Witness encryption over blockchain state aims to release a secret on a ledger condition without a key custodian. Validators with enough stake to construct a valid fork witness can obtain the secret although the condition never holds on the canonical chain. They finalize a private fork that satisfies the condition, and keeping the fork hidden withholds the conflicting votes that slashing needs. We propose slashable secrecy to address this gap with Ethereum’s native slashing rules, without an additional key-custody committee or separate collateral. In executions where the condition never holds on the finalized canonical chain through completion, an information advantage yields evidence of those votes against keys the adversary controlled, or a solution to a designated hard problem. We give a construction from a witness KEM and prove slashable secrecy conditionally on its extraction interface. We bound the implicated historical stake under changing validator weights. For an archived Ethereum mainnet state, the historical evidence-weight floor exceeds 3.5 percent of its active stake, about 1.44 million ETH, under stated budget and coverage assumptions. Experiments on a synthetic Ethereum network confirm native processing of the evidence, without WE decryption. Two limitations remain. A witness KEM satisfying the full relation and extraction interface remains uninstantiated. Enforcement requires that the evidence is available, converted to native form and included while its signers remain eligible.

Merz and Ran derive additional equations from divided powers of the public polar forms in characteristic two. We extend this construction to finite fields of arbitrary characteristic and apply it to the security analysis of QR-UOV.

We give a Monte Carlo algorithm for exact Euclidean SVP on Haar-random lattices with arithmetic time $(3/2)^{n/2+o(n)}$ and space $(4/3)^{n/2+o(n)}$, up to polynomial factors in the logarithmic condition number of the input basis. The leading exponents match those of heuristic lattice sieving. For a set of lattices of Haar measure $1-o(1)$, the algorithm succeeds with probability $1-o(1)$ on every input basis. Our algorithm regenerates each sieve list by running a Markov chain on the nonzero lattice points in a smaller ball. The parent list supplies signed increments. Each step reports all admissible proposals and assigns each the same probability, with the remaining probability assigned to staying put. The resulting chain is symmetric and has uniform stationary distribution. Trajectories using independent transition randomness produce endpoints jointly close to independent uniform samples once the chain mixes. Matrix Chernoff bounds transfer a Laplacian gap from the full angular graph to the graph defined by the parent list. The main proof task is to establish the required graph estimates on Haar-random lattices. We do so by adapting Rogers's moment method to centered trace moments and lattice-point counts. Spherical filtering reports the complete proposal sets and the final short differences within the claimed bounds.

The Universal Composability (UC) framework provides a paradigm for security definitions that allows for arbitrary composition, but has been criticized for being unamicable to the concrete security approach, as the meaning of a concrete UC-security statement is hard to interpret in practice. This work aims at alleviating this concern in the context of Password-Authenticated Key Exchange (PAKE): we show that any concrete UC-security statement for PAKE can be easily converted to a concrete game-based security statement, whose real-life meaning is clearer. We also briefly discuss potential generalizations of our result to other cryptographic primitives.

Good-case latency, studied in early fast-consensus protocols (Martin and Alvisi, DSN 2005) and formalized by Abraham, Nayak, Ren, and Xiang (DISC 2020), captures a natural efficiency goal: when the sender is honest, agreement should be reached quickly for the honest parties. In the standard classical model, however, there exists a barrier for any $f\geq n/3$ corrupted parties. Specifically, synchronous broadcast requires good-case latency at least $\Delta+\delta$ for $f\geq n/3$, where $\delta$ is the actual, unknown message-delay bound and $\Delta \gg \delta$ is its known, conservative upper bound. Under partial synchrony, consistency and liveness cannot even both hold for $f \geq n/3$ (Dwork, Lynch, and Stockmeyer, JACM 1988). In this work we study the use of quantum information to get past these classical barriers, specifically using one-shot signatures (OSS) (Amos et al., STOC 2020, Shmueli and Zhandry, CRYPTO 2025). OSS prevents even a corrupt signer from issuing signatures on different messages under the same verification key, which provides cryptographic non-equivocation without trusted hardware assumptions. Assuming OSS and a public-key infrastructure, we obtain two main results against quantum polynomial-time static corruptions. First, under synchrony, we construct a state-machine replication (SMR) protocol without clients, with optimal $\delta$ good-case latency, tolerating any $f<n$ corruptions among $n$ parties. Second, under partial synchrony, we obtain SMR with $2\cdot \delta$ good-case latency which is consistent under any number of corruptions and live assuming $f<\frac{n}{2}$. Specifically, a corrupt majority may cause progress to stop, but cannot create conflicting histories. Such an always consistent protocol is impossible classically (without assumptions like trusted hardware) even if liveness is only required to hold against a single corrupt party. In both our SMR protocols, communication is entirely classical, with only local quantum computation.

Password-authenticated key exchange (PAKE) and obfuscated key exchange (OKEX) are widely used protocols, appearing in passport access control, Tor's censorship evasion, and more. As quantum threats grow nearer, there have been an increasing number of proposals for post-quantum PAKE and OKEX. All such protocols are similar in that they build on a KEM, obfuscating public keys and/or ciphertexts sent over the wire, e.g., by adding a random mask or applying an ideal cipher. Many propose instantiation with ML-KEM, a NIST-standardized lattice-based KEM. Unfortunately, ML-KEM is a poor fit for these obfuscating protocols. The algebraic structure of ML-KEM public keys and ciphertexts means that obfuscating these values requires custom procedures for hash-to-vector, matrix expansion, serialization/deserialization, and randomized ciphertext decompression. In order to be broadly useful, these procedures also must be constant-time to prevent side channels and must be standardized to permit interoperability. No such set of procedures exists today. We observe that the barriers to instantiating PAKE and OKEX disappear if some of the KEM's algebraic structure is removed, i.e., if ML-KEM is replaced with a KEM whose public keys and ciphertexts appear to be uniform as bytestrings. In this work, we specify Kopis, a Module Learning-with-Rounding (MLWR) KEM with public keys and ciphertexts that are uniform as bytestrings. Kopis is intended to be a drop-in replacement for ML-KEM, in size, speed, and security. Kopis is nearly identical to Saber, a NIST PQC finalist, and thus inherits its years of cryptanalysis. We demonstrate that Kopis bears the security properties needed for use in various PAKE and OKEX schemes and provide a formally verified Rust implementation complete with portable, AVX2, and NEON backends, and a non-formally-verified C implementation for Cortex-M4. We perform benchmarks and find that Kopis is comparable to and often outperforms the fastest known ML-KEM implementations.

Subversion attacks where the attacker aims to replace parts of a cryptographic system by manipulated parts in an undetectable manner have been shown to model both theoretical and practical attacks such as supply chain attacks. Originally proposed by Young and Yung (CRYPTO 1996), interest in them has increased dramatically after the revelations about the inner workings of intelligence agencies due to Snowden and the following paper by Bellare, Paterson, and Rogaway (CRYPTO 2014). One of the most promising countermeasures against such attacks are cryptographic reverse firewalls, proposed by Mironov and Stephens-Davidowitz (EUROCRYPT 2015), which are small devices used by the parties with the aim to rerandomize the protocol message to remove possible leakage. A wide range of protocols and corresponding firewalls have been developed based on this notion. The usage of such firewalls, however, also introduces another attack surface as an attacker might also corrupt these firewalls. In most works, this problem is either not addressed or treated as if in this case, the complete party using the firewall is compromised. However, as firewalls typically only perform rerandomization without knowledge of secret key material, this is a very coarse over-approximation, as an honest party Alice is now treated as maliciously corrupted. Instead, the main security problem comes from the fact that the firewall can impersonate Alice. In this paper, we introduce the notion of impersonation resilience, which allows us to develop protocols that are also secure against such a corrupted firewall and thus result in an honest complete party. We show a generic compiler that transforms subversion-resilient protocols for commitment or coin toss into protocols that are also impersonation resilient. Following a recent research line, our protocols and security analysis are built on the Universal Composability (UC) framework of Canetti. Of independent interest, we show that existing UC subversion models are either too strong and do not allow secure string commitments, or too weak and allow trivially secure protocols. We addressed this by developing a new, intermediate UC subversion model.

On September 20, 2026, the Chinese Institute of Commercial Cryptography Standards published the 119 first-round candidates of its Next-generation Commercial Cryptographic Algorithms (NGCC) program: 34 signature schemes, 41 key encapsulation mechanisms, 9 key exchange protocols, and 35 hash functions. The program follows the template of the open NIST competitions for AES, SHA-3, and post-quantum cryptography. It opened just after cryptographers' ``Lee Sedol moment'' in the summer of 2026, when AI analysis overtook humans in analyzing the HAWK signature scheme. During the first 7 days of the NGCC competition, according to our harvested sources, 191 active findings were published for 89 candidates, 78 of them rated Critical: universal forgeries, signing-key recovery, trivial hash collisions, broken implicit rejection, and seeds too short for the claimed security level. Our independent evaluation effort discovered, verified, and disclosed 110 of those issues (47 Critical) using the agentic workflow described in this work; outside researchers, some AI-assisted, found the rest. Early AI-assisted findings mostly concerned implementations; by the end of the week, reproduced AI-assisted attacks also included new design-level key recovery. We describe the workflow, review loop, classification ruleset, and observed failure modes. As part of the evaluation, we also benchmarked all algorithm candidates and found that NGCC hash selection may significantly affect final public-key performance, as candidate implementations spend a large share of their cycles on ``placeholder'' hashes.

In public blockchains, the ability to order visible transactions allows block producers to extract value from users, a problem known as Maximal Extractable Value (MEV). Proposer-Builder Separation has turned that right into a formalized auction, and the leading protocol-level mitigations answer it with payload blindness: encrypted mempools, verifiable permutations, and block delay hide or scramble transactions before the order is fixed. Every such mitigation carries a security argument that assumes an adversary who learns nothing before the order commits. Deployed systems face a different adversary, and this paper measures the cost of that difference. We evaluate the three families of mitigations against a single adversary hierarchy, using closed-form analysis and simulations calibrated to Ethereum. Against a fully blind adversary, the outcome follows from the definitions: encryption with a permutation removes the attack classes that depend on transaction content, and block delay increases extraction rather than reducing it. Once that idealization is dropped, deployment problems dominate. The unencrypted envelope identifies the sender, so past behavior restores a usable guess at hidden content. Optional encryption gives builders a reason to starve the transactions it protects, and voluntary adoption then collapses. Key rotation turns a cryptographic parameter into a source of queueing congestion. Suppressing extraction, finally, removes far more producer revenue than it returns to users in lower fees, so the cost of every mitigation falls on the party that controls its deployment. The binding obstacles to MEV-free blockchains are therefore liveness and deployment incentives rather than cryptography.

Secure Transformer inference can be made non-interactive under fully homomorphic encryption (FHE), but the computation is extremely expensive. Existing FHE-based systems reduce that cost by optimizing individual stages in isolation, each within its own component rather than against the CKKS level budget they all share. A local gain therefore may not translate into an end-to-end speedup. We present THEMIS, a co-designed system for encrypted Transformer inference organized around two design principles, one bounding the depth each kind of stage may spend and one fixing where on the modulus chain it runs. THEMIS generalizes coefficient-encoded plaintext-ciphertext matrix multiplication (PCMM) to slot-encoded ciphertexts without format conversion, retaining the same accelerated coefficient-side backend and amortizing its nearly fixed cost through multi-batch packing. Two attention ciphertext-ciphertext matrix multiplication (CCMM) kernels combine the idle imaginary lane of each slot with baby-step giant-step accumulation and hoisting, so the attention multiplications issue far fewer key switches. For softmax, THEMIS conditions the first denominator with a calibrated row-wise offset and reserves high precision for the final normalization alone, which cuts the depth the reciprocal path consumes while keeping the precision of the returned probabilities. For a single stage, THEMIS accelerates PCMM and the attention CCMMs by $21.66\times$ and up to $7.39\times$ over MOAI (ICLR'26), and by up to $23.02\times$ and $16.49\times$ over Euston (S&P'26), while THEMIS's softmax runs $2.57\times$ faster than THOR (CCS'25) at higher precision. For the complete pipeline, THEMIS serves BERT-base on a CPU in $400.06$ amortized seconds per input, with accuracy on GLUE tasks comparable to plaintext. Of that latency, the stages around bootstrapping account for only $10.83\%$, which is the lowest share among all works compared here.

Multi-key fully homomorphic encryption (MKFHE) enables computation over ciphertexts encrypted under keys independently generated by different parties. Recently, Min, Park, and Song (MPS, CRYPTO 2026) constructed the first RLWE-based MKFHE scheme in the plain model, i.e., without trusted or interactive setup. Their construction requires each local compact Gentry-Sahai-Waters (GSW) ciphertext to be extended to a joint-key GSW-like ciphertext before evaluation, incurring $O(dk^2)$ gadget products per input for $k$ parties and gadget length $d$. In this paper, we first construct an extension-free MKFHE scheme (called Levis-fast) in the plain model, eliminating the $O(dk^2)$ gadget products required for joint-key ciphertext extension before homomorphic evaluation. Our core technique is a compatibility technique, termed Cofactor Compatibility, which establishes a common projective decryption relation across ciphertexts encrypted under independently generated local keys, enabling their direct homomorphic evaluation. We further present a compact variant (named as Levis-small) that reduces the communication of each fresh ciphertext from $O(dk^2)$ to $O(d)$ ring elements with only a lightweight lifting operation. A proof-of-concept implementation shows that, compared with MPS, for $k\in\{2,4,8\}$, our construction Levis-fast achieves evaluation speedups of $67.7\times$, $52.8\times$, and $139.4\times$, respectively, while our compact variant Levis-small reduces communication by a factor of $2.5\times$, $8.7\times$ and $14.2\times$, and achieves evaluation speedups of $11.8\times$, $19.7\times$, and $54.4\times$, respectively.

The $k$-nearest neighbor ($k$NN) algorithm is a core primitive for similarity search over sensitive data, but evaluating $k$NN under fully homomorphic encryption remains expensive because it requires distance computation, encrypted ranking, and top-$k$ extraction. CKKS is attractive for this setting because it natively supports packed approximate arithmetic, yet existing CKKS-based systems such as Engorgio (USENIX Security 2025) incur high overhead when used for reranking candidate sets. We present NOMOS, an encrypted $k$NN protocol for candidate sets that targets the ranking and top-$k$ extraction bottleneck. NOMOS builds on Mazzone et al.'s matrix-based ranking method (USENIX Security 2025), but introduces a gap-amplified sign approximation that focuses precision on near-zero distance gaps, where $k$NN rank decisions are most sensitive. NOMOS integrates this primitive into a complete encrypted $k$NN pipeline, using slot-index alignment and ReLU-based top-$k$ extraction to avoid full sorting. For large databases, offline k-means preprocessing forms fixed-capacity candidate sets, allowing NOMOS to avoid global top-$k$ extraction and reduce sign-approximation calls from quadratic global growth to near-linear clustered scaling. With these techniques, NOMOS outperforms state-of-the-art encrypted ranking and top-$k$ baselines. Across the Mazzone-style ranking benchmark and candidate-set workloads compared with Engorgio, NOMOS reduces latency by nearly $8\times$ and up to $828\times$, respectively. On the real-world SIFT dataset, NOMOS achieves $100\%$ top-1 and top-8 retrieval accuracy on evaluated candidate sets, showing consistent retrieval quality on real data.

We give a randomized subexponential-time algorithm for decision Learning with Errors (LWE) in two complementary parameter regimes. For polynomial prime modulus \(q=n^{\kappa+o(1)}\) with any fixed \(\kappa>1/2\), the algorithm handles independent discrete Gaussian errors drawn from \(D_{\mathbb Z,s_e}\), with Gaussian parameter \(s_e\) satisfying \(\ln(2+s_e)=(\ln n)^{a+o(1)}\) for any fixed \(0\le a<1\). Conversely, polynomial error \(s_e=n^{\gamma+o(1)}\), for any fixed \(\gamma>0\), can be handled with a quasipolynomial prime modulus \(q=\exp\!\left((\ln n)^{1+\eta+o(1)}\right)\) for any fixed \(\eta>0\). In both regimes, for an arbitrary secret distribution, the algorithm succeeds with probability \(1-o(1)\) using \(m=n+\Theta(n/\ln\ln n)\) original samples, with expected time and space \(2^{\Theta(n/\ln\ln n)}\). Our starting point is the Wagner-style Gaussian sampler of Ducas, Engelberts, and Loyer (CRYPTO 2025). We instantiate its auxiliary extensions with random \(P\)-ary lattices whose improved smoothing bound supports the accuracy required for LWE without increasing the leading list size exponent. At the smaller Gaussian width enabled by this geometry, the basis-dependent condition of the exact sampler used in prior work is no longer available. We therefore use the statistically approximate shifted discrete Gaussian sampler of Aggarwal, Dadush, and Stephens-Davidowitz (FOCS 2015) and control its error for adaptively chosen shifts. Finally, a martingale analysis applies the Aharonov--Regev Fourier distinguisher (JACM 2005) directly to the dependent output, avoiding the loss incurred by comparison with an independent product distribution. Our analysis applies to unstructured LWE with independent uniform public vectors. In particular, it does not directly apply to ML-KEM, whose security is based on the Module-LWE problem: the algebraic dependencies arising from its module structure are not covered by our analysis.

