Constructing $\mathcal{iO}$ from simple, safe assumptions in the post-quantum regime is an important problem with wide-ranging applications. In this work, we make progress towards this goal. We formulate a new, arguably simple assumption called LWE with Structured Preimage that suffices to build $\mathcal{iO}$. Our assumption is instance-independent, falsifiable and non-interactive. Our assumption posits that a set of LWE (Learning With Errors) samples is indistinguishable from random given a short Gaussian matrix which is carefully chosen to satisfy the required functionality while avoiding problematic leakage. We provide a thorough cryptanalysis of our assumption, using the extensive cryptanalytic effort against the related evasive LWE assumption (Wee, Eurocrypt 2022 and Tsabary, Crypto 2022) to gain confidence. We emphasize that our assumption is superficially similar but fundamentally different from evasive LWE. Thus, we obtain $\mathcal{iO}$ from a simple lattice assumption whose hardness is somewhat better understood as compared to brand new assumptions.

Lattice-based homomorphic e-voting protocols built on commitments, such as EVOLVE, keep ballots private against all but one authority and the tally verifiable even if all authorities collude, but need every authority to tally. We present T-EVOLVE, in which votes are Shamir-shared over the commitment message space: any t of n authorities that took part in the checking phase complete the tally, privacy holds against t-1 colluding authorities and verifiability against all. The voter proves that her committed shares form a Reed-Solomon codeword whose value at zero is a valid vote; the parity checks cost no communication, and tallying interpolates public column sums without norm growth. Complaints of authorities, including about ciphertexts that do not decrypt, are publicly verifiable given encryption with publicly verifiable opening, which we define and instantiate under LWE. We prove privacy, verifiability, individual verifiability and robustness in the classical random oracle model; the verifiability reduction is not tight and the parameters rest on classical hardness estimates. In our C implementation, a yes/no ballot for four authorities takes 109 KB without signatures, or 147 KB with the computed seed ciphertexts of our instantiation, and an authority aggregates 10^4 ballots in about three minutes per successful tally round on one core.

Over the years, several ECDSA security experiments have been proposed to enable faster distributed ECDSA signing. These experiments are not known to reduce to the standard ECDSA game, and recent work (Groth and Shoup, Eurocrypt 2022) shows that some are vulnerable, especially when combined with raw signing (signing hash digests directly, rather than pre-hashed messages) and additive key derivation. Furthermore, several of these variants are implemented in public libraries and used by companies, sometimes in commercially deployed products, yet lack sound security foundations. In this note, we revisit the security landscape of these alternative modes of operation for ECDSA. As our main result, we show that the security of some of these variants, which are used in the wild, is equivalent in the generic group and random oracle model to a standard conjecture from fine-grained complexity on the average-case hardness of the $k$-SUM problem. We complement our study by proving lower bounds, conditioned on fine-grained complexity conjectures, on the running time of generic group model attacks against other standard modes of operation analyzed in (Groth and Shoup, Eurocrypt 2022). Overall, our results provide a complete picture of the security landscape of ECDSA variants, and reveal an elegant connection with (old and new) conjectures from the field of fine-grained complexity.

Succinct Non-interactive Arguments of Knowledge (SNARKs) can enable efficient verification of computation in many applications. However, generating SNARK proofs for large-scale tasks, such as verifiable machine learning or virtual machines, remains computationally expensive. A promising approach is to distribute the proof generation workload across multiple workers. A practical distributed SNARK protocol should have three properties: horizontal scalability with low overhead (linear computation and logarithmic communication per worker), accountability (efficient detection of malicious workers), and a universal trusted setup independent of circuits and the number of workers. Existing protocols fail to achieve all these properties. In this paper, we present Cirrus, the first distributed SNARK generation protocol achieving all three desirable properties at once. Our protocol builds on HyperPlonk (EUROCRYPT'23), inheriting its universal trusted setup. It achieves linear computation complexity for both workers and the coordinator, along with low communication overhead. To achieve accountability, we introduce a highly efficient accountability protocol to localize malicious workers. Additionally, we propose a hierarchical aggregation technique to further reduce the coordinator’s workload. We implemented and evaluated Cirrus on machines with modest hardware. Our experiments show that Cirrus is highly scalable: it generates proofs for circuits with 33 million gates in under 40 seconds using 32 machines with 8 cores each. Compared to the state-of-the-art accountable protocol Hekaton (CCS'24), Cirrus achieves over 7$\times$ faster proof generation for PLONK-friendly circuits such as the Pedersen hash. Our accountability protocol also efficiently identifies faulty workers within just 4 seconds, making Cirrus particularly suitable for decentralized and outsourced computation scenarios.

We present WISCH, a commit-reveal protocol that combines compact aggregate signatures with hash-based commitments to enable selective disclosure of correlated data in multiparty computation. The protocol separates an on-chain verification core from off chain preparation, so that verification cost depends only on the number of openings, not on the size of the underlying message space. This yields asymptotic efficiency: on-chain cost grows linearly in the number of revealed items and is independent of the ambient domain, while the per-byte overhead decreases with the message granularity. Security is established via a simulation-based proof in a UC framework with an ideal ledger functionality, in the algebraic group and global random-oracle models, under standard assumptions for discrete-log-based signatures and hash-based commitments. Thus WISCH provides selectively verifiable revelation with succinct on-chain checks and provable security guarantees.

Conventional profiled side-channel analysis generally assumes that the plaintexts or ciphertexts associated with target traces are available during key recovery. We consider a profiled blind setting in which the attacker can obtain labeled traces from a profiling device using known inputs and keys, but observes only leakage traces from the target device. Under this setting, we propose Blind-DLPA, an end-to-end multi-task framework for {profiled blind side-channel analysis (profiled BSCA) that processes complete preprocessed trace windows} and jointly estimates the soft Hamming-weight posteriors of an input variable and a key-dependent intermediate variable. These posteriors are combined with pre-computed theoretical joint distributions to rank the key hypotheses, avoiding both manual {point of interest} (PoI) selection and a parameter-sensitive Gaussian label-error model. Evaluations on unprotected AES and Kyber demonstrate successful key recovery, while experiments on protected AES implementations show robustness to desynchronization and Boolean masking. To the best of our knowledge, Blind-DLPA provides the first reported profiled blind key recovery on the ASCAD dataset, reaching a guessing entropy of zero with 39 attack traces. Complementing these results, we revisit the Ascon Hamming-weight joint-distribution model adopted in prior work and identify previously overlooked collisions between key-dependent theoretical distributions that prevent unique key recovery under this model.

We present a continued-fraction key-recovery attack on the knapsack-based public-key cryptosystem proposed by Gómez-Torrecillas, Lobillo, and Navarro (GTLN). The key observation is that ratios of public-key differences closely approximate rational numbers with small denominators, enabling their exact recovery by continued fractions. Divisibility relations in the recovered fractions yield multiples of two private-key integers through greatest common divisor computations. Once these two integers are identified by a bounded cofactor search, all remaining private-key integers except the modulus and the shift are uniquely determined. Further greatest common divisor computations, cofactor enumeration, and modular inversion then recover the secret modulus and shift. The above process of key recovery uses only public keys. For fixed cofactor bounds, the algorithm runs in polynomial time in the public-key bit length, while a heuristic analysis predicts a high probability of recovering the original key. In experiments with prime-based key generation, our Python implementation recovered the complete private key in all 2,400 trials across the 24 recommended parameter sets, with each attack taking less than 0.05 seconds.

Deterministic variants of CSIDH remove randomness from the group action, either through implementation techniques or, as in Houben's deterministic CSIDH and OSIDH-LD, by design. Since earlier fault attacks on CSIDH mostly target random point sampling, determinism seems to close that avenue. We show that it opens another: every secret-dependent step occurs at a fixed, public point of every execution, so an attacker can fault the same step repeatedly. Our attack forces the mask that selects which of two lanes computes the next isogeny to zero, for example by skipping one instruction. Whether the output changes reveals whether a secret exponent reaches a chosen threshold, and a binary search over these thresholds recovers the full key with one fault per execution: at most 297 oracle queries for OSIDH-LD and 222 for deterministic CSIDH with CSIDH-512-sized keys. We recover full OSIDH-LD keys in a software fault simulation of the reference implementation, and show on a ChipWhisperer-Lite that the targeted instruction is skipped with probability at least $0.94$ at an isolated fault position. Finally, we argue that fault resistance requires giving up determinism, and propose countermeasures relying on randomization.

We propose a deterministic lattice-reduction algorithm with bit complexity matching QR factorization up to logarithmic factors, and an implementation that uses fewer instructions than \texttt{flatter} (CRYPTO 2023) in our benchmarks. The key technical innovations are iterative precision management, a finer-grained potential analysis, and a new representation for bases and transformations, all integrated into a recursive framework. We analyze the asymptotic behavior of our algorithm, and show that, for fixed reduction and output accuracy, the running time is $\widetilde O\!\left( n^\omega\bigl(1+\log\kappa_{\rm col}(\mathbf B)\bigr)\right)$, where $\mathbf B\in\mathbb Z^{n\times n}$ is a nonsingular lattice basis and $\kappa_{\rm col}$ is the optimally column-scaled spectral condition number. This gives a finer complexity than prior art, by allowing a tighter condition number $\kappa_{\rm col}$. Besides, through a new observation on the recursive structure, we demonstrate that the algorithm is free from heuristic assumptions. We compare our implementation with \texttt{flatter} on q-ary, NTRU-like, scaled q-ary, and Coppersmith inputs. Our implementation uses fewer instructions in all 153 executions. The median ratios of \texttt{flatter}'s instruction count to ours are 1.55 for ordinary q-ary inputs and 1.86 for NTRU-like inputs.

In this paper, we introduce SCMAC, a general framework that transforms large-memory stream ciphers into AEAD schemes. It represents an intermediate design paradigm between Encrypt-then-MAC and dedicated single-pass AEAD, partially integrating encryption and authentication mechanisms while mitigating the risk of state leakage associated with immediate absorption and squeezing. Consequently, this approach harmonizes high performance with enhanced security. Additionally, we propose LOL2.0, an enhanced version of the blockwise stream cipher design framework LOL. This new framework improves security through modifications to the FSM update and output functions, and increases flexibility in constructing LFSR components. Based on SCMAC}$ and LOL2.0, we present two AEAD ciphers, LOL2.0-Mini and LOL2.0-Double, which support both stream cipher and AEAD modes. These ciphers are tailored to Beyond 5G/6G environments, offering 256-bit key length and resistance to known cryptanalysis methods, including differential, linear, and integral attacks. They also provide 128-bit security against forgery attacks in the nonce-respecting setting. Due to their compatibility with AES-NI and SIMD instructions, LOL2.0-Mini and LOL2.0-Double achieve software performance of 90 Gbps and 144 Gbps in stream cipher mode, respectively. In AEAD mode, they perform at 59 Gbps and 110 Gbps, significantly faster than their predecessor's Encrypt-then-MAC versions.

This paper investigates pseudorandom generation in the context of masked cryptographic implementation. Although masking and pseudorandom generators (PRGs) have been distinctly studied for a long time, there has been little study on how randomness should be generated in masked implementation. The lack of analysis on mask-bits generators obscures the practical security of masked cryptographic implementation, potentially confusing practitioners (e.g., designer, implementer, and evaluator) about how to realize them securely. This paper provides a novel viewpoint and comprehensive analyses by developing three new models, each of which corresponds to a practical scenario: leakage assessment, experimental evaluation of attack success rate or key lifetime, and deployment. We reveal what PRG properties are required. In particular, we support a long-held belief/folklore through proof and experiment: for the output of PRG for masking, cryptographic security (i.e., unpredictability) is not necessary. In addition, we thoroughly investigate the practical security of PRGs within the masking context. We conclude this paper with some recommendations for practitioners and a proposal of leakage-resilient method offering comparative performance.

Graphics processing units (GPUs) are widely employed as accelerators in modern servers to handle key-establishment requests in bulk. Such deployments require the GPU implementation to sustain high throughput while keeping each request within its latency bound. In this work, we present a high-performance, end-to-end GPU implementation of Hamming Quasi-Cyclic (HQC), a code-based key encapsulation mechanism (KEM). We propose two novel techniques to accelerate the dominant cost of HQC, which is binary polynomial multiplication over Galois Field GF(2). The first is a parallelization of the Frobenius additive fast Fourier transform (FAFFT), and the second is a mapping of the cyclic product, viewed as a Toeplitz matrix–vector product, onto one-bit integer (INT1) tensor cores. We further explore the design space of these multipliers, measuring them directly on the GPU to derive the best combination for the architecture. We further propose a GPU-resident computation strategy that keeps the entire KEM on the GPU, thereby reducing costly memory traffic. Beyond multiplication, we introduce warp-level parallelization strategies to accelerate the remaining stages, hashing, Reed–Muller/Reed–Solomon (RM/RS) coding, and fixed-weight sampling, which become the performance bottleneck once multiplication is optimized. By varying the mapping of KEM instances to GPU threads, we derive five variants spanning the trade-off between throughput and latency and organize them into a thread-to-KEM mapping taxonomy. On an RTX 4090, the Coarse-Grained (CG) variant maximizes batch throughput. Our multiplier reaches 3,828k polymul/s for standalone multiplication, about 2.9× the latest GPU HQC implementation HIGH, and for the full KEM the CG variant achieves 1.56×, 1.55×, and 2.03× higher end-to-end throughput than HIGH for keygen, encaps, and decaps. For single-shot latency the tensor-core-based BMMAw variant achieves a latency as low as 254 µs. The proposed warp-parallel FGmw variant still attains a latency of 354 µs, demonstrating that our approach remains effective on GPU architectures lacking INT1 tensor-core support. All five variants are further evaluated on an RTX 3090 and an embedded Jetson AGX Orin to confirm cross-platform portability.

We present the first strongly adaptive common coin protocol, under the PKI setup (in the random oracle model and the algebraic group model, yet with no trusted dealer), that (i) achieves the optimal resilience $t< n/2$ in synchronous networks, and (ii) attains near-optimal asymptotics: near-quadratic communication $O(\kappa \lambda n^2\log n)$ and logarithmic rounds $O(\kappa\log n)$, with failure probability $\textsf{negl}(\lambda)+2^{-\kappa}$, where $\lambda$ (resp. $\kappa$) is the computational (resp. statistical) security parameter. Furthermore, the coin protocol assumes no memory erasure. At its core is a ``special-purpose'' distributed key generation (DKG) protocol that produces a secret in an elliptic-curve group. Our common coin immediately implies the first strongly adaptive and optimally resilient Byzantine Agreement with subcubic communication and sublinear rounds in the absence of a trusted dealer. Furthermore, we give two non-trivial applications of independent interest: (i) a strongly adaptive Parallel Broadcast (PBC) under standard PKI with near-quadratic communication and logarithmic rounds, whereas all existing subcubic solutions (Gelles et al. CRYPTO'25, Civit et al. PODC'24) require at least linear rounds; (ii) a strongly adaptive ``general-purpose'' DKG for field-element secrets with $O(\lambda\kappa n^2\log n)$ communication and $O(\kappa\log n)$ rounds (assuming memory erasures), fully compatible with legacy threshold schemes (BLS, Schnorr, ElGamal), improving upon (Feng et al. PODC'24), which requires $O(\lambda\kappa n^{2.5} \log n)$ communication and $O(n)$ rounds. Our core is a new design methodology, which we call \emph{Circular Dragon}. This extends the Dragon method (PODC'24) that was originally developed for sub-cubic communication DKG protocols but with linear rounds, by further reducing the round complexity.

SPDZ-family protocols for maliciously secure multi-party computation protect secret-shared values with message authentication codes (MACs) under a secret-shared global key. Their security requires that all values and preprocessing used together be authenticated under the same key. We present Off-Key, a privacy attack that exploits violations of this requirement. Depending on which specific MAC check protocol is used, a corrupted party can either recover the value of a shared secret from a single authentication check or test a guess through selective failure by modifying a MAC share and observing whether a masked check succeeds. While this attack does not compromise the theoretical security guarantees of the protocols, we demonstrate this key-consistency vulnerability in evaluated versions of MP-SPDZ, SCALE-MAMBA, and FANNG-MPC, which allow a corrupted party to use different keys across batches, threads, or process runs. To help implementations avoid this class of attacks, we identify the state that enforces key consistency in representative preprocessing protocols and show how preserving and reusing it prevents the attack.

