We present a fast implementation of Falcon (FN-DSA) signature verification with AVX-512. On a modern AMD Zen5 core, it completes a Falcon-512 verification in 3.6 microseconds, 2.6 times faster than an already optimized baseline, with comparable gains on Zen4, and consistent results across clang 21 and gcc 15. The speedup comes from rewriting the Number-Theoretic Transform (NTT) and from vectorising all other stages of the verification algorithm. The novelty is to use a 32-bit Barrett-style representation, instead of the reference 16-bit Montgomery, and adopt Shoup-Harvey precomputed multipliers for twiddle reduction. With all optimizations applied, hash-to-point (and specifically Keccak) is the dominant cost. We therefore propose a non-standard Falcon variant that replaces SHAKE256 with KTP256, an XOF based on KangarooTwelve with parallel squeeze. It cuts verification to 2.2 microseconds on Zen5, yielding 4.2 times over the baseline, and is of independent interest for any post-quantum scheme that uses a Keccak sponge to sample large amounts of data from a fixed seed. All code is open source.

Due to the insecurity of McEliece cryptosystems instantiated with Generalized Reed-Solomon codes, there have been several proposals of McEliece type systems that replace the permutation matrix by a matrix $M$ with larger row and column weight. In many of them, the secret key is still a GRS code. There have been successful attacks on some of those schemes with row and column weight between $1$ and $1 + R$, where $R$ is the rate of the code. The case of weight two and larger has been left open in these works. Subsequently, several authors proposed schemes with weight exactly two and with even higher weight. We provide distinguishers for the public codes appearing in these cryptosystems in the high rate regime. In addition, we give a framework to turn a good enough distinguisher into a key-recovery attack. In the case where the matrix $M$ has row and column weight $2$, we can successfully attack the scheme in the high rate regime using a cube code distinguisher.

Private Set Operations (PSO) enable mutually untrusted parties to securely compute arbitrary functions (e.g., union, intersection, and cardinality) over their private input sets, which have wide applications in many real-world scenarios. Existing PSO protocols fall short of practical deployment for several reasons. (1) \textit{Function-specific}. Real-world privacy-preserving applications often require multiple set operations within the same task, while existing solutions typically address individual functionalities (e.g., intersection or union) in isolation, making it difficult and costly to support diverse set operations in a unified and efficient manner. (2) \textit{Lacking malicious security}. As PSO is commonly employed in highly sensitive applications, it is often necessary to provide strong adversarial guarantees with malicious security. Unfortunately, most of existing works only achieve semi-honest security, which limits their practical applicability. (3) \textit{Restricted settings}. Majority of existing works focus exclusively on the two-party setting. How to extend them to the multi-party setting with malicious majority securely and efficiently is unclear. To date, designing a maliciously secure multi-party PSO (mPSO) framework that efficiently supports diverse set operations remains an open challenge. This paper presents the \textit{first} maliciously secure mPSO framework, named UM-PSO, that supports a broad range of set operations with practical efficiency. At the core of our framework is a function-independent preprocessing phase that prepares a reusable pool of secret-shared items, which can then be leveraged to securely compute diverse set functionalities in the online phase. To achieve malicious security efficiently, we design verification mechanisms on top of SPDZ-based authenticated secret sharing, along with tailored techniques and optimizations to further improve practical performance. We implement our protocols and report concrete performance results. For a representative setting with 5 parties and a total of $2^{12}$ 128-bit items, our framework achieves an online running time of $0.627$ seconds and incurs $3.35$ MB of communication. Compared to the baselines, our framework achieves up to $51\times$ speedup and $76\times$ lower communication cost.

PRIVIDEMA project (Privacy-Preserving Identity Management for Digital Wallets and Secure Data Sharing and Processing for Cyber Threat Intelligence Data) advances the state of the art in cryptographic and Privacy-Enhancing Technologies (PETs) to enable secure, interoperable, and trustworthy data exchange across sectors, with a focus on the domains of Cyber Threat Intelligence and Digital Identity Management. This paper presents two representative real-world use-cases: (1) privacy-preserving digital identity management based on the European Digital Identity (EUDI) Wallet, and (2) privacy-preserving Cyber Threat Intelligence (CTI) sharing for Software Bill of Materials (SBOMs) and vulnerability datasets. Both use cases showcase how advanced PETs, including Fully Homomorphic Encryption (FHE), Federated Learning (FL), and Differential Privacy (DP), can be composed to protect sensitive data throughout its lifecycle while maintaining analytical and operational utility. Together, these use cases chart a practical course toward more scalable, standards-compliant, and privacy-preserving data ecosystems that align with Europe’s vision for secure and trustworthy digital services.

Internet shutdowns are used authoritarian regimes to suppress communication that end up crippling essential Internet-driven services, besides the obvious silencing of dissent. Traditional tools like VPNs and Tor, dependent on active Internet connections, falter during these blackouts. Earlier solutions, such as Dolphin, delivered meagre bandwidth and weak privacy safeguards, exposing a glaring weakness in the battle against digital oppression. ViNET, a system that cleverly repurposes Video over LTE (ViLTE) calls, often operational during shutdowns, into a stealthy conduit for real-time Internet access. By ingeniously embedding network traffic in ViLTE packets, ViNET achieves robust 60 to 400 Kbps transmission rates, matching 2G speeds and surpassing previous solutions like Dolphin by 1500x–4000x, while ensuring end-to-end TLSbased confidentiality and integrity. This performance enables text-based web browsing with page loads in seconds to minutes, 1 MByte file downloads in ≈30s, and seamless messaging over Telegram. ViNET also outsmarts machine learning-based traffic classifiers, achieving a remarkable false positive rate, at times as high as 40%, when attempting to detect ViNET using SOTA models. With such standout metrics, ViNET emerges as a formidable ally, offering a performant, reliable and privacy-first lifeline, in the face of Internet shutdowns.

Post-Quantum Cryptography is now in its deployment phase. Amongst the threats encountered in real-world applications is Side Channel Analysis, a cryptanalysis branch relying on the study of physical leakages from unsecured implementations. However, the FALCON post-quantum signature includes non-linear functions on real numbers, and applying the generic masking countermeasure to these functions has only been recently studied. In this work, we use convergent sequences to approximate the function and a minimax polynomial to compute the first term of the sequence. The method is applied to the computation of the inverse, the inverse square root and the square root in FALCON. A theoretical analysis of the security in the t-probing model using the NI criterion and its variants is proposed. Compared to the existing state-of-the-art which only covers the inversion for floating-point implementation, this paper is generic and works with any representation and precision for real numbers.

Torus Fully Homomorphic Encryption (TFHE) enables the homomorphic evaluation of arbitrary functions via Programmable Bootstrapping (PBS). However, the modulus switching step inherent to bootstrapping introduces a rounding error that forces the discretization of the input space, limiting the achievable precision on real-valued inputs. We propose a correction algorithm based on a first-order Taylor expansion, applied after bootstrapping, that directly mitigates this rounding error. Our method leverages the many-LUT technique to simultaneously recover encryptions of the function and its derivative within a single PBS, making the correction essentially free in terms of bootstrapping latency. We support our construction with a heuristic average-case noise analysis, validated by empirical measurements, and demonstrate a tenfold reduction in bootstrapping noise standard deviation. As a proof of concept, we apply our method to the numerical integration of ordinary differential equations under encryption.

This paper gives a modular and unified framework within which to derive fast protocols for Private Set Intersection (PSI). At the core of this is a new primitive, that we define, and that we call a Just-In-Time OPRF (JIT-OPRF). We show how to obtain PSI generically from any JIT-OPRF, and then how to obtain JIT-OPRFs from Oblivious Transfer (OT) and Vector Oblivious Linear Evaluation (VOLE). We recover as special cases PSI protocols in the literature based on these two assumptions. Our results and proofs throughout are concrete rather than asymptotic, with explicit bounds that allow one to determine security parameters to achieve a desired level (e.g.~128 bits) of proven security in practice. Our results show interesting differences in the concrete security of OT and VOLE based PSI. Beyond the practical contribution of concrete-security, our work adds conceptual simplicity to this area, and opens the door to new PSI protocols via the construction of new JIT-OPRFs.

Falcon was selected by NIST in 2022 for standardization as a post-quantum digital signature scheme. Among all standardized signature schemes, Falcon achieves the smallest signature size. Its main drawback, however, is its reliance on floating-point arithmetic, which plays a critical role in the security analysis. This reliance poses significant challenges for practical implementations: some platforms lack floating-point units, floating-point division is not constant time on many processors, and protecting floating-point computations against side-channel attacks using masking techniques is particularly difficult on embedded devices. To address portability issues, Pornin (ePrint 2019/893) proposed an implementation of \falcon that emulates floating-point arithmetic using integer operations. While it enables deployment on a wider range of platforms, this approach incurs a substantial performance penalty compared to the native floating-point implementation. This work studies the theory and practice of implementing Falcon's signing procedure in fixed-point arithmetic. This requires a specific analysis of the boundedness and precision of intermediate variables. 1. Our boundedness analysis revolves around a key fact: almost every intermediate variable arising during key expansion and signing is bounded by a function of four quantities that can be computed at key generation time. Our modified key generation enforces thresholds on these quantities through a light rejection step that rejects less than 50% of initial Falcon keys. This then yields sharp, unconditional bounds on all fixed-point variables. Establishing these bounds is highly nontrivial, and relies on Gaussian concentration arguments as well as on symplectic pairs, a generalization of symplecticity. 2. Our precision analysis remains, for now, partly empirical. Following a Rényi divergence argument, our main theorem proves the security of fixed-point Falcon conditioned on error bounds of certain intermediate values. These error bounds are derived empirically based on extensive experiments. We provide a C fixed-point implementation. It is approximately a factor of two slower than the original floating-point \falcon implementation, but achieves a speedup of an order of magnitude compared to emulated floating-point implementations.

Neural differential distinguishers have become an active research direction in​ symmetric-key cryptanalysis since the introduction of deep-learning-based attacks on​ round-reduced SPECK. Early neural distinguishers typically used a single ciphertext pair​ or ciphertext difference as input. Recent studies, however, show that richer input​ representations can substantially affect the information available to the classifier, the data​ cost of each labeled sample, and the relevance of the distinguisher to practical attacks.​ Examples include multi-pair, multi-difference, matrix-style, multi-round,​ structured-encoding, and score-aggregation based inputs.​ This paper provides a taxonomy and survey of rich input representations in neural​ differential cryptanalysis. We introduce a representation-centric framework that describes​ an input representation by its difference set, number of observations per sample, sharing​ structure, encoding function, and ciphertext cost. Using this framework, we organize​ existing works into representation families and compare their motivations, benefits, and​ limitations. We also argue that representation-rich distinguishers require cost-aware​ evaluation: fixed-sample comparisons and fixed-ciphertext comparisons answer different​ questions and may lead to different conclusions. Finally, we identify open problems related​ to automated representation search, theoretical explanation of representation gain,​ cipher-family transferability, interpretability, reproducibility, and key-recovery integration.​ The survey highlights that rich input representations should be treated as first-class​ cryptanalytic design choices rather than secondary implementation details.

In AfricaCrypt 2025, Seck et al. proposed a new generalized Wiener-type attack on an RSA-like cryptosystem proposed by Cotan and Teseleanu (NordSec 2023). In their attack, they studied the generalized key equation $eu - (p^4 - 1)(q^4 - 1)v = w$ and showed that a private exponent $d$ which is too large or too small can be recovered in polynomial time. Another RSA variant based on cubic Pell curves with key equation $ed - (p - 1)^2(q - 1)^2 k = 1$, was examined by Rahmani and Nitaj in AfricaCrypt 2025. Note that these two attacks are valid for a balanced modulus $N = pq$ ($q < p < 2 q$). In this paper, we extend these two attacks by showing that for a modulus $N=pq$ product of arbitrary primes $p$, $q$, one can efficiently factor $N$ by studying the two key equations $ex - (p^4 - 1)(q^4 - 1)y = \omega$ and $ex - (p - 1)^2(q - 1)^2 y = \omega$ under certain conditions on $x,y$ and $\omega$. Our new attacks are based on Coppersmith method and continued fractions.

Simon's algorithm can detect hidden XOR periods in functions derived from symmetric ciphers. Finding such functions becomes difficult when nonlinear layers and diffusion spread the relevant expressions across many branches, so recent work has used symbolic search to automate the construction. We refine the algebraic SMT model of Liu et al. in two ways. Prefix realization checks whether a symbolic starting state can be reached through preceding rounds and records the round-key nibbles needed to produce it. DDT Filtering restricts a local S-box input to a DDT bucket so that the symbolic path can cross an additional nonlinear layer. The latter condition is key-dependent: the target period need not lie in the translation space of the selected bucket, and our results state this condition explicitly. We report the maximum round counts found for GFS-2F, GFS-4F, Skipjack-B, LBlock, TWINE, CRAFT, and SKINNY, with Liu et al.'s automated model as the main comparison. We also combine selected witnesses with partial round-key guesses in the Grover–meet–Simon setting, yielding reduced-round key-recovery candidates below the corresponding comparison budgets.

Hybrid fully homomorphic encryption (FHE) inference improves the practicality of private inference by letting the server evaluate linear layers homomorphically while the client decrypts and applies nonlinearities. Recent schemes attempt to protect model confidentiality by returning noisy, output-permuted responses and appealing to shuffle-model differential privacy (DP). We show that this protection fails in the correctness regime required by hybrid FHE systems. For a $d$-input linear layer, $d+1$ admissible queries suffice for exact recovery of a permutation-invariant layer summary, hence for perfect model distinguishability. We further show that input DP is orthogonal to model confidentiality and that the local-DP premise required for shuffle amplification cannot hold under correctness-bounded noise. We recover all linear layers of a SAFHIRE-style ResNet-20 end-to-end from TFHE transcripts with zero error, using $d+1$ queries per layer for a total of $5{,}712$ direct queries. Under the same query model, we also confirm exact per-layer recovery on pretrained ImageNet-scale CNNs and ViT-B/16. The leaked spectra enable fingerprinting, lineage attribution, and improved logit-based extraction, while suppressing them destroys inference utility.

Proof-of-work (PoW) remains a fundamental mechanism for achieving decentralized consensus, most commonly instantiated using cryptographic hash functions. In such constructions, mining takes the form of an unstructured search problem over a large input space, where miners repeatedly evaluate candidate solutions until a valid one is found. While this design has proven effective in practice, it admits a quadratic quantum speedup via Grover’s algorithm, raising concerns about the long-term security of hash-based mining. Motivated by this limitation, we investigate the use of code-based cryptographic problems as an al- ternative foundation for proof-of-work. In particular, we focus on the syndrome decoding problem and examine its classical and quantum com- plexity based on current state-of-the-art information-set decoding (ISD) algorithms and their quantum variants, comparing the resulting quantum advantage with that of hash-based and lattice-based constructions. Building on this analysis, we propose a proof-of-work construction based on the Syndrome Decoding Problem (SDP) with a structured profile constraint, which enables controlled variation of solution density and difficulty. Under the standard random-instance heuristic, we derive ex- pressions for the expected number of solutions and the probability of successful mining, providing a principled basis for parameter selection.