Migrating blockchain systems to Post-Quantum Cryptography (PQC) requires not only replacing classical primitives, but also analysing transformations that change how signatures are represented and verified. We study Falcon-PKR, a public-key-recovery variant of Falcon, motivated by Zcash-like transparent transaction workflows. Falcon-PKR replaces explicit storage of the full Falcon public key with a compact stored digest and reconstructs a candidate public key from the signature during verification. In our construction, this reduces the combined representation size of public key and signature by approximately 15%, but it also introduces a distinct security case in which verification depends on a reconstructed key derived from adversarially supplied signature data. We address this with a machine-checked EasyCrypt formalisation in the Random Oracle Model (ROM). We mechanically verify an EUF-CMA reduction showing that the security of Falcon-PKR is bounded by the security of standard Falcon together with collision resistance of a domain-separated public-key hash. The analysis therefore treats both assumptions explicitly and does not claim a proof of Falcon itself. We also machine-check correctness for honest signing under an abstract Falcon signing interface. We implement Falcon-PKR for Falcon-512 and Falcon-1024 in Python and C, and evaluate runtime and size against ECDSA and selected Post-Quantum (PQ) alternatives, exposing explicit verification and storage trade-offs. As a complementary case study, we implement and analyse an extended SECUER-based Multi-Party Computation (MPC) ceremony architecture. Together, the two case studies address both transaction-signature and ceremony-infrastructure layers of PQ blockchain migration.

Supersingular abelian surfaces are essential in isogeny-based cryptography. Despite this, we have no efficient algorithm to verify if a given abelian surface is supersingular. In this work, we initiate this research topic by giving an efficient Monte Carlo algorithm to verify if an abelian surface over $\mathbb{F}_p$ is supersingular in $O(\log p)$ with negligible failure probability, and an efficient conclusive algorithm if the order is smooth. We derive this algorithm by a careful analysis on the structure of supersingular Jacobians over $\mathbb{F}_p$. Furthermore, we derive efficient algorithms to verify if an abelian variety of any dimension is minimal or maximal, and to verify if a Jacobian of any dimension is superspecial.

In this work, we assess the security of the main signature scheme standardised by NIST, ML-DSA, and its precursor identification schemes under an extended quantum adversarial model, one in which the adversary is allowed to use quantum resources to interact with a prover/signer. We begin our analysis by developing new techniques for superposition attacks that realise a relative phase oracle for the LSBs of a classical function evaluated in a quantum computer. We then extend these techniques to enable a relative phase oracle for arbitrary bits. Leveraging these techniques, we demonstrate full key-recovery attacks on several lattice-based identification schemes, exploiting the affine structure of the output. Finally, we extend these attacks to the corresponding Fiat-Shamir signature schemes and obtain key-recovery attacks under reasonable implementation assumptions. As a result, we are able to mount full key-recovery attacks in the Q2 model against the original CRYSTALS-Dilithium scheme, as well as the corresponding NIST Standardisation Rounds 1 and 2 proposals. However modifications introduced in the scheme during the NIST process preclude our superposition attacks against the final standardised version ML-DSA. We identify and discuss the specific aspects of the algorithm's execution that affect the applicability of our techniques. Overall, our work expands the body of research on superposition attacks and represents a further step towards establishing full quantum security for cryptographic constructions.

The Internet of Things (IoT) is revolutionizing society by enabling anytime, anywhere connectivity, but its widespread deployment also makes IoT devices attractive targets for malicious activities. Over the past decade, radio-coupling based Far-field EM Side-Channel Attacks (FEM-SCAs), also known as screaming channel attacks, have emerged as a new threat to these wireless IoT edges. Unlike conventional power or near-field EM side-channel attacks, FEM-SCAs exploit the unintended coupling between digital computation and the Radio Frequency (RF) transmission chain, allowing sensitive information to be captured through radiated radio signals at long distances. Since the first screaming-channel demonstration, this field has progressed rapidly: attacks have become more efficient, DL-enabled methods have been developed, and recent studies have begun to examine more realistic wireless-protocol settings. Despite existing practical cases of remote FEM-SCA attacks, the literature remains fragmented. To systematically understand this security threat and to aid future countermeasure design, this paper presents the first systematic survey of existing screaming channel attack methodologies and case studies. We organize studies into a hierarchical framework covering leakage discovery and understanding, enhanced attack capability, attack targets and variants, and public data collections. Through a fine-grained cross-paper analysis, we compare representative works in terms of target implementation, attack distance, analysis method, profiling requirement, acquisition environment, and other factors. Building on this end-to-end review, we provide a focused discussion that distills FEM-SCA research into one central trade-off, three major limitations, and three future research roadmaps. Taken together, this survey offers a structured framework for understanding a rapidly developing far-field side-channel attack class, and provides practical guidance for evaluating its real-world threat boundaries.

The 2007 algorithm of Joux, Naccache, and Thomé (\textsc{jnt}) shows that, with subexponential access to an $e$-th root oracle, one can forge \textsc{rsa} signatures for \emph{odd} $e$ in time close to the special number field sieve, without factoring the modulus; a recent \textsc{jnt} implementation by Shea et al.~\cite{Forge26} carried that attack to $1024$-bit \textsc{rsa}. We revisit the \textsc{jnt} construction at $e=2$, the Rabin case, where an $e$-th root oracle is a square-root oracle. A \emph{raw} square-root oracle factors $n=pq$ in one query, so it is of no interest; the interesting object is a \emph{redundancy-constrained} (affine-padded) Rabin oracle that returns a single canonical root and thereby resists the one-query attack. We show that a one-sided number field sieve against such an oracle produces a congruence of squares $X^2\equiv Y^2\pmod n$ with $X\not\equiv\pm Y$ with probability $\tfrac12$ per dependency, and hence \emph{factors} $n$ in special-number-field-sieve time \[ L_n \left(\frac{1}{3},{\sqrt[3]{\frac{32}{9}}}\right)\simeq L_n(1/3,{1.526\ldots}), \] strictly below the general number field sieve's \[ L_n \left(\frac{1}{3},{\sqrt[3]{\frac{64}{9}}}\right)\simeq L_n(1/3,{1.923\ldots}). \] The mechanism is a pleasant inversion: the sign ambiguity that the odd-$e$ algorithm must suppress becomes, at $e=2$, the very quantity that \textsl{leaks the factorization}. We give the algorithm in full --- \textsc{lll} polynomial selection for a quadratic field, a line sieve producing prime-ideal relations, quadratic characters, $\mathbb F_2$ linear algebra, and an exact number-field square root --- prove the half-rate splitting, and analyse the complexity, including the precise reason the attack collapses when the padding is a hash rather than an affine function of an attacker-chosen message. An open-source implementation realises every step. A small toy example run of it, from the padded modulus to the recovered factors, is given in Appendix~\ref{app:example}. Our implementation confirms a clear performance improvement in factoring speed.

We improve differential-linear distinguishers and derive key-recovery attacks on reduced-round versions of the PRFs Orthros, Gleeok, ZIP-AES, ZIP-GIFT-64, and ZIP-GIFT-128. Relative to previous differential-linear analyses, we extend the reported coverage for Orthros from 7 to 9 rounds and for Gleeok-128 from 4 to 5 rounds. For Orthros and Gleeok-128, we obtain estimated correlation magnitudes \(2^{-61.40}\) and \(2^{-31.71}\), respectively. We also obtain distinguishers for 6-round Gleeok-256, \((3,3)\)-round ZIP-AES, \((7,7)\)-round ZIP-GIFT-64, and \((10,10)\)-round ZIP-GIFT-128. For key recovery, we give a \((3,3)\)-round differential-linear attack on ZIP-AES requiring approximately \(2^{122.42}\) chosen plaintexts and \(2^{122.88}\) ZIP-AES evaluations. Our \((10,10)\)-round ZIP-GIFT-128 attack has estimated data, time, and memory complexities of \(2^{93}\) chosen plaintexts, \(2^{117}\) full PRF evaluations, and \(2^{25.01}\) bits. We further obtain weak-key attacks on 9-round Orthros, 5-round Gleeok-128, and 6-round Gleeok-256, with key-space coverages of \(2^{-2.87}\), \(2^{-3}\), and \(2^{-1}\), respectively. The Orthros key-recovery result reaches one round beyond the previous DL key-recovery coverage. These results use automated differential and linear trail search together with existing round-based correlation estimation. We enforce the compatibility constraints between branches and select input-side extensions that make their prescribed differences jointly reachable.

The Internet of Things (IoT) comprises a vast array of interconnected devices that rely heavily on wireless communication to enable applications in domains such as healthcare, transportation, and smart environments. However, intrinsic vulnerabilities in wireless networks, such as susceptibility to eavesdropping, impersonation, and message tampering, require the development of robust yet lightweight authentication mechanisms. To address these concerns, we introduce AEBAP, an efficient authentication protocol based on elliptic curve cryptography (ECC), specifically designed for secure communication in resource-constrained IoT environments. AEBAP ensures mutual authentication, data integrity, and resilience against both passive and active attacks by leveraging the cryptographic strength and computational efficiency of ECC. We evaluate the protocol’s performance through experimental implementation and analyze its security using both informal reasoning and formal verification tools, including Scyther and ProVerif. The results demonstrate that AEBAP achieves strong security guarantees with minimal computational and communication overhead, making it a promising solution for securing next-generation wireless IoT systems

In a multi-instance problem, the adversary is given $n$ independent problem instances and succeeds if it solves at least $k$ of them. We study the generic hardness of a broad class of multi-instance problems over prime-order groups, including multi-instance Computational Diffie-Hellman (CDH), Square Diffie-Hellman (SDH), Inverse Diffie-Hellman (IDH), and Linear Kernel Diffie-Hellman (LKDH). As expected, we show that, in generic groups, solving multi-instance CDH and SDH is as hard as solving $k$ independent discrete logarithm instances. In contrast, although the single-instance versions of CDH and IDH are known to be equivalent, we establish generic upper and lower bounds showing that multi-instance IDH (and LKDH) can be significantly easier to solve than multi-instance CDH in certain parameter regimes. All problems, however, offer $1/2(\log(p)+\log(k))$ bits of security. Our lower-bound techniques extend Yun's information-theoretic hyperplane query model (EUROCRYPT 2015). At the core of our approach lies an inductive argument showing that, in order to establish a generic-group lower bound, it suffices to bound the adversary's "zero-hyperplane-query" advantage in the hyperplane query model. For the multi-instance problems considered in this work, we derive such bounds using techniques from algebraic geometry. More precisely, we analyze the Krull dimension of suitable algebraic varieties, either by explicitly computing Gröbner bases or by upper bounding the number of algebraically independent elements in the associated coordinate rings.

Batch decryption allows an authority to release a short key that enables public decryption of a selected batch of ciphertexts. Motivated by encrypted mempools, we study this capability through two constructions with different authorization semantics and assumptions. First, we provide a simple and compact epochless construction in an RSA group based on Fiat's Batch RSA [CRYPTO'89]. Its batch-decryption hint is just one group element, and its keys and ciphertexts have size independent of the batch size, with no batch bound fixed at setup. We prove adaptive security under the strong RSA assumption in the random-oracle model. The scheme permits repeated releases for overlapping batches, with each release authorizing decryption of the selected ciphertexts. Second, we give an adaptively secure generic construction of identity-based encryption with batch decryption in the epoch-based model, which permits at most one batch-key query for the challenge epoch. The construction combines deferred encryption via garbled circuits, non-inclusion secure registration-based encryption, and weak receiver non-committing IBE. We construct the latter primitive from ordinary IBE and pseudorandom functions, obtaining an instantiation of the epoch-based construction from the computational Diffie--Hellman assumption.

Oblivious Transfer (OT) is a fundamental building block for secure computation, in which a sender holds two messages and a receiver learns exactly one of them, without revealing which one was chosen and without learning the other. While generic constructions for Universally Composable (UC) OT exist, instantiating them from post-quantum assumptions remains challenging, particularly under adaptive corruption. In this work, we present the first adaptively UC-secure OT protocol based on Group Actions, specifically assuming weakly pseudorandom Effective Group Actions (EGA) like CSIDH. We adhere to the framework of [BC15], which derives an adaptively UC-secure OT protocol from SPHF-friendly extractable and equivocable (E²) commitment schemes. The central challenge in instantiating this construction from group actions is the lack of SPHF-friendly IND-CCA encryption. Classical CCA transformations such as Fujisaki-Okamoto destroy the algebraic structure required for building SPHFs over ciphertexts, while known group action-based schemes offer no native mechanism to prove ciphertext validity. To overcome this obstacle, we construct from group actions an IND-CCA encryption scheme with enough algebraic structure to efficiently recognize valid ciphertexts. Our contributions are threefold: (1) a verifiable chameleon hash function with perfect soundness in the standard model, (2) an SPHF-friendly, publicly verifiable IND-CCA encryption scheme in the random oracle model, and (3) we combine these to build an SPHF-friendly E² commitment scheme and derive a fully adaptively secure OT protocol in the UC framework. This is the first construction of its kind under group action assumptions, enabling post-quantum secure OT with adaptive security guarantees. These building blocks may also be of independent interest e.g., to obtain digital signatures, non-malleable commitment schemes, or verifiable encryption.

The Chinese NGCC post-quantum competition received a family of lattice KEMs whose decryption failure rates (DFRs) are certified by their designers with models that differ in detail. We recompute the failure probability of the first-round lattice KEMs whose claimed DFR, or a simple recomputation of it, lies near or below the nominal level, and we estimate the offline search for weak ciphertexts under a cap of $2^{64}$ or $2^{80}$ decapsulation queries. Three distinct mechanisms are relevant. (i)~\emph{Correlated decoding blocks.} DTRU decodes 16-coefficient DoubleE$_8$ blocks; in the tricyclotomic ring $\mathbb{Z}_q[x]/(x^n-x^{n/2}+1)$ and the LPPNF ring, the two octets of a block are ring-paired and the repetition code places the same bit on both. Our covariance-aware estimates raise the DFR of six of the seven sets by roughly $50$--$110$ bits. Their estimated uncapped first-failure costs are $2^{85}$--$2^{111}$ decapsulations. Under a fitted ciphertext-tail model, DTRU-648, DTRU-768, and DTRU-Prime fit within $2^{64}$ expected queries after $2^{22}$--$2^{26}$ estimated offline encapsulations. (ii)~\emph{Omitted compression noise.} Cheetah compresses its public key and both ciphertext components. Section~2.2 of the specification omits the public-key term $\langle e_b,r\rangle$, while the $v$-compression error can be treated as a known, ciphertext-dependent shift. Under the coefficient-independence model, exponentially tilted one-dimensional FFTs give DFR estimates of $2^{-79.1}$ and $2^{-51.8}$ for Cheetah128 and Cheetah256, rather than the claimed $2^{-129}$ and $2^{-176}$. Their expected random-query waiting times are below $2^{80}$. We check the noise model at observable rates on a scaled-down instance and against full-size shallow-tail samples. (iii)~\emph{Bounded noise in two-dimensional codes.} Rudraksh2 and Scabbard decode coefficient pairs with B2-Minal codes and already evaluate their joint distribution by two-dimensional FFT. We rederive the two-dimensional atoms and evaluate one-dimensional projections onto failure radii of the real decoder. The resulting projected-tail estimates are $2^{-103.9}$ for Rudraksh2-128-I and $2^{-102.1}$ for Scabbard-128, a few bits below the claimed $2^{-100}$ and $2^{-99}$. Under a $2^{80}$ query cap, the estimated classical totals are $2^{112}$ and $2^{188}$, respectively. No attack described here recovers a key. Under the first-failure DFR metric, several estimated costs lie below their nominal levels; the formal far-tail figures remain subject to the modelling, extrapolation, and geometric limitations stated in the paper.

