Retrieval-augmented generation (RAG) systems critically depend on a vector-retrieval stage that selects relevant documents from a large embedding database. When this stage is outsourced to a RAG-as-a-Service provider, query embeddings can reveal sensitive user intent, the outsourced index can leak proprietary corpus information, and a malicious provider can silently manipulate retrieval results. This motivates privacy-preserving verifiable retrieval. The client must be able to confirm that the returned top-$k$ identifiers were produced by faithfully executing an agreed approximate nearest neighbor (ANN) algorithm on a committed encrypted index, while leaking no non-public database information beyond the functional baseline induced by the returned top-$k$ identifiers. We present VeriANN, the \emph{first} encrypted ANN retrieval framework, to our knowledge, that simultaneously achieves \emph{query privacy}, \emph{database confidentiality}, and \emph{verifiability of retrieval results} against malicious servers, under a two-server non-colluding trust model. VeriANN couples distributed-point-function--based PIR over locality-sensitive hashing indexes with authenticated garbled circuits, so that the entire top-$k$ pipeline---bucket decryption, Merkle-root reconstruction, frequency counting, and top-$k$ selection---is executed obliviously and with end-to-end integrity. Making this integration practical requires three new techniques: (i) a sort-based hierarchical oblivious frequency-counting algorithm that enables a distance-free post-processing stage, reducing top-$k$ aggregation from quadratic to quasi-linear complexity; (ii) an end-to-end authenticated verification design that binds the full retrieval pipeline against selective-failure attacks while reducing client-side verification to a single hash check against the published Merkle root; and (iii) a modular state-pool design with an authenticated state-transfer mechanism that dynamically composes precomputed garbled states across query parameters while preserving cross-circuit verifiability. On million-scale corpora, VeriANN achieves second-scale end-to-end latency with KB-scale client-to-server communication, while adding minimal online overhead over a non-verifiable baseline.

To enhance the security of stealth addresses and protect user privacy, Liu et al. (EuroS&P 2019) proposed a Key-Insulated and Privacy-Preserving Signature Scheme with Publicly Derived Public Keys (PDPKS). In this scheme, the payee generates a master public/secret key pair, and the payer derives a public key from the payee's master public key and binds the cryptocurrency asset to the resulting derived public key. The payee then verifies, using the master secret key, whether the derived public key has been correctly generated from the master public key. In this paper, we show that a public-key encryption (PKE) scheme secure against chosen-ciphertext attacks (CCA) can be generically constructed from PDPKS. Specifically, we utilize unlinkability, which hides the master public key from which a derived public key originates, to conceal plaintext information from ciphertexts. We also simulate the decryption oracle by leveraging the derived public key checking algorithm. In addition, to guarantee the correctness of the proposed PKE scheme, we rely on the consistency of PDPKS introduced by Emura (IACR CiC 2025). Given the motivation behind PDPKS, namely the construction of stealth addresses in a provably secure manner, unlinkability is regarded as the core security property of PDPKS. Our result shows that achieving this core security property essentially requires CCA-secure PKE, or cryptographic primitives of equivalent strength, and that such primitives are indispensable for constructing PDPKS.

Inner product functional encryption (IPFE) in unbounded setting for permissive relation offers a powerful cryptographic approach for enforcing fine-grained access control over sensitive information in untrusted cloud settings and has found growing applicability in areas such as cloud security, controlled access to electronic health records, network privacy, mobile data protection, the Internet of Things and many more. In spite of its importance, the profile of this primitive is not extensive. In this work, we propose the first permissive and unbounded public key IPFE scheme, providing post-quantum security guarantees in privacy-preserving environments. Our construction is lattice-based, achieves adaptive security and builds on modified ALS-IPFE scheme of Abdalla et al. (ASIACRYPT 2020). The unbounded setting and permissive relation between message vector and secret key vector supported by our scheme make it more flexible and practical for adapting to real-world application. We establish the adaptive indistinguishability of our construction within the random oracle model, by providing formal proof assuming the hardness of the learning with errors problem. Our scheme is the first of its kind in the post-quantum setting as existing permissive unbounded IPFE are pairing-based and derive their security from classical number-theoretic assumptions. Furthermore, as exhibited by our experimental results our proposed scheme is computationally lightweight.

Decentralized Identity (DID) systems aim to provide users with self-sovereign control over their credentials. However, verifying identities on public blockchains often risks leaking sensitive attributes and transaction histories, whereas relying on heavy generic cryptographic protocols leads to prohibitive on-chain costs. In this paper, we propose \textbf{CUBE} (Credential Unlinkability using Blinded Elements), a verifiable credential framework that integrates partially blind BBS signatures with Non-Interactive Zero-Knowledge (NIZK) proofs. By shifting complex identity validation off-chain while blinding the core identity-binding elements, the scheme ensures on-chain unlinkability without losing attribute auditability. To prevent Sybil attacks and credential transfer, we integrate a deterministic nullifier tied to Soulbound Tokens (SBTs). We formalize the scheme's system model and establish its security regarding existential unforgeability, signer-blindness, and zero-knowledge. Performance results show that this construction maintains minimal on-chain gas consumption, offering a practical deployment path for privacy-preserving verifiable credentials in Web3 environments.

Secure multi-party computation in permissionless settings like blockchains faces the challenge of maintaining security under adaptive corruptions. YOSO MPC (Benhamouda et al., TCC 2020; Gentry et al., Crypto 2021) addresses this through ephemeral roles, allowing committee members to speak only once before erasing state, thus preventing adaptive attacks within each role's lifetime. However, prior work on YOSO MPC relied on an honest majority within committees and required enormous committee sizes, often numbering in the thousands. In this paper, we challenge both requirements by leveraging the cryptoeconomic properties of the underlying blockchain. We introduce a mechanism for identifying parties who fail to fulfill their roles during protocol execution, using time-lock puzzles. This enables misbehaving parties to be penalized based on publicly verifiable fraud proofs, allowing for a more aggressive committee threshold. Furthermore, we propose a new sortition procedure that ensures the resulting committee always has a constant size, not just in expectation. This reduces fluctuations in committee size, enabling an even higher committee threshold. These techniques allow us to handle any constant fraction $f < 1$ of total corruptions. Finally, we refine and generalize the analysis of corruptions in YOSO protocols, obtaining tighter bounds. Combined with our other enhancements, this enables committees of around 100 parties. Our analysis yields a $70$--$80\%$ improvement over the estimates of the seminal work by Benhamouda et al. (TCC 2020). We believe our work paves the way for practical deployments of YOSO MPC protocols.

Zero-knowledge proofs allow to prove a statement while not revealing anything about the witness. In particular, non-interactive zero-knowledge (NIZK) has emerged as the preferred paradigm due to its public verifiability. However, existing NIZK protocols often suffer from high prover overhead for large statements. Conversely, designated-verifier zero-knowledge (DVZK) offers superior prover efficiency and scalability, but is restricted to a single, designated verifier. This leaves a critical gap in scenarios requiring a prover to efficiently convince a group of n verifiers without incurring massive prover overhead of non-interactive systems. To reconcile this, we focus on multi-verifier zero-knowledge (MVZK) protocols, which efficiently prove the same statement to n verifiers simultaneously. MVZK protocols inherit the prominent prover efficiency of DVZK and extend its utility to the multi-party setting. In this work, we propose a highly efficient MVZK protocol in the preprocessing model, secure against a dishonest majority. It tolerates a corrupted prover and up to n-1 corrupted verifiers, where the prover sends only a single message to verifiers, while several prior works require at least two online rounds. Furthermore, compared to the state-of-the-art 1-round protocol by Zhou et al. (PKC 2025), our protocol eliminates the extension-field multiplications from 4n to 0 over any field, achieving superior online efficiency. Experimental results demonstrate that our protocol achieves 9x faster proving and 47x faster verification when evaluating Boolean circuits with 10^4 AND gates.

While public blockchains provide transparent and auditable transaction histories, they inherently compromise user privacy. Existing privacy-enhancing protocols, such as those deployed on Ethereum, typically rely on succinct zero-knowledge proofs (zk-SNARKs) to obscure the transaction graph. However, implementing comparable cryptographic guarantees on high-throughput blockchains like Algorand is challenging due to strict per-call execution budgets and the state contention introduced by global Merkle accumulators. This paper presents Obscura, a decentralized, non-custodial privacy protocol tailored for constrained smart contract environments. Obscura achieves transaction anonymity using Linkable Spontaneous Anonymous Group (LSAG) signatures over the BN254 elliptic curve, verified entirely on-chain. To overcome limitations of the Algorand Virtual Machine (AVM), we introduce a novel state model that leverages Algorand's Box Storage for $O(1)$ commitment membership checks, eliminating the need for global Merkle accumulators, and a dynamic opcode-budget expansion mechanism via pooled inner application calls. Our implementation demonstrates that signer-ambiguous privacy is practical and efficient on Algorand without relying on trusted setups or succinct proofs. Obscura provides a robust privacy layer for transparent ledgers, bridging the gap between high-throughput blockchain architectures and the dual requirements of cryptographic privacy and selective auditability.

The security of a recent MPC-in-the-Head signature scheme introduced at Crypto 2024 by Huth and Joux required the introduction of a new ad hoc hardness assumption called the Subfield Bilinear Collision (SBC) problem. By relying on the VOLE-in-the-Head framework, the authors further improved the performance of this scheme at Asiacrypt 2025, resulting in a very compact construction. In this paper, we improve the original cryptanalysis of SBC in several ways. First, we describe a link between the SBC problem and the decoding problem in the rank metric for codes linear over an extension field $\mathbb{F}_{q^m}$, strengthening its theoretical hardness and expanding the range of attacks on the SBC problem. Second, we analyze Gröbner basis algorithms applied to the bilinear modeling of SBC proposed by Huth and Joux and formulate conjectures on the behavior of this system. Finally, we describe another algebraic modeling of SBC obtained by using the Plücker relations between the maximal minors of a matrix. While we do not threaten the parameters of the proposed signature schemes relying on SBC, our work opens the door to a more accurate analysis. In particular, we were not able to analyze the inclusion of the field equations of $\mathbb{F}_{q}$ in the Gröbner basis algorithm, which is especially relevant since $q=2$ in these parameters. We leave this task for future work.

Existing benchmarks of post-quantum cryptographic (PQC) algorithms focus on raw throughput or latency on unconstrained hardware, leaving open the question of how implementation choices affect microarchitectural behavior under varying resource pressure. This paper addresses that gap by profiling RustCrypto and PQClean implementations of ML-KEM-768 and ML-DSA-65 across three cgroups-enforced configurations (0.5 CPUs, 1.0 CPUs, and unconstrained). The C baseline uses PQClean reference code; the Rust implementation uses the RustCrypto project's ml-kem crate v0.3.0 and ml-dsa crate v0.0.4. We utilize robust non-parametric statistics (Median and Interquartile Range) over the full execution distributions to reduce sensitivity to scheduler-induced timing variance and avoid arbitrary outlier filtering. Alongside hardware performance counters, we present Flamegraphs to analyze sampled execution hotspots. Results demonstrate that the evaluated Rust configurations exhibit a latency overhead for both ML-KEM (+42.4%) and ML-DSA (+47.8%) under severe 0.5 CPUs throttling compared to clang-compiled C. Massif traces attribute all additional Rust heap usage entirely to runtime initialization, with no observable dynamic allocation within the measured cryptographic core execution paths.

We present PQES-AKE, a novel two-party authenticated key exchange (AKE) protocol built upon the Post-Quantum Encryption and Signcryption Scheme (PQES) introduced by Kara et al. The protocol achieves mutual authentication, session key secrecy, and forward secrecy in a post-quantum adversarial model. The central design principle of PQES-AKE is the concealment of ephemeral Diffie-Hellman (DH) keys within affine masks derived from randomness generated internally by the PQES signcryption algorithm. The security of PQES-AKE rests on three hardness assumptions, including Learning With Errors (LWE) for ciphertext confidentiality, a Secret-Base Discrete Exponentiation (SBDE) assumption for signature unforgeability, and the Computational Diffie-Hellman (CDH) assumption for session key secrecy. The protocol completes in two network rounds, with a total communication cost of approximately 627 bytes, and requires 17 modular exponentiations. A Python prototype evaluated on a commodity Intel Core i7 laptop achieves an average execution time of 6.2ms. These results confirm that PQES-AKE provides a competitive, single-primitive alternative to composite KEM-then-authenticate constructions in post-quantum secure channel establishment.

Linearization is a cryptanalysis technique in which a nonlinear function (an S-box) is represented by an affine mapping on a certain subset of inputs. Its variants were applied to analyze Keccak, LowMC, RAIN and AIM. In these primitives, the S-boxes are either very small (up to 5 bits) or are very specific monomial functions over a binary field. Linearization of arbitrary S-boxes was never practically explored due to the lack of theoretic, algorithmic, and cryptanalytic understanding. For the first time, we develop an algorithmic toolkit which allows one to compute strong linearizations of S-boxes, when they exist. For up to $n=8$ bits, our algorithms are able to find provably the best possible approximations, while for larger S-boxes it is feasible to obtain good approximations together with meaningful upper bounds. We apply our algorithms to a variety of S-boxes from existing primitives, to monomial functions, to so-called APN functions, and to 16-bit Super-Sboxes. We obtain interesting results raising many new open questions and open up new research directions, as well as a foundation for developing cryptanalytic attacks. To advance the cryptanalytic utility of linearization, we study and solve the problem of covering an S-box with multiple approximations. As an application, we derive a generic linearization approach for the CICO problem (constrained-input-constrained-output) over SPN-based permutations (Substitution-Permutation Networks) with general linear layers. This is the first such general cryptanalysis based on the existence of a strong linearization of the S-box.

Private Information Retrieval (PIR) is of growing importance in privacy-preserving data access, as it enables users to retrieve information from databases without revealing their query content, thereby aligning with modern data protection and regulatory standards. State-of-the-art schemes, such as HintlessPIR and TensorPIR proposed by Li et al. at CRYPTO 2024, leverage lattice-based cryptography for efficient and privacy-preserving data retrieval. HintlessPIR achieves a communication complexity of $O(N^{1/2})$, which remains suboptimal for large databases. To further reduce communication overhead, the same work introduces TensorPIR, lowering the asymptotic complexity to $O(N^{1/3})$. However, this improvement requires larger parameters and more CRT moduli, leading to a practical communication cost that is not significantly smaller than that of HintlessPIR. In this work, we propose a new framework that rethinks the encryption strategy for the index, reducing both communication and computation costs through fewer CRT moduli. In experiments on 16 GB, 32 GB, 64 GB, and 128 GB databases, our total communication cost drops to as low as 45.5% of TensorPIR's. Theoretically, as $N$ grows, our query and answer sizes are reduced to 36.9% and 22.2% of TensorPIR's, respectively. Compared with HintlessPIR, our scheme achieves lower theoretical communication complexity, leading to substantially smaller practical communication for large $N$. Moreover, our total online time is reduced to 28.9% to 56.1% of HintlessPIR's.

