattice-based proof systems with linear-sized zero-knowledge proofs forming the foundation of many of the most efficient quantum-safe privacy protocols, and succinct proofs rapidly catching up and surpassing other quantum-safe alternatives in many metrics. A recent comparison of lattice-based aggregate signatures (Ethereum Foundation, 2025) involving the hash-based aggregate signature scheme Plonky3 and the instantiation of aggregate signatures from Falcon from the LaZer lattice library (Lyubashevsky, Seiler, Steuer, CCS 2024) using LaBRADOR (Beullens, Seiler, Crypto 2023), showed that lattice-based constructions have an advantage in terms of proof size and prover time, but are around an order of magnitude slower with regards to verification time. In general, it appears that slower verification times are the main obstacle to the adoption of succinct lattice-based proof systems. In this work, we introduce and implement Orthus, a proof system with sub-linear verification designed for relations that naturally arise in lattice-based constructions. Asymptotically, the verification time grows with the square root of the witness size, and for a concrete example of aggregating Falcon signatures our implementation reduces the verifier running time by a factor of $9X$ when aggregating $2^{17}$ signatures.

The quantum indifferentiability of the Merkle-Damgård (MD) domain extender is a foundational problem in post-quantum cryptography. Recently, Gorjan et al. identified critical flaws in existing consistency proofs for this construction, invalidating prior security guarantees. Quantum indifferentiability proofs typically reduce to two oracle-indistinguishability games: the indistinguishability game and the consistency game. To analyze the systems arising in these games, we formalize and generalize Zhandry's compressed oracle proof technique into a modular quantum game-playing framework for systems constructed from random functions. On the positive side, we develop an error-propagation technique within our framework to track coherence penalties and bad sampling branches for the consistency game. This yields a tight consistency bound of $O(q_s^{3/2}/2^{n/2})$, matching the optimal complexity of generic quantum collision attacks. Benefiting from the same formalization, we also identify a fundamental obstruction in the indistinguishability game---a gap also present in Zhandry's original proof. Specifically, under sequential adaptive queries, the simulated quantum state inevitably leaks into the ``bad database'' subspace and yields a lower bound on the corresponding oracle deviation. This clarifies why completing the full quantum indifferentiability proof requires additional ideas.

In this paper, we present Trilithium: a protocol for distributed key generation and signing compliant with FIPS 204 (ML-DSA). Our protocol allows two parties, ``server'' and ``phone'' with assistance of correlated randomness provider (CRP) to produce a standard ML-DSA signature. We prove our protocol to be secure against a malicious server or phone in the universal composability model, introducing some novel techniques to argue the security of two-party secure computation protocols with active security against one party, but only active privacy against the other. We provide an implementation of our protocol in Rust and benchmark it, showing the practicality of the protocol. As additional contribution, we propose an actively secure generalization of Attrapadung et al. (ASIA CCS ’22) comparison protocol and a new rounding protocol for fractions with private numerator.

An adaptor signature (AS) scheme extends a digital signature by tying together message authentication with the exchange of a secret. Such atomic exchange of a secret for a signature has key applications in blockchain protocols, e.g., payment channels, atomic swaps or coin-mixing. To ensure compatibility with the environments, AS schemes should be scriptless -- that is, their signatures should be verifiable using the same procedure used to validate transactions' signatures, without auxiliary logic or scripts. As shown by Erwig et al. (PKC'21), it is impossible to construct scriptless AS for standard signature schemes with unique signatures. In contrast, Liu et al. (ASIACRYPT'24) demonstrated that dropping the scriptless requirement entirely makes AS construction for any EUF-CMA secure signature scheme straightforward.This raises a fundamental question: must we abandon scriptlessness entirely to construct AS for any signature scheme? We answer this question in the negative by introducing the notion of almost scriptless AS. Here, the only relaxation is that the signature is applied to an extended message -- specifically, the concatenation of the original message and a random string (i.e., signing $m \| r$ instead of $m$). We argue that this mild extension preserves the core benefits of scriptlessness in blockchain applications. We present a generic compiler that transforms any functional signature scheme into an AS, almost preserving the signature verification. In turn, show how indistinguishability obfuscation (in the CRS model) or witness encryption (in the ROM) allow turning any signature into a functional signature in a scriptless fashion. Both constructions ultimately yield almost scriptless AS for unique-witness (hard) relations and for any base signature.

The shortest vector problem (SVP) is central in lattice-based cryptography. In this paper, we focus on one of recent classes of algorithms for solving SVP: genetic algorithms (GAs) for lattice. In this paper, we propose the fastest GA to date for solving the SVP. From a search strategy perspective, our algorithm can be seen as an improved version of Fukase's algorithm. On the other hand, from a structure perspective, our algorithm is more than just an improved version of Fukase's algorithm. It is double-structured consisting of: (i) the inner GA, which inherits the basic structure from Fukase’s algorithm, and (ii) the outer GA, which optimizes the parameters used in the inner GA. The inner and outer GAs use mutually distinct objective functions. In our algorithm, we use two types of chromosomes and split the criterion for evaluation of chromosomes into two objective functions: the squared Euclidean norm for the inner GA and the evolution velocity of a lattice basis for the outer GA. The latter measures the velocity of the changes of the G-S sum, which is the sum of the squared lengths of the Gram-Schmidt orthogonalized vectors of a lattice basis, and is our novel criterion.

With the standardization of post-quantum digital signature schemes and their increasing deployment in security critical applications such as firmware authentication and software distribution, implementations are expected to operate in physically accessible and potentially hostile environments. Consequently, considerable effort has been devoted to protecting these schemes against a variety of attacks, including timing sidechannel attacks. However, evaluating their resilience against fault injection attacks remains equally important. Previous differential fault analysis (DFA) attacks on lattice-based signatures have primarily targeted intermediate values during signing and often relied on assumptions regarding rejection sampling or multiple fault injections. In this work, we demonstrate that the challenge sampling procedure itself constitutes a practical attack surface. Specifically, We present fault attacks against the challenge sampling procedures of deterministic ML-DSA, a NIST-standardized signature scheme, and HAETAE, a KpqC-selected signature scheme, showing that a single faulted signature is sufficient to recover the secret key required for signature forgery. To the best of our knowledge, this is the first fault attack on HAETAE achieving secret-key recovery that enables the generation of valid forged signatures. Our attack model of ML-DSA does not require direct access to faulted challenges. Using only public information, we identify intended fault injections and distinguish them from unintended fault outcomes. We evaluate the method through simulation and practical fault injection, achieving a 100% identification rate for intended faults. We further propose a countermeasure for the identified vulnerability

Semantic search over vector databases is a fundamental problem in both theory and practice, with large-scale systems relying on approximate nearest-neighbor (ANN) algorithms to retrieve semantically similar results efficiently. Achieving this capability securely while keeping both data and queries hidden remains a major challenge. Existing secure semantic search systems incur high latency and fail to scale to realistic database sizes. We present $\mathsf{BiSON}$, the first secure nearest-neighbor search protocol capable of supporting billion-scale encrypted vector databases. Even at this scale, $\mathsf{BiSON}$ answers queries in mere milliseconds and maintains search accuracy comparable to state-of-the-art insecure ANN algorithms, demonstrating that secure semantic search can be both private and truly high-performance. Compared to Compass, the prior state-of-the-art system, $\mathsf{BiSON}$ reduces communication up to $28\times$, improves end-to-end latency by up to $23.5\times$, and scales to datasets that are two orders of magnitude larger. A central contribution of $\mathsf{BiSON}$ is a new disk-compatible Oblivious RAM (ORAM) architecture that enables seamless scaling to billion-point datasets without compromising latency or privacy. Together, these innovations make $\mathsf{BiSON}$ the first practical and scalable solution for secure semantic search at cloud scale.

Cross-chain atomic swaps enable decentralized asset exchange across independent ledgers, but their public transcripts may expose transaction flows, signer identities, and business relationships. Existing scriptless swap mechanisms based on adaptor signatures provide witness-coupled execution, yet the signer is public. Linkable ring adaptor signatures further hide the signer within a ring, but they do not support controlled opening when a completed swap becomes disputed. In this paper, we put forward ALRAS, an accountable anonymous cross-chain atomic-swap mechanism based on Pair-Consistent Threshold-Openable Linkable Ring Adaptor Signatures. We design a pair-consistent opening mechanism that binds a ring-adaptor pre-signature, an opening ciphertext, a scoped link tag, and the completed full signature to the same hidden signer. This mechanism prevents false-opening, ciphertext-substitution, and transcript-splicing attacks while requiring a threshold-governed and publicly verifiable opening in the dispute path. We construct a generic compiler from a NIZK-compatible, index-hiding LRAS using threshold ElGamal opening, consistency proofs, and public pair verification. We further formalize the signing-layer interface and security goals and analyze signer anonymity, scoped linkability, witness extractability, non-frameability, and pair-consistent opening soundness. A reproducible Python artifact provides reference modules, attack-oriented sanity tests, and operation-count benchmarks. The results show the expected linear scaling with ring size and isolate the accountability overhead introduced by threshold opening and transcript binding.

This paper presents RiskService, a modular risk assessment module integrated into the Q-OPSEC adaptive AI middleware for quantum cryptography. A synthetic dataset covering 58 features across nine groups, including behavioral, device, network, authentication, and LLM-derived signals, feeds a training pipeline evaluating six model families under class-imbalanced conditions. LightGBM achieves the best performance, with AUC-ROC of 0.9895, average precision of 0.9344, and Brier score of 0.0421 at threshold 0.60, with inference latency of 1.8ms. Deployment benchmarks across three hardware tiers confirm feasibility under constrained resources: quantized XGBoost runs in 54.2ms on the ESP32 with AUC-ROC of 0.9112, enabling a two-tier architecture where edge nodes perform preliminary screening and forward ambiguous events for full-precision regime determination. Calibrated risk scores govern the selection among classical TLS1.3, post-quantum, and hybrid key derivation paths in the Q-OPSEC cryptographic layer.

We present cryptographic personas, an approach for facilitating access to pseudonymous speech within a community without enabling abuse. In systems equipped with cryptographic personas, users are able to authenticate to the service provider under new, unlinkable personas at will and post messages under those personas. When users violate community norms, their ability to post anonymously can be revoked. Cryptographic personas draws on techniques from recent work, zk-promises. We develop two significant improvements over existing work that make it possible to integrate cryptographic personas into real-time applications like group messaging: we show how to push expensive proof generation into an offline phase and find a way to optimize server-side overhead using recent proof folding techniques. We implement cryptographic personas, integrating them into Signal and Slack, and show that they are concretely efficient enough for deployment.

At CRYPTO 2025, Bhaumik et al. formalised the notion of Key Control (KC) security of Key Derivation Functions (KDFs). A KC adversary, on seeing the root key of a KDF, attempts to manipulate its auxiliary inputs (the `Context' string) to obtain a derived key from a pre-selected set of keys. In this paper we extend the notion of KC security to Key Combining Functions, which are KDFs that convert two root keys to a single derived key; we name the new notion Combining Key Control (CKC) security. We then investigate the CKC security of KDF Combiners and show that (up to certain limitations) it follows from the KC security of either of the component KDFs.