The Learning With Errors (LWE) problem is a fundamental assumption in post-quantum cryptography. Regev established a quantum reduction from LWE to the Dihedral Coset Problem (DCP). Later, Brakerski et al. introduced the Extrapolated Dihedral Coset Problem (EDCP), proving its equivalence to LWE. However, unlike DCP, EDCP no longer admits a coset structure. This limits the direct application of techniques for hidden subgroup problems. In this work, we introduce the Cyclotomic Coset Problem (CCP), a cyclotomic generalization of DCP that preserves an exact hidden-subgroup structure. Let $\zeta_p$ be a primitive $p$-th root of unity, let $\pi=\zeta_p-1$, and write $q=p^t$ and $L=t(p-1)$. We work over $R_q=\mathbb Z_q[\zeta_p] \cong \mathbb Z[\zeta_p]/(\pi^L)$, where the isomorphism follows from the total ramification identity $(p)=(\pi)^{p-1}$.We exploit the resulting $\pi$-adic ideal chain to construct a quantum sieve that successively reduces phase states modulo $\pi^{L},\pi^{L-1},\ldots,\pi$. For every fixed prime $p$ and modulus $q=p^t$, our algorithm solves the CCP in time and sample complexity $2^{O_p(\log n\log q)}$, using polynomial quantum space. The sieve also applies to uniform EDCP and Gaussian $S\ket{\text{LWE}}$, yielding quasi-polynomial time algorithms for all the above problems when $q=\text{poly}(n)$. This extends the power-of-two EDCP sieve of Bai et al. (CRYPTO 2025) to a cyclotomic setting. However, we emphasize that our result does not, by itself, yield a quasi-polynomial-time algorithm for standard LWE, because the currently known reduction produces only a limited number of approximate CCP states.

We present SUCRE, a novel countermeasure designed to physically protect the rejection sampling step of ML-DSA, one of the post-quantum signature schemes standardized by NIST. At the core of SUCRE is a masking gadget that securely unmasks a vector while simultaneously applying a random permutation of its coefficients. This lightweight mechanism preserves the vector’s infinity norm, enabling rejection sampling to proceed as usual without requiring any complex mask conversions. We formally prove that a $d$-probing adversary can learn at most some permuted rejected values---information which, we show, should remain insufficient to endanger the security of the signature scheme. This security argument relies on a new variant of the Module Learning with Rounding (MLWR) assumption, for which we provide a dedicated concrete security analysis to assess its hardness relative to the standard MLWR assumption. Our implementation of SUCRE achieves a significant performance improvement over previous masked non-bitsliced implementations of rejection sampling---delivering four to six times faster execution than Coron et al. (TCHES 2024)---albeit at the cost of increased memory usage. Since the rejection step accounts for approximately 25% of the total runtime in masked ML-DSA implementations, and given the expected adoption of ML-DSA on embedded platforms, this speedup could significantly enhance efficiency in real-world applications.

MAYO is a post-quantum signature scheme based on UOV that uses the whipping transformation to achieve more compact public keys and retain efficient signing. We present the first structural forgery attack that exploits the geometry of the resulting multivariate quadratic (MQ) maps. Our starting point is the observation that whipping amplifies polar cancellations in the underlying MQ map, producing subspaces with low-dimensional quadratic and polar images. We combine this geometric insight with the Pseudo-Oil Attack (ASIACRYPT 2026) and a descent to the binary field into a structural forgery algorithm. Independently, we introduce a multi-target reduction for homogeneous MQ maps. Projecting onto a quotient of the codomain reduces the number of equations, and homogeneity allows suitable solutions to be rescaled to the original targets. Concretely, the combination of our forgery attacks lowers the estimated bit security of the Security Level I and III parameter sets of MAYO Round 2 by roughly 18 and 16 bits, respectively. In particular, the Level I parameter set falls 15 bits short of its required security level. For the recently released MAYO Round 3 parameters, our attack still reduces the estimated security by roughly 6, 4 and 2 bits for the new MAYO1, MAYO2 and MAYO3 respectively, bringing MAYO2 below the required security by 3 bits.

Decentralised proof of personhood, cryptographically binding a digital identity to a unique living human without a trusted central authority, is a foundational problem in permissionless networks. We present a novel protocol, Secure-GYID (S-GYID), resilient to Identity Theft Attack (i.e., adversarial authorities substitute a victim's biometric fingerprint under a malicious public key) and Ghost Key Attack (i.e., colluding authorities fabricate a registration for a non-existent user). Our protocol closes both vulnerabilities by replacing raw biometric transmission with an encryption-based digital fingerprint derivation $F = E(pk_u, P_u)$ computed under a one-way, chosen-plaintext-secure, deterministic scheme, so that no authority can substitute or forge a binding pair without knowledge of the user's secret key. S-GYID further introduces a three-stratum generational authority hierarchy with bounded tenure and VRF-based session selection to limit long-term collusion structurally. We prove Identity Theft Resistance, Biometric Detectability, and Ghost Key Resistance under standard cryptographic assumptions, and provide a hypergeometric session-capture analysis that establishes concrete parameter design rules for both the key activation and authority promotion thresholds.

We give an elementary construction of large Reed-Solomon lists on multiplicative subgroups. For every fixed rational rate $\rho\in(0,1)$, suitable sequences of lengths give lists of size at least $2^{(2-o(1))H(\rho)/\eta}$ at agreement fraction $\rho+\eta$ as $\eta\to0$, where $H$ is binary entropy. This doubles the leading entropy exponent of the antipodal lower bound stated by Arnon, Boneh, and Fenzi, building on the construction of Krachun, Kazanin, and Haböck. If the reduced denominator of $\rho$ is a power of two, the lengths can also be chosen as powers of two. The construction lifts subsets with a prescribed product from a quotient subgroup of size $s$. This fixes a coefficient while losing at most a factor $s$ in the number of subsets. More precisely, for $n=hs$, $h\ge2$, and $1\le m\le s-2$, a code of dimension $\kappa=mh$ on a subgroup of order $n$ has a word with at least $\binom{s-1}{m+1}/s$ codewords at agreement $\kappa+2h-1$. This holds over every field containing the required roots of unity. Consequently, the exponent constant $c_2$ in the universal list-size conjecture of the S-two whitepaper must satisfy $c_2\ge2$.

Non-uniform security allows an adversary to receive bounded advice about an oracle before attempting a fresh challenge. This captures the most realistic attacks and has already been studied extensively in prior work. In this work, we introduce an operator-norm approach for non-uniform security in the quantum random oracle and random permutation models. This new approach yields a unified reduction for both search success probability and distinguishing advantage. Previously, the reduction only worked with success probability even in the decision games, yielding a worse bound. Our framework enables tight bounds for Yao's box, both with and without salting, and improved bounds for pseudorandom generators. We also prove an optimal generic salting theorem for decision games. By defining a property of a game, which separates the contributions of the existing queries in the offline stage and subsequent online queries, we obtain stronger bounds for specific salted constructions. These include salted permutation inversion, tight up to logarithmic factors, and salted random-function inversion, tight up to logarithmic factors and the gap already present in classical function inversion.

POKÉ, introduced by Basso and Maino, is one of the most efficient isogeny-based public-key encryption schemes. The generic parallel-encryption approach yields a $(t,n)$-threshold variant by running $n$ independent POKÉ instances and secret-sharing the message, but this multiplies the public-key and ciphertext sizes by roughly $n$. We present S-TPOKÉ, a POKÉ-based $(t,n)$-threshold construction for every $1\le t\le n$, and Ch-TPOKÉ, an $(n,n)$ variant that arranges the parties' secret isogenies differently. Both schemes avoid repeating part of the isogeny computation that appears in every independent POKÉ instance. Compared with the trivial construction, they reduce the number of degree-$3^{b}$ isogenies computed during encryption from $2n$ to $n+1$ and reduce the ciphertext size by about a factor of two when $n$ is large. The two schemes differ in how the parties' secret isogenies are arranged. S-TPOKÉ is our main construction: the dealer samples $n$ independent secret isogenies, while encryption samples one sender-side secret isogeny and shares it across the parties. Ch-TPOKÉ instead arranges the parties' secret isogenies into a chain. For S-TPOKÉ, we prove SIM-CPA security under static corruption in the random oracle model from the $(k,n)$-S-C-POKE assumptions for all $1\le k\le t$, which extend C-POKE to the threshold setting. For Ch-TPOKÉ, we prove only SIM-CPA security under static maximal corruption from the $(j,n)$-Ch-D-POKE assumptions for all $j\in\{1,\ldots,n\}$, which extend D-POKE to a chain-based threshold setting. This guarantee is strictly weaker than SIM-CPA security under static corruption. We also give asymptotic parameter choices targeting $\lambda$-bit security and derive closed-form expressions for the public-key, ciphertext, and partial-decryption sizes in terms of $\lambda$ and $n$.

Homomorphic encryption (HE) enables privacy-preserving inference by allowing neural networks to operate directly on encrypted data, but its computational cost remains a major obstacle to deploying large language models in practice. In particular, CKKS-based inference consumes ciphertext modulus through homomorphic multiplications and requires costly bootstrapping when the available modulus is exhausted. In this work, we propose an error-propagation-aware scale design for efficient CKKS-based privacy-preserving LLM inference. We characterize the numerical errors introduced by individual homomorphic operations and analyze how they propagate through subsequent Transformer computations. Based on this analysis, we quantify the contribution of each local error to the final inference error and determine the precision required for individual operations. We then allocate operation-wise scales and modulus levels accordingly, avoiding unnecessarily conservative precision while maintaining the target inference accuracy. As a result, more computation can be performed within a given modulus chain, reducing the frequency of costly bootstrapping operations and improving overall inference efficiency. Compared with THOR, our method reduces modulus consumption by 30.0% and the number of bootstrapping operations by 83.6% for the standard Transformer. For the HE-friendly Transformer, our method reduces modulus consumption by 33.6% and the number of bootstrapping operations by 80% compared with PowerFormer.

The XOR of two or more independent random permutations (XoP) is the prototypical pseudorandom function built from permutations achieving the security beyond the birthday bound. The security of the XoP construction is now well established against classical adversaries, however, its security against quantum adversaries that query the construction in superposition has remained widely open. We prove that the XOR of $r\ge 2$ independent random permutations over $\{0,1\}^n$ is indistinguishable from a random function by any $q$-query quantum algorithm with advantage \[ O\left(\min\left\{ \frac{q^3}{2^{rn}},\frac{q^{1.5}}{2^{(r-0.5)n}},\frac{1}{2^{(r-1.5)n}} \right\} \right) \] for all $q\le 2^n/57774$, where the hidden factors depend only on $r$. In particular, the XoP construction remains secure throughout the entire query range, far beyond the $2^{n/3}$ quantum birthday bound due to the quantum collision finding attack. To our knowledge, this is the first construction from permutations that achieves the quantum version of the beyond birthday bound security. We present several heuristic attacks suggesting the tightness of our bounds. For $q\lesssim 2^{n/2}$, the quantum collision finding-based attacks heuristically give the advantage $\Omega(q^3/2^{rn})$ and $\Omega(q^{1.5}/2^{(r-0.5)n})$, and for $q\approx 2^n$, the heuristic collision counting-based attack appears to have the advantage about $2^{-(r-1.5)n}$. We use a Fourier-analytic variant of the polynomial method on the space of functions: the distinguishing advantage of any $q$-query quantum algorithm is controlled by the Fourier components of degree at most $2q$, which is controlled by $2q$ input-output data of the construction. Most components are bounded as a $\ell_2$ norm of the Fourier weights of the XOR of permutations, which gives the bound $2^{-(r-3/2)n}$. For the bound $q^3/2^{rn}$, few low-degree components are too large. We reinterpret these low-degree components as (sums of) distinguishing advantages of the other problems. For example, the degree-2 and degree-4 terms are interpreted as the advantages against random functions with and without \emph{planted collisions}, which in turn are bounded using Zhandry's small-range distributions. Finally, the $q^{1.5}/2^{(r-0.5)n}$ bound can be proven using another bound for the planted collisions. This new bound is proven using the compressed oracle by interpreting the advantage as the other bound about random functions. It also gives a new bound for the small-range indistinguishability for (ironically) large ranges, which is of independent interest.

We present two seed-recovery attacks on a family of local PRGs, which map an $n$-bit random seed to an $m$-bit pseudorandom string by applying $\XorMaj$ predicates. For PRGs with large locality, we extend the Group-and-Solve (GAS, Eurocrypt 26) framework to Guess-Filter-Solve (GFS). GFS first guesses that a set of seed bits are all $1$s and then filters for outputs whose inputs to $\Maj$ contain a sufficiently large subset of the guessed bits. Then high-bias noisy equations can be collected for the correct guess and solved by specific solvers. Compared with GAS, GFS collects substantially more noisy equations with high bias and hence outperforms GAS significantly, especially when the output is short. For example, for the challenge parameter $n=256$ and $m=2^{16}$ (STOC 16), the complexity for GFS is $2^{68.78}$ while it is $2^{157.91}$ for GAS. In addition, the asymptotic complexity of GFS is $2^{0.15n+o(n)}$. Independently, inspired by the Guess-and-Decode (GADec, TIT 22), we propose the Filter-Guess-Propagate (FGP) attack. Compared with GADec, FGP introduces two speed-up techniques at each iteration of Belief Propagation (BP): a filter scheme to reduce the number of equations and a dynamic-programming technique to update the log-likelihood ratios of variables efficiently. Together, these improvements enable FGP to perform fast BP and outperform GADec significantly. For $\XorMaj_{10,64}$ with $n=256$ and $m=2^{40}$ (Eurocrypt 24), the total complexity of FGP is $2^{52.66}$, whereas even a single BP iteration of GADec costs $2^{106.42}$. We further extend FGP to $\XorMod$ predicates and experimentally evaluate the resulting attack complexity. We also apply FGP to a ZKP protocol from Eurocrypt 25 and QuietOT from Asiacrypt 24, with only a small computational overhead. For the ZKP protocol, FGP leads to an attack on witness indistinguishability, while for QuietOT, it similarly yields an attack on OT receiver privacy.

The Fujisaki-Okamoto (FO) transform makes ML-KEM IND-CCA secure by re-encrypting the decrypted message and returning an implicit-rejection value on any mismatch. Deployed implementations of ML-KEM and its predecessor Kyber have realized this check incorrectly: a skipped conditional move (pqc_kyber/cosmian_kyber, RUSTSEC-2026-0290/-0288) and truncated ciphertext comparisons (wolfSSL, CVE-2026-10097 and CVE-2026-6330). We ask how much of the check must be broken before the key is recoverable, and show that one unverified ciphertext coordinate suffices. For a valid ciphertext the adversary knows the encryption randomness, so sweeping an unverified v-coordinate over the compression grid measures the decryption noise there, a known short-coefficient linear form in the secret; one bounded-error observation per message, solved by least squares, recovers the key. Under a regularity assumption we prove that O(kn log kn) observations identify the key, and we demonstrate full recovery from a single unverified coordinate on all three parameter sets in a few times 10⁵ decapsulation queries against a simulated incomplete comparison built on the kyber-py implementation, with ML-KEM-1024 cheapest owing to its finer compression grid. Sessions fall inversely with the number of unverified coordinates but query cost does not: one unverified coordinate costs what a leaked tail of fifty does. The skipped conditional move yields a complete plaintext-checking oracle and Θ(kn) queries.

A $(T,N)$-threshold signature scheme distributes a signing key among $N$ participants so that any $T$ participants can jointly generate a valid signature, while fewer than $T$ cannot. In this work, we first introduce a threshold one-time signature scheme with \emph{identifiable abort} based on a variant of Lamport one-time signature and Shamir secret sharing, enabling authorized participants to jointly reconstruct signatures from partial signatures. We then extend the scheme to support multiple messages using multi-layer Merkle trees. One-time signatures introduce specific coordination challenges: participants must agree on both the message and the one-time key index to avoid unsafe key reuse. We address this using a bulletin-board mechanism for consensus. Under this framework, our construction produces signatures with one message from the bulletin board to each signer and one response message from each signer, while the bulletin board may require additional communication to reach agreement. With a simple majority-vote bulletin board, the scheme signs in four rounds. Subject to this coordination constraint, the construction inherits the guarantees of the underlying threshold framework: Universal Composability (UC) unforgeability with identifiable abort, non-UC robustness, and a bulletin-board mechanism that is UC-secure with an honest super-majority and robust when the central aggregator is honest.

