International Association
for Cryptologic Research

Coin flipping in the presence of a dishonest majority is a fundamental cryptographic primitive whose requirements lack a clean characterization. Recent work (Bonneau et al., Eurocrypt 2025) showed a lower bound that fair dishonest-majority coin-flipping implies delay functions. However, until now known upper bounds exhibited a significant gap: All existing protocols rely on assumptions that we do not know how to instantiate in the plain model.

In this work, we close this gap. Specifically, we show that fair $n$-party coin flipping in the presence of up to $n-1$ malicious corruptions follows from the minimal assumption of delay functions. This completes the equivalence between delay functions and fair dishonest-majority coin-flipping protocols.

The Even-Mansour cipher is a construction of a keyed pseudorandom permutation from a random unkeyed permutation. Its generalization to multiple rounds, known as iterated Even-Mansour or key-alternating cipher, is an important abstraction in block cipher design. Yet, while the security of single-round Even-Mansour is tight in the quantum setting (with attacks matching security proofs), much less is known on multi-round versions.

In this paper we study the quantum security of iterated Even-Mansour ciphers with two keys (the key-schedule alternates between two independent keys), which model concrete block ciphers like LED. We give the first quantum attacks improving asymptotically over exhaustive key search for 4 to 6 rounds.

On 4 rounds, we present three attacks: two using collision search and one using a quantum version of the multibridge attack of Dinur, Dunkelman, Keller and Shamir (ASIACRYPT 2014), which relies on a quantum walk. The latter reaches up to a quantum time $2^{7n/9}$ where $n$ is the block size, compared to $2^n$ of exhaustive key search.

On 6 rounds, we present an attack of quantum time $2^{n} / \sqrt{\log n}$, adapting classical attacks based on multicollisions. In both cases, our new attacks require only classical known-plaintext queries.

The DKLs23 protocol (Doerner, Kondi, Lee and shelat, IEEE S&P '24) is a state-of-the-art multiparty ECDSA signing protocol. Due to its exceptional combination of simplicity, efficiency, and statistical UC security within an elegant hybrid model providing access to standard ideal functionalities, it is rapidly seeing widespread adoption.

We provide a comprehensive security analysis of the DKLs23 protocol, showing that although it is not statistically secure as originally claimed, it is nevertheless computationally secure, and can be made statistically secure via a lightweight refinement. Our contributions are as follows:

-- Statistical insecurity: Within the hybrid model utilized for the original analysis, we construct a computationally-unbounded "split-view" adversary that successfully attacks the protocol by causing two or more honest parties to output different valid signatures on the same message (specifically, signatures with independent nonces). Considering any ideal ECDSA signing functionality that outputs a single signature per session, such an attack cannot be simulated in the ideal model, and thus the protocol is not statistically secure.

-- Computational security: We prove that the protocol is nevertheless computationally secure based on the assumption that ECDSA is strongly unforgeable up to sign (i.e., up to the trivial $(r, \pm s)$ malleability), as defined by Groth and Shoup (EUROCRYPT '22). Specifically, complementing our split-view attack, we show that any adversary for which the protocol's execution is distinguishable from its ideal-model simulation can be efficiently transformed into an algorithm that breaks the strong unforgeability up to sign of ECDSA.

-- A refined statistically-secure protocol: Identifying the root cause of our split-view attack, we present a refined protocol that is statistically secure. Our refinement incorporates a lightweight consistency check, where each party sends a single group element as part of the protocol's third-round message. Our refinement additionally introduces a relaxed zero-sharing functionality that serves as a drop-in replacement for the original protocol's zero-sharing functionality. We show that this relaxed functionality can be unconditionally realized by a simple one-round protocol (executed in parallel with the first round of signing) without a dedicated setup or pre-shared seeds. Consequently, when paired with a compatible (e.g., Paillier-based) VOLE instantiation, this eliminates the need for long-term secure pairwise storage across the entire signing protocol.

A recent work by Hanzlik et al.~(Asiacrypt'25) introduced Tanuki, a family of blind-signature frameworks based on non-commutative cryptographic group actions. Tanuki develops new techniques to obtain concurrently secure blind signatures, and admits compact instantiations in two distinct regimes: (i) an isogeny-based instantiation from the CSI-FiSh group action with signatures of about 4.5 KB, and (ii) a code-based instantiation from LESS and the code-equivalence group action with signatures around 64 KB. To the best of our knowledge, these are the first efficient blind-signature constructions in the isogeny- and code-based settings that support concurrent executions.