Threshold signatures have received considerable attention in recent years due to ongoing standardization efforts and deployment in real-world systems. In this work, we prove the universal composability of a wide range of threshold signature schemes, including state-of-the-art protocols compatible with standard signatures used in practice, such as BLS and Schnorr signatures, as well as emerging post-quantum solutions. Importantly, we show UC security without any modifications to the existing protocols. To this end, we design natural game-based definitions to capture different combinations of main threshold signature scheme properties, such as different levels of unforgeability, adaptive corruption, robustness, and different degrees of preprocessing. These definitions generalize prior definitional work, such as Bellare et al. (CRYPTO'22), and cover a wide range of existing schemes. Moreover, we identify and resolve gaps in prior work. We then express these properties in terms of a UC ideal functionality $\mathcal{F}\text{-}\mathtt{TS3}$. We prove that a threshold signature scheme UC-realizes $\mathcal{F}\text{-}\mathtt{TS3}$ if and only if it satisfies our game-based definitions. This opens up the usage of (existing) threshold signature schemes in a UC setting, enabling scheme designers to formulate their protocols relative to an ideal threshold signature functionality and use the UC composition theorem to argue security given any concrete instantiation. To further support UC scheme designers and to give further guidance on UC modeling for threshold signatures, we provide additional ideal threshold signature functionalities $\mathcal{F}\text{-}\mathtt{TS2}$, $\mathcal{F}\text{-}\mathtt{TS1}$, $\mathcal{F}\text{-}\mathtt{TSSync2}$, and $\mathcal{F}\text{-}\mathtt{TSSync1}$, which capture fewer properties than $\mathcal{F}\text{-}\mathtt{TS3}$ but are more convenient to use. $\mathcal{F}\text{-}\mathtt{TS2}$, $\mathcal{F}\text{-}\mathtt{TS1}$, $\mathcal{F}\text{-}\mathtt{TSSync2}$, $\mathcal{F}\text{-}\mathtt{TSSync1}$ can also be UC-realized by schemes proven secure according to our game-based definitions. Through this work, we show that composable security does not require sacrificing performance, but it does require rigor when setting up game-based definitions and ideal functionalities.

End-to-end encryption guarantees message confidentiality but does not hide metadata such as communication patterns among senders and recipients, or their identities. Oblivious Message Retrieval (OMR) is a cryptographic protocol that enables servers to assist recipients in retrieving their messages from a database without learning the mapping between messages and recipients, thereby protecting such metadata. This paper investigates two central questions of OMR: (1) What is the precise relationship between OMR and the better-studied primitive of Private Information Retrieval (PIR)? (2) Can OMR schemes achieve concrete efficiency comparable to state-of-the-art PIR protocols? We show that OMR with a property we call strong detection-key-unlinkability is at least as hard as PIR, and that existing OMR constructions already satisfy this property. This PIR-to-OMR reduction has low overhead, suggesting that OMR cannot be made substantially more efficient than PIR. We then present $\mathsf{UnifOMR}$, which achieves $20\times$ to $1080\times$ faster server runtime over the state-of-the-art $\mathsf{SophOMR}$ under practical parameter settings. For $2^{19}$ messages of 612 bytes each, $\mathsf{UnifOMR}$ completes in only ${\sim}25$ seconds with 4 MB of communication, compared to $>1250$ seconds and 260 KB for $\mathsf{SophOMR}$. These gains come with two trade-offs: an asymptotically linear digest size (albeit with small constants), and two rounds of interaction between the detector and the client. Furthermore, crucially, $\mathsf{UnifOMR}$ uses batch PIR as a black-box component, which in our experiments accounts for $50$--$92\%$ of the server runtime. Thus, $\mathsf{UnifOMR}$ nearly matches the aforementioned lower bound concretely (for databases of $2^{16}$ to $2^{23}$ messages, each with $612$ to $3060$ bytes), given the status quo of batch PIR.

A non-interactive secure computation (NISC) protocol allows a client with input $x$ and a server with input $y$ to compute $f(x,y)$ using a single message from the client and a single response from the server. The protocol is called succinct if the size of the server’s message depends only on the output length and is independent of the size of $y$ and the complexity of $f$. In the semi-honest setting, succinct NISC is known from fully homomorphic encryption (FHE). In contrast, malicious security is currently known only from non-standard assumptions, such as SNARKs for NP. In this work, we construct maliciously secure succinct NISC protocols for natural and widely studied functionalities from standard assumptions, namely, FHE and batch arguments (BARGs). Our first result is a protocol for private set membership (PSM): the client holds an element $x$, the server holds a large set $S$, and the function outputs $1$ if and only if $x \in S$. We then give several generalizations: - Dictionary lookup: The server holds a dictionary $D$ of key–value pairs, the client’s input is a key $k$, and the output is $D[k]$. - Verifiable dictionary lookup: The server’s dictionary must additionally satisfy a predicate $P$, computable by a read-once machine with small state. - UP search: The client input is an instance $x$, and the output is $D[w]$, where $w$ is the unique witness for $x$ under some UP relation. Our protocols achieve split-simulation security against a malicious server and standard security against a malicious client. Split-simulation is a relaxation of the standard real-ideal paradigm, where correctness of the client’s output and indistinguishability of the server’s view are guaranteed separately. At the heart of our results lies a new simulation technique in which the server’s large input is extracted piece by piece and reconstructed into a coherent input. This reconstruction is enabled by a new monotone coupling argument based on Strassen’s theorem.

In this paper, we propose Titan, an efficient polynomial commitment scheme (PCS) with transparent setup. It achieves commitment time of $O(n)$, evaluation time of $O(\sqrt{n})$ while the proof size and verification scales as $O(\sqrt[4]{n})$. Titan features an order of magnitude smaller proof sizes than hash based PCS, while featuring a significantly more efficient prover and verifier compared to state of the art group based schemes like Dory and Hyrax. To achieve this balance, Titan borrows two-tiered commitments from Dory, and realizes outer commitment using interactive protocols of proximity (IOPP) over groups, such as Basefold and WHIR, instead of expensive bilinear pairings. This allows Titan to be instantiated over general curves with discrete-log hardness such as Pasta Curves, instead of requiring pairing friendly curves. We compile a variant of Spartan protocol for R1CS with Titan PCS to realize a new SNARK, which we call TitanSnark. Our construction TitanSnark preserves the prover efficiency of the existing Spartan protocol, while improving proof size and verification quadratically from $O(\sqrt{n})$ to $O(\sqrt[4]{n})$. Concretely, for circuits of size $\geq 2^{22}$ this results in around $3\times$ more efficient proof size and verification. Our blueprint of combining IOPPs over groups with Pedersen style inner commitments is of independent interest, as are several optimizations towards efficiently realizing WHIR IOPP over prime-order groups.

Gradient boosted decision trees (GBDTs) are among the most effective models for tabular data and are widely used in domains such as finance, healthcare, and risk assessment. As these models are increasingly trained and served by external providers, clients need a way to check that a prediction or a model update was produced by the claimed training pipeline. At the same time, the provider may need to keep the training data and model parameters private. This makes zero-knowledge proofs for GBDT training and inference a natural tool for accountable machine learning. Existing constructions for proving GBDT training typically rely on generic ZKP compilers. They build a certification circuit that checks the forest against the training data, and then prove the circuit execution. This leads to high prover cost. On the other hand, a more direct approach to decompose proof of training into algebraic constraints inevitably introduces many auxiliary witnesses to assist proving. Proving these constraints separately could result in a huge amount of independent auxiliary commitments, whose committing and opening could dominate both proof size and prover time. Batching these constraints is also difficult because they come from different stages of training and have potentially different witness shapes and sizes, which are committed over different domains. We present \textsc{Terrae}, a zero-knowledge proof system for quantized GBDT training and inference based on KZG polynomial commitments. \textsc{Terrae} avoids both dependency on proving circuit computation and proving each constraint separately by leveraging the structure of GBDT training and novelly batching the constraints. We introduce two batching techniques: domain-lifting batching for linear constraints and interleaving batching for non-linear constraints. Both techniques work over differently-sized domains and reduce many constraints to a single claim without introducing extra polynomial commitments. We also design a histogram proof that proves the correctness of converting sample-wise data into its frequency representation, which may be of independent interest. Our evaluation shows that, compared with prior approaches, \textsc{Terrae} significantly reduces proof-generation time while adding only a small proof-size overhead.

PRISM (PKC25) is a hash-and-sign signature scheme whose security relies on the hardness of computing large-prime-degree isogenies originating from a curve of unknown endomorphism ring. In PRISM, the degree of such isogenies is obtained by hashing messages onto a set of large odd integers that pass a primality test. In this work, we investigate the impact of the choice of primality test on the security of PRISM. We first show that when a weak primality test is used, the assumption underlying the security proof in the standard model does not hold. We then extend our analysis to the assumption used in the security proof in the (quantum) random oracle model. In this setting, we argue that the Miller-Rabin test suffices and estimate the minimal number of iterations required for PRISM to achieve the desired security level, thus minimising signing costs.

Communication locality of an $n$-party protocol measures the maximum degree of the communication graph induced by the protocol execution. While secure multi-party computation (MPC) with small, sublinear locality exists in the static-corruption setting, this goal seems nearly paradoxical in the adaptive-corruption setting: Even against fail-stop adversaries, small neighbour sets of honest parties lie vulnerable to identification and corruption. Surprisingly, Chandran et al. [ITCS '15] showed that for a single MPC execution, sublinear locality and adaptive security can be simultaneously achieved, assuming honest-to-honest channels are hidden from the adversary. Their solution works in the ``hidden-graph model,'' where a fresh, initially hidden, low-degree graph is being used in each round. In turn, the combined degree grows with every round---inherently limiting the approach to a single-shot MPC execution, and sublinear total rounds. This raises the following question, which is the focus of our work: Is it possible to maintain sublinear locality over an unbounded number of executions facing adaptive adversaries? In this work, we provide an affirmative answer in two settings: First, we consider semi-honest adversaries and information-theoretic security, and construct reusable MPC with polylog($n$) locality. Second, we consider fail-stop adversaries and computational security, and construct reusable MPC with $\tilde O(n^{2/3})$ locality. Our results are obtained by devising low-locality protocols while hiding important information about the graph topology, enabling the parties to reuse a single hidden graph. As an independent contribution, this serves as new results for adaptively secure topology-hiding computation (Moran, Orlov, Richelson [TCC '15]).

We propose a costless platform for fair exchange based on smart contracts to favor economic inclusion. Our smart contract is minimal, as most of communication is done offchain. The smart contract costs are covered by incentivized sponsors. Our protocol is a knowledge-coin exchange: it allows to exchange a digital item, characterized by an automatically verifiable description, against a payment in cryptocurrency. The exchange is fair in the sense that either both parties receive what they expect (the exchange completes) or both parties lose nothing (the exchange is canceled). We ensure a costless transaction in cancelation cases, and a transaction with pre-determined fee if it completes. We also ensure privacy of the transaction. Our protocol offers an improvement compared to OptiSwap: we can work with any description function. The complexity is never higher and sometimes significantly smaller. Namely, the worst case complexity is logarithmic instead of being linear. Furthermore, we introduce sponsoring as an enabler for economic inclusion.

In this work, we cryptanalyse the post-quantum signature scheme AIMer v2.1, which is one of the winners of the Korean Post-Quantum Cryptography competition (KpqC), and whose earlier version was a candidate in the US NIST's additional post-quantum digital signatures call. We show that AIM2, the underlying symmetric-key primitive, is not secure up to the claimed level by developing and applying a new algebraic attack framework based on extended linearization over a univariate polynomial ring and a novel algorithm for finding a null vector of a polynomial matrix. In particular misuse scenarios, such as reused-key or related-key settings, our attacks become practically feasible, allowing experimental verification and benchmarking. We also evaluate the approach on the RAIN block cipher used in the Rainier post-quantum signature scheme and obtain improved attacks, although not threatening its claimed security.

Convolutional neural network parameters are valuable intellectual property, yet many APIs expose only top-1 labels and assume hidden logits limit parameter recovery. Prior cryptanalytic extraction can recover functionally equivalent ReLU MLPs, but CNNs introduce weight sharing, parallel critical hyperplanes, coupled spatial perturbations, and channel-sign ambiguity. This paper presents an end-to-end hard-label extraction attack for known-architecture ReLU CNN classifiers with average pooling. The main algorithmic contribution is channel-level recovery with SVGR-guided retained-candidate discrete optimization under a retained-candidate assumption. The attack locates dual points on decision and activation boundaries, recovers shared channel signatures with SVD, resolves channel signs, and peels layers while absorbing ReLU scale factors into later linear layers. Across evaluated 1D MNIST, 2D MNIST, and RGB CIFAR-10 variants, extraction reaches 100% prediction fidelity. Moreover, the evaluation demonstrates downstream security implications: extracted watermarked CNNs preserve behavior-level ownership evidence. Furthermore, the recovered models can be wrapped with deterministic triggers without erasing retained watermark signals, creating risk for both owners and downstream users. These results demonstrate that hiding logits alone does not protect parameters for this CNN family once architecture information is available. The anonymous artifact is available for review at https://anonymous.4open.science/r/cnn_hard_label_extraction-83F4.

Designing threshold lattice-based FHE schemes remains challenging due to the noise leakage that may occur during distributed decryption. The mainstream approach to avoid this consists of relying on noise flooding or smudging techniques. However, using these techniques comes at the cost of the much larger parameters required to ensure reliable decryption, and they are not easily applicable to schemes with smaller ciphertext moduli such as TFHE. In this paper, we demonstrate that smudging can be avoided for LWE-based FHE schemes, such as TFHE, by using a correct Linear Homomorphic Encryption (LHE) scheme, like Paillier, to encrypt the $b$-term of an LWE pair obtained after completing a homomorphic computation and sanitizing the resulting ciphertext. The key intuition is that, because the b-term of the LWE pair is not revealed to the decrypting parties, noise leakage is no longer an issue (with sanitization ensuring noise/message independence). We then instantiate this approach using TFHE as the baseline LWE scheme as well as the Tiresias threshold variant of Paillier. We prove the resulting construction, denoted thPLWE, is IND-CPA secure under static corruption and adaptive queries (Scor-Adp-IND-CPA) under the assumption that Tiresias achieves the same. We then provide experimental results to assess the practicality of the approach and compare it to other recent works.

Although automated symbolic protocol verification has proven valuable and effective, current approaches begin to reach their limits: While small protocols can be analyzed automatically, the most complex case studies often require substantial expert time and resources. There have been many attempts to solve this problem by compositional verification, but they rely on unrealistic protocol assumptions and do not support real-world security properties like Forward Secrecy. In this work, we enable compositional symbolic analysis for real-world security protocols with respect to modern security properties. We develop a composition result in the Applied π-Calculus that holds even in the presence of attackers capable of dynamic corruption if the protocols satisfy a disjointness requirement. We demonstrate the applicability and effectiveness of our result on the composition of a data exchange protocol with a Diffie-Hellman key exchange and a compositional analysis of Forward Secrecy in TLS 1.3 within the scope of RFC 8446 and the ECH extension. While monolithic analyses of TLS 1.3 with ECH fail to deliver a result in 10% of cases, all compositional analyses succeed. Additionally, runtime decreases by 71% and memory usage by 86% on average.

Mechanized cryptographic proofs face a long-standing trade-off between assurance and expressiveness. Existing foundational frameworks, which reduce every proof step to the kernel of a general-purpose proof assistant, offer a small, auditable trusted base, but struggle to model the oracle manipulations and rewinding arguments pervasive in modern cryptography. They also tend to lack the tactic infrastructure of specialized, non-foundational tools like EasyCrypt. We present VCVio, a foundational framework in Lean 4 that closes both gaps with established ideas from programming-language theory: algebraic effects and handlers on the oracle side, and a modular relational program logic on the tactic side. Concretely, a computation with oracle access is the free monad over the polynomial functor determined by the oracle specification, exposing its interaction history as an explicit syntax tree. Caching, logging, reprogramming, and seed pre-sampling become handler combinators; rewinding reduces to deterministic transcript replay without any internal adversary state. On top of the oracle core, VCVio provides two reusable layers. We extend the recent Loom framework (POPL 2026) to the relational setting, yielding a single tactic framework that handles both unary and relational probabilistic reasoning. Alongside this, our treatment of state-separating proofs achieves compositional separation by typing, whereas Nominal SSProve recovers it by quotienting locations modulo alpha equivalence. We exercise this stack on three case studies: a random-oracle commitment scheme; the Bellare--Neven forking lemma, mechanized without the rewindability axioms used in the recent EasyCrypt formalization by Firsov and Janků; and the Schnorr signature scheme establishing EUF-CMA security. A significant share of our development used LLM coding agents and external automated proof-search systems; we report on the workflows, successes, and failure modes as a data point in LLM-assisted theorem proving.