The Estonian i-voting experience, since 2005, is probably the richest to analyze; yet it still holds a collection of noteworthy threats as stated in the 2025 Estonian Academy of Science (Cyber Security Committee) report. This paper first gathers vulnerabilities discovered and improvements/fixes introduced to the Estonian i-voting system, IVXV, in the years 2023-2025; then presents a thorough analysis of its status, as of October 2025 version, with exploits pointed out and solutions suggested. In our review, we shade some light on automated formal verification research attempts that went unnoticed by the Estonian research community; we also notice that, since 2024, forcing a time gap between multiple votes could prevent Perreira revoting attack for verifying voters. Although the problem of not authenticating the Voting Application (VA) is not new and was discussed in the Estonian report, we warn of possible threats that have been missed. We show how new technologies like anonymous online auctions between candidates and hardware execution attests for conditional payment can be used to orchestrate an automated large-scale attack where an encrypted vote is generated online without the vote sellers even knowing who they’re voting for; adding fresh randomness to each ballot enables the attack to pass duplicate ballots anomaly check if existed. We agree that compromised voters’ credentials is a known threat to all i-voting systems; however, it only gets severe in the Estonian case where any application can cast a vote. Finally, we discuss the approaching quantum threat and recommend protecting election data from the possible HNDL (Harvest Now Decrypt Later) privacy threat by encrypting ballots, while residing on the system servers, using a quantum secure symmetric key algorithm (AES). The appendices contain also two suggested solutions for insiders' threat.

We present a new key recovery attack against the McEliece cryptosystem with binary Goppa codes that applies to a wide range of parameter sets. Earlier work already observed that homogeneous polynomials vanishing of higher order at the columns of the parity check matrix of a given code could be used to distinguish binary Goppa codes from random linear codes. This work now exploits the structure of these polynomials for key recovery. We illustrate the effectiveness of our approach by breaking a number of previously unbroken McEliece key recovery challenges published by the Technology Innovation Institute (TII). We conjecture that our approach also applies to Classic McEliece parameter sets and yields a key recovery algorithm with roughly the same complexity as the higher-order vanishing distinguisher. While this complexity is still significantly higher than the targeted security level of Classic McEliece parameter sets, this improves on currently known key recovery attacks.

The stateless hash-based digital signature algorithm SLH-DSA is a standardized post-quantum signature scheme based on the SPHINCS$^+$ framework. Although SLH-DSA has well-studied security properties, its signatures are relatively large. This has motivated continued work on reducing the signature size of stateless hash-based signature schemes. Recent work of Abri and Katz introduced forced pruning for reducing the few-time signature component in SPHINCS$^+$-style schemes. However, the concrete cover bound for PORS+FP remains conservative, which prevents smaller parameter choices from meeting the target security level. We introduce BPORS+FP, a bucket-thinned variant of PORSFP for the bottom few-time signature layer of SPHINCS$^+$-style schemes. The construction places independent PORS child keys under an outer FORS-like bucketing layer. For each selected child key, the number of previous uses is reduced from the bottom-key use count \(q_0\) to a binomially thinned count \(R\sim\operatorname{Bin}(q_0,2^{-B})\). The SPHINCS$^+$ level cover term is therefore evaluated at a smaller random use count, which creates room for smaller child parameters. BPORS+FP also combines this bucket-thinning effect with a global forced-pruning size threshold. Our evaluation shows that BPORS+FP gives shorter signatures than PORS+FP in five of the six standard SPHINCS$^+$ parameter rows considered, with the only exception being the 128-bit fast row. For NIST's limited-signature-use SLH-DSA parameter sets, replacing the few-time component by BPORS+FP reduces the total signature size by about 22%--26%, compared with about 10%--14% from PORS+FP.

We present a new algorithm to distinguish alternant and Goppa codes from general linear codes. Our approach is based on higher-order vanishing of polynomials and can be applied to a wide set of code parameters. It also applies to Goppa code parameters used in the Classic McEliece key encapsulation mechanism. While these parameters are out of reach in practice, we analyse the behaviour of our distinguisher and estimate its complexity for them, indicating that it is more efficient than previous distinguishing approaches. This is supported by concrete experiments that distinguish codes with larger parameters in practice.

The AEGIS family of authenticated encryption algorithms is built on a large state whose update function is a cascade of dependent AES rounds. For bitslicing, this looks like the worst possible case. Yet the parallelism is already inside a single update: for example, an AEGIS-128L update applies one AES round to all eight state blocks at once, filling an eight-block bitsliced data path by itself. We describe a sliced representation that keeps the rest of the cipher cheap too and lets AEGIS-128L run $2.5 times$ fewer parallel AES rounds per byte than bitsliced AES-128-CTR. On ARM, RISC-V, and WebAssembly, the resulting constant-time implementations are faster than side-channel-hardened AES-GCM on every platform measured, the X2 variants by factors of two to six. In pure JavaScript, where bitwise operators are exactly 32 bits wide, the same layout is faster than the widely used pure-JavaScript implementations of AES-GCM and ChaCha20-Poly1305.

Higher-dimensional SQIsign variants use product and Kani-style isogeny representations to make response isogenies compact, checkable, or compatible with non-smooth degrees. These representations raise a foundations question: do they introduce genuinely higher-dimensional hardness, or do they preserve elliptic extraction while moving the additional assumptions into simulation? This paper gives a proof-theoretic separation between these two layers. We identify a recoverability condition under which an accepted higher-dimensional response publicly induces an elliptic Hom element; under the usual challenge-separation hypotheses, special soundness then extracts an elliptic \OneEnd witness. The remaining higher-dimensional assumptions are simulation assumptions, and we formulate them as non-interactive hint distributions. The separation yields two concrete theorem packages. First, SQIsign2D--West admits an exact Fiat--Shamir-with-hints EUF-CMA theorem: the security loss is expressed through a simulation-hint \OneEnd assumption, the statistical simulator loss, the challenge-space term, and the commitment min-entropy term; a pushable uniform-hint corollary gives the EndRing-compatible interpretation under a named hint-indistinguishability assumption. Second, for SQIPrime2D we do not claim a proof for the published auxiliary sampler. We define and analyze \(\mathsf{SQIPrime2D\text{-}UAux}\), a foundations variant that replaces the published Algorithm-context AIO layer by a context-independent uniform auxiliary hint distribution. UAux is an ideal proof-model distribution unless an efficient represented sampler is separately supplied; an approximate sampler instantiates the theorems with an explicit additive sampling loss. For this SQIPrime2D-UAux foundations variant, UAux gives a context-independent and exactly pushable replacement for the auxiliary AIO layer. We then introduce challenge-carrying uniform hints that additionally reveal the non-smooth challenge isogeny, the residual response isogeny, and the UAux auxiliary isogeny. These hints are stronger than ordinary SQIPrime auxiliary information, but they are fully pushable through the smooth self-reduction isogenies used in EndRing-style reductions. Consequently SQIPrime2D-UAux admits a fully pushable EndRing-compatible challenge-carrying hint layer, with a q-HintDist assumption separating simulation-shaped hints from the pushable distribution. None of these SQIPrime-side statements is a claim of plain EndRing security or a claim that the published SQIPrime2D AIO sampler itself is pushable.

Single-server PIR is a powerful cryptographic primitive that allows a client to retrieve public data from a remote server without revealing which item it accessed. Its privacy guarantee, however, inherently forces the server to do work linear in the database size, which is impractical at a large scale. Client-Preprocessing PIR (CP-PIR)~[Patel et al., CCS 2018] suggests to push linear computation to an offline preprocessing phase, enabling online queries with sublinear server computation and communication. While CP-PIR has since attracted considerable attention, designing an efficient preprocessing phase remains challenging. The original construction, along with much subsequent work~(e.g.,~[Zhou et al., S\&P 2024]), streams the entire database, which incurs linear communication that scales only to moderately sized data. A different approach consists of implementing the preprocessing using Fully Homomorphic Encryption (FHE) (e.g.,~[Corrigan-Gibbs et al., Eurocrypt 2022]), but the current best proposal (ThorPIR [Fisch et al., CCS 2024]) still imposes prohibitively expensive homomorphic computation on the server. In this paper, we tackle the problem of designing a practical preprocessing phase for CP-PIR. We introduce RotPIR, a novel CP-PIR with a preprocessing that is simultaneously sublinear-communication (i.e., no database streaming) and computation-efficient, while keeping online communication and computation sublinear. RotPIR is obtained by co-designing our PIR protocol with the underlying FHE operations. Specifically, we propose an innovative preprocessing framework with an advanced homomorphic operator, {\em oblivious homomorphic rotation}, which enables the database to be rotated according to an encrypted offset, and significantly accelerates the offline server-side computation. Our experimental results show that RotPIR can achieve up to $1000\times$ speedup in offline server-side computation when compared to the state-of-the-art CP-PIR protocols that do not stream the entire database during the preprocessing.

We introduce Falafel, a modular scheme for Fast, Authenticated, Locally Attested FEderated Learning, with which parties can create a zero-knowledge proof of training (zkPoT) for Federated Learning (FL). The proof guarantees active security during the federated training process as well as publicly verifiable correctness of the final, trained model. All without revealing any additional information about the local datasets or intermediate local model states. Specifically, our approach targets FL of (deep) neural networks with a centralized server for weight updates. Our zkPoT not only offers attestation for local training steps, but also for the centralized weight update, as well as taking into account input authenticity by introducing a trusted auditor. This way an external verifier can check the entire training process, from dataset to final model. In contrast to prior work on zkPoTs, our construction solely relies on well-understood cryptographic assumptions and primitives, is highly parallelizable, and takes a modular approach. This modular (commit-and-prove) approach uses several novel core proof components, that could be swapped for other building blocks if desired. We show that, for LeNet, we generate a zkPoT of 70 kB in roughly 150 seconds for a single training round. Falafel’s prover time is in line with prior work, and its proof size is significantly smaller (10–15×), without relying on less-understood assumptions or instantiating Fiat–Shamir using arithmetic hash functions.