Despite this advance, the Tanuki frameworks rely on a non-standard and interactive assumption, namely the so-called ``one more'' vectorization assumption. Given several structural attacks and vulnerabilities discovered in various group action instantiations, relying on non-standard assumptions can raise concerns.

In this work we present a new framework building upon Tanuki's techniques that achieves concurrent security while achieving better performance, and relying only on the standard group action hardness assumption, the vectorization problem (also known as the group action inversion problem). For the LESS instantiation, we apply dedicated code-based techniques to reduce signature sizes by a factor of 14.5. These improvements come with rigorous reductions to the standard problem, do not weaken the security claims, and are directly applicable to the LESS instantiations of Tanuki. As a result, our isogeny-based and code-based instantiations yield signature sizes of 8.89 and 8.84 KB, respectively, and retain concurrent security under the standard group-action inversion assumption.

In Geelen and Vercauteren~(Eurocrypt 2025), a Generalized BFV~(GBFV) fully homomorphic encryption scheme was proposed. Here, a plaintext space of form $\mathbb{Z}[x]/(\Phi(x),t(x))$ was utilized to reduce the number of Single Instruction Multiple Data (SIMD) slots within the initial BFV plaintext space. This lowered its dimension and thus enabled lower latencies as well as greater flexibility in parameter selection. However, to obtain slots of degree $1$, the methods of Geelen and Vercauteren limit the choice of plaintext modulus to that of large primes, which can be unnecessary for various use cases.

To resolve this, we propose a generalized method to perform FHE based on a subring of the plaintext polynomial ring. We utilize the decomposition ring $\mathcal{O}_{\mathbf{K}}$, with which when taking quotient with a rational prime $p$, already factors into residual fields of dimension $1$. From here, we develop methods to perform FHE on subrings of the decomposition ring $\mathcal{O}_{\mathbf{K}}$, which we refer to as the decomposition subring $\mathcal{O}_{\mathbf{M}}$. We introduce novel methods to enable both encoding and decoding maps within the decomposition subring $\mathcal{O}_{\mathbf{M}} \subset \mathcal{O}_{\mathbf{K}}$. By utilizing $\mathcal{O}_{\mathbf{M}}$, we further lower the dimension of the underlying ring, improving upon efficiency while retaining sufficient security. In experiments, we provide a proof-of-concept implementation, demonstrating up to a $5.06 \times$ improvement in the latency of operations for selected parameters. This approach offers enhanced flexibility in the selection of parameters for FHE with the subring dimension being any suitable divisor of $r$. This direction also represents the first generalization of the subring approach for FHE.

We present new frameworks for secure function evaluation (SFE) and private function evaluation (PFE) that support both Boolean and arithmetic circuits. While SFE requires multiple parties to jointly compute a \textit{public} circuit, PFE generalizes SFE by allowing one party to keep the circuit \textit{private}. Our work achieves the first linear-complexity PFE protocol with respect to both the number of parties $n$ and circuit size $m$, significantly improving upon prior PFE constructions that require $O(mn^2)$ complexity and are limited to Boolean circuits.

Random Vector Oblivious Linear Evaluation (VOLE) correlations are a widely used backend for zero-knowledge proofs and secure computation, and can now be generated with strong concrete efficiency. Many applications, however, need correlations on the receiver’s actual input. They therefore start from random VOLE and send a linear-size derandomization vector, which remains a main communication bottleneck.

We study chosen-input VOLE (CI-VOLE), where the receiver privately chooses a large vector \(\mathbf{x}\), the sender fixes \(\Delta\), and the parties obtain shares of \(\mathbf{x} \cdot \Delta\) without communicating a linear-size object. This work presents \(\textsf{LogVole}\), a concretely efficient CI-VOLE protocol with polylogarithmic end-to-end communication under Ring-LWE. The construction uses a recursive shrink/expand design: it authenticates short digests of the chosen input and then uses a succinct telescope to expand those relations back to the full vector. The protocol has \(O(\lambda \log^2(|\mathbf{x}| + m_{\mathrm{msg}}))\) one-time setup and query communication and \(O(|\mathbf{x}|/n)\) ring operations. Here, \(n\) is the underlying ring degree, \(\lambda\) is the computational security parameter, and \(m_{\mathrm{msg}}\) is the size of the shares.