We propose NAIBI-Full, a lattice-based key encapsulation mechanism (KEM) together with its forward-secure ephemeral key-agreement protocols, built on the regular representation 𝜌 of the non-split commutative algebra \cA𝛼 =\Rq⁢[𝑦]/(𝑦𝑘 −𝛼) over \Rq =\Z𝑞⁢[𝑥]/(𝑥𝑛 +1), 𝑘 ∈{2,3}, 𝛼 a non-𝑘 -th power. Each party publishes the full matrix \bft =𝐴⁢𝜌⁡(\bfs) +\bfe ∈\Rq𝑘×𝑘 ; because 𝜌⁡(\cA𝛼) is commutative, the cross-product collapses to small noise and a Peikerthint closes the gap to exact agreement, even though the public matrix 𝐴 is fully generic in 𝑀𝑘⁡(\Rq). Hardness rests on a single, well-localised assumption: structured-secret Module-LWE \MLWErho, which we identify exactly with a 𝜌⁡(𝑦)-linked 𝑘-sample MLWE problem via column decomposition, placing it inside the well-cryptanalysed MLWE landscape of ML-KEM. NAIBI-Full is the conservative member of the family: a clean account in terms of a standard lattice assumption, at the cost of 𝑘2-element public keys and ciphertexts. We obtain an IND-CCA2 KEM (FO⊥, ROM and QROM) plus two forward-secure ephemeral protocols (ephemeral-static and ephemeral-ephemeral) sharing the same algebraic core, and a statistical, decapsulation-level binding correctness guarantee with collision probability ≤(2/3+13⁢𝑞)⌈𝑛/2⌉ +(8/𝑞)𝑛/2 +2−256 (below 2−148 at every parameter set). Crucially this binding holds in the malicious-key model on the ciphertext axis (𝖬𝖠𝖫-𝖡𝖨𝖭𝖣-𝖪-𝖢𝖳), with no distributional assumption on the adversarial keys --- the property ML-KEM is known to lack. We deliberately do not offer a static-static mode, which would inherit the active key-mismatch attacks of the Ding/Peikert/NewHope family; NAIBI-Full is confined to its key-mismatch-resistant deployments. Parameter sets cover NIST security Categories~1, 3 and~5, all with 𝛿 ≤2−128 .

We observe that there exists a single-server quantum private information retrieval with polylogarithmic communication assuming post-quantum one-way functions. Our observation follows immediately from the compilation technique of [Kerenidis-Wolf STOC'03] when combined with distributed point functions by [Gilboa-Ishai EUROCRYPT'14].

A $t$-out-of-$n$ threshold decryption scheme distributes decryption key shares among $n$ parties so that any $t$ of them can jointly decrypt a ciphertext, while fewer than $t$ learn nothing about the plaintext. Traditional threshold schemes provide no accountability: a coalition of $t$ or more parties can combine their key shares and construct a pirate decoder that decrypts arbitrary well-formed ciphertexts, without any risk of being traced. To address this, Boneh, Partap, and Rotem [CRYPTO '24] introduced the notion of threshold traitor tracing (TTT), where a tracing algorithm that is given black-box access to the pirate decoder can identify at least one of the colluding parties. Many subsequent threshold traitor tracing schemes similarly find only a single traitor, even though the decoder must have been constructed using at least $t$ keys. While some constructions can find multiple traitors, they do so at the cost of large ciphertexts or only achieving a weak form of correctness. In this work, we make the following contributions: - Lower bounds: We show that for all existing traitor tracing techniques, the ciphertext must be large to allow tracing close to $t$ traitors. In particular, to trace $t-O(1)$ traitors, the ciphertext size must be at least $\Omega(t)$. To trace $a \leq t- \omega(1)$ traitors, the ciphertext size must scale with $\Omega(\frac{a-1}{t-a+1})$. For schemes that rely on fingerprinting codes, we show an even stronger lower bound. - Upper bounds: We present two generic compilers that construct traitor tracing for general access structures (beyond threshold) from two building blocks: attribute based encryption for general access structures and sufficiently-expressive policies and mixed functional-encryption. We also present two concrete instantiations. Under exponential security assumptions, we construct a pairings-based threshold traitor tracing scheme that can trace $t$ traitors with ciphertext size $O(t^2)$. We also construct an LWE-based traitor tracing scheme for a DNF access structure, that can trace an authorized subset of traitors with ciphertext size $O(\hat{t}^2)$, where $\hat{t}$ denotes the size of the largest unauthorized subset in the access structure. - A Candidate Theoretical Instantiation: We present a new tracing mechanism that can trace $t(1-1/\lambda^c)$ traitors with $\mathsf{poly}(\lambda)$ size ciphertext, public key, and secret keys. We prove security assuming ideal (black box) obfuscation. Our work raises several open questions in the context of tracing multiple parties in a threshold traitor tracing scheme.

The computation of optimal Ate pairings on elliptic curves with embedding degree $k=27$ (BLS27) is highly relevant for achieving the 256-bit security level, especially in the context of recent advances in the Number Field Sieve (NFS) and its variants (exTNFS, SexTNFS). Traditional binary approaches fail to fully exploit the degree-3 extension tower of $\Fpk{27}$. In this work, we propose an efficient ternary version of the Miller loop, restricting the seed representation to sparse ternary digits $\{0, 1\}$ to streamline point operations and eliminate costly inversions. Furthermore, we generate two new parameter seeds tailored for exTNFS and SexTNFS security levels. These seeds feature sparse ternary representations that simultaneously guarantee the efficiency of the Miller loop and allow the full exploitation of cyclotomic cubing in $\mathbb{F}_{p^{27}}$ during the hard part of the final exponentiation. Compared to the state of the art binary approach by Fouotsa et al. (2020), our exTNFS seed yields a $22\%$ improvement in the overall optimal Ate pairing computation cost. Concurrently, our proposed SexTNFS seed ensures a higher level of security against the most advanced NFS variants.

Maintaining a decentralized system requires a collective governance mechanism that allows participants to agree on changes to the system. In particular, the governance mechanism should offer a voting functionality for casting, collecting, and tallying votes in a confidential yet verifiable manner. Scaling this functionality for millions of participants in a cost-effective manner is a critical requirement for permissionless blockchains that remains unmet. We put forward a "layer-2" approach to meet this requirement in a setting where a permissionless blockchain acts as the fallback "layer-1" mechanism. Specifically, our approach to scalability realizes the protocol in a layer-2 fashion: the bulk of the protocol is executed off-chain, but secured on the blockchain with a minimal footprint. We prove our protocol secure in the Universal Composability (UC) framework. First, we formalize a governance ideal functionality $\mathcal{F}_{\mathsf{L2Gov}}$. Our definition offers high levels of confidentiality and verifiability. Moreover, in the case of misbehavior, it allows faults to be attributed so that appropriate action (such as the slashing of on-chain funds) can be taken. Second, we demonstrate that our protocol UC-realizes the $\mathcal{F}_{\mathsf{L2Gov}}$ functionality based on a blockchain, an off-chain bulletin board, a distributed homomorphic encryption functionality ($\mathcal{F}_{\mathsf{DHE}}$), and other standard hybrids. To the best of our knowledge, this work presents the first layer-2 blockchain voting protocol with a rigorous security analysis. We also point out some challenges that arise when applying the UC framework to layer-2 protocols.

We present, Quintus, information-theoretic BFT protocols for tolerating $f < n/5$ Byzantine faults among $n$ parties. We present two protocols: (1) The first protocol, Quintus-Fixed, is in a fixed view regime where views advance at a cadence $3\Delta$ time. This protocol incurs a good-case latency of $2\delta$ time where $\delta$ indicates actual network delay and message complexity of $O(n^3)$ in a view. % In optimistic cases with good leaders, it incurs $O(n^2)$ message complexity. (2) The second protocol, Quintus-Responsive, is an optimistically responsive protocol with good-case latency of $2\delta$ time, $O(n^2)$ message complexity, and $2\Delta + 2\delta$ worst-case view latency where $\Delta$ denotes a pessimistic network delay parameter under synchrony.

The Generalized Feistel Network (GFN) underpins widely standardized block ciphers, yet its resistance to full plaintext recovery remains largely unexplored. This paper extends the full-plaintext attack framework for standard Feistel ciphers to multi-branch scenarios, mainly makes the following $3$ research contributions: (1) Developed classic full plaintext recovery attacks on $d$-round Type-I GFN ($d\ge 3$) under CPA with $d+1$ encryption queries and $2d$-round Type-I GFN under CCA with $d$ decryption queries. Query complexity depends on d, increasing branches can enhance anti-interference capability. (2) Developed classic full plaintext recovery attack on 2-round Type-II GFN ($d\ge 4$) under CPA with $3$ encryption queries and 3-round Type-II GFN under CCA with $1$ encryption plus $2$ decryption queries. Query complexity is independent of $d$, increasing branches does not improve resistance. (3) Finded that all attacks treat round functions as black boxes, confirming that the weakness resides in the GFN topology rather than specific round-function designs. Strengthening S-boxes or diffusion matrices cannot mitigate it, only increasing rounds beyond the security threshold provides effective defense.

GRAFHEN is a group-based homomorphic-encryption proposal whose public key is a rewriting system and whose secret key is a permutation representation. We present Maverick, an equivalent-key recovery attack. Maverick breaks every released GRAFHEN challenge, including the recommended two-copy $S_{11}$ instance: it reconstructs an equivalent key from public rules and correctly decrypts all $20{,}000$ supplied labelled ciphertexts. On $12$ independently generated recommended-parameter keys, the median end-to-end time is $552$ s and the median peak memory use is $11.28$ GB on an Apple M3 Pro. The attack converts selected public rewrite rules into group relators, reconstructs a regular action by Todd-Coxeter enumeration, recognizes the resulting permutation representations, and aligns the two sides through the public mixed relations. Public labelled encryptions then calibrate an equivalent decryptor. We prove a proof-carrying version of this procedure: a target-order table with a replayable trace certifies the recovered regular action. The reported $S_{11}$ experiments use target-order closure checks, complete-corpus verification, and decryptor validation. We also give an output-sensitive analysis and state the hypotheses needed to extrapolate beyond the measured instances. Following an independent key-recovery attack, GRAFHEN proposed in July 2026 to replace $S_{11}$ by $\mathrm{PSL}_2(343)$. We adapt Maverick to this setting and demonstrate complete public-rule recovery, alignment, certification, and calibration on generated $\mathrm{PSL}_2(169)$ instances. The two-side $q=169$ run decrypts all $5{,}000$ held-out ciphertexts in a $103$~s critical path using $0.93$ GiB peak memory; a $k=2$ admissibility-filtered corpus also succeeds. Under GRAFHEN's stated worst-case estimate for Dumezy's degree-based search, this degree $170$, $d=5$ setting already has cost $O(2^{850})$, well beyond the intended reach of that attack. At the target group, the post-enumeration recovery path from a generated regular action takes $35.0$ s and $1.92$ GiB peak memory. These results suggest that the proposed platform-group change is insufficient to rule out Maverick; recovery from an admissibility-filtered corpus at $q=343$ remains to be measured because the pre-filter KeyGen enumeration exceeded $32$ GiB of memory before it could produce a corpus.

This work presents ConvertInput-Free Vector Homomorphic Secret Sharing (Vector-HSS), a novel HSS primitive based on the Decisional Composite Residuosity (DCR) assumption. Our construction enables efficient high-dimensional vector computations while avoiding the costly $\texttt{ConvertInput}$ operation. As a unified framework, Vector-HSS can be used as a building block for Private Information Retrieval (PIR), Secure Multi-Party Computation (MPC), Privacy-Preserving Machine Learning (PPML), etc. The key idea behind Vector-HSS is to introduce a vector-centric computation paradigm. Unlike traditional approaches, this design allows the server to perform natural and efficient vector computations without the $\texttt{ConvertInput}$ operation while keeping client-side overhead comparable to that of state-of-the-art solutions. To further improve efficiency, we develop a batching mechanism based on the Chinese Remainder Theorem (CRT) that enables parallel computation across multiple vectors. Building on these techniques, we further design a suite of protocol modules to securely support Euclidean/cosine distance computation, comparison, and matrix-vector multiplication in practical applications. Experiments show that our scheme achieves $280\times$ and $70\times$ speedups over prior HSS schemes (EUROCRYPT 2021 and S&P 2026, respectively) for batched inner product evaluation. When applied to privacy-preserving image retrieval, our method achieves sub-second retrieval time, outperforming state-of-the-art solutions under similar security requirements.

We propose a complementary stopping strategy based on complex multiplication (CM) for the subfield-search stage of supersingular isogeny path-finding, a bottleneck in the Delfs-Galbraith/SuperSolver algorithm. The original search performs a non-backtracking walk in the supersingular \(2\)-isogeny graph until it reaches the subfield terminal set \(S_p\). Our idea is to enlarge the set of recognizable terminals, by adding a precomputed set of CM supersingular vertices. For a discriminant bound \(M\), we construct \(S_{\mathrm{CM}}(M)\) from roots of Hilbert class polynomials \(H_D(X)\) over \(\mathbb F_{p^2}\), where \(D\) ranges over inert negative fundamental discriminants with \(|D|<M\). The walk then stops upon reaching \(S_p\cup S_{\mathrm{CM}}(M)\). The only additional per-visit cost is an expected \(O(1)\) hash-table membership query in the precomputed CM terminal table. We estimate the size and preprocessing cost of \(S_{\mathrm{CM}}(M)\), obtaining the heuristic growth \(|S_{\mathrm{CM}}(M)|=\Theta(M^{3/2})\), and show that the overlap \(S_{\mathrm{CM}}(M)\cap S_p\) is lower order. We also give terminal-connection procedures showing how searches that stop at CM vertices can be converted into full isogeny paths under the standard quaternionic and KLPT heuristics. The method does not change the asymptotic exponent of the underlying Delfs-Galbraith search; instead, it provides a complementary technique for existing subfield-search methods by adding efficiently recognizable CM terminals. Experiments on small parameters show that enlarging the terminal union reduces both visited vertices and field multiplications, while lookup benchmarks at SQIsign parameters confirm that the additional table membership test has stable and moderate per-visit overhead.

We show that under a plausible number-theoretic conjecture, for any constant $s$ there exists an $s$-server private information retrieval (PIR) protocol that on an $n$-bit database requires communication $\exp(O((\log n)^{1/s} (\log \log n)^{1-1/s}))$. Previous constructions attaining the same communication required $2^{O(s)}$ servers. Our number-theoretic conjecture is implied by existing conjectures, namely the generalized repunit conjecture and Schinzel's hypothesis H (either one of these conjectures would suffice alone). Our result builds on the ``matching vector family + $S$-decoding polynomials'' framework pioneered by Efremenko (STOC 2009) and recently refined by Ghasemi, Kopparty, and Sudan (STOC 2025). The main ingredient is a framework for constructing $S$-decoding polynomials with only $k+1$ nonzero coefficients modulo special products of $k$ primes, resolving an open problem posed by Ghasemi and Kopparty (ITCS 2026). By the lower bound shown by Ghasemi and Kopparty, this is the minimum achievable sparsity. We also empirically validate our construction and make our result unconditional for all $s \leq 15$. We also apply our techniques to regimes where $s$ grows with $n$, showing under a stronger variant of our number-theoretic conjecture that the communication complexity of $s$-server matching-vector PIR can be superpolynomially reduced from the previous state of the art for any $s \leq \exp(o(\sqrt{\log \log n/\log \log \log n}))$. The main result for $s = O(1)$ and its proof were discovered in a GPT-5.5 Pro conversation prompted by the authors.

Vector commitment (VC) schemes enable a prover to commit to a vector and later open any position with a short proof. However, existing VC schemes are designed for centralized settings, and cannot work in decentralized systems, where the input vector is distributed across multiple machines. Similarly, traditional VC schemes cannot leverage distributed parallel computation across multiple machines for acceleration. To tackle this issue, we introduce a new notion—distributed VC (DVC), which allows multiple machines, each holding only a subvector of the input vector, to collectively commit to the entire vector and generate position proofs in a distributed manner. To the best of our knowledge, there is no prior work on DVCs and no existing work can trivially derive an efficient DVC scheme. The key challenge is that both commitments and proofs depend on the entire vector, while no single machine holds the complete vector in distributed settings. We propose the first DVC scheme, HLE-DVC, which leverages $M$ machines to process the distributed vector $\mathbf{v}$ of length $N$ in parallel, with each machine holding a subvector of length $\frac{N}{M}$. HLE-DVC achieves compact proof size-$\text{O}(\log M)$ and allows each machine to generate all its position proofs in a single communication round, with communication cost $\text{O}(\log M)$ and computation cost $\text{O}(\frac{N \log N}{M})$. Moreover, HLE-DVC supports batch proving, proof aggregation, and efficient updates. We conduct the experiments and open-source the code. Using 256 machines to generate all proofs for a committed vector of length $2^{30}$ takes 17,515 seconds. This achieves a $256\times$ parallel speedup over HLE-DVC on a single machine, and is $142\times$ faster than Hyperproofs (a famous single machine VC scheme). The communication cost per machine is 0.768 KB.