Privacy-preserving inference (PI) enables users to query large language models (LLMs) without revealing their prompts, but incurs substantial computation and communication overhead. Prior PI systems primarily optimize prefill and time to first token (TTFT). This suits applications that need only a single output token, yet most real-world use cases require multi-token responses. Such autoregressive workloads are dominated by time per output token (TPOT) instead. For the first time, we investigate generating full multi-token answers for real prompts under PI. We show that PI decode is hindered by two bottlenecks: (i) nonlinear kernels that require many interactive communication rounds, and (ii) attention protocols that underutilize ciphertext capacity and repeatedly re-encrypt or transmit the growing key and value (KV) cache. We present HERMES, a PI system optimized for LLM decoding. HERMES replaces high-round nonlinear protocols with compute- and bandwidth-intensive alternatives that require fewer communication rounds. It also introduces a novel matrix-multiplication protocol based on homomorphic encryption that keeps the KV cache encrypted on the server and uses grouped-query attention (GQA) to improve ciphertext utilization. On Llama 3.1 8B Instruct, across the network conditions and prompts used in our evaluation, HERMES lowers TPOT by up to 2.7× and total PI latency by up to 2.1×.

We present an algorithm for computing endomorphisms of superspecial principally polarized abelian surfaces over finite fields. Under a standard heuristic, we obtain a non-scalar polarized endomorphism in expected time and memory $p^{4/5 + o(1)}$.

VDOO is a multivariate signature scheme submitted to the Next-generation Commercial Cryptographic Algorithms Program (NGCC). We study the security of its submitted parameter sets. In this paper, VDOO is described as a multilayer Rainbow construction. By retaining only its last oil space, we obtain a generalized UOV instance and apply existing wedge attacks. For the parameter set targeting 512-bit security, we estimate costs of $2^{432}$ and $2^{379}$ gates for the reconciliation and intersection variants, respectively. These estimates rely on the assumptions of the attack model and are below both the claimed security level and the attack costs reported in the specification. Our analysis uses only the generalized UOV structure. The additional information in the multilayer structure may allow further improvements. Our results also motivate further study of parameter choices that balance resistance to known attacks with signing efficiency.

A recent analysis of module-BKZ [Ducas–Engleberts–Perthuis, Asiacrypt'25] predicts subexponential speedups for lattice reduction on module lattices over cyclotomic fields whose conductor has small odd prime factors. This threatens NTRU+, the South Korean standard for key encapsulation, and related schemes; however, the short vectors one seeks to find are short in the coefficient geometry, whereas module-BKZ operates in the canonical geometry. We introduce relative canonical and relative coefficient embeddings, realising a module over a cyclotomic field $K$ as a module over any subfield $L$, and characterise when the two agree up to scaling: exactly when the radicals of their respective conductors $c$ and $\ell$ satisfy $\mathrm{rad}(c)/\mathrm{rad}(\ell) \in \{1,2\}$. Furthermore we quantify the distortion incurred in general when passing between embeddings, and hence identify the optimal subfield for module-BKZ and BKZ to use. Estimating the cost of the best attack with simulation-based models [Perthuis–Trenkić, PQCrypto'26], we find that the best module attack saves only 4–10 blocksizes, costing NTRU+ keys at most three bits of security in the Core-SVP model. We further extend the analysis of overstretched NTRU regimes [Ducas–Woerden, Asiacrypt'19] to the module setting, and find the fatigue point is reached sooner than with unstructured counterparts, though NTRU+ parameterisations remain safe.

Threshold implementations (TIs) are now an established class of side-channel countermeasures. Their underlying idea is simple and compelling: under mild, practical assumptions, they provide protection against glitches and allow composability. Yet our understanding of one-stage TIs with a minimal number of shares remains limited, both for cryptographically relevant families—particularly power functions—and for concrete small functions. In particular, until now, except for Feistel-constructions, no optimal TI had been found for families of mathematically well-structured and cryptographically non-trivial functions, especially power functions. In small dimensions, many functions - particularly cryptographically interesting ones — were not known to admit an optimal TI. This was especially true for the 4-bit S-boxes frequently used in practical lightweight ciphers. Optimal refers to share-optimal, direct one-stage, uniform, first-order TI. Here, we introduce new families of TIs, including the first infinite families of cryptographically nontrivial power permutations. Moreover, every four-bit permutation of algebraic degree t admits a direct, uniform TI with t+1 shares and no fresh randomness. Those results prove several previous conjectures and claims wrong. Since such permutations are widely used in symmetric ciphers, our constructions offer new implementation options. $\textbf{Note:}$ The threshold implementations presented in this paper are available at: https://github.com/enripicc/Optimal-Threshold-Implementations-for-3-4-and-5-bits-permutations

Zero-knowledge codes, introduced by Decatur, Goldreich, and Ron (ePrint 1997), are error-correcting codes in which few codeword symbols reveal no information about the encoded message, and have been extensively used in cryptographic constructions. Quantum CSS codes, introduced by Calderbank and Shor (Phys. Rev. A 1996) and Steane (Royal Society A 1996), are error-correcting codes that allow for quantum error correction, and are also useful for applications in quantum complexity theory. In this short note, we show that (linear, perfect) zero-knowledge codes and quantum CSS codes are equivalent. We demonstrate the potential of this equivalence by using it to obtain explicit asymptotically-good zero-knowledge locally-testable codes.

We present a new ABE for Turing machines, where - encryption runs in time $O(T)$ and produces a ciphertext of size $O(T)$ for time $T$ computation; - key generation produces a key of size $O(1)$; - security relies on the (public-coin) circular evasive LWE assumption. In fact, we obtain an ABE for a simple and more general model of computation which we refer to as iterated (local) computation. We improve on the recent construction of Agrawal, Kumari, and Yamada (CRYPTO 24) in three ways: (i) faster encryption and smaller ciphertext size; (ii) smaller key size, and (iii) weaker assumptions, eliminating the need for circular tensor LWE.

VOLE-in-the-Head (VOLEitH) has emerged as a promising paradigm for the design of post-quantum signatures, as it enables efficient signing and verification while also achieving small signature sizes. In the ongoing NIST PQC standardization process for additional digital signatures, two VOLEitH signature schemes, namely FAEST and SDitH, have advanced to the third round. Regarding their practical security, especially resistance to power side-channel attacks, existing studies have focused on only a few specific operations, and thus a comprehensive analysis remains lacking. To address this gap, we present, to the best of our knowledge, the first DPA-style attack framework against VOLEitH signatures. Our framework targets the secret witness, whose recovery permits the generation of valid signatures for arbitrary messages. Based on this framework, we systematically analyze the leakage stemming from the computation of sensitive intermediate values involved in VOLE correlations, and characterize how such leakage can be linked to secret witness hypotheses for mounting DPA-style attacks. As a consequence, we propose six classes of DPA-style attacks on FAEST and SDitH, including two vertical and four horizontal attacks. Finally, the proposed attacks are validated using both simulated leakage under varying noise conditions and practical measurements on three ARM Cortex-M4 devices, demonstrating their effectiveness in both settings.

We develop a new Coppersmith lattice attack on balanced CRT-RSA with small CRT exponents $d_p, d_q$ using unravelled linearization. The new attack matches the practical effectiveness of the Takayasu–Lu–Peng attack (JoC 2019) while using lattices of roughly half the dimension. In contrast to their attack, for which there is a noticeable gap between the theoretical predictions and experimental results, our theoretical estimates closely match the experimental results for all tested parameter sets. Our analysis further shows that the asymptotic bound remains $d_p,d_q<N^{0.122}$, so the new attack does not achieve the asymptotic improvement anticipated by Takayasu, Lu, and Peng. Nevertheless, performing LLL reduction on lower-dimensional lattices substantially reduces the running time, allowing us to attack much larger $d_p,d_q$ in practice. Furthermore, through elegant variable substitutions, we extend our attack to two most significant bit (MSB) leakage models, obtaining the first attack exploiting MSB leakage of $p+q$ and an improved attack exploiting MSB leakage of $d_p,d_q$. In both models, the asymptotic bounds improve as the amount of leakage increases and recover the Takayasu–Lu–Peng bound in the absence of leakage.

The National Institute of Standards and Technology (NIST) Post-Quantum Cryptography (PQC) standardization process has drawn significant attention from the research community recently, especially regarding these PQC schemes' hardware acceleration. Nevertheless, related research on the emerging schemes, e.g., those currently under consideration by the NIST additional digital signature scheme standardization, still needs further exploration. With this background, this paper presents an efficient and novel hardware acceleration for FAEST, one of the promising signatures in the NIST Round 3 additional scheme competition. Overall, we have presented several layers of innovative efforts to obtain the proposed acceleration. First of all, we have conducted detailed algorithmic analysis on the major computationally intensive operations within FAEST and proposed novel design strategies and algorithms for their efficient hardware implementation. Next, we have proposed novel design efforts to construct these major operations into efficient building blocks to finalize the overall accelerator, along with the help of optimized operational phase workflow. The dedicated extension to build the L1-EM-fast accelerator is also given. Finally, we have provided a detailed and thorough evaluation process to showcase the superior performance of the proposed design over the existing complete, Sign part, and single security level MPC-in-the-head signature acceleration works. For instance, at the same security level, the proposed fast variant has at least 98\% less equivalent Area-Delay Product (eADP) than the recent complete SDitH design. To the authors' best knowledge, this is the first hardware acceleration work for FAEST, and we hope the outcome of this research will facilitate the ongoing PQC standardization process.

Random Vector Oblivious Linear Evaluation (VOLE) correlations can be generated efficiently for zero-knowledge proofs and secure computation. Applications that need correlations on the receiver’s actual input typically derandomize random VOLE by sending a linear-size vector, a main communication bottleneck. We study chosen-input VOLE (CI-VOLE), where the receiver privately chooses a large vector \(\mathbf{x}\), the sender fixes \(\Delta\), and the parties obtain shares of \(\mathbf{x}\cdot\Delta\) without communicating a linear-size object. This work presents LogVOLE, a concretely efficient CI-VOLE protocol with polylogarithmic end-to-end communication under Ring-LWE. The construction uses a recursive shrink/expand design: it authenticates short digests of the chosen input and then uses a succinct telescope to expand those relations back to the full vector. The protocol has \(O(\lambda\log^2(|\mathbf{x}|+m_{\mathsf{msg}}))\) one-time setup and query communication and \(O(|\mathbf{x}|/n)\) ring operations. Here, \(n\) is the underlying ring degree, \(\lambda\) is the computational security parameter, and \(m_{\mathsf{msg}}\) is the size of the shares. LogVOLE also supports a public-key non-interactive mode: for a fixed \(\Delta\), the sender publishes reusable parameters, and a receiver sends one compact \(\mathbf{x}\)-dependent message to obtain the matching VOLE shares. This gives a route to non-interactive VOLE-based ZK with polylogarithmic communication for arbitrary circuits. We also give a malicious-security extension in the random oracle model. Using LogVOLE, we construct the first concretely efficient VOLE-based designated-verifier ZK protocol for arbitrary circuits with polylogarithmic communication. At 128-bit computational and 40-bit statistical security, our implementation achieves online throughput of 13.9 million \(\mathbb{Z}_p\) correlations/s and 12.9 million ZK multiplication gates/s using 16 CPU cores per party. With golden-seed optimization and reusable setup, our GPU implementation processes 532.3 million \(\mathbb{Z}_p\) correlations/s and 451.7 million ZK multiplication gates/s online on an H200 GPU. With one CPU thread per party, our implementation proves \(1024\times1024\) matrix multiplication in about 4 seconds online, with 226 kB of online communication.

To address the challenges of interactive credential issuance and conditional privacy-preserving authentication for dynamic terminals accessing multiple third-party services, we propose an traceable and aggregatable tagged witness signature (TA-TWS). Building upon this scheme, we design an efficient and privacy-preserving anonymous authentication framework, termed SwiftAuth. SwiftAuth decouples the issuer’s authorization phase from the user’s credential acquisition process in traditional anonymous authentication systems by introducing an asynchronous credential distribution mechanism. This allows issuers to generate authorization components even when users are offline, while ensuring that only the designated user can derive the complete access credential. Furthermore, during the authentication phase, SwiftAuth reduces communication and verification overhead in concurrent multi-service access by compressing multiple credentials into a constant-size representation, and supports verifier-side batch verification across users. In addition, it provides conditional privacy by integrating a regulatory trapdoor, ensuring default anonymity for legitimate users while enabling authorities to trace malicious actors upon protocol violations. Finally, we formally prove that the proposed TA-TWS achieves unforgeability and witness hiding. Extensive experiments were conducted on multiple resource-constrained devices, and Aliyun servers, using the MIRACL Core cryptographic library, demonstrate the practicality and efficiency of our approach.

We introduce CRISP (\underline{C}hannel-\underline{R}andomised Single-\underline{I}mage\\ \underline{S}teganography with \underline{P}ermutations), a homomorphic steganography scheme for outsourced computation. In the setting we consider, a client (Alice) hides Boolean inputs in the least-significant bits of cover images and asks an honest-but-curious cloud (Carol) to evaluate a logic circuit, gate by gate, directly on those images so that a receiver (Bob) can later extract the result. The setting is natural for outsourcing but non-standard for steganography: Carol knows that steganographic embedding is used, knows the scheme, and knows the public channel-assignment permutations; the only secret is the per-execution pixel position $(\mathit{row}, \mathit{col})$ in the image at which the bits live. The security goal is therefore positional hiding under known presence, not Cachin-style undetectability. CRISP embeds all three inputs of a Fredkin gate (a universal reversible three-bit logic gate) into the three RGB channels of a single cover image at a secret pixel position, and writes all three outputs into a single output cover at the same position. Two independently sampled permutations $(\pi_{\mathrm{in}}, \pi_{\mathrm{out}}) \in S_3 \times S_3$ assign channels to logical roles at the input and output of each gate, and both travel with the public circuit specification. Two results about the limits of this design follow, and we regard them as the more useful contribution. First, per-gate resampling of $\pi_{\mathrm{out}}$ does not give circuit privacy. We prove that a server holding the circuit specification reads the channel-to-role map at every gate directly, and that a weaker adversary holding only the images recovers the same map and the wiring graph with nine channel-pair comparisons per gate. Second, a $1/(h{\times}w)$ positional bound proved on a single image does not survive a full multi-image transcript when ancillary wires carry publicly known constants. We restate the security game over the whole transcript and prove a bound $2^{\lambda}/(2^{\lambda}+n-1)$ with $n = h{\times}w$ and $\lambda$ the gap between the number of secret input bits and the collision entropy of the server's prior on them. Constants embedded only at the secret pixel push $\lambda$ up by one bit each, and enough of them pin the pixel down exactly. Two cheap repairs drive $\lambda$ back to zero and restore the exact $1/(h{\times}w)$ bound. The decay is polynomial, not super-polynomial, so the bound is statistically small but not cryptographically negligible in the standard sense.

Let $p\equiv3\pmod4$ be a prime and let $N\geq2$ be an integer. We determine, to first order in $1/p$ and with an explicit error bound, the proportion of superspecial principally polarized abelian surfaces over $\overline{\mathbb{F}}_p$ that are optimally $(N,N)$-split. The surfaces are weighted by the reciprocals of their automorphism orders, which is the stationary measure of the Richelot random walk. The main theorem states that for $p\nmid N$ the expected number of optimal $(N,N)$-splittings of a surface is exactly $5NJ_2(N)(p-1)/(p^2+1)$, where $J_2$ is Jordan's totient; that for $p>2N^2$ the second factorial moment is $c_N/(p^2+1)$ with $c_N$ independent of $p$; and consequently that, for fixed $N$, the proportion of split surfaces is $5NJ_2(N)/p+O_N(p^{-2})$. The constants $c_N$ are determined explicitly for $2\leq N\leq7$. This proportion is the stationary target density of the splitting-detection attack on the superspecial isogeny problem in dimension two. It was previously known only from experiments or from a one-sided bound. The method is to show that the superspecial surfaces sample the genus of their refined Humbert invariants with Siegel's weights, which makes Siegel's theorem on genus averages available. The same method gives the first moment of primitive representations of every discriminant prime to $p$, mixed moments for several levels, an exact probability at level $2$, and a proof that the geometric upper bound of earlier work has the correct leading term. All results are proved; the enumerations enter only through the values of $c_N$, and every formula was additionally confirmed by exact computation at twelve primes.