\(\textsf{LogVole}\) also supports a public-key non-interactive mode: for a fixed \(\Delta\), the sender publishes reusable parameters, and a receiver sends one compact \(\mathbf{x}\)-dependent message to obtain the matching VOLE shares. This gives a route to non-interactive VOLE-based ZK with polylogarithmic communication for arbitrary circuits. We also give a malicious-security extension in the random oracle model.

Using \(\textsf{LogVole}\), we obtain the first concretely efficient VOLE-based ZK protocol with polylogarithmic communication for arbitrary circuits. At 128-bit computational and 40-bit statistical security, our implementation reaches 12.9 million \(\mathbb{Z}_p\) inputs/s, 9.0 million ZK multiplication gates/s on a 16-core machine, and proves \(1024 \times 1024\) matrix multiplication in about 4s with single-thread computation and 226 KB communication.

Module lattice-based key encapsulation mechanisms (ML-KEM) are susceptible to side-channel-assisted chosen-ciphertext attacks (SCA-CCAs) that exploit leakage from the re-encryption process during decapsulation. These attacks enable adversaries to recover secret keys with hundreds to thousands of oracle accesses, thereby posing a critical threat to the practical deployment of post-quantum cryptography. This paper presents RandInvalidCoeff, a novel and lightweight countermeasure that introduces randomness into the decryption function to mitigate SCA-CCAs. By randomizing invalid coefficients in the decrypted message polynomial, RandInvalidCoeff injects probabilistic errors into side-channel observations, significantly reducing the attacker’s ability to perform reliable key recovery. This randomization slightly increases the decryption failure rate (DFR). Nevertheless, our analysis shows that strong resistance can be achieved with an acceptable DFR of approximately $2^{-80}$. We provide information-theoretic and statistical analyses of the countermeasure to quantify the reduction in information leakage for plaintext-checking (PC) and decryption-failure (DF) oracle attacks. Furthermore, we performed PC- and DF-oracle attacks on an implementation with RandInvalidCoeff to validate the theoretical analysis, confirming that the proposed method achieves the expected countermeasure effect. The results demonstrate that the number of observations required for successful key recovery increases by a factor of more than eight, with only a few percent performance overhead compared to unprotected implementations.

Retrieval-augmented generation (RAG) systems critically depend on a vector-retrieval stage that selects relevant documents from a large embedding database. When this stage is outsourced to a RAG-as-a-Service provider, query embeddings can reveal sensitive user intent, the outsourced index can leak proprietary corpus information, and a malicious provider can silently manipulate retrieval results. This motivates privacy-preserving verifiable retrieval. The client must be able to confirm that the returned top-$k$ identifiers were produced by faithfully executing an agreed approximate nearest neighbor (ANN) algorithm on a committed encrypted index, while leaking no non-public database information beyond the functional baseline induced by the returned top-$k$ identifiers.

We present VeriANN, the \emph{first} encrypted ANN retrieval framework, to our knowledge, that simultaneously achieves \emph{query privacy}, \emph{database confidentiality}, and \emph{verifiability of retrieval results} against malicious servers, under a two-server non-colluding trust model. VeriANN couples distributed-point-function--based PIR over locality-sensitive hashing indexes with authenticated garbled circuits, so that the entire top-$k$ pipeline---bucket decryption, Merkle-root reconstruction, frequency counting, and top-$k$ selection---is executed obliviously and with end-to-end integrity. Making this integration practical requires three new techniques: (i) a sort-based hierarchical oblivious frequency-counting algorithm that enables a distance-free post-processing stage, reducing top-$k$ aggregation from quadratic to quasi-linear complexity; (ii) an end-to-end authenticated verification design that binds the full retrieval pipeline against selective-failure attacks while reducing client-side verification to a single hash check against the published Merkle root; and (iii) a modular state-pool design with an authenticated state-transfer mechanism that dynamically composes precomputed garbled states across query parameters while preserving cross-circuit verifiability. On million-scale corpora, VeriANN achieves second-scale end-to-end latency with KB-scale client-to-server communication, while adding minimal online overhead over a non-verifiable baseline.