DAG-based Byzantine fault-tolerant (BFT) consensus protocols achieve high throughput by allowing many validators to propose concurrently, but scaling them to large committees remains challenging. In a committee of $n$ validators, up to $f$ of which may be Byzantine ($n = 3f{+}1$), dense round-based DAG designs require each block to reference at least $2f{+}1$ blocks from the previous round. This yields $O(n)$ metadata per block, $O(n^2)$ metadata per round, and $O(n^3)$ metadata bytes transmitted per round under all-to-all dissemination, increasing bandwidth and processing costs and making metadata, rather than payload, the latency bottleneck. We present Bluestreak, a sparse uncertified DAG BFT consensus protocol that keeps non-leader blocks constant-size (in $n$) and concentrates committee-scale ancestry in a single leader block per round, yielding constant \emph{average} metadata per block as committees grow. Bluestreak combines this sparse block format with a new leader commit rule co-designed for the sparse DAG and a new pull-based pacemaker, and we prove safety and liveness under partial synchrony using only collision-resistant hashes and standard digital signatures. We implement and evaluate Bluestreak under wide-area latency spanning ten geo-distributed regions. Bluestreak scales from 10 to 400 validators on commodity 4-vCPU instances with sub-second WAN latency throughout (${\approx}\,470$ ms at $n{=}10$, ${\approx}\,720$ ms at $n{=}400$), keeping average per-block metadata constant at ${\approx}\,320$ bytes. At $n{=}120$, Bluestreak sustains ${\approx}\,220$k tx/s with LSM-tree storage and ${\approx}\,400$k tx/s with WAL-based storage, both at sub-second latency.

Substitution-permutation networks (SPNs) are the most popular construction method for block ciphers and sponge permutations. Basically, we can divide SPNs into two groups by considering their diffusion layer profiles: bit-wise versus byte-wise (or nibble-wise) diffusion. In this paper, we suitably combine both approaches and present a more efficient and flexible construction that achieves a combination of small S-boxes, linear layers consisting only of XOR operations and bit permutations, and a small number of rounds. As concrete results, we present the family SEFA of several lightweight and flexible block ciphers, AEADs, and cryptographic hash functions, including: * SEFA-128/256: A TFHE-friendly block cipher with 128-bit block, 256-bit key, using 4-bit S-boxes, through 16 rounds. * SEFA-512/256: A wide-block AEAD suitable for encrypting 256-bit blocks with 256-bit keys, using 8-bit S-boxes, through 16 and 10 rounds. * SEFA-1536: A hash function using sponge construction with a 1536-bit state permutation including 8-bit S-boxes and 12 rounds. We analyze the security from several attack perspectives. Also, we present hardware implementation results, along with comprehensive performance benchmarks, to demonstrate performance and flexibility.

There are two kinds of cryptographic group actions: restricted and unrestricted. While unrestricted actions like (qt-)PEGASIS are needed for more advanced constructions, restricted ones like dCTIDH are sufficient for instantiating a NIKE and usually much more efficient. In this work, we propose CORAL, a significantly faster algorithm to evaluate the same action as (qt-)PEGASIS, but in a restricted fashion; CORAL only computes two-dimensional $2$-isogenies to evaluate the action and outperforms both recent unrestricted (KLaPoTi, (qt-)PEGASIS) and (restricted) CSIDH-based approaches (SQALE, dCTIDH). In essence, CORAL trades off unrestrictedness for efficiency. Our unoptimised C implementation evaluates a group-action in 240 ms with a 2032-bit prime. When used to construct a non-interactive key exchange, CORAL yields an actively secure post-quantum NIKE with compact public keys (e.g. 256 bytes for 2032-bit primes).

ML-DSA is a lattice-based signature scheme that has recently been standardized by NIST as FIPS 204. Among the many subroutines used by ML-DSA are the high bits (Hb) and low bits (Lb) functions, which, as their name suggest, return only the higher bits or the lower bits of some integer. Recently, Seck and Roux-Langlois (IACR CiC 2025) conjectured that the high bits of a sum of two integers t and r can be expressed as the sum of the high bits of each integer, plus an error term that can take at most seven different values. In this paper, we study the properties of the functions Hb and Lb and we prove that the conjecture of Seck and Roux-Langlois holds. In addition, we provide a complete characterization of the error term. As an application, we explain how these properties can be used to design lattice-based signature schemes with advanced features.

Rotating leader Byzantine fault-tolerant (BFT) protocols, also known as protocols in the leader-speaks-once (LSO) model, have become a topic of interest with the rise of blockchains. Many recent efforts have been made to lower the latency and simplify the design. However, existing works often sacrifice expected latency (latency when failures might occur) to enjoy higher good-case latency. In this work, we present a generic approach to building rotating leader BFT protocols that are both simple and fast. We present two variants: HumBird-1, a synchronous BFT under the $f<n/2$ assumption; HumBird-2, a partially synchronous BFT under the $f<n/3$ assumption, where $n$ is the number of replicas in the system and $f$ is the number of Byzantine failures. We show that by relaxing LSO to the leader-speaks-twice (LST) model and introducing a special uncle block field, we can significantly reduce both good-case latency and expected latency. Our experimental results show that compared to the state-of-the-art rotating leader BFT, HumBird-1 and HumBird-2 achieve up to 32% lower latency and 70% higher throughput, and 95% lower latency and 140% higher throughput, respectively.

The selfish-mining literature has progressively lowered the hashrate threshold at which a rational Bitcoin miner strictly profits by deviating from the honest protocol, from Eyal and Sirer's 25% down to single digits under richer attacker models. Two such models remain unreconciled: Gervais et al. (CCS 2016) parameterize network-layer adversaries through an eclipse fraction omega and an honest-only stale rate o, but assume constant block rewards; WeRLman (IEEE S&P 2023) models fee-rich rewards through a deep-RL solver, but assumes a network-clean attacker. An adversary that exploits both surfaces has not been analyzed. We present the first joint analysis. We formulate a Markov decision process that integrates Gervais's network-layer channels with WeRLman's whale-transaction tracking, solve it at a 5.7 x 10^8 state truncation, and anchor the construction by reduction to each prior model at the appropriate parameter limit. Our threat model targets a state-level adversary with per-block routing influence over a meaningful fraction of honest hash power, not an attacker who eclipses individual nodes. Under this model, the joint threshold collapses far below either single-channel result. At L = 3, the F=10 baseline (no network channels) crosses at alpha = 13.2%; a 10% eclipse fraction alone drops it to 2.6%, a 10% stale rate alone to 4.8%, and both channels together to 1.4%. At L = 5 the joint configuration drops further to 0.9%, an at least 15x collapse. An analytical lemma accounts for the interaction: the honest-chain growth probability factors as (1 - alpha - omega)(1 - o), isolating a cross-term omega * o that is a property of the joint transition kernel itself. The cross-term is structural, not a training artifact, and its presence implies that mitigations targeting only one channel leave the joint contribution structurally present whenever the other channel is non-zero.

The security of decentralized asset custody and blockchain consensus increasingly relies on threshold signatures to eliminate single points of failure. In these high-stakes environments, static security models are an insufficient theoretical abstraction. Real-world blockchain deployments demand adaptive security to ensure protocols remain secure against adversaries who reactively compromise participants based on observed network traffic and protocol state. While the NIST standardization effort and Bitcoin’s Taproot (BIP340) upgrade have accelerated interest in adaptively secure threshold Schnorr signatures, a threshold system is only as secure as its setup phase. In decentralized settings, this necessitates a Distributed Key Generation (DKG) protocol to eliminate reliance on a trusted dealer. However, a critical gap remains: current DKG protocols are incompatible with the specific key structures required by promising schemes (EUROCRYPT'26). Furthermore, a result from CRYPTO'25 demonstrated that unique key commitments necessitate a non-falsifiable assumption for adaptive security. To avoid non-standard assumptions, DKG protocols must be key-share hiding, a property existing DKGs fail to provide. We close this gap by proposing two novel DKG protocols that support identifiable abort and tolerate a dishonest majority and prove them secure under new ideal functionalities in the UC framework. Our first protocol achieves optimal round complexity via a single broadcast round at the cost of allowing adversarial bias, while our second protocol eliminates the bias in two rounds. In addition, the protocols provide a proactive key refresh mechanism that allows long-lived decentralized networks to refresh internal key material periodically. This enables the system to recover from transient node compromises without the operational burden of rotating the underlying public key. Our evaluation demonstrates that these constructions are practically efficient, incurring minimal communication and computation overhead for modern high-throughput architectures.

We prove that row-wise interleaving does not impose a linear loss on two coding-theoretic soundness properties used in recent IOP/SNARK analyses: generator mutual correlated agreement and curve decodability. For generator-MCA, let $G:\Omega\to\mathbb{F}_q^\ell$ be a coefficient generator over a finite seed set and let $C$ be an $\mathbb{F}_q$-additive code. For every interleaving width $s$ and distance parameter $\delta$, we show $$ \varepsilon_G(C,\delta) \le \varepsilon_G(C^{\equiv s},\delta) \le \left(1+\frac1q+\cdots+\frac1{q^{s-1}}\right)\varepsilon_G(C,\delta). $$ Moreover, if $|\Omega|\le q$, then the transfer is exact: $$ \varepsilon_G(C^{\equiv s},\delta)=\varepsilon_G(C,\delta). $$ In particular, affine-line MCA is invariant under row-wise interleaving. This answers the known interleaving-loss question and removes the linear interleaving factor from the affine-line MCA bound. It also implies that polynomial-generator MCA bounds transfer to interleaved codes without an additional interleaving-width factor. We further establish interleaving stability for curve decodability. We introduce a marked formulation, prove its equivalence to the standard definition for $\mathbb{F}_q$-additive codes and $1\le b\le a\le q$, and use it to transfer curve decodability to row-wise interleavings. If $C$ is $(\ell,\delta,a,b)$-curve-decodable and $\binom{a}{b}\le q$, then $C^{\equiv s}$ is also $(\ell,\delta,a,b)$-curve-decodable for every $s$. We also give a field-size-weighted variant that transfers larger base-code witness parameters to smaller interleaved-code witness parameters.

We study the Lattice Isomorphism Problem (LIP) for both indefinite and definite quadratic forms, with applications to the DEFI signature scheme. By combining arithmetic and algorithmic techniques, we obtain efficient attacks on DEFIv2, a digital signature scheme based on isotropic quadratic forms. Our approach to the Decision \ Distinguishing-LIP draws on the arithmetic theory of quadratic forms, with particular emphasis on indefinite forms of dimension at least 3. We show that such forms arise naturally in the analysis of DEFI and prove that, under suitable assumptions, the genus, spinor genus, and equivalence class coincide. This structural collapse leads to a classical polynomial-time algorithm for the Decision \ Distinguishing-LIP instances obtained from DEFI. In addition, we present an efficient algorithm for recovering the secret key of DEFIv2 and demonstrate practical signature forgeries within minutes using the authors' public challenge instances. Finally, we evaluate the impact of our methods on HAWK and show that, in contrast to DEFI, they do not compromise its security.

Ring signatures provide authentication over messages, whilst providing anonymity amongst a set of signer-defined public keys. They see active use in cryptocurrencies, e-voting and concurrent signature domains. However, post-quantum constructions typically rely on lattices, specifically utilising the Learning with Errors (LWE) and Short-Integer-Solution (SIS) problems, which cause inefficiencies when compared with classical constructions. One promising route to circumvent the inherent challenges of these underlying assumptions is the Lattice Isomorphism Problem (LIP), which underpins the HAWK signature scheme by Ducas et. al, currently a second round candidate in the NIST standardisation project Post Quantum Cryptography: Additional Digital Signature Schemes. It offers significant performance improvements over standard lattice assumptions due to its improved decoding, however, the only known construction of a ring signature from LIP has been shown to not satisfy linkability or correctness. In this paper we propose RingSLIP, a secure linkable ring signature based on LIP, utilising the HAWK signature. The resulting ring signature is logarithmic in the number of ring members, and concretely has size 46KB when targeting 128 bits of security for 4096 ring members, which is competitive with other lattice-based schemes. Furthermore, we observe that our construction also benefits from online/offline computation, resulting in a signature with online signing and verification only requiring $8.54 \times 10^4$ and $1.48 \times 10^5$ CPU cycles respectively, compared to $1.35 \times 10^{11}$ without these optimisations.

We introduce BlindReview, an anonymous and end-to-end verifiable peer review system that cryptographically guarantees both privacy and auditability throughout the reviewing process. We formally define these security properties and provide rigorous proofs that BlindReview satisfies them. We also present an implementation demonstrating our protocol’s practicality. This work serves as a foundation for verifiable and privacy-preserving peer review, offering a concrete solution to enhance transparency and reduce bias in the academic peer review process.

Atomic swaps are a fundamental primitive for the trustless exchange of digital assets across blockchains: they guarantee that either both parties receive the agreed assets or neither party transfers. While this all-or-nothing guarantee is powerful, it also imposes an inherent determinism that rules out exchanges whose intended outcome is probabilistic. As a result, existing atomic swaps cannot realize trustless exchanges in which one party pays for a fixed chance of receiving a larger asset or reward, as in lotteries, randomized allocation mechanisms, and probabilistic cross-chain trades. We introduce probabilistic swaps, a new cryptographic primitive that extends atomic swaps to the probabilistic setting. In a probabilistic swap, one party's transfer is executed with a fixed, publicly specified probability embedded in the protocol and cannot be biased by either party. This yields a trustless mechanism for randomized exchange with verifiable odds and no trusted intermediary. Our construction combines adaptor signatures with oblivious pseudorandom functions (OPRFs) to realize the desired probabilistic outcome while ensuring that neither party can predict or bias it in advance. Along the way, we introduce a new mechanism for the atomic exchange of OPRF evaluations for payments, which may be of independent interest. A key feature of our approach is that it preserves the minimal on-chain footprint of modern atomic-swap protocols. The protocol relies only on standard Bitcoin scripts, such as digital signatures and timelocks, and is deployable on any blockchain that already supports atomic swaps. Consequently, probabilistic swaps are indistinguishable from ordinary on-chain transactions, which helps preserve privacy and fungibility. We provide formal security foundations and demonstrate practicality through a probabilistic swap between the Bitcoin and Litecoin testnets, as well as in the Lightning Network.