The Mitaka signature scheme is a variant of Falcon (FN-DSA). It has a considerably simpler signing procedure that can be parallelized while retaining Falcon's efficiency advantage. Mitaka offers two different signing approaches: a default one relying on floating-point arithmetic and an alternative, called MitakaZ, avoiding floating-point arithmetic at the cost of more Gaussian samples. Despite its better portability, MitakaZ has not previously been implemented in practice. This work presents an efficient fixed-point implementation of the Mitaka signing algorithm. We optimize the MitakaZ Gaussian sampler to make it suited to fixed-point arithmetic while achieving higher efficiency. Specifically, we replace the wide integral Gram root decomposition used in MitakaZ with a fixed-point square Cholesky decomposition, which substantially reduces the cost of integer Gaussian sampling. We prove bounds on intermediate values and representation errors without empirical assumptions on their magnitudes. The distributional analysis models each integer Gaussian call as exact at its represented inputs. We provide a fixed-point implementation of the new Mitaka signing algorithm in C. On an Intel Core~i7-1360P, our native AVX2 implementation generates signatures in an average of 361 kcycles for Mitaka-512 and 707 kcycles for Mitaka-1024, measured with Linux hardware performance events. On an ARM Cortex-M4F STM32F411, the corresponding measured costs are 4.0 and 7.8 Mcycles.

Linear correctors reduce the bias of random bits via parity (XOR), but their guarantees are known mostly for independent bits, an assumption violated by many physical entropy sources. We give a general, exact formula for the parity bias of dependent bits from a (hidden, possibly non-homogeneous) Markov chain, as a product of twisted transfer kernels. Under next-bit unpredictability, i.e. conditional bias at most $\beta$, the decay is governed by $\beta$ itself: sharp for a one-bit context, $|\mathrm{bias}|\le\beta^{\lceil n/2\rceil}$, and \emph{near-optimal} for an $m$-bit context, within a factor $3^{1/3}\approx1.44$ of the best possible per-bit rate, which is at least $\beta^{1/(m+1)}$ (attained by a noisy LFSR) and asymptotically equal to it as $\beta\to0$. Against the best previous bound (Zhou and Bruck, ISIT 2011) we \emph{correct the exponent} and \emph{tighten the bound on $n$ bits by a factor of about $2^{\lfloor(n-1)/2\rfloor}/\beta$}, with a matching construction. The decay is non-monotone, so a corrector should be certified at every operating length, or via the envelope $\beta^{\lceil n/2\rceil}$. Finally, bounded memory is necessary: if unpredictability is imposed on the full history, XOR-ing does not reduce the bias at all.

Signatures in the MPC-in-the-head paradigm rest only on a symmetric primitive, but their signing is slow, because it computes hash functions and a linear map for every simulated party of every repetition. We show that the Hexagon NPU of Snapdragon SoCs shortens one complete signing operation of AIMer, the MPC-in- the-head signature that the Korean post-quantum cryptography competition selected. Prior work speeds up such signatures on one CPU core, accelerates post-quantum arithmetic on GPUs for batches of operations, and reports only single post-quantum functions for mobile NPUs. Our implementation divides each signing operation along its dependency graph. The NPU computes the hashing and the per-party linear map of the last repetitions, which need no secret key, and the CPU keeps the secret key and the two hashes that absorb the repetitions in index order. A fast AArch64 implementation serves both as the CPU part and as the baseline, and it signs 4.5 to 6.1 times faster than the reference implementation on one core. On a Snapdragon 8 Gen 3 tablet, one core with the NPU signs 1.30 to 1.42 times faster than two cores and 1.74 to 1.97 times faster than one core for the three short-signature parameter sets. The same configuration uses 13 to 27 % less energy per signing operation than two cores. On Snapdragon 8 Elite and 8 Gen 2 phones, one core with the NPU signs 1.28 to 1.35 and 1.74 to 1.82 times faster than two cores.

The design of lightweight cryptographic schemes necessitates efficient circuit implementations of linear layers. A commonly used metric for evaluating circuit efficiency is the number of XOR gates required. For a given linear transformation over $\mathbb F_2$, finding its circuit implementation with the minimum number of XOR gates is referred to as the Shortest Linear Program (SLP) problem. As a prominent heuristic, the Boyar-Peralta (BP) algorithm provides competitive results, and numerous subsequent studies have introduced further optimizations. However, the inefficient implementations of the BP-like algorithms significantly limit their applicability to high-dimensional and dense matrices, and effective solutions to these performance bottlenecks remain scarce. In this paper, we address the performance bottlenecks of the BP algorithm and its variants (e.g., A1, A2 and BP-LSL) both theoretically and practically. We introduce the meet-in-the-middle (MITM) approach to reduce their theoretical time complexity. Practically, we re-design the implementation framework of these algorithms to fully leverage GPU parallelism, which significantly reduces the time spent on computing multiple XOR sums of bases, performing binary search, and updating distances. Meanwhile, we also propose a candidate pruning mechanism to reduce the computational burden on the GPU side and further improve the overall efficiency. Compared with the original implementations, we significantly accelerate the solving process for both normal and depth-constrained scenarios while maintaining the same solution quality. Our experimental results demonstrate that, for a 26-dimensional matrix with density 0.5, our implementation requires only 9.44 seconds on an entry-level GTX 1650 GPU, achieving a speedup of over $6{,}200\times$ compared with the current recursive, exhaustive, and one-threaded implementation. Using a high-performance RTX 4090 GPU, we extend the solvable boundary to 64-dimensional sparse matrices and 42-dimensional matrices with density 0.381. For 32-dimensional dense matrices, our accelerated A1 algorithm successfully establishes some new g-XOR records, including a 172-step g-XOR implementation for Whirlwind M0 and a 170-step implementation for Whirlwind M1. Besides, we also provide a 157-step g-XOR sequence for AES-InvMixColumn matrix with depth 5 through our BP-LSL implementation. Based on our accelerated BP implementation, we construct some MDS matrices with dimension 40 or more. For $4\times 4$ blockwise circulant matrices of dimensions 40, 48, and 64, the minimum g-XOR sequence lengths we found are 110, 132, and 184.

Eevee's Umbreon and Espeon modes claim online authenticated-encryption security under nonce reuse. We give an independent analysis of associated-data correlations that yield probability-one non-empty-message forgeries with three encryption queries and one verification query. Two AD-only tags reveal a mask difference that translates a ciphertext to another AD value. The basic attacks and their proof diagnosis overlap with independent and concurrent work by Mao et al. Our complementary contribution is a systematic affine treatment of partial final message blocks. For any admissible fixed final-fragment length r, n-r+3 encryption queries suffice; allowing the forged length to be r or r-h for a chosen 1 <= h < r < n, while choosing the source plaintext adaptively, reduces this to n-r+2. Both constructions satisfy the padding check and succeed with probability one. They apply to general message lengths, with at least one preceding complete block for Espeon. We also analyze the published short-message Espeon AD omission, validate the published complete-block Umbreon attack using the official ForkSkinny primitive in a specification adapter, and report a separate two-query attack accepted by the unmodified public C modes. Finalization is discussed only as an unproved countermeasure direction.

SNARKs let a verifier check an expensive computation via a succinct proof, without re-executing the computation. However, many applications still verify proofs individually, creating verifier load and high fees in replicated or constrained-verifier settings. Existing proof aggregation schemes largely follow the generalized inner product argument (GIPA) line, achieving $O(\log n)$ proof size and verifier work for aggregating $n$ proofs, but remaining costly in practice and operating in batch mode. Rather than batching until a full window is available, we present SNARKMux, a streaming SNARK aggregation scheme that maintains a constant-size aggregate and requires $O(1)$ online verifier work per window of size $n$. Motivated by incremental verifiability, SNARKMux directly folds the Groth16 and Plonk verification relations and composes these proof-system-specific folds with Nova's circuit-layer fold; this defers expensive target-verifier logic (e.g., pairings) to the final check while keeping constant aggregator state. As part of public-input aggregation, we propose a generic instance-delegation technique: the prover aggregates instances, and the verifier performs a simple binding preprocessing costing only $O(n)$ hashes per window, after which online verification is constant-cost. Notably, our Groth16 and Plonk instantiations cover both circuit-specific and universal-setup SNARKs, with preprocessing that makes Plonk challenges folding-compatible, leading to a 0.7 KB Groth16 aggregate with 18 ms verification and a 0.5 KB Plonk one with 2 ms verification for 256 proofs.

Memory checking arguments enable an untrusted prover to prove that it is correctly processing reads and writes to memory. They are used widely in modern SNARKs, especially in zkVMs, where the prover proves the correct execution of a CPU including the correctness of memory operations. We describe a new approach for memory checking, called the method of one-hot addressing and increments. We instantiate this method via two families of protocols, called Twist and Shout. Twist supports read/write memories, while Shout targets read-only memories (also known as lookup arguments). Both have logarithmic verifier costs. Unlike prior works, these protocols do not invoke "grand product" or "grand sum" arguments. Twist and Shout reduce commitment costs in two Jolt settings: 32 RISC-V registers and structured lookup tables of size $2^64$. With curve-based commitments, Twist at $d=1$ has about 3.7x fewer nonzero committed values and 1.7x fewer field multiplications than Spice for 32 registers; Shout at $d=2$ has at least 8x fewer nonzero committed values and 3.4x fewer field multiplications than Lasso for structured tables. We integrate Twist and Shout into the Jolt zkVM. They speed up the Jolt prover 3x while reducing proof size by about 5x.

Asynchronous verifiable secret sharing (AVSS) allows a dealer to distribute a secret among parties while preserving privacy and consistent reconstruction, despite Byzantine faults and arbitrary message delays. It is a fundamental building block for Byzantine agreement, distributed key generation, and secure multiparty computation. Packed AVSS protocols share many secrets together to reduce communication per secret. The best known AVSS protocols achieve quadratic communication while sharing linearly many secrets. In particular, Bingo (Abraham et al., CRYPTO 2023) shares a batch of $\Theta(k)$ secrets among $k$ parties using $O(\lambda k^2)$ words of communication, while also achieving adaptive security, but relies on assumptions that are not post-quantum secure. Known post-quantum alternatives have higher worst-case communication for comparable batch sizes or require substantially larger batches to achieve linear amortized communication. We present Lattice Bingo, a lattice-based packed AVSS protocol with quadratic communication and linear packing. For every constant $\epsilon>0$, it shares $\Theta(k)$ secrets among $k\geq(3+\epsilon)f$ parties, tolerates $f$ Byzantine parties, and uses $O(k^2\operatorname{poly}(\lambda))$ words of communication. It additionally achieves one-shot adaptive secrecy: the adversary may adaptively choose its corruption and reconstruction requests based on the public transcript observed so far, but must submit these requests together in a single batch. Our main technical contribution is a commitment scheme for two-dimensional linear codes based on the PowerBASIS assumption. We combine PowerBASIS commitments with the linear code based secret sharing of Applebaum, Nir, and Pinkas, replacing the Reed–Solomon encoding and KZG commitments used in Bingo. Our commitment supports proof interpolation, enabling parties to recover missing shares and their opening proofs. It additionally achieves a notion that we call one-shot simulation hiding. Together, these properties allow us to adapt Bingo’s framework to obtain Lattice Bingo with the same efficiency and one-shot adaptive security.

Very recently, Wesolowski (ePrint 2026/1486) proposed a novel heuristic algorithm for solving the supersingular isogeny-path problem in time and memory \(p^{1/3+o(1)}\), where \(p\) is the characteristic of the underlying field. Although this improves asymptotically on the previous \(p^{1/2}\log^{O(1)}(p)\) complexity, its concrete impact on isogeny-based schemes, particularly SQIsign, remains unclear because of the superpolynomial overhead hidden in \(p^{o(1)}\) and the exponential memory requirement. In this work, we assess the cost of Wesolowski's attack, study its time--memory tradeoffs, and investigate optimizations based on the van Oorschot -- Wiener (vOW) technique. Our analysis shows that, over the practical memory ranges considered, Wesolowski's algorithm is expected to improve on the state of the art only at NIST Level I. At higher security levels, its prohibitive memory requirements offset the asymptotic advantage over accelerated Delfs--Galbraith methods. With high parallelization, however, the vOW variant can recover this advantage. We further study quantum claw-finding improvements. While Grover search can essentially eliminate the large memory requirement, it offers little improvement in running time, whereas Tani's algorithm provides a stronger gate--memory tradeoff at the cost of substantial coherent quantum memory. Finally, we provide an optimized SageMath implementation and compare the theoretical time and space complexities against their empirical counterparts.

This paper introduces Zippel, a language, compiler, runtime, and analyzer for cryptographic proof systems. Zippel lets developers write proof systems with ease using syntax that mimics pseudocode in cryptography papers. It also eliminates entire classes of vulnerabilities by construction owing to its type system and runtime. For example, Zippel automatically synchronizes protocol transcripts and correctly applies the Fiat--Shamir transform. Zippel also has fully automated static analyses that confirm whether a protocol is complete and sound given only the protocol's description. We have implemented 35 proof systems in Zippel including Sumcheck, Schnorr, KZG, Groth16, Bulletproofs, Hyrax, Spartan, Dory, HyperPlonk, DeKART, and Pari. Our evaluation shows that Zippel programs are competitive with hand-written implementations on multi-core hardware, so Zippel's security and implementation benefits do not come at high cost.

The emerging ecosystem of outsourced proving services, decentralized prover networks, and prover marketplaces raises a new requirement for ZK-SNARKs: the need to watermark proofs with provenance information, such as the prover identity and a fresh request-time nonce. The prover identity records who should receive credit for the proof, while the nonce binds the proof to a particular request and is intended to prevent the prover from reusing work performed before that request was created. The key security requirement is that a prover must perform fresh work—comparable to computing the proof from scratch—when generating a proof for a fresh provenance, even if the attacker may have generated the same proofs before or performed precomputation. Prior attempts, such as Succinct Network, proposed embedding provenance information in the Fiat-Shamir challenges, though without a rigorous security definition or analysis. We show that this approach is not secure and is vulnerable to preprocessing attacks, in which an adversary can precompute provenance-independent information that can later be used to reduce the effort required to generate proofs for a fresh provenance. We instantiate these attacks against KZG-PLONK. To arrive at a secure construction, we propose the first formal definition for provenance-binding ZK-SNARKs to capture the above desired property. We present a generic construction that augments code-based polynomial commitments, such as BaseFold and FRI, with provenance binding. Compiling them with Poly-IOPs yields provenance-binding ZK-SNARKs. Our construction incurs minimal overhead.

Cayley hash functions hash binary strings by representing the bits of the message as elements of a semigroup and multiplying the corresponding elements. This gives Cayley hash functions useful homomorphic properties. Here, we propose CHAMP, a Cayley hash function based on products of $2\times 2$ matrices over a finite field, and discuss its security, implementation, and performance.

SPECK has recently been introduced as a code-based digital signature scheme exploiting the similarities between the Permuted Kernel Problem (PKP) and the Permutation Code Equivalence Problem (PEP). By utilizing PEP as a trapdoor for PKP, SPECK achieves a significant speedup compared to LESS, replacing expensive Gaussian elimination with vector-matrix multiplications. This comes at the cost of larger signatures, since each round of the Zero Knowledge (ZK) protocol used in SPECK has soundness error $1/2$. A well known technique to reduce the soundness errors (and thus the number of parallel repetitions and, ultimately, the signature size) in ZK proofs based on group actions consists in giving multiple elements in the public keys. Despite being constructed around an instance of PEP, which admits a natural description as a code-based group action, the protocol employed in SPECK deviates from the traditional proof of knowledge used for group actions. As shown by the authors of SPECK, a naive use of the multi-key optimization may lead to concrete security concerns. Therefore, the question on whether such a technique can be applied successfully to SPECK remains open. In this paper, we give a positive answer to such a question. We revisit the multi-key optimization for SPECK and investigate the underlying security concerns in detail, identifying conditions and parameter constraints under which multiple keys can be securely integrated into the protocol. Even though, when instantiated with conservative parameters, the multi-key optimization leads to unappealing performance, we show there is wide room for improvements. Furthermore, we design a ring signature scheme based on the same underlying construction.