Hash-based signatures offer a conservative foundation for post-quantum authentication, but their large signatures impose substantial communication and storage costs. For security parameter $\lambda$, discrete-logarithm-based signatures have length $O(\lambda)$, while known hash-based constructions have quadratic signature length, up to logarithmic factors, even for one-time signing. Is this gap inherent? We prove what are, to the best of our knowledge, the first lower bounds on the length of signature schemes in the (pure) random oracle model. Our bounds apply to schemes with non-adaptive verifiers and a natural security property called salted soundness: a scheme with such security is unforgeable even against an adversary that is granted a limited ability to resample and restore oracle answers. This class essentially captures all known hash-based constructions (possibly after low-cost modifications). We show that the combined public-key and signature length of a one-time signature scheme must be $\Omega(\lambda^2/\log\lambda)$. For many-time signatures, we prove the stronger conclusion that the signature length alone must satisfy the same lower bound, irrespective of the public-key length. More precisely, if the relevant length is $o(\lambda^2/\log\lambda)$, then an adversary making $2^{o(\lambda)}$ random-oracle queries breaks salted soundness with inverse-polynomial probability. Our proof uses the high-entropy hitting lemma of Haitner, Nukrai, and Yogev (Crypto 22) to transform a short signature scheme into a scheme whose verifier makes only a few queries. We then apply the Barak and Mahmoody-Ghidary (FOCS 07) attack on one-time signatures with a low-query verifier. Balancing these two steps yields the near-quadratic lower bounds.

We determine all input differences with constant whole-output XOR derivatives for a four-word ARX topology containing FEILIAN SubColumn. For every word width $w\geq2$ and arbitrary XOR-linear internal maps, the complete linear-structure space contains a universal two-dimensional MSB family and has dimension at most five, with equality attained. We give a necessary-and-sufficient classifier involving at most 32 candidate masks and characterize all additional structures, including an exceptional coset possible only when the first map's image lies in the span of the least and most significant bits. For the specified 64-bit FEILIAN component, the complete space is exactly the universal family. With FEILIAN's actual ShiftRow, no nonzero member remains constant after both of the first two SubColumn layers. We also classify propagation at every boundary for all 20,160 invertible binary four-row mixers composed with ShiftRow. The five profiles stabilize by the third SubColumn layer, and exactly 4,032 mixers (20%) retain a nonzero family indefinitely. Algebraic proofs are supplemented by exhaustive small-word checks and a separate census audit. These results concern component structures and constancy at successive boundaries; they neither classify all endpoint structures of the iterated permutation nor establish an attack on the hash.

In-the-head signatures provide a route to post-quantum authentication based on symmetric primitives. Their algebraic instantiations rely on constraint relations that faithfully encode the underlying one-way function (OWF). We give a classical, public-key-only forgery attack on AIM2-based AIMer v2.0; AIMer was selected in Korea's KpqC competition. For every honestly generated public key of every v2.0 parameter set, the attack forges signatures on arbitrary messages with probability one, without signing queries. We introduce a \emph{null-branch witness attack} exploiting zero factors that leave intermediate values unconstrained. We complete these local assignments into witnesses satisfying the full relation, including public-output binding, using only public data and without solving an OWF inversion problem. Prover completeness ensures that the original message-bound prover can use these witnesses to generate signatures accepted by the unmodified verifier. Proof-system soundness applies to the encoded relation, which the constructed witnesses satisfy. Tests with reference implementations confirm accepted forgeries from satisfying witnesses whose decoded values are not valid OWF preimages. The median AIMer-256f forgery API time is approximately $11.6$ ms in our reference benchmark. We identify a gap in AIMer's security reduction: a satisfying relation witness need not decode to an OWF preimage. A complementary application to vulnerable Lynxer variants extends the analysis to VOLE-in-the-Head. We give quadratic encodings that are sound and complete for the full AIM2 and Lynx computations, including zero inputs. These results highlight relation encoding as a distinct security obligation between OWF hardness and proof-system soundness.

In~\cite{sarr25}, Sarr introduced an embarrassingly parallel impersonation attack against ECMQV and ECHMQV-C whose core step is an adding-based pseudo-random walk over a cyclic group $G$, of order $n$, searching for a \emph{decomposed $i$-point}. In this work, we revisit that construction in the richer multi-party setting where two sets of parties, the initiators $\{\hat{A}_1,\cdots,\hat{A}_{z_1}\}$, and the responders $\{\hat{B}_1,\cdots,\hat{B}_{z_2}\}$, interact under ECHMQV-C. First, we exhibit an embarrassingly parallel attack such that, when $m$~processors are available, the attack runs in expected time $$ \frac{\sqrt{n}}{m\,z_1 z_2}\left(\costa(z_1)+\costd(z_1 z_2)\right), $$ wherein $\costa(z_1)$ is the time for a batch of $z_1$ elliptic-curve additions and $\costd(z_1 z_2)$ is the time for a batch of $z_1 z_2$ digest computations. Second, for any positive integer $z_3$ such that $z_1 z_2 z_3\ll \sqrt{n}$, we propose an improved attack that runs in time $$ \frac{\sqrt{n}}{m\,z_1 z_2 z_3}\left(\costa(z_1 z_3)+\costd(z_1 z_2 z_3)\right), $$ Third, for ECMQV, assuming $z_1z_3 \ll \sqrt{n}$, we propose an attack that runs in time $$ \frac{\sqrt{n}}{m\,z_1 z_3}\costa(z_1 z_3).$$ The attacks require no shared storage among processors, they require respectively $\mathcal{O}(z_1 z_2)$, $\mathcal{O}(z_1 z_2 z_3)$, and $\mathcal{O}(z_1 z_3)$ memory complexity at each processor, and only marginal server--processor communication. As a concrete illustration, for a 128-bit ECHMQV-C instance, with $m=2^{10}$ processors, $z_1=z_2=2^{15}$, and $z_3=2^{10}$, our improved attack yields an effective parallel running time corresponding to 78 bits of security under an idealized massively parallel architecture in which the required batch elliptic-curve additions can be evaluated concurrently. This figure refers to parallel time rather than total computational work, which remains proportional to the number of elliptic-curve additions performed.

We present the first rigorous security analysis of the Resource Public Key Infrastructure (RPKI), an IETF standard for protecting inter-domain routing from basic yet effective attacks: prefix and subprefix hijacks. Existing evaluations of RPKI's security focus on empirical studies: adoption measurements, simulations evaluating the security provided by different adoption levels, and identification of implementation and specification flaws. In contrast, we focus on rigorous, modular security specifications and analysis of RPKI, including its interactions with the Border Gateway Protocol (BGP) and the Internet Protocol (IP). We identify sufficient conditions for RPKI to provably achieve its goals (requirements), under explicit, well-defined assumptions (models). We show that existing RPKI deployments do not always meet these conditions, e.g., because of circular dependencies, and propose standard-compliant improvements that restore them.

The ICCS Next-Generation Commercial Cryptography (NGCC) round-1 call received 84 public-key candidates for public evaluation. We present a design-level assessment that targets weaknesses no local code fix can close, identifying eight such flaws. Each recurs a pitfall already known from NIST PQC standardization: reducible-ring sub-ring projections that break IND-CPA below the claimed level; public data that fixes a value meant to remain secret, enabling public-key-only forgery or keyless decapsulation; static-key reuse without a chosen-ciphertext transform; and rejection sampling whose sign handling leaks an equivalent signing key. All findings were obtained with AI assistance. Artifacts: https://github.com/acprk/ngcc-round1-cryptanalysis.

We derive joint truncated differential (TD) probabilities from multiple differential-linear (DL) approximations and use them in a framework for preimage filtering. For a fixed input difference, the inverse Walsh transform recovers the probabilities of affine output cosets from DL correlations over a complete mask subspace. In our applications, these correlations are estimated using the round-based DL method. A filter accepts a selected union of affine cosets, whose probability is computed from their joint distribution without assuming independence among the DL events. The framework handles multiple targets, sharing base evaluations and confirming each accepted candidate only once. An independent sampling analysis allows candidate sets from different iterations to overlap and relates success probability to confirmation cost. Applying this framework, we obtain the first preimage attacks on KNOT-Hash below the designers' claimed preimage bounds, for $9$ to $12$ rounds. For all four JH members, we obtain preimage attacks on the reduced-round hash functions under the padding rule of the specification, covering $3$ rounds per compression-function call forJH-224/256/384 and $4$ rounds for JH-512, with speedups ranging from $2^{54}$ to $2^{158}$ over generic preimage search. For reduced-round SKINNY-Hash, we also present the first second-preimage attacks on target messages containing at least two padded blocks, covering $5$ and $6$ rounds of SKINNY-tk2-Hash and $5$, $6$, and $7$ rounds of SKINNY-tk3-Hash. As a further application of the DL-to-TD construction, we give a $6$-round TD distinguisher on Xoodoo/Xoodyak in the related-key setting, whose estimated sample complexity improves on the previous best by about $25$ bits.

We study classical and quantum indistinguishability of sums of independent random permutations and related transformations from permutations to functions. Let $G$ be a finite abelian group of order $N$, and let $\pi^k_+(x)=\pi_1(x)+\cdots+\pi_k(x)$ for $k\geq2$ independent uniform random permutations of $G$. We give a unified Fourier analytic treatment in which the construction is represented by its probability density and a distinguisher by its acceptance function, with the classical and quantum query models imposing different restrictions on the Fourier support of the latter. Classically, we obtain the bound $O_k(q/N^{k-1/2})$ for every $q<N$, and refine it below the birthday threshold to $O_k(q^2/N^k)$. In the quantum model, a simulation argument gives $O_k(N^{-(k-3/2)})$ for $q\leq(N-1)/2$, while Fourier interpolation gives concrete finite bounds up to $q\leq4N/15$ and the query-dependent bounds \[ O\!\left(\min\left\{N^{-1/2},\frac{q^3}{N^2}+\frac1N\right\}\right), \qquad O_k\!\left(\min\left\{\frac{q^3}{N^k},N^{-(k-3/2)}\right\}\right), \] for $k=2$ and $k \geq 3$, respectively, throughout $1\leq q\leq(N-1)/2$. For $q = 1$, the first bound sharpens to $O(N^{-2})$. Over $G=\mathbb F_2^n$, a one-query Fourier attack matches the order of our one-query bound, while an $N/2$-query parity attack with advantage $1/2$ shows that our bounds reach the constant-advantage query threshold. We further study two variants of sum of permutations over binary vector spaces. First, we allow arbitrary surjective linear postprocessing, which includes truncation, and obtain classical and quantum bounds that retain the output-size dependence. Second, we analyse Dinur's variable-output single-permutation construction, $\mathsf{LXoP}$, for every fixed output width, and derive its classical and quantum security bounds; for one- and two-block outputs, we give concrete quantum security bounds.

We study local rewriting after an assumed erasure step in an ideal oblivious-transfer protocol. Bob transforms his retained record while Alice's actual record remains fixed. Exact rewriting between shared-source and independent-source records is possible in both directions precisely when the retained records of the shared source are independent. For balanced deterministic maps retaining $k$ and $\ell$ bits from an $n$-bit source, the optimal error over the maps is $\max\{0,1-2^{n-k-\ell}\}$. For fixed full-row-rank linear maps, it is $1-2^{-d}$, where $d$ is their row-space intersection dimension. A nonlinear example shows that an optimal approximate rewrite may change Bob's marginal distribution.

We give a strict generalization of the LLL algorithm over number fields, based on the reduction theory of $\mathrm{GL}(n)$ over the adele ring of a number field. Our algorithm is free of heuristics, with rigorous bounds on output quality and complexity. As a consequence, we obtain a hierarchy of reductions from module-(H)SVP to ideal-HSVP, an example of which has runtime and approximation factors subexponential in the field degree. More importantly, we uncover a close connection between structured lattice reduction and a Diophantine approximation over number fields.

The Fiat--Shamir transformation is a fundamental paradigm in cryptography for compiling interactive public-coin protocols into non-interactive arguments. While this transformation has been extensively studied for public-coin protocols, the setting of private-coin protocols, where the verifier's messages depend on secret randomness, remains largely unexplored. To date, there are no candidate transformations for private-coin protocols, neither in the standard model nor in idealized settings. In this work, we present a generic transformation that compiles any 3-message private-coin interactive proof into a non-interactive argument in the standard model, while preserving zero-knowledge. Our construction relies on sub-exponentially secure indistinguishability obfuscation, pseudorandom functions, and input-hiding obfuscation (IHO). As a corollary, this rules out the existence of 3-message weak zero-knowledge proofs with small enough soundness error. We complement this positive result by showing that the reliance on IHO is inherent: any secure Fiat--Shamir transformation for general private-coin protocols necessarily implies the existence of IHO. Finally, we rule out Fiat--Shamir transformations for multi-round private-coin protocols. Specifically, assuming the existence of collision-resistant hash functions, we prove that no such transformation exists in the multi-round setting.

\Falcon{} is a digital signature scheme based on NTRU lattices, known for its compact signatures. Its weak-smoothness variant, \FalconWS{} (ASIACRYPT 2025), reduces signature sizes by allowing narrower Gaussian sampling distributions. Further reductions require efficient sampling at narrower widths and a security analysis that accounts for the resulting distributions. We analyze the distribution of accepted preimages directly, without estimating the smoothing parameter of the NTRU lattice. We also modify the rejection-corrected Klein--GPV sampler to reduce sampling cost while controlling the resulting distributional error. We combine these results to construct \FalconPP{}, a variant of \Falcon{}, and give UF-CMA and SUF-CMA bounds in the classical random-oracle model. For ring degrees $512$ and $1024$, our estimates give signature sizes of $419$ and $921$ bytes, respectively. These are $37.09\%$ and $28.05\%$ smaller than \Falcon{} signatures, and $11.60\%$ and $5.92\%$ smaller than the estimates for \FalconWS{} at their respective parameter sets.

We present a key-recovery attack on the knapsack McEliece-based public key cryptosystem recently proposed by G\'omez-Torrecillas, Lobillo, and Navarro in DCC 2026. Given the public key alone, the attack recovers the complete private key in time polynomial in the bit-length of the public key, and therefore constitutes a total break. The attack combines two observations based solely on the public key. An integer combination of the public entries whose coefficients sum to zero eliminates the secret mask. If such a combination is also orthogonal to the public key and sufficiently short, then its coordinates are divisible by the corresponding private key integers. The modulus required for correct decryption creates a large norm gap between these short vectors satisfying the hidden private key relations and the remaining vectors in the lattice. LLL reduction exploits this gap to recover the short vectors and hence the corresponding divisibility relations. The private key integers and the remaining secret parameters are then recovered by combining information from multiple overlapping lattices and using greatest common divisors. We implemented the attack in SageMath and recovered the complete private key for all twenty four parameter sets proposed by the authors within 3 seconds, despite claimed security levels ranging from $64$ to $156$ bits. Our analysis further shows that the weakness is structural rather than a consequence of the particular parameter choices.

Deep learning-based side-channel analysis (DLSCA) is dominated by CNNs and from-scratch Transformer architectures, while pretrained Large Language Models (LLMs) as side-channel distinguishers remain largely unexplored. We present the first systematic study of seven off-the-shelf pretrained LLMs (DeepSeek, Falcon, GPT-J, GPT-2, GPT-2m, Qwen2, T5) on three masked AES datasets, i.e., ASCADf, ASCADv, and eShard. With lightweight fine-tuning and no architectural redesign of the backbone, Falcon and GPT-2m reach GE=1 on ASCADf in only 12 to 16 traces (16, 12 and 12 traces for Falcon and 15, 14 and 13 for GPT-2m on desync0, desync50 and desync100) and uniquely sustain this trace count under desynchronization, an order of magnitude below the best prior desynchronized results. The strongest reported alternatives, EstraNet (13 traces) and Order-vs-Chaos (1 trace), are bespoke architectures trained from scratch and report only synchronized results, while other CNN- and Transformer-based baselines degrade substantially under desynchronization. The pretrained LLMs additionally extract exploitable leakage from all 16 first-round AES key bytes, the first such result outside of multi-task CNNs trained from scratch. We further provide the first per-share evaluation and the first interpretability analysis of LLM-based SCA using Effective Perceived Information (EPI), revealing a correlation between the models' leakage extraction capability and their attack performance. Strikingly, randomly initialized backbones perform on par with their pretrained counterparts, indicating that much of the advantage is architectural rather than derived from language pretraining. Our findings establish LLM architectures as unexpectedly powerful, robust, and reusable side-channel distinguishers whose inductive bias yields very low trace complexity and strong robustness to desynchronization.