To enhance the security of stealth addresses and protect user privacy, Liu et al. (EuroS&P 2019) proposed a Key-Insulated and Privacy-Preserving Signature Scheme with Publicly Derived Public Keys (PDPKS). In this scheme, the payee generates a master public/secret key pair, and the payer derives a public key from the payee's master public key and binds the cryptocurrency asset to the resulting derived public key. The payee then verifies, using the master secret key, whether the derived public key has been correctly generated from the master public key. In this paper, we show that a public-key encryption (PKE) scheme secure against chosen-ciphertext attacks (CCA) can be generically constructed from PDPKS. Specifically, we utilize unlinkability, which hides the master public key from which a derived public key originates, to conceal plaintext information from ciphertexts. We also simulate the decryption oracle by leveraging the derived public key checking algorithm. In addition, to guarantee the correctness of the proposed PKE scheme, we rely on the consistency of PDPKS introduced by Emura (IACR CiC 2025). Given the motivation behind PDPKS, namely the construction of stealth addresses in a provably secure manner, unlinkability is regarded as the core security property of PDPKS. Our result shows that achieving this core security property essentially requires CCA-secure PKE, or cryptographic primitives of equivalent strength, and that such primitives are indispensable for constructing PDPKS.

Inner product functional encryption (IPFE) in unbounded setting for permissive relation offers a powerful cryptographic approach for enforcing fine-grained access control over sensitive information in untrusted cloud settings and has found growing applicability in areas such as cloud security, controlled access to electronic health records, network privacy, mobile data protection, the Internet of Things and many more. In spite of its importance, the profile of this primitive is not extensive. In this work, we propose the first permissive and unbounded public key IPFE scheme, providing post-quantum security guarantees in privacy-preserving environments. Our construction is lattice-based, achieves adaptive security and builds on modified ALS-IPFE scheme of Abdalla et al. (ASIACRYPT 2020). The unbounded setting and permissive relation between message vector and secret key vector supported by our scheme make it more flexible and practical for adapting to real-world application. We establish the adaptive indistinguishability of our construction within the random oracle model, by providing formal proof assuming the hardness of the learning with errors problem. Our scheme is the first of its kind in the post-quantum setting as existing permissive unbounded IPFE are pairing-based and derive their security from classical number-theoretic assumptions. Furthermore, as exhibited by our experimental results our proposed scheme is computationally lightweight.

Decentralized Identity (DID) systems aim to provide users with self-sovereign control over their credentials. However, verifying identities on public blockchains often risks leaking sensitive attributes and transaction histories, whereas relying on heavy generic cryptographic protocols leads to prohibitive on-chain costs. In this paper, we propose \textbf{CUBE} (Credential Unlinkability using Blinded Elements), a verifiable credential framework that integrates partially blind BBS signatures with Non-Interactive Zero-Knowledge (NIZK) proofs. By shifting complex identity validation off-chain while blinding the core identity-binding elements, the scheme ensures on-chain unlinkability without losing attribute auditability. To prevent Sybil attacks and credential transfer, we integrate a deterministic nullifier tied to Soulbound Tokens (SBTs). We formalize the scheme's system model and establish its security regarding existential unforgeability, signer-blindness, and zero-knowledge. Performance results show that this construction maintains minimal on-chain gas consumption, offering a practical deployment path for privacy-preserving verifiable credentials in Web3 environments.

Secure multi-party computation in permissionless settings like blockchains faces the challenge of maintaining security under adaptive corruptions. YOSO MPC (Benhamouda et al., TCC 2020; Gentry et al., Crypto 2021) addresses this through ephemeral roles, allowing committee members to speak only once before erasing state, thus preventing adaptive attacks within each role's lifetime. However, prior work on YOSO MPC relied on an honest majority within committees and required enormous committee sizes, often numbering in the thousands.