The Signal Protocol’s Double Ratchet and X3DH/PQXDH handshakes give in-transit messages forward secrecy and post-compromise security: compromising a session key does not expose past traffic, and the protocol self-heals after a fresh Diffie–Hellman step. Encrypted backups, by contrast, are commonly protected by a single static secret, a “Backup Recovery Key” generated once and held constant until manually rotated. We show, with an explicit attack, that this baseline design provably fails even a minimal forward-secrecy-style security notion: disclosure of the key at any time exposes the entire backup history, with no self-healing. This is not a hypothetical concern: a June 26, 2026 joint FBI/CISA advisory attributes exactly this exploitation pattern to two Russian intelligence-linked clusters, tracked as UNC5792 and UNC4221, who obtained victims’ Backup Recovery Keys through impersonation-based social engineering rather than cryptanalysis. We propose STEBR (Secure Timed-Erasure Backup Ratchet), a backup-key architecture built from three composable layers: (1) a self-erasing hashchain key ratchet so that compromise of the current backup key exposes only a bounded, recent window of history rather than the full archive; (2) (t, n) threshold secret sharing of the current epoch key across independently held devices/guardians so that no single credential extracted in one social engineering interaction is sufficient; and (3) an interactive, rate-limited, out-of-band confirmation gate on any restore request so that possession of valid recovery material is necessary but not sufficient to complete a restore. We give formal security definitions for each property and prove them via standard reductions (PRF security of the key-derivation function, IND-CPA security of the backup AEAD scheme, the information-theoretic secrecy of Shamir sharing, and the authenticity of the existing ratchet-protected control channel). All three layers are composed on top of existing Signal Protocol primitives; none require modifying the Double Ratchet, X3DH/PQXDH, or the wire format of message envelopes. This is a proposal for hardening the backup-key management layer specifically; we make no claim that the Signal Protocol’s transport-layer cryptography is broken or requires replacement the cited advisory itself states plainly that it is not.

Almost fifty years after its introduction, the McEliece cryptosystem occupies an unusual place in the post-quantum landscape. Its public keys are far larger than those of most competing schemes, its original parameters no longer provide adequate security, and several compact variants proposed to reduce key size have subsequently been broken. Nevertheless, the binary Goppa-code foundation retained in Classic McEliece continues to resist known practical attacks for the selected Classic McEliece parameter sets. This survey asks why McEliece has remained relevant despite these limitations. We trace its development from the original 1978 encryption scheme to the modern Classic McEliece key-encapsulation mechanism and organize nearly five decades of cryptanalysis into generic decoding, structural recovery, attacks on compact variants, protocol-level attacks, implementation leakage, and quantum speedups. We emphasize several distinctions that are often blurred in discussions of the scheme: breaking an obsolete parameter set is not the same as recovering the hidden Goppa structure; distinguishing a public code does not necessarily lead to practical key recovery; and compromising a modified or structured variant does not automatically compromise Classic McEliece. This history does not support either of two simple narratives: that McEliece has remained unchanged or that it has simply been broken. Its longevity reflects a conservative mathematical foundation that has survived repeated reassessment, together with parameters, security models, and implementations that have evolved in response to new attacks. We close by outlining the main questions that will shape its future: whether public-key and key-distribution costs can be reduced without exposing exploitable structure, how far modern algebraic cryptanalysis can be extended, how classical and quantum security estimates should be refined, and how secure implementations can be integrated into practical systems.

We give an unconditional construction of information-theoretically secure one-time private-key unclonable encryption scheme for one-bit messages, with efficient encryption and decryption and exponentially small unclonable-indistinguishability advantage.

A central challenge in quantum algorithm analysis and cryptography is reasoning about algorithms with oracle access to a random group element (e.g. a random function, a random permutation, a random unitary). Can we efficiently simulate such algorithms? Can we determine what they know after $t$ queries? Classically, an important tool for this is lazy sampling, where the oracle does not commit to the full group element at the beginning, but rather samples partial information about it on the fly. We study a quantum analog of lazy sampling: compressed oracles (or recording oracles), which are quantum data structures that allow such on-the-fly simulation for quantum queries. Compressed oracles were originally introduced by Zhandry (CRYPTO '19) for random functions, were generalized to random unitaries by Ma-Huang (STOC '25) and to permutations by Carolan (STOC '26), and have been employed to great effect in security proofs and query complexity lower bounds due to their interpretability. In this work, we define and analyze a general-purpose and interpretable path-recording oracle, derived from first principles, that perfectly simulates random elements of any closed subgroup of $U(N)$. Our path-recording oracle stores superpositions of $t$ input-output pairs $|(x_1, y_1), \dots, (x_t, y_t)\rangle$, which encode a Feynman path explored by the algorithm and thus transparently records the information that the algorithm may have learned from its queries. Our compressed oracle builds on a recent work of Grinko and Yoshida (QIP '26), who proposed a different kind of general-purpose compressed oracle without clear interpretability. Crucially for applications, we derive an operationally useful mathematical description of our update procedure in terms of the commutant of the group's tensor power representation. One powerful feature of our path-recording oracle is that it enables direct comparisons between compressed oracles for different groups, which gives a new technique for proving pseudorandomness results. For our main application, we formally relate the $S_N$ and $U(N)$ compressed oracles, yielding what is arguably the simplest construction to date of pseudorandom unitaries: the product $PC$ of a pseudorandom permutation and a random Clifford. This improves on the prior $PFC$ construction of (Metger-Poremba-Sinha-Yuen, FOCS '24; Ma-Huang, STOC '25).

We give, to our knowledge, the first plain-model, one-time information-theoretically secure, efficient unclonable encryption scheme for one classical bit. Previous work by Bhattacharyya and Culf (Nature Physics, 2026) and Bhattacharyya, Broadbent, and Culf (arXiv:2603.08916) either only showed $1/\mathsf{poly}(\lambda)$ security loss or required inefficient encryption/decryption operations. We avoid both of these caveats; in doing so, we obtain (to our knowledge) the first plain-model construction of many-time secure $1 \to 2$ unclonable encryption for arbitrary polynomial-length messages, assuming the existence of pseudorandom function-like states (Bartusek and Goldin, arXiv:2605.27647). The key is a uniformly random non-identity phase-free Pauli on $n$ qubits, and bit $a$ is encrypted as a random $(-1)^a$ eigenstate of that Pauli. Encryption and decryption use $O(n)$ single-qubit operations and $O(n)$ time classical computation; key generation uses only $O(n)$ time classical computation. The scheme is exponentially secure; we prove that the probability that both receivers recover the bit is at most $\frac{1}{2}+\frac{1}{2}\sqrt{{2^n}/({4^n-1})} = \frac{1}{2} + O\left(2^{-n/2}\right).$ By a lower bound due to Broadbent, Culf, and Rochette, this is the best probability bound achievable with $n$-qubit ciphertexts (up to the constant hidden in the $O(\cdot)$). The main conceptual idea is to leverage, in a precise spectral sense, the balanced commutation-anticommutation structure of the Pauli group. The proof is intricate but completely elementary and makes use of standard spectral bound techniques. The main technical workhorse is a standalone linear-algebraic lemma which we present in its own section: informally, it relates the positivity of two different operators, each capturing the intuition that if the two receivers can individually decrypt unusually often then they must also disagree often. GPT-5.6 Sol Ultra found this proof in an extended conversation with the author and drafted a preliminary version of this paper. The author is fully accountable for the correctness of this paper.

Recent advances in quantum hardware, including Google's Willow processor, have substantially narrowed the timeline to cryptographically relevant quantum computers. In the blockchain setting, where addresses and key derivation standards such as BIP32, BIP44, and SLIP-10 are the dominant infrastructure for wallet management, a quantum computer running Shor's algorithm can recover any elliptic-curve private key from the corresponding public key, threatening every wallet in production today. Migrating to post-quantum signature schemes requires changing the public key format and forcing address migration across all participating networks, a significant problem for blockchain communities. We present an orthogonal approach: keep the existing address format entirely unchanged and instead replace the classical signing step with a NIZK proof of knowledge of the seed underlying the existing address, where security against quantum adversaries reduces to the conjectured quantum hardness of the underlying hash functions and the soundness of the NIZK against quantum adversaries, requiring no address migration or key registration. We build on the observation of Baldimtsi et al. that EdDSA's deterministic seed-to-key mapping makes the seed a valid zero-knowledge witness for the public key, and extend their single-level result to the full hierarchical deterministic wallet setting. Starting from BIP32-Ed25519, we replace the classical signing step with a NIZK proof certifying knowledge of the root seed and the full derivation chain, and prove EUF-CMA security for the resulting scheme; post-quantum security is conjectured to hold since all underlying primitives depend only on the hardness of hash functions and the soundness of the NIZK against quantum adversaries. The existing schemes each derive their quantum-safe witness as an incidental artifact of a curve-specific key format, and none provides a single derivation standard that works uniformly across curves. We therefore introduce QBIP32, a new key derivation scheme based on a keyed function HASH768 (instantiated with KMAC256) that produces the signing scalar, an explicit quantum-safe witness, and the chain code in a single call. QBIP32 is defined for any elliptic curve group of prime order with a fixed generator, requiring no structural change to the derivation or proof system across curves: the same construction covers secp256k1, Ed25519, and any future curve used in blockchain infrastructure. This universality stands in contrast to the BIP32-Ed25519 approach, which relies on the Ed25519 extended key format and has no analogue for other curves. We then address the efficiency problem: a monolithic proof of the full derivation chain has cost growing linearly with derivation depth. Our main contribution is ZKPoSP (Zero-Knowledge Proof of Seed Provenance), a signature scheme conjectured secure against quantum adversaries that splits the proof into a derivation proof generated once per key pair and a signing proof generated once per message, reducing per-message proving cost to a constant independent of derivation depth. We further characterise exactly when the derivation proof itself can be shortened to cover only the last step of the derivation rather than the full chain from the root seed, and identify the existence of a private value that is bound to the seed by a one-way function and not recoverable from the public key as the precise criterion. This criterion is met by hardened keys but not by non-hardened keys, a structural distinction common to all schemes: BIP32 secp256k1, SLIP-10/Ed25519, BIP32-Ed25519, and QBIP32 all admit a last-step derivation proof for hardened keys, while non-hardened keys require a proof reaching back to the last hardened ancestor. We exploit this for BIP44 paths to prove only one hardened step plus the non-hardened suffix in a single proof, allowing the root seed to be removed from the proving device once the anchor node is generated, while remaining in secure long-term storage. Before Q-day, separating the derivation and signing proofs already reduces per-transaction cost to a constant independent of derivation depth. After Q-day, once networks reject all non-post-quantum signatures, the leaf scalar can be moved to the public statement, removing all elliptic-curve scalar multiplications from the proof circuit and reducing derivation proving time substantially. We implement all constructions in Rust using RISC Zero as the NIZK backend, instantiate HASH768 with KMAC256, and report benchmarks for monolithic proofs, ZKPoSP across full BIP44 paths, and the post-Q-day variant. Signing proving time is constant at approximately 12-13 seconds and verification time is constant at approximately 9-10 ms across all variants and depths.

We observe that the existing norms within cryptography do not expect protocol analysts to document the sociotechnical properties that a deployed system should have. To help close this potential gap, we develop a framework that allows bringing sociotechnical dimensions into analyses of cryptographic systems, and in particular facilitates "in-context" analysis of proposed cryptographic deployments on top of widely-accepted cryptographic modeling techniques. To explore the utility of our framework, we use Apple's 2021 CSAM scanning proposal as a case study. We show how our framework naturally surfaces many of the criticisms of Apple's proposal and helps us identify a previously undocumented property of the proposal.

FAEST is a family of post-quantum signature schemes based on VOLE-in-the-Head, and is one of the nine candidates advanced to the third round of the NIST Additional Digital Signature process. FAEST relies only on symmetric cryptographic primitives, including block ciphers and hash functions, and does not require structured number-theoretic assumptions. We propose two families of signature schemes, SM4th and uBlockith, targeting 128-bit and 256-bit classical security, respectively. SM4th and uBlockith follow the FAEST framework but instantiate it with Chinese-designed block ciphers, including SM4, uBlock, and Ballet. We further design constraint systems tailored to these block ciphers and provide instruction-set-aware optimized implementations. Our evaluation on two Intel platforms and a Hygon platform shows that the end-to-end performance of the proposed schemes is strongly platform dependent. On an Intel platform with native SM4 support, the SM4th variants achieve performance comparable to the corresponding FAEST-128 variants, with a gap of less than $1\times$. On the Hygon platform with native CIS-SM4 support, the SM4th variants are within approximately $3\times$ of FAEST-128. The SM4th-EM-s (short) variant has a combined public-key and signature size of $3\,850$ bytes, compared with $3\,938$ bytes for FAEST-EM-128s. The uBlockith variants remain approximately $3$--$4\times$ slower than FAEST-256. These results demonstrate the feasibility and costs of instantiating VOLE-based signatures with the selected Chinese block ciphers.

Standard Tseitin encodings of the SHA-256 nonlinear functions Ch and Maj can hide conditioned differential projections from Boolean Constraint Propagation (BCP). We materialize them as short, semantically redundant CNF clauses. A cofactor theorem characterizes all controlled differential linear forms; its implemented unit-vector specialization returns exactly all minimum-control projections, yielding four Ch and twelve Maj clauses per bit. The clauses preserve models, introduce no variables, and strictly strengthen BCP on an explicit gate fragment. We claim neither propagation completeness nor a general affine compiler. We evaluate mechanism separately from performance and distinguish the production bundle from the proposed layer. Frozen studies show a fixed-formula bundle benefit, but the matched clause isolation fails its effect gate and an unrestricted control is inconclusive. We therefore show neither a solver-independent speedup nor a new cryptanalytic attack. The restricted weight-15 C15 census passes the CaDiCaL rule but not the Kissat rule. In the stratified C16 extension, the frozen decisions are too censored for CaDiCaL and too censored for Kissat; these solver-stratified labels are not pooled. A pinned three-solver replay validates larger-bundle execution but cannot attribute performance to the clauses. A variable-preserving probe exposes all 32 tested implications only after augmentation.

Public blockchains expose all state and computation by default, which is incompatible with financial applications that require confidentiality. Solana achieves high throughput and sub-second confirmation, making it an attractive settlement layer, yet it offers no general mechanism for computing over encrypted state: fully homomorphic encryption (FHE) remains orders of magnitude too slow for interactive use, secure multi-party computation (MPC) incurs heavy communication, and Solana’s native confidential-transfer extension hides only token amounts and supports no programmable logic. We present Encifher, a confidentiality coprocessor for Solana that brings general, programmable computation over encrypted state to a high-throughput chain. Encifher adopts the ciphertext-handle and symbolic-execution interface of confidential-computing coprocessors (e.g., Zama’s fhEVM), but resolves it inside a Trusted Execution Environment (TEE) rather than with a fully homomorphic evaluator: on-chain Solana programs manipulate only 128-bit handles to ciphertexts, while an off-chain coprocessor running inside a hardware enclave fetches the corresponding ciphertexts from a public data availability layer, decrypts and computes on plaintext within the enclave, re-encrypts, and commits attested, Merkle-anchored results back on chain. A key observation is that Solana’s account model and parallel (Sealevel) scheduler turn the transaction’s declared read/write set into the dependency graph of the confidential computation, yielding parallel, correctly-ordered execution of encrypted operations without a bespoke scheduler. To avoid the single-point-of-failure of an enclave holding a master decryption key, Encifher distributes trust across a threshold-decryption committee and verifies enclave attestation on chain. Encifher is deployed in production, powering confidential payments, swaps, and a cross-chain bridge. In production, a confidential swap settles in a single Solana transaction costing 157,000 compute units; the AES-256-GCM symmetric-encryption layer runs at over a million operations per second and threshold decryption completes in single-digit to tens of milliseconds (near-plaintext speed, against the many-orders-of-magnitude overhead of FHE), and Encifher has served over 5,000 users and 50,000 confidential operations. We are explicit about the cost of this design point: Encifher reduces the trust base to TEE integrity, honest threshold key management, and the cloud attestation root, rather than to cryptographic hardness alone.