The BAG-Loong reference implementation samples its secret matrices X and Y from fixed, publicly known subspaces, although the specification calls for secret random supports. This makes the public-key relation S = HX + Y , with public H, amenable to Gaussian elimination. Expanding the relation over F2 and projecting away the support of Y leaves a linear system for X. We prove an exact recovery criterion based on its column rank. All 40 supplied known-answer-test records, covering four parameter sets, satisfy this criterion: two independent solvers recover each X exactly, and the unmodified decapsulation code reproduces the corresponding session keys. For the largest parameter set, the reduced system has 9360 equations in 728 unknowns per column; one elimination solves all 15 columns.

Post-quantum signature schemes such as ML-DSA, FN-DSA (Falcon), and SLH-DSA have significantly larger keys and signatures than their classical counterparts, making compact multiparty signing an increasingly important research problem. We survey more than 30 schemes published between 2021 and 2026, covering threshold and dis tributed signing, proof-based aggregation, and algebraic half-aggregation. Our survey shows that most existing work is designed around blockchain and validator-consensus applications, where large numbers of mostly ho mogeneous signers sign a common message and accountability is typically represented by a compact signer set. We found that a different and practically important setting has received little attention: institutional multiparty document signing, where tens to hundreds of signers may use different post-quantum schemes or parame ter sets during a gradual migration, while requiring non-interactive sign ing and exact per-signer accountability. To study this gap, we develop an eight-dimensional taxonomy based on deployment requirements and sys tematically classify existing approaches. We also formulate three testable hypotheses and propose a common benchmark methodology for evalu ating communication, computation, verification cost, scalability, signer heterogeneity, and accountability. Our analysis finds no published study that quantitatively evaluates the institutional workload across the ag gregation paradigms covered in our survey. We therefore identify the key experimental and architectural requirements for assessing whether ex isting post-quantum aggregation techniques can support heterogeneous, accountable, and non-interactive institutional signing.

SQIsign holds the smallest known combination among post-quantum signatures, and its dimension-2 signature carries an auxiliary curve whose only role is to make the response computable in dimension 2. SQIsignHD's dimension-4 response has no such curve. We take that construction to the round-3 SQIsign primes, which replaced the round-2 primes in September 2026 after the attacks of Wesolowski and others, on our Rust port of the SQIsign reference code, and measure it in one session next to the reference's own assembly build. At NIST level I the dimension-4 signature is 142 bytes against 200 for the specification's format, with an 84-byte public key: 226 bytes for key and signature together, the smallest level-I combination we are aware of, among isogeny schemes and post-quantum signatures alike, at parameters that stand after those attacks. The price is verification: the dimension-4 verifier costs 9.9 times the dimension-2 verifier of the same code (120.3 against 12.2 megacycles). The dimension-4 parameters published with SQIsignHD are for its authors' own primes; we derive them for the round-3 primes, state which choices are SQIsignHD's and which are ours, and report what was built and measured.

There is currently a strong interest in designing standard-compatible threshold cryptographic primitives, a trend bolstered by NIST's Call for Multi-Party Threshold Schemes (NIST IR 8214C). While Multi-Party Computation (MPC) can be applied to the construction of threshold Key Encapsulation Mechanism (KEM) from NIST standard ML-KEM scheme to preserve the compatibility with ML-KEM, such a direct construction yields a high number of threshold decapsulation rounds as many as 384 for MK-KEM-512. In this paper, we optimise the round complexity of MPC-based threshold ML-KEM decapsulation. Our first construction (Scheme A) uses masked predicates, parallel coin expansion and global scheduling methods to improve the round complexity of MPC-based ML-KEM decapsulation, while maintaining ML-KEM encapsulation, public key and ciphertext formats. For ML-KEM-512, 768 and 1024, our construction improves the round complexity to 145, 218, and 290, respectively. We also introduce a variant (Scheme B) that uses an MPC-friendly variant of Kyber KEM and KangarooTwelve hash to further improve the round complexity to $35$ at the security level of ML-KEM-512, without full ML-KEM compatibility. In the semi-honest MPC model, we prove Scheme A security by exact composition with ML-KEM, and Scheme B IND-CCA security in the QROM from Module-LWE and negligible decryption failure.

Incrementally verifiable computation (IVC) [Valiant, TCC '08] allows one to iteratively prove that a configuration $x_0$ reaches a configuration $x_T$ via $T$ repeated applications of a (possibly non-deterministic) machine $\mathcal{M}$. An IVC scheme is fully succinct if the proof size is independent of both $T$ and the size of the intermediate configurations. In this work, we develop a new indistinguishability obfuscation ($i\mathcal{O}$)-based approach to IVC that avoids the extraction-based security analyses central to prior constructions. Assuming subexponential hardness of $i\mathcal{O}$ and one-way functions, we construct an adaptively sound fully succinct IVC scheme for deterministic computations. This yields the first IVC for deterministic computations that does not rely on algebraic assumptions. Under the same assumptions, we further obtain a fully succinct two-hop IVC scheme for $\mathsf{NP}$ with non-adaptive soundness, allowing one to prove that $x_0$ reaches $x_2$ via an intermediate configuration $x_1$. This is the first IVC scheme for $\mathsf{NP}$ achieving full succinctness. Our constructions are based on a new connection between IVC and secret sharing for $s$-$t$ connectivity in graphs.

Multi-agent systems built on large language models (LLMs) are increasingly being deployed in high-stakes settings such as finance, healthcare, and software engineering, where agents coordinate through natural-language messages. These same communication channels, however, can also enable colluding agents to exfiltrate confidential information or coordinate unauthorized actions. Steganography makes such behavior particularly difficult to detect by hiding covert communication within outputs that appear ordinary to an auditor reading the transcript. Existing provably undetectable LLM steganography protocols, however, are not suited to realistic deployments. High-capacity schemes typically assume a symmetric setting where the receiver can reproduce the sender's output distribution. The state-of-the-art practical protocol for asymmetric agents has very low capacity. Additionally, most existing approaches rely on a pre-shared secret key. In this paper, we make the systematic threat of undetectable agent collusion concrete by proposing Codetta, a high-capacity steganographic protocol for independently deployed agents under realistic asymmetric settings. Codetta combines a shared public model for estimating the communication channel, a sampling mechanism that preserves the sender's output distribution, and an adaptive error-correcting code for high-capacity communication. It further removes the need for a pre-shared secret key through a steganographic key-exchange protocol, enabling independently deployed agents to establish a shared key while keeping their communication transcript computationally indistinguishable from ordinary model outputs. Across three agent workloads and three sender models, Codetta achieves up to $94\times$ the capacity of the state-of-the-art asymmetric protocol. Its key exchange establishes a shared key using approximately 80k visible tokens, with an empirically certified failure probability of at most $4.1\times10^{-3}$ across all three workloads. These results show that effectively undetectable collusion is becoming feasible even between independently deployed agents, and we suggest that auditing mechanisms must be amended with complementary techniques beyond simply inspecting agents' communication transcripts.

We study interactive proofs of proximity (IPP) for model evaluation: a resource-limited verifier interacts with an untrusted prover, typically the model owner, to certify statistical properties of a model under an unknown input distribution. Our formulation is shaped by the constraints of practical evaluation: it separates sampling the input distribution from querying the model and evaluating its output, allowing their costs and access patterns to be treated independently; it distinguishes real audit data (black-box sampling) from generated data (chosen-randomness, or gray-box, access to the sampler); and it allows the prover and the verifier to score outputs with different evaluators, as happens when scores come from human or judge models. We focus on doubly-sublinear $\mathsf{IPP}$s, in which both the verifier and the designated honest prover use sublinear resources, and on (weighted) Hamming weight properties, which capture the expectation of a Boolean evaluation rule under an unknown distribution and, consequently, a broad range of model-evaluation statistics. As a first step, we give a tolerant $\mathsf{dsIPP}$ for ordinary Hamming weight. For completeness and soundness radii $\varepsilon_c <\varepsilon_f$ and gap $g=\varepsilon_f-\varepsilon_c$, its logarithmic-round instantiation uses $\tilde{O}(1/g)$ verifier queries and $O(1/g^2)$ honest-prover queries, improving the cubic dependence of Amir, Goldreich, and Rothblum [ITCS 2025]. We prove matching query lower bounds up to polylogarithmic factors. We then study distribution-weighted Hamming weight under several access models. Under black-box sampling, the verifier uses $\Theta(1/g^2)$ samples but only $\tilde{O}(1/g)$ evaluations, and we show that the quadratic sample complexity is necessary in the interior regime. With chosen-randomness access to a sampler, the problem reduces to ordinary Hamming weight, giving $\tilde{O}(1/g)$ verifier calls and evaluations. When the two parties' evaluators may disagree arbitrarily on a $\rho$-fraction of the distribution and by up to $\gamma$ elsewhere, we give protocols that remain doubly sublinear whenever $g$ exceeds twice the mean mismatch $\kappa = \rho + (1-\rho)\gamma$. Finally, we show how our technical results can improve the efficiency of model evaluation in natural motivating scenarios by shifting the bulk of the evaluation burden to the model owner while letting any number of auditors verify claims cheaply; we apply them to auditing criteria including accuracy, group fairness, calibration, harmlessness, usefulness, and average-case robustness.

The security of isogeny-based signatures is almost exclusively studied in the single-user setting, leaving a gap for realistic multi-user deployments. This gap is especially crucial for CSI-FiSh, where the small challenge space and parameter sensitivity directly impacts security estimates. We address the multi-user security of CSI-FiSh and obtain tight concrete classical multi-user bounds in the random-oracle model (ROM) plus generic group-action model (GGAM). Crucially, our analysis only incurs an additive degradation in the number of users rather than a multiplicative one. As a byproduct, we show that CSI-FiSh attains $125$ bits of provable classical security even with $2^{46}$ users. We extend this analysis to preprocessing attacks, where an adversary with nation-state resources can perform offline precomputations. We capture this by extending the preprocessing security framework of Coretti et al. to ROM+GGAM and obtain concrete multi-user bounds for CSI-FiSh with preprocessing. Finally, we address the multi-user security of CSI-FiSh in the quantum random-oracle model and obtain results in the algebraic group action model which also avoids this multiplicative loss. This gives a unified concrete security treatment of plain CSI-FiSh in the deployment regimes where multi-user and preprocessing effects are unavoidable.

Setting concrete parameters for group action based cryptographic protocols is notoriously difficult due to the incomplete understanding of the concrete efficiency of Kuperberg's subexponential quantum attack. Estimates for the CSIDH group action do exist in the literature, but they do not easily translate into meaningful estimates for the many recent and far more efficient alternative group actions. In this paper, we implement the recent qt-Pegasis group action framework as a (simulated) quantum circuit, allowing for concrete estimation of its efficiency and Kuperberg's attack. Our results suggest that using a 2048-bit base field in qt-Pegasis offers reasonable quantum security, while a 4096-bit base field is required to reach NIST security level 1.

The communication complexity of computing a function in the two party setting can be much smaller than requiring one of the parties to send its input. We revisit how this communication complexity must change if the function must be computed securely. Hubáček and Wichs show that any protocol for computing a function securely must communicate at least as many bits as the length of the function's output. However, all positive results in this direction require much more communication than optimal. In particular, the state of the art for general protocols requires a $\textit{multiplicative}$ overhead polynomial in the security parameter, achieving only ''rate 0'' asymptotically. We show that, assuming the existence of input-succinct indistinguishability obfuscation for Turing machines, it is possible to achieve constant rate for this task. This compiler works even when the original protocol communicates single bits in each round, which is the main obstacle in prior works, and necessitates the use of obfuscation. The compiler can be based on standard non-succinct indistinguishability obfuscation for circuits (instead of Turing machines) in the common random string or random oracle models.

Weak and shallow pseudo random functions form a new class of symmetric primitives that is seeing a growing relevance, from their use in the initialization phase of some MPC protocols to the internals of some FHE-based protocols. However, their security is hard to ensure: "weak" means that chosen plaintext attacks are irrelevant, and "shallow" means that their construction cannot be round-based: in this exotic setting, how can we define secure PRFs? In this paper, we investigate EALPN, a recent proposal of this type. We identify critical blind spots in the initial asymptotic analysis of the designers: the role of l, one of its parameters, turns out to be crucial. Indeed, we present a key recovery attack with a complexity that is polynomial in all other parameters, and whose complexity grows exponentially but still slowly with l. As a consequence, some parametrizations intended to provide 128 bits of security only offer 37 bits. Our attack is based on novel use of the belief propagation algorithm. Our analysis of its efficiency in our specific setting can be of independent interest.

Feige, Lapidot, and Shamir [FOCS'90] presented a generic approach for building non-interactive zero-knowledge proofs via the notion of hidden-bits generators (HBGs). At a high level, an HBG allows a prover to statistically commit to a $k$-bit pseudorandom string in the CRS model with a succinct commitment. Later, the prover can open this pseudorandom string at an arbitrary subset $S \subseteq [k]$ of positions by providing a proof $\pi_S$. The hiding property requires that unopened positions remain pseudorandom. In this work, we study the efficiency of HBGs, focusing on direct constructions that make black-box use of cryptography. We obtain the following results: Succinct CRS: Assuming learning with errors (LWE), we construct an HBG with {\em succinct} CRS of size $\mathsf{poly}(\lambda,\log k)$ for generating $k$ hidden bits. This achieves an exponential improvement over a recent sequence of works by Waters [STOC'24], Branco et al.~[EUROCRYPT'25], and Waters, Wee, Wu~[EUROCRYPT'25] that required a CRS of size at least $k \cdot \mathsf{poly}(\lambda)$. Batch opening: Using pairings, we construct an HBG with batch opening, where the proof size for any subset is $ \mathsf{poly}(\lambda)$. Previously, this was only known from the Naccache-Stern public-key cryptosystem [Groth, ASIACRYPT'10]. Succinct CRS and Batch opening: Assuming the hardness of RSA, we construct an HBG where both the CRS and the opening proof for any subset are of size $ \mathsf{poly}(\lambda,\log k)$. No black-box constructions achieving this efficiency were previously known.

Polar-KEM is a lattice-based key encapsulation mechanism submitted to the Next-generation Commercial Cryptographic Algorithms Program. Its security is claimed to rely on a lattice isomorphism problem over polar-code-defined Construction-D lattices. In its core key-generation algorithm, a polar lattice basis is constructed from a polar-code chain, reduced using LLL, and left-multiplied by a secret orthogonal matrix. The resulting matrix is published as the public key. We show that the key-generation procedure does not instantiate a general lattice isomorphism problem. The reduced reference basis is generated through a public chain of computations: public parameters determine frozen sets, the frozen sets determine a polar-code chain, the code chain determines a Construction-D basis, and the basis is then reduced by the public LLL procedure. Under the natural executable interpretation of the specification, an adversary can reproduce the same reduced basis. If the public key is \ensuremath{B_{\mathsf{pk}}=O B_{\mathsf{red}}}, the secret orthogonal matrix is recovered by the single linear-algebra operation $$ O=B_{\mathsf{pk}}B_{\mathsf{red}}^{-1}. $$ The attack is polynomial time and recovers the exact secret isometry, or its numerical representation, without solving a shortest-vector problem or a general lattice isomorphism problem. We also examine the erasure parameter used by the frozen-set selection algorithm. The specification neither assigns it a concrete value nor defines it as a sampled secret with a distribution, encoding, entropy requirement, or storage mechanism. Treating this unspecified value or unspecified LLL tie-breaking as secret entropy would define a different scheme and would not repair the published construction. The present paper focuses on this direct basis-alignment weakness. Additional structural and correctness analyses are left to an extended version.

Facilitating value transfers with a scriptless chain is a longstanding problem in cryptography. We present a cross-chain messaging and value transfer protocol that maintains game-theoretic atomicity even when one party is operating on a chain which is fully scriptless, such as shielded Zcash, which has no scripting capabilities at all and requires transactions to be virtually identical. The observation is that consensus protocols which utilise segregated witness schemes to ensure transaction ID unmalleability (such as ZIP 244 in Zcash, SegWit in Bitcoin) segregate transaction data from the transaction witness component (which is the part that is actually signed). The transaction identifier is, therefore, a virtually collision-resistant commitment to the effects intended by the transaction, computable before signing, and in many chains, even without the knowledge of the signer. A contract on another chain can therefore recompute a future transaction ID from the few fields it needs to see, such as the recipient, the value and the expiry, while every other part of the transaction arrives as an opaque digest. It learns that any transaction with this ID has the agreed effect, without learning anything about the sender and without the recipient signing anything. An optional zero-knowledge layer hides the recipient and value as well. Combined with a light client for the settlement chain on the Turing-complete chain, this yields fully trustless verification that a shielded payment occurred, with no validator consortium or multisig that can be hacked or stalled.

