International Association
for Cryptologic Research

Single-server PIR is a powerful cryptographic primitive that allows a client to retrieve public data from a remote server without revealing which item it accessed. Its privacy guarantee, however, inherently forces the server to do work linear in the database size, which is impractical at a large scale. Client-Preprocessing PIR (CP-PIR)~[Patel et al., CCS 2018] suggests to push linear computation to an offline preprocessing phase, enabling online queries with sublinear server computation and communication. While CP-PIR has since attracted considerable attention, designing an efficient preprocessing phase remains challenging. The original construction, along with much subsequent work~(e.g.,~[Zhou et al., S\&P 2024]), streams the entire database, which incurs linear communication that scales only to moderately sized data. A different approach consists of implementing the preprocessing using Fully Homomorphic Encryption (FHE) (e.g.,~[Corrigan-Gibbs et al., Eurocrypt 2022]), but the current best proposal (ThorPIR [Fisch et al., CCS 2024]) still imposes prohibitively expensive homomorphic computation on the server.

In this paper, we tackle the problem of designing a practical preprocessing phase for CP-PIR. We introduce RotPIR, a novel CP-PIR with a preprocessing that is simultaneously sublinear-communication (i.e., no database streaming) and computation-efficient, while keeping online communication and computation sublinear. RotPIR is obtained by co-designing our PIR protocol with the underlying FHE operations. Specifically, we propose an innovative preprocessing framework with an advanced homomorphic operator, {\em oblivious homomorphic rotation}, which enables the database to be rotated according to an encrypted offset, and significantly accelerates the offline server-side computation. Our experimental results show that RotPIR can achieve up to $1000\times$ speedup in offline server-side computation when compared to the state-of-the-art CP-PIR protocols that do not stream the entire database during the preprocessing.

We introduce Falafel, a modular scheme for Fast, Authenticated, Locally Attested FEderated Learning, with which parties can create a zero-knowledge proof of training (zkPoT) for Federated Learning (FL). The proof guarantees active security during the federated training process as well as publicly verifiable correctness of the final, trained model. All without revealing any additional information about the local datasets or intermediate local model states.

Specifically, our approach targets FL of (deep) neural networks with a centralized server for weight updates. Our zkPoT not only offers attestation for local training steps, but also for the centralized weight update, as well as taking into account input authenticity by introducing a trusted auditor. This way an external verifier can check the entire training process, from dataset to final model.

In contrast to prior work on zkPoTs, our construction solely relies on well-understood cryptographic assumptions and primitives, is highly parallelizable, and takes a modular approach. This modular (commit-and-prove) approach uses several novel core proof components, that could be swapped for other building blocks if desired. We show that, for LeNet, we generate a zkPoT of 70 kB in roughly 150 seconds for a single training round. Falafel’s prover time is in line with prior work, and its proof size is significantly smaller (10–15×), without relying on less-understood assumptions or instantiating Fiat–Shamir using arithmetic hash functions.

The EasyCrypt proof assistant has been used to successfully formalize security proofs for a wide variety of crypto- graphic primitives. However, attempts at formalizing objects with interactivity, such as protocols, have fared much worse. In this paper, we investigate (some of) the reasons for this difficulty by formalizing a simple interactive key agreement protocol. From a first complete but exploratory proof, to a failed attempt at a structured proof, and to what we believe is an “essential” proof, we identify which proof features contribute most to the complexity of formalization in pRHL. In particular, we argue that difficulties in formalizing the security of interactive protocols in the computational model arise from the fact that such proofs rely on both state and temporal invariants—the former to support cryptographic reasoning, and the latter to support reasoning about the protocol’s structure. We believe that this observation can help build new reasoning tools that can bridge the gap that currently exists between primitive-focused tools and protocol- focused tools.

Cryptographic migration, particularly in the post-quantum setting, poses significant practical challenges and requires reliable performance data to support sound engineering decisions. For ML-DSA, however, existing benchmarking practices often produce misleading or non-comparable results, complicating migration and cryptographic agility efforts. This paper analyzes common pitfalls in benchmarking ML-DSA signature operations, including subtle inconsistencies when comparing security levels. We show that execution-time variability of the ML-DSA signing algorithm - an inherent property due to rejection sampling and other data-dependent components - makes commonly used straightforward metrics, e.g., min/average/max, unsuitable for migration planning. To address this gap, we propose a robust benchmarking methodology based on standardized input data sets and clearly qualified reporting metrics. The proposed approach enables fair comparison across hardware and software implementations and supports designers of real-time systems to assess the worst-case execution time.

Post-quantum signature algorithms pose significant challenges for DNSSEC migration: their larger keys and signatures exceed DNS over UDP transport limits, making TCP fallback unavoidable even for the most compact schemes. We propose a differentiated algorithm selection, assigning distinct signature algorithms to the Zone Signing Key (ZSK) and Key Signing Key (KSK) roles. This approach expands the space of deployable post-quantum configurations beyond what undifferentiated selection permits, enabling algorithms that would otherwise be impossible to deploy: UOV, with 128-byte signatures but 43~KB keys, produces DNSKEY responses exceeding the 64~KB DNS limit under undifferentiated constraints, yet becomes viable when paired with a compact-key KSK. We also evaluate hybrid PQ/T schemes through signature concatenation, combining classical P256 with post-quantum algorithms in a single RRSIG record to provide dual security during the transition period.