Sender untraceability hides the account spent by a cryptocurrency transfer among a set of candidates, its masking set. What a transfer does to that set separates two designs: classical schemes retain the whole set and append a nullifier marking the spent account, so the ledger grows with every transfer; constant-state schemes instead consume and replace the entire set. We ask how this choice affects synchronization. We formalize the two designs as the linear and constant untraceable asset transfer objects (LUAT and CUAT) and locate them in the consensus hierarchy. In LUAT, transfers from distinct accounts commute. Its consensus number is 2, compared with 1 for standard asset transfer, independently of the masking-set size and of the untraceability notion, and LUAT is starvation-free. Partitioning the accounts into fixed masking sets lets exhausted sets be garbage-collected without increasing that number. In CUAT, a transfer consumes and replaces every account of its masking set, so two transfers whose sets intersect cannot both take effect. We formalize this with the conflict graph on masking sets, whose edges join sets sharing an account. Under weak untraceability, which protects a transaction in isolation, the consensus number is unbounded already for one-round protocols. Under strong untraceability, which protects against an observer of the complete history, untraceability holds on a history exactly when any two accounts sharing a masking set occur in the same number of the masking sets in it. This uniform incidence bounds the conflict graph, and matching constructions attain it, so the consensus number is determined exactly and grows quadratically in the masking-set size. Finally, CUAT is not starvation-free. The two objects therefore pay for the same privacy differently: LUAT in storage, CUAT in synchronization and fairness.

Recent advances in fully homomorphic encryption (FHE) have enabled privacy-preserving machine learning directly over encrypted data. As a representative recurrent architecture, the long short-term memory (LSTM) network is widely used for modeling sequential dependencies, yet existing FHE-based LSTM inference schemes still suffer from high latency and limited scalability. In this paper, we present an efficient privacy-preserving LSTM inference protocol on encrypted sequential data based on FHE. We insert a lightweight normalization module before nonlinear activations to bound the hidden states, thereby enabling accurate low-degree polynomial approximations of the Sigmoid, Tanh, and inverse square-root functions via a hybrid Remez and least-squares strategy. We implement the proposed protocol using the Lattigo library, incorporating ciphertext packing optimization, rotation minimization, and SIMD-based parallelization. Experiments show that on standard text classification benchmarks, our encrypted LSTM achieves competitive accuracy compared with plaintext models and consistently outperforms the state-of-the-art FHE-based method, achieving up to a 4.7x speedup.

Free Hosting Platforms (FHPs) let users publish websites with minimal cost and configuration, but the same provider-managed infrastructure can also be used to host phishing websites. We study how this setting affects Certificate Transparency (CT)-based phishing detection by analyzing X.509, CT, and URL features across FHP phishing, FHP benign, non-FHP phishing, and popular benign websites. Reflecting the shared and wildcard certificate practices common in this setting, we analyze the certificate-level and domain-level data separately. Our measurement study shows that many apparent phishing indicators instead reflect hosting-provider characteristics: in our domain-level correlation analysis, hosting-platform status is more strongly associated with the extracted X.509, CT, and URL features than phishing status is, with the strongest FHP-associated feature (subdomain levels, $\eta=0.54$) exceeding the strongest phishing-associated feature (certificate validity period, $\eta=0.31$). We further evaluate two representative CT-based phishing detection frameworks on FHP-only data and discover that provider-managed infrastructure creates challenges for applying them directly. These findings show the need for future work on CT-based phishing detection methods that account for this deployment setting, especially as AI tools lower the effort required to create convincing phishing websites at scale.

Zero knowledge is formalized via a simulator — i.e., an efficient computation which simulates the view of a (malicious) verifier. The foundational results in constant-round zero knowledge [GMW86,FS90,GK96] all use expected polynomial-time (EPT) simulators, and there is evidence that strict poly-time simulators do not exist for these protocols [BL02]. In the post-quantum setting, we must upgrade the simulator to at least quantum polynomial time (QPT) in order to properly simulate quantum verifiers. Chia et al. [CCLY22] proved a surprising negative result which precludes non-trivial ZK for constant-round protocols with both (strict) QPT and a natural notion of expected quantum polynomial-time (EQPT) black-box simulation. In light of this, Lombardi, Spooner, and Ma [LMS22] introduced a novel EQPT notion, coherent-runtime EQPT or EQPT$_c$, and showed that the [GMW86,FS90,GK96] protocols all allow for EQPT$_c$ simulation. In this work, we identify a fundamental issue with the definition of EQPT$_c$ simulation, and propose a resolution. In particular, we demonstrate that EQPT$_c$ computation is not necessarily efficient and can, in fact, decide any classical decision problem. This is possible through a freedom of choice in selecting a unitary dilation for an efficient quantum channel. We propose an revised definition which carefully restricts this choice, and prove that the definition preserves the zero knowledge of the [GMW86,FS90,GK96] protocols. Additionally, by upgrading the [GK96] framework to the fully quantum setting, we demonstrate for the first time a constant-round (malicious verifier) zero knowledge proof system for QMA (with EQPT$_c$ simulation).

Password-based authentication remains widespread, and large-scale sets of leaked hashes enable practical offline brute-force attacks. Multi-target attacks, which check candidates against large sets of hashes simultaneously, are particularly effective. Understanding the capabilities of low-cost platforms for such attacks is important to assess real-world password security risks. Therefore, we present BF², a modular and scalable FPGA–CPU framework that accelerates multi-target password recovery. BF² combines a password-candidate generator, a fully-pipelined NT hash core, a Bloom filter stage to filter non-matching candidates, and a multi-threaded host-side component that performs exact membership check using a perfect hash function. We implement BF² on the low-cost, \$199 NiteFury II board. With 16 parallel pipelines running at a 100 MHz clock frequency, our FPGA implementation generates $1.6\times10^9$ hashes/s. In our experiments, BF² demonstrates up to $7.5\times$ higher throughput than John the Ripper, and reduces power consumption by as much as $90\%$ compared to Hashcat on an RTX 5000.

For cryptosystems whose security relies on the hardness of decoding in the sublinear regime, the best known attacks are based on Information Set Decoding (ISD). In this regime, which is particularly relevant to HQC and Pseudorandom Correlation Generators (PCG), the cost of Gaussian elimination is no longer negligible and significantly affects the overall attack complexity. In this work, we revisit the Reduce-and-Prange technique of Kim and Lee, which reduces the cost of Gaussian elimination by reusing partial pivots. We refine its complexity analysis using branching-process techniques, thereby obtaining a more accurate assessment of its performance. We then extend partial pivot reuse to Stern's algorithm and introduce MAGE-Stern, a multilevel amortized Gaussian elimination variant of Stern's algorithm. Under a consistent logic-gate cost model, MAGE-Stern improves upon the best previously known attack against HQC by approximately 3 bits in time complexity, while reducing the memory complexity by about 12 bits. In particular, we estimate the security of the standardized HQC Category I parameter set at approximately 140 bits, about 3 bits below its NIST security target. We further combine multilevel amortized Gaussian elimination with the projective decoding framework of Carrier, Hatey, and Tillich, and investigate its application to regular decoding. Applied to the reference Pseudorandom Correlation Generator (PCG) parameter sets of Boyle, Couteau, Gilboa, and Ishai, the resulting algorithms improve upon the best previously known attacks by up to 6 bits across a broad range of practical parameters.

Private set union~(PSU) allows two parties to compute the union of their private sets without revealing their intersection. In many real-world applications, parties' datasets undergo frequent updates as elements are added or removed over time. Existing PSU protocols, however, must recompute the entire union from scratch whenever either party's set changes. This becomes highly inefficient when updates are small or frequent relative to the original set sizes. In this paper, we introduce the first updatable PSU~(uPSU) protocol for the standard two-party setting, which supports efficient incremental updates. We present a systematic classification of all possible update scenarios, which shows that only a small subset of updated elements actually modify the union, and establish the leakage baseline for uPSU. Based on these classification and leakage baseline, we provide a generic construction for uPSU that uses existing PSI and a tagged variant of PSU as building blocks. We prove security against semi-honest adversaries in the simulation-based model, and guarantee that incremental updates reveal no more information than a fresh execution of a standard PSU protocol on the updated sets. We instantiate and implement our generic construction using Kim et al.'s PSU protocol~(ACM SAC 2026) and Raghuraman and Rindal's PSI protocol~(ACM CCS 2022), demonstrating significant performance improvements over full recomputation of the union, even though its cost still depends on the original set size rather than purely on the update size. For set size $n = 2^{20}$ and update size $t = 2^{12}$, our protocol achieves a 14.1--45.4$\times$ speedup with a 4.8--59.1$\times$ communication reduction over full recomputation using baseline PSU protocols.

In the information-theoretic model, parties communicate over sender-authenticated point-to-point channels, but use no digital signatures or other transferable cryptographic certificates; the adversary is otherwise computationally unbounded. We present \name, an information-theoretic Byzantine agreement protocol for partial synchrony with a good-case latency of two rounds that achieves the optimal resilience bound of $n = 5f - 1$ in this setting. When the actual network delay after GST is at most $\delta \le \Delta$, our protocol achieves a \emph{robust} good-case latency of $2\delta$. The protocol proceeds in views and guarantees a worst-case view latency of at most $2\Delta + 2\delta$. Moreover, each party requires only $O(1)$ words of persistent storage, and each view incurs $O(n^2)$ messages of $O(1)$ words each.

Outsourcing computations to cloud providers raises significant data privacy concerns, making Privacy-Preserving Computation via Fully Homomorphic Encryption (FHE) increasingly vital. However, adapting data sorting routines to the FHE domain introduces severe performance bottlenecks. This survey systematizes the state-of-the-art in FHE-based sorting algorithms. A novel complexity metric, FHE-Effort, is introduced to accurately evaluate homomorphic circuit efficiency. Eighteen algorithms are benchmarked across three major FHE schemes using a unified codebase. The analysis concludes that TFHE is currently the most efficient scheme for sorting applications, and sorting networks like Odd-Even Merge and Bitonic Sort offer the optimal algorithmic architectures.

Efficient polynomial multiplication and matrix-vector operations are fundamental to computational algebra and modern cryptography. In lattice-based post-quantum cryptography (PQC), schemes utilizing Number Theoretic Transform (NTT)-unfriendly rings require highly optimized subquadratic multiplication algorithms. In this paper, we establish a rigorous mathematical framework for generalized $k$-way split polynomial multiplication and Toeplitz Matrix-Vector Product (TMVP) algorithms over arbitrary fields. First, we construct generalized $k$-way Schoolbook and Karatsuba multiplication algorithms, deriving exact closed-form recurrence relations and arithmetic complexities for any integer $k$. Second, we introduce a novel $k$-way TMVP algorithm utilizing optimal evaluation points and matrix row-reversal techniques. We mathematically prove that this generalized formulation strictly achieves the theoretical interpolation lower bound, requiring exactly $2k-1$ subproblems and yielding a subquadratic asymptotic complexity of $O(n^{\log_k(2k-1)})$. Furthermore, we determine the optimal consecutive application sequence of $k$-way Karatsuba and Schoolbook algorithms for any input size $n$, proving that the peak efficiency is driven entirely by the prime factorization of $n$. Finally, we establish exact algebraic crossover thresholds, demonstrating that our generalized TMVP formulas and optimal algorithmic sequences significantly outperform state-of-the-art unequal $k$-way splits and classical combinations in the literature, providing minimum arithmetic operation counts for $k \in \{5, 6, 8, 12\}$ and inputs of power-of-two and power-of-three dimensions.

Over the last decades, symbolic (Dolev-Yao) methods for the analysis of security protocols have proven to be effective to analyze and establish strong guarantees for widely deployed protocols and systems, such as TLS 1.3, E-voting protocols, EMV, and MLS. On the one hand, analysis methods like Tamarin and ProVerif provide automation and support for user-defined equational theories. On the other hand, methods like DY* offer more flexible and modular reasoning, but hardcode threat models and do not support custom equational theories. We present DyLean, a framework for the symbolic analysis of cryptographic protocols in the Lean theorem prover. Our framework comprises both a flexible general-purpose symbolic semantics, as well as a concrete proof methodology. DyLean allows defining protocols and expected security properties; its semantics and equational theories can be customized by the user. Furthermore, the semantics are agnostic of the specific proof methodology: our goal is to provide a generic framework that can be used by the community as a foundation to develop various proof methodologies. Moreover, we provide a concrete proof methodology inspired by DY*, based on trace invariants. Thus, DyLean inherits from the qualities of DY*: it is able to analyze protocols involving unbounded loops or datastructures, and is able to compose security proofs in a variety of scenarios. Our proof methodology improves on DY* by allowing for user-defined equational theories and threat models. We exercise DyLean on several focused case studies, which include protocols using merkle trees, ratcheting protocols, post-quantum protocols, and protocols analyzed under different equational theories, which demonstrates that DyLean can effectively analyze protocols with each of these features.

Proof-of-useful-work (PoUW) certifies computational hardness, not utility: a certified computation need not be anyone's demanded job. We separate three properties of a work receipt — work soundness ($\mathsf{W}$), job binding ($\mathsf{B}$), and demand exogeneity ($\mathsf{E}$) — and locate the gap at $\mathsf{E}$. Two results are unconditional. First, payments between coalition-controlled requesters and workers are recoverable transfers that contribute no Sybil-resistant cost, so no security lower bound may count them (Lemma 1). Second, under free pseudonyms and endogenous observation a coalition can simulate the receipts of economically independent requesters, so endogenous receipts cannot certify $\mathsf{E}$ (Theorem 1); we lower-bound the cost of evading a stated class of provenance estimators. Building on these, a robustness bound: because a permissionless mechanism must remain live on the zero-demand path, its leader-election floor cannot depend on the demand component of service receipts (Theorem 2), and any admissible receipt boost is quantitatively capped. Fork-independent salvage value of useful outputs can leave security neutral, negative, or positive depending on salvage asymmetry and demand, which we characterize in a stylized free-entry model. Constructively, an irrecoverable tax on every settled payment makes the burn — not proof of independence — the security resource. Deployed evidence comprises one reported audit (Pearl cuPOW) and a reward-program farming analogue; the election-side failure is, at present, a model prediction. Useful-computation receipts are appropriate instruments for payment, collateral, and loss allocation — and a bounded, priced election boost — but not the leader-election floor.

Hamming Quasi-Cyclic (HQC) is a code-based key encapsulation mechanism selected by NIST for standardization, making its resistance to implementation attacks critically important. We present a side-channel attack that exploits load/store leakage in the manipulation of HQC's sparse secret vectors. Analysing Cortex-M4 assembly generated from the reference implementation, we identify a leakage surface in which the low and high 32-bit halves of each 64-bit word leak with different strengths, due to compiler-generated register spilling. We exploit this leakage to construct a simple zero-word distinguisher classifying machine words of the secret vector as zero or nonzero from electromagnetic measurements. The recovered zero positions are then translated into decoding hints, reducing HQC key recovery to a shortened syndrome-decoding problem. We analyse the resulting decoding complexity for all HQC parameter sets: at 32-bit granularity an expected $88.7\%$ of the machine words of~$y$ are zero for HQC-1, cutting the decoding to ${\approx}\,2^{46}$ bit operations. Experiments on a Cortex-M4 validate the predicted low/high-half asymmetry---approximately $500$ traces for the stronger low-half channel and $5{,}000$ for the weaker high-half channel---and recover the zero words of an HQC-1 key at 32-bit granularity. Finally, we discuss practical countermeasures that eliminate the sparsity exploited by the attack.