Dwork and Naor (FOCS 2000) showed a generic transformation to construct a ZAP (a two-round public-coin witness-indistinguishable proof) from any non-interactive zero-knowledge (NIZK) proof with statistical soundness in the common random string model. In recent years, a number of works have shown how to construct NIZK arguments in the common random string model from a broad range of assumptions including decisional Diffie-Hellman (DDH), learning with errors (LWE), or combinations of multiple assumptions. While a number of previous works have developed specialized tools to build ZAPs using these same assumptions (through a non-trivial adaptation of the underlying NIZK), a natural question is whether we can generically obtain a ZAP from these NIZK arguments à la Dwork-Naor. In this work, we introduce the notion of a sometimes-constricting generator and show how to use it to generically upgrade any computational (resp., statistical) NIZK argument in the common random string model into a computational (resp., statistical) ZAP argument. We then show how to build sometimes-constricting generators from either the DDH assumption (over pairing-free groups) or the LWE assumption. Our transformation immediately allows us to recover constructions of ZAPs from assumptions like DDH or LWE, as well as enables new constructions from different combinations of cryptographic assumptions with properties that were not previously attainable. More broadly, our compiler provides a general mechanism to convert any future NIZK construction in the common random string model into a ZAP.

Pairing-based cryptography relies heavily on the efficiency of bilinear pairings, the computation of which is dominated by the final exponentiation step. This paper describes an efficient cubing operation in the cyclotomic subgroup of $\mathbb{F}_{q^6}$ for $q\equiv1\mod{6}$. As an application, we use existing results for computing Frobenius maps to optimize the cost of the optimal Ate pairing final exponentiation over the SG54 curve. Furthermore, we introduce a novel decomposition for the hard part of the final exponentiation for this curve. Additionally, we apply established methods for cyclotomic cubing to accelerate the final exponentiation for the BLS15 and BLS27 curves. Compared to previous works, our approach achieves efficiency gains of $24\%$ for SG54 and $22\%$ for the BLS15 and BLS27 curves.

We present a machine-checked security proof for the NTOR key exchange protocol, which is used to establish connections in the Tor onion routing system. It was previously studied by Goldberg et al. (DCC 2013), but within a slightly non-standard model that did not explicitly capture forward secrecy. Our proof is fully formalized in EasyCrypt, adding to the still small set of cryptographic protocols verified in the computational model. A key contribution is a systematic treatment of halting reductions involving failure events expressed as global properties of the execution. In the course of this work, we also contributed improvements to the EasyCrypt framework itself. We prove NTOR secure in a new model of unilaterally authenticated key exchange that captures forward secrecy, and is intentionally close to established bilaterally AKE models (such as eCK). By examining more carefully how identities and public keys are used in key exchange proto- cols, we obtain simpler formal arguments and introduce several variants of our UAKE security model, connected by general reductions that, in the case of NTOR, are also realized in EasyCrypt. This allows us to carry out the main proof in a simpler setting and then derive the desired security guarantee for NTOR via these reductions.

In 1997, Lo proved that if one of the parties is malicious, it is not possible to achieve unconditional security in quantum bit-commitment (Phy. Rev. Lett, 1997) and hence in two-party quantum computation (Phy. Rev. A, 1997). However, restricting the computational power of the adversary, via assumptions like the existence of one-wayness, it has been shown that secure quantum bit-commitment is indeed possible by Dumais et al. (EUROCRYPT 2000). In their paper, they showed that with the assumption of a one-way permutation that is secure against any polynomial-time quantum adversary, one can achieve a secure quantum bit-commitment scheme. Although security is guaranteed, complete fairness remains an issue in quantum two-party computation for the real-world framework. In this paper, we show for the first time that there are some functions for which secure two-party quantum computation with complete fairness is achievable. This seems in sharp contrast with the impossibility result of Ben-Or et al. (FOCS, 2006). In Ben-Or et al.'s work, they have considered a malicious quantum adversary with unconditional computational power and used a broadcast channel. We have used the hybrid model idea of Gordon et al. (STOC 2008) using a non-simultaneous channel and the idea of composition of multiparty computations by Ran Canetti (Journal of Cryptology, 2000), to achieve complete fairness in the quantum domain, under the assumption of computationally bounded adversary. The functions we study are of two types (similar to Gordon et al.): one is any function without an embedded XOR, and the other is a particular function containing an embedded XOR. At first, we design secure two-party computation protocols in a hybrid model, using a trusted third party. Then we prove how these protocols achieve complete fairness in the hybrid model. Finally, we construct a secure two-party communication protocol and show how we can use this to remove the trusted third party of the hybrid model, and achieve both security and complete fairness in the real-world model.

We introduce new techniques for verifiable reporting of abusive messages in private messaging platforms. Our techniques are compatible with both metadata-hiding messaging systems, where the platform does not know who speaks to whom, and with third-party moderation, where the platform is not involved in the process of verifying or judging reported content. While prior work in this space considers the question of how a moderator would verify reports, prior works do not address the question of how a moderator and platform would collaborate to enforce moderation decisions. In a setting where the platform does not wish to be involved in or responsible for enforcing moderation decisions, or in federated settings where it is not clear who would be responsible for enforcement, this presents an additional challenge. Our work solves this problem with a lightweight credentialing and revocation mechanism that does not involve the platform in moderation enforcement at all. In order to support this added functionality, we build on Asymmetric Message Franking (Crypto '19) and improve performance over the original scheme, reducing moderator computation and communication costs to verify reports by $6\times$ and $7\times$, respectively.

Succinct non-interactive arguments (SNARGs) for NP allow an efficient prover to convince a verifier that an NP statement is true with a proof that is much shorter than the original NP witness. Gentry and Wichs (STOC ’11) showed that adaptive soundness of such SNARGs cannot be proven via a black-box reduction from any falsifiable assumption. However, recent works by Waters, Wu and Zhandry (STOC ’24, CRYPTO ’24, CRYPTO ’25) circumvent this negative result by relying on subexponential hardness assumptions and having a long common reference string (CRS) that is longer than the statement size. In this work, we study unique SNARGs where each statement has at most one accepting proof. The above constructions of adaptively sound SNARGs are not unique and crucially rely on the existence of multiple valid proofs in their security analysis. We explore to what extent this is inherent as follows: - On the negative side, we give a strengthened Gentry-Wichs style black-box separation for the case of perfectly complete and unique SNARGs for NP with adaptive security. Our black-box separation extends even to reductions that rely on subexponentially hard falsifiable assumptions and to SNARGs that have an arbitrarily long CRS. - On the positive side, we construct perfectly unique and adaptively secure SNARGs for NP with a long CRS based on subexponentially hard one-way functions and indistinguishability obfuscation. We do so by relaxing perfect completeness and allowing for a negligible completeness error. This is the first unique SNARG with a proof of adaptive security from falsifiable assumptions, even restricted to P

Pseudorandom Generators (PRGs) based on Threshold-XOR predicates with large locality and high stretches have recently gained traction, since they lend themselves as shallow weak Pseudorandom Functions (PRFs) to fast multiparty computation protocols. In this work, we present novel fast attacks on such PRGs that achieve substantial advantages. Concretely, we break the security levels of most parameters collected by Boura, Couteau, Perrin and Rotella (ToSC'25), as well as those proposed by Fu, Li, Lyu and Liu (EC'26). On the asymptotic side, we prove that our attacks achieve an advantage of $n^{-n/a}$ where $n$ denotes the seed length and $a$ the locality of threshold predicates. As a consequence, when $a \in \Theta(n)$, we get poly-time attacks with noticeable advantage. These results close current gaps on the theoretical study of THR-XOR based Goldreich PRGs. Additionally, we demonstrate how the attack advantage can be amplified for PRGs with large output lengths (which are common in the context of weak PRFs). Finally, we discuss alternative predicates for Goldreich PRGs that resist all currently known attacks.

Fair exchange protocols on blockchain enable atomic exchange of digital goods and cryptocurrency between untrusted parties. Two prominent protocols, Zero-Knowledge Contingent Payment (ZKCP) and FairSwap, guarantee fairness: either both parties receive the expected items (digital goods and cryptocurrency) or neither does. However, both protocols lack accountability: when an exchange terminates abnormally, the protocol cannot identify which party caused the failure. This lack of accountability undermines the applicability of fair exchange protocols in decentralized settings. To fill this gap, we identify the common accountability issue in both protocols and revise them by adding signature exchange and chaining. We formally define the revised protocols in the universal composability framework and provide a proof sketch, and measure the computational overhead of the revised protocols in our implementation and experiment.

Analyzing time-series databases in a privacy-preserving manner has gained significant attention, especially when the data contains sensitive personal information such as medical records or spatio-temporal data such as trajectories. Motivated by scenarios where a user must show whether an anomaly (or similarity) is detected in a time series containing sensitive data, we propose a toolkit for proving these properties on (committed) private time series. We leverage Matrix Profile (MP), a state-of-the-art data-mining structure, to detect subsequence anomalies and similarities in time series, in contrast to many works that only detect anomalies and similarities on complete time series. As recent findings have shown, the aggregated data used by MP (such as subsequence distances or MP values) leak critical information about the time series. It is therefore crucial to consider a strong adversary model where all information other than the presence or absence of anomalies/similarities remains protected. To guarantee this, we propose a combination of commitment and zero-knowledge proof systems that ensure both the validity of the proven result and the (unconditional) protection of the time series. The proposed schemes maintain reasonable execution times, even for large real-time time series.

Public-key pseudorandom correlation functions (PK-PCF) are an exciting recent primitive introduced to enable "non-interactive key exchange for secure computation". Despite significant advances in the group-based setting, success in the post-quantum regime has been much more limited. To the best of our knowledge, there does not exist even a single efficient candidate post-quantum PK-PCF for the standard string oblivious transfer (OT) correlation. In this work, we address this gap by constructing the first efficient lattice-based public-key PCF for the string OT correlation. Our PK-PCF generates a few hundred OTs per second, and requires a large but manageable public key size (a few hundred megabytes). In contrast, the only previous lattice-based non-public-key PCF, proposed in the very recent work of Hasler, Reisert and Küsters (Asiacrypt 2025), can generate up to 9 OT/s and has key sizes of several gigabytes. At the heart of our result lie several technical contributions that might be of independent interest. In particular, we introduce the first efficient lattice-based constrained pseudorandom functions for low-degree polynomials, from a new but natural "secret-power" variant of ring learning with errors. Our assumption is non-interactive and falsifiable, and we carefully analyze it for attacks. Additionally, we introduce a new packing mechanism compatible with local rounding of noisy shares from a "truncated" variant of our previous assumption, which allows further efficiency. We remark that in the pre-quantum regime, the state of art for PK-PCF only two years ago was 1 OT/s, while they now clock at ~30k OT/s. We are optimistic that our construction will follow a similar trajectory.

Credit scoring plays a critical role in the financial industry, allowing institutions to evaluate the creditworthiness of potential borrowers. Typically, a model is estimated from repositories of attributes of past borrowers linked to their loan and payments performance. The model is then used to compute an applicant's score. The training and customer data are subject to regulations that require privacy of financial records. This creates a tension between the full utilization of available data and the prevention of leakage. Recently, the tension has intensified from, on one hand, improvement in AI methods to utilize data from nontraditional sources to develop prediction models and, on the other hand, increased concern over the vulnerability of encrypted data to penetration from quantum computers. We present a credit score workflow that addresses both issues by using AI methods to estimate a credit score model in a collaborative setting, combined with post-quantum cryptographic methods to protect data. We develop a ``toy'' workflow which can form a base for more complex ``real world'' implementations. We provide links to a code-base.

This paper provides a performance comparison of five MILP solvers applied to related-key differential cryptanalysis of ITUbee [10]. We evaluate three open-source solvers (GLPK, HiGHS, SCIP) and two commercial solvers (Gurobi, CPLEX) using MILP models for 8, 10, and 12-round attacks. As rounds increase, the number of equations and con- straints grows exponentially. Experiments used an 11th Gen Intel Core i7-1165G7 processor with 32 GB of RAM. Commercial solvers (Gurobi and CPLEX) perform better than open-source options, achieving up to 94× speedup compared to GLPK for the 12-round model. This work provides guidance for choosing a solver for MILP-based cryptanalysis.

Proof of Assets (PoA) protocols enable custodians to prove ownership of digital assets without revealing their account addresses or corresponding balances. While existing PoA protocols focused on either private or public balances, hybrid-state blockchains such as the Aztec Network involve both. In these systems, private balances are managed by encrypted notes that work similarly to the UTXO model, with only commitments stored on-chain. We present a PoA protocol that supports hybrid balances by combining public-state membership proofs with proofs of ownership over private notes. Since a custodian may control multiple accounts and numerous notes, we employ hierarchical proof-carrying data via recursive zk-SNARK, enabling scalable proving and efficient batch verification. We implement our system using the Noir DSL with the UltraHonk proving backend, and evaluate the performance.

An adaptor signature scheme can be seen as committing to a signature using an NP statement, in such a way that (1) the commitment, called a presignature, is verifiable, (2) the corresponding witness enables opening the commitment (adapting the presignature), and (3) seeing a valid commitment-opening (presignature-signature) pair leaks the witness. In the blockchain space, where signed transactions must be broadcast to the public to take effect, this last property allows "forcing" a party to leak a witness for possibly multiple presignatures issued for the same NP statement. This then gives rise to many applications such as atomic swaps or payment channels. Importantly, in prevailing adaptor signature schemes, presignatures are already technically signatures, in that they are non-interactive zero-knowledge proofs of knowledge of the signing key. This has a number of consequences, most important being that the presignature constitutes evidence of intent to participate in a protocol based on adaptor signatures. Perhaps surprisingly, however, for many practical applications, this strong "binding" of presignatures turns out to be non-essential. In this work, we revisit the definitions of adaptor signature schemes, demonstrating that prevailing security requirements are often too strict. To this end, we formally define fair signature exchange (FSE) and abandon the assumption implicit in prior work that adaptor-based FSE must be "symmetric" with both parties using the same adaptor signature scheme. The resulting relaxation of security requirements leads us to the notion of presignature deniability, an extension to adaptor signature schemes that we define formally and construct from various assumptions.

Anonymity guarantees of privacy-oriented cryptocurrencies are garnering negative attention from lawmakers who view them as antinomic to accountability. Having recognized their potential for innovation, however, regulators may not want to outright ban privacy coins but instead seek a middle ground where financial oversight is effective, and still some privacy is maintained. Mature designs, such as Zcash, Monero, or Firo, are expected to facilitate this through so-called viewing keys that can be disclosed to third parties for the purpose of supervision. This paper studies which privacy guarantees continue to hold once they have been. In doing so, it fills the gap in provable anonymity guarantees for Zcash and Firo under the compromise of the incoming viewing key, while, at the same time, exposing problems with Monero. Finally, the paper shows that malicious parties may happily surrender all their viewing keys in each of Zcash, Monero, and Firo and yet still find very efficient ways of evading financial monitoring.

The rapid adoption of blockchain-based financial systems has been accompanied by a surge in illicit activities, including money laundering, ransomware payments, phishing scams, and terrorist financing, necessitating robust anomalous transaction detection mechanisms. Detecting anomalies in cryptocurrency transactions is critical, as undetected illicit activity can result in significant economic losses and undermine trust in digital financial systems. This systematic review examines the state-of-the-art in cryptocurrency anomaly detection, with particular focus on methodological developments between 2008 and December 2025. A PRISMA-guided systematic literature search was conducted across IEEE Xplore, Scopus, Web of Science, ACM Digital Library, Google Scholar, and SpringerLink. From an initial set of 450 records, 32 empirical studies were selected after rigorous screening and eligibility assessment and included in the qualitative synthesis. Unlike prior surveys, this review provides a focused synthesis of empirical cryptocurrency transaction studies, a taxonomy of anomaly types, and a critical assessment of dataset bias and evaluation practices. The literature reveals a clear methodological shift from traditional feature-engineered machine learning approaches (e.g., Random Forest, XGBoost, and Support Vector Machines) toward graph-based deep learning architectures. Graph Neural Networks (GNNs), particularly Graph Convolutional Networks (GCNs) and Graph Attention Networks (GATs), demonstrate competitive performance by capturing relational dependencies among blockchain addresses, while temporal graph models and hybrid GNN–transformer architectures enhance the detection of evolving, multi-hop laundering schemes. Unsupervised and semi-supervised approaches address the challenge of limited labeled data but introduce trade-offs in interpretability. Emerging research directions include privacy-preserving federated learning and cross-chain detection frameworks. Despite some studies reporting accuracies exceeding 90%, the field faces several limitations, including dataset bias, lack of standardized multi-chain benchmarks, inconsistency in evaluation metrics, limited adversarial robustness testing, scalability constraints, and insufficient explainability for regulatory compliance. This review aims to provide researchers and practitioners with a structured synthesis of current methodologies, a comprehensive taxonomy of anomalies, and a detailed roadmap for transitioning from experimental validation to real-world, scalable deployment.