The increasing usage of Zero-knowledge proof protocols has raised the need for cryptographic primitives that are efficient in that setting, called Arithmetization-oriented primitives. The security of such permutations is commonly evaluated with the CICO-$k$ problem. The best known CICO-$1$ attack against ZK-Friendly permutations over $\mathbb{F}_q^t$ based on $\alpha$-inversions $x\mapsto x^{1/\alpha}$ exploits resultants (ASIACRYPT 2024, CRYPTO 2025). It starts from one input variable $x$ and introduces a temporary variable after each $\alpha$-inversion. With an efficient procedure to eliminate temporary variables, the attack reaches a time and memory complexity of $\tilde{\mathcal{O}}(D_I (2-1/\alpha)^n)$, where $D_I$ is the ideal degree of the CICO-$1$ modeling and $n$ is the number of $\alpha$-inversions. In this work, we study such an approach using two input variables $x_1 , x_2$, and we generalize the temporary variable elimination to that setting. Subsequently, we present a new CICO-$2$ attack framework and a new Start-From-The-Middle (SFTM) CICO-$1$ attack framework. Both our attacks rely on fast bivariate resultants for their final bivariate system solving step. Using resultant algorithms with complexity almost linear in $D_I$, our CICO-$2$ and CICO-$1$ attacks reach a complexity almost linear in $\alpha^n D_I$ and in $D_I$, respectively, which is a first theoretical improvement. Designing an efficient implementation of these resultant algorithms remains a challenge, so for our practical contributions we turn to Villard's algorithm (ISSAC 2018). After adapting it to our context, we obtain practical complexities $\tilde{\mathcal{O}}((\alpha^n D_I)^{\gamma_2})$ and $\tilde{\mathcal{O}}(D_I^{\gamma_1})$ for CICO-$2$ and CICO-$1$ respectively, where $1.2 \le \gamma_1 \le 1.25 \le \gamma_2 \le 1.33$ depending on the chosen linear algebra exponent $2 \le \omega \le 3$. Our attacks improve upon the best known ones against several instances of Anemoi, Rescue and Griffin, successfully breaking $128$-bit and $256$-bit security instances of Rescue in the CICO-$1$ setting and full-round instances of Anemoi and Griffin in the CICO-$2$ setting for the first time. Our implementation of the attack confirms the practicality of the approach.

We introduce a new compact and constant-time implementation of the FAEST v1.1 signature scheme that allows it to run in resource-constrained Arm Cortex-M4 microcontrollers under 190M cycles for signing or verifying at level 1 security. The main technique for reducing the memory footprint is a new abstraction to reuse or recompute VOLEs on demand, which reduces memory consumption by at least an order of magnitude.

The EasyCrypt proof assistant has been used to successfully formalize security proofs for a wide variety of crypto- graphic primitives. However, attempts at formalizing objects with interactivity, such as protocols, have fared much worse. In this paper, we investigate (some of) the reasons for this difficulty by formalizing a simple interactive key agreement protocol. From a first complete but exploratory proof, to a failed attempt at a structured proof, and to what we believe is an “essential” proof, we identify which proof features contribute most to the complexity of formalization in pRHL. In particular, we argue that difficulties in formalizing the security of interactive protocols in the computational model arise from the fact that such proofs rely on both state and temporal invariants—the former to support cryptographic reasoning, and the latter to support reasoning about the protocol’s structure. We believe that this observation can help build new reasoning tools that can bridge the gap that currently exists between primitive-focused tools and protocol- focused tools.

Post-quantum signature algorithms pose significant challenges for DNSSEC migration: their larger keys and signatures exceed DNS over UDP transport limits, making TCP fallback unavoidable even for the most compact schemes. We propose a differentiated algorithm selection, assigning distinct signature algorithms to the Zone Signing Key (ZSK) and Key Signing Key (KSK) roles. This approach expands the space of deployable post-quantum configurations beyond what undifferentiated selection permits, enabling algorithms that would otherwise be impossible to deploy: UOV, with 128-byte signatures but 43~KB keys, produces DNSKEY responses exceeding the 64~KB DNS limit under undifferentiated constraints, yet becomes viable when paired with a compact-key KSK. We also evaluate hybrid PQ/T schemes through signature concatenation, combining classical P256 with post-quantum algorithms in a single RRSIG record to provide dual security during the transition period. Using a containerized testbed validated against AFNIC's .fr TLD structure (4.2 million domains), we systematically measure response sizes, resolution latency, TCP fallback rates, and signing performance across 18 configurations. Differentiated configurations achieve 1.28-1.52× latency overhead relative to classical ECDSA while enabling algorithms that undifferentiated constraints prohibit. Hybrid PQ/T concatenation introduces acceptable overhead (7--19%) for backward-compatible quantum resistance.

Little OaldresPuzzle_Cryptic (LOPC) is specified as a parameterized 128-bit keyed block-transformation core built from three internal components: the NeoAlzette 64-bit ARX-box layer, the XorConstantRotation (XCR) Hybrid8–Shadow round-material generator, and a reversible Key Switch Layer. For every 128-bit data block, the core is invoked with a 128-bit key and a one-time public input number_once; the implementation supports counter-indexed block processing by assigning distinct number_once values to successive blocks. Authentication is not implemented inside the LOPC core: authenticated encryption must be obtained by composing the core with an external MAC or AEAD wrapper. The paper gives a code-faithful specification of the current construction, including the diagonal NeoAlzette placement, XCR-derived round material, keyed switching, and the keyed bit-position tweak. For the NeoAlzette component, it provides local differential and linear MILP boxes, fixed-public arithmetic oracle interfaces, and a mathematical oracle-to-MILP backbone for MEDCP/MELCC-style single-characteristic searches. The current artifact additionally reports one-round 12-hour SCIP incumbent campaigns for differential and linear NeoAlzette characteristics; these are trace/oracle-consistent incumbents, not solver-certified optima. For XCR, it specifies the Hybrid8 byte layer, the zero-fill Shadow arithmetic operators, the non-padded polynomial-Weyl constant stream, and the exact component-oracle boundary; full pseudorandom-generator security of XCR is not claimed. The manuscript separates component-local evidence from composition-level security claims. It proves round invertibility of the specified core and records the current component-analysis infrastructure, but it does not claim a complete AEAD mode, a full PRP/PRG proof for the LOPC composition, or complete endpoint differential/linear hull bounds unless the corresponding endpoint enumeration is explicitly complete. The repository also contains a separate OPC companion block-cipher artifact; Appendix B records its artifact boundary, but OPC is not analyzed as part of the LOPC security claims. Keywords: ARX cryptography, lightweight symmetric encryption, NeoAlzette ARX-box, XorConstantRotation, round-material generation, counter-indexed block processing, keyed switching, shadow-boxed arithmetic, Hybrid8, MEDCP, MELCC, MILP trail search, endpoint HULL, implementation artifact

Batched encryption (BE) has emerged as a novel public-key cryptographic paradigm that enables the efficient decryption of a designated batch of $B$ ciphertexts simultaneously. By incorporating threshold decryption capabilities into this framework, batched threshold encryption (BTE) further decentralizes the decryption process. While both BE and BTE serve as highly effective solutions for mitigating Miner Extractable Value (MEV) attacks in blockchain networks by providing robust mempool privacy, ciphertext integrity, and communication efficiency, they still suffer from heavy computational overhead during the ciphertext decryption phase. In this paper, we address this computational bottleneck by introducing a novel framework that delegates the heavy decryption workloads to an untrusted cloud server while enabling verifiability of the outsourced computations. To achieve this, we first propose an outsourced batched identity-based encryption (O-BIBE) scheme by integrating outsourcing functionalities into the conventional BIBE paradigm, accompanied by a rigorous security proof. We then construct a verifiable outsourced batched encryption (VOBE) scheme by strategically combining O-BIBE with other core cryptographic building blocks and formally prove its security. To eliminate the single point of failure and enhance threshold resiliency, we extend our framework to the threshold setting by developing an outsourced threshold batched identity-based encryption (O-TBIBE) scheme. Building upon this, we propose a verifiable outsourced batched threshold encryption (VOBTE) scheme, which successfully achieves decentralized threshold resilience. Our proposed VOBE and VOBTE schemes are the first to concurrently guarantee ciphertext integrity and mempool privacy against sophisticated blockchain attacks, while significantly reducing decryption costs via efficient and verifiable outsourcing.

Integrating Real-World Assets (RWA) into Decentralized Finance (DeFi) enables borrowers to leverage off-chain assets for on-chain transactions. However, this integration faces a critical security challenge: ensuring that private asset data, utilized within cryptographic proofs, is authenticated by and cryptographically bound to a trusted issuer. Existing solutions, such as decentralized identifiers (DIDs) and oracles, fail to simultaneously satisfy the requisite security standards and performance constraints. To address this, we propose Real-world Qualification Proof (RQP), a cryptographic protocol designed for the privacy-preserving verification of off-chain asset qualifications. RQP introduces a new primitive, Witness-Hiding Authentication (WHA), which operates in conjunction with zk-SNARKs. WHA enables asset issuers to authenticate RWA data, allowing the on-chain smart contract to efficiently verify the binding relationship between the issuer's authentication and the borrower's zero-knowledge proof. The proposed WHA effectively anchors the data privacy guarantee of RQP within the zero-knowledge property of the proof system while ensuring source authenticity. Furthermore, to ensure scalability and minimize on-chain gas costs, we adopt zk-rollup methodologies and employ the Inner Product Argument (specifically MIPP) to aggregate multiple RQP proofs. This yields a protocol that is not only secure and private but also computationally efficient for high-throughput DeFi applications. Experiments show that logarithmic verification efficiency optimization can be achieved in the multi-borrower proof scenario.

We show how to improve rank-metric solvers when certain side information (hints) about the secret is available. Concretely, we adapt the kernel search algorithm for MinRank and the GRS algorithm for the Rank Syndrome Decoding problem when some entries in the rank decomposition of the error matrix are known. This setting is motivated by side-channel leakage and cryptographic applications: Mirath and RYDE, two signature candidates in the NIST post-quantum competition, rely on these problems and employ secret keys in this decomposed form. As a main technical ingredient, we give an optimal procedure for guessing a subspace containing the row space of a systematic matrix given only partial knowledge of its entries. Further, we describe a profiling side-channel attack on the reference implementation of Mirath to demonstrate the plausibility of obtaining such hints.

Multivariate quadratic (MQ) signature schemes such as MAYO are among the leading candidates for post-quantum digital signatures, with security relying on the hardness of solving systems of multivariate quadratic equations. In this paper, we present a fault-assisted man-in-the-middle attack targeting the key-generation procedure of MAYO. Specifically, we target the computation of the public key, which is represented as a system of $m$ quadratic polynomials. Following the MAYO specification, each polynomial is associated with a matrix representation composed of the components $P_i^{(1)}, P_i^{(2)}$, and $P_i^{(3)}$. Our attack injects a single fault during the computation of the $P_i^{(3)}$ component of the public key, causing the resulting public key to satisfy a simplified linear relation involving the secret oil matrix. From the faulty public key, we derive an overdetermined linear system over $F_{16}$ that enables complete recovery of the secret oil matrix. Unlike previous fault attacks that primarily target the signing algorithm, our attack targets the key generation procedure to recover the oil secret and exploit the recovered oil secret to reconstruct the legitimate public key corresponding to the victim's secret key i.e correcting the public key. This allows the adversary to transparently participate in the communication as a man-in-the-middle, producing valid signatures on behalf of the victim. We evaluate the attack on a fault simulated MAYO implementation and demonstrate successful recovery of the oil matrix from a single faulty key-generation execution followed by public key correction.

The Hidden Weight Bit Function (HWBF) has drawn considerable attention for its simplicity and cryptographic potential. Despite its ease of implementation and favorable algebraic properties, its low nonlinearity limits its direct application in modern cryptographic designs. In this work, we revisit the HWBF and propose a new weightwise quadratic variant obtained by combining the HWBF with a bent function. This construction offers improved cryptographic properties while remaining computationally efficient. We analyze the balancedness, nonlinearity, and other criteria of this function, presenting theoretical bounds and experimental results to highlight its advantages over existing functions in similar use cases. The different techniques we introduce to study the nonlinearity of this function also enable us to bound the nonlinearity of a broad family of weightwise quadratic functions, both theoretically and practically. We believe these methods are of independent interest.