Using a containerized testbed validated against AFNIC's .fr TLD structure (4.2 million domains), we systematically measure response sizes, resolution latency, TCP fallback rates, and signing performance across 18 configurations. Differentiated configurations achieve 1.28-1.52× latency overhead relative to classical ECDSA while enabling algorithms that undifferentiated constraints prohibit. Hybrid PQ/T concatenation introduces acceptable overhead (7--19%) for backward-compatible quantum resistance.

A Password-Authenticated Key Exchange (PAKE) protocol allows two parties to jointly establish a cryptographic session key, in the "password-only" setting where the only information shared in advance is a low-entropy password. In recent years, the One-encryption EKE with 2-round Feistel cipher (OEKE-2F) protocol, a compiler from Key Encapsulation Mechanism (KEM) to PAKE, has received much attention, for the following reasons: (1) When instantiated with the Diffie–Hellman KEM, it is the most computationally efficient PAKE protocol to date that is secure in the Universal Composability (UC) framework; and (2) When instantiated with a post-quantum KEM, it provides a generic way to construct efficient PAKE protocols based on post-quantum assumptions.

Unfortunately, the community cannot agree upon what the OEKE-2F protocol exactly is: part of the second protocol message is an RO hash of the KEM key, together with any number of the following:

- The password, - The KEM public key, - The first protocol message, and - The KEM ciphertext.

This yields 16 potential variants of OEKE-2F; only two of them have been studied in the literature, and their pros and cons are poorly understood.

In this work, we present a comprehensive analysis of *all 16 variants* of OEKE-2F, proving the UC-security of each of them. The general takeaway is that the "hash everything" version requires the fewest security properties of the underlying KEM scheme, and the more items we remove from the hash, the more security requirements the KEM scheme has to satisfy — although all of the additional KEM properties are still mild. We pinpoint the exact KEM properties each version of OEKE-2F needs, and thoroughly explain the rationales.

The significance of this work lies in that it helps the community converge upon the "right" version of OEKE-2F, and perhaps also in that this is the first paper by the author that is over 100 pages.

Integrating Real-World Assets (RWA) into Decentralized Finance (DeFi) enables borrowers to leverage off-chain assets for on-chain transactions. However, this integration faces a critical security challenge: ensuring that private asset data, utilized within cryptographic proofs, is authenticated by and cryptographically bound to a trusted issuer. Existing solutions, such as decentralized identifiers (DIDs) and oracles, fail to simultaneously satisfy the requisite security standards and performance constraints. To address this, we propose Real-world Qualification Proof (RQP), a cryptographic protocol designed for the privacy-preserving verification of off-chain asset qualifications. RQP introduces a new primitive, Witness-Hiding Authentication (WHA), which operates in conjunction with zk-SNARKs. WHA enables asset issuers to authenticate RWA data, allowing the on-chain smart contract to efficiently verify the binding relationship between the issuer's authentication and the borrower's zero-knowledge proof. The proposed WHA effectively anchors the data privacy guarantee of RQP within the zero-knowledge property of the proof system while ensuring source authenticity. Furthermore, to ensure scalability and minimize on-chain gas costs, we adopt zk-rollup methodologies and employ the Inner Product Argument (specifically MIPP) to aggregate multiple RQP proofs. This yields a protocol that is not only secure and private but also computationally efficient for high-throughput DeFi applications. Experiments show that logarithmic verification efficiency optimization can be achieved in the multi-borrower proof scenario.

For many applications of SNARKs, a key bottleneck is proving large batches of standard cryptographic hash evaluations, such as SHA-256, Keccak, or BLAKE3. We introduce Flock, a hash-based SNARK for extremely fast proving of such batched Boolean computations. Flock proves batches of the same R1CS circuit (plus input/output relations between them), can prove hash-chains and Merkle path openings, and in principle can be extended to full-fledged hash-based signature verification. At its core, Flock combines new optimizations for the lincheck and zerocheck protocols with an aggressively optimized proof-of-concept implementation co-designed by coding agents.

On a single core of an M4 Max processor, Flock proves 82k evaluations of the BLAKE3 compression function, 42k SHA-256 compressions, and 30k Keccak permutations per second — less than a $250\times$ overhead over native execution. On ten cores, throughput exceeds 660k BLAKE3 compressions per second; in proving SHA-256, Flock is more than $9\times$ faster than Binius64, the prior state of the art, and more than $500\times$ faster than the fastest elliptic curve-based SNARK we measured against.

The stateless hash-based digital signature algorithm SLH-DSA is a standardized post-quantum signature scheme based on the SPHINCS$^+$ framework. Although SLH-DSA has well-studied security properties, its signatures are relatively large. This has motivated continued work on reducing the signature size of stateless hash-based signature schemes. Recent work of Abri and Katz introduced forced pruning for reducing the few-time signature component in SPHINCS$^+$-style schemes. However, the concrete cover bound for PORS+FP remains conservative, which prevents smaller parameter choices from meeting the target security level.