Anonymous-credential (AC) schemes equip users with credentials on attested attributes such that users can later prove possession of a credential certifying (a subset of) those attributes without revealing anything else. In standard AC schemes, such proofs reveal the issuer of the credential, which may be more information than intended or necessary. Lately, there has been significant interest in designing stronger issuer-hiding anonymous-credential schemes that only reveal that the user has a credential from an issuer in a certain policy set. Katz and Sefranek recently showed how to add issuer hiding to BBS-based anonymous credentials. However, their scheme requires per-verifier policy keys with corresponding secret keys needed for verification; this means proofs are no longer publicly verifiable, and may pose a barrier to practical deployment. As another drawback, security of their scheme relies on the generic group model (GGM). In this work, we propose a template for constructing issuer-hiding, BBS-based anonymous credentials that does not require policy keys and whose security can be reduced to security of the BBS signature scheme (in particular, without relying on the GGM). At the core of our template is a technique to randomize BBS public keys and adapt signatures accordingly, which we show also has applications to tight multi-user security of BBS signatures. We design, implement, optimize, and experimentally compare various instantiations of our template that offer tradeoffs in proving time, verification time, and proof size. All instantiations offer good performance for policy sets of up to 64 issuers.

Trustworthy federated learning requires both update privacy and aggregate integrity. While secure aggregation protects the confidentiality of client updates, it does not prevent a malicious server from tampering with the final aggregate. Existing verifiable schemes typically address this limitation by introducing separate integrity-verification layers, such as zero-knowledge proofs, homomorphic hashes, and commitmentbased mechanisms. However, these approaches either require clients to remain online after uploading their updates for additional verification or recovery procedures, or incur substantial computation overhead that scales linearly with the model dimension. To address these limitations, we propose SealAgg, a one-shot verifiable secure aggregation framework that simultaneously guarantees update confidentiality and aggregate integrity against a malicious server. SealAgg allows clients to disconnect immediately after uploading their updates and introduces an aggregatenative auditing mechanism that enables lightweight integrity verification without a separate costly verification pipeline. Specifically, each client embeds dual hidden finite-field linear projections and a context-binding heartbeat value into its update before encryption, so that the audit material is co-aggregated with the gradients along the same path. Moreover, we design an asymmetric three-server architecture that confines integrity validation entirely to the server side, thereby fully supporting one-shot client participation. We provide formal analyses of the correctness and security of SealAgg. Extensive experiments show that SealAgg achieves practical end-to-end efficiency, incurs only a small auditing overhead relative to the total cost, and outperforms state-of-the-art schemes.

We address the question of realizing privacy preserving analysis of user data. The abstract scenario considered is that an analyst aims to evaluate a function $f$ on some user data $X$. To achieve comprehensive privacy, it is necessary to protect the input $X$ directly. However, it is known that $f(X)$ may leak too much information about $X$ as well. A common approach to mitigate such risks is to make the computation differentially private. In practice, this is often accomplished by replacing $f$ by a noisy variant $f^*$. We investigate the use of multi-input functional encryption (MIFE) for achieving input and output privacy in one cryptographic mechanism. In an MIFE scheme, a setup authority can generate restricted decryption keys which enable to learn specific functions of encrypted messages, without revealing any additional information. To achieve differential privacy in this process, we introduce as a new cryptographic primitive: noisy multi-input functional encryption (NMIFE). It extends the concept of MIFE such that the decryption key may also encode a noisy function where the noise value is secret. While the change from MIFE to NMIFE is rather straightforward, the challenge is to come up with precise and workable definitions of correctness and security that we propose and explain in this work. Here, the security definition is tailored to the use case of differential privacy. As it is a special case of the established notion of full-hiding security, we present a generic transformation that enables turning any full-hiding MIFE scheme into a secure NMIFE scheme that has practically the same performance as the initial MIFE scheme. Moreover, we make use of the fact that the proposed security definition is less restrictive and present a new concrete NMIFE scheme for evaluating the inner product. It is dubbed DiffPIPE (short for DIFFerentially Private Inner Product Evaluation). DiffPIPE is not the result from the transformation and outperforms all from existing full-hiding MIFE schemes constructed NMIFE schemes. In experiments, we demonstrate its applicability for realizing privacy preserving counting queries on data sets.

As digital identity systems gain traction around the world, many see privacy-enhancing technologies (PETs) as the key to ensuring safe deployment. We critically examine whether this is the case using the European Digital Identity Framework (EUDIF) as an example. We leverage techniques from cryptographic modeling to formally capture the necessary leakage of the functionality of the EUDIF and its proposed applications. Then, we develop a harm analysis methodology that illustrates, using harm trees, how this leakage — and other constraints stemming from design decisions or the context of deployment — lead to harms. Moreover, our harm modeling enables us to distinguish between which pathways to harm are inherent to the core functionality, and which pathways can be prevented with PETs. Our analysis shows that, while PETs can reduce information flows, they fall short in mitigating the harms that deploying digital identity can bring to individuals and society.

Post-quantum migration in Transport Layer Security (TLS) requires evidence-aware measurements that distinguish session negotiation, endpoint capability, certificate-chain evidence, and the provenance of missing observations. This distinction is essential under TLS 1.3 encryption, resumption, mutual TLS, trace truncation, fragmentation, coalescing, active certificate retrieval, and temporal drift. We present a multi-surface framework for post-quantum TLS observability. The framework separates passive session evidence, active probing, certificate-chain evidence, and registry knowledge, and maps them onto measurement planes for session behavior, key establishment, endpoint capability, authentication, lifecycle, observability, and policy. We instantiate it as a reproducible artifact with schema-enforced observations and results, versioned registries, auditable inference rules, stress contracts, and baseline adapters. We evaluate the framework on 29 controlled scenarios spanning TLS 1.2 and TLS 1.3, classical and hybrid key establishment, mutual TLS, resumption, HelloRetryRequest, truncation, fragmentation and coalescing, temporal drift, IPv6, and chain-depth variation. Passive evidence closes session-level planes, active probing establishes capability lower bounds, and multi-surface evidence closes the full measurement object while preserving uncertainty and contradiction when required. Against an inherited TLS quantum-vulnerability analyzer, the baseline detects 2 of 29 runs and 0 of 23 TLS 1.3 runs. In a stratified public campaign over 1000 targets and 2000 fresh probes, the framework completes 1971 handshakes, collects 1368 chain artifacts, confirms hybrid capability for 310 targets, and identifies 310 cases where endpoint capability exceeds what any single classical session view reveals. These results support post-quantum TLS readiness assessment as a structured observability problem based on explicit evidence surfaces, per-plane closure, active corroboration, source linkage, and first-class treatment of unknown, na, ambiguity, and contradiction.

In secret-key private information retrieval (SK-PIR), the client in an offline phase processes the database using a short secret key. In the online phase the client could then use the secret key to make queries to the server, without revealing the entries accessed, and using only sublinear communication $o(N)$ in the database size $N$. While (non-SK) PIR requires public-key cryptography, recent work provides evidence that SK-PIR may not. In particular, Chen, Ishai, Mour, and Rosen (STOC 26) construct SK-PIR with communication $N^{\varepsilon}$, for any $\varepsilon$, from high-noise LPN, which is not known to imply public-key cryptography. We construct SK-PIR with online communication $\tilde{O}(\sqrt{N)}$, under the minimal assumption of one-way functions. More generally we can achieve client-to-server communication $\tilde{O}(N_c)$ and server-to-client communication $\tilde{O}(N_s)$ as long as $N_c \cdot N_s \geq N$. Our construction is simple and is based on garbled circuits with an uncorrelated input encoding property, which is satisfied by schemes from the literature.

Hash-based SNARKs are arguably the most prominent and widely deployed class of transparent SNARKs, owing to desirable properties such as plausible post-quantum security and the avoidance of public-key cryptography. The key ingredients in the construction of hash-based SNARKs are an error-correcting code and an Interactive Oracle Proof of Proximity (IOPP) for that code. A particularly desirable property for hash-based SNARKs is field-agnosticism, i.e., the ability to natively prove statements over arbitrary fields (of sufficient size). We advance the study of field-agnostic hash-based SNARKs as follows: $\bullet{}$ We introduce a new family of linear-time encodable field-agnostic error-correcting codes called Encode-Repeat-Accumulate (ERA) codes. These codes achieve a strong trade-off between encoding time and relative distance, the two properties that largely determine the commitment time and proof size of the resulting hash-based SNARK. We also show that ERA codes are efficiently codeswitchable (Ron-Zewi and Rothblum [JACM 2024]), i.e., we can efficiently reduce the task of checking the proximity of a word to an ERA code to checking the proximity of a related word to an arbitrary code. $\bullet{}$ We present an IOPP for (interleaved) ERA codes that leverages their fast encoding time, strong distance guarantees, and efficient codeswitchability to achieve concretely small query complexity (and hence small proof size in the resulting hash-based SNARK) while maintaining good prover efficiency.

The Recording Standard Oracle with Errors (RstOE) technique is a quantum-security proof technique that provides a structured framework for analyzing adversarial capabilities in quantum settings. For example, it can be applied to prove the quantum security of compressing pseudorandom functions. However, against adaptive quantum chosen-plaintext adversaries, traditional RstOE-based proofs may suffer from the ''trivialization of norm'' problem. In the RstOE analyses considered in this paper, this issue can be traced to three recurring causes: delayed evaluation of bad events, the presence of unrecorded external variables, and unconstrained independence among intermediate variables. To address this obstacle, we propose two refinements of the RstOE methodology, namely Pure-Database Substitution and Early-Defense. Pure-Database Substitution algebraically eliminates unrecorded external variables and reformulates collision constraints in terms of internal database records. Building on this substitution, Early-Defense moves the collision check to the point at which a new internal variable is sampled. Because the bad event then depends on this freshly generated quantum randomness, only a negligible fraction of the $2^n$ superposition branches satisfy the collision constraint. This reduces the amplitude of transitions into the bad subspace and avoids the $O(1)$ norm collapse. We demonstrate the method on TNT as a case study and outline extensions to EDMQ, EDMDQ, LRWQ, and QPMAC.

Broadcast encryption (BE) allows a sender to succinctly encrypt a message to any dynamically chosen subset of recipients. The gold-standard for BE is optimal succinctness (parameters independent of the number of users) and adaptive security, and attaining both from falsifiable post-quantum assumptions has been a central open problem. Recently, Goyal and Yadugiri (GY) gave the first adaptively-secure and optimally-succinct slotted distributed BE under a falsifiable lattice assumption, but their techniques inherently require an a-priori bound on the number of users and a slotted user structure. Two highly-sought-after generalizations thus remained open: flexible BE (FBE), where users asynchronously sample and register their own keys; and identity-based BE (IBBE), where a trusted authority issues keys for identities drawn from a super-polynomially large space. In this work, we present the first adaptively-secure FBE and IBBE schemes with all parameter sizes independent of the number of users, both under the same falsifiable lattice assumption (decomposed LWE) and in the same model (Random Oracle Model) as the prior state-of-the-art for slotted distributed BE. Our FBE additionally enjoys a transparent setup, in line with the trustless ethos motivating distributed and flexible BE. At the technical heart of our results, we extend the equivocal encryption framework of GY to capture unbounded and dynamic broadcast systems, and introduce Equivocal Matrix Commitments---a strengthening of matrix commitments that supports adaptive equivocation of the committed matrix. We expect this new abstraction to find broader applications in designing adaptively-secure trustless lattice-based encryption.

We give the first rigorous $O(1)/|F|$ FRI commit-phase soundness bound for plain Reed–Solomon above the Johnson radius — the central open question in the proximity-gap line, made urgent by the late-2025 disproof of the up-to-capacity conjecture (Crites–Stewart; BCHKS; Diamond–Gruen). The bound is proved via a structural mechanism new to the proximity-gap literature: the action–orbit symmetry on the cyclic FRI evaluation domain (five-line proof, no correlated agreement, no character sums, no list-decoding). The construction is unconditional for sparse adversary inputs; for general inputs it reduces to a single sparse-worst-case dominance conjecture (Q2), consistent with every adversarial construction in the proximity-gap literature, including Arnon–Boneh–Fenzi (ABF) Lemma 6.13, Crites–Stewart, and BCHKS. Deployment consequence. Plugged into the ABF §6.3 deployment instance at 128-bit security, the bound halves the rigorous STARK proof size on plain Reed–Solomon: 79.8 KiB against ABF's smallest deployable candidates — 161.4 KiB on interleaved RS ($2.0\times$ larger) and 281.2 KiB on folded RS ($3.5\times$ larger), both requiring strictly stronger code-class assumptions. Production STARK L2s (Starknet's Cairo pipeline, Plonky3-based rollups, the next generation of zkVMs) ship plain RS today without a rigorous above-Johnson bound for it; our work is the first deployment-scale rigorous construction on plain RS at 128-bit security — no protocol modification, no new hardness assumption, no change of code family. Mathematical depth. A separate universal extension to the $(3k/2, 2k)$ family of arising pencils reduces to a single named open problem in number theory (Q1): the non-vanishing of an explicit norm $\mathrm{Norm}_{K_d/\mathbb{Q}}(F_d(\alpha)) \neq 0$ on a class-field extension of $\mathbb{Q}[\sqrt{-D}]$, $D = 83{,}860{,}066{,}393{,}667$, with Hilbert class field of degree $\sim 3.4 \times 10^6$. The problem is settled rigorously over $\mathbb{Q}$ at $d \in \{4, 8\}$ (exact rational norm at $d=4$; multi-threaded msolve at $d=8$) and connects our work to classical questions in cyclotomic number theory and Hecke L-value non-vanishing.

Permissionless Proof-of-Stake (PoS) economic security is predicated on the high cost of violating consensus safety or liveness. We show that liquid staking introduces additional risks that are not captured by standard PoS economic security arguments. Through an empirical study of Ethereum data, we find that the operational performance of liquid staking pools is positively associated with subsequent normalized liquid staking token (LST) returns. Motivated by this, we present a cross-layer attack: a low-stake adversary can manipulate the consensus protocol to degrade a target pool's performance and take application-layer positions that profit if the market reprices the corresponding LST in-line with the historically observed association. To make the consensus layer manipulation concrete, we develop a deep reinforcement learning (DRL) framework to automatically discover attack strategies. Our evaluation shows that the learned strategies can recover near-optimal theoretical attacks and uncover new manipulation behaviors that significantly degrade target pool performance. We further characterize feasible application-layer monetization channels and analyze leveraged shorting in detail using Monte Carlo simulations, showing that such attacks can be profitable with over one-half probability for LSTs of major staking pools. Our findings reveal a previously overlooked attack surface in PoS systems with liquid staking and expose a gap between consensus and economic security.