We generalise a pairing on elliptic curves over finite fields, called the generalised Tate pairing, which is defined in terms of an arbitrary endomorphism of the curve, with certain trace requirements. We rederive this pairing from group cohomology, which allows us to generalise the pairing to principally polarized abelian varieties over any field, endomorphisms of any trace, and prove perfectness using a general duality theorem.

Elliptic-Curve Cryptography (ECC) found in Zero-Knowledge Proofs (ZKPs) protects assets worth more than a billion dollars on privacy-preserving blockchain networks. There, the transaction rate is mostly limited by the computational cost of Multi-Scalar Multiplications (MSMs). Thus, hardware acceleration of these operations, for instance, using FPGAs, is of interest. Current accelerators leverage the Pippenger algorithm to compute the MSMs. Due to data dependencies, the algorithm’s performance is affected by the latency of the internal modular multipliers. Typically, these multiplications are realized using Montgomery multipliers. A promising variant of this algorithm is LogJumps, which offers potential for parallelism and lower latency. This is achieved by reducing data dependencies within the Montgomery reduction. Yet, prior work has neither formalized nor explored a low-latency, hardware-friendly parallel realization of this method. We address this gap by formalizing parallelism in LogJumps and presenting the first practical, truly parallel LogJumps architecture for the BLS12-377 prime. Our modular multiplication design achieves up to 56% lower latency than the lowest-latency multiplier in the ZPRIZE 2022, while maintaining a 250 MHz frequency and throughput. Furthermore, we reduce the MSM latency by up to 1.85× using a full-point adder pipeline, while our logic consumption increases by only 1.32×.

Hints are a concept from side-channel analysis referring to small amounts of information that enable an adversary, via a potentially very efficient procedure, to extract the secret. We take this cryptanalytic concept and give it a constructive make-over. We formalize a short $\Sigma$-protocol based on the famous Goldreich, Micali, Wigderson protocol, in which the responses are not of the full witness size, but are only small hints. The hints can be used to extract the full response. We show that under our formalization, these protocols preserve the security properties of $\Sigma$-protocols. We instantiate a practical protocol using a group action from tensor isomorphism and an efficient extracting procedure borrowed from an attack by Narayanan et al. on the MEDS signature scheme. We derive a signature scheme, called miniMEDS, which demonstrates practically the benefits of our hint-based construction, allowing for 22%-24% reduction in signature size compared to the latest updated parameters of MEDS.

Stateful hash-based signature schemes like LMS and XMSS are built on the Winternitz one-time signature. The effect of state reuse for these schemes has been shown to be disastrous [1][2]. This paper shows that the signer can mitigate this effect if a state is reused only once. This is achieved by repeating the randomized hashing step until a hash value with specific properties is found. Our results show that at least 80 bits of security can be achieved in 99% of the key reuses, an improvement of 49 bits. This requires the signer to repeat the randomized hashing step 1.4 million times on average. Slightly lower security can be reached with much less hashing.

We present Aggios, a scalable and privacy preserving proxy voting system designed for frequent and large-scale elections such as Decentralized Autonomous Organizations (DAO), when storing votes on the bulletin board is expensive. To this end, Aggios introduces `aggregators': entities to which voters delegate their votes, and who then post their batched proofs on the public ledger. Aggios achieves strong integrity guarantees: only authorized voters can vote, votes are counted correctly, voters are assured their vote is counted. At the core of Aggios, lies a novel zero-knowledge argument, which we call the Extended Partition Argument (EPA), that allows a prover to demonstrate that a committed vector can be decomposed into multiple disjoint ``subvectors'' forming a partition, each subvector of public (or not) sizes. The argument is compatible with a universal SRS, does not require precomputation, and offers efficient proving and verification complexity. We prove security of the EPA in the algebraic group model. Our implementation of EPA shows suitability of the argument even for very large vectors. Using the EPA as the central block to Aggios, we show that our voting scheme is at least 512 times more compact than naive casting of $N$ votes, and can even be size-independent of the number of voters in the optimal case, thus offering a practical route to frequent and privacy-preserving voting at scale.

In 2020, a coordinated law-enforcement effort infiltrated Encrochat, an end-to-end encrypted service provider, exfiltrating historical and real-time data and metadata over months. Encrochat was used extensively by organised crime, and the data from the operation was used as supporting evidence in over 6,000 arrests and related prosecutions across Europe. Encrochat's architecture was vertically integrated, with the company acting as both a device vendor and service provider; Encrochat sold modified Android smartphones with its own PKI and custom applications, including encrypted messaging based on the Signal protocol. In this work, we give the most detailed public account to date of Encrochat's infrastructure and how it was compromised.

We give a new algorithm to attack RSA with small private exponent, when some partial information of $p + q$ is given. The algorithm is a very simple modification of original Wiener’s attack with continued fractions, and allows us to factor $n$ whenever $d<n^{(1+\delta)/2}$ if we know a $δ$-fraction of the most significant bits of $n$. The algorithm is unconditional, which is not the case in previous improvements that use Coppersmith method. As a simple example, our algorithm can be applied to break any cryptosystem with modulus $n$ of $512$ bits and $d < n^{0.3}$, given an improvement in the original. attack of Wiener.

We explicitly construct and benchmark the first lattice-based IVC scheme from folding. The scheme supports customizable constraint systems over rings which we exploit to obtain proofs of correct execution of an FHE bootstrapping, a critical component of verifiable FHE. Notably and of independent interest, we introduce a novel CCS relation capable of performing automorphism stability checks which yields better expressivity for CCS over rings. We use this new relation to arithmetize the folding scheme verifier as well as TFHE's bootstrapping operation, and measure the performance of our folding scheme implementation on this arithmetization. Benchmarks indicate smaller proofs compared to the state of the art at the cost of a sharp increase in prover and verifier time. Lastly, we consider the security of folding-based IVC schemes with a super-constant number of recursive rounds and give an argument for the knowledge soundness of our construction in the ROM. Our work also discusses and highlights key open questions for future work, such as the design of hash functions over rings that permit efficient arithmetizations.

We consider the problem of computing the variance and tail probability bounds for the weight of the product $z = x \cdot y$ of two random polynomials $x, y \in \F_2[X]/(X^n+1)$, where the weight of a binary polynomial is defined as the number of its nonzero coefficients. We investigate two probabilistic models for $x$ and $y$: the \emph{uniform slice} model, where the weights are fixed to $w_x$ and $w_y$, and the \emph{binomial} model, where the coefficients are independent Bernoulli variables with parameters $p_x$ and $p_y$. Our analysis is directly motivated by the need for accurate security analysis of the error vector of the HQC code-based encryption scheme. Prior work has progressed from heuristic arguments backed by extensive simulations to exact computations of the probability mass function (PMF) of the weight of the error vector; however, these computations were largely restricted to the uniform slice setting. We adopt a different approach, leveraging the full covariance structure of the product vector $z$ (i.e., the pairwise covariances of its coefficients) to derive tight, rigorously proven bounds on the tail probabilities of its weight for both the uniform and binomial models. These results confirm HQC's security guarantees and, moreover, reveal additional symmetry properties of the HQC error vector that are desirable for cryptographic design.

Every formally verified system embeds a verification boundary: the interface between code with machine-checked proofs and code that is trusted without them. We study what happens when this boundary is not communicated clearly. Through a case study of CE Labs's libcrux and hpke-rs cryptographic libraries, we present thirteen vulnerabilities that escaped formal verification. Nine reside in unverified code, including a cross-backend endianness bug that caused real decryption failures in Signal's post-quantum ratchet, a missing mandatory X25519 validation, nonce reuse via integer overflow, and two FIPS~204 specification violations in the ML-DSA verifier. Four reside in formally verified specification and proof code: in ML-KEM, a wrong decompression constant, a missing inverse NTT, and a false serialization proof; in ML-DSA, a wrong multiplication specification that renders axiomatized AVX2 proofs unsound. From these findings, we develop a taxonomy of five verification boundary failure types, a lightweight auditing methodology for detecting them, and a comparative analysis with AWS's verified libcrypto. The same failure types arise in both projects, but their management---through systematic documentation, proof execution in CI, and clear scope communication---varies significantly. We call the gap between verification claims and verification reality "verification theatre", and propose concrete practices for closing it.

The secure management of private keys is a fundamental challenge, particularly for the general public, as losing these keys can result in irreversible asset loss. Traditional custodial approaches pose security risks, while decentralized secret sharing schemes offer a more resilient alternative by distributing trust among multiple parties. In this work, we extend an existing decentralized, verifiable, and extensible cryptographic key recovery scheme based on Shamir's secret sharing. We introduce a refresh phase that ensures proactive security, preventing long-term exposure of secret shares. Our approach explores three distinct methods for refreshing shares, analyzing and comparing their security guarantees and computational complexity. Additionally, we extend the protocol to support any monotone access structure, enabling the most general and fine-grained control over key reconstruction.

Multi-Scalar Multiplication is a critical operation in most pairing-based zero knowledge proofs. In a lot of studies, memory limitations have often been reported to be the primary bottleneck preventing the calculation of larger MSMs. In this paper, we are particularly interested in the acceleration of this operation on devices with limited memory. Pippenger’s algorithm (also known as bucket method) is the most efficient and, consequently, the most widely used method to calculate Multi-Scalar Multiplications. We propose an optimization of Pippenger’s algorithm which is at least as efficient as the original, and significantly more effective when operating under limited memory. The main idea is to use an adapted number of buckets depending on the available memory instead of $2^w −1$. We conducted tests on the curve BLS12-381 with Multi-Scalar Multiplications ranging from $2^8$ to $2^{14}$ points. The results obtained demonstrate that we have a very significant gain (up to $40\%$) for very limited memories. This gain gradually decreases as more memory becomes available, until we achieve performance comparable to Pippenger’s once memory is no longer limited. For example, in a Multi-Scalar Multiplication with $2^{13}$ points, we observe a gain of $40\%$ with only $1$ KB of memory, $20\%$ with $15$ KB, $15\%$ with $35$ KB, and so on, down to $1.5\%$ once memory is no longer a constraint.

Cryptographic signatures play an integral part in ensuring authenticity and integrity in digital systems. Their security crucially relies on the secrecy of the signing key, since knowledge of this key enables an adversary to generate valid signatures on any message. Once a signing key is compromised, the standard countermeasure is to revoke the corresponding public key and to invalidate all signatures produced for this key. However, with this approach even legitimate signatures created by the honest signer would retroactively lose their validity. In this work, we initiate the formal study of a new approach - Signatures with Post-Compromise Accountability (SPCA) - which provides security guarantees even after the secret key was compromised. This notion effectively introduces a grace period for the legitimate key owner, during which the validity of honestly generated signatures is preserved despite the adversary’s knowledge of the secret key. We formally define SPCA and its security guarantees, and present two constructions achieving this notion. Our first construction generalizes the signature-in-signature approach of Błaśkiewicz et al. (ESORICS '21), where an inner signature is embedded into the randomness of an outer signature. This construction, however, requires revealing the signing secret key during revalidation. Our second construction overcomes this limitation by enabling revalidation without disclosing the secret key, yielding stronger security guarantees.