Succinct arguments are central cryptographic objects, underlying various applications such as blockchains and image authentication. Almost all succinct arguments used in practice follow the commit-and-open paradigm introduced by Kilian (STOC 1992): commit to a probabilistic proof, then open the few locations the verifier queries. Decades of work have generalized and optimized this paradigm, yet its exact provable security in the standard model remains unclear. Existing analyses proceed by rewinding, and they leave gaps: strict-time analyses lose an inverse-polynomial factor, while expected-time analyses are sharper but apply only to special cases of this paradigm. We resolve both gaps. On the negative side, we show that the strict-time loss is inherent: no strict polynomial-time reduction relying on a black-box extractor can achieve negligible knowledge error (unless the underlying language is easy). On the positive side, we give a new expected-time analysis, achieving negligible soundness and knowledge errors via an expected polynomial-time reduction against expected polynomial-time adversaries, at the full generality of the paradigm, capturing multi-round and functional variants such as polynomial and linear IOPs compiled with the corresponding commitments. This is the first standard-model analysis to reach this regime for succinct arguments deployed in practice.

We record the following bound: almost all Boolean functions $f : \{0,1\}^n \times \{0,1\}^n \to \{0,1\}$ require $2n - 2\log n - O(1)$ bits of communication for perfect two-party conditional disclosure of secrets with a one-bit secret. This only gives a factor 2 improvement over the previous best bound due to Applebaum, Holenstein, Mishra and Shayevitz [EUROCRYPT 2018], but at least (nearly) matches the input length. The proof is a straightforward compression argument that uses the birthday bound to give a succinct representation of transcript collisions (the latter being a technique from Feige, Kilian and Naor [STOC 1994], refined in Applebaum et al.). Viewing transcript-collision testing as an elementary case of distribution testing extends the argument to imperfect correctness and privacy. We do not currently know how to extend the argument to an explicit hard predicate.

We discover two laws governing public-key key exchange and public-key encryption. The first states that a non-interactive key-exchange scheme is secure only if it is kleptographically insecure. The second states that a public-key encryption scheme is secure only if it is kleptographically insecure. They give two impossibility results: no kleptographically secure non-interactive key exchange with pseudorandom shared keys exists, and no kleptographically secure public-key encryption with pseudorandom ciphertexts exists. More precisely, no non-interactive key-exchange scheme can simultaneously establish pseudorandom shared keys and support black-box execution in which the user observes only the public keys and the final shared keys output by the black box, and no public-key encryption scheme can simultaneously have pseudorandom ciphertexts and support black-box execution in which the user observes only the public keys and plaintexts input to the black box and the ciphertexts output by it. Our argument turns the very shield of a primitive into a spear against itself, showing that the security guarantee of the primitive is precisely what enables a kleptographic attack. We instantiate the laws with two post-quantum schemes: CSIDH and Regev encryption.

Government portals often issue PDF certificates whose provenance can be verified only through a live HTTPS verification service. Proving a limited fact from such a document therefore commonly requires disclosing the complete document or giving the verifier access to the portal. We present GovBind, a protocol that combines zkTLS provenance with a zero-knowledge content proof, without requiring the issuer to modify its service or embed an independently verifiable signature. A baseline construction binds both stages through a commitment to the complete response body. To make client-side proving feasible for compressed PDFs, an optimized construction instead commits separately to private ranges, discloses the remaining bytes, requires their exact partition, and opens the claim-bearing compressed stream in a document profile-specific proof that constrains DEFLATE decompression. We formalize GovBind with game-based definitions of correctness, soundness, and privacy, where soundness jointly captures authenticity, content validity, and binding, and we prove both constructions secure relative to the explicit leakage and trust assumptions of Proxy-mode TLSNotary. Our prototype supports proofs of no overdue tax debt, bounded traffic penalties, and residence city over documents returned by the Turkish government verification service, e-Devlet. Across 72 generated proofs in 24 sessions, end-to-end generation took 54-119 seconds, verification took 44-127 milliseconds, and proofs were 11-12 KiB.

We construct the first Batched Threshold Encryption scheme with a \emph{transparent} setup where public parameters are \emph{independent} of the batch size. As a result batches of arbitrary sizes can be decrypted, without imposing an a priori fixed bound. We prove security under a constant size assumption -- the decisional bilinear square Diffie--Hellman assumption. Setup is just a distributed key generation protocol to sample secret shares of a random value. Ciphertexts consist of two $\mathbb{G}_1$ elements, one $\mathbb{G}_2$ element and the encrypted message, plus a NIZK for CCA security (two $\mathbb{F}$ elements with a sigma protocol). Partial decryptions are a single $\mathbb{G}_1$ element, computed with one scalar multiplication. Decrypting a batch of $B$ ciphertexts costs $O(B)$ pairings and $O(B\log^2 B)$ group operations. In the ramp setting, with a gap between the reconstruction threshold $t$ and corruption threshold $f$ as in consensus protocols with $n\ge3f+1$, we construct a pairing-free batched threshold encryption scheme from DDH whose partial decryptions are $2B/(t-f)$ group elements, and reduce the aggregation cost of our pairing-based scheme to $O(B\log^2(B/(t-f)))$ group operations.

ZKPoSP proves that a public key or address was honestly derived from a hidden wallet seed, without revealing the seed or the private derivation state. This paper studies relationships among several derived values: whether public keys or addresses, possibly on different curves and different blockchains, share a hidden origin, which is the seed or an anchor of the wallet, and who else can recognize this relation. We give a model for such provenance proofs, with derivation proofs, which carry a link value, and provenance proofs, which show that several derivation statements share an origin. We define correctness, derivation soundness, provenance soundness, non-frameability and unlinkability. We give four constructions, which differ in who can link: only the user, with a joint proof or with commitments linked later; anyone within a linking context, with a deterministic tag, which can also act as a nullifier; or a designated authority, with an encryption of that tag. We prove, in sketch form, that the constructions satisfy the five properties under the security of the ZKPoSP derivation relations, the random oracle model, and the zero knowledge and simulation extractability of the proof system. We describe an application to cross-chain transfers from Bitcoin to Solana, in which the payout address must come from the same wallet as the source address, so that an attacker cannot substitute the destination. We report Plonky3 benchmarks of the derivation proofs on which the constructions are built.

Inspired by the recent polynomial-time adaptive attacks on threshold Schnorr signatures, we contextualize the Low-Dimensional Vector Representation (LDVR) assumption and its impact on relevant threshold Schnorr signature schemes. Our analysis focuses in large part on FROST, a widely deployed threshold Schnorr signature scheme. However, our analysis is applicable to any relevant threshold Schnorr signature scheme, such as Lindell's three-round threshold Schnorr protocol. We show that for cases where FROST is used with 131 parties and fewer, and for parameter choices of 128-bit generic (discrete log) security, FROST is secure for any signing threshold. This bound increases to 260 parties for parameter choices of 256-bit security; our analysis similarly can be extended to other parameter choices. This bound assumes the best possible LDVR adversary, even more powerful than the results by Rodríguez García and Tessaro. In other words, for real-world uses of FROST with parameter choices of 128-bit security, and with a small (131 and fewer) number of parties, the security of FROST is determined entirely by the hardness of the Algebraic One-More Discrete Logarithm (AOMDL) assumption, as LDVR is unconditionally hard for this parameter regime. It is an open research question whether the concrete attacks given by Rodríguez García and Tessaro can be improved to approach the unconditional LDVR security bound considered in our analysis. We then show for each additional party for 132 total number of signers and greater, again for parameter choices of 128-bit generic security, the resulting security of FROST is at worst reduced by approximately one bit (or less) of security for the worst-case choice of corruption threshold. This analysis can be used by practitioners to determine the worst possible security of even large-scale FROST deployments. Finally, we give two variants to FROST that build upon prior masking techniques to allow for full adaptive security. The first variant allows for masking keys to be derived from Diffie-Hellman identity keys, allowing for constant memory overhead, at the tradeoff of increased computation. The second variant allows for a 50% reduction in memory overhead for storage of pairwise masking keys, by employing symmetric key predistribution techniques.

Secret sharing distributes a secret among participants so that only sufficiently large groups can recover it. Fully anonymous secret sharing also allows recovery from share values alone, without participant identities. Below the reconstruction threshold, the shares must look exactly like independent uniform random values, revealing neither the secret nor their holders' identities. Con, Li, and Mazor established that such schemes with error-free recovery exist for every threshold, leaving an efficient general construction open. We give efficient constructions for every threshold 2 ≤ t ≤ n among n participants. For an L-bit secret, each share has L + O(t² log² n) bits. Sharing runs in expected polynomial time, and reconstruction runs in deterministic polynomial time. Our approach combines an efficient one-bit construction with a general transformation that uses it to protect a short message needed for anonymous reconstruction of a long secret. The additional share length has an upper bound depending only on the number of participants and the threshold. For a fixed participant count and threshold, the rate approaches one as secrets grow longer, while anonymity remains exact and recovery never errs.

The standardization of post-quantum cryptography, notably ML-KEM, introduces a severe network bottleneck: large public keys and ciphertexts often exceed the Maximum Transmission Unit (MTU) limits of UDP-based protocols. This size explosion inevitably leads to unreliable IP-layer fragmentation or forces complex protocol workarounds. To overcome this, we propose a novel design philosophy for post-quantum Authenticated Key Exchange (AKE). We challenge the rigid cryptographic paradigm that mandates negligible decryption failure rates (DFR). By safely trading minor, manageable decryption failures for aggressive size compression, we drastically reduce the bandwidth footprint of lattice KEMs in ephemeral exchanges. We demonstrate this approach via a compact AKE for the Internet Key Exchange protocol (IKEv2). Integrating standard ML-KEM into IKEv2 currently necessitates the high-latency IKE_INTERMEDIATE exchange (RFC 9242) to distribute large payloads. By employing our compressed KEM design (800-byte public key, 928-byte ciphertext), the entire key exchange fits within the initial IKE_SA_INIT packet, completely eliminating the need for RFC 9242. To ensure that protocol aborts caused by decryption failures do not introduce security vulnerabilities, we formalize IND-CPAF (Indistinguishability under Chosen Plaintext Attack with Failures) to rigorously bound failure-dependent leakage. More importantly, we prove our IKEv2 instantiation still secure in the classical Canetti-Krawczyk model. Finally, our implementation in the strongSwan IPsec library confirms a fragmentation-free handshake: over 10,000 real-world connections, it achieves a 48.8 ms average setup time---matching classical ECDH---and keeps initial packets strictly under the 1280-byte IPv6 MTU, with merely a 0.002% retry rate.

Communication is a central efficiency bottleneck in garbled circuits. Rosulek and Roy (CRYPTO 2021) introduced \emph{slicing} and \emph{dicing}, obtaining a garbling scheme in which XOR gates require no communication and each two-input AND gate costs \(1.5\lambda + 5\) bits, where \(\lambda\) is the security parameter. In this work, we investigate the power of these techniques for garbling gates of larger fan-in. We develop a linear-algebraic framework that yields concrete constructions and asymptotic bounds. For three- and four-input gates, we obtain constructions with communication costs $7\lambda/3 + 35$ and $15\lambda/4 + O(1)$ bits, respectively. For arbitrary fan-in \(n\), we give a construction for any single-output gate with communication cost bounded by \(22 \cdot 2^n\lambda/n + 2^n\) bits. Our constructions are compatible with free-XOR, and all hash queries within each gate are nonadaptive. We prove security of the framework in the random-oracle model and under a circular correlation robustness (CCR) condition for any number of slices. We also evaluate simple uses of the three-input construction against the best two-input circuits collected in our experiments, finding evidence of communication savings on control circuits.

Central Bank Digital Currencies (CBDCs) aim to replicate the utility of physical cash in the digital era by balancing privacy with regulatory auditability. Despite recent advancements, existing CBDC schemes suffer from limited concurrency and the lack of offline payment confirmation, forcing users to process concurrent payments one by one and requiring counterparts to remain online. These constraints severely limit CBDC's applicability in high-frequency, real-world payment scenarios. This paper proposes PulpoPay, the first CBDC scheme to provide high concurrency and offline confirmation, while maintaining auditable privacy. To achieve high concurrency and offline confirmation, PulpoPay, at its core, introduces a coin-based payment protocol that facilitates users to concurrently withdraw, transfer, and deposit coins without synchronization or online requirements for counterparts. For auditable privacy, we leverage signatures on randomizable ciphertexts to enable fine-grained auditing without compromising privacy. Furthermore, we design a coin identifier with offline-checkable uniqueness to resist double-spending attacks even in disconnected (offline) environments. We formally prove PulpoPay's security within the Universal Composability (UC) framework. We implement a prototype of PulpoPay. Experimental results demonstrate that (1) a payment with an offline receiver can be finished within 0.3~s using a mobile phone; (2) PulpoPay outperforms the state-of-the-art PEReDi [CCS'22] in the scenarios of concurrent payments. For a typical setting of 200 concurrent payments, PulpoPay reduces processing time by at least 66.89% and communication overhead by at least 76.45%. This advantage becomes even more significant as the number of concurrent payments grows.

The module lattice isomorphism problem (module-LIP), introduced with HAWK, has attracted growing interest. Its most studied case is ${\mathcal O_{\mathbb{L}}}^2$-LIP, underlying HAWK key recovery, where $\mathbb{L}$ is a power-of-two cyclotomic field and ${\mathcal O_{\mathbb{L}}}$ its ring of integers. Three recent independent algorithms reduce this $2n$-dimensional problem to polynomially many exact-SVP calls: the Claude-derived algorithm uses dimensions at most $n/2+1$, and the ChatGPT-derived and Mureau--Pellet-Mary algorithms use $3n/4+1$. These improve Ducas's generic $\mathbb Z$LIP bound $n+1$ (DCC 2024). Although known SVP methods still give exponential running times, the impact on parameter selection led the HAWK team to withdraw the scheme. All three approaches rely substantially on rank-two structure. Higher-rank module-LIP is a possible direction for alternatives, calling for further study of its hardness. We first use the symmetric square to obtain a rank-two reduction, matching the bound $3n/4+1$ above. Its auxiliary objects correspond geometrically and algebraically to those of the ChatGPT-derived algorithm, so this does not constitute a substantively new reduction; the differences lie in the interpretation and post-processing. This viewpoint nevertheless motivates our dimension reduction in rank four. In rank four, the conjugate Hodge star on the exterior square yields a publicly computable fixed lattice isometric to $\mathbb Z^{3n}$, from whose orthonormal basis we reconstruct a module isomorphism. For ${\mathcal O_{\mathbb{L}}}^4$-LIP with the standard free module as reference, we reduce the $4n$-dimensional problem to polynomially many SVP calls in dimensions at most $3n/2+1$, improving the generic bound $2n+1$. All computation outside the oracle runs in deterministic polynomial time.

The complexity of fast correlation attack is fundamentally determined by the correlations of the linear approximations used. Conventional fast correlation attacks either rely on a single dominant linear approximation or use the lower bound to evaluate the resulting correlation of multiple linear approximations, which have the same output mask and distinct input masks. How to exploit multiple linear approximations with distinct output masks remains an open problem. In this paper, we propose a framework of fast correlation attack exploiting multiple linear approximations called \texttt{MultLA} to solve this problem. \texttt{MultLA} utilizes the arithmetic mean of the absolute correlations of linear approximations, rather than the lower bound of that. For SNOW 5G, our attack has time/memory/data complexities of ${{2}^{279.25}}/{{2}^{265.03}}/{{2}^{263.62}}$, which are all better than those of the existing work. When the time and memory complexities are slightly better than those of the existing work, the data complexity is significantly reduced from ${{2}^{265.4}}$ to ${{2}^{261.21}}$. To the best of our knowledge, our attacks achieve the best known cryptanalytic results of SNOW 5G up to now.