Token-weighted governance can fingerprint individual voters: when weights are unequal and externally known, the exact weighted tally may reveal who voted which way. Publishing only the winning outcome hides the tally from the public, but a system that reconstructs the tally in order to decide still hands it to whoever runs the computation. Publishing only the winner is not the same as computing only the winner. We present a verifiable protocol for weighted DAO votes in which no protocol role ever receives the weighted tally in plaintext. Each ballot proves in zero knowledge that its encrypted contribution is exactly zero or the voter’s registered weight. Trustees add accepted contributions and compare the sum with a threshold entirely under encryption using the Cortier–Gaudry–Yang (CGY) conditional-gate toolbox, and decrypt only the final decision. A public verifier checks that the computation consumed exactly the ciphertexts accepted by the governance contract. We prove accepted-result correctness even when all trustees are malicious; restricted-I/O SUC security of the tally against static active corruption of any sub-threshold trustee coalition, which is any four of five in our reference instance; and winner-only disclosure relative to the real sealed board. With 1,024 voters, the encrypted tally takes 157 s and independent replay 115 s, while ballot proving dominates the 28.5-minute end-to-end pipeline. A fresh Arbitrum Sepolia execution exercises the complete public-chain path.

Performance in terms of bandwidth and execution time, as well as decoding failures remain important challenges for code-based KEMs. This paper introduces SLEEK: Sparse quasi-cycLic codEs with closEd-form DFR Key encapsulation, a Key Encapsulation Mechanism (KEM) based on Quasi-Cyclic Moderate-Density Parity-Check (QC-MDPC) codes. The scheme employs a parallel bit-flipping decoder with three iterations and a closed-form estimate of the decoding-failure rate (DFR). The latter allows parameter selection with analytically bounded failure probability and supports the use of standard IND-CCA transformations. We designed two variants of SLEEK. The first, SLEEK-LT, targets IND-CCA security for long-term keys, and supports QC-MDPC codes with different rates, allowing a tradeoff between public-key and ciphertext size. The second, SLEEK-E, targets IND-CPA security for ephemeral keys in settings requiring forward secrecy. While SLEEK-LT makes conservative choices and aims at security against active attackers, SLEEK-E relies on a novel QC key structure, for which we establish security equivalent to that of the original QC-MDPC construction under the same assumptions, while reducing key-generation cost. We explore a broad design space and provide parameter sets targeting $128$-, $192$-, and $256$-bit security, together with an $80$-bit configuration for constrained embedded platforms. We also optimize polynomial inversion and parallel bit-flipping decoding, the two dominant components of the implementation. We provide quantitative benchmarks of our optimized AVX2 implementation of SLEEK. For SLEEK-LT, ciphertexts are $4.9\times$ smaller than those of the NIST standard choice, HQC, at the cost of a $47$% increase in the runtime, and is $1.3\times$ to $2.7\times$ faster than BIKE. For SLEEK-E, execution time improves by $1.6\times$ over HQC with a bandwidth usage reduced by $2.1\times$. Compared with Lean-BIKE, SLEEK-E is $5.3\times$ faster and substantially reduces the impact of decoding failures on system reliability.

Large public keys and ciphertexts remain a major obstacle to the deployment of post-quantum cryptosystems in applications currently relying on compact classical schemes. In code-based post-quantum key encapsulation mechanisms, reducing the Decoding Failure Rate (DFR) generally requires larger parameters, further increasing communication and storage overheads. Ephemeral key-pair scenarios allow a different trade-off: ideally, each secret key is used for a single decapsulation, limiting the opportunities to observe and exploit decryption failures. We investigate how this setting can be used to reduce the public-key and ciphertext sizes of code-based key encapsulation mechanisms such as BIKE. We present the first optimized implementation of the $\textsf{BF-max}$ decoder: compared with conventional parallel bit-flipping decoders currently used by BIKE, $\textsf{BF-max}$ provides better error-correction capability, but its computational structure makes an efficient implementation less straightforward. Combining $\textsf{BF-max}$ with other decoders from the literature, we introduce decoding strategies that offer different trade-offs among DFR, execution time, public-key size, and ciphertext size. Experimental results show that the proposed design reduces both public-key and ciphertext sizes by 7.8\% compared with LeanBIKE, a BIKE variant specifically designed for ephemeral-key use, while retaining similar execution time and DFR. For additional context, the selected parameter set yields a combined public-key and ciphertext size that is 22\% smaller than that of BIKE and smaller by a factor of 2.79 than that of HQC. Note that BIKE and HQC, unlike LeanBIKE and our design, target the long-term-key setting. As a concrete application, we show that the solutions we propose make it possible to incorporate BIKE into constrained protocols, such as Internet Key Exchange version 2 (IKEv2), in which no code-based KEM would otherwise fit.

Side-channel attacks can uncover sensitive data by analyzing information leakages of cryptographic hardware devices caused by the power consumption, timing, electromagnetic, glitches, etc. Threshold implementation (TI), introduced by Nikova et al. in 2006, was proposed to resist differential power analysis side-channel attack on hardware implementations of block ciphers and eliminate information leakage due to glitches. For a function of algebraic degree $t\ge 2$, a TI requires at least $t+1$ shares. However, achieving this bound without fresh randomness is challenging, and we refer to such TIs as optimal. While a universal construction using $t+2$ shares is available, attaining the $t+1$ lower bound depends on the target permutation. In this paper, we present four constructions for optimal TIs of bijective S-boxes. We first demonstrate how adjoining identity coordinate functions enables optimal TIs, and then prove that $\mathcal{Q}_{30}^5$ admits optimal TIs. Second, we derive a matrix criterion for a class of quadratic permutations with optimal TIs, which covers all known examples, and can yield new $6$-bit quadratic classes with optimal TIs. Third, we introduce a weighted interpolation construction, which yields an infinite family of power permutations admitting optimal TIs, thereby providing counterexamples to the conjecture by Piccione et al. in 2023 that nonlinear power permutations cannot meet the $t+1$ lower bound. Notably, this family includes Bracken-Leander functions. To the best of our knowledge, this represents the first time optimal TIs have been constructed for permutations achieving differentially 4-uniform. Finally, we present a derivative-uniform framework. Although this construction is not algebraic-degree-preserving for TIs and comes at a high cost of implementation, it is of significant theoretical interest and enables us to prove that every $4$-bit cubic permutation admits optimal TIs.

Probabilistic countermeasures are a common means of protecting programs against side-channels. These countermeasures are hard to implement and are routinely broken by compilers. Proving that a compiler preserves probabilistic side-channel security directly would require reasoning about perfect simulatability of distributions, a challenging technique normally reserved for high-assurance cryptography in frameworks like EasyCrypt and out of scope for compiler correctness. In this paper, we present a language- and leakage-model-agnostic framework for provably secure compilation of probabilistic side-channel security notions. Our main contribution is formalizing a deterministic leakage-preservation relation that implies preservation of probabilistic security notions, including d-NI and d-SNI for masking and cryptographic constant-time. Our framework establishes the same guarantees without probabilistic proof obligations, reducing preservation to a per-pass simulation argument on deterministic traces. We use the Rocq proof assistant to prove that a model of the core pipeline and several optimizing passes of the Jasmin compiler preserve security in the value-probing model with glitches. We also show how to harden against transition leakage with lightweight annotations at the source level. On top of this, we build libmasking, an open-source library of arbitrary-order masked gadgets in Jasmin that securely compiles to ARM and RISC-V assembly, provides C language bindings, and is benchmarked on real hardware. Together, these contributions are a step towards programming environments in which masked code is written or generated, verified at the source level, optimized, and compiled without breaking security.

Fully Homomorphic Encryption (FHE) is a modern cryptographic technique that allows performing computations directly on encrypted data. This makes FHE an indispensable method for privacy-preserving applications, where users' data are encrypted and processed by a potentially untrusted third party. Nevertheless, FHE operations are computationally expensive, often rendering them impractical for realistic scenarios. Notably, a major performance bottleneck for FHE is an operation called bootstrapping that allows refreshing the inherent noise of FHE data to support more computations. In this work, we introduce LazyArc, a versatile lightweight dynamic Out-of-Order (OoO) software engine that enables higher-throughput FHE computations. Our proposed OoO paradigm improves the performance by masking the latency of bootstrapping via a bespoke instruction-bootstrapping scheduling paradigm. Also, we introduce a novel tool, dubbed RegisterMap Tool, to statically analyze FHE arithmetic circuits and track the noise of each ciphertext to allow proactive bootstrapping scheduling. Our approach is evaluated using linear algebra benchmarks and achieves more than 2x speedup compared to in-order baselines, and more than 5x speedup compared to the FHEBooster scheduler.

Fully homomorphic encryption (FHE) enables computation directly on encrypted data and is increasingly researched for privacy-preserving machine-learning inference. Such workloads are dominated by matrix multiplication, which is not represented natively by conventional vector-oriented FHE schemes. CKKS is widely used for approximate encrypted inference because it supports packed real and complex arithmetic; however, matrix multiplication generally requires specific packing formats that are tailored to certain models, and involves many expensive ciphertext rotations. Depending on the matrix dimensions and packing strategy, these techniques can introduce substantial latency and memory overhead. The recently proposed Gentry-Lee (GL) scheme instead provides native slot-encoded matrix arithmetic through a multivariate ring construction while retaining approximate packed computation. Although promising, the prime-p GL instances considered here require prime-length NTTs and a three-dimensional DFT message encoding, whose efficient implementation has received limited study. Moreover, the original scheme does not specify a concrete bootstrapping procedure, which is required to support the deep computations used by large neural-network models. In this work, we present a low-depth complex bootstrapping framework tailored to the GL scheme. Our construction combines a two-stage GL StC, in which the X-axis inversion uses native plaintext-ciphertext matrix multiplication and the W-axis inversion uses a diagonal BSGS transform, with a slice-wise adaptation of SHIP to the Gaussian (X, W) algebra. The public masked-column candidates evaluate the complete W-axis monomial action and the fine X-axis residue, leaving only the coarse X-axis displacement for hidden HMux selection and eliminating encrypted W-axis selection. We further algebraically reduce the online plaintext-encoding requirement of the masked-column interface from the fully expanded candidate-family upper bound of 8θφ(p) + 2 to 2φ(p) + 2 plaintexts per Y-slice and optimize the Rader NTT through fused kernels and other arithmetic optimizations. Across the evaluated configurations, the faster GL axis order gives amortized per-slice StC speedups of 3.44x-4.10x at one thread and 7.75x-9.04x at 32 threads over the matched CKKS baselines. For full complex bootstrapping, the CKKS-to-GL per-slice latency ratios are 0.78-1.21 at one thread and 1.05-1.95 at 32 threads.

Sumcheck is increasingly used in proof systems based on multilinear polynomials, but its execution structure differs from that of conventional GPU targets such as MSM and NTT. Each round contains substantial data-parallel polynomial computation, but consecutive rounds depend on challenges derived from previous rounds and interact with the surrounding prover's proof-generation operations. Efficient acceleration therefore depends not only on GPU arithmetic throughput, but also on where polynomial data resides, what crosses the CPU-GPU boundary, and when execution should return to the CPU. We present Chimera, a hybrid CPU-GPU backend for Sumcheck computations in the Spartan R1CS prover. Chimera keeps large polynomial data on the GPU across profitable rounds, returns only the compact polynomial values needed by Spartan's transcript, and sends the resulting challenge back to the GPU for folding. It switches sufficiently small late rounds to Spartan's native CPU implementation. When polynomial data exceeds GPU memory, Chimera processes it in smaller portions and transitions to resident GPU execution once the remaining data fits. Chimera preserves Spartan's proof format and verifier behavior while also reducing CPU-side overhead directly surrounding the accelerated Sumcheck computations. On BN254 Spartan R1CS instances, Chimera reduces the measured Sumcheck-related region from \(672.785\) ms to \(84.245\) ms at \(N=2^{17}\), a \(7.99\times\) speedup. Complete proving time improves at every measured size, reaching \(1.27\times\)-\(1.64\times\) speedup for \(N=2^{24}\)-\(2^{27}\). Separately, our standalone quadratic GPU Sumcheck executes in \(28.7\) ms at \(N=2^{22}\), compared with \(84.2\) ms for ICICLE's CUDA Sumcheck implementation, a \(2.94\times\) GPU-to-GPU improvement. These results show that effective Sumcheck acceleration depends on both efficient GPU execution and careful integration with the surrounding proof system.

The security of lattice-based cryptography relies critically on the concrete hardness of the approximate shortest vector problem (Approx-SVP). For cryptographic-sized instances, existing Approx-SVP rank reduction conditions may be overly aggressive, as they implicitly assume access to a large number of extremely short lattice vectors. In this work, we systematize and refine Approx-SVP rank reduction conditions from a feasibility perspective. We identify that, in the context of the dimension-for-free (D4f) technique, the existence of a single sufficiently short vector is the essential requirement, and we derive two refined and compact rank reduction conditions accordingly. The first condition is based on geometric properties of lattice sieving, while the second incorporates a basis-quality-dependent probabilistic bound. These results are validated through extensive experiments on high-dimensional lattices, where the compact condition outperforms prior methods by up to a factor of $60$ in dimensions $850$ and $925$. To reliably realize these conditions in high dimensions, we present APBKZ, an adaptive Pump-based lattice reduction strategy that dynamically selects the blocksize and D4f parameters according to the evolving Gram-Schmidt profile. We further introduce HeadAPBKZ, a head-focused execution mode that restricts reduction to a critical prefix once the rank reduction condition is satisfied. Combining these advances, we develop an improved concrete security estimation framework for the MSIS problem. Applied to Dilithium, our analysis indicates that, when compact rank reduction behavior is integrated with the D4f technique, the estimated concrete security of Dilithium is reduced by 3.65-6.09 bits relative to the conservative Core-SVP baseline, providing a more realistic concrete assessment. We also derive an analytic approximation whose closed-form estimates remain close to the numerical estimation, with discrepancies of only about 1.1 bits.

Homomorphic Encryption (HE) enables secure cloud computing through computations on encrypted data, but the physical execution of HE workloads on shared GPUs can still expose relevant metadata through microarchitectural behavior. We present a case study of BFV relinearization in HEonGPU, a state-of-the-art GPU HE library, and show that repeated executions exhibit structured, reproducible variation in shared-L2 activity across relinearization-key contexts. Our analysis further shows that the regular control-flow structure observed in the optimized HEonGPU binary is compiler-dependent rather than enforced by the source implementation. Together, these observations motivate an HE design in which execution regularity is established explicitly rather than obtained as a consequence of compilation. We present JANUS-FHE, a GPU framework for BFV multiplication and relinearization that restructures the computation around fixed-width large-integer arithmetic. JANUS reconstructs ciphertext coefficients from the RNS representation, uses Kronecker substitution to express polynomial multiplication as large-integer multiplication, and evaluates the resulting convolution through a Stockham-organized Discrete Galois Transform (DGT). JANUS carries this fixed execution structure through product recovery, BFV scale-and-round, and method-I relinearization, using fixed-width computation and branchless masked arithmetic throughout. This formulation makes the control flow, memory-access schedule, and execution geometry depend on public parameters rather than the ciphertext or evaluation-key values. Under the same shared-L2 methodology used for HEonGPU, JANUS exhibits fewer recurring key-conditioned differences, while SASS-level analysis confirms that its intended regular execution structure is preserved after compilation. At \(N=8192\), JANUS completes the full multiplication-and-relinearization path in \(0.350\) ms, compared with \(0.153\) ms for HEonGPU, representing a \(2.29\times\) latency overhead for JANUS's parameter-determined execution structure.