One-shot signatures (OSS) are a powerful and uniquely quantum cryptographic primitive which allows anyone, given common reference string, to come up with a public verification key $\mathsf{pk}$ and a secret signing state $\ket{\mathsf{sk}}$. With the secret signing state, one can produce the signature of any one message, but no more. In a recent breakthrough work, Shmueli and Zhandry (CRYPTO 2025) constructed one-shot signatures, either unconditionally in a classical oracle model or assuming post-quantum indistinguishability obfuscation and the hardness of Learning with Errors (LWE) in the plain model. In this work, we address the inefficiency of the Shmueli-Zhandry construction which signs messages bit-by-bit, resulting in signing keys of $\Theta(\lambda^4)$ qubits and signatures of size $\Theta(\lambda^3)$ bits for polynomially long messages, where $\lambda$ is the security parameter. We construct a new, simple, direct, and efficient one-shot signature scheme which can sign messages of any polynomial length using signing keys of $\Theta(\lambda^2)$ qubits and signatures of size $\Theta(\lambda^2)$ bits. We achieve corresponding savings in runtimes, in both the oracle model and the plain model. In addition, unlike the Shmueli-Zhandry construction, our scheme achieves perfect correctness. Our scheme also achieves strong signature incompressibility, which implies a public-key quantum fire scheme with perfect correctness among other applications, correcting an error in a recent work of Çakan, Goyal and Shmueli (QCrypt 2025) and recovering their applications.

Ensuring the integrity and traceability of data transformations in distributed systems presents significant challenges, particularly in environments where data privacy and decentralization are paramount. This paper introduces a novel secure lineage verification system based on Directed Acyclic Graphs (DAGs) and homomorphic hash functions, VERDICT. Our approach represents data artifacts and their transformations as two interconnected DAGs: a Data DAG tracking data dependencies and an Event DAG capturing causality between transformation events. We propose a level-based DAG compression technique that decomposes these graphs based on distance from genesis nodes, enabling efficient verification through skip DAG structures. The system incorporates bucket indexing and Merkle tree verification to provide cryptographic guarantees of data and event existence. We present formal algorithms for DAG construction, level-based hashing, skip DAG traversal, and verification processes. Security analysis demonstrates the system’s resistance to tampering and modification attacks while maintaining privacy. Replay attacks are prevented through an application-layer challenge-response mechanism. Our approach has significant applications in federated learning environments and decentralized architectures, where it can serve as a notary component for tracing events without compromising data confidentiality. Theoretical analysis shows that our method achieves verification in 𝑂(log𝑛) time in the number of DAG levels, independent of the number of nodes per level, making it suitable for large-scale distributed systems.

We study the design of a privatization mechanism and privacy accounting in the Pufferfish Privacy (PP) family. Specifically, motivated by the curse of dimensionality and lack of practical composition tools for iterative learning in the recent Rényi Pufferfish Privacy (RPP) framework, we propose Sliced Rényi Pufferfish Privacy (SRPP). SRPP preserves PP/RPP semantics (customizable secrets with probability-aware secret–dataset relationships) while replacing high-dimensional Rényi divergence with projection-based quantification via two sliced measures, Average SRPP and Joint SRPP. We develop sliced Wasserstein mechanisms, yielding sound SRPP certificates and closed-form Gaussian noise calibration. For iterative learning systems, we introduce an SRPP-SGD scheme with gradient clipping and new accountants based on History-Uniform Caps (HUC) and a subsampling-aware variant (sa-HUC), enabling decompose-then-compose privatization and additive composition under a common slicing geometry. Experiments on static and iterative privatization show that the proposed framework exhibits favorable privacy–utility trade-offs, as well as practical scalability.

Digital identity systems are being deployed worldwide to enable secure, privacy-preserving authentication. In this regards, Europe's EUDI Wallet mandates selective attribute disclosure and unlinkable authentication, effectively requiring anonymous credentials. Yet current proposed solutions omit them because they lack device binding: tying a credential to a secure hardware element on the user's device to prevent cloning or sharing. Device binding encodes a device public key in the credential and, at presentation time, produces a fresh signature under the hardware-protected secret key -- a proof-of-possession (PoP). While academic solutions for device binding exist, they require pairing-friendly curves, whereas consumer phones are restricted to ECDSA over P-256. In this work, we bridge this gap by enabling device binding of pairing-based credentials using the device's standard ECDSA signature as the PoP. To explore the efficiency–complexity trade-off of such solution, we present three constructions. Our most efficient solution generates unlinkable binding proofs of size ~1.5kB in under ~400ms using a simple arithmetic circuit, whereas the most conservative circuit-free approach matches this proving time at ~122kB. All solutions follow a common blueprint expressed in the reductions of knowledge framework (Crypto 2023), which enables modular composition of zero-knowledge proofs and eases both security analysis and implementation. This framework has previously been mainly used in a theoretical context, and our work demonstrates that it is a powerful tool to design, analyze and implement advanced real-world systems.

In this paper we study the S-box known as Chi or \chi initially proposed by Daemen in 1995 and very widely used ever since in Keccak, Ascon, and many other. This type of ciphers is typically analyzed [in recent research] in terms of subspace trail attacks [TeDi19] and vector space invariants. An interesting question is then, when different spaces are mapped to each other by translations with a constant. In this paper we relax this fundamental question and we consider arbitrary sets of points and their translations. We generalize previous S-box partial linearization results on Keccak and Ascon from Eurocrypt 2017. We basically introduce new ways to linearize the Ascon S-box to the maximum possible extent. On this basis we show further remarkable properties and some surprising connections between [simultaneous] linear and [prominent] differential properties. We exhibit a new family of maximum size and optimal approximation properties with 11 points, beyond the maximum size of any set in the DDT table. We prove a theorem which guarantees that this type of properties are stable by arbitrary input-side translations which holds for all quadratic permutations. All this will be placed in the context of previous work on classification of 5-bit quadratic permutations.

Accurate measurements of user engagement underpin important decisions in various settings, such as determining advertising fees based on viewership of online content, allocating public funding based on a clinic’s reported patient volume, or determining whether a group chat app disseminated a message without censorship. While common, self-reporting is inherently untrustworthy due to misaligned incentives (e.g., to inflate). Motivated by this problem, we introduce the notion of Verifiable Aggregate Receipts (VAR). A VAR system allows an issuer to issue receipts to users and to verify the number of receipts possessed by a prover, who is given receipts upon serving users. An ideal VAR system should satisfy inflation soundness (the prover cannot overstate the count), privacy (the verifier learns only the count), and be performant for large-scale applications with millions of users. We formalize VAR using an ideal functionality and present two novel constructions. Our first protocol, S-VAR, leverages bottom-up secret-sharing to enable tiered ''fuzzy'' audits, and achieves constant-size receipts regardless of the number of supported thresholds. Our second protocol, P-VAR, uses bilinear pairings to aggregate receipts into a proof verifiable in constant time, enables exact auditing, and can be extended to handle a dynamic user set. We prove both constructions secure with respect to our ideal functionality. We implement and benchmark our VAR constructions, showing that they outperform all baseline and existing solutions by at least an order of magnitude in both proving and verification time. Finally, we show how VAR applies to the aforementioned use cases and further demonstrate its practicality by integrating it with Bluesky, a decentralized social network.

Federated learning (FL) proposes to train a global machine learning model across distributed datasets. However, the aggregation protocol as the core component in FL is vulnerable to well-studied attacks, such as inference attacks, poisoning attacks [71] and malicious participants who try to deviate from the protocol [24]. Therefore, it is crucial to achieve both malicious security and poisoning resilience from cryptographic and FL perspectives, respectively. Prior works either achieve incomplete malicious security [76], address issues by using expensive cryptographic tools [22, 59] or assume the availability of a clean dataset on the server side [32]. In this work, we propose AlphaFL, a two-server secure aggregation protocol achieving both malicious security in the universal composability (UC) framework [19] and poisoning resilience in FL (thus malicious$^2$) against a dishonest majority. We design maliciously secure multi-party computation (MPC) protocols [24, 26, 48] and introduce an efficient input commitment protocol tolerating server-client collusion (dishonest majority). We also propose an efficient input commitment protocol for the non-collusion case (honest majority), which triples the efficiency in time and quadruples that in communication, compared to the state-of-the-art solution in MP-SPDZ [46]. To achieve poisoning resilience, we carry out $L_\infty$ and $L_2$-Norm checks with a dynamic $L_2$-Norm bound by introducing a novel silent select protocol, which improves the runtime by at least two times compared to the classic select protocol. Combining these, AlphaFL achieves malicious$^2$ security at a cost of 25% − 79% more runtime overhead than the state-of-the-art semi-malicious counterpart Elsa [76], with even less communication cost.

Zero-Knowledge Succinct Non-interactive Arguments of Knowledge (zkSNARKs) are important cryptographic primitives critical in many real-world applications. zkSNARKs are not used in isolation but are deployed within a broader context in which other cryptographic protocols may be concurrently executed. Universal-Composability (UC) allows rigorous analysis of cryptographic primitives being used in such arbitrary contexts. A UC analysis is even more desirable for popular, well-audited, and heavily deployed zkSNARKs already being used in practice. Prior works that study the UC security of existing zkSNARKs (without modifications) are either not modular, hence requiring case-by-case analysis for new proof systems, or have largely focused on zkSNARKs in the Random Oracle Model (ROM). The latter includes zkSNARKs with logarithmic proof sizes compiled from Interactive Oracle Proofs. This state of the art leaves out a large family of very efficient, often constant-size, zkSNARKs that rely on the Algebraic Group Model (AGM) and optionally on the ROM. This includes zkSNARKs compiled from Polynomial Interactive Oracle Proofs, such as Plonk and Marlin, among others. In this work, we address the UC security for unmodified zkSNARKs that are proven secure in AGM (+ROM). Our approach is modular: we identify simple, and mostly standard properties on the underlying zkSNARK that imply UC security. We observe that checking these properties for existing zkSNARKs is a surprisingly simple task using the rigorous formulation of AGM from Jaeger and Mohan (CRYPTO’24). The simplicity and modularity of our framework makes it easy-to-use for concluding UC security of several zkSNARKs in the same setting. Concretely, using our framework we establish that Plonk and Marlin are UC secure without any overhead.

Motivated by new attack vectors against key encapsulation mechanisms (KEMs), a framework for binding security has recently been introduced and has since been widely used for analyzing post-quantum schemes. While the migration to such post-quantum schemes has already started, classical KEMs remain relevant due to the use of hybrid schemes, which combine post-quantum and classical KEMs. However, KEMs based on classical schemes have not been analyzed with respect to their binding security yet. Moreover, recent work revealed a connection between KEM combiners and binding security, showing that schemes for which a certain binding notion is fulfilled can be used more efficiently in combiners. In this work, we address the lack of a binding security analysis for classical KEMs and examine the implications of our results for combiners. More precisely, we consider KEMs built from classical cryptographic schemes such as Diffie-Hellman (DH) and RSA, as illustrated by NIST in SP 800-227. We cover KEMs based on (elliptic-curve) Diffie-Hellman, X25519, RSA, and RSA-OAEP. Due to structural similarities to the other DH schemes and since it has not been analyzed so far with respect to its binding security, we also include the post-quantum scheme CSIDH. Our analysis yields mixed results for the KEMs under consideration, with both binding attacks as well as proofs. Where possible, we propose minor modifications to the schemes, which improve their binding security.