We propose a plausibly post-quantum additively homomorphic PKE scheme, SoliloQuat, based on the short generator principal ideal problem (SG-PIP) in orders of quaternion algebras. SoliloQuat is inspired by Soliloquy, a KEM that was both introduced and broken by Campbell-Groves-Shepherd in 2014. However, it is not known if their attack can be generalised to the non-commutative setting, despite having received cryptanalytic attention due to a reduction from the rank 2 module-LIP instances underlying HAWK to nrd-PIP (Eurocrypt `25). Demonstrating the correctness of our scheme requires novel results on the eigenvalues of the left regular representation of quaternions, which may be of independent interest. We prove IND-CPA security of our scheme, assuming the hardness both of SG-PIP in orders of quaternion algebras, and some less-exotic lattice-based assumptions.

We prove the first unconditional soundness theorem above the Johnson bound for FRI, STIR, and WHIR — the proximity-testing protocols underlying every deployed STARK, zkVM, and FRI-based system on Ethereum's roadmap. For $\mathrm{RS}[F, L, k]$ with $k = 2^m$ and $L$ admitting a fixed-point-free involution (standard for deployed FRI, in either characteristic), for every $\delta \in (\delta_J,\, 1-\rho)$: $$\varepsilon_{\mathrm{FRI}} \;\leq\; \frac{nR}{|F|} \;+\; \left(1 - \frac{\delta}{2}\right)^{\!q}.$$ Three results. (A) The bound above, via threshold halving from Rothblum–Vadhan–Wigderson (STOC 2013); the protocol, prover messages, and verifier checks are unchanged — only the query parameter is recalibrated. The argument enters the unique-decoding regime after one round, where BCIKS locks the distance, making it immune to any open-zone counterexample. (B) The ${\sim}2{\times}$ query overhead is optimal within the correlated-agreement (CA) framework: $\varepsilon_{\mathrm{ca}}(C, \delta, \delta) = \binom{n}{w}/|F|$, tight for large fields, exponential in the code length, and vacuous at FRI scale. (C) First $p$-dependent list-size bounds: $\mathbb{E}[M] = \binom{n}{w}/p^c$ at all codimension excesses $c \geq 1$; a sub-Poisson Bernstein tail at $c = 2$; and a phase-diagram conjecture at $c \geq 3$ (the deployment regime) predicting a linear $M_{\mathrm{true}} \leq \lfloor (2D-1)/c \rfloor$. Impact for Ethereum. Every deployed and proposed FRI-based system — SP1, RISC Zero, Plonky3, the ${\sim}30$ zkVMs on EthProofs, Stwo (Mersenne31 / circle FRI), the planned post-quantum signature aggregation layer — now has a positive proven soundness floor in the open zone above Johnson, replacing a conjecture whose up-to-capacity form was disproved in late 2025 by Crites–Stewart and independently by Kambiré. The cost is a factor ${\sim}2$ in queries; the bound holds in characteristic 2 via additive folding, on the unit circle via the Stwo coupling, and compiles to non-interactive knowledge soundness via Fiat–Shamir and DEEP. The half-threshold CA bound is formally verified in Lean 4 with Mathlib.

Verifiable Computation on Encrypted Data (VCoED) addresses the computational integrity gap in Fully Homomorphic Encryption (FHE). While recent protocols have made significant strides in making VCoED feasible, server-side proof generation remains computationally intensive, often requiring hours for a modest $2^{20}$-gate payload circuit (e.g., 2.27 hours for Phalanx, 9.26 hours for Blind Fractal). Moreover, most existing schemes lack support for payload circuits that are homomorphically executed with SIMD operations. In this work, we present Lasagne, a new efficient VCoED scheme for BGV/BFV-type FHE schemes. Lasagne offers the following: 1. It supports multiplicative layered payload circuits and allows them to be homomorphically evaluated under SIMD message encoding, which aligns with the requirements of practical FHE deployment. 2. It achieves efficient prover time while maintaining acceptable communication/verification overhead, and supports flexible parameters choosing to trade off prover time and communication overhead. For a 16-layer, $2^{20}$-gate payload circuit, Lasagne generates a 30 MB proof in just 6–12 minutes(single core), achieving an $11\times$–$23\times$ speedup over Phalanx (2.27 hours, 61.4 MB). When the payload natively supports SIMD execution ($2^4$ slots), the proving time further reduces to 4–5 minutes (a $27\times$–$34\times$ speedup). We instantiate Lasagne for a face recognition application built on FHE. Empirical results confirm the validity of our time estimates and the practical viability of the scheme.

We introduce MERIDIAN, a 128-bit block cipher designed for resource-constrained environments as a lightweight alternative to AES-128. MERIDIAN retains the AES-128 interface, including a 128-bit block, 128-bit key, and 4×4 byte state, while reusing the standard AES S-box. This enables compatibility with existing AES-128 modes such as ECB, CBC, CFB, OFB, CTR, XTS, CMAC, CCM, and GCM, and allows implementations to reuse established S-box ROMs and GF(28) inverse circuits. The cipher is based on three round operations: Directional Substitution (DS), Meridian Diffusion (MD), and Admittance Mixing (AM), followed by a round constant. Its state is represented over the discrete torus Z4 × Z4. The MD layer combines two orthogonal byte permutations, meridian and parallel, with column mixing to obtain full byte diffusion within three rounds without requiring MDS multiplication. MERIDIAN uses twelve rounds and avoids an expanded key schedule. We present MILP-verified differential and linear bounds, including exact active-S-box counts up to eleven rounds and a sub-additive bound for twelve rounds. We also provide AES-aligned cryptanalysis covering differential, linear, integral, biclique, slide, related-key, invariant-subspace, fault, meet-in-the-middle, and algebraic attacks. A reproducible fifteen-experiment benchmark suite compares MERIDIAN directly with AES-128, including key agility, cold-start latency, energy, masking cost, memory, throughput, and hardware complexity. Empirical results show that MERIDIAN reaches strict avalanche behavior in three rounds, matches AES-128 in entropy and NIST SP 800-22 fitness, reduces unrolled gate count, lowers RAM usage, and improves constrained-device efficiency. MERIDIAN is proposed as a research prototype for further public cryptanalysis.

Nearly all succinct proof systems express computations as algebraic constraints over a finite field. Operations not native to this field, such as bitwise manipulation, modular arithmetic, and lattice-ring operations, require an arithmetization step that can inflate the witness size by one or more orders of magnitude. We introduce Universal Constraint Systems (UCS) and Zinc$+$. The first is a relation that can express the above constraints with minimal overhead. The second is a framework for building SNARKs for UCS. Concretely, UCS consists of algebraic constraints and ideal membership predicates over multiple polynomial rings simultaneously, such as $\mathbb{F}_q[X], \mathbb{Q}[X], \mathbb{Z}[X]$, etc. Zinc$+$ SNARKs are built from 1) a PIOP for UCS, and 2) a hash-based IOPP for multilinear polynomials over $R=\mathbb{Q}[X]$ or $R=\mathbb{F}_q[X]$. For 1), we provide a general compiler that takes standard finite-field PIOPs and turns them into a PIOP for UCS. The IOPP in 2) depends on $R$: for $R=\mathbb{F}_q[X]$, we construct it via a black-box lift of any existing IOPP for $\mathbb{F}_q$, and for $R=\mathbb{Q}[X]$, we present a novel tensor IOPP design, instantiated with the new code family below. We introduce Integer Pseudo-Reed Solomon (IPRS) codes, a new family of MDS codes over $\mathbb{Q}$ and $\mathbb{Q}[X]$. While not Reed-Solomon codes, these codes have optimal MDS relative minimal distance, support efficient FFT-based encoding, and have bounded norm growth when encoding (unlike a naïve lift of Reed-Solomon codes to the integers). Our unoptimized, open-source, implementation proves 7 SHA-256 compressions followed by the multi-scalar multiplication (MSM) part of an ECDSA verification (the bulk of the work), with the following performance, benchmarked on a MacBook Air M4, without zero-knowledge: Prover time: 40.6 ms, Verifier time: 7.0 ms, Proof size: 198 KB. Zinc$+$ can be instantiated end-to-end or as a lightweight extension to any existing hash-based SNARK over~$\mathbb{F}_q$.

The *random oracle model* (ROM) allows us to optimistically reason about security properties of cryptographic hash functions, and has been hugely influential in designing practical cryptosystems. But it is overly optimistic against non-uniform adversaries, and often suggests security properties and security levels unachievable by any real hash function. To reconcile with this discrepancy, Unruh [CRYPTO ’07] proposed the *auxiliary-input random oracle model* (AI-ROM), where a non-uniform attacker additionally gets a bounded amount of advice about the random oracle. Proving security in the AI-ROM is often much more difficult, but a series of works starting with Unruh provided useful technical tools to do so. Although these tools lead to good results in the information-theoretic setting, they are unsatisfactory in the computational setting, where the random oracle is used alongside other computational hardness assumptions. At the most basic level, we did not even know whether it is possible to efficiently simulate random oracle queries given auxiliary input, which has remained as an explicit open problem since the work of Unruh. In this work, we resolve the above open problem and show how to efficiently simulate auxiliary-input random oracles. Moreover, the simulation has low concrete overhead, leading to small losses in exact security. We use it to prove the security of a broad class of computational schemes in the AI-ROM, including the first non-interactive zero-knowledge (NIZK) scheme in the AI-ROM. As a tool of independent interest, we develop a new notion of ultra-secure pseudorandom functions with fast RAM evaluation, which can achieve $2^\lambda$ security while having sublinear $\mathrm{o}(\lambda)$ evaluation time.

Fully homomorphic encryption is a promising cryptographic primitive for privacy-preserving computation, yet bootstrapping remains the primary bottleneck for its practical deployment. For the CKKS scheme, the dominant cost of bootstrapping arises from the homomorphic evaluation of the Discrete Fourier Transform (DFT) and its inverse. Existing approaches realize these operations as matrix-vector products, thereby relying heavily on a large number of homomorphic rotations, a type of key-switching operation. Despite substantial efforts to reduce the rotation count, these transforms remain fundamentally rotation-heavy -- requiring $O(r \cdot N^{1/2r})$ rotations per ciphertext at the cost of $r$ multiplicative levels, where $N$ is the ring degree -- and still account for a major portion of the overall bootstrapping latency. In this paper, we resolve this dependency in a batched manner, yielding a novel batch bootstrapping algorithm. We propose \emph{MRFHE}, an FHE scheme over a mixed-radix cyclotomic ring, which inherently decomposes the DFT into two layers -- a radix-$2$ DFT and a radix-$3$ DFT. This structure allows the homomorphic linear transformations during bootstrapping to be realized as two smaller, independent DFT evaluations. By batching ciphertexts, each smaller DFT can be reduced to a batch matrix multiplication over cleartexts, requiring only $O(1)$ key-switching operations per ciphertext and admitting efficient acceleration by highly optimized libraries such as BLAS and FLINT. We implement MRFHE on top of the Lattigo library, demonstrating significant efficiency gains in batch bootstrapping and general ciphertext operations.

Isogeny-based cryptography is a kind of cryptography whose security relies on the computational hardness of the isogeny problem. This field is gaining attention as a promising candidate for post-quantum cryptography. Among the notable schemes within this category is SQIsign, a signature schemes that has been submitted to the NIST Post-Quantum Cryptography Standardization competition. In this paper, we introduce a new isogeny-based signature scheme, ∆-SQIsign, which represents a significant departure from existing isogeny-based signatures including SQIsign. The key distinction in our scheme lies in its use of the degree of isogeny as a challenge within the underlying Σ-protocol. Then, the prover outputs an isogeny of the given degree as a response. To construct such a scheme, we introduce a new algorithm, called ∆-KLPT, which is a variant of GeneralizedKLPT. Similar to GeneralizedKLPT, our algorithm outputs an ideal equivalent to a given ideal with a fixed norm; however, under certain conditions, it can produce an ideal of smaller norm than GeneralizedKLPT.

Identity-Based Encryption (IBE) schemes were introduced to simplify public-key infrastructure by using any arbitrary strings as public keys. However, a longstanding criticism of IBE is the trade-off inherent in the ``key escrow'' problem: the design of IBE ensures that the authority possesses a master secret key that allows it to generate secret keys for any identity and, consequently, decrypt any ciphertext. While concepts such as Blind IBE and Accountable Authority IBE attempt to mitigate this trust assumption, they fall short of fully preventing a malicious authority from passively decrypting user traffic. A major improvement was proposed by Mitrokotsa \etal where they formalized a stronger notion called Oblivious IBE, where the authority cannot decrypt a ciphertext without brute-forcing the identity space. However, their construction inherently needs a composite group approach and offers no generic methodology. In this work, we present the first generic compiler that transforms any blind IBE into an oblivious IBE. Our transformation establishes a fundamental connection between blindness during key extraction and obliviousness during encryption. We prove that by combining a blind IBE with a hash function which takes input over the identity space, we can force the authority to search exhaustively for the recipient's identity to decrypt. To demonstrate the versatility and practical impact of our compiler, we propose two primary instantiations in the random oracle model: the first oblivious IBE in a prime order group and a post-quantum Oblivious IBE based on lattice assumptions (inspired by a variant of GPV). In addition, we make slight modifications to get our initial instantiation to function in the standard model.

Fungible tokens on public blockchains expose all balances and transfer amounts in the clear, which is incompatible with the financial privacy required by many real-world applications. We present Merces a confidential token contract that hides user balances and transaction amounts while preserving on-chain verifiability. The core idea is to store secret shares of balances within a decentralized MPC network, while only commitments are published to a smart contract. Thereby, Merces is capable of translating any existing token (e.g., any ERC20 token) into a confidential version. Deposits, withdrawals, and transfers are computed privately within the MPC network, which generates a collaborative SNARK (CoSNARK) to prove the validity of each state transition. In particular, the proof ensures that on-chain commitments are updated consistently and that the sender has sufficient funds. In this paper we give a full formalization of our construction in the Universal Composability (UC) framework, provide rigorous security proofs, and describe a concrete instantiation using Groth16 over BN254 with Poseidon2-based commitments. We further provide a complete end-to-end implementation, accompanied by extensive benchmarks and discussion of a working demo: our system achieves over 300 transactions per second, including proof generation, while requiring only minimal client-side computation.

Naively multiplying two $2 \times 2$ matri- ces requires eight multiplications and four additions. Strassen showed how to perform the same computation using seven multiplications and 18 additions. By chang- ing basis, Karstadt and Schwartz lowered the number of additions to 12, which they showed to be optimal within this generalized Karstadt-Schwartz (KS) framework. We present improved methods for optimizing the number of additions in Strassen-type matrix multipli- cation schemes for larger matrix sizes, and without any change of basis. Considering fast matrix generation process holistically as consisting of scheme generation and addition reduction, we discuss how to optimize both parts of this pipeline. We indicate that minimizing ad- ditions during the generation process is advantageous. We implement of our methods and use them to optimize the number of additions for schemes with dimensions up to $(n, m, k) = (5, 7, 10)$. Our methods can handle larger dimensions than (what has been published within) the KS framework. We compare our results against solutions within the KS framework on several large sets of schemes. We show that our method performs better relative to the KS framework, the larger the matrix dimensions are. We also apply our algorithms to a large number of schemes where we do not have apples-to-apples results in the KS framework as a comparison. We optimize the arithmetic complexity for two sets of thousands of schemes with the same rank. The number of additions needed after optimization roughly follows a normal distribution. Thus, we need to generate many solutions to minimize arithmetic complexity. Finally, our results on a large set of schemes and our extensive list of future research directions make for a valuable benchmark and facilitate future study of the arithmetic complexity of fast matrix multiplication.