HQC has recently been selected by NIST as a code-based alternative to ML-KEM and is currently undergoing standardization. While multiple timing and power side-channel attacks against HQC have been presented, application of masking has so far only been studied for software implementations. As part of this work, we close this gap by first proposing a novel masking technique for the sparse-dense vector multiplication, one of the core components in all HQC operations. We manage to securely exploit the sparsity of the secret operand using a mixed Boolean and arithmetic masking technique and prove its first-order security in the transition- and glitch-robust probing model as well as its PINI-composability. With the same memory width, our configurable and highly parallelizable masked design takes only 3% more clock cycles than a previous unprotected HQC multiplier. Furthermore, our technique requires only 81 bits of randomness per cycle, irrespective of its parallelism. However, like previous Rotate-and-Add constructions, it is vulnerable to profiled horizontal side-channel attacks, which recover all support indices within ±8 positions from 200 traces of our FPGA implementation despite TVLA showing no signs of leakage after 10 million traces. To prevent such attacks, we integrate efficient hiding countermeasures natively into the architecture of the multiplier, resulting in only 1.7% additional latency and moderate area overhead. Together with efficiently masked fixed-weight samplers and a masked decoder, we present the, to our knowledge, first fully masked hardware implementation of HQC, supporting first-order masked key generation, encapsulation, and decapsulation. Notably, our masked key generation is faster than a previous unprotected design from literature on an Artix-7 FPGA. Lastly, all modules of our complete designs show no signs of first-order leakage after 1 million traces.

Lattice-based post-quantum cryptographic schemes such as ML-KEM or ML-DSA combine bitwise operations, which are most efficiently masked using Boolean secret sharing, with arithmetic operations modulo q, which are cheaper to mask using an additive sharing in the respective field or ring. Previous work has automated the generation of Boolean-masked hardware circuits as well as the design space exploration process, but to the best of our knowledge, no similar generic framework exists for hardware designs requiring mixed masking domains. Such designs pose three additional challenges. First, share-wise arithmetic requires no registers to be secure, leading to long critical paths without deliberate pipelining. Second, the conversions required at domain boundaries increase both complexity and susceptibility to human error. Finally, generation of masking randomness from a traditional PRNG requires post-processing, e.g., via rejection sampling, to achieve uniformity modulo q, which results in a variable output rate. We solve these issues and integrate our scheme-agnostic solutions into the masking and design space exploration framework HADES. An efficient pre-synthesis critical path estimation, which is around 60 times faster than synthesis with traditional timing analysis, enables effective exploration of mixed-domain masked circuits without compromising the maximum clock frequency. Our adapted gadget-based masking procedure tracks masking domains and inserts pipelined conversions at domain boundaries automatically, or lets the template developer place resource-shared conversions manually. Lastly, a Markov-chain model of probabilistic masking randomness generation and buffering yields cost-minimal design configurations that guarantee stall-free masked operation except for a user-defined failure probability. We evaluate our methodology for multiple relevant moduli and implement an arbitrary-order masked ML-KEM decapsulation core as a case study for our open-source framework. Its area-optimized configurations represent, to the best of our knowledge, the most compact reported ML-KEM designs, with 54.1 kGE unmasked and 125.4 kGE at first order using the NanGate45 library. Jointly optimizing for area and critical path yields competitive clock frequencies of 325–429 MHz for at most 31% more area, which is still smaller than all previous designs. Practical side-channel security at both first and second masking order is validated through FPGA-based TVLA measurements of the full decapsulation routine using 10 million traces each.

We present $\textsf{Sluice}$, a read-write streaming Groth16 prover that reduces $\textit{prove-phase}$ random-access working memory from $\mathcal{O}(N)$ to $\mathcal{O}(\log N)$ once the CRS, QAP, and witness are materialized as private streams. It preserves the standard Groth16 interface: a proof of 3 group elements, 3-pairing verification, and unchanged verifier contracts. Our key technical contribution is $\textit{Split-Butterfly-Merge}$ ($\mathsf{SBM}$), an NTT algorithm in the read-write streaming model with $\mathcal{O}(\log N)$ memory, $\mathcal{O}(N \log N)$ total I/O, and $\mathcal{O}(\log N)$ sequential passes over external storage. Combining SBM with streaming sparse R1CS evaluation and chunked Pippenger MSM yields a verifier-compatible Groth16 proving path that exchanges RAM for sequential storage I/O and wall-clock time. Our prototype uses a fixed-window MSM engineering point; the measurements validate memory reduction and proof compatibility, while the theorem states the asymptotically tuned MSM schedule. We implement $\textsf{Sluice}$ over BN-254. Direct prove-only runs produce valid 128-byte proofs through $N=2^{25}$. The same-size bounded-memory comparison is at $N=2^{23}$: $\textsf{Sluice}$ succeeds under an 8GB Linux cgroup cap, whereas the standard prover is killed under 8GB and 12GB caps and succeeds only at 16GB. These results position $\textsf{Sluice}$ as a storage-rich, RAM-limited proving option rather than a replacement for optimized in-memory provers.

Verifiable computation systems often need to prove large matrix multiplication statements, but a direct SNARK arithmetization of a \(k \times k\) product requires \(\mathcal{O}(k^3)\) constraints. Freivalds' randomized check reduces the algebraic computation to vector-matrix products, but proving those products inside a SNARK still costs \(\mathcal{O}(k^2)\) constraints. We present LAMP, a matrix-multiplication checking protocol that combines Freivalds' randomized check with proximity testing over linear error-correcting codes. The prover commits to encoded matrices and intermediate vectors before the sampled query positions are derived. The CP-SNARK circuit then checks only the sampled codeword positions and commits to the values used inside the circuit, while Merkle openings and CP-Link proofs ensure consistency between the in-circuit witnesses and the externally committed values. We prove soundness for this committed-input setting under the soundness of the SNARK backend, the binding of the commitments, the correctness of the CP-Link checks, and the relative distance and unique-decoding radius of the Reed--Solomon code. For a fixed number \(t\) of sampled positions, the main in-circuit SNARK relation has \(\mathcal{O}(tk+E_{\mathsf{code}})\) constraints, with additional \(\mathcal{O}(t\log n)+E_{\mathsf{link}}(k,t)\) backend work for Merkle openings and CP-Link checks. We implement LAMP in Go and compare it with a Freivalds-based SNARK circuit. In the matrix benchmark at \(k=2^{12}\), LAMP reduces the constraint count by \(9.68\times\) and shortens proof generation time by \(5.81\times\); verification remains approximately \(0.13\,\text{s}\) across the measured range.

SQIsign is an isogeny-based signature scheme, which is one of the Round-3 candidates for NIST's additional post-quantum digital signature standardization. NIST considers resistance to side-channel attacks as one important factor in evaluating digital signature schemes. However, side-channel analysis of SQIsign remains very limited. To the best of our knowledge, all existing studies target the Round-1 version, so their applicability to the substantially revised Round-3 SQIsign has not been established. Moreover, existing studies either provide experimental validation only for toy parameters or assume exploitable leakage without demonstrating its extraction in practice, leaving their applicability to realistic implementations unclear. In this work, we identify five side-channel vulnerabilities in the signing procedure of Round-3 SQIsign and provide polynomial-time algebraic algorithms that recover the secret key from the corresponding leaked intermediate values. Additionally, we further provide algorithms that enable the reconstruction of the complete secret key even when the side-channel leakage reveals only partial bits of an algebraic value, for each vulnerability. Finally, we further perform power analysis attack on the SQIsign source code, extracting the necessary leakage or its partial information for each vulnerability.

Choosing a hardware S-box means balancing cryptanalytic strength (differential uniformity δ, linearity L, and algebraic degree) against circuit cost (AND count and AND depth D). Under masking, non-linear gates dominate silicon area, registers, and fresh randomness, while D sets pipeline latency. As a result, automated searches have largely retreated to quadratic permutations (D = 1), whose slow degree growth forces high cipher round counts. We present Yoshan, a co-synthesis engine that optimizes an S-box permutation and its gate-level circuit together across n ∈ {5,6,7,8}. Inside a quality-diversity archive, Yoshan seeds search with subfield towers, Feistel/Misty/MM networks, affine wrappers, CCZ graph automorphisms, and bilinear or shear constructions. It then evolves circuits via cryptographically guided DAG rewrites and exploratory differentiable Piling-Up seeding and crossover with Hungarian LSAP projection, before compressing them with SMT sub-DAG shaving, stage-preserving CSE, exact depth-1 SAT, and four-tier inverse compilation. Every archived circuit is exported gate for gate to SystemVerilog and certified by exhaustive simulation and a Z3 miter. Across 31,337 certified netlists (30,986 distinct permutations) in 56 (n,δ,L,deg) profiles, EA invariants and an exact affine-equivalence solver against a 712-entry catalogue (power maps, 5- and 6-bit quadratic/quartic classifications, Feistel/MISTY/Bridge structures, two-point-swapped power maps, and cipher S-boxes) partition the archive into known catalogue classes (Category A, 2,681 permutations) and permutations certified EAseparated from it (Category B, 28,305 permutations; 12 benchmark classes YSHn,i). All 30 benchmark S-boxes and their explicit inverses are synthesized gate-exactly in 45nm CMOS (unmasked and pipelined d = 2 DOM) and traced from seed to final netlist. For known classes, we obtain a gate-exact depth-3 AES-class pair (42 AND, 101 XOR; inverse 42 AND, 106 XOR at D = 3) and a provably AND-optimal 5-AND, D =1 circuit for the 5-bit Q71 class (δ = 4,L = 16). When the lookup table can vary, we find a 12-AND 6-bit degree-5 S-box YSH6,5 (δ = 6,L = 24,β = 14), a 5-AND, D =2 5-bit quartic S-box YSH5,2 in both directions, and 28- and 18-AND 8-bit degree-7 S-boxes, all compared against the best published circuits.

The deepest level of Falcon's NTRU solver needs only one Bézout coefficient from two large integer resultants already represented in a residue number system (RNS). We give $\mathtt{safeRNSgcd}$, which computes this coefficient while keeping the large states in RNS. Its central insight is that centered explicit CRT can recover the exact low bits needed by SafeGCD batches using single-word fixed-point arithmetic. Integrated into $\mathtt{ntrugen}$, our C implementation reduces inversion and private-key basis-generation costs on a Raspberry Pi 5 and two x86-64 processors, compared with original $\mathtt{ntrugen}$ and a variant omitting the unused coefficient.

Recently, the notion of dynamic zk-SNARKs was introduced. A dynamic zk-SNARK augments a standard zk-SNARK with an efficient update algorithm. Given a valid source statement-witness pair $(x,w)$ together with a verifying proof $p$, and a valid target statement-witness pair $(x',w')$, the update algorithm outputs a verifying proof $p'$ for $(x',w')$. Crucially, $p'$ is not recomputed from scratch; instead, the update algorithm takes time roughly proportional to the Hamming distance between $(x,w)$ and $(x',w')$, analogous to how dynamic data structures update the result of a computation after a small change. In this paper, we initiate the study of designated-verifier dynamic zk-SNARKs: dynamic zk-SNARKs in which only a designated verifier, holding secret verification state, can be convinced by a proof. Following recent advances in designated-verifier zk-SNARKs---such as efficient post-quantum designated verifier SNARKs (CCS 2021) and designated verifier SNARKs with very small proofs (CRYPTO 2025)---we construct a designated-verifier dynamic zk-SNARK with $O(\log n)$ update time, constant proof size, and concrete efficiency. Our construction significantly outperforms Dynalog (both asymptotically and concretely), the only publicly verifiable dynamic zk-SNARK with polylogarithmic update time (Wang et al., 2024). The concrete efficiency of our construction enables, for the first time, an efficient implementation of a dynamic proof of index: Given a digest $d$ of an arbitrary set and a digest $d'$ of its sorted index (e.g., binary search tree), we produce a SNARK proof certifying the consistency of $d$ and $d'$. More importantly, this proof can be updated in sublinear time when the underlying set changes---for example, when an element is modified or inserted, potentially altering the sorted order. We demonstrate applications of designated-verifier dynamic proofs of index to verifiable dynamic database outsourcing, where a client outsources a database and later maintains verifiable indices for efficient query answering, even under arbitrary database updates.

The evaluation of two-dimensional isogeny representations is a fundamental operation in many isogeny-based cryptographic schemes, notably the public-key encryption schemes POK\'{E} (Eurocrypt 2025) and PIKE (PKC 2026), as well as the digital signature schemes SQIsign2D-West (Asiacrypt 2024) and SQIsign2DPush (Eurocrypt 2026). However, existing two-dimensional evaluation algorithms rely on time-consuming discrete logarithm computations and torsion-basis generation, creating a severe performance bottleneck for the entire protocol. In this paper, we propose a novel algorithm for evaluating two-dimensional representations by leveraging the properties of dual isogenies, thereby eliminating the need for costly discrete logarithms. We apply this methodology to significantly accelerate some isogeny-based protocols, including POK\'{E}, SQIsign2D, and their variants. We provide optimized C implementations for the speed-optimized variants of POK\'{E} and SQIsign2D using our proposed method. Experimental benchmarks demonstrate that the fast variants of POK\'{E} combined with our new techniques achieve computational speedups of up to $3.47\times$ in terms of CPU clock cycles compared to POK\'{E} at the NIST-I security level. Additionally, our explicit analysis and implementation results confirm that the signing phase of SQIsign2DPush (resp. the NIST post-quantum cryptography standardization candidate SQIsign-v3.0), when using our method, achieves a performance improvement of up to $11.24\%$ (resp. $5.02$\%) across the three NIST security levels.

Incrementally Verifiable Computation (IVC) allows one to prove the correctness of a computation of potentially unbounded length (or, depth) in an incremental way, while a computationally weak client can efficiently check its correctness in time sublinear in the computation's length. IVC are of practical relevance; yet, most existing IVC schemes are only provably secure for constant-depth computations. Arguing their security for computations of polynomial depth relies on heuristic assumptions, raising both theoretical and practical concerns. More generally, it remains unclear whether these schemes are genuinely insecure at superconstant depths or whether our current proof techniques are simply insufficient. In this work, we delve into the security foundations of incremental proof systems, while at the same time looking for new approaches to prove security at superconstant depths. To this end, we study the relation between the depth of the target computation and IVC security as a question in its own right. Specifically, we ask: - Can we prove an IVC secure at depth $d =\omega(1)$ if it satisfies a "weak" security property at some "larger" depth $D$? We uncover a surprising connection between infinitely-often soundness (guaranteed to hold only for some infinite set of parameters) and standard soundness in IVC: a scheme that is infinitely-often sound at $D$ depth achieves standard soundness at some "smaller" depth $d=o(D)$. - How does a proof system's security degrade with depth? More precisely, if a scheme loses negligible soundness beyond (e.g.) $O(1)$ depth—the current provable frontier of most practical schemes—can we at least achieve noticeable (but arbitrarily low) soundness for some superconstant depth? We show the answer is negative. - Depth boosting: If there exists an IVC scheme secure at depth $d$, does there exist one secure at a "greater" depth? We show a simple and black-box boosting technique: given an IVC secure at depth $d$, we can construct one secure at depth $D = d^\rho$ for any function $\rho$ such that $d^\rho$ is polynomially bounded ($\rho$ can even be superconstant). This allows us to systematically amplify security from modest depths to much greater ones (e.g., constant to polynomial depth, with only a logarithmic overhead). Our results uncover a nuanced landscape of depth, efficiency, and security in IVC, and new strategies to prove security beyond $O(1)$ depth. They also apply to non-deterministic computations and other soundness notions, including incremental functional commitments (IFC), a streaming variant of functional commitments that we introduce.

Liu et al. (2022 Phys. Scr. 97 045102) propose a quantum public key encryption scheme in which a qubit message is encrypted by a controlled-NOT gate driven by a four-state public key, followed by measurement of the message register, and claim information-theoretic security. I show that the encryption map reduces exactly to \( |M\rangle \mapsto R_{\theta}X^{m}|M\rangle \), where the outcome \(m\) is published. \(R_{\theta}\) is diagonal and the ciphertext reproduces the computational-basis distribution \((|\alpha|^2,|\beta|^2)\) of the plaintext, while the plaintexts \(|0\rangle\) and \(|1\rangle\) are perfectly distinguishable. The claim of information-theoretic security is therefore invalid.