We present Bulletproofs* (BP*, BulletproofsStar), a folding scheme for arithmetic circuit proofs under standard assumptions and without preprocessing, i.e., for the arithmetic circuit satisfiability language of Bulletproofs (S&P 18), following the recipe of ProtoStar (ePrint 2023/620). To this end, we first adapt the algebraic verifiers of the arithmetic circuit proof of Bulletproofs to the algebraic form required by ProtoStar, and prove that the modified protocol remains secure. Then, we design the Bulletproofs* folding scheme that is complete and knowledge-sound. Finally, we analyze the resulting verifier cost after the folding-to-IVC transformation. The result shows an asymptotic linear gain compared to repeated invocations of the monolithic Bulletproofs verifier.

Hybrid Homomorphic Encryption (HHE) is emerging as a practical alternative to fully homomorphic encryption by offloading computational overhead to the cloud. Despite the growing number of HHE schemes and implementations, no unified evaluation methodology currently exists. In this work, we present a comprehensive and reproducible benchmarking framework covering both standard and HE-friendly HHE schemes. We analyze and evaluate 19 open-source HHE frameworks, comprising 218 distinct ciphers' benchmarks, across diverse HE libraries and programming languages. To ensure fair comparison, we interpret the main results under an HHE-128 security target, separating standardized or author-claimed 128-bit settings from below-target measurements. Our contributions include a unified repository, a language-agnostic benchmarking tool, and detailed metrics on runtime and memory usage. The results offer actionable insights into the security-aware performance trade-offs of each design and lay the groundwork for standardizing future HHE evaluations.

Functional Encryption (FE) is a cryptographic technique established to guarantee data privacy while allowing the retrieval of specific results from the data. While traditional decryption methods rely on a secret key disclosing all the data, FE introduces a more subtle approach. The key generation algorithm generates function-specific decryption keys that can be adaptively provided based on policies. Adaptive access control is a good feature for privacy-preserving techniques. Generic schemes have been designed to run basic functions, such as linear regression. However, they often provide a narrow set of outputs, resulting in a lack of thorough analysis. The bottom line is that despite significant research, FE still requires appropriate constructions to unleash its full potential in securely analyzing data and providing more insights. In this article, we introduce SPADE, a novel FE scheme that features multiple users and offers fine-grained access control through partial decryption of the ciphertexts. Unlike existing FE schemes, our construction also supports qualitative data, such as genomics, expanding the applications of privacy-preserving analysis to enable a comprehensive study of the data. SPADE is a significant advancement that balances privacy and data analysis with clear implications in healthcare and finance. To verify its applicability, we conducted extensive experiments on datasets used in sleep medicine (hypnogram data) and DNA analysis (genomic records).

Hybrid Homomorphic Encryption (HHE) is considered a promising solution for key challenges that emerge when adopting Homomorphic Encryption (HE). In cases such as communication and computation overhead for clients and storage overhead for servers, it combines symmetric cryptography with HE schemes. However, despite a decade of advancements, enhancing HHE usability, performance, and security for practical applications remains a significant stake. This work contributes to the field by presenting a comprehensive analysis of prominent HHE schemes, focusing on their performance and security. We implemented three superior schemes--PASTA, HERA, and Rubato--using the Go programming language and evaluated their performance in a client-server setting. To promote open science and reproducibility, we have made our implementation publicly available on GitHub. Furthermore, we conducted an extensive study of applicable attacks on HHE schemes, categorizing them under algebraic-based, differential-based, linear-based, and LWE-based attacks. Our security analysis revealed that while most existing schemes meet theoretical security requirements, they remain vulnerable to practical attacks. These findings emphasize the need for improvements in practical security measures, such as defining standardized parameter sets and adopting techniques like noise addition to counter these attacks. This survey provides insights and guidance for researchers and practitioners to design and develop secure and efficient HHE systems, paving the way for broader real-world adoption.

Post-quantum signatures built from Fiat--Shamir transforms of zero-knowledge identification protocols---including LESS, CROSS, and MEDS---use GGM-tree seed compression to shrink signatures, revealing only the seeds of public rounds while hiding the challenge-dependent ones. This mechanism introduces a fault-attack surface: faulting the seed-publication can expose hidden seeds alongside their zero-knowledge responses, enabling recovery of secret information. We introduce the Generic ZK Seed Tree (GZKST), a unified abstraction of GGM-tree generation, challenge partitioning, and seed publication across these schemes, and formalize its correctness and seed-hiding invariants. We show that prior attacks on LESS-v1 and LESS-v2 violate the same invariant despite targeting different implementation layers and tree constructions, derive generic key-recovery algorithms from this view, and bound the number of effective faulted signatures needed for full recovery---only a few successful queries suffice for every MEDS parameter set. We further demonstrate the attacks in practice through clock-glitch fault injection against the MEDS reference implementation on an ARM Cortex-M4 (ChipWhisperer-Lite), identifying multiple exploitable surfaces in tree traversal and path construction that enable complete tree disclosure, partial subtree recovery, or leakage of hidden leaves.

Organizations relying on RSA-OAEP encryption in protocols such as JWE, SAML, and OIDC face a critical challenge: transitioning to post-quantum cryptography without disrupting operational continuity. This paper presents a phased migration strategy that uses RSA-KEM-ML-KEM composite Key Encapsulation Mechanisms as an intermediary step between current RSA-OAEP encryption and the target state of pure ML-KEM adoption. We formalize the RSA-KEM-ML-KEM construction, prove IND-CCA2 security via a Split-Key PRF combiner, and integrate it into the Hybrid Public-Key Encryption (HPKE) framework. Our implementation demonstrates that composite schemes enable quantum-resistant encryption while preserving existing RSA key infrastructure, though with measurable throughput trade-offs that inform migration timelines. We analyze protocol-specific integration for JWE, SAML, and OIDC encryption use cases, providing decision frameworks for transitioning from RSA-OAEP through composite approaches to pure post-quantum encryption. This work contributes a formally analyzed transition mechanism and practical migration guidance for organizations seeking to adopt quantum-resistant encryption in RSA-dependent systems, validated through application to identity and access management protocols.

Algebraic attacks are an important class of cryptanalytic techniques for Poseidon/Poseidon2 and Neptune. These designs use partial S-box activation in internal rounds to reduce arithmetization cost, and this structure makes linear subspace trails an important technique in their algebraic analysis. If the state at some internal round is restricted to a suitable linear subspace, then several subsequent internal rounds can be linearized and therefore do not increase the degree of the polynomial system used to model the attack. Recent studies have explored such linearization and round-skipping techniques for algebraic attacks on Poseidon/Poseidon2 and Neptune. These techniques reduce the complexity of attacks by lowering the degree of the polynomial systems that model the attacked rounds. Consequently, a precise bound on the length of linear subspace trails is needed for a more accurate assessment of the algebraic security of these designs. We revisit infinite and finite linear subspace trails in Poseidon-like designs. First, motivated by previous work that relates infinitely long linear subspace trails to invariant subspaces of the linear layer, we revisit this phenomenon for the Cauchy MDS matrices used in Poseidon. We further give a quantitative heuristic estimate for the probability that such invariant subspace conditions occur under random parameter choices. Second, we analyze finite linear subspace trails for partial rounds in a general setting, where the state width is $t$ and each round activates $s$ S-box coordinates. Under the rank growth condition stated in this paper, when no such invariant subspace exists, a finite trail has length at most $\lceil t/s \rceil - 1$. For Poseidon, $s = 1$, this gives at most $t - 1$ consecutive linearized internal partial rounds. For the internal linear layers of Poseidon2 and Neptune, a similar conclusion applies. More precisely, if repeated diagonal entries in the lower-right block do not give rise to infinitely long linear subspace trails, then the maximum length of a finite linear subspace trail is exactly $t - 1$. Third, for preimage attacks in sponge mode with rate $r$, capacity $c$, and digest size $d$, the available extra constraint budget is $Ec = r - \min(c,d)$. For Poseidon/Poseidon2 and Neptune, the finite trail bound and this constraint budget together determine how many internal partial rounds can be linearized in the corresponding attack model.

Anamorphic encryption enables covert communication over public cryptographic channels while preserving the apparent correctness and security of the underlying cryptographic scheme, even against adversaries with access to secret keys. Classical formulations of anamorphic encryption emphasize zero-latency channels, where an anamorphic message is embedded within a single ciphertext; however, recent works show that achieving such guarantees typically requires highly structured constructions or strong, non-black-box assumptions. In this work, we explore a complementary point in the design space by relaxing strict zero-latency and introducing µ-message asymmetric anamorphic encryption (AAE), where a single anamorphic payload is distributed across a small number µ of ordinary cryptographic objects. Our first contribution is a general abstraction of µ-message AAE, which captures the ability of a cryptographic primitive to jointly encode hidden information across multiple independently generated objects, while remaining indistinguishable from honestly generated ones. We formalize corresponding security notions, including indistinguishability, and resistance to key exposure, and show how these notions naturally support asymmetric anamorphic settings where the encryption-side anamorphic key may be leaked without compromising the covert channel. Our second contribution is to demonstrate that relaxing strict zero-latency enables simple, black-box, and CCA-secure constructions of AAE from widely deployed cryptographic primitives, avoiding the need for specialized algebraic structure. In particular, we show how µ-message extensions can be instantiated in several representative and practically relevant settings: – We construct µ-message AAEs from standard PKE schemes, including ElGamal and Dual-Regev, without relying on additional group- or lattice- specific sampling algorithms and achieve strong security even against adversaries with full access to secret keys. – We show that µ-message extensions compose naturally with Fujisaki–Okamoto–style transforms, yielding the first generic approach to CCA-secure AAEs from a broad class of CPA-secure schemes satisfying mild pseudorandomness properties. – We extend the µ-message framework to the identity-based encryption (IBE) and signature settings by introducing IBAE and asymmetric anamorphic signatures (AAS), illustrating that asymmetric anamorphism can be realized even in centralized, authority-driven systems and in authentication-only settings. Finally, we introduce stream anamorphism notifiers, lightweight mechanisms that allow a receiver to efficiently locate and extract anamorphic content from a stream of cryptographic objects. Overall, our results highlight a clear trade-off between latency, deployability, and security, and show that relaxing zero-latency yields a practically relevant and theoretically clean pathway to strong anamorphic guarantees.