Fuzzy Password-Authenticated Key Exchange (fuzzy PAKE) was introduced at Eurocrypt'18, enabling two parties to securely establish a shared cryptographic key using passwords that are close and potentially low-entropy. This is a generalization of standard PAKE and is particularly useful for handling mistyped passwords or inherently “noisy” samples such as biometrics. While this primitive sounds promising, existing definitions and protocols face several challenges: they may suffer from gapped leakage (namely, leakage of a small amount of information from failed authentications), or they may be restricted to Hamming distance. We review the functionality and describe our contributions below: 1. Leakage under Reuse. We show that, when a password may be reused across multiple sessions, any leakage from the functionality has the same eventual compromise consequence under repeated use. Concretely, we construct an efficient ideal-world adversary that recovers an n-character password within O(n) active sessions, assuming it starts from a password not too far from the target. Our attack applies to both Hamming distance and Minkowski (L_p) distance under reasonable parameter choices. This implies that, for common distance metrics in practical settings, several notions of leakage are effectively unified when passwords are reused, thereby resolving an open question from Eurocrypt'18. 2. Supporting L_p Distances. We propose substantially more efficient protocols for generalized Minkowski (L_p) and Hamming distances in the random oracle model. As a key technical step, we show how to achieve malicious security using only a semi-honestly secure oblivious key-value store, while addressing several subtleties in the proof. Concretely, compared with existing approaches for L_2 distance, our protocol reduces runtime by about 86% and bandwidth by about 99%.

Multi-key fully homomorphic encryption (MKFHE) supports homomorphic computation over ciphertexts encrypted under independently generated keys. Known constructions accommodate independent keys by expanding every ciphertext under the concatenation of the participating secret keys, and then evaluating the circuit in that expanded dimension. A concatenated key is $N$ times longer than an individual key, so the ciphertext on each wire and the running time of each gate grow with $N$, the number of users. L\'opez-Alt, Tromer, and Vaikuntanathan, who introduced MKFHE, asked for a scheme in which all algorithms are independent of $N$. More than a decade later, no MKFHE scheme has a homomorphic evaluation whose cost is even sublinear in $N$. We construct the first MKFHE whose homomorphic evaluation asymptotically matches that of single-key FHE, while users still generate their keys and encrypt independently and the participating set is chosen only after encryption. We insert a public, deterministic, and non-interactive preprocessing phase between encryption and evaluation: key aggregation combines the selected public keys, and ciphertext preparation converts each independently encrypted input into a short single-key ciphertext under a \emph{virtual key}, namely the sum of the participating secret keys. Evaluation then runs on ordinary single-key ciphertexts, so every wire ciphertext, every gate, and the decryptable output are independent of $N$. We give two instantiations, a leveled GSW-based scheme over $\mathbb{Z}_q$ from standard LWE and a leveled BFV-based scheme over cyclotomic rings from circular Ring-LWE. Both retain single-round distributed decryption with statistically simulatable partial decryptions, where the published key material grows with $N$. As a proof of concept, we implement our ring-based construction in Go. For 32 users, its multiplication is $275.13\times$ and $45.50\times$ faster than CDKS and KKLSS, and its ciphertexts are $16.5\times$ smaller than both.

Hash-based signature schemes present an appealing proposition: they are broadly regarded as the most conservative in terms of assumptions, and their efficiency profiles suit many applications. However, little is known about their compatibility with threshold signing, which is common practice today in domains like digital asset security. Especially in the context of an impending migration to post-quantum cryptography, this gap in the literature leaves uncertain what hash-based standards would imply for applications that rely on threshold signing. In this work, we develop a new framework by which to analyze such hash-based schemes, and prove inherent barriers to designing an entire class of efficient (fully distributed) threshold signing protocols. Our framework is simple, and yet powerful. Our results encompass standard schemes such as XMSS and SLH-DSA. Our approach is to connect hash-based signatures to the literature on straight-line extraction in the random oracle model. We then apply and build upon techniques from the recent work of Doerner et al. (Crypto '24) to show that threshold signing protocols for hash based schemes must—beyond a certain number of signers—use the circuit representation of the hash function, i.e. it can not use the hash function as a black box. We then give a more fine-grained analysis for the specific case of the Winternitz signature scheme—a building block of both NIST standards—and show that it can not permit even two-party signing with blackbox use of the hash function.

We study the matrix signing problem for positive semidefinite matrices, assigning one sign to each original matrix regardless of its rank. This includes the higher-rank Kadison--Singer partition problem [KS59] when the matrices sum to the identity. For arbitrary positive semidefinite matrices $A_1,\ldots,A_m\in\mathbb C^{n\times n}$, we prove that there are signs $\sigma_i\in\{-1,1\}$ such that $\|\sum_i \sigma_i A_i\|\le 3.34963\|\sum_i \operatorname{tr}[A_i]A_i\|^{1/2}$. We give a deterministic algorithm achieving this bound in $\widetilde O(mn^2+n^{4.75})$ real arithmetic operations. Inspired by the Lee--Sidford barrier, we use a potential function built from Schatten norms to obtain a square-root logarithmic dependence on the rank. Under the additional assumptions $\sum_iA_i=I$, $\|A_i\|\le\alpha$, and $\operatorname{rank}(A_i)\le r$, we obtain a discrepancy of at most $\min\{1,3.48745\sqrt{\alpha\log(2r)}\}$. We also give a deterministic algorithm achieving a discrepancy of at most $\min\{1,4.171\sqrt{\alpha\log(2r)}\}$ in $\widetilde O(mn^2+n^{6.38})$ real arithmetic operations. This dependence on $\alpha$ and $r$ is optimal up to an absolute constant when $0<\alpha\le1/256$ and $r\ge256\alpha^{-6}$: even diagonal matrices can force every signing to have a discrepancy of at least $\min\{1,\sqrt{\alpha\log(2r)}\}$. For a zero-one incidence matrix with at most $d$ ones in each row and each column, our deterministic algorithm achieves a discrepancy of $O(\sqrt{d\log(d)})$, recovering Harvey's bound [Har15] by a different method. We give a deterministic construction of a single spanning tree that is simultaneously spectrally thin with respect to any given collection of $k\ge1$ positive edge weightings of the same graph, assuming small edge leverage in every weighting. The tree retains the original edge weights, and its thinness bound grows only logarithmically with $k$.

Distribution-aware encryption seeks guarantees tailored to the probability law of the protected data and the secret key. We study simultaneous message-recovery, key-recovery, and target-distribution semantic security for arbitrary finite joint distributions, without assuming that messages and keys are independent. We represent encryption by a decomposition of the joint probability matrix and construct this decomposition through capacity-controlled randomized rounding. A stepwise conditional sampler turns the rounding process into a correct encryption algorithm without enumerating its output distribution or rejecting complete samples. Let $p_\star$ and $q_\star$ be the largest message and key probabilities. Our construction attains the exact message-recovery optimum $\max\{p_\star,q_\star\}$, has key-recovery success below $2q_\star$, and provides $O(\sqrt{q_\star})$ advantage against prediction of every fixed Boolean message predicate. The semantic guarantee follows from negative correlation of the binary row-rounding remainders. We prove that the key-recovery factor cannot be uniformly improved while preserving exact message-recovery optimality, and that the semantic bound has the optimal worst-case order. We also establish additive robustness under distribution error and short-ciphertext existence by preserving only the moments needed for the security proof. The general sampler runs in expected polynomial time in the explicit rational input size; short ciphertexts do not by themselves imply efficient preprocessing or compact public descriptions. Structured sources admit additional efficient implementations.

In order to estimate accurately the impact of large-scale computing devices, one requires a precise resource estimate of quantum algorithms for cryptographic problems. As a start, these algorithms can be described as quantum circuits. One then estimates the number of gates, qubits, and circuit depth that they require, as a first step towards physical resource estimates. In order to simplify this task, different quantum programming languages have been used, targeting different circuit sizes and abstraction levels. Quantum cryptanalysis is indeed a domain in which one may consider both medium-scale circuits with fine-grained optimizations (such as optimizations of Shor's algorithm) and very large-scale circuits with well-defined building blocks (such as exhaustive key search on block ciphers using Grover's algorithm). This paper presents Qarton, a python library to represent logical quantum circuits, focused on quantum cryptanalysis. It allows to study very large-scale circuits like Grover searches, to simulate classical or ``almost'' classical circuits such as the arithmetic building blocks of Shor's algorithm, and to analyze trade-offs between qubit and gate count when switching between different implementations of arithmetic operations. Qarton is equipped with a library of around 300 circuits and examples from different areas of quantum symmetric and asymmetric cryptanalysis.

Recent work has shown that the approximate homomorphic encryption scheme CKKS can perform exact modular arithmetic with large moduli. This enables high-precision integer computation: given bounds on the outputs of an arithmetic circuit, we can recover the exact integer results from the modular outputs using any sufficiently large modulus. The particular choice of modulus does not affect correctness. Long computations require periodic bootstrapping, which refreshes ciphertexts so that further operations remain possible. However, in Gao and Zheng's construction (Crypto '26) and its extensions by Wei et al. and Liu et al. (both ePrint '26), converting between the representations used for arithmetic and bootstrapping, which is required at every refresh, becomes increasingly expensive as the integers grow. We reduce this overhead by choosing message spaces that fit the representations already used inside standard CKKS bootstrapping. Building on GBFV (Geelen and Vercauteren; Eurocrypt '25) and its interpretation within CKKS (Kim; Asiacrypt '26), we organize encrypted data into independent polynomial “lanes” (namely, the factors of $(\mathbb{R}[X]/(X^n+1))^{N/n}$) that already appear as intermediate representations during bootstrapping (as intermediate stages of CoeffToSlot and SlotToCoeff). This avoids additional conversions specific to the message encoding. Supported message spaces include integers modulo $\beta^n+1$, where $n$ is a power of two and $\beta\geq2$ is a small integer, selected prime fields of up to $1\,024$ bits, and extension fields. For integer messages, we also give conversions in both directions between an arithmetic representation (for operations on whole integers) and a digit representation (for operations on their encrypted base-$\beta$ digits). We evaluate our construction and our port of Gao and Zheng in Lattigo on the same AWS Graviton5 hardware, using one thread at $N=2^{16}$ and targeting $128$-bit security. Our bootstrapping latency remains nearly constant for $8\leq n\leq2^{14}$ and stays below $8$ seconds across all tested message spaces, including $24\,577$-bit moduli ($n=4\,096$, $\beta=64$). For $8\leq n\leq1\,024$, this gives a speedup of $2.1\times$ to $6.8\times$ over the port, comparing arithmetic modulo $2^n+1$ with their arithmetic modulo $2^n$. These gains carry over to sustained computation: including bootstrapping to support arbitrary evaluation depth, we estimate amortized multiplication speedups of $3.2\times$ to $12.8\times$ over the port for $8\leq n\leq512$. As one concrete example, arithmetic bootstrapping takes $6.44$ seconds per ciphertext packing $16$ integers modulo $2^{4\,096}+1$. In sustained computation, the amortized cost is $0.22$ seconds per integer multiplication at over $4\,000$ bits of precision, including refreshing. Our arithmetic-to-digit conversion has per-call timings comparable to our implementation of Wei et al.'s conversion for $64\leq n\leq1\,024$ and $\beta=2$, and our analysis indicates better scaling for larger integers.

To address the scalability and flexibility limitations of dedicated point-to-point cabling in broadcast production, the broadcasting community created a suite of standards for carrying media over IP multicast. This shift removes the inherent physical protection that dedicated cabling provides, exposing streams to tampering and eavesdropping. Such threats have been widely reported and pose major risks to broadcasters and their audiences. Despite almost a decade of deployment, the security of IP-based broadcast has received little academic attention. We collaborate with the European Broadcasting Union (EBU) to establish the security and deployment requirements of this environment. We introduce SafeCast, a system to secure the transmission of ultra-high-bitrate multicast media. SafeCast builds on established and standardized protocols (the MLS group key agreement protocol and the SRTP media-protection protocol), while extending and adapting them to the demanding setting of broadcast media. SafeCast provides strong confidentiality and integrity guarantees, and exploits the precise clock synchronization of broadcast networks to achieve cheap per-sender authentication. We evaluate SafeCast against the stringent deployment requirements of production facilities (throughput, latency, large dynamic groups) and find that it can sustain the most common media formats with ample headroom.

Multiparty private set union (MPSU) enables a group of mutually distrusting parties, each holding a private set, to learn the union of their sets without revealing additional information. MPSU is a fundamental primitive with applications to privacy-preserving tasks such as cyber-risk assessment and private record matching. State-of-the-art MPSU protocols require parties to sequentially shuffle encrypted values in order to hide which party contributed which inputs to the final result. We introduce a new paradigm for semi-honest MPSU that eliminates the need for such shuffling. This allows the protocol to run in constant rounds regardless of how many parties are involved. The resulting protocol also benefits from improved parallelism, an information-theoretic online phase, and native support for unbalanced input sizes, a situation most prior works must handle by padding inputs to hide individual input sizes. We implement and evaluate our protocol across a range of party counts, input sizes, and network conditions. In the unbalanced setting, where parties hold unequal-sized inputs, our protocol significantly outperforms the state-of-the-art schemes PULSE (CCS ’25) and DZBC25 (USENIX Security ’25). In the balanced setting, it achieves an order-of-magnitude improvement over PULSE in most settings and outperforms DZBC25 in WAN deployments with 100ms latency.

In a zkTLS protocol, a user proves to a third party a property of data obtained from an online service over TLS, revealing nothing beyond the statement proven. Each existing scheme, however, comes with its own security model, written for that scheme alone, so the schemes are not proven secure against a common definition. The root cause is a mismatch of levels: existing models are stated at the level of TLS and therefore reflect how each construction handles it. Yet TLS is only the transport, and a zkTLS proof is about the application-layer protocol executed over it. We therefore introduce the first transport-agnostic security model for zkTLS, stated at the application layer and mentioning neither TLS nor any particular construction. The resulting notion, Zero-Knowledge Proof of Protocol Execution (zkPoPE), defines what it means for a party that has executed an arbitrary two-party protocol with a counterparty to prove, in zero knowledge, that its private input and the reply it received satisfy a chosen property, and, crucially, that the reply comes from a real execution with that counterparty rather than being fabricated. This proof-of-execution requirement separates zkPoPE from a NIZK over the input--reply pair: knowing a satisfying pair does not by itself show that an execution occurred. We formalize zkPoPE as a UC ideal functionality F_{zkpope}. We then introduce the Reclaim Protocol, a zkTLS scheme that UC-realizes F_{zkpope} under a deployment-aligned trust model and underlies a production system. Reclaim builds on Distributed-AEAD, a new three-party authenticated-encryption primitive of independent interest. On a lower-mid-range phone, Reclaim attests to a 1200kB response in 7.28s, two orders of magnitude beyond any size previously benchmarked for zkTLS.

The dual attack is a central tool for evaluating the security of the Learning with Errors (LWE) problem, which is the foundation of the lattice-based cryptosystems such as ML-KEM. Since the introduction of FFT acceleration by Guo and Johansson (ASIACRYPT 2021) and subsequent optimizations in the MATZOV report, FFT-based dual attacks have achieved concrete security estimates for ML-KEM. However, these results rely on one specific independence heuristic that is known to fail in certain parameter regimes (CRYPTO 2023). Recent work by Pouly and Shen (EUROCRYPT 2024) initiated the study of provable dual attacks through explicit geometric analysis, but restricted the analysis to the orthogonal lattice, requiring approximately \(m\approx2n\) LWE samples. Qu and Xu (ASIACRYPT 2025) subsequently introduced modulus switching into the provable dual-attack setting, enabling evaluation over a smaller modulus, with a revised analysis given in their later version. More recently, a closely related ePrint revisited the concrete complexity estimates of these provable attacks after correcting the norm-bound formula used in the earlier analysis. In this work, we provide a provable correctness analysis of the Guo--Johansson-style FFT-based dual attack over the general dual lattice. By extending the analysis from the orthogonal lattice to $L_q(\mathbf{A}^{T})$, where $\mathbf{y}$ is not restricted to $\mathbf{0}$, we reduce the required number of LWE samples from $m\approx2n$ to $m\approx n$ while retaining the computational efficiency of FFT-based score evaluation. We further derive an explicit upper bound on the false-positive probability via an integral estimate for a geometric distinguishing event. For concrete complexity estimation, we follow the abstractions and cost models used in prior provable analyses while refining the probability-dependent treatment of the norm bounds. We obtain attack costs of $216$, $317$, and $426$ bits for ML-KEM-512, ML-KEM-768, and ML-KEM-1024, respectively. Compared with the recomputed estimates of the previous best published provable dual attack, these represent reductions of $22$, $30$, and $52$ bits, respectively.