In the blockchain setting, where key derivation standards such as BIP32, BIP44, and SLIP-10 are the dominant infrastructure for wallet management, a quantum computer running Shor's algorithm can recover any elliptic-curve private key from the corresponding public key, threatening every wallet in production today. Migrating to post-quantum signature schemes requires changing the public key format and forcing address migration across all participating networks. We present an orthogonal approach: keep the existing address format unchanged and replace the classical signing step with a NIZK proof of knowledge of the seed underlying the address (or of the private data of a hardened ancestor), where no step of the security argument relies on the discrete logarithm problem. We prove security against quantum adversaries in the quantum random oracle model, under an explicit assumption on the zero-knowledge and simulation extractability of the NIZK. We build on the observation of Baldimtsi et al.\ that EdDSA's deterministic seed-to-key mapping makes the seed a valid zero-knowledge witness for the public key, and extend their result to hierarchical deterministic wallets. Our main contribution is ZKPoSP (Zero-Knowledge Proof of Seed Provenance), a signature scheme that splits the proof into a derivation proof generated once per key pair and a signing proof generated once per message, so that the per-message proving cost does not depend on the derivation depth. We also introduce QBIP32, a key derivation scheme based on a keyed function HASH768 (instantiated with KMAC256) that produces the signing scalar, an explicit witness, and the chain code in a single call at hardened steps, for any elliptic curve group of prime order. As last contributioun we notice that after Q-day, once networks reject all non-post-quantum signatures, the signing scalars can be moved to the public statement reducing derivation proving time.

This paper deals with the hardness of finding short vectors in module lattices. Let $K$ be a number field of degree $d$ and $\mathcal{O}_K$ its ring of integers. We show that if a module lattice $M$ of rank $n$ in $\mathcal{O}_K^n$ has some Galois-symmetries, namely if it is fixed coordinate-wise (as a set) by a group $G$ of automorphisms of $K$, then $M$ can actually be seen as a module of rank~$n$ over a subfield~$K'$ of $K$ ($K'$ is the fixed-field of $G$), whose degree is $|G|$ times smaller than the degree of $K$. When one wants to find short vectors in $M$, this translates into the observation that the module lattice $M$, which is a priori a lattice of rank $n d$ can in fact be seen as a lattice of rank only $n d / |G|$. Hence, finding short vectors in $M$ is easier than what one could have expected by forgetting about the algebraic structure of $M$. This result is a generalization of a similar result by Boudgoust, Gachon and Pellet-Mary (Crypto'22), which was restricted to ideal lattices (i.e., modules of rank $1$).

We present a deterministic $n$-party Byzantine broadcast protocol secure against $t<n$ faults, with communication complexity $O(n^2\log^4(n)\lambda)$ and $O(t)$ rounds (where $\lambda$ is a security parameter), improving upon the seminal Dolev--Strong protocol from 1983.

Stateless hash-based signatures are among the most important post-quantum signature schemes. Although they have been standardized by NIST, they still have large signatures. Within these constructions, the few-time signature component is receiving increasing attention. Recent work has introduced new techniques, including rejection sampling, forced pruning, bucket thinning, and hash chains. In this work, we continue to improve few-time signatures with a new technique, guarded sharing. Our construction moves beyond the previous tree-based model to a DAG-based signature. By combining guarded sharing with bucket thinning, hash chains, and rejection sampling, we obtain a new signature scheme called BGS-CC. Our construction further improves on the state-of-the-art few-time signature BPORS-C+BFP. Most notably, for 128-bit security and a small use quota of $Q=2^{24}$, it yields complete signatures of 2,228 bytes. To our knowledge, this is the first SPHINCS-based stateless signature to be shorter than the 2,420-byte signatures of the standardized module-lattice scheme ML-DSA-44.

We show that under a plausible number-theoretic conjecture, for any constant $s$ there exists an $s$-server private information retrieval (PIR) protocol that on an $n$-bit database requires communication $\exp(O((\log n)^{1/s} (\log \log n)^{1-1/s}))$. This achieves a superpolynomial improvement in communication when $s \geq 4$; previous constructions attaining the same communication required $2^{O(s)}$ servers. Our number-theoretic conjecture is implied by existing conjectures, namely the generalized repunit conjecture and Schinzel's hypothesis H (either one of these conjectures would suffice alone). Our result builds on the "matching vector family + $S$-decoding polynomials" framework pioneered by Efremenko (STOC 2009) and recently refined by Ghasemi, Kopparty, and Sudan (STOC 2025). The main ingredient is a framework for constructing $S$-decoding polynomials with only $k+1$ nonzero coefficients modulo special products of $k$ primes, resolving an open problem posed by Ghasemi and Kopparty (ITCS 2026). By the lower bound shown by Ghasemi and Kopparty, this is the minimum achievable sparsity. We also empirically validate our construction and make our result unconditional for all $s \leq 15$. We also apply our techniques to regimes where $s$ grows with $n$, showing under a stronger variant of our number-theoretic conjecture that the communication complexity of $s$-server matching-vector PIR can be superpolynomially reduced from the previous state of the art for any $s \leq \exp(o(\sqrt{\log \log n/\log \log \log n}))$. The main result for $s = O(1)$ and its proof were discovered in a GPT-5.5 Pro conversation prompted by the authors.

The post-quantum signatures selected by NIST are ten to over a hundred times larger than the elliptic-curve signatures they replace. Moreover, unlike the BLS signatures that blockchains use to aggregate validator votes, they do not aggregate natively. Both problems can be addressed with a SNARK: a short proof that a batch of signatures is valid, replacing the signatures themselves. The prevailing approach, central to Ethereum's roadmap, pairs hash-based signatures with hash-based SNARKs. This is slow because the prover must prove many hash evaluations per signature. We instead aggregate lattice-based signatures with a lattice-based SNARK. We present Aerie, a proof system for aggregating Falcon-512 and Falcon-1024 signatures. By retaining each signature's short random salt in the aggregate, Aerie lets the verifier compute the hashes directly. The proof then covers only algebraic and norm checks. Aerie combines protocols tailored to these checks with the Akita polynomial commitment scheme. Unlike prior Falcon aggregation schemes, it also proves that the signatures satisfy Falcon's byte-format requirements. On an Apple M4 Max laptop without GPU acceleration, Aerie aggregates 32,768 Falcon-512 signatures, roughly the number of validator votes in one Ethereum slot, in 0.65 seconds. A single proof covers the whole batch, with no recursion. The aggregate is 42.1 bytes per signature including the salts, or about 66 KiB in total if the signatures share one salt. It verifies in 54 milliseconds on one core, 10× faster than checking the signatures individually. On one core, proving takes only about 8× as long as individual verification. We prove knowledge soundness of Aerie in the classical random-oracle model and derive aggregate unforgeability from Falcon's security.

This paper presents a new fuzzy private set intersection (FPSI) protocol, a two-party protocol to securely identify similar items across private sets. Our design departs from the prevailing separation-based paradigm---e.g., ``apart by $2\delta$'' or the disjoint projection assumption---which either incurs exponential overhead in dimensionality or requires high dimensionality to justify the assumption. Instead, we address this tension by explicitly allowing collisions within $\delta$-balls, but requiring that their multiplicity be bounded per axis. We formalize this new structural property as $C$-max collision. We theoretically analyze its plausibility on several common distributions, e.g., the uniform distribution, and real datasets, and provide an efficient algorithm to verify this assumption. Under the $C$-max collision property, we propose an efficient FPSI protocol for $\ell_{\infty}$ distance that supports both low- and high-dimensional regimes. Our construction is based on a novel abstraction that views FPSI as an oblivious intersection of membership tags, which natively handles axis-wise matching multiplicity. We capture its requirements through a new functionality called oblivious selected set intersection, along with its instantiation based on symmetric key techniques. Assuming the $C$-max collision property on the receiver's set, our protocol achieves computation/communication complexities scaling linearly with both parties' set sizes for a fixed $C$. We implement our protocol and conduct extensive evaluation. While a direct comparison is infeasible, ours achieves online efficiency comparable to state-of-the-art separation-based FPSI protocols in both low- and high-dimensional regimes.

Lattice-based polynomial commitment schemes (PCSs) promise post-quantum SNARKs with two properties that elliptic curves provide and hash-based schemes, today's deployed post-quantum default, do not: concretely small proofs and commitment time proportional to the number of nonzero entries in the committed polynomial rather than its length. The second property is essential to Twist and Shout (CRYPTO 2026), the fastest known memory-checking arguments and a core component of the Jolt zero-knowledge virtual machine (zkVM): their prover commits to enormous polynomials that are almost entirely zero. Yet despite a wave of recent work, existing lattice-based PCSs achieve at most two of the three properties that deployment demands: small proof size, fast verification, and soundness from standard assumptions such as Module-SIS. We present Akita, a lattice-based PCS that achieves all three. We improve on the square-root-time verifier of Hachi (ePrint 2026), our direct predecessor, through a new setup offloading technique: the public setup matrices are committed ahead of time, and the verifier's work in processing them is deferred and proved against these commitments. For any fixed $K\ge2$, this reduces verification time to $\widetilde O_{K,\lambda}(N^{1/K})$ while preserving $\widetilde O_{K,\lambda}(\log N)$ proof size, $\widetilde O_{K,\lambda}(N)$ prover time, and security from standard Module-SIS. We also optimize every fold from root to tail and iterate the fold to completion. This includes an optimized digit range check, relation-specific ring dimensions and subring challenges, complementary methods for embedding field evaluations and checking ring relations, commitments compressed to $128$ bytes each, and exact Euclidean norm checks for tighter Module-SIS parameters. Beyond the core protocol, Akita provides the capabilities needed for deployment in a zkVM: batched openings of separately committed polynomials, low-communication distributed proving, and an offline planner for selecting secure parameters under configurable cost objectives. We implement Akita in Rust and benchmark it against existing lattice-based and hash-based PCSs. Across these benchmarks, Akita produces proofs of only $58$–$68$ KB, matching Greyhound's when both schemes are calibrated to the same lattice-security target, while verifying $22.1\times$ to $108.7\times$ faster. Akita's prover uses the least memory: beyond storing the polynomial itself, its memory overhead grows sublinearly in the polynomial size. We also integrate Akita into Jolt. For every program size we evaluate, Jolt-with-Akita achieves a $2.2\times$ to $4.2\times$ prover speedup and $2.8\times$ to $8.5\times$ verifier speedup over Jolt-with-Dory, while producing comparable proof sizes, with every proof below $100$ KB.

Facial recognition has become central to modern authentication systems, security frameworks, and personalized services. However, its widespread adoption is hindered by severe privacy risks, particularly surrounding unauthorized access to sensitive biometric data. To address these challenges, this paper presents GhostFaceMPC, the first end-to-end, privacy-preserving face recognition system to evaluate a deep convolutional neural network extractor and matching under secure multi-party computation. GhostFaceMPC enables secure processing of facial data across all stages of a face recognition process, from feature extraction and storage to matching, without exposing raw images or biometric embeddings at any stage. We introduce a multi-party computation-friendly quantization of the GhostFaceNet model and circuit optimizations that make face recognition under multi-party computation practical. The code is available at https://github.com/crypto-unict/GhostFaceMPC.

A quantum one-time program scheme is a functionality-preserving compiler that transforms a program into a quantum state that can be used to obtain only one output of the program. Our goal is to design quantum one-time programs that can be realized on existing quantum technologies. Our contributions are two-fold: 1. We design a BB84 state-based quantum one-time program scheme in the stateless trusted hardware model that is resilient to single-qubit corruption errors and detectable erasure errors. To illustrate, under independent noise with a 90% detectable erasure rate and a 3% Pauli Y-error rate on surviving qubits, a signature token of 39,801 BB84 qubits achieves forging probability at most $\small 2^{-128}$ against at most $\small 2^{32}$ classical verification queries, with honest failure probability below $\small 10^{-6}$. Prior to our work, [Behera, Sattath, and Shinar TQC'22] studied a BB84 state-based quantum one-time program scheme resilient to independent single-qubit corruption errors; our construction treats detectable erasures separately. 2. We give two extensions to our scheme. First, we study the setting wherein the same trusted hardware can be reused across different independently generated quantum one-time programs. Second, we study the setting wherein multiple trusted hardware devices are used and the security holds as long as at least one of them is not compromised.

Discrete Gaussian sampling remains one of the most delicate operations to protect against side-channel attacks in lattice-based cryptography. In this work, we present the first masked evaluation of the Knuth-Yao sampler, a generic building block for lattice-based schemes. Its random-walk formulation might seem fundamentally at odds with masking, since the walk's control flow depends precisely on the secret sample being produced. We show instead that its underlying tree structure is remarkably suited to it. Evaluated as a bitsliced Boolean circuit, the public tree prescribes an evaluation order requiring exactly L - 2 masked AND gadgets, where L is the total Hamming weight of the probability expansions of the target distribution. This makes the approach particularly effective for the narrow distributions used in lattice-based schemes. We provide a generic framework that compiles any finite-precision distribution into a masked C implementation with optimized linear-gate count. We use FrodoKEM and HAWK as case studies, and also compile the base samplers of Falcon and HAETAE. On ARM Cortex-M4, our sampler outperforms the state-of-the-art masked CDT approach for every distribution at masking orders 1 to 5, running up to 2.3 times as fast at order 1, even for distributions where it evaluates more non-linear gates. Finally, since the Fujisaki-Okamoto transform ties FrodoKEM to the exact randomness consumption of its specified sampler, we discuss the consequences of this constraint. We benchmarked an unmasked implementation and argue that the Knuth-Yao approach is competitive even without masking, while using identical input randomness.

Secure aggregation is a fundamental building block for privacy-preserving federated learning, yet most existing masking-based secure aggregation protocols do not provide post-quantum security. In this work, we present SecAgg++, a masking-based post-quantum secure aggregation protocol for the single-server setting. SecAgg++ integrates post-quantum cryptographic primitives while preserving the communication and computational efficiency of classical frameworks such as SecAgg and SecAgg+, and supports client dropout handling through an efficient recovery procedure.

We describe the design, implementation, and experimental evaluation of Magnetar, a transparent proof system for RV64I program executions (i.e., a zkVM). Magnetar is the first zkVM to simultaneously satisfy the following three properties: 1. General-purpose proving. Magnetar proves programs compiled to the general-purpose RV64I ISA. An implementation of the Ethereum Virtual Machine (EVM) written in Rust or Go can therefore run inside Magnetar, yielding a zkEVM for proving executions of existing EVM smart contracts. 2. Hash-based, post-quantum security. Magnetar’s cryptographic security is rooted in standard hash functions (e.g., SHA-256 or SHA-3). 3. Efficient recursion. Magnetar’s verification work is dominated by evaluating standard hash functions. Magnetar’s proof engine, BinarySpartan, is well-suited for such bit-oriented computations, so verifying a proof is itself an efficient proving workload. Unlike prior general-purpose zkVMs, Magnetar does not rely on circuit-friendly algebraic hash functions such as Poseidon or Poseidon2, elliptic-curve or lattice assumptions, or a conjectured Reed–Solomon proximity gap. Even prior zkVMs commonly described as hash-based rely on elliptic-curve or lattice assumptions in their core proving machinery, provide only about 100 bits of security, or rest on conjectured soundness; some do more than one of these. Finally, we implement Magnetar in Rust and experimentally evaluate it. We find that, at 120 bits of provable security and with 12 performance cores on an M4 Max MacBook Pro, Magnetar proves 2^{22}-cycle executions at 7.2–8.7 million cycles per second, with proofs of about 600 KiB that verify in 11–13 ms. Across 15 application workloads, Magnetar’s proving throughput is 24–66× that of SP1 Hypercube, a hash-and-more-based zkVM; 12–37× that of Jolt-Dory, a curve-based zkVM; and 6–20× that of Jolt-Akita, a lattice-based zkVM, with geometric-mean speedups of about 39×, 18×, and 9.6×, respectively. An optimized Magnetar proves 222-cycle executions at 9.5–12.8 million cycles per second, which increases each geometric-mean speedup by about 1.3×. Magnetar’s proofs are about 4.6× smaller than SP1 Hypercube’s; Jolt’s proofs are under 100 KiB, but they rely on elliptic-curve or lattice assumptions.