We introduce a simple yet novel framework for privacy-preserving machine learning inference that allows a client to query multiple models without a trusted third party aggregator by leveraging homomorphically encrypted model evaluation and multi-party computation. This setting allows for dispersed training of models such that a client can query each separately, and aggregate the results of this `ensemble inference'; this avoids the data leakage inherent to techniques that train collectively such as federated learning. Our framework, which we call MIOPE, allows the data providers to keep the training phase local to provide tighter control over these models, and additionally provides the benefit of easily retraining to improve inference of the ensemble. MIOPE uses homomorphic encryption to keep the querying client's data private and multi-party computation to hide the individual model outputs. We illustrate the design and trade-offs of input- and output-hiding ensemble inference as provided by MIOPE and compare performance to a centralized approach.We evaluate our approach with a standard dataset and various regression models and observe that the MIOPE framework can lead to accuracy scores that are only marginally lower than centralized learning. The modular design of our approach allows the system to adapt to new data, better models, or security requirements of the involved parties.

We prove a folklore characterization of the BN pairing subgroup as the kernel of a relative trace map on the $n$-torsion points.

Approval phishing is a form of Web3 phishing that exploits token approval mechanisms to trick users into granting attackers spending authority over their tokens. As attackers increasingly hijack legitimate websites, URL-based detection alone becomes insufficient, leaving crypto wallets as the last line of defense. Based on the characteristics of approval mechanisms, we propose four wallet-based interventions for mitigating approval phishing: Spending Cap Suggestion, Active Spender Warning, Passive Spender Warning, and Delayed Confirmation. We evaluate the interventions through a between-subjects experiment (n = 364) and semi-structured interviews (n = 23). Compared with the control group, the Spending Cap Suggestion condition significantly increases the likelihood that users set spending caps. The Active Spender Warning, Passive Spender Warning, and Delayed Confirmation conditions all increase cancellation rates of phishing tasks, although the increases are statistically significant only for Active Spender Warning and Delayed Confirmation conditions. The effectiveness of the interventions varies across users, as users may struggle to interpret suspicious cues and focus on transaction outcomes while overlooking approval details. Our findings highlight the need to strengthen defenses against such attacks by increasing users' awareness of post-approval consequences and supporting approval-parameter verification at the moment of authorization.

Transport Layer Security (TLS) attestation protocols are a key building block for decentralized applications that require authenticated off-chain data. However, existing Designed Commitment TLS (DCTLS) constructions rely on designated verifiers, which prevents public verifiability and enables prover--verifier collusion in on-chain settings. To address these limitations, we propose a collusion-minimized TLS attestation framework $\Pi_{\mathrm{coll\text{-}min}}$ that extends existing DCTLS protocols to support jointly verifiable attestations with distributed verifiers. The framework combines two complementary components: dx-DCTLS, a generic transformation layer that upgrades existing DCTLS constructions into exportable variants by replacing non-verifiable components with verifiable counterparts, and a decentralized validation layer based on distributed verifiable random functions (DVRFs) and a threshold signature scheme (TSS). Together, these two components allow multiple verifiers to jointly validate TLS attestations while minimizing prover--verifier collusion. In this study, we formalize a threshold attestation unforgeability notion capturing adversarial behaviors in multi-verifier environments and prove security under standard assumptions. Specifically, by transitioning from independent multi-session validations, as commonly employed in decentralized oracle networks (DONs), to a unified and exportable attestation framework, we eliminate the per-verifier repetition on the prover side. Consequently, the prover complexity is reduced from $O(n)$ to $O(1)$. To evaluate practicality, we provide an end-to-end prototype implementation of $\Pi_{\mathrm{coll\text{-}min}}$ and compare it against a DECO-based replication baseline. The results show that the proposed framework remains efficient at high threshold sizes and introduces only modest additional overhead, demonstrating the feasibility of collusion-minimized and jointly verifiable TLS attestations for smart contract environments.

The resistance of provably secure masked circuits to physical attacks depends in part on the underlying algebraic group and recombination function. Masking over finite fields of odd prime order has been demonstrated, both in theory and in practice, to provide increased natural resistance to side-channel and fault attacks. Its instantiation with a simple additive encoding and implementation-friendly prime modulus was suggested to lead to favorable tradeoffs between security and performance in prior works. To most efficiently leverage these advantages, a family of lightweight Tweakable Block Ciphers (TBCs) called Feistel for Prime Masking (FPM) has been introduced by Grassi et al. at Eurocrypt'24, together with a first hardware-oriented instance called small-pSquare. Yet, barriers for the use and further development of prime-field masking continue to exist and include the lack of automated verification tools compatible with arithmetic over Fp, as well as efficient methods for constant-time generation of uniformly distributed randomness over the field. In this work we tackle these barriers and present our findings from formally verifying, securely integrating and physically evaluating higher-order masked implementations of small-pSquare as an exemplary case study. Our integration includes the tape-out of an Application-Specific Integrated Circuit (ASIC) manufactured in 65 nm technology and a custom Printed Circuit Board (PCB). We demonstrate how to securely verify prime-field masked circuits with existing tools such as SILVER, MATCHI and PROLEAD and certify the glitch+transition robustness of our concrete implementations. Along the way we discover and solve a 0-issue originating from incomplete modulo reductions which is present in public source codes of masked prime-field ciphers but has never been discussed. We also introduce Privium, a Bivium-inspired primitive, to efficiently produce random values uniformly distributed over Fp without the need for rejection sampling. We then describe our efficient serialized pipelined small-pSquare architecture enabling an attractive tradeoff between area and latency and compare its pre- and post-layout implementation figures. Finally, we experimentally demonstrate the strong leakage resistance of our formally verified circuits on real silicon.

A verifiable delay function (VDF) requires a specified number of sequential steps to compute, yet the validity of its output can be verified efficiently, much faster than recomputing the function from scratch. VDFs are a versatile cryptographic tool, with many industrial applications, such as blockchain consensus protocols, lotteries and verifiable randomness. Unfortunately, without exceptions, all known practical VDF constructions are broken by quantum algorithms. In this work, we investigate the practicality of VDFs with plausible post-quantum security. We propose Papercraft, a working implementation of a VDF based entirely on lattice techniques and thus plausibly post-quantum secure. Our VDF is based on new observations on lattice-based succinct argument systems with many low-level optimisations, yielding the first lattice-based VDF that is implementable on today's hardware. As an example, our Papercraft implementation can verify a computation of almost 6 minutes in just 7 seconds. Overall, our work demonstrates that lattice-based VDFs are not just a theoretical construct, paving the way for their practical deployment.

The continued advancement of quantum computing is expected to transform the landscape of cryptographic security, making many classical algorithms vulnerable to quantum attacks such as Grover’s exhaustive key search. In this study, we present an efficient quantum circuit implementation of the lightweight block cipher KLEIN for all variants. Each functional component of the cipher, such as key addition, substitution, RotateNibbles, MixNibbles, and key scheduling, is implemented. The complete quantum design involves gates such as CCNOT, CNOT, and Pauli-X. Furthermore, we provide a comprehensive resource estimate for executing Grover’s search algorithm on the proposed quantum circuits, highlighting their resilience and practicality in post-quantum cryptographic contexts.

Secure Multi-Party Computation (MPC) is a cryptographic primitive that enables multiple parties to jointly compute a function over their inputs without revealing the inputs. An MPC protocol is required to provide security against adversarial behavior, typically considered in two classic models: the \textit{semi-honest} model, where adversaries follow the protocol but attempt to learn additional information from the transcript, and the \textit{malicious} model, where adversaries may arbitrarily deviate from the protocol. Protocols secure against semi-honest adversaries are often more efficient, but in many real-world applications the stronger guarantee of malicious security is required. In this work, we propose an efficient MPC protocol secure against static malicious adversaries controlling at most $t<n/3$ out of $n$ parties. Our protocol builds on Shamir's secret sharing and follows a compiler-based approach: the parties first evaluate the circuit using a semi-honest protocol and then run a verification procedure that enables honest parties to detect cheating except with small statistical error. Our construction injects fresh randomness into the verification procedure to detect cheating even in the presence of incorrect multiplication triples. It also reduces communication overhead by replacing several invocations of multiplication verification with local degree-$2t$ computations and a batched opening, while keeping the local verification cost comparable to or lower than that of prior protocols. We give a concrete instantiation of the compiler and prove that the resulting protocol is secure against malicious adversaries.

We present ORQ, a system that enables collaborative analysis of large private datasets using cryptographically secure multiparty computation (MPC). ORQ protects data against semi-honest or malicious parties and can efficiently evaluate relational queries with multi-way joins and aggregations that have been considered notoriously expensive under MPC. To do so, ORQ eliminates the quadratic cost of secure joins by leveraging the fact that, in practice, the structure of many real queries allows us to join records and apply the aggregations "on the fly" while keeping the result size bounded. On the system side, ORQ contributes generic oblivious operators, a data-parallel vectorized query engine, a communication layer that amortizes MPC network costs, and a dataflow API for expressing relational analytics — all built from the ground up. We evaluate ORQ in LAN and WAN deployments on a diverse set of workloads, including complex queries with multiple joins and custom aggregations. When compared to state-of-the-art solutions, ORQ significantly reduces MPC execution times and can process one order of magnitude larger datasets. For our most challenging workload, the full TPC-H benchmark, we report results entirely under MPC with Scale Factor 10 — a scale that had previously been achieved only with information leakage or the use of trusted compute.

We show that the certificateless signature scheme [IEEE ITJ, 26852-26865, 2024] is insecure against public key replacement attack. An adversary can forge signatures for any message by replacing the signer's public key. We find the two components $\delta_A$ and $T_A$ of signature $\sigma_A=(m_A, ID_A, \delta_A, T_A)$ are not tightly bound to the target message $m_A$ and the singer's identity $ID_A$. The inherent flaw results in that the adversary can find an efficient signing algorithm functionally equivalent to the valid signing algorithm. The findings could be helpful for researchers unfamiliar with the designing techniques for certificateless signatures.

Censorship resistance and high throughput are two key benefits of modern multi-proposer BFT protocols. However, in existing designs these two properties are at odds: censorship resistance is typically achieved through duplicating transactions, which in turn harms throughput. This leaves open the question of whether it is possible to improve both properties simultaneously. In this paper, we formally study the trade-offs between censorship resistance and throughput in multi-proposer BFT protocols, where up to $f$ parties may be Byzantine. We present a model for the transaction assignment process, which allows us to classify assignment protocols into meaningful categories. Using this model, we establish fundamental tradeoffs between censorship resistance and throughput. We show that under well-defined conditions, any deterministic transaction assignment protocol that achieves optimal throughput must suffer from $f$ rounds of censorship delay; any deterministic assignment protocol that guarantees every transaction is committed within a constant number of rounds must suffer a factor of $f$ loss in throughput relative to the optimal baseline. On the positive side, we propose and analyze new transaction-assignment protocols that enable flexible choices among throughput–censorship tradeoffs spanning the full spectrum dictated by our lower bounds. In particular, we give a protocol that achieves $\log f$ censorship delay while paying only a factor-2 throughput loss relative to the state-of-the-art MirBFT (EuroSys’23), which incurs $f$ rounds of censorship delay. We further propose randomized assignment protocols that provably break both the deterministic lower bound for the censorship delay and throughput in expectation. All assignment protocols discussed can be integrated with existing multi-proposer protocols within our model as add-ons without modifying the consensus.