With the expansion of Machine Learning as a Service (MLaaS), Secure Multi-Party Computation (MPC) is widely used to protect the privacy of both proprietary models and client data during inference. To achieve practical performance, these protocols typically rely on fixed-point arithmetic over finite rings. However, this design choice introduces a unique arithmetic vulnerability: silent modular wraparound. In this paper, we propose a novel model extraction attack that actively exploits this behavior to accurately recover neural network parameters. Unlike existing methods that heavily rely on the non-differentiable points of piecewise linear activation functions (e.g., ReLU [CRYPTO 20, EUROCRYPT 25]), our attack leverages the discontinuous jumps triggered by modular wraparound. We successfully extract parameters from networks employing smooth activation functions (e.g., Swish, GELU) and effectively handle expansive network architectures where previous differential attacks fail. We present polynomial-time algorithms for recovering neuron signatures, norms, and signs, demonstrating that our approach remains highly robust even in restricted black-box scenarios where only top-1 label and probability are available to the attacker. Rigorous theoretical proofs and signal-to-interference ratio (SIR) analyses confirm that our sign recovery method significantly outperforms existing neuron wiggle techniques [EUROCRYPT24].

Group signatures are one of the central privacy-preserving authentication mechanisms, offering an interesting trade-off between accountability and anonymity. Their versatility has led to many applications and even standardization at ISO/IEC. Unfortunately, they lack so far efficient quantum-safe constructions, despite several works implementing the seminal framework by Bellare, Micciancio and Warinschi (BMW) in the lattice setting. In this work, we propose an alternative lattice-based construction that departs from the BMW blueprint by trying to minimize the number of elements to conceal in zero-knowledge proofs, the latter being quite complex in this setting. Concretely, it relies on delegated lattice bases, while avoiding the complex OR-proofs of some previous attempts in that direction. Combined with some tricks leveraging the peculiarities of a recent lattice sampler, it results in an efficient scheme that yet retains all the BMW security properties while only relying on standard lattice assumptions.

It is obviously necessary that the security of post-quantum cryptographic schemes is based on computational problems that are hard to solve even with a quantum computer (unlike, e.g., factoring). Examples of such computational problems appear in the theory of lattices or in coding theory. However, this is not sufficient: also the security proof, which comes in the form of an algorithmic reduction that turns any hypothetical attacker into an algorithm that solves the considered hard computational problem, needs to be valid when considering quantum computing as the model of computation. In this work, we provide an overview of the hurdles one typically encounters when proving the security of post-quantum cryptographic schemes, and we elaborate on some of the mathematical techniques that have been developed in order to overcome these hurdles (to some extent). We also discuss the caveat that even when a security proof can be established (by reducing the security to a quantum-hard computational problem), the reduction often suffers from a larger reduction loss, compared to when proving classical security, which negatively affects the concrete security. In the second part of this work, we offer a survey of the respective reduction losses in (1) generic transformations that are often used in the design of cryptographic schemes (like the Fiat-Shamir and Fujisaki-Okamoto transformations), and (2) some concrete cryptographic schemes (with a focus on those standardized by NIST), when considering classical and when considering post-quantum security. Finally, we consider the notion of bit security, the standard measure of the concrete security of a cryptographic scheme (or of the hardness of an underlying computational problem). A natural question is how the bit security is affected by the different reduction losses we encountered. Surprisingly, we observe that a better or worse reduction (in terms of the reduction loss) is not always reflected as such in the bit security. We explain this phenomenon by the fact that the bit security is oblivious to the actual advantage–time function, and instead considers a worst-case behavior of that function. Thus, by exploiting the actual advantage–time function there is potential to get more accurate (i.e., less conservative) estimates for the concrete security.

This work establishes cFHE (compressed FHE), a unified analytical and empirical framework that integrates low-rank matrix factorization techniques into the CKKS homomorphic encryption scheme. Theoretical bounds are derived for the accumulation of relative error across sequences of factorized matrices, leading to an explicit expression for the attainable computation depth as a function of target accuracy, norm amplification behavior, and per-layer approximation quality. Extensions to tree-based evaluation structures are also formulated, allowing depth to scale logarithmically with the number of factors. The analytical results are linked to CKKS arithmetic through a precision-balancing model that connects low-rank approximation errors and ciphertext noise. This connection is at the core of cFHE; it enables the automatic selection of CKKS parameters (polynomial modulus degree, modulus chain, and scaling factor) for a desired accuracy, ensuring that low-rank tolerances and cryptographic precision are jointly optimized. Experimental evaluations demonstrate that encrypted low-rank matrix multiplications achieve both significant runtime improvements and reduction of ciphertext sizes over direct or tree-based encrypted multiplications while maintaining the prescribed accuracy. cFHE is agnostic to other CKKS optimizations and can be combined with them for further gains.

A lookup argument is a cryptographic primitive that allows a prover to convince verifiers that every element of a private query vector belongs to a public table vector without disclosing the underlying data. It can enforce correct instruction execution in zero-knowledge virtual machines and serve as an important supplement to zero-knowledge succinct non-interactive arguments of knowledge (zkSNARKs). However, existing lookup argument protocols operate exclusively in the single-prover setting and do not address the requirements of collaborative zkSNARKs, in which multiple parties jointly generate proofs over additively secret-shared data while preserving privacy from both other provers and verifiers. This work presents MPlookup, the first multi-party lookup argument protocol for collaborative zkSNARKs. MPlookup achieves quasilinear $O(N \log^2 N)$ complexity through four oblivious sorting operations together with a multi-point polynomial evaluation performed entirely over secret shares. We introduce a multi-point evaluation protocol in the distributed oblivious polynomial evaluation setting, constructed via oblivious subproduct tree construction and oblivious polynomial division with private divisors. We prove that the protocol satisfies obliviousness, completeness, soundness, and zero-knowledge. We implement MPlookup as an open-source Rust library, built upon the collaborative zkSNARKs framework and the CompatCircuit arithmetic black box. Our evaluation confirms a performance improvement over an $O(N^2)$ baseline while remaining competitive given the obliviousness requirement.

Fair data exchange (FDE) lets a seller receive payment if and only if the buyer obtains the committed data, and its most practical realizations reduce the task to verifiable encryption under committed key (VECK) over a Reed--Solomon-coded file with Fiat--Shamir sampling. In the state-of-the-art code-based scheme, however, proving is dominated not by the file but by a size-independent constant: in-circuit ElGamal operations tie the sampled ciphertexts to the commitment, and the resulting elliptic-curve gadgets both inflate the circuit and force the proving system onto a slow two-chain inner curve whose key verification is expensive to settle on-chain. We eliminate these ciphertexts---and with them every in-circuit public-key operation. In our construction the polynomial commitment itself certifies sample--file consistency: a KZG subset-consistency check and a single evaluation opening, exposed only as a group element, tie the sample to the committed file, while a lightweight commit-and-prove SNARK certifies only field-arithmetic masking and interpolation relations. We prove security in the algebraic group model and random oracle model under discrete-logarithm-type computational assumptions, dropping the DDH and DCR assumptions of prior VECK schemes. The circuit shrinks by about \(20\times\) and the prover runs directly on BLS12-381: for \(2^{17}\)-element files, cryptographic proof generation drops from \(21.1\) s to \(0.945\) s at sample size \(512\), while cryptographic verification depends only on that sample size. The key stays on a precompile-friendly curve, where its scalar multiplication costs \(12{,}000\) gas instead of \(0.9\)--\(5.9\) million for the non-precompiled alternatives.

Integrated sensing and communication (ISAC) combines sensing and communication within a shared system framework by using the same transmitted signal for both objectives. ISAC can improve the efficiency of spectrum and hardware use but also gives rise to new security challenges, as users associated with one function may need to be prevented from inferring information related to the other. This paper surveys information-theoretic approaches to secure ISAC with emphasis on formulations, performance metrics, and fundamental limits. We first review the information-theoretic ISAC models that underlie secure formulations. We then organize the secure ISAC literature according to the protected functionality and the adversary model, covering secure communication, sensing security, and active-adversary settings such as jamming. We also discuss formulations in which communication security and sensing security interact more directly, as well as their connections to privacy and covert communication. Throughout, we highlight the main modeling assumptions and the insights they provide on the tradeoffs among communication reliability, sensing performance, and security.

The rapid progress in quantum computing has sparked a new wave of cryptosystem innovation, namely, the development of cryptographic schemes that are resistant to quantum attacks, known as Post-Quantum Cryptography (PQC). Notably, the National Institute of Standards and Technology (NIST) has already initiated the PQC standardization process with several algorithms selected. Meanwhile, an additional round of digital signature scheme competition is on-going. Following the standardization efforts, many investigations in the field have gradually switched to the implementation side (especially on the hardware platform aspect). This paper follows this trend by delivering an efficient Hardware Accelerator for Key Generation of the digital signature scheme PERK (HAKE), which is one of the promising candidates in the NIST additional round of digital signature scheme standardization. Apart from that, we have followed the PERK's recent update to design two versions of Key Generation accelerators, one based on the previous PERK specification and another based on the newly released specification. Overall, we have conducted three major efforts to obtain the proposed accelerators. (i) We have broken down the Key Generation process of PERK into three distinct components through detailed algorithmic analysis, and meanwhile, we have proposed innovative methodologies to reduce these components' hardware design complexities. (ii) We have developed dedicated hardware microarchitectures for these components to construct the Key Generation accelerator (HAKE). (iii) We have conducted detailed implementation and comparison to showcase the efficiency of the proposed accelerator. For instance, it is shown that the proposed accelerator (following the previous PERK specification) is found to be 14.3$\times$ faster than the software implemented one and less area-time complexities than other recent NIST-selected SPHINCS$^+$ hardware accelerations. Overall, our design is highly efficient and configurable, and it is the first hardware accelerator for Key Generation of PERK, to the best of our knowledge. This research will be beneficial for the ongoing NIST PQC standardization and hardware acceleration for related schemes, and attract many follow up works in the field.

A practical acceleration framework for CKKS homomorphic encryption is proposed, in which multiplication-heavy sub-circuits are evaluated by adding encrypted log-magnitudes rather than multiplying ciphertexts. This logarithmic-number-system (LNS) representation consumes no multiplicative levels; a lightweight interactive refresh operation re-enters the linear CKKS domain whenever additive accumulation is required, avoiding bootstrapping entirely. Three execution strategies---an automatic planner, a client-side accumulation variant, and a server-side re-encryption variant---are mechanized in an OpenFHE-based runtime under 128-bit classical security and evaluated on a deep multiplication chain and an attention-like pipeline across three network environments. On the attention pipeline, the linear baseline requires a ring degree of 65,536 and about 2.9 GB of public-context material, whereas LNS operates at a ring degree of 8,192 with about 50 MB---a 58x context reduction yielding 22-36x end-to-end speedup and up to 46x payload reduction. On the multiplication chain the gap widens with depth, from about 10x speedup and 26x payload reduction at L=8 matrices, to 35x and 98x at L=20, because LNS context requirements are decoupled from multiplicative depth while the linear baseline must escalate its ring degree to maintain accuracy and security.

In this paper a novel key refresh architecture using multiple independent third-party refreshers, to eliminate the centralized trust required by single-dealer approaches, is presented. Each refresher independently maintains and refreshes a split of its share, distributing fragments to signing parties asynchronously without coordination. This eliminates the need for coordinated interaction required by committee-based refresh protocols, avoiding substantial communication overhead and synchronization complexity. The architectural separation, where signing parties never participate in refresh and refreshing parties never participate in signing, enables efficient proactive security without disrupting operational availability. The proposed design does not require all refreshers to participate in each refresh operation. Unavailable refreshers are not excluded from the protocol, only malicious ones that deviate from protocol rules. This provides graceful degradation: the system maintains confidentiality even when all refreshers are compromised (requiring only one honest signing party) and achieves proactive security with minimal participation (requiring only one honest refresher between compromise events). This approach extends the period between costly on-chain key rotations by maintaining security through continuous off-chain refresh. Key rotation should be carried out when very few honest refreshers remain. Security under various adversarial scenarios is proven, including malicious refreshers, cross-epoch compromises, and denial-of-service attacks, demonstrating $O(k)$ communication per refresh for k participating refreshers versus $O(n^2)$ for committee-based protocols. The proposed approach is particularly suited for high-availability systems requiring frequent or continuous key refresh, including cryptocurrency wallets and distributed key management.

The recent development of Fully Homomorphic Encryption (FHE) witnessed the emergence of a new generation of tailored cryptographic primitives designed to meet its specific criteria. Among promising candidates for FHE constructions stands out the FLIP cipher, which employs Boolean functions that are evaluated only on specific subsets of $\mathbb{F}_2^n$. In this article, we study Weightwise Almost Perfectly Balanced (WAPB) functions, which are almost balanced on each of these subsets. While WAPB functions have been of great interest for new constructions recently, some aspects, such as resilience remain poorly understood. As such, we take a first step at characterizing the resilience of WAPB functions, through their properties as correctors. We highlight its close connection with the restricted Walsh transform and uncover an algebraic relation between Krawtchouk matrices and Vandermonde matrices, which reduces the problem of determining the corrector order of a WAPB function to a particular instance of the Prouhet-Tarry-Escott problem. This reduction helps us show that for infinitely many integers $n$, WAPB functions in $n$ variables have corrector order tightly upper bounded by the Hamming weight of $n$ minus one. We conjecture that this observation holds for any positive integer $n$, which is verified for $n$ up to $62$.

The emergence of quantum computing poses significant threats to conventional cryptographic systems, necessitating the efficient hardware acceleration of Post-Quantum Cryptography (PQC), especially on the Field-Programmable Gate Array (FPGA) platforms. SPHINCS$^+$, recently standardized by NIST (National Institute of Standards and Technology) as SLH-DSA (Stateless Hash-Based Digital Signature Algorithm), represents the only hash-based digital signature scheme. Its practical deployment, however, is restricted by computationally intense operations, particularly in the eXtended Merkle Signature Scheme (XMSS) tree, where WOTS+ (Winternitz One-Time Signature Plus) public key generation consumes the majority of signature generation cycles. With this background, this paper presents Trident, an innovative FPGA-based hardware accelerator that addresses critical performance and resource challenges in XMSS of SLH-DSA. First, we propose a triangle hash unit architecture that enables parallel execution of up to three hash operations simultaneously, directly addressing the computational bottleneck in XMSS tree construction and WOTS+ chain operations. Second, we develop an optimized memory caching scheme that reduces on-chip memory requirements via intermediate value management. Third, we implement the Trident on FPGAs and comprehensively evaluate it across all parameter sets at multiple security levels, i.e., up to 8.6$\times$ improvement in signature generation and up to 5.4$\times$ speed-up in verification operations. Extended Hypertree evaluation shows a 34.6$\times$ area-delay product (ADP) improvement on UltraScale+ FPGA for SLH-DSA-128s. This Trident represents a significant advancement toward practical SLH-DSA deployment in FPGA environments.