Beanie is a tweakable block cipher recently published at ToSC aiming for memory encryption of microcontroller units. In line with this goal, it handles small plaintexts of only 32 bits and has a low latency. In this paper, we propose the first third-party analysis of the two variants of Beanie. By carefully leveraging structural properties of the cipher and taking advantage of its distinctive attack model, we manage to mount several key-recovery attacks against both the 5+5-round version and the 7+7-round version.

We present the first new infinite family of APN functions obtained by applying the switching construction to a known family since the introduction of the Budaghyan-Carlet-Leander family in 2009. Our construction is also the first example of an infinite APN family obtained via the switching construction from an infinite family of non-power functions. More generally, we study families of APN functions that can be obtained from the Budaghyan-Helleseth-Kaleyski family by the addition of carefully selected perturbation terms. We perturb the known family by combinations of Frobenius conjugates of the relative norm and obtain four constructions, naturally arranged into two switching pairs. One of these families is EA-equivalent to the Li-Zhou-Li-Qu family, for which our construction yields a new univariate representation. Switching it by a norm-derived Boolean term produces a second family that we prove to be APN in every dimension where the base family is defined, and we show that this family is CCZ-inequivalent to all previously known constructions. Furthermore, we investigate two other infinite families that can be switched to one another, conjecture that they are APN for infinitely many dimensions, and obtain conditions that can be used to characterize their APN-ness. The new infinite APN family and the two conjectured APN families generalize previously known sporadic APN instances in dimension 10.

Security evaluation of masking in low-noise regimes remains poorly understood: increasing the masking order does not automatically translate into higher concrete resistance once many correlated intermediates are processed by a full implementation. A common approach is to reduce noisy side-channel leakage to the random probing model (RPM), but existing reductions can be too loose to yield meaningful leakage rates in practice, and current RPM analyses often rely on costly simulations or numerically propagated bounds. This work develops analytic and algorithmic tools for estimating and upper-bounding RPM security of masked gadgets and their compositions. First, for noisy Hamming-weight leakage over $\mathbb{F}_{2^u}$ we compute concrete RPM leakage-rate parameters for a tighter $\mathbb{F}_2$-linear reduction based on binary inner products, providing a tangible link between SNR and probing rate. Second, for $\mathbb{F}_q$-linear circuits we leverage a vector-space representation to characterize RPM leakage as an erasure event, yielding a direct connection to local metrics such as advantage and implying global simulability for refreshed, block-separated executions. Third, we improve Monte Carlo estimation of rare leakage events using importance sampling, enabling evaluation in low-rate/high-order regimes that are infeasible with naive sampling. Finally, we revisit the leakage-diagram technique and derive explicit bounds for refresh gadgets, and we apply the same viewpoint to composition through \emph{bridges}, showing that SNI—while sufficient for threshold probing model (TPM)—does not capture the RPM phenomenon governing refresh boundaries. We implement our methods in \textsf{LAPSE}, a tool that compiles gadget descriptions into linear-algebraic representations and supports exact computation as well as Monte Carlo/importance-sampling estimation of RPM security parameters.

zk-SNARKs enable succinct, efficiently verifiable proofs of correct computation over private data, but require the computation to be compiled into a \emph{statically defined and bounded} arithmetic circuit. This requirement creates a multidimensional mismatch with data-analytic programming, which consists largely of array programs: (a)~array operations and resulting shapes are dynamic; (b)~arrays are accessed at data-dependent positions; (c)~control flows are data-dependent. Existing zk-SNARK DSLs enforce this requirement using conservative syntactic restrictions that reject many bounded programs, or leave the programmer to bound and encode these by hand, while zkVMs recover expressiveness at substantially higher proving cost. We present \textsc{Zinnia}, a zk-SNARK programming framework for analytics in which programs are written in a subset of Python with NumPy. Zinnia's compiler uses SMT-backed symbolic execution over array types with bounds to derive properties of the program's values that hold on every input, which we call \emph{facts}. The facts bound every data-dependent shape and loop, which gives each array its capacity in the circuit. Built atop this compiler, \textsc{Zinnia} provides bounded-dynamic array and arithmetic operations for analytics. The same facts guide how these operators are lowered: for each operator, \textsc{Zinnia} considers known circuit constructions, whose cost depends on what the facts guarantee. Unlike a program, a circuit has no order in which a check protects later uses, so if a construction needs a fact, another constraint in the circuit must enforce it. A construction chosen for one operator may enforce a fact that another relies on. \textsc{Zinnia} therefore chooses the constructions of all operators together, seeking to minimize estimated circuit cost. Our evaluation on unmodified programs from three NumPy corpora shows that the circuits \textsc{Zinnia} compiles are never larger than optimized hand-written ones in existing DSLs, and that \textsc{Zinnia} achieves over $30\times$ faster proving than zkVM-based approaches by geometric mean.

The Learning with Errors (LWE) problem is a central foundation for post-quantum schemes such as Kyber and Dilithium. Dual attacks are among the main tools for assessing the concrete hardness of LWE instances. At EUROCRYPT 2024, Pouly and Shen introduced the first provable dual attack against LWE. Subsequently, at ASIACRYPT 2025, Qu and Xu incorporated modulus switching into this framework by recovering the guessed secret mod several small primes and recombining the resulting residues via the Chinese Remainder Theorem (CRT). Although this CRT-based strategy substantially reduces the search space, it reconstructs the full guessed secret through several distinct primes whose product must exceed \(q\). Consequently, the total guessing cost is dominated by the largest CRT prime \(p_k\). This raises a natural question: can the same recovery effect be achieved by repeatedly applying the subroutine with a fixed small prime, while further reducing the overall complexity? We answer this question affirmatively by proposing layered modulus switching (LaMS), a provable modulus switching dual attack based on a \(p\)-adic view of the guessed secret. Instead of recovering residues mod several distinct primes, LaMS fixes a single small prime \(p\) and recovers the guessed secret digit by digit in its \(p\)-adic expansion. After each digit is recovered, its contribution is subtracted from the LWE samples, producing a new target LWE instance in which the next digit becomes the new secret mod \(p\). As a result, the guessing cost is reduced from \(O(\mathrm{poly}(m,n)(N+\sum_{j=1}^{k}p_j^{n_{\mathrm{guess}}}))\) in the CRT-based attack to \(O(\mathrm{poly}(m,n)\lceil\log_p q\rceil(N+p^{n_{\mathrm{guess}}}))\), where \(p \ll p_k\). We also correct a parameter issue in two previous works (EUROCRYPT 2024 and ASIACRYPT 2025) on Kyber estimates. After this correction, LaMS lowers the estimated attack cost by up to 1 bit for Kyber compared with the corrected CRT-based attack of Qu and Xu.

Eevee is a family of three AEAD modes, Umbreon, Jolteon, and Espeon, proposed at CCS 2023 for IoT-to-cloud secure computation. We analyze structural flaws in the algorithms of the supplied full-version specification and the proof steps underlying their online authenticated-encryption claims. An AD-free, two-encryption prefix distinguisher has advantage $1-2^{-n}$ in the ideal-forkcipher model, contradicting the specified online ideal object. Independently, the separable associated-data transform yields a four-encryption nonce-misuse distinguisher with advantage $1-2^{-n}$, a deterministic AD-only forgery, and nonempty-message forgeries obtained from cross-domain state differences. These attacks contradict the advertised nonce-misuse bounds of Umbreon and Espeon. With nonce-respecting encryption queries, one two-block Jolteon encryption permits a fresh one-block forgery with the same tag, while Espeon's short-message path permits arbitrary AD substitution. We trace these counterexamples to failures of online-prefix consistency, conditional transcript distributions, domain separation, and checksum freshness in the original proof. The authenticity attacks follow from deterministic identities, and the privacy counterexamples persist with an ideal forkcipher. We derive corresponding requirements for AD processing and message finalization, and briefly summarize supporting checks of the published C routines. The central failures concern the mode design and cannot be resolved solely by correcting implementation encodings.

Despite decades of cryptographic advances, electronic cash (e-cash) remains largely confined to payments and lacks the broader decentralized financial applications built around cryptocurrencies. As a step toward broadening its application layer, we present an issuer-independent e-cash exchange in which a liquidity provider holds inventories of two independently issued e-cash currencies and users trade between them without requiring either issuer to participate in individual swaps. Our design combines a blockchain settlement layer, which automates the exchange and makes its execution publicly verifiable, with an exchange-compatible e-cash protocol. Classical e-cash must be adapted to this setting in two respects: payments must become publicly verifiable by the exchange, and the additional privacy risks created by public execution must be addressed. We formalize these new privacy requirements and construct a compact e-cash realization with publicly verifiable payments and aggregate anonymous reissue. We prove the security and privacy properties of the resulting exchange protocol under the stated cryptographic and issuer-functionality assumptions.

The sumcheck protocol, a ubiquitous component of modern proof-systems, enables proving the sum of evaluations of a low-degree multivariate polynomial. In theory, sumcheck has been generalized from polynomials to (tensors of) any multiplication code, a code whose pointwise products of codewords lie in a related product code. All practical systems nonetheless specifically use polynomials. For proof-systems over binary fields that target Boolean circuits, this choice has a real cost: the product of two binary messages under Reed--Solomon is no longer binary. As a result, the prover's work in the first, and most expensive, round of sumcheck (the so-called univariate skip) grows by a logarithmic factor. We present a new concrete multiplication code based on algebraic geometry that is binary-preserving: the product of two encoded binary messages is again a binary message. Specifically, we construct an explicit multiplication code over $\mathbb{F}_{2^{128}}$ that carries $64$-bit messages to binary product messages of length $222$, and whose product code has relative distance greater than $1-2^{-119}$. The part of the product message that the prover actually sends in sumcheck is more than $3 \times$ smaller than with Reed--Solomon, as used in practice. The code comes from a genus-$95$ curve over $\mathbb{F}_2$ with $64$ rational points, built as a $(\mathbb{Z}/2)^3$ Artin--Schreier cover of a genus-$4$ curve. We implemented the resulting protocol, which we call the AG skip, inside the Flock proof-system. For $2^{32}$ constraints, it speeds up the skip round by $2.36\times$ and the whole zerocheck, which was the prover's most expensive component, by $1.65\times$.

This work presents an efficient, scalable, and robust threshold ECDSA signing protocol for the $t\leq (n-1)/3$ scenario, making it suitable for e.g., bridging consensus from one Blockchain to another. Our construction allows to batch-compute pre-processing material for efficient online signing. While our protocol is based on established ideas for (Verifiable) Secret Sharing, we optimize it to scale efficiently both in terms of computation and communication with a large number of signers. We therefore combine efficient batching techniques for sharing (Fitzi & Hirt, PODC 2006), randomness extraction (Beerliova-Trubiniova & Hirt, TCC 2008) and share opening (Damgård & Nielsen, CRYPTO 2007) with recent advances in efficient Zero-Knowledge proofs (Attema & Cramer, CRYPTO 2020). We implement and evaluate the protocol experimentally and show that it is practical for large number of parties $n$.

Decentralized Finance (DeFi) continues to experience rapid growth, yet a significant portion of capital remains inefficiently utilized in overprovisioned lending reserves or inactive liquidity positions. This paper presents two extension-based improvement proposals aimed at increasing capital efficiency in DeFi protocols. The first addresses idle capital in pool-based lending by adding an allocation layer that can deploy otherwise unused liquidity into external yield-generating strategies. The second targets inactive concentrated-liquidity positions through a position-management layer that automates range migration. Both proposals are examined in terms of motivation, mechanism design, expected effects, implementation approach, and practical limitations. Evaluation results are proposal-specific: the lending analysis indicates meaningful supplier-yield uplift under selected external-yield assumptions, while the range-migration analysis focuses on active-time sensitivity and execution cost. Prototype benchmarks suggest that both mechanisms can be implemented as modular extensions, but also expose additional gas overhead and proposal-specific risks, including external-strategy dependence, recall and loss-allocation concerns, and range-policy misconfiguration.

Fault injection attacks have been extensively studied in the context of post-quantum cryptography, yet existing analyses on code-based KEMs largely focus on faults targeting the Fujisaki-Okamoto transform. This work presents new fault injection attacks against BIKE and HQC that operate beyond this commonly protected component and target less obvious instructions within the decapsulation process. The proposed attacks achieve full key recovery using only valid ciphertexts under NIST Level 1 parameters, requiring 17392 and approximately 3 million decapsulation queries for HQC and BIKE, respectively. In addition, we introduce a general approach to identify effective fault locations by analyzing decoder behavior under perturbed conditions. The attacks are experimentally validated on an STM32H7 microcontroller using laser fault injection, demonstrating high repeatability. These results reveal a broader attack surface and provide a foundation for more efficient fault attack analyses in future work.

Shift-invariant permutations of \(\mathbb F_2^n\) are particularly attractive in symmetric cryptography because of their regularity and implementation efficiency. Constructing such permutations with an explicit algebraic structure remains a challenging problem. In this paper, we study a family of shift-invariant transformations of \(\mathbb F_2^n\) constructed from a recursively defined sequence of mappings \(\{\gamma_j\}_{j\ge 0}\) associated with landscapes. First, we prove that, under an explicit dimension condition relating \(n\) to the support of the landscape, the sequence \(\{\gamma_j\}_{j\ge 0}\) has the polynomial composition property if and only if the corresponding landscape is quasi-conserved on \(\mathbb F_2^n\) with a nonzero special index. Then, we determine the eventual zero or periodic behavior of \(\{\gamma_j\}_{j\ge0}\), including the exact index at which the sequence either first vanishes or becomes periodic, together with the least eventual period, and establish linear independence until the first linear relation occurs. When the polynomial composition property holds, we establish an explicit isomorphism between the group of permutation elements in the monoid generated by these mappings and the unit group of a quotient ring \(\mathbb F_2[z]/\langle p(z)\rangle\), where \(p(z)\) is a monomial or a binomial determined by the landscape. This framework reduces the tasks of testing bijectivity, computing iterates, and determining compositional inverses and orders of permutation elements to polynomial computations. Finally, we apply the results to mappings represented by binomials and trinomials in the quotient ring, obtaining explicit criteria and formulas, and tabulate more than one hundred representative constructions of shift-invariant permutations, recovering and unifying several previously studied families.

We study a protocol-level reaction leakage in CKKS deployments where public coefficient-to-slot (C2S) evaluation keys are combined with a client's 1-bit validity response. Under this deployment surface, a malicious evaluator can recover a ternary secret key using asymptotically optimal $O(\mathcal{H})$ reaction queries, where $\mathcal{H}$ is the entropy of the secret key. The attack does not break RLWE or CKKS IND-CPA security. Instead, it exploits the interaction between client-side validity reactions and public homomorphic linear transformations. A shift of a public encryption key yields a ciphertext whose plaintext is a function of the secret key; the public ${\sf C2S}$ layer then repacks this information to construct a ciphertext whose validity depends strictly on whether a targeted secret coefficient matches a guessed value. Furthermore, each submitted query is independently randomized with a fresh encryption of zero, so that each resulting malicious ciphertext appears entirely distinct, thereby allowing the attack to simply evade trivial detection mechanisms on the client side. We implemented the full end-to-end attack in Lattigo v6.2.0 and recovered the full secret key across four parameter sets drawn from standard CKKS presets. For uniform ternary secrets, the attack uses $O(N)$ queries and is within a factor $2/\log_2 3 < 2$ of the oracle-only entropy lower bound. For sparse ternary secrets, a tailored variant further reduces the number of queries in practice. Our results show that observable validity reactions form a practical key-recovery channel in CKKS deployments exposing this surface, even when the underlying cryptographic assumptions remain intact.