In this paper, we challenge both requirements by leveraging the cryptoeconomic properties of the underlying blockchain. We introduce a mechanism for identifying parties who fail to fulfill their roles during protocol execution, using time-lock puzzles. This enables misbehaving parties to be penalized based on publicly verifiable fraud proofs, allowing for a more aggressive committee threshold. Furthermore, we propose a new sortition procedure that ensures the resulting committee always has a constant size, not just in expectation. This reduces fluctuations in committee size, enabling an even higher committee threshold. These techniques allow us to handle any constant fraction $f < 1$ of total corruptions.

Finally, we refine and generalize the analysis of corruptions in YOSO protocols, obtaining tighter bounds. Combined with our other enhancements, this enables committees of around 100 parties. Our analysis yields a $70$--$80\%$ improvement over the estimates of the seminal work by Benhamouda et al. (TCC 2020). We believe our work paves the way for practical deployments of YOSO MPC protocols.

Zero-knowledge proofs allow to prove a statement while not revealing anything about the witness. In particular, non-interactive zero-knowledge (NIZK) has emerged as the preferred paradigm due to its public verifiability. However, existing NIZK protocols often suffer from high prover overhead for large statements. Conversely, designated-verifier zero-knowledge (DVZK) offers superior prover efficiency and scalability, but is restricted to a single, designated verifier. This leaves a critical gap in scenarios requiring a prover to efficiently convince a group of n verifiers without incurring massive prover overhead of non-interactive systems. To reconcile this, we focus on multi-verifier zero-knowledge (MVZK) protocols, which efficiently prove the same statement to n verifiers simultaneously. MVZK protocols inherit the prominent prover efficiency of DVZK and extend its utility to the multi-party setting. In this work, we propose a highly efficient MVZK protocol in the preprocessing model, secure against a dishonest majority. It tolerates a corrupted prover and up to n-1 corrupted verifiers, where the prover sends only a single message to verifiers, while several prior works require at least two online rounds. Furthermore, compared to the state-of-the-art 1-round protocol by Zhou et al. (PKC 2025), our protocol eliminates the extension-field multiplications from 4n to 0 over any field, achieving superior online efficiency. Experimental results demonstrate that our protocol achieves 9x faster proving and 47x faster verification when evaluating Boolean circuits with 10^4 AND gates.

While public blockchains provide transparent and auditable transaction histories, they inherently compromise user privacy. Existing privacy-enhancing protocols, such as those deployed on Ethereum, typically rely on succinct zero-knowledge proofs (zk-SNARKs) to obscure the transaction graph. However, implementing comparable cryptographic guarantees on high-throughput blockchains like Algorand is challenging due to strict per-call execution budgets and the state contention introduced by global Merkle accumulators. This paper presents Obscura, a decentralized, non-custodial privacy protocol tailored for constrained smart contract environments. Obscura achieves transaction anonymity using Linkable Spontaneous Anonymous Group (LSAG) signatures over the BN254 elliptic curve, verified entirely on-chain. To overcome limitations of the Algorand Virtual Machine (AVM), we introduce a novel state model that leverages Algorand's Box Storage for $O(1)$ commitment membership checks, eliminating the need for global Merkle accumulators, and a dynamic opcode-budget expansion mechanism via pooled inner application calls. Our implementation demonstrates that signer-ambiguous privacy is practical and efficient on Algorand without relying on trusted setups or succinct proofs. Obscura provides a robust privacy layer for transparent ledgers, bridging the gap between high-throughput blockchain architectures and the dual requirements of cryptographic privacy and selective auditability.

The Subfield Bilinear Collision (SBC) problem was introduced at Crypto 2024 by Huth and Joux to build an MPC-in-the-Head signature scheme. The problem has later proven to be even more efficient when used within the VOLE-in-the-Head framework (Asiacrypt 2025). In this note, we improve the original cryptanalysis of SBC in several ways. First, we describe a link between the SBC problem and the rank decoding problem, strengthening its theoretical hardness and expanding the range of attacks on the SBC problem. Second, we analyze Gröbner basis algorithms to solve the SBC bilinear system and obtain conjectures on the behavior of this system. Finally, we describe another algebraic modeling of SBC using the Plücker relations between the maximal minors of a matrix. While we do not threaten the parameters of the proposed signature schemes relying on SBC, our work opens the door to a more accurate analysis. More precisely, we do not take the field equations into account in our attacks. Including them would likely reduce the complexity, although the analysis would become more complicated. We leave this task for future work.