We formalize the notion of polynomial commitment schemes (PCSs) in the proof assistant Isabelle/HOL and formally verify the security proofs of two variants of the widely popular Kate, Zaverucha, and Goldberg (KZG) construction. Moreover, we formalize the Algebraic Group Model (AGM) by Fuchsbauer, Kiltz, and Loss using a novel constraint-programming-inspired approach. We formalize a reusable abstract definition of polynomial commitment schemes and define games for correctness, binding, hiding, and knowledge soundness/extractability. Based on this, we verify all applicable security proofs for two concrete PCS constructions: the standard (DL-)KZG and a batched KZG, using our AGM formalization in the knowledge-soundness proofs. Our proofs follow Shoup’s sequence-of-games approach, with machine-checked transitions, and are carried out in the CryptHOL framework for formal verification of cryptography in Isabelle. To our knowledge, this work is the first formalization of polynomial commitment schemes, the first formalization of the AGM, and the first formal verification of the security proofs for any concrete polynomial commitment scheme. This work lays the foundation for the formal verification of advanced cryptographic constructions, such as pairing-based zero-knowledge proofs (ZKPs) and succinct arguments.

We study large-scale, field-agnostic, hash-based polynomial commitment schemes (PCSs) with the goal of minimizing prover time while preserving polylogarithmic proof size and verifier time. This setting is motivated by advanced applications of zero-knowledge succinct non-interactive arguments of knowledge (zkSNARKs) such as zero-knowledge machine learning (zkML), where committed polynomials may encode billions of parameters and large prime fields are desirable for avoiding wraparound in fixed-point arithmetic. We introduce SwitchFold, a generic construction of a hash-based multilinear PCS from any sequence of linear codes with geometrically increasing block lengths. The polylogarithmic proof size and verifier time do not rely on any specific algebraic structure of the codes, while the linear prover time follows solely from the linear encoding time. At its core, SwitchFold recursively applies the code-switching technique (Ron-Zewi and Rothblum, JACM ’24), reducing each multilinear extension (MLE) claim under one code to a simpler MLE claim under a shorter code. The generator-matrix MLE claims produced by code switching are accumulated across repeated PCS openings using an accumulation scheme (Bünz et al., TCC ’20), and are then proved through a final recursion. We instantiate SwitchFold with the Brakedown code sequence (Golovnev et al., CRYPTO ’23), whose recursive code structure aligns naturally with our framework; we call the resulting scheme BrakeFold. In contrast to prior code-switching PCSs such as Blaze (Brehm et al., EUROCRYPT ’25) and BrakingBase (Nair et al., ASIACRYPT ’25), SwitchFold does not require an auxiliary foldable code. At the scale of one billion coefficients and 100-bit security, the marginal cost of each additional PCS opening in BrakeFold yields 3.5× smaller proof size and 20.6× faster verification than Brakedown, with only a 1.3× increase in prover time. Its succinctness matches that of BaseFold (Zeilberger et al., CRYPTO ’24), while reducing prover time by 17.0×.

As the usage of Artificial Intelligence (AI) for sensitive purposes increases, there is a growing need for privacy-aware explainable AI (XAI) tools. In this paper, we present a privacy-preserving counterfactual explanation algorithm. Our starting point is a decision-support model that is able to operate on vertically partitioned datasets, meaning that each party holds a different subset of datapoint attributes. The goal of a counterfactual algorithm is to find, given an observation, a datapoint from the (virtual) dataset that is closest to the observation but has a different label. Our algorithm fully preserves the privacy of the n datapoints belonging to the different parties by combining the strengths of homomorphic encryption and secret sharing. Through a number of experiments, we demonstrate the added value of combining multiple datasets in a realistic scenario and show that the privacy-preserving solution does not affect the accuracy. We fully implement our solution and demonstrate that it scales as to thousands of datapoints.

Recently, Shark (S\&P'25) considered the problem of actively two-party secure machine learning inference using an authenticated distributed comparison function (DCF). This is the state-of-the-art work in this setting. On the other hand, Grotto (CCS'23) built a variant DCF with the key size half that of classic DCF. Unfortunately, as Shark states, \textit{it is not known how to extend Grotto to the malicious setting}. In this paper, we present the first actively secure Grotto-style DCF scheme. Our authenticated DCF is deliberately designed on the correlated GGM tree and maintains the key-size advantage of semi-honest Grotto. We further implement an actively secure ML inference framework, named LightShark, which supports efficient primitives (e.g., ReLU, spline, and truncation) and ML models (e.g., VGG-16, GPT, BERT). Compared with Shark, our LightShark outperforms by $1.49 \times \sim 2.69\times$ and reduces communication costs by $66.7\%$ for Bert-base inference. Surprisingly, for larger LLM models, the experimental evaluation demonstrates that our framework works vastly well.

We prove that under a plausible heuristic assumption (on the smoothness of certain random integers), the supersingular isogeny problem can be solved in time and memory $p^{1/3 + o(1)}$. This improves upon the previous best complexity of $p^{1/2} \cdot(\log p)^{O(1)}$. This problem is arguably the central hard problem underlying isogeny-based cryptography, and the cost of its resolution is a major (and often the only) factor in the choice of secure parameters. The impact on concrete parameter sets remains to be clarified, as the asymptotic advantage of the new algorithm is mitigated by a superpolynomial overhead hiding in the $o(1)$ exponent, and by its high memory requirement.

Hybrid homomorphic encryption (HHE) lets a constrained client send compact symmetric ciphertexts while a server transciphers them into homomorphic ciphertexts, making HE-friendly ciphers such as PASTA a practical choice. Efficient and side-channel-secure execution of PASTA on embedded devices, however, remains challenging, since existing hardware relies on dedicated cipher cores and provides no side-channel protection. We present a hardware/software co-design of PASTA on RISQrypt, an existing post-quantum cryptography (PQC) platform, without adding any cipher-specific RTL. The affine layers, S-boxes, and SHAKE128 sampling are executed by the platform's arithmetic and Keccak accelerators under software control. We further integrate first-order arithmetic masking by reusing the masking accelerator for share refreshing and masked-multiplication randomness, requiring no additional hardware while keeping arithmetic on secret shares off the processor datapath. The masked multiplication shows no first-order leakage in a TVLA evaluation with $100\,000$ traces on an Artix-7 FPGA. Compared with a software-only baseline on the same core, the co-design achieves speed-ups of $9.68\times$ and $9.85\times$ in the unmasked and masked configurations, respectively. To the best of our knowledge, this is the first side-channel-protected, hardware-accelerated implementation of PASTA.

Confidential sources are vital for investigative journalism and thus for holding those in power to account. However, sources often face great risks to their privacy and safety. SecureDrop is a system that enables sources to anonymously contact journalists, including at major news organisations around the world. Despite its widespread use, the current design requires physical servers hosted on premises. While cloud-based deployment would alleviate this burdensome requirement and improve SecureDrop's usability and accessibility, it would also introduce new threats to security that are not addressed by the current design. In particular, a lack of end-to-end encryption presents serious risks in the event that a cloud service provider is coerced into revealing information. In this work, we present and formally analyse a new protocol for SecureDrop which addresses the challenges of off-premises deployment. Our protocol composes an encryption scheme with hybrid post-quantum guarantees and an identity-hiding message-fetching mechanism to provide strong anonymity guarantees. In contrast to existing systems, we minimise incriminating evidence against whistleblowers by providing message-level deniability and by having sources remain stateless. Our formal security analysis combines the Tamarin prover for symbolic analysis and game-based proofs for computational analysis. Finally, our benchmarks demonstrate that the protocol achieves practical levels of performance in a browser context. The Freedom of the Press Foundation plans to deploy the new protocol, with integration efforts beginning in 2026.

Recent algorithmic advancements in the Multi-Party Computation-in-the-Head (MPCitH) paradigm have resulted in more efficient post-quantum digital signature schemes. MQOM is a MPCitH-based digital signature scheme and candidate in the ongoing NIST Post-Quantum Cryptography (PQC) standardization effort, offering performance competitive with lattice- and multivariate-based schemes in software. In this work, we develop a dedicated hardware accelerator for MQOM and analyze the impact of recent algorithmic modifications on hardware performance. This is achieved through the careful co-design of high-throughput symmetric primitive engines and highly-optimized polynomial arithmetic cores, minimizing stalling and supporting entirely on-the-fly computations of all polynomial arithmetic. As a result, no intermediate buffers are required and re-computation or sampling is avoided. Secondly, we analyze MQOM's use of correlated GGM trees for generating MPC party shares, which reduce computational cost at the cost of increased signature size. We observe that this choice leads to increased design flexibility and significantly reduces on-chip memory requirements for hardware designs. Furthermore, MQOM proposes several parameter sets per security level. We analyze the impact of different MQOM parameter sets on hardware cost and performance. Our design with NIST L1 parameters only requires 15 812/9 384 LUTs/FFs and 4.5 BRAMs on FPGA, while performing the signature generation in 0.46 ms and signature verification in 0.38 ms. Compared to state-of-the-art hardware implementations of other MPCitH-based DSAs, we improve the area-time-product (ATP) by a factor $3.5\times$ up to $66.4\times$. Compared to the lattice-based ML-DSA scheme, our MQOM hardware design is only outperformed by a factor $1.5\times$. Our results show that MQOM and the correlated GGM tree structure are hardware-friendly designs, leading to one of the highest HW-vs-SW speedup ratios among similar PQC DSAs, while also attaining the smallest on-chip memory footprint among high-performance hardware implementations.

Adaptor signatures allow a signer to publish a pre‑signature that can be transformed into a valid signature by anyone once a secret witness is learned. Poelstra first suggested this primitive to bypass the limited scripting capabilities of Bitcoin. These schemes were later formalized by Aumayr et al. (ASIACRYPT 2021) and refined by Dai et al. (INDOCRYPT 2022) and Gerhart et al. (EUROCRYPT 2024). In this work, we revisit the constructions of adaptor signatures deployed in practice without any formal proof of security. First, we demonstrate that the current security model does not capture the ECDSA adaptor signature that underlies most real‑world systems. Second, we propose a relaxed definition and prove that it is satisfied by the ECDSA adaptor construction under the strong unforgeability of ECDSA. Finally, focusing on oracle‑based conditional payments, we formulate the first security model for adaptor‑based Discreet Log Contracts (DLCs) and show that our relaxed notion suffices for their security.

We give in this short note a circuit implementing the matrix-vector product with the 32x32 binary matrix of the AES MixColumns using 88 XOR gates. Previously known circuits minimizing this metric have been published in the past years and achieved 94 XOR, 92 XOR, 91 XOR, and 89 XOR. As far as we can tell, a circuit with 88 XOR was previously unknown.

In secret-key private information retrieval, a client with a short secret key retrieves a database item while hiding the requested index, and possibly also the database, from the server. The server answers using an encoded version of the database, generated via one-time preprocessing. Secret-key PIR provides an attractive "stateless" alternative to stateful PIR and oblivious RAM, and can be viewed as strengthening the standard notion of searchable symmetric encryption by not allowing any access pattern leakage. We give the first candidate doubly-efficient secret-key PIR schemes that achieve a constant multiplicative storage overhead, asymptotically approaching 1 in natural regimes, together with $k^{o(1)}$ communication and online server work for a database of size $k$. The best previous online server work with constant storage overhead was $k/\textrm{polylog}(k)$. Our constructions follow the permuted-code blueprint for doubly efficient sk-PIR (Boyle-Ishai-Pass-Wootters and Canetti-Holmgren-Richelson, TCC 2017), and are based on similar assumptions. The main novelty is that we instantiate this blueprint using new families of "$t$-smooth" locally decodable codes with improved tradeoffs between rate, locality, and smoothness. This includes a new $t$-smooth local decoder for Reed-Muller codes using concatenated curves, as well as a construction based on curve-lifted codes that has attractive concrete efficiency features. We perform extensive cryptanalysis of the underlying assumptions and benchmark performance under realistic parameters, demonstrating the practicality of our schemes. A representative instantiation encodes a $37$ GB database of $18$-bit records with only $4.2$× storage overhead, while requiring the server to read less than $600$ KB from the encoded database per query.

As a companion to the proved bounds in "Shortening Bounds for Reed-Solomon MCA", we formulate the complete finite Reed-Solomon mutual correlated agreement (MCA) problem and a pole-aware conjectural positive-density profile envelope. An exact first-match compiler and realized-image moment and incidence inequalities isolate the payments required for a safe certificate without confusing supports, pairs, rays, and affine slopes. We prove a ceiling-normalized moment obstruction, a projective incidence theorem and benchmark dimension diagnostic, and a moving-scale consequence of the previously proved implication from a Sidon payment through the Balog-Szemer\'edi-Gowers theorem and Boolean-cube growth. Exact unsafe edges, repository audits, and numerical margins lead to four direct adjacent conjectures - two MCA and two auxiliary list inequalities - whose safe sides still require primitive-fiber, residual-projection, algebraic-routing, and add-back payments. In a collision-nonbinding, subexponential-budget identity-candidate branch, we conjecture a non-oracular exhaustive atlas whose exact unsafe--safe bracket, through a proved crossing reduction, yields \(\delta^*_{C_n,\mathrm{off,sup}}=1-\rho_n-g^*(\rho_n,\log_2 |{\mathbb B_n}|)+o(g_n^*)\); the general identity lower route instead uses an exact pole-adjusted target, and no matching bracket is claimed for the unrestricted smooth or circle problem.

Wiener's continued-fraction attack gives the classical provable bound \(d<N^{1/4}\) for balanced RSA. Boneh and Durfee reached the exponent \(1-\sqrt{2}/2\approx0.2929\), but their argument relies on a heuristic independence assumption. We prove the first fully provable improvement beyond Wiener's \(1/4\) exponent: for every fixed \(\varepsilon>0\), balanced RSA with \(e=\Theta(N)\) can be factored deterministically in polynomial time whenever \(d\leq N^{11/42-\varepsilon}\).

Numerous real-world systems in the FinTech space rely on zero-knowledge proof (ZKP) to verify information without revealing it. For example, range verification is an essential component of transaction systems to ensure that a payment amount does not exceed the payer's wallet balance. However, this verification requires to access the payer's account balance and transferred amount, which they may want to keep confidential. This drives the need for private range verification. In its simplest form, private range verification can be achieved with a zero-knowledge range proof (ZKRP) to verify that a secret value lies within public bounds. When the bounds are also private, ZKRP can still be used, but multiple ZKRPs are needed for each private range verification. This causes a considerable slowdown in the transaction system, which can not only delay transactions but also cause system failures when delays build up beyond control. To address this limitation, we consider the problem of Sequential Private Range Verification, which involves verifying in a sequence that a series of values fall within sequentially-linked private bounds, rather than verifying each private range independently. We propose a novel ZKP, which we call zero-knowledge multiplicative non-negative proof (ZK-MultNNP), and use it in our proposed framework PERSEPHONE to address this problem. We demonstrate experimentally that PERSEPHONE outperforms a ZKRP-based solution by 3x. Furthermore, we observe in a realistic digital payment system that transaction requests are always processed within the Doherty threshold of 400ms with the PERSEPHONE-based system, against only 9% for the ZKRP-based solution.

In this paper, we propose several classes of permutation polynomials having the form $\sum\limits_i(x^{2^m}+x+\delta)^{s_i}+ax$ for $i=1$ or $i=2$, where the exponent $s_i$ satisfies $s_i\equiv 2^j\pmod{2^m+1}$ or $s_i \equiv 2^j\pmod{2^m-1}$ for some different integers $j$, $a\in\mathbb{F}_{2^m}^*$ and $\delta\in \mathbb{F}_{2^{2m}}$. More precisely, by applying the AGW criterion and determining the number of solutions to certain equations over $\mathbb{F}_{2^{2m}}$, several classes of permutation polynomials of the form $(x^{2^m}+x+\delta)^s+ax$ over $\mathbb{F}_{2^{2m}}$ are presented. In addition, we construct some classes of permutation polynomials of the form $(x^{2^m}+x+\delta)^{s_1}+(x^{2^m}+x+\delta)^{s_2}+ax$ over $\mathbb{F}_{2^{2m}}$. Our results generalize some known constructions of permutation polynomials. Finally, we demonstrate that the permutation polynomials proposed in this paper are not quasi-multiplicative equivalent to known ones.