Recent work has introduced the Hamiltonian phase state (HPS) assumptions, which postulate that Hamiltonian phase states can be used to instantiate pseudorandom and one-way state generators. Additionally, it has been conjectured that these assumptions can be true, even if one-way functions do not exist. This is exciting, because if true, then the HPS assumptions provide a route to the instantiation of Microcrypt. In this work we falsify this conjecture, by proving that if the HPS assumptions are true, then one-way functions exist. While this removes the possibility of instantiating genuine Microcrypt cryptography with Hamiltonian phase states, it shows that the HPS assumptions provide novel inherently quantum assumptions for the construction of classical cryptography. Technically we achieve this via a method for the construction of one-way puzzles from one-way state generators and tailored "measure first, ask later" state certification protocols. This generalizes prior constructions of one-way puzzles from one-way state generators via classical shadows and allows us to relate properties of the one-way puzzle to properties of the state certification protocol used in the construction. Specifically, if the state certification protocol admits efficient classical post-processing then one obtains an efficiently verifiable one-way puzzle, and if the state certification protocol can be efficiently classically simulated in a certain sense, then one obtains a classical one-way puzzle, which implies one-way functions. The latter observation allows us to prove that the HPS assumptions imply one-way functions, by exploiting properties of state certification protocols for phase states. The former observation provides a new toolbox for the construction of efficiently verifiable one-way puzzles by exploiting tailored state certification protocols for pseudorandom and one-way state generators.

Signatures with Post-Compromise Accountability (SPCA), introduced by Dayanikli et al. at SCN'26, are signature schemes that enable signatures generated before the compromise of a signing key to be distinguished from those produced after the compromise. In this paper, we extend this notion to static group signatures and introduce Group Signatures with Post-Compromise Accountability (GSPCA). GSPCA preserves the anonymity and traceability guarantees of group signatures while enabling pre-compromise signatures to be revalidated after key compromise. The coexistence of opening and revalidation algorithms gives rise to a new consistency requirement, which we formalize as opening--revalidation consistency. We present a generic construction of GSPCA from public key encryption schemes, signature schemes, and simulation-sound non-interactive zero-knowledge proof systems. A central technical difficulty is that the encryption randomness in our construction is derived from a randomized signature component and may therefore have high min-entropy without being uniformly distributed. To address this issue, we introduce adaptive hedged security against adaptive chosen-ciphertext attacks (AH-CCA), which extends indistinguishability under adaptive chosen-ciphertext attack (IND-CCA2) to adaptively chosen high-min-entropy message--randomness distributions, and show how to realize the required randomness-recovering encryption in the random oracle model. We also give a generic signature-based mechanism that provides the required min-entropy and key-binding properties. Finally, we show that ordinary IND-CCA2 security alone is insufficient as a general assumption for our construction by exhibiting an IND-CCA2 secure encryption scheme for which the resulting GSPCA scheme fails to satisfy anonymity.

Secure aggregation with input validation enables a server to securely compute the summation of private data from multiple clients while verifying that the inputs satisfy specific constraints. However, the practical deployment of this paradigm at scale is hindered by two primary limitations. First, existing schemes suffer from severe efficiency bottlenecks due to their reliance on generic, computationally expensive zero-knowledge proofs (ZKPs). Second, the scope of input validation is currently restricted to norm checks (e.g., $L_2$ and $L_\infty$) against public bounds. This paper presents \textsf{Vespa}, a single-server secure aggregation scheme that simultaneously achieves practical efficiency and expands validation capabilities to support both \textit{norm checks against public bounds} and \textit{similarity checks against private server inputs}. Specifically, we design a novel validity-weighted secure aggregation protocol over committed inputs, built upon highly efficient vector oblivious linear evaluation (VOLE). To efficiently realize input validation, we introduce customized $L_2$ and $L_\infty$ norm checks based on VOLE-based ZKPs, centered around optimized range proofs with reduced range sizes. Furthermore, we extend our framework to support advanced similarity-based checks against private server inputs, instantiated with widely used Euclidean and cosine similarities. This allows \textsf{Vespa} to first filter out invalid inputs using norm checks, followed by performing fine-grained validation via similarity metrics. We compare our scheme with the state-of-the-art secure aggregation works, including RoFL (S\&P 2023), ACORN (USENIX Security 2023), and Armadillo (CCS 2025), and extensive evaluation shows that our $L_2$ and $L_\infty$ norm checks achieve runtime improvements of up to $2\sim 3$ and $1\sim 3$ orders of magnitude, respectively. Our similarity checks also achieve practical performance, consuming only around $94$ seconds for an $818$k-entry vector.

Lexical search retrieves documents containing query keywords that require exact matches, such as rare terms, entity names or codewords. Search is increasingly hosted in the cloud, which places both the corpus and every query on infrastructure the data owner does not control. Encrypted lexical search addresses this concern by ensuring no third party, including the cloud provider, learns which queries are issued or which documents are retrieved. The key binding constraints are all on the client — accuracy, memory, computation, and communication — since cloud capacity is elastic. Existing approaches that guarantee full privacy without caveats require prohibitively high client-side persistent storage or communication. We present Lexicure, a protocol for encrypted lexical search that reduces the search to arithmetic operations favorable to cryptographic primitives, such as encrypted matrix–vector products (EMVP). Across sixteen diverse datasets, Lexicure retains over $95\%$ of plaintext BM25 accuracy on average. Lexicure sets a new baseline for leakage-free lexical search, requiring 2.6-9.9$\times$ less communication than alternative approaches and less than 1KB of client-side storage. A major challenge is that secure lexical search is inherently bandwidth-bound. We additionally describe an approach for compressing the communication further in exchange for a larger server. To do so, we introduce a new cryptographic primitive that modifies EMVP to securely compute quadratic and higher-degree functions, more efficiently than a direct reduction. Lexicure demonstrates that leakage-free encrypted search with practical performance is achievable and opens new avenues for secure information retrieval systems.

Unbalanced Oil and Vinegar (UOV) and its variants are among the candidates in the NIST call for additional post-quantum signatures. Their security rests on the hardness of recovering a hidden subspace on which a public system of quadratic forms vanishes. In characteristic $2$ the polar forms of such a system are alternating, which a recent attack exploits by working in the exterior algebra rather than the polynomial ring. Unlike its polynomial-ring counterparts, it either applies at a threshold fixed by the parameters or not at all, and for most proposed parameter sets it does not. We remove this threshold and improve complexity in two independent ways. First, over the integers the square of an alternating polar form is $\omega \wedge \omega = 2\,\omega^{(2)}$, so in characteristic $2$ it vanishes only because the factor $2$ does. Dividing that factor out before reducing leaves the divided square $\omega^{(2)}$, which still vanishes on the oil space but is in general not a consequence of the original equations. Iterating gives a whole tower $\omega^{(2^j)}$ of new equations. Second, the symmetric powers $\textrm{Sym}^d\mathbb{F}_q^n$ and the exterior powers $\bigwedge^a\mathbb{F}_q^n$ are the two extreme shapes of the Schur modules $L_\lambda\mathbb{F}_q^n$. We introduce an extension of Macaulay matrices to an arbitrary shape $\lambda$ which we call Schur--Macaulay matrices. For both constructions we conjecture a Hilbert series and verify it experimentally. We also extend the approach to odd characteristic. The attack then applies to every Round-2 parameter set of UOV, MAYO, SNOVA, and QR-UOV but one. Four of the alternate Round-2 parameter sets of MAYO fall below their claimed security level while being out of reach of all previous attacks. After disclosing preliminary results to the MAYO team, a parameter set designated for Round-3 was discarded and parameters increased. For SNOVA, the divided powers remove the spurious kernel elements that obstructed the exterior algebra attack, and seven of the eleven Round-2 parameter sets fall below their claimed security level, and the complexity estimates drop further compared to previous attacks.

A Gaussian leftover hash lemma (LHL) states that, for a matrix $\mathbf{X}$ with discrete Gaussian columns and a sufficiently wide Gaussian vector $\mathbf{v}$, the product $\mathbf{X}\mathbf{v}$ is close to a discrete Gaussian. Over the integers this is a classical tool, and Albrecht-Felderhoff-Lai-Lapiha-Woo (EUROCRYPT'26) recently extended it to modules over a number field $K$ of degree $d$. In every version, the lemma rests on two facts about the kernel lattice of $\mathbf{X}$: that $\mathbf{X}$ is surjective, and that the smoothing parameter of the kernel is small. We prove both facts with a single analytic estimate. An exact identity expresses the Gaussian mass of the dual kernel, multiplied by the index of the image of $\mathbf{X}$, as an integral of one-dimensional periodic Gaussian sums over a torus. Bounding this integral below two forces the index to be one, which is surjectivity, and bounds the smoothing parameter at the same time. No separate surjectivity argument and no GRH are needed. For smoothing error $2^{-\lambda}$ the smoothing parameter is $O_K(\sqrt\lambda)$ with explicit constants, once $\mathbf{X}$ has $m\gtrsim dr\ln(srm)$ columns, and a deterministic lower bound shows that this order is optimal. The width $s$ of the matrix enters only through the number of columns. Over power-of-two cyclotomic fields the theorem even applies to matrices whose integer coefficients follow a discrete Gaussian of width one. In the SIS-to-$k$-SIS reduction of Albrecht et al. (EUROCRYPT'26), the new bound lowers the hint width from $d^{39/2}\lambda^{9/2}$ to $d^{3/2}\lambda^{3/2}$ and the norm loss from $d^{41/2}\lambda^{5}$ to $d^{3/2}\lambda^{2}$, up to logarithmic factors. Additionally, we also formalized the main results of the paper in Lean.

Pseudorandom codes (PRCs) are error-correcting codes whose codewords are computationally indistinguishable from uniformly random strings to any efficient adversary. Most prior PRC work focuses on Hamming error channels; nevertheless, the few proposed constructions on edit channels are not optimized for a stochastic channel with both Hamming and synchronization errors. We study PRC over a stochastic memoryless Binary Substitution-Insertion-Deletion (BSID) channel and its generalized $q$-ary version. At each current input symbol, the channel inserts a uniformly random symbol without advancing with probability $P_i$, deletes and advances with probability $P_d$, or transmits and advances otherwise; a transmitted symbol is then replaced uniformly by another alphabet symbol with probability $P_s$. We first prove that the majority based PRC construction of Christ and Gunn remains robust over the BSID channel whenever $1-P_i-P_d>0$ and $P_s<1/2$, by proving its majority decoding after the BSID channel recovers more than half of the original coordinates by a constant margin with overwhelming probability. Then we propose a unique-decodable public-key multi-bit PRC on a constant alphabet constructed by letting the Christ--Gunn majority component protect control information and the Haeupler--Shahrasbi synchronization/list-recovery construction encodes the high-rate payload. For every sufficiently large admissible constant alphabet q depending on the channel parameters, the PRC is robust against a q-ary SID channel bounded by $P_i+P_d<1$, $P_s<$1, and its rate approaches the genie-aided capacity upper bound of the channel when q approaches infinity.

VDOO is a Rainbow-like multivariate signature scheme with additional ``diagonal” structure intended to resist structural attacks. We show that its security is governed primarily by the first two oil layers, while the diagonal structure has negligible impact, and that all proposed parameters fail to meet their claimed NIST security levels. We provide a corrected complexity analysis of the Simple and Rectangular MinRank attacks, introduce a hybrid Simple–Padded MinRank attack, and compare their effectiveness. Open-source code is provided for independent validation, clarifying VDOO’s true security and informing future Rainbow-type post-quantum designs.

Wide-block block ciphers have attracted significant interest due to emerging high-throughput encryption requirements and NIST's Accordion Mode Process. The primary choice for such ciphers is Rijndael-256, also known as WAES. At the same time, independent efforts continue to explore more efficient designs and implementations. In this paper, we present LEANY, a 256-bit block cipher with a 256-bit key. LEANY is a nibble-oriented SPN whose state is an 8×8 matrix of 4-bit nibbles. Each round consists of four layers: key addition, a 4-bit S-box layer, row-wise nibble shifts, and multiplication by an 8×8 MDS matrix over $\mathrm{GF}(2^4)$. This structure follows the same shift-then-mix principle as AES, but with a wider state and a smaller cell size. LEANY consists of only 12 rounds. Since the linear diffusion layer has branch number 9, the wide-trail strategy guarantees that every four consecutive rounds activate at least $9^2=81$ S-boxes in any differential or linear characteristic. Consequently, upper bounds on the best differential and linear trail probabilities fall below $2^{-256}$ after seven rounds. We further analyze LEANY against impossible differential, invariant subspace, integral, meet-in-the-middle, boomerang, and several algebraic attacks. Finally, FPGA implementations demonstrate both compact and high-performance hardware realizations: the iterative architecture occupies only about 1.4K LUTs, whereas the fully pipelined architecture achieves a steady-state throughput exceeding 50 Gbps. Compared with existing 256-bit wide-block block ciphers, including WAES, LEANY provides substantially better area efficiency and competitive throughput (TP) and throughput-to-area ratio (TAR) results.

Spending limits are the workhorse of custody policy, yet in every deployed threshold-signing stack they live outside the signing protocol—in centralized policy engines, on-chain covenants, or hardware co-signers—where they leak budget state, bind to a single chain, or add a trusted bypass surface. The workload is compounding: agent payments passed one hundred million transfers on a single chain in under a year. We initiate the study of protocol-native spending limits: per-epoch budgets secret-shared among the signers and enforced inside the signing session, with unchanged on-chain verification. We first show that the natural approach fails: gating a threshold signature with a passively secure MPC comparison admits a deterministic bypass. For the class of linear gatein-combination protocols we prove that every member signs over-budget transactions with probability one, disguised against any transcript auditor up to the statistical masking bound. We then construct BTS, a budgeted threshold Schnorr scheme with a formal budget-soundness definition for honest-majority configurations. The gap is closed with an authenticated gate: in implementation, every attack attempt is caught before a signature is produced, at a measured cost of 3.4–3.7× multiplications and five extra rounds. Batched over k=20 payments, enforcement amortizes to about one network round trip per payment in our WANmodeled prototype.

Succinct proofs for arithmetic modulo powers of two are crucial for verifying machine-word computations in practice. However, designing SNARKs over such rings is challenging, since they lack the algebraic properties that common SNARKs over fields rely on to achieve negligible soundness error. Existing approaches either work over Galois rings, whose arithmetic is expensive, or lift the statement to the integers and prove it over a large random prime field, which is also several times slower than the structured primes used in practice. We present $\mathsf{Rotor}$, an efficient SNARK for circuits over $\mathbb Z_{2^k}$. Unlike prior work, $\mathsf{Rotor}$ operates natively over power-of-two rings and derives its soundness from three levels of ring precision. To prove statements over $\mathbb Z_{2^k}$, we first construct a sumcheck-style interactive oracle proof with tensor queries over a larger ring $\mathbb Z_{2^m}$. We then establish a weakened proximity gap for linear codes, in which proximity testing over a still larger ring $\mathbb Z_{2^\ell}$ ensures that the underlying vectors are close to the code after reduction to $\mathbb Z_{2^m}$. This yields a Brakedown-style commitment with tensor evaluation proofs over $\mathbb Z_{2^m}$. In both cases, a sufficiently large gap between the precisions guarantees negligible soundness error. Finally, we introduce compatible commitments, which link ring witnesses to their binary-field representations and enable permutation checks over fields to verify permutations over $\mathbb Z_{2^k}$, completing the construction of $\mathsf{Rotor}$.

Cashu, the dominant deployed Chaumian ecash system, has grown to 31 specification documents, 58 indexed mints, and seven interoperable wallets, while the cryptographic literature has studied only its blind-signature core. Every incident in the system’s short audited history, including a cross-mint theft disclosed in early 2026, is compositional: it emerges from keyset rotation, wallet recovery, and multi-mint identity. We give the first system-level security analysis of a deployed ecash system, built on a five-layer model, a nine-property family (three properties new), and a stateful one-more-unforgeability theorem whose proof separates forgery from theft; the deployed attacks commit theft without forging anything. We reproduce the disclosed theft end-to-end, exhibit a strictly stronger public-key-claim variant, and measure all 58 indexed mints: every reachable mint declares support for DLEQ proofs, the sole remaining defense, yet declarations are unauthenticated the guardrail sits with the issuer, not the wallet. A theft theorem gives necessary and sufficient conditions for prevention, and replaying three fixes shows the cheapest one costs honest issuers nothing. A defect taxonomy and a three-system comparison suggest a broader lesson: recoverability is not free. All artifacts are pure standard-library Python and pass the 49 o cial test vectors.