The main contribution of this paper is to introduce Subspace Differential Uniformity (SDU) for S-boxes and block ciphers. The SDU is essentially a measure of how well any function spreads input differences clustered in affine subspaces away from affine clusters in output differences. We provide some lower bounds for the SDU and describe an efficient algorithm for computing the SDU. Moreover, we provide results for some popular classes of S-boxes up to $n=8$.

Secure computation allows multiple parties to jointly evaluate a function without leaking their individual inputs. An intrinsic issue with these techniques is that they do not offer any protection against parties which may contribute bad quality or even maliciously crafted data. We introduce TRIP, a protocol which protects against malicious manipulations of the input in secure computation of linear regression tasks. Linear regression is the cornerstone in many machine learning tasks, and hence creating secure protocols for this task is a crucial step towards secure machine learning. Our protocol utilizes a novel combination of techniques from secure computation, robust statistics, and differential privacy. On synthetic data, TRIP recovers the planted ground truth; on real-world datasets, its model remains close to the clean OLS baseline under up to 40\% target corruption. In terms of efficiency, our protocol runs up to $250\times$ faster than an MPC-only baseline for $10^6$ samples. Even in the smallest parameter setting, TRIP is $10\times$ faster than our baseline.

Euclidean lattices are an interesting object of study in many regards and can have a rich structure arising from various constructions, e.g., from number field extensions. A particularly interesting class is the one of well-rounded lattices, as they relate to the well-known densest sphere packing problem in geometry, theta function minimization, and the famous Minkowski and Woods conjectures. In addition to being an important mathematical object in their own right, lattices also play a central role in many applications. This paper offers a survey of structured lattices and discusses their recent applications in lattice-based cryptography and secure wireless communications. Our goal is to spark the interest of mathematicians and adjacent communities in these fascinating topics in the intersection of lattices, number theory, cryptography, and wireless communications.

This paper is devoted to the study of the Ring-LWE-based digital signature scheme proposed by Sharafi and Daghigh, especially, the cryptanalysis of this scheme. The Sharafi and Daghigh’s scheme is inspired by the Lindner–Peikert encryption paradigm and adopts a hash-and-sign approach via the Fiat–Shamir transformation. The security claims rely on the assumed hardness of the Ring LWE and Ring-SIS problems, whose definitions and properties are well studied in last two decades. We demonstrate that this scheme is not secure and generalise our analysis to the analogous scheme in the plain-LWE setting.

Private Information Retrieval (PIR) protocols allow a client to recover items from a server-held database without revealing the locations of requested items. In Symmetric PIR (SPIR), the client also learns nothing about the database beyond the requested items. Such schemes are critical for maintaining security in applications such as compromised credential checking, where database elements are considered as sensitive as queries. Existing approaches to building SPIR schemes require running multiple cryptographic primitives in parallel. Moreover, they do not naturally translate to the post-quantum setting, even though practical PIR schemes are typically post-quantum due to their reliance on learning with errors (LWE). This work explores the possibility of deriving SPIR from PIR directly, utilising noise flooding to maintain the privacy of the database. While the common analysis based on the statistical distance leads to impractical parameters, we instead utilise arguments based on the Rényi divergence to obtain significantly improved parameters. We obtain simple single-server SPIR from state-of-the-art LWE-based PIR schemes with polynomial noise dimension and ciphertext modulus (concretely of 64 bits in size). Along the way, we note that practical schemes that utilise preprocessing via client-downloaded offline hints require extra protections for the database. Overall, via an implementation of our approach, we show that post-quantum, round-optimal SPIR schemes can be constructed requiring online communication of 8 MB and server computation costs of 302 ms for a database of 1 million 1 kB elements.

Let $E$ be an elliptic curve over a perfect field $K$. A function $f\in K(E)$ is a compression of degree 2 on $E$ if $f(-P) = f(P)$ for all $P\in E$, and the field extension $K(f)\subset K(E)$ is of degree 2. For a finite subgroup $G\subset E$ over $K$ a function $w\in K(E)$ we will call a $G$-compression if $w(\pm P +G) = w(P)$ for all $P\in E$, and the field extension $K(w)\subset K(E)$ is of degree $2|G|$. We will show that $w\in K(E)$ is a $G$-compression if and only if $w = f\circ \Phi$ for a separable isogeny $\Phi:E\to E'$ over $K$ with $\ker \Phi=G$, an elliptic curve $E'/K$, and a compression $f\in K(E')$ of degree 2 on $E'$. This allows to obtain a doubling, a differential addition, and a method for point recovery for $G$-compressions using known properties of compressions of degree 2. For $G$-compressions $w$ studied in the literature on an extended Jacobi quartic, a twisted Edwards curve, a twisted Jacobi intersection, and a twisted Hessian curve (for the first and third model additional conditions on coefficients are assumed) we will give the decomposition $w = f\circ \Phi$ as above, and the function induced by the dual isogeny $\widehat{\Phi}$ and compressions of degree 2, which can be used for point recovery. For the first three models this isogeny $\Phi$ is to a Montgomery curve over $K$, and has the first coordinate $x(\Phi)=1/w$. We also give isomorphisms from some models of elliptic curves to a Montgomery curve.

The transition to post-quantum cryptography (PQC) is constrained by the limited cryptanalytic history of individual PQC algorithms. Hybrid constructions, which combine several primitives so that breaking the hybrid requires breaking each component, address this concern directly. This paper presents Cobra, a hybrid Key Encapsulation Mechanism (KEM) that integrates FrodoKEM (unstructured LWE), ML-KEM (FIPS 203 module-LWE), HQC (code-based), and a Dummy KEM for agility, and analyses all 15 mathematically distinct composition methods spanning parallel, cascading, multi-stage, and nested topologies. We prove that every Cobra method achieves IND-CCA2 security within the MarketTheoretic Security Framework (MTSF), which subsumes and strictly extends both Universal Composability and the Random Oracle Model. An explicit 10-round bidding-round chain per method yields post-quantum ask prices of approximately 2−127 at NIST Level 1 together with composability under arbitrary TLS 1.3 embeddings, per-session CNF auditing, and unbounded-session security via pinging. Although all fifteen methods are security-equivalent, encapsulation latency varies by 3.2× (1.2–3.8 ms) and Theorem 7.1 reduces deployment selection to a Pareto-optimal set of five archetypes. Three real-world TLS 1.3 case studies (financial, healthcare, government) confirm the prediction, with infrastructure overhead clustering at 15–22% across sectors.

Avoiding feeding forward seems to be a major goal of the sponge construction. We make a step back and investigate adding feeding forward back to sponge. The obtained sponge-with-feeding-forward construction has a number of benefits: (1) In the random permutation model, its preimage and second preimage security bounds are much better than the standard sponge with the same capacity, while collision and indifferentiability security bounds are comparable; (2) Its collision and (second) preimage security can be reduced to well-defined properties of the underlying permutation, i.e., correlation intractability w.r.t. certain family of evasive relations. We further incorporate several somewhat new ideas to form detailed hash and XOF constructions SpongeFwd: (1) Feeding-forward is only applied to the capacity part, and the final output(s) is the capacity part (with the rate part discarded). In this way, when $c$ equals the primary hash output size $h$, a single permutation-call suffices for squeezing. This also simplifies the underlying evasive relations for the reduction security proof. (2) We replace the hash IV with the first message block to have the best possible efficiency. (3) We employ a parallel structure to define an XOF variant. (4) We use HAIFI-style counter inputs to achieve both length-independent second-preimage security and domain separation for XOF. The better (second) preimage security enables constructing 512-bit output hash function from Keccak-p[800]: with 512-bit capacity, its collision and (second) preimage security bounds are the same as the standard SHA-3-512, while its hardware area is reduced by roughly 38% (according to our preliminary estimation).

We present Panther, a family of six robust hybrid key encapsulation mechanism (KEM) combiners that pair FrodoKEM (unstructured LWE) with ML-KEM (module-LWE, FIPS 203) so that IND-CCA2 security holds whenever either assumption is hard. The family includes five hardened variants of the textbook combiners—parallel HKDF, SHAKE256 splitkey, sequential chaining, XOR, and nested—each made to satisfy a uniform robustness predicate (transcript binding, domain separation, implicit rejection, length normalisation, ∨-security), together with a novel structural-splicing construction Panther-SS that interleaves the constituent ciphertexts and binds the cut-positions via a structural tag. Every combiner admits a systematic Market-Theoretic Security Framework proof in which each bidding round is documented by its purpose, the scheme component it replaces, and its complexity cost; the framework extends cleanly to correctness, unbounded session security, QROM security, and quantitative side-channel resistance. We complement the theory with extensive benchmarks on liboqs-backed reference implementations, including a head-to-head comparison of Panther combiners against the keyencapsulation candidates that appeared in NIST PQC Rounds 1–4 (Kyber/ML-KEM, FrodoKEM, NTRU, SABER, NTRU Prime, Classic McEliece, BIKE, HQC). The experiments cover keygen/encaps/decaps latency, throughput, memory footprint, ciphertext and key sizes, scaling with query count, CPU-cycle counts, security-vs-performance Pareto analysis, and an attack-vsdefence matrix against published side-channel attacks on both constituents. The results confirm that hybrid robustness is essentially free over the slower constituent, that Panther-SS uniquely achieves full robustness with combiner-only overhead below half a percent of total latency, and that the Panther family sits on the Pareto frontier of post-quantum KEM candidates.

We present new frameworks for secure function evaluation (SFE) and private function evaluation (PFE) that support both Boolean and arithmetic circuits. While SFE requires multiple parties to jointly compute a \textit{public} circuit, PFE generalizes SFE by allowing one party to keep the circuit \textit{private}. Our work achieves the first linear-complexity PFE protocol with respect to both the number of parties $n$ and circuit size $m$, significantly improving upon prior PFE constructions that require $O(mn^2)$ complexity and are limited to Boolean circuits.

We propose a novel method for using lookup tables (LUTs) in multiparty noise sampling which allows using smaller and/or fewer LUTs compared to previous work (Franzese et al., CCS'25, and Kii et al., PETS'25), leading to efficiency improvements of several orders of magnitude. This is primarily achieved by not evaluating the LUTs at uniformly random indices but rather using a non-uniform index distribution that can be sampled efficiently. Our method is largely distribution-agnostic, and we demonstrate its flexibility by approximating the discrete Laplace and Gaussian distributions (for a wide range of parameters) to a negligible statistical distance. Our concrete implementation, based on 3-party replicated secret sharing, achieves sub-kilobyte communication and millisecond-level computation. Amortized over 1000 discrete Laplace or Gaussian ($\sigma \leq 1000$) samples, we require just 619 bytes of communication (constituting over two orders of magnitude less communication than all previous work) and under 2 ms per party in the semi-honest setting, in all considered network configurations. With recently proposed batched multiplication checks, the malicious setting adds less than 1 byte and 5 ms per sample (amortized). Offering potential independent value, our open-source implementation also extends LUT communication trade-offs (Morita et al., USENIX'25), thus enabling more efficient evaluation of larger LUTs. Further, the merits of our sampling method are not contingent on the above MPC setting and we give analytical performance estimations for use with other MPC machinery, which indicate that it widely is a competitive alternative, especially for somewhat concentrated distributions.