We make progress on the question of constructing explicit evaluation places for leakage-resilient Shamir's secret sharing, over composite order fields. Previously, Maji et al. (EUROCRYPT 2024) showed that random evaluation places yield Shamir's secret sharing over the composite order field $\mathbb{F}_{p^d}$ that is statistically secure against physical-bit leakage. Later, Nguyen (EUROCRYPT 2025) established a "dichotomy" that linear code-based secret-sharing scheme over the field $\mathbb{F}_{p^d}$ is either statistically secure or completely insecure against such leakage. Building upon Nguyen's dichotomy, we present a partial derandomization of evaluation places, improving upon the Maji et al. result for a restricted regime of parameters. We replace the random choice of $n$ independent evaluation places by the iterates $x_j = \Phi^j(x_0)$ of a simple fixed rational function $\Phi$, where the initial point $x_0 \in \mathbb{F}_{p^d}^*$ is randomly chosen. The randomness in the evaluation places thus drops from $nd \log p$ bits to $d\log p$ bits. Our construction is valid for the regime $n = O(d/\log_p d)$, and any reconstruction threshold $k \ge 2$; in fact, the scheme attains perfect security (statistical distance exactly zero) against single-block leakage. Our technique is a partial fraction nondegeneracy argument that exploits the distinct poles of the rational iterates.

We present Mu-qt-PEGASIS, a mathematically precise con- ditional compiler for interactive aggregate signatures built from the qt-PEGASIS effective class-group action. Our central observation is that the torsor structure of the public-key space blocks the standard Schnorr- or BLS-style verification equations used in conventional aggregate sig- natures. We resolve this by separating verification into two layers: a proof-authentication layer that certifies public-key registration and round- robin key aggregation, and a transcript-consistency layer that verifies the final aggregate signature relative to an authenticated aggregate key. The resulting framework is formulated in the programmable random-oracle model. Public-key registration and linked aggregation are authenticated via Fiat–Shamir compilations of explicit public-coin Σ-protocols for the relations Rreg and Rlink . Under the hardness of the Group Action Inverse Problem (GAIP), together with the random-oracle assumptions for Hnizk and Hsig , we prove MU-EUF-CMA security against static corruptions. At the protocol level, for a fixed Fiat–Shamir repetition parameter t, the aggregate signature has size O(t) and is independent of the number of signers n, while the authenticated registration and aggregation transcript remain linear in n.

Boomerang cryptanalysis is inherently a four-point phenomenon, yet its recent geometric formulation relies on a 3-wise representation imposed by a quartet-sum-zero assumption. This simplification makes the transition matrices tractable, but it also removes boomerangs with unequal paired differences and prevents the framework from modeling impossible boomerang distinguishers. We propose an exact 4-wise geometric framework for boomerang cryptanalysis that is a \emph{strict generalization} of the 3-wise framework: it recovers the 3-wise framework as the equal-difference $a=a',\,b=b'$ specialization, and at the same computational cost additionally covers the unequal-difference boomerangs and impossible boomerang distinguishers that the 3-wise representation cannot reach. By choosing bases adapted to the two value coordinates and two difference coordinates of a boomerang quartet, our framework removes the 3-wise assumption and gives a unified transition-matrix description for both impossible boomerang distinguishers and fixed-key boomerang probabilities. The framework has two concrete applications. First, it yields a positive (satisfiability) model for searching for impossible boomerang distinguishers from the difference coordinates in the 4-wise representation. Using this model, we find new impossible boomerang distinguishers for \present, \ascon, \skinny, and \gift. Second, it computes fixed-key boomerang probabilities as sums of \emph{quasi-boomerang quartet characteristic} correlations. For the 13- and 17-round boomerang distinguishers of \skinny-64-128 and \skinny-64-192, respectively, the resulting probabilities match the experimental results and explain the gap left by the 3-wise framework through contributions from unequal-difference boomerangs.

Confidential virtual machines (CVMs) provide hardware-rooted attestation and isolation, protecting data in use from untrusted cloud infrastructure. However, current CVM attestation frameworks are limited to a two-party trust model between the cloud provider and the CVM owner, and primarily guarantee only the boot-time state. As CVMs increasingly host public-facing workloads (e.g., LLM inference APIs, web applications) that process end-user data, this creates a three-party trust mismatch among the cloud provider, the CVM owner, and end users. Once a workload is deployed, end-users lack cryptographic assurance of runtime integrity and must implicitly trust the CVM owner for any post-launch modifications. Furthermore, extending continuous runtime attestation to a large number of end users introduces severe scalability bottlenecks and is vulnerable to co-location-based attacks. Existing methods either enforce static post-launch lockdown or rely on CVM owner-maintained software logs that are not hardware-anchored. We present Vordr, a framework that removes the CVM owners from the end-user's trust domain across the full CVM lifecycle while still allowing workload-level updates/installations with auditability. We introduce a novel architecture that establishes an exclusive administrative binding between a process-based TEE (Warden Enclave (WEN)) and the CVM. This binding strictly blocks the CVM owners (or cloud) from directly manipulating the CVM. Vordr continuously tracks runtime integrity via a hardware-rooted Linux IMA event log anchored to PCR 10, serving time-bounded, platform-unlinkable cached or audit-ready quotes for independent end-user auditing. We optimize the costly IMA-log extraction via a novel incremental attestation design leveraging the IMA log's append-only structure and the WEN's sealed state. We implement Vordr, validate it across several workloads, and show that it provides up to 60.8x speedup for runtime monitoring with huge communication reductions in steady-state incremental rounds compared to prior methods. Vordr delivers highly scalable and verifiable runtime attestation, providing substantially stronger guarantees for runtime integrity and platform unlinkability.

Searchable Symmetric Encryption (SSE) enables data owners to securely store encrypted data on untrusted cloud servers while retaining the ability to perform secure searches and retrieve relevant documents. However, standard SSE schemes expose search patterns (whether two queries are identical), and result patterns (which documents are returned), making them susceptible to leakage-abuse attacks that can infer sensitive information such as the queried keywords and/or document contents. While Oblivious RAM (ORAM) and Private Information Retrieval (PIR) can hide these patterns, their high computation and communication overhead often render them impractical for real-world search workloads. A more efficient alternative is to obfuscate search and result patterns using Differential Privacy (DP). Unfortunately, existing DP-based SSE schemes either provide insufficient query privacy protection, or still incur substantial performance overhead. In this paper, we propose FROST, a novel differentially private SSE scheme that efficiently obfuscates both search and result patterns, while providing strong resilience against all known statistical leakage-abuse attacks. The core component of FROST is our new rerandomized PIR (RePIR) scheme designed for private databases, which allows server-side rerandomization of encrypted PIR query responses. In FROST, we also introduce a novel method for applying DP noises to SSE for search result obfuscation using only simple arithmetic operations. An important property of FROST is that it requires only a single round of communication, with small user-side storage as an additional benefit. We fully implemented FROST and conducted extensive experiments over real-world datasets to rigorously assess its practical performance and resilience. Our experiments showed that FROST not only effectively mitigates pattern-leakage attacks while maintaining reasonable utility, but also achieves up to four orders of magnitude faster keyword search and three orders of magnitude lower bandwidth overhead than prior DP-based SSE schemes.

A Proof of Space, PoS, as introduced by Dziembowski et al. [CRYPTO'15], is a two-phase protocol that enables a Prover to convince an efficient Verifier that it has allocated a large amount of persistent memory to storing some information. To our knowledge, all existing PoS protocols are only known to be secure in the random oracle model (or under ad hoc assumptions about cryptographic assumptions). We provide an elementary framework for constructing PoS from a combination of derandomization assumptions and cryptographic assumptions. We provide a few simple instantiations of the framework. We show that non-trivial PoS follow from (a) $\mathsf{E}=\mathsf{DTIME[2^{O(n)}]}$ is hard for exponential-size nondeterministic circuits (an assumption introduced to show $\mathsf{AM}=\mathsf{NP}$), and (b) collision-resistant hash functions. We also show that PoS with nearly optimal parameters and interaction pattern follows from assumption (a) above and (c) SNARGs for $\mathsf{P}$.

The Sumcheck protocol is a cornerstone of modern proof systems, yet its prover remains a performance bottleneck. Even in the multilinear case, the repeated construction of round polynomials leads to significant overhead, limiting scalability in practice. We take a different approach: instead of modifying the protocol, we rethink the representation of multilinear polynomials. We show that any multilinear polynomial admits a simple and structured binary-tree circuit representation, where each node follows a clean recursive rule. This perspective is not merely conceptual; it directly translates into faster algorithms. Our circuit view unifies three core operations: evaluation, summation over the Boolean hypercube, and Sumcheck round generation within a single framework. Construction from the coefficient vector costs exactly nN field operations, and evaluation via bottom-up folding requires exactly N − 1 multiplications — optimal for this class of algorithms. A key structural property of the circuit is its regularity: fixed depth, local recurrences, and no data-dependent branching. This is not incidental — it is a direct consequence of the recursive decomposition, and it is precisely what makes the representation amenable to parallel execution and hardware acceleration. We implement our approach in Rust on the BN254 scalar field and benchmark it against ark-poly with parallelism enabled on both sides. At n = 20, our parallel evaluation kernel achieves a 3.4× speedup over ark-poly (14 ms vs 48 ms). The verifier completes in under 1 μs across all tested dimensions, yielding a prover-to-verifier ratio exceeding 105 at n = 20. Our results suggest that revisiting polynomial representations is a promising direction for accelerating fundamental primitives in proof systems.

Side-channel analysis (SCA) attacks rely on leakage from a target device. It is common to assume that linear operations implemented by XOR gates produce symmetric leakage and carry negligible side-channel information. In practice, leakage from XOR gates produces complex, non-independent, and time-varying asymmetric behavior. The paper introduces Feature Estimation based Attacks (FEbA) -- a dedicated profiling attack that exploits these asymmetries. The attack is versatile; it was demonstrated to be successful against the sharing and refreshing phases in masking-based implementations by greatly narrowing the guessing key space, with no access to intermediate values. Such attacks have implications for designs such as ASCON, GIBBON, and ACE, where XORs that utilize the key are vulnerable to attacks regardless of the inherent SCA protection levels used in them (e.g., sponge $rate$, the leak-free components for re-keying, and masking order $d$). Experimental results indicate that the entropy of a $32$-bit key can be reduced below $1$ bit using (up to) $20,000$ traces from a standalone XOR without any access to intermediate values, or below $500$ traces with access to intermediate values.

Post-quantum cryptography (PQC) standardisation reached a pivotal milestone in August 2024 with the release of NIST FIPS 203 (ML-KEM) and FIPS 204 (ML-DSA), yet the vast majority of deployed public-key infrastructure continues to rely on RSA-2048 and Elliptic Curve Diffie-Hellman (ECDH), both vulnerable to Shor's algorithm on a cryptographically relevant quantum computer. The Harvest Now, Decrypt Later (HNDL) threat renders this risk operationally present: adversaries may archive ciphertext today for future decryption once a Cryptographically Relevant Quantum Computer (CRQC) becomes available. This paper proposes the Crypto-Agility Readiness Score (CARS), a five-dimension weighted composite index for assessing PQC migration readiness in legacy systems across PKI, TLS, and HSM environments. CARS operationalises five dimensions -- Inventory Completeness, Algorithm Compliance, Architectural Decoupling, Toolchain Readiness, and Governance & Compliance Alignment -- with weights derived via a two-round Delphi process with 12 senior migration engineers. In an empirical evaluation of 43 open-source cryptographic software repositories, mean CARS values were 24.9 +/- 9.5 (Legacy Crypto Libraries), 25.8 +/- 8.2 (PKI/Certificate Management), 39.7 +/- 15.2 (HSM/PKCS11 Middleware), 47.2 +/- 16.5 (TLS 1.3 Hybrid), and 47.5 +/- 11.1 (PQC Native; overall 34.1 +/- 15.0, n=43). A notable result is that PQC reference implementations score in the At-Risk range despite high Algorithm Compliance (d2 >= 0.61), because Architectural Decoupling (d3) is near zero, confirming that algorithmic presence alone does not imply organisational migration readiness. Category differences are statistically significant (Kruskal-Wallis H(4) = 17.55, p = 0.0015, epsilon^2 = 0.357, large effect). Construct validity is supported by a moderate convergent Spearman correlation between Algorithm Compliance and Toolchain Readiness (rho = 0.558, p < 0.001, n = 43) and discriminant independence from Architectural Decoupling (rho = -0.031, p = 0.843). A longitudinal case study on oqs-provider (v0.3.0 to v0.6.0) demonstrates that CARS tracks real migration progress (Delta CARS = +21 pts). Microbenchmarks show ML-KEM-768 completes a full KEM cycle in 0.28 ms versus 2.87 ms for RSA-2048 (10.2x faster); authors' own measurements on Apple M1 Pro ARM64 (liboqs-python v0.15.0, n=10,000) confirm the ratio is preserved (M1 Pro: 0.051 ms full KEM cycle). A hybrid TLS 1.3 handshake (X25519MLKEM768) adds approximately 1.29 ms incremental overhead over ECDHE-only. CARS may support structured prioritisation of migration efforts; external predictive validation against migration outcomes remains future work.

SMAC is a recently proposed by Wang et al.~stand-alone Message Authentication Code (MAC) constructed from repeated applications of the AES round function and featuring an aggregation mode, SMAC-1$\times n$, for scalable parallel processing. Although originally designed for high-throughput CPU implementations leveraging AES-NI instructions, its structural properties suggest strong compatibility with hardware parallelism. However, no systematic FPGA-oriented architectural study of SMAC has been reported. This paper presents a scalable FPGA architecture of SMAC implemented on a Xilinx Kintex UltraScale+ KCU116 platform. The $\Pi$ transformation is evaluated in a single clock cycle using fully combinational AES rounds, and throughput scaling is achieved through physical replication of aggregation lanes. All SMAC-1$\times n$ configurations up to $n=16$ are implemented and evaluated. Post-implementation results achieve maximum operating frequencies up to 526\,MHz and peak throughput of 731\,Gbps for SMAC-1$\times 16$. The design exhibits near-linear throughput scaling up to eight lanes and reaches a maximum efficiency of 24.5\,Mbps/slice. These results demonstrate that SMAC’s round-based construction is well suited for FPGA parallelism and enables competitive high-throughput hardware MAC acceleration.

In lattice sieving, the sphere model assumes that sieving elements are distributed close to or on a sphere with uniformly distributed direction. It is extensively used to predict how lattice sieving behaves. In the sphere model the probability that a random pair of vectors reduces is asymptotically $p_n={(3/4)}^{n/2}/\sqrt{3\pi n/8}$. In practice sieving algorithms have been observed to perform better than predicted by the sphere model. It is an open question how this gap behaves asymptotically: does the gap vanish or grow as the dimension grows? Our work answers this question by showing that it is asymptotically constant. We generalise the sphere model to uniform ball and non-uniform ball models and analyse reduction probability distributions. We find that asymptotically the input distribution only affects the total reduction probability, not the shape of the output length distribution. We show that the reduction probability advantages of our models over the sphere model range from $\times 1.5$ up to $\times 8$.

Distributed cryptography is a new cryptographic paradigm that enables fine-grained decryption capabilities in a trustless setting. In a distributed monotone-policy encryption scheme, users generate their own public and private keys. Thereafter, one can encrypt a message with respect to an arbitrary set of public keys together with an access policy. Any group of users that satisfies the access policy can recover the message; conversely, the message is computationally hidden from any group of users that does not satisfy the policy. The key requirement is succinctness: the size of the ciphertext should be sublinear in the size of the access policy. Distributed monotone-policy encryption generalizes related notions like distributed broadcast encryption (where the access policy is set membership) and silent threshold encryption (where the access policy is a threshold policy). In this work, we achieve the following: - First, we give the first optimal distributed monotone-policy encryption scheme for the class of DNF policies from the decomposed LWE assumption in the random oracle model. Here, optimal means that the size of the public parameters, the user public keys, and the size of the ciphertext are independent of the size of the policy. As a corollary, we also obtain a (reusable) succinct computational secret sharing scheme for DNFs from decomposed LWE in the random oracle model. - Next, we show how to adapt our techniques to obtain a distributed monotone-policy encryption scheme for $k$-DNFs in the plain model where the size of the ciphertext is $k \cdot L^{1/2}$, $k$ is the maximum size of each min-term, and $L$ is the number of min-terms in the DNF. This is the first scheme from the decomposed LWE assumption in the plain model. If we settle for a much weaker notion of selective security, then we also achieve full succinctness in the plain model (i.e., where the ciphertext size is independent of the size of the DNF). - By specializing our results to the setting of broadcast encryption, we obtain an adaptively-secure distributed broadcast encryption scheme with ciphertext size $|S|^{2/3}$, where $|S|$ is the size of the broadcast set. Security relies on decomposed LWE (with a polynomial modulus-to-noise ratio) in the plain model. This scheme is the first lattice-based scheme with adaptive security that supports an a priori unbounded number of users in the plain model. Previous lattice-based distributed broadcast encryption schemes with adaptive security in the plain model assumed an a priori bound on the number of users (but achieved optimal-size ciphertexts that are independent of the size of the broadcast set).