Multi-key fully homomorphic encryption (MKFHE) enables computation over encrypted data under multiple different keys. Constructing MKFHE without any trusted or interactive setup remains an open problem. In the context of MKFHE, a trusted setup is often assumed to mean the use of a common random string (CRS). In this paper, we present the first MKFHE scheme in the plain model (i.e., without any trusted or interactive setup) based on the RLWE assumption. Specifically, we construct a multi-key somewhat homomorphic encryption based on the RLWE assumption and extend it to a multi-key variant of the Gentry-Sahai-Waters (GSW) scheme with a circular security assumption. Our design yields a 2-round multi-party computation (MPC) in the plain model against semi-honest adversaries. Moreover, it can be applied to transform existing FHE schemes that rely on RGSW in their construction into a multi-key variant. We also provide concrete conversions for widely-used FHE schemes, including BGV, BFV, CKKS, FHEW, TFHE, and Carousel. Finally, we implement our scheme and present experimental results for the expansion algorithm from a single-key ciphertext to a multi-key ciphertext and the multi-key homomorphic multiplication algorithm.

Bitcoin (BTC) is the largest crypto asset, yet the Bitcoin blockchain offers few applications in which BTC can be used. A standard approach to make BTC useful is bridging: BTC is deposited on the Bitcoin chain and a wrapped asset is minted on a chain such as Ethereum, where it can be used in smart contract applications. Unfortunately, all Bitcoin bridges to date require trust assumptions on a centralized party or a committee running the bridge to enable withdrawals of the deposited BTC, including state-of-the-art BitVM bridges. In this paper, we observe that while bridges are application-agnostic, most BTC holders are interested in collateral-based applications, where BTC is deposited as collateral, and only the depositor or a set of known counterparties can withdraw the asset. For this class of applications, we propose a primitive, Trustless Bitcoin Vaults, that guarantees that the BTC depositor or the counterparties can withdraw the deposited BTC following only the logic of the application smart contract without trusting any third party. We present a protocol that achieves the security guarantees of this primitive and instantiate it for a lending application where the deposited BTC is used as collateral to borrow against a set of liquidators on the Aave v4 smart contracts on Ethereum. Our mainnet experiments show that at the current Bitcoin price and fee rate, a deposit costs about \$0.7 in fees while a withdrawal costs at most \$7.7. Our construction is built on recent advances in efficient proof verification for Bitcoin.

In a single secret leader election (SSLE) protocol, all parties collectively and obliviously elect one leader. Parties other than the selected leader should not be able to learn the identity of the leader unless it is revealed by the leader itself. The problem is first formalized by Boneh et al. (AFT 2020), and the first concretely feasible lattice-based SSLE with proof-of-concept implementations, $\mathsf{Qelect}$, was recently introduced by Wang and Zhang (USENIX 2025). In this work, we present $\mathsf{Relect}$, an efficient SSLE protocol, based on the Ring Learning with Error assumption. We build it by leveraging the algebraic structure of the underlying threshold Fully Homomorphic Encryption (FHE) and by designing tailored homomorphic circuits. Compared to prior works, $\mathsf{Relect}$ (1) achieves substantially higher efficiency and (2) removes the strong environment assumption in $\mathsf{Qelect}$ (a trusted setup), while allowing dynamic leader selection for each round. Concretely, for $32$ -- $2048$ parties, our local FHE computation runtime (a major efficiency bottleneck for SSLE) achieves $7.15$ -- $42.4\times$ faster than $\mathsf{Qelect}$ for a single thread and $7.10$ -- $48\times$ faster for 16 threads. Furthermore, we show that for the same parameters, our communication cost is also $1.14$ -- $2\times$ smaller. As mentioned, this is achieved while removing the trusted setup. In terms of end-to-end runtime, following $\mathsf{Qelect}$, we tested $2$ -- $128$ parties. We show that under the LAN setting, $\mathsf{Relect}$ is $2.77$ -- $345\times$ faster than $\mathsf{Qelect}$ per round. Under the WAN setting, $\mathsf{Relect}$ is $1.94$ to $17.2\times$ faster than $\mathsf{Qelect}$. Note that these performance gains are all achieved while removing the trusted assumption and achieving dynamic leader selection for each round.

FAEST is a post-quantum signature scheme that combines VOLE-in-the-Head with QuickSilver to prove knowledge of a secret key. It relies on well-established symmetric primitives and offers small public keys, but signing and verification are computationally expensive. We present an NVIDIA GPU implementation of the key-generation core and the QuickSilver procedures OWFProve and OWFVerify for the standard and EM constructions in both s and f variants. Profiling shows that once AES is accelerated by hardware, field multiplication in QuickSilver becomes the largest cost throughout this parameter grid. In FAEST-128f, field multiplication takes about 82% of signing time. To address this bottleneck in our GPU implementation of FAEST, we use PTX clmad for native carry-less arithmetic and Karatsuba to reduce the number of limb products. The clmad build improves throughput across all twelve OWFProve and OWFVerify paths, and its advantage grows with the field width. On an RTX A5000, PTX clmad raises standard OWFProve throughput to 1.99x, 2.45x, and 2.82x that of the software-multiplication build at 128, 192, and 256 bits, respectively. Together, PTX clmad and Karatsuba deliver 26.6x the throughput of the software-multiplication build in the field-multiplication-heavy kernel of standard 256-bit OWFProve. When all OWFProve stages are included, the combined build reaches 2.9x and 3.1x the software throughput for standard and EM at 256 bits, respectively. These results establish native carry-less arithmetic as a key design choice for GPU implementations of FAEST, with Karatsuba providing an additional improvement for 256-bit proving.

Integral distinguishers can reveal more than a zero-sum property: the number of ones in an output component may be divisible by a high power of $2$, rather than merely being even. To exploit this divisibility, we relate linear, integral, differential-linear, and restricted differential sums through two-way conversions with explicit divisibility guarantees and data complexity, recovering established links as special cases. We derive exact random-permutation probabilities and rigorous bounds to quantify the distinguishing strength while accounting for dependencies between output conditions. To discover these properties, we develop automated MILP/SAT models that use complete-round Walsh coefficients or combine Walsh and ultrametric representations to obtain stronger bounds. These weighted models prove finite divisibility even when compatible trails exist, beyond what trail-existence tests alone can establish. For differential-linear sums, we show that combining differential and linear propagation with local DLCT zeros can give false zero-correlation claims. We address this limitation with exact mix-basis models that establish zero correlation and finite divisibility. To complement these symbolic methods, we provide a black-box algorithm using exact histograms and the fast Walsh-Hadamard transform to search all output masks for selected input conditions and identify zeros and finite divisibility properties. Our MILP/SAT models significantly improve the divisibility bounds reported by Beyne and Verbauwhede in 674 cases across the SIMON family, as well as for PRESENT, without trail enumeration and at unchanged data complexity, e.g., from $2^5$ to $2^{11}$ on 9-round SIMON32 and from $2^6$ to $2^{22}$ on 10-round SIMON48. To our knowledge, we are the first to prove higher divisibility for 8-round SPECK and for BEANIE, with new bounds for GIFT-64 and Ascon and exact counts for SKINNY-64. Our black-box searches reveal new properties on RC5, ChiLow-32, KeeLoq, and KATAN32, including output-bit combinations missed by single-bit searches, and lead us to introduce probabilistic divisibility.

Fault injection attacks on zero-knowledge (ZK) constructions have received little attention in the wider literature. Recent work has demonstrated single-fault key recovery attacks against a ZK signature scheme. In this paper, we detail candidate fault injection attacks against zero-knowledge scalable transparent argument of knowledge (zkSTARK) provers, designed to violate ZK capabilities. zkSTARK proving systems are complex, and implementations differ substantially in their implementation specifics. We propose a corresponding variety of fault injection attacks against different popular algorithmic primitives. To the best of our knowledge, this marks the first exploration of the fault injection surface of zkSTARKs, and of the wider class of general-purpose ZK proving systems.

Facilitating value transfers with a scriptless chain is a longstanding problem in cryptography. We present a cross-chain messaging and value transfer protocol that maintains game-theoretic atomicity even when one party is operating on a chain which is fully scriptless, such as shielded Zcash, which has no scripting capabilities at all and requires transactions to be virtually identical. The observation is that consensus protocols which utilise segregated witness schemes to ensure transaction ID unmalleability (such as ZIP 244 in Zcash, SegWit in Bitcoin) segregate transaction data from the transaction witness component (which is the part that is actually signed). The transaction identifier is, therefore, a virtually collision-resistant commitment to the effects intended by the transaction, computable before signing, and in many chains, even without the knowledge of the signer. A contract on another chain can therefore recompute a future transaction ID from the few fields it needs to see, such as the recipient, the value and the expiry, while every other part of the transaction arrives as an opaque digest. It learns that any transaction with this ID has the agreed effect, without learning anything about the sender and without the recipient signing anything. An optional zero-knowledge layer hides the recipient and value as well. Combined with a light client for the settlement chain on the Turing-complete chain, this yields fully trustless verification that a shielded payment occurred, with no validator consortium or multisig that can be hacked or stalled.

Anonymous credentials enable privacy preserving authentication, but their transferability motivates binding each credential to a key protected by a secure element (SE). Such binding should preserve privacy even when the SE is remote or corrupted: every presentation must require fresh SE participation without revealing its context to the SE (Friedrichs et al., EC'26). Existing context-blind device-bound constructions rely on classical assumptions, whereas existing plausibly post-quantum anonymous credentials do not provide this functionality. We give a modular construction of context-blind device-bound anonymous credentials from a position-binding vector commitment, a signature scheme, a round-optimal blind signature, and a non-interactive zero-knowledge argument. We prove correctness, one-more unforgeability, unlinkability against a colluding issuer, verifier, and fully corrupted SE, and SE-obliviousness. We instantiate the construction with the CAPSS framework (Feneuil and Rivain, TCHES'26), Griffin/Jive Merkle commitments, and proofs of the complete presentation relation. For 16 attributes and four disclosures, using the Ligero-based proof backend from Longfellow (Frigo and shelat, CiC'26) yields a presentation taking 2.60 s on the user side and 0.29 s to verify, with a 506.11 KB proof. We also evaluate an Aurora backend for the same relation. We complement these measurements with published results to explore the proof-size/proving-time trade-offs offered by alternative transparent, plausibly post-quantum proof systems for relations of comparable size. To the best of our knowledge, this is the first concrete construction and evaluation of context-blind device-bound anonymous credentials assembled entirely from plausibly post-quantum components.

Almost perfect nonlinear (APN) functions provide optimal resistance to differential cryptanalysis in characteristic two, and constructing new infinite families inequivalent to the known ones remains an important problem in the study of cryptographic functions. We introduce extended biprojective functions, obtained by augmenting biprojective polynomials with truncated trace terms, and establish a new infinite family of quadratic APN functions. To investigate these constructions, we develop an efficient APN test based on the ranks of binary matrices and employ it in exhaustive searches in dimensions up to 28. Using ortho-derivative differential spectra to distinguish CCZ-equivalence classes, we identify APN functions inequivalent to known families and uncover a systematic pattern across dimensions, leading to conjectures on further infinite families of quadratic APN functions.

Profiled side-channel attacks combine noisy leakage predictions with the mathematical relations imposed by the target algorithm to recover secrets from a small number of observations. Two established approaches are algebraic side-channel analysis (ASCA), which encodes leakage predictions and algorithmic relations as a Boolean satisfiability (SAT) problem, and soft-analytical side-channel analysis (SASCA), which performs probabilistic inference over a factor graph using belief propagation (BP). We evaluate both on the AES-based MILENAGE authentication algorithm deployed on USIM cards, targeting the first AES-128 invocation on $\mathit{RAND}\oplus\mathit{OPc}$ under the subscriber key $K$, where $\mathit{OPc}$ is an operator-specific secret unknown to the attacker. Neural networks predict posterior probability distributions over the AES S-box output byte values across multiple rounds and these predictions are supplied to ASCA and SASCA to recover $K$ and $\mathit{OPc}$ from a single trace. SASCA recovers both secrets in 87.7% of attacks, but converges to an incorrect $\mathit{OPc}$ in 6.1% of cases despite recovering $K$ correctly. ASCA enforces global consistency and resolves this ambiguity, but it succeeds in only 34% of attacks under a 1-hour timeout and our constraint-selection strategy. Motivated by these complementary failure modes, we combine the two into a hybrid attack in which BP refines the neural network predictions before they are supplied to the SAT solver. The hybrid approach recovers both secrets in 93.8% of single-trace attacks, resolving all cases where SASCA recovers $K$ correctly but $\mathit{OPc}$ incorrectly. It has a higher success rate and a lower average runtime than either method alone, despite performing more work per attack. Finally, we suggest a countermeasure, based on masking each AES round key with an independent, per-device secret, that reduces an attacker's advantage over guessing $K$ and $\mathit{OPc}$ to zero bits, and confirm empirically that it defeats the hybrid attack in all evaluated cases.

Fully homomorphic encryption (FHE) allows arbitrary computation over encrypted data, but its secret key presents a single point of failure which limits its applications. Threshold FHE patches this gap by distributing the secret key to $K$ parties, requiring a threshold $t \leq K$ of them to cooperate for decryption. We focus on the asynchronous setting where a ciphertext can be decrypted by collecting decryption shares from any $t$ parties who do not need to coordinate or even be online simultaneously. Asynchronous schemes are sought in applications such as privacy-preserving Ethereum Virtual Machines (EVM), processing of long-lived private data with quorum-based decryption and the thresholdisation of any cryptographic primitive in general. We present Tulva, a practical threshold FHE scheme which equips a base FHE scheme with an asynchronous threshold decryption mechanism in a modular way. Our scheme simultaneously (1) is compatible with virtually any base FHE scheme and leaves its ciphertexts unchanged apart from an appended random tag, (2) supports a wide range of threshold profiles $(t,K)$ and ring degrees $\geq 256$ with 6--25 bits partial decryption per plaintext bit, and (3) achieves security in the presence of partial decryption queries on challenge ciphertexts based on the standard LWE assumption. We provide an open-source implementation, benchmark its threshold decryption performance and evaluate the end-to-end costs for typical privacy-preserving EVM use cases. For 16-out-of-512 threshold and a publicly preprocessed ciphertext, computing secret-dependent partial decryption and public share combination requires only 3.7ms and 0.5ms, respectively, on commodity hardware. Compared with the state-of-the-art synchronous scheme [Zyskind et al., CCS'25], we replace their ciphertext-independent yet interactive preparation of secret-correlated randomness with a public, ciphertext-dependent 0.5s preprocessing step, eliminate interaction in the online phase while maintaining similar decryption time on the same machine, and support 32$\times$ more total users.

Unbiased and publicly verifiable randomness is a fundamen- tal component of Web3 security, and output-private distributed verifiable random functions (DVRFs) extend this guarantee by keeping the gener- ated randomness hidden from chain observers until the requester chooses to reveal it. Two constructions currently realize output privacy under dif- ferent algebraic regimes: FlexiRand, whose on-chain verification rests on bilinear pairings, and IcyVeil, a pairing-free design whose verification re- duces to a constant number of group operations. While it is folklore that pairing-free verification should be cheaper on the Ethereum Virtual Ma- chine (EVM), the actual on-chain cost of output-private randomness has never been measured for either scheme. In this paper, we present the first EVM implementations of both constructions. Both verifiers are served by a single coordinator contract realizing the common blind–evaluate–pre- verify lifecycle, so that every measured difference is attributable solely to the verification arithmetic. The isolated verification is 57% cheaper in execution gas for the pairing-free scheme (51,561 against 118,541 gas); over the full request lifecycle, whose remaining stages are shared, the ad- vantage is about 11%. This on-chain saving comes with a cost off chain: the pairing-free scheme’s distributed evaluation requires roughly 2.5 to 8.2 times more aggregate committee compute across committee configu- rations (n, t), a gap absorbed comfortably by Ethereum’s block time and one that narrows further once the committee executes concurrently. We report both axes, separating one-time distributed key generation (DKG) cost from IcyVeil’s consumable preprocessing, and reconcile the on-chain and off-chain ratios, which point in opposite directions. All contracts, harnesses, and raw measurements are publicly available.