Aggregate signatures allow a set of signers to compress individual signatures on distinct messages into a short signature, offering significant savings in storage and verification time. However, existing aggregate signatures neither support key aggregation nor achieve strong privacy guarantees for signers. In a very recent work, Nick, Ruffing and Seurin (EUROCRYPT’26) proposed DahLIAS, a pairing-free aggregate signature scheme with constant size signatures. Unfortunately, DahLIAS fails to provide aggregated verification and privacy properties. As a side contribution, they also constructed a generic transformation from multi-signatures to aggregate-signatures. However, the transformed schemes cannot satisfy unrestrictedness and privacy. In this paper, we formally introduce the notion of aggregate signatures with verifiable key aggregation (ASvKA), along with new unforgeability and privacy definitions. We then present a generic transformation that turns any multi-signature (MS) scheme into aggregate signature scheme with verifiable key aggregation and privacy properties, which also lifts weaker unforgeability of the underlying MS to stronger unforgeability of ASvKA. Finally, we instantiate our transformation with two concrete multi-signature schemes. For pairing-free schemes, we propose PP-SpeedyASvKA, a two-round privacy-preserving aggregate signature derived from the multi-signature SpeedyMuSig, achieving the strongest unforgeability and privacy while preserving the efficiency. For pairing-based schemes, we construct PP-BAS-0 and PP-BAS-1 from a BLS multi-signature, offering different trade-offs between unforgeability and privacy.

Fault injection attack targetting schemes with Zero-Knowledge (ZK ) properties have been relatively absent in the wider literature. One of the few examples has recently shown a ZK signature scheme to be vulnerable to fault injection attacks. In this paper we detail candidate fault injection attacks against Zero-Knowledge Scalable Transparent Argument of Knowledge (zkSTARK) provers, designed to violate the construction’s zero knowledge capabilities. zkSTARK proving systems are complex, with a huge amount of diversity in implementation specifics. We match the variety within the STARK implementation ecosystem, proposing a variety of ffault injection attacks against different algorithmic primitives. To the best of our knowledge this marks the first exploration of the fault injection surface of zkSTARKs, and of the wider class of general purpose ZK proving systems.

The transition to post-quantum cryptography (PQC) is essential to safeguard networked systems against future quantum-enabled adversaries. While recent standardisation efforts have introduced PQC algorithms such as ML-KEM into protocols like TLS 1.3, verifying their correct deployment in realworld systems remains a challenge. Existing approaches rely on configuration-level inspection or high-level cryptographic libraries, which do not reflect actual runtime behaviour. This paper presents a novel methodology for detecting postquantum and hybrid TLS key exchange mechanisms through direct inspection of raw TLS handshake records. By parsing ServerHello messages at the byte level and extracting keyshare group identifiers from the key share extension, the proposed approach enables accurate classification of endpoints into CLASSICAL_ONLY, PQC_ONLY, and HYBRID_CONFIRMED states. We implement the methodology within a prototype compliance system and evaluate it across 38 production endpoints and a controlled three-node cloud testbed spanning two validation phases. Phase 1 reveals that all three testbed nodes — including a PQC-capable application server — are correctly classified as CLASSICAL_ONLY, exposing an application-layer versus transport-layer mismatch invisible to configuration auditing. Phase 2, following an OQS-capable TLS frontend upgrade, produces a confirmed HYBRID_CONFIRMED result with group 0x11EC (X25519MLKEM768) on the same physical server, achieving 100% target accuracy across all three nodes. We further document a critical false positive failure mode in naive string-matching approaches and validate correct four-state classification under known ground-truth conditions. Unlike prior work, this approach provides verifiable, evidence-based assessment of cryptographic posture, enabling reliable auditing of PQC readiness.

We study the local leakage resilience of $t$-out-of-$n$ threshold secret sharing schemes. We present a remarkably simple, perfectly correct attack that fully breaks any scheme with linear reconstruction over a finite field using $\lg t + \mathcal{O}(1)$ bits of leakage per share. In particular, this yields concretely efficient attacks on additive secret sharing and on Shamir’s scheme for arbitrarily large thresholds over arbitrarily large finite fields. Our key technical idea is an approximately linear scale-and-round function that maps shares from an arbitrarily large field into a much smaller ring, while preserving the distance of well-separated secrets. Our results provides two surprising insights: Bigger finite fields do not necessarily improve leakage resilience and increasing the reconstruction threshold in Shamir’s scheme does not help too much either.

A universal, dynamic accumulator is a verifiable data structure that compresses a set of elements (e.g., unspent coins, issued public key certificates, etc.) into a succinct digest while supporting addition and deletion of elements alongside efficient proving of (non-)membership in that set. In many applications, valid (non-)membership proofs are a prerequisite to accessing a service (e.g., sending a private payment transaction, establishing a TLS connection, etc.). Typically, newly added or deleted elements necessitate updating all existing (non-)membership proofs per update. Thus, intermittently connected clients will possess invalid (non-)membership proofs whenever they reconnect. In this work, we design, implement, and evaluate algorithms for the RSA and bilinear accumulators that allow a resource-constrained client to privately delegate the updates of its (non-)membership proofs to an untrusted server. We define and prove security in a game-based framework under standard assumptions. We also study proof delegation in the batch setting. The online client algorithms are constant-time, i.e., independent of the updated set size $k$, compared to prior $\mathcal{O}(k),\mathcal{O}(\sqrt{k})$ works. The private delegation algorithms for membership proofs incur an asymptotically constant computational overhead for the server (e.g., $6.12\times$ overhead when $2^{10}$ elements were added in the offline phase to the RSA accumulator) compared to the non-private membership proof creation algorithms.

In this paper, we present LockMeld, the first solution for enabling private cross-chain transfers when both underlying chains rely on homomorphic commitments to safeguard transaction amounts. LockMeld tackles the core challenges of ensuring unlinkability without sacrificing availability and accommodating arbitrary transaction amounts. Central to our solution is a batching technique that selectively discloses transaction details to the cross-chain intermediary, preventing any actor from directly correlating a sender’s escrow on one chain with the corresponding redemption on the other. Moreover, LockMeld combines additive homomorphic public-key encryption with randomizable signatures over randomizable commitments, ensuring robust on-chain confidentiality while still enabling necessary account management for future transactions. We provide not only a rigorous game-based security analysis but also demonstrate the protocol’s resilience against both malicious participants and external adversaries. We also implement and evaluate LockMeld's performance. This empirical validation reveals that LockMeld’s privacy guarantees can be achieved in practice without incurring excessive overhead, making it an attractive option for privacy-conscious cross-chain interoperability.

Cryptographic protocols are the cornerstone of Internet security, and any flaw in their design would have drastic effects. We can formally prove the absence of such flaws using a variety of automated or semi-automated tools. However, some features of real-world protocols are notoriously hard to analyze using these tools, including unbounded loops, unbounded data structures, and unbounded and dynamic number of protocol participants. The DY* protocol verification framework recently emerged as a tool designed to address these challenges, and it was successfully used to analyze protocols such as Signal, ACME and TreeSync. However, we note that DY* suffers from two deep limitations: first, security proofs of protocol subcomponents cannot be composed, which hinders the analysis of large protocols; second, the security proofs depend on a simple language to describe compromises, which overly restricts the set of compromise scenarios DY* can reason about. In this paper, we present a major overhaul of DY* that addresses these limitations. We enable composing security proofs in DY* by developing a framework to define trace invariants modularly, and we improve the precision of compromise scenarios that DY* can prove by fully generalizing the notion of security labels. These improvements are essential to enable the analysis of large protocols. In particular, our new version of DY* was already used by and crucial to the security proofs of the TreeKEM protocol (IEEE S&P 2025).

The arithmetic crosscorrelation of pseudorandom sequences is a key measure of their suitability for cryptographic and communication applications. While prior work has addressed this quantity for binary sequences, the non-binary setting has remained largely unexplored. This paper initiates a systematic study of the arithmetic crosscorrelation of non-binary pseudorandom sequences constructed from higher-order multiplicative characters over finite fields. For two sequences of coprime periods $P$ and $Q$, defined via $r$-th order characters of polynomials of degree $d$, we show that the joint local patterns of the sequences are asymptotically uniformly distributed, and use this to derive an explicit bound on the arithmetic crosscorrelation $C^A_{S,T}(\tau)$. Specifically, we establish $$ \mathcal{N}\big(C^A_{S,T}(\tau)\big) \ = \ O\Big(\big(\varphi(r)d P^{1/2} Q (\log P)^2\big)^{\varphi(r)}\Big) $$ for all shifts $\tau$, for $r$-th order character sequences, where $\varphi(\cdot)$ is the Euler totient function and $\mathcal{N}(\cdot)$ denotes the norm function. To the best of our knowledge, this work establishes the first nontrivial upper bounds on the arithmetic crosscorrelation of non-binary pseudorandom sequences, thereby extending the results of Chen et al. [IEEE IT'22] and Yan and Ke [ePrint: 2026/616], which were obtained exclusively for the Legendre sequence.

Zero-knowledge execution of high-level programs proceeds by repeatedly evaluating CPU steps. Each such step privately selects and evaluates an instruction (possibly involving memory access) from a rich instruction set. Building on this paradigm, ZEE (Heath et al., S&P'21) realized a full toolchain supporting arbitrary $\texttt{ANSI C}$ programs, demonstrating this capability by proving SIR- and CVE-reported bugs in off-the-shelf Linux programs $\texttt{sed}$ and $\texttt{gzip}$. We revamp the state of the art by building a new constant-round ZK system ZEE200, which is about $20\text{-}40\times$ faster than ZEE. ZEE200 is built on a novel and convenient cryptographic framework for efficiently proving general statements represented as real-world programs. Our framework integrates several crucial recent advances, such as Tight ZK CPU (Yang et al., CCS'24) and fast ZK RAM (Yang and Heath, USENIX Security'24). We develop better encodings for $\mathbb{Z}_{2^{32}}$ arithmetic, and numerous low-level optimizations. Compared to ZEE's $\approx 10$ KHz CPU speed on a limited ISA, ZEE200 runs at $\approx 200$ KHz (still on a commodity laptop and a LAN!), while supporting a much richer ISA. For example, we rerun a ZEE's benchmark, proving a SIR-reported vulnerability in off-the-shelf Linux utility $\texttt{sed}$. On a 2021 ThinkPad X1 Carbon Gen 9 under a simulated $1$Gbps LAN (single-threaded), ZEE200 completed the proof in $1.5$ seconds, compared to ZEE's $30.1$ seconds, a $20\times$ improvement.

Sanitizable signature schemes~(SSS) allow a designated sanitizer to modify admissible portions of a signed message while preserving the validity of the original signer's authorisation. All existing SSS constructions satisfying the Brzuska et~al.\ security framework rely on classical number-theoretic assumptions broken by Shor's algorithm. We present \textsf{UOV-San}, a sanitizable signature scheme based entirely on multivariate cryptography. The construction employs a dual-signature architecture with strict key separation enforced by a two-message interactive signing protocol: the signer holds only $\sk_S$ and the public trapdoor-hash key $\ck$, whereas the sanitizer holds $\sk_{\mathsf{San}}$ and the trapdoor key $\tk$. We introduce a target second-preimage resistance assumption, \textsf{tSPR}, for UOV public maps. It captures the hardness of finding a distinct input $r'\neq r$ that collides with a given random target input $r$ under the public map $P$, namely $P(r')=P(r)$. Based on this assumption we construct MV-CH, a dedicated multivariate target-collision trapdoor hash. MV-CH is not a standard message-dependent chameleon hash of the form $CH(m,r)$; instead, it hashes only the randomness $r$, while message binding is provided by the upper-layer dual-signature construction. The sanitizer can use the UOV trapdoor to generate target collisions, whereas outsiders face the \textsf{tSPR} problem, except for random-oracle target-collision events. \textsf{UOV-San} provably achieves unforgeability, immutability, and accountability---including against a malicious signer---under UOV EUF-CMA security and \textsf{tSPR} in the random-oracle model. We forgo transparency and privacy: these properties are structurally incompatible with the dual-signature architecture and key-separation requirement, and are operationally unnecessary for our target application domains such as supply-chain audit, government document redaction, and blockchain audit trails. Experimental evaluation confirms practical signing times under $5$ ms and verification times under $2$ ms on commodity hardware.

The ARIA block cipher is the Korean national standard (KS X 1213) and an IETF standard (RFC 5794). Despite its widespread use, research on efficient implementation for modern ARMv8 processors has remained limited compared to AES, which benefits from dedicated hardware instructions. The best prior ARMv8 result by Eum et al. reported 0.573 cycles per byte (cpb); however, through direct communication with the authors and independent re-evaluation, we confirmed that this published figure reflects a measurement error and that the actual cost is 5.845cpb. In this paper, we present a 16-way parallel ARIA implementation on ARMv8 NEON that evaluates all four ARIA S-boxes through the AESE/AESD cryptographic extensions, eliminating S-box table lookups from the round function entirely. Two of the S-boxes reduce to a single AESE/AESD instruction, while the remaining two are computed via a nibble-split decomposition of the underlying multiplicative inverse, requiring only two NEON registers of precomputed constants per S-box. Combined with a byte-sliced data layout and a 64-instruction transposition butterfly, our implementation achieves 1.483cpb for ARIA-128 on the Apple M1—a 3.94× speedup over the corrected prior result. Multi-threaded CTR-mode measurements demonstrate near-linear scalability, reaching 6.67GB/s with 4 threads on the performance cores and 8.33GB/s with 8 threads. On the ARM Cortex-A76 (Raspberry Pi 5), the implementation achieves 3.586cpb and scales to 2.36GB/s with 4 threads.

The prevalence of biometric authentication has been on the rise due to its ease of use and elimination of weak passwords. To date, most biometric authentication systems have been designed for on-device authentication of the device owner (e.g., smartphones and laptops). Recently, biometric authentication systems have started to emerge that are designed to authenticate users against cloud databases storing representations of biometrics for large numbers of users (potentially millions), such as those facilitating biometric payments. However, the use of a large cloud database introduces a significant attack vector, as a breach of the database could lead to the compromise of all enrolled users' sensitive biometric data. Indeed, all such existing systems either do not adequately protect against such a breach, or are impractical to deploy and use due to their high computational overhead. In this work, we present a new biometric authentication system that provides provable security guarantees against data breaches, while remaining scalable and performant. To do so, we marry artificial intelligence with advanced cryptographic techniques in a novel fashion, providing several optimizations along the way. Our work is the first to show that real-world scalable privacy-preserving biometric authentication without auxiliary identifiers is feasible, and we believe that it will spur widespread industrial adoption and further research in this area.

Existing leakage-resistant AEADs are rarely compatible with {\it single-length key} blockciphers (BCs), i.e., blockciphers with key-length equaling block-length. We present UEDTDM and UEDTMX, two single-length key BC-based leakage-resistant AEAD constructions. Both of them are one-pass with rate $1/4$, use ``partially fixed-key'' BC to maximize {\it practical} efficiency, and gather the strongest level of Grade-3 leakage-resistance (a terminology due to Bellizia et al., CRYPTO 2020) with a satisfactory black-box security bound. Their concrete security bounds are comparable with state-of-the-art construction TEDT of Berti et al. (TCHES 2020). Assuming that the underlying MJH hash has $(n-2\log_2n)$-bit collision security, they achieve $(n-2\log_2n)$-bit CIML2 and black-box CCA security, and approximately $n/2$-bit CCAmL2 security. Even more, they achieve birthday-bound context-committing security. To prove these claims, we introduce a framework UEDT that generalizes and expands the usability of the EDT construction of Berti et al. (ToSC 2017), prove unified provable security results, and then derive concrete bounds for the two instances, UEDTDM and UEDTMX. This framework may be of independent interest. We also demonstrate the performance advantage of our algorithms, especially in software. On x86 architectures where the AES-NI instructions are supported, our algorithms are twice faster than the closest competitor; LR-BC-3 (Bronchain et al., TCHES 2021). In addition, the ability to use the efficient MJH hash function and to reduce the amount of rekeying makes the algorithms faster across multiple platforms, as well.