We derive an explicit exponent \(\Psi_\rho\) that bounds the Reed--Solomon MCA bad-slope numerator at every fixed relative radius between Johnson and capacity. The resulting positive-relative-radius exponential-budget safe-frontier certificate strictly improves the smallest-test MDS exponent and gives a constant post-Johnson radius for every positive usable budget exponent. An all-test-size MDS circuit-incidence envelope gives exact large-field capacity plateaux, improved adjacent thresholds, and four explicit length-\(512\), \(2^{-128}\)-secure smooth multiplicative certificates beyond Johnson. An exact CA--MCA decomposition gives challenge-restricted, endpoint-exact linear-budget thresholds through asymptotically half the minimum distance, and monomial equivalence transfers the applicable bounds to circle presentations. A Gowers--cube argument proves primitive max-fiber flatness from an image-normalized Sidon payment at an accessible moment order. The unrestricted subexponential-budget smooth/circle frontier remains open because shortening has positive exponential cost and the analytic payment, residual ray compiler, profile add-back, and matching attacks are not yet available.

Fixed‑weight sampling is a core primitive in many post‑quantum schemes, including the HQC key encapsulation mechanism. An early implementation of fixed-weight vector sampling in HQC was shown by Guo et al. (CHES 2022) to suffer from a timing side-channel vulnerability, leading to complete key recovery. This timing side-channel was fixed in the current HQC version, however, power side-channel leakage is not addressed. In this work, we demonstrate that fixed-weight vector sampling in HQC is vulnerable to power side-channel attacks and present two practical attacks. First, we construct a power-based distinguisher targeting the support-vector generation and employ the strategy developed by Guo et al. (CHES 2022) to recover the shared key. Our attack recovers the key with a 100% success rate using 900,000 distinguisher calls. On these grounds, we evaluate hiding countermeasures based on dummy operations and find that they linearly increase the trace requirement for a successful distinguishing attack by the number of dummy operations. Second, we target a masked software implementation of the fixed-weight vector sampling in HQC and demonstrate a single‑trace attack on the support conversion that recovers the secret key, again with a success rate of 100%. We then discuss leakage attribution, specifically how shares are unintentionally recombined. Finally, we investigate how hiding techniques such as bitslicing, shuffling, and dummy operations can enhance the security of the implementation. In particular, the use of shuffling can lead to a complete prevention of our attack. Our results show that fixed-weight vector sampling of HQC is highly susceptible to power side-channel analysis. In particular, our results highlight that a combination of masking and hiding is required to effectively protect the implementations.

EME is a parallelizable encrypt-mix-encrypt wide-block construction proved secure for m-block messages only in the range m <= n, where n is the block length of the underlying block cipher. Halevi and Rogaway justified this restriction by giving a splicing distinguisher for m >= n + 2, but left open the first excluded length, m = n + 1. We resolve that boundary for the direct, unrefreshed EME-core extension beyond its specified m <= n domain: the original formulas are applied to m = n + 1 blocks while continuing to use the same global mask. Under one fixed tweak, two encryption queries and one decryption query distinguish this extension from a random permutation. The result applies to this unrefreshed extension; refreshed variants such as EME* and IEEE EME2-AES are outside the scope of the distinguisher. The boundary attack is not a shortened form of the known zero-sum attack. At m = n + 1, the non-first coefficients have no nonempty zero-sum; instead, they form a basis and therefore uniquely represent the coefficient 1. Combining this representation with the special equation for the first mixed block gives the cancellation needed for a ciphertext splice. The same mechanism applies to Sarkar's EMME framework: when multiplication by the field element x is replaced by a linear operator psi with degree-n minimal polynomial, the minimal-polynomial relation supplies the corresponding operator identity. EME* and IEEE EME2-AES avoid this setting by refreshing the mask at chunk boundaries. The attack identifies the algebraic obstruction that such refresh steps avoid.

GRAFHEN is a group-based fully homomorphic encryption scheme in which public rewriting rules hide a permutation representation used for decryption. We give a framework for equivalent-key recovery for GRAFHEN instances based on symmetric groups, together with a practical attack that succeeds on every released challenge, including the recommended semidirect construction based on $S_{11}$ with five generators per copy. The recovered generators are determined only up to simultaneous conjugation, which is the natural isomorphism ambiguity of the public presentation. Known-zero ciphertexts transport the decryption subgroup under this conjugation, so the recovered representation suffices to decrypt the challenge ciphertexts. Our attack, HEnbane, first derives short consequences by two complementary procedures: bounded congruence closure and direct cancellation between public rules with a common right-hand side. The closure also supplies generator-order multiples. It then reconstructs one generator tuple by conflict-driven search over partial permutation tables and recovers the second tuple from the public mixed relations in semidirect instances. The reduction and reconstruction problems are parameterized by the permutation degree and generator count rather than by a particular challenge key. The experiments establish practical success for all released instances, while the analysis makes no distributional running-time claim for larger parameter choices in general. The attack shows that the published count of approximately $2^{101}$ equivalence classes is not an attack-cost estimate at the recommended parameters.

This short note discusses in detail a folklore but little-known hybrid hash function grounded on both the discrete logarithm and short integer solution problems. In particular, specific satisfactory parameters are provided to ensure the standard $128$-bit security level for the lattice problem with $256$-bit module, which may be useful in its own right. The hash function is a natural generalization of the classical Pedersen and Ajtai ones. Nevertheless, to the authors' knowledge, no one has previously explicitly analysed their hybrid version. Besides, the obtained result is probably prone to significant further optimizations by applying many tricks from elliptic curve and lattice cryptographies. Hashing is known to be a basic operation for constructing more complex and important cryptographic schemes. The authors intend to explore such hybrid ones in future articles. However, the hash function under consideration may be precious by itself due to its double provable security. Thus, this introductory work represents a kind of reincarnation of curve-based cryptography whose development has been severely and unfairly undermined by the potential but still vague quantum threat.

This paper proposes a high-speed hardware accelerator for QR-UOV, a multivariate scheme, that executes all three operations: key generation, signature generation, and signature verification. QR-UOV utilizes a quotient polynomial ring structure to reduce the public-key size of the original UOV scheme; however, this introduces functional requirements distinct from other multivariate schemes, such as polynomial-matrix operations over $\mathbb{F}_{q^\ell}$, coefficient expansion for the Mersenne prime field $\mathbb{F}_{q}$, and the expansion of symmetric matrices generated in a compressed form. To accelerate polynomial-matrix multiplication over $\mathbb{F}_{q^\ell}$, the proposed architecture employs a $D \times D$ systolic array ($D$ is the parallelization factor), in which each PE internally contains a polynomial multiply-accumulate unit. For signature verification, the architecture also incorporates a quadratic-form operation unit without explicitly storing the intermediate vector--matrix products. In addition, to ensure a regular data supply from key expansion to matrix operations, the architecture incorporates on-the-fly rejection sampling, which exploits the property that AES-CTR output blocks can be generated independently, as well as an expansion process for the symmetric matrices in compressed form. Furthermore, the architecture enables pipelined processing, overlapping the $i$-th polynomial-matrix operation with the $(i+1)$-th public-key expansion. FPGA evaluation shows that the proposed hardware executes key generation, signature generation, and signature verification in 0.74 ms, 0.28 ms, and 0.19 ms, respectively, at security level I. Furthermore, we confirm that the proposed hardware exhibits a lower LUT-time product than that of existing UOV hardware.

We provide the first construction of identity-based encryption from isogeny-based assumptions. Security of our construction relies on a novel assumption called the "CDH with Mismatched Torsion” (CD-HwMT) assumption, which we introduce. At a high level, the assumption posits the hardness of solving a CDH-like problem even when the adversary is given some additional “safe” leakage. We justify our assumption by showing that, in the Algebraic Isogeny Model, our assumption reduces to well-known assumptions from the literature. As a bonus feature, our identity-based encryption enjoys anonymity, which means that the ciphertexts hide not only the message but also the target identity. We additionally obtain the first isogeny based constructions of laconic oblivious transfer, as well as public-key encryption that simultaneously satisfies security against high-rate key leakage and key-dependent message/circular security from the CDHwMT assumption. All our constructions can be conjectured to be post-quantum secure. At the heart of our results lie several new techniques, which we believe will help in building even more advanced cryptography in isogeny-land.

Classical deep learning for differential cryptanalysis requires millions of ciphertext pairs, rendering attacks infeasible or easily detectable. This work overcomes this data limitation by introducing quantum differential distinguishers, enabling a practical attacker model where executing few queries is feasible. We design these distinguishers via quantum machine learning based on variational quantum circuits. To address circuit design challenges, we propose QuantumScouter, a reinforcement learning method that discovers compact quantum circuits. Unlike prior work, QuantumScouter explicitly targets metrics like gate count and circuit depth, producing circuits suitable for noisy intermediate-scale quantum hardware. We apply QuantumScouter to the SPECK32/64 and SIMON32/64 ciphers. The models are trained to distinguish ciphertext pairs possessing a meaningful differential from completely random pairs. For SPECK, our approach achieves $0.80$ accuracy, outperforming the $0.53$ of prior work while reducing required qubits from $16$ to $6$. For SIMON, we establish a novel quantum baseline with $0.75$ accuracy. Notably, under a restricted regime of merely $400$ training samples, classical deep learning models struggle. A simple MLP with $361$ parameters fails to capture differential characteristics, resulting in an accuracy of $0.51$, while a deep ResNet with $64{,}737$ parameters overfits to yield an accuracy of $0.55$. In stark contrast, our data-efficient quantum distinguisher extracts meaningful features using only $49$ gates, maintaining $0.80$ accuracy.

We present Trout++, a complete threshold signing suite for ECDSA signatures. Trout++ descends from the recent Trout protocol (Dahari-Garbian, Nof, and Parker, ACM CCS 2025) and inherits its transparent setup, two-round structure, and strong security guarantees, while introducing several significant improvements. Unlike Trout, Trout++ offers pre-signing, where the first round is key-, signing-set-, and message- independent. This property is not only important in its own right but also enables us to apply the ROAST transformation (Ruffing, Ronge, Jin, Schneider-Bensch, and Schröder, ACM CCS 2022) to our protocol, yielding the \textit{first} arbitrary-threshold (including with a dishonest majority), robust, asynchronous signing protocol for ECDSA signatures. Furthermore, we introduce several optimizations to the building blocks in Trout that reduce both bandwidth and computation. Our benchmark results show that our implementation of Trout++ is approximately twice as fast \emph{and} twice as small compared to the prior implementation of Trout. We also present a constant-time implementation with running time that is \textit{ten times faster} than Trout's constant-time implementation. Finally, we show how Trout++ can be composed with an account derivation scheme that does not require additional setups per derivation, enabling more practical solutions for managing key material. In total, we achieve complexities and functionality comparable to, and closing the gap with, leading solutions for Schnorr signatures (such as FROST).

Batched identity-based encryption (batched IBE), introduced by Agarwal, Fernando, and Pinkas (CRYPTO 2025), enables a key authority to issue a single succinct key that decrypts an entire batch of ciphertexts. However, existing batched encryption protocols support only identity-based access control and do not accommodate expressive attribute-based policies. We are the first to introduce Batched Attribute-Based Encryption (B-ABE), a generalization of batched encryption to the attribute-based setting. In B-ABE, ciphertexts are associated with attribute sets and batch labels, while a single batch key is bound to an access policy and a public digest of the batch. The key decrypts exactly those ciphertexts in the batch whose attributes satisfy the policy, and its size is independent of the batch size. We construct B-ABE in asymmetric bilinear groups and prove security under the standard Decisional Bilinear Diffie-Hellman (DBDH) assumption in the random oracle model. We further introduce the first Threshold Batched Attribute-Based Encryption (TB-ABE), in which the master secret is distributed among L authorities via Shamir secret sharing. Any subset of at least T authorities can non-interactively generate publicly verifiable key shares that aggregate into a succinct batch key of the same asymptotic size as in the single-authority setting. We formalize security against static corruptions of up to (T-1) authorities and adaptive key-share queries and prove security under the DBDH assumption in the random oracle model.

Lookup arguments are designed to prove that all elements in a query vector appear in a lookup table. These arguments are critical for efficiently proving ZK-unfriendly statements, such as range checks and the evaluation of complex functions. Most existing lookup arguments are optimized for scenarios where the query size is smaller than the table size. However, in many real-world applications, the query size $m$ is often much larger than $n$, the table size. This disparity leads to inefficiencies in such schemes. To overcome this limitation, we propose Celer, a novel lookup argument in which the prover's runtime increases slowly with $m$, thereby providing improved scalability. The efficiency of our lookup PIOP stems from reducing the number of commitments to be sublinear in the query size $m$, while maintaining field operations linear in $m$. Experimental results demonstrate that our lookup scheme significantly outperforms state-of-the-art lookup schemes. For the workload of query size $m=2^{28}$ and table size $n=2^{16}$ (a real world case in proving Llama language model inference), our scheme achieves a 25.9$\times$ prover-time speedup over plookup and is 9.4$\times$ faster than LogUp.

We study Batched IBE through the lens of Multi-Message Signatures -- a natural extension of standard digital signatures in which a single signing operation signs an entire vector of messages at once. A public open algorithm then derives an opening for each message, allowing anyone to verify that an individual message was signed. First we show that Multi-Message Signatures are essential by constructing a Multi-Message Signature scheme from every Batched IBE scheme with a sufficiently large plaintext space. We then show how to construct a Batched IBE scheme from a Multi-Message Signature with deterministic verification given an extractable witness encryption for the verification relation, similar to the duality between IBE and digital signatures. Such a witness encryption scheme can be instantiated efficiently for the special case of linearly-verifiable pairing based multi-message signatures. Next we analyze existing constructions of Batched IBE and extract linearly-verifiable Multi-Message Signatures which provide us with valuable insight into the inner workings of various Batched IBE schemes. Leveraging these insights, we construct the first Batched IBE scheme supporting $q$ key queries per label with an $O(qB)$ CRS size and constant size ciphertexts.

In reaction to the emerging quantum threat, the National Institute of Standards and Technology (NIST) seeks post-quantum secure digital signature schemes. NIST's ongoing competition recently advanced to the third round, in which the Unbalanced Oil and Vinegar scheme (UOV) is a promising candidate due to UOV's conservative design, small signatures, and performant signing and verification. While these benefits make UOV attractive, the implementation aspects for compact hardware acceleration of UOV remain underexplored. Existing hardware accelerators optimize for performance and have large memory footprints. Yet, constrained devices require compact and low-memory hardware support. At the same time, lowering the memory consumption of UOV without sacrificing performance is challenging due to UOV's large public keys and intermediate results. In addition, low-end devices are prone to power side-channel attacks and benefit from lightweight countermeasures. In this work, we focus on the open challenges of compact UOV hardware acceleration. We design a low-memory UOV architecture with runtime-flexible support of NIST security levels 1 to 5. Our architecture uses a load-balanced 16-lane datapath supporting the critical matrix operations of UOV. In addition, we lower UOV's peak memory consumption using a slicing technique and enable on-the-fly data generation via streamlined data realignment. We also include a pipelined Gaussian Elimination unit and a streaming approach for the large public keys needed for signature verification. In addition to compact hardware acceleration, we defend against differential power analysis attacks through a lightweight blinding countermeasure relying on UOV's equivalent keys. Our blinding requires random non-singular matrices, which are not trivial to sample efficiently in hardware. We therefore assess existing sampling approaches and propose a novel technique based on the lower-upper decomposition of matrices. The resulting blinding solely re-uses existing datapath components and limits the runtime overhead to less than 30%. Compared to existing UOV accelerators, our efficient FPGA design reaches up to 5.1x lower signing and 3.2x lower verification latency, while reducing the memory consumption between 2.2x and 16x.