Existing benchmarks of post-quantum cryptographic (PQC) algorithms focus on raw throughput or latency on unconstrained hardware, leaving open the question of how implementation choices affect microarchitectural behavior under varying resource pressure. This paper addresses that gap by profiling RustCrypto and PQClean implementations of ML-KEM-768 and ML-DSA-65 across three cgroups-enforced configurations (0.5 CPUs, 1.0 CPUs, and unconstrained). The C baseline uses PQClean reference code; the Rust implementation uses the RustCrypto project's ml-kem crate v0.3.0 and ml-dsa crate v0.0.4. We utilize robust non-parametric statistics (Median and Interquartile Range) over the full execution distributions to reduce sensitivity to scheduler-induced timing variance and avoid arbitrary outlier filtering. Alongside hardware performance counters, we present Flamegraphs to analyze sampled execution hotspots. Results demonstrate that the evaluated Rust configurations exhibit a latency overhead for both ML-KEM (+42.4%) and ML-DSA (+47.8%) under severe 0.5 CPUs throttling compared to clang-compiled C. Massif traces attribute all additional Rust heap usage entirely to runtime initialization, with no observable dynamic allocation within the measured cryptographic core execution paths.

We present PQES-AKE, a novel two-party authenticated key exchange (AKE) protocol built upon the Post-Quantum Encryption and Signcryption Scheme (PQES) introduced by Kara et al. The protocol achieves mutual authentication, session key secrecy, and forward secrecy in a post-quantum adversarial model. The central design principle of PQES-AKE is the concealment of ephemeral Diffie-Hellman (DH) keys within affine masks derived from randomness generated internally by the PQES signcryption algorithm. The security of PQES-AKE rests on three hardness assumptions, including Learning With Errors (LWE) for ciphertext confidentiality, a Secret-Base Discrete Exponentiation (SBDE) assumption for signature unforgeability, and the Computational Diffie-Hellman (CDH) assumption for session key secrecy. The protocol completes in two network rounds, with a total communication cost of approximately 627 bytes, and requires 17 modular exponentiations. A Python prototype evaluated on a commodity Intel Core i7 laptop achieves an average execution time of 6.2ms. These results confirm that PQES-AKE provides a competitive, single-primitive alternative to composite KEM-then-authenticate constructions in post-quantum secure channel establishment.

Event date: 2 November to 6 November 2026

We now offer a new doctoral student position in the field of Applied Cryptography and Privacy. The primary duties of the doctoral student positions are to perform research and teaching within the Applied Cryptography and Privacy area. The research is devoted to the broader area of privacy-preserving communication and computation outsourcing.

Communication over the internet is susceptible to surveillance and censorship. Privacy preserving communication techniques (e.g., Tor, Nym, Snowflake) allow users to circumvent such surveillance and censorship. The research scope would include designing, analysing and implementing such systems; additionally, studying different attacks and countermeasures are expected to be part of the research method.

Privacy-preserving computation outsourcing allows users to outsource computation tasks to a cloud server without revealing to the server anything about the user data or even what kind of computations the user is performing. There are different techniques for such privacy-preserving computation outsourcing such as Trusted Execution Environment (e.g., Intel SGX) and Fully Homomorphic Encryption (TFHE, BGV). Furthermore, the specific functions/tasks can be subject to attacks, and identifying attacks and countermeasures is expected to be studied. The research method will be a combination of system studies, design, and experimental research.

The position is funded by the Wallenberg AI, Autonomous Systems and Software Program (WASP).

How to apply:

Applications need to be submitted to the application portal at: https://lu.varbi.com/en/what:job/jobID:917016/

Applications shall be written in English and include:

- CV and a cover letter stating the reasons why you are interested in the doctoral programme/employment and in what way the research project corresponds to your interests and educational background.

- Copies of issued study certificates and/or awarded degree certificates.

- Other documents you wish to be considered (grade transcripts, contact information for your references, letters of recommendation, etc.)

Closing date for applications:

Contact: Debajyoti Das ([email protected])

More information: https://lu.varbi.com/en/what:job/jobID:917016/