In this paper, we present an optimized implementation of Hamming Quasi-Cyclic (HQC) on the ARM Cortex-M4. We optimize (i) the polynomial multiplication and (ii) the support expansion in fixed-weight sampling, and (iii) propose an optional caching strategy that reuses the public transforms and hash recomputed under a fixed key. For the polynomial multiplication, the fixed-constant multiplications in the Frobenius additive FFT (FAFFT) butterfly spend nearly half of their instructions on VMOV data movements between general-purpose and floating-point registers rather than arithmetic. Because minimizing the XOR count alone can increase the total instruction count, we propose a dirty-aware register-allocation policy and an XOR-operation reordering that reduce the VMOV count by up to $48.1\%$ while leaving the XOR count unchanged. We apply these to a multiplication that combines prior FAFFT-CRT methods, and for HQC-1 we further find a $34\%$ sparser FAFFT modulus that lowers the CRT reconstruction cost. For fixed-weight sampling, we rewrite the support expansion with predicated execution and 4-way unrolling, lowering the per-word cost of its inner loop from $22$ to $6$ cycles while remaining constant-time. On the NUCLEO-L4R5ZI board, our implementation reduces key generation, encapsulation, and decapsulation by up to $33.1\%$, $34.6\%$, and $29.8\%$ over the faster of the two prior state-of-the-art implementations, and the optional caching yields a further reduction of up to $32.7\%$ and $18.9\%$ for encapsulation and decapsulation.

Identity-based key encapsulation remains attractive for managed systems, but practical post-quantum instantiations must balance compact ciphertexts, low decryption-failure rate (DFR), high-throughput and protection-friendly private-key extraction, and meaningful concrete security reductions. Existing NTRU-based IBE schemes satisfy these requirements only partially: compact DLP-style constructions lack a satisfactory reduction and have high failure rates, while LATTE's higher-rank structure and correctness treatment come with larger private keys, larger ciphertexts, and additional encapsulation/decapsulation work. These lines also use moduli and transform roots distinct from those of standardized PQC schemes, complicating deployment in implementations already built around standardized arithmetic. We introduce `ANSA-IBKEM`, a practical single-level identity-based KEM that retains the compact DLP-style identity relation while redesigning the trapdoor, extraction, correctness, and implementation layers around standardized post-quantum arithmetic. The construction combines annular NTRU trapdoors, Hybrid-Sampling extraction, a BCH-based message layer, and ciphertext compression over the ML-DSA modulus $q=8380417$. At the selected compressed points $(d_u,d_v)=(21,4)$ and $(23,5)$, the resulting ciphertext sizes are $3200\,\mathrm{B}$ and $7168\,\mathrm{B}$, with BCH-tail DFR estimates below $2^{-164}$ and $2^{-248}$ after applying one-sided $95\%$ upper bounds to the measured nonzero-error rates. We present a layered random-oracle-model security reduction for `ANSA-IBKEM` with an explicit concrete advantage bound and separate accounting for birthday-style collision terms. The proof accounts for the transform layer with explicit HHK-style losses in the identity-based setting, passes from exact extraction to ideal conditional extraction using Rényi divergence, and reduces to a programmed single-user encryption experiment connected to annular-NTRU/RLWE-style assumptions. This route separates transform losses, extraction-distribution losses, correctness terms, message-space terms, collision terms, and lattice-assumption terms, and it gives a proof template for DLP-style lattice IBKEMs. We also give a method for deep arithmetic reuse, with full low-level ML-DSA arithmetic reuse on the $N=1024$ line.

Dilithium, as a quantum-secure digital signature standard in FIPS 204, has received widespread attention for its physical implementation security. NIST selected Dilithium's randomized signing mode as the default, which can mitigate the severe physical attacks that exploit the deterministic signing mode. However, the physical attack resilience of randomized signing mode is currently an open question. In 2024, Krahmer et al. demonstrated a key-recovery attack against randomized Dilithium by exploiting fault injection. The skipping fault correction attack in Krahmer et al.'s work benefits from operational simplicity in practical settings. Nevertheless, it uses a full-rank collection strategy, requiring several effective faults equal to the number of key coefficients. By developing an optimized skipping fault correction attack, we prove the non-necessity of the full-rank collection strategy. Theoretically, we derive the minimum number of faults M_min and a key-dependent trend for reliable key recovery. For the M_min, we obtain it by analyzing secret coefficient coverage and unique bounded solution probability under the random-row model. Lemma~1 guarantees high-probability coverage of all coefficient positions, while Lemmas~2--~4 and Theorem~1 prove sufficient uniqueness conditions. Furthermore, we instantiate M_min of Dilithium for security levels L2, L3, and L5 with a high key recovery probability. For the key-dependent trend, Remark~2 reveals that the secret key with a larger number of $\pm \eta$ in the coefficients (denoted as $\mathrm{abs_\eta}$) tends to be easier to recover, offering a feature-based insight into recovery efficiency. We formulate the key recovery of Dilithium as an MILP problem and propose an MILP model. Based on the MILP model, we design algorithms of adaptive skipping fault correction attacks for plain and shuffling settings to recover the key with fewer faults. In our experiments, we explored factors influencing key recovery success, confirming theoretical predictions that success rates increase with more faults and larger $\mathrm{abs_\eta}$. Compared to Krahmer et al.'s work, our improved attack reduces the required number of faults for recovering the private key. Specifically, for the plain setting, fault reductions were 25.9% (L2), 16.2% (L3), and 25.6% (L5). Similarly, for the shuffling setting, reductions were 25.6% (L2), 13.5% (L3), and 26.3% (L5).

NTRU-based bootstrapping offers a high-performance variant of FHEW-like bootstrapping schemes and is simpler than its RLWE-based counterparts. Nevertheless, it remains costly in terms of both memory and time. A key computational bottleneck arises from the constraint $q\mid 2N$ which links the LWE ciphertext modulus $q$ to the NTRU dimension $N$. In this work, we apply extended techniques to remove the limitation $q \mid 2N$. With a large modulus $q$, we are able to complete the bootstrapping algorithms using a relatively small $N$-dimensional ring, thereby improving both time and memory efficiency. Additionally, we employ sorting-based techniques to eliminate unnecessary operations, which further enhances time performance. We also extend this approach to improve the efficiency of NTRU-based multi-key bootstrapping algorithms. We implement our algorithms using the CHIFHE and MKFHE libraries. At the 128-bit security level, our sorting-based techniques (with factor $\eta=16$ ) accelerate single-key bootstrapping by factors of $1.82\times$ and $1.24\times$ over the FINAL scheme (ASIACRYPT 2021) and the key unrolling method (CHES 2024), respectively. For multi-key bootstrapping (with factor $\eta=4$), we achieve a $1.70\times$ speedup over the prior art (ASIACRYPT 2024). In addition, both single-key and multi-key algorithms reduce memory usage by a factor of $\eta$.

The cost of quantum cryptanalysis is dominated by the quantum circuit of the target cipher. Estimating the quantum attack cost of a cipher thus requires building that circuit and measuring its qubit count, Toffoli count, and Toffoli depth. This is manual work that needs expert knowledge and must be redone for each cipher and each cost target. Large language models handle ordinary programming well, but their use in constructing quantum circuits for ciphers is still limited. In this work, we collect quantum circuit optimization techniques that apply across many ciphers. We write these techniques into a guideline for a general-purpose LLM. Given this guideline and a single target cipher, the model produces two circuits. One minimizes the qubit count, and the other minimizes the Toffoli depth. Each circuit is verified against the test vectors of the cipher before its resources are estimated. Using this approach, we implement quantum circuits of CRAFT, MANTIS, QARMA, mCrypton, EPCBC, and Pyjamask for which quantum circuit implementations have not previously been reported.

The server-aided Secure Multi-Party Computation (MPC) model with dynamic participation, where servers may join or leave during the computation is particularly well-suited for practical, long-running applications. Unfortunately, existing protocols supporting dynamic participation either incur communication costs that scale linearly with the circuit size or rely on the heavy hammer of Fully Homomorphic Encryption (FHE). This contrasts with “classic” MPC protocols, where sublinear communication can be achieved without FHE. Focusing on the Layered MPC framework (introduced by David, Ishai, Konring, Kushilevitz, and Narayanan, CRYPTO 2023), we show that this overhead is not inherent. We construct sublinear-communication Layered MPC protocols while maintaining a minimal number of online servers — only two or three per layer. Our constructions rely on a layered-friendly adaptation of Homomorphic Secret Sharing (HSS), which we formalize as HSS with Layered Resharing.

Oblivious transfer (OT) is a foundational tool in secure computation. Random OT-correlated pairs of the form $(r_0,r_1)$ and $(b,r_b)$, where $r_0,r_1,b \stackrel{{}_\$}{\leftarrow} \{0,1\}$, significantly speed up secure computation protocols. Pseudorandom correlation functions (PCFs), introduced by Boyle et al. (FOCS 2020), are an efficient means of non-interactively generating correlated pairs. In a PCF, two parties store short keys that are used to locally generate large amounts of correlated pairs. While pre-quantum PCFs for OT achieve highly compact key sizes (e.g., $30$ kB), a significant gap remains in the post-quantum regime, where existing solutions rely on lattices or learning-parity-with-noise-style assumptions and yield much larger keys. We construct compact post-quantum PCFs for OT. Our construction has key sizes in the range of $100$ kB, approaching the compactness of pre-quantum PCFs and seven times smaller than the most compact state-of-the-art post-quantum alternatives. The key size of our PCF remains invariant regardless of the target number of OTs, in contrast to prior alternatives. We estimate a throughput of $7$ OTs per second for our PCF. We additionally provide a security proof in the quantum random oracle model, constituting the first such analysis of a post-quantum PCF. The core of our construction is a new, compact constrained pseudorandom function (CPRF) for inner-product membership predicates. Its security is based on a natural extension of the parallelization problem, which we introduce as the parallelization problem with auxiliary inputs. We provide an extensive analysis of this assumption as well as an implementation of our construction.

Training machine learning models in untrusted clouds requires strong guarantees of confidentiality, integrity, and correctness, while remaining scalable and resilient to node churn. These challenges are further amplified in emerging agentic AI systems, where autonomous and distributed learning components require trustworthy coordination and secure state management across heterogeneous cloud environments. Existing Trusted Execution Environments (TEEs) lack scalability and remain vulnerable to side-channel attacks for large workloads, while pure secure multi-party computation (MPC) approaches incur prohibitive overhead in practice. SENTRA (Secure ENclave-based TRaining Architecture) addresses these challenges through a hybrid architecture that combines TEEs, secret sharing, and communication-efficient MPC with system level mechanisms that secure the entire training lifecycle. SENTRA introduces a scalable collective attestation protocol that verifies all participating enclaves and enforces hardware exclusivity before any node may store or process secret shares. Training data and model parameters are stored as secret shares in a versioned enclave-backed key–value store (KVS), providing rollback protection and consistent state under adversarial conditions. SENTRA further supports dynamic, fault tolerant membership through Dynamic Proactive Secret Sharing (DPSS)-based resharing, safe packed-MPC computation under degree bounds, and adaptive handling of node failures. Evaluation of a prototype implementation shows that SENTRA achieves up to 8.89 samples/s throughput and 1.29× faster training than the CrypTen baseline in software-only mode. In hardware-enclave mode, SENTRA incurs only an 8.3% performance overhead while providing memory-isolated confidentiality, fault-tolerant membership management, rollback protection, and recovery from node failures in approximately 8 seconds.

Retrieval-augmented generation (RAG) grounds large language models on external knowledge by using vector similarity search over document embeddings to identify relevant documents and supplying their contents as generation context. However, its retrieval stage creates privacy risks: user queries may reveal sensitive intents, while the database may contain proprietary or confidential records. Existing secret-sharing-based solutions that protect both query and database privacy remain costly. To make private vector similarity search more efficient, we present CoSecRAG, a two-server system for RAG that protects both database and query embeddings. CoSecRAG introduces Inner Product Preserving Query Mask (IPQ-Mask) to lower similarity-scoring costs by avoiding online secure multiplications and Post-Scoring Cluster Pruning (PSCP) to reorganize the execution pipeline for approximate retrieval, reducing private-extraction volume and secure top-K selection costs. We implement CoSecRAG and evaluate it on six BEIR datasets and large-scale synthetic benchmarks. CoSecRAG maintains strong retrieval quality while substantially reducing the cost of private vector similarity search. Compared with P²RAG, the most recent two-server baseline for private vector similarity search in RAG, CoSecRAG achieves up to 181× online score-computation speedup and 81× online speedup in secure top-K computation. End-to-end, it achieves up to 99× online and 34× offline runtime speedups. Compared with PRAG, CoSecRAG achieves 19×–58× online and 2×–16× offline end-to-end speedups.

Zero-knowledge (ZK) proof systems have developed rapidly in recent years, with hash functions as one of their central building blocks. Since these often dominate the prover cost, circuit-friendly hash function design has become an active research area. Most hash proposals target prime fields, although recent protocols such as Binius and VOLE-based ZK operate natively over binary extension fields \(\mathbb{F}_{2^n}\). These binary field protocols reduce the cost of proving widely used binary and bitwise statements, thereby opening up new design opportunities. At the same time, the demand for ZK applications such as zkRollups is pushing towards performant hardware acceleration, a requirement that recent designs have largely neglected. Hence, a modern ZK hash function should also be efficient in hardware and fast in plain evaluation, to avoid new bottlenecks in non-circuit workloads. In this paper, we introduce RainHash2.0, a cryptographic permutation that addresses both gaps. RainHash2.0 is natively defined over binary extension fields, making it a natural match for \(\mathbb{F}_{2^n}\)-based protocols such as Binius and VOLEitH, while being tailored for efficient hardware and competitive plain performance. To achieve this, we exploit new techniques from Binius to horizontally split the round function - arguably a novelty in itself that is particularly effective when finite fields of different sizes are used simultaneously. We implement RainHash2.0 in the Binius and VOLE-based ZK frameworks, comparing it against SHAKE, recent arithmetization-oriented designs, and its direct predecessor RainHash. Across proof size, prover- and verifier runtime, RainHash2.0 delivers significant improvements. In addition, we prototype RainHash2.0 on FPGA hardware and reach efficiency gains of up to 8.8$\times$ over related circuit-friendly hash functions. These results mark RainHash2.0 a practical choice for modern ZK applications.

Range proofs enable a prover to convince a verifier that a committed value lies within a specific interval without revealing additional information. They are fundamental to privacy-preserving systems including anonymous credentials, e-voting, e-cash, and cryptocurrencies like Monero and Grin. A critical challenge is efficiently proving that multiple committed values simultaneously satisfy range constraints while minimizing communication overhead. Vector commitment schemes provide a promising approach to this problem. Missileproof (CCS'24) recently proposed a range proof for vector commitments achieving $O(1)$ proof size and verifier time, but with prover complexity of $O(N\ell \log(N\ell))$ for proving $\ell$ values in $[0, 2^N)$. We present \textbf{Rarus}, an efficient range proof for polynomial-based vector commitments that achieves optimal asymptotic complexity across all metrics. Our key innovation is replacing binary decomposition with optimized $b$-ary decomposition, coupled with Bi-variate Zero-Test and accelerated Uni-variate Sum-Check protocols. Rarus achieves $O(1)$ proof size and verifier time, while reducing prover time to $O\left(\frac{N\ell}{\log(N\ell)}\right)\mathbb{G} + O(N\ell)\mathbb{F}$, where $\mathbb{G}$ and $\mathbb{F}$ denote group and field operations respectively. In addition, our protocol supports arbitrary ranges $[0,R)$ beyond powers of two. Experimental results demonstrate that Rarus achieves a $20\times$ speedup over both Bulletproofs and Missileproof when proving 16,384 values in $[0, 2^{64})$.