We introduce BPORS+FP, a bucket-thinned variant of PORSFP for the bottom few-time signature layer of SPHINCS$^+$-style schemes. The construction places independent PORS child keys under an outer FORS-like bucketing layer. For each selected child key, the number of previous uses is reduced from the bottom-key use count \(q_0\) to a binomially thinned count \(R\sim\operatorname{Bin}(q_0,2^{-B})\). The SPHINCS$^+$ level cover term is therefore evaluated at a smaller random use count, which creates room for smaller child parameters. BPORS+FP also combines this bucket-thinning effect with a global forced-pruning size threshold.

Our evaluation shows that BPORS+FP gives shorter signatures than PORS+FP in five of the six standard SPHINCS$^+$ parameter rows considered, with the only exception being the 128-bit fast row. For NIST's limited-signature-use SLH-DSA parameter sets, replacing the few-time component by BPORS+FP reduces the total signature size by about 22%--26%, compared with about 10%--14% from PORS+FP.

Multivariate quadratic (MQ) signature schemes such as MAYO are among the leading candidates for post-quantum digital signatures, with security relying on the hardness of solving systems of multivariate quadratic equations. In this paper, we present a fault-assisted man-in-the-middle attack targeting the key-generation procedure of MAYO. Specifically, we target the computation of the public key, which is represented as a system of $m$ quadratic polynomials. Following the MAYO specification, each polynomial is associated with a matrix representation composed of the components $P_i^{(1)}, P_i^{(2)}$, and $P_i^{(3)}$. Our attack injects a single fault during the computation of the $P_i^{(3)}$ component of the public key, causing the resulting public key to satisfy a simplified linear relation involving the secret oil matrix. From the faulty public key, we derive an overdetermined linear system over $F_{16}$ that enables complete recovery of the secret oil matrix.

Unlike previous fault attacks that primarily target the signing algorithm, our attack targets the key generation procedure to recover the oil secret and exploit the recovered oil secret to reconstruct the legitimate public key corresponding to the victim's secret key i.e correcting the public key. This allows the adversary to transparently participate in the communication as a man-in-the-middle, producing valid signatures on behalf of the victim.

We evaluate the attack on a fault simulated MAYO implementation and demonstrate successful recovery of the oil matrix from a single faulty key-generation execution followed by public key correction.

The Learning with Errors (LWE) problem is a central foundation for post-quantum schemes such as Kyber and Dilithium. Dual attacks are among the main tools for assessing the concrete hardness of LWE instances. At EUROCRYPT 2024, Pouly and Shen introduced the first provable dual attack against LWE. Subsequently, at ASIACRYPT 2025, Qu and Xu incorporated modulus switching into this framework by recovering the guessed secret modulo several small primes and recombining the resulting residues via the Chinese Remainder Theorem (CRT). Although this CRT-based strategy substantially reduces the search space of each individual run, it reconstructs the full guessed secret through several distinct primes whose product must exceed \(q\). Consequently, the total guessing cost is dominated by the largest CRT prime \(p_k\). This raises a natural question: can the same recovery effect be achieved by repeatedly applying the subroutine with a fixed small prime, while further reducing the overall complexity? We answer this question affirmatively by proposing layered modulus switching ($\LaMS$), a provable modulus switching dual attack based on a \(p\)-adic view of the guessed secret. Instead of recovering residues modulo several distinct primes, \LaMS\ fixes a single small prime \(p\) and recovers the guessed secret digit by digit in its \(p\)-adic expansion. After each digit is recovered, its contribution is subtracted from the LWE samples, producing a new target LWE instance in which the next digit becomes the new target modulo \(p\). As a result, the dominant guessing term is reduced from \(O(\nsol p_k^{\nsol})\) in the CRT-based attack to \(O(\lceil \log_p q\rceil \nsol p^{\nsol})\), where \(p < p_k\). We also correct a parameter issue in previous Kyber estimates. With this correction, \LaMS\ reduces the estimated attack cost by 22/31/41 bits for Kyber-512/768/1024, respectively, relative to the corrected CRT-based attack of Qu and Xu.

We generalise a pairing on elliptic curves over finite fields, called the generalised Tate pairing, which is defined in terms of an arbitrary endomorphism of the curve, with certain trace requirements. We rederive this pairing from group cohomology, which allows us to generalise the pairing to principally polarized abelian varieties over any field, endomorphisms of any trace, and prove perfectness using a general duality theorem.

Elliptic-Curve Cryptography (ECC) found in Zero-Knowledge Proofs (ZKPs) protects assets worth more than a billion dollars on privacy-preserving blockchain networks. There, the transaction rate is mostly limited by the computational cost of Multi-Scalar Multiplications (MSMs). Thus, hardware acceleration of these operations, for instance, using FPGAs, is of interest. Current accelerators leverage the Pippenger algorithm to compute the MSMs. Due to data dependencies, the algorithm’s performance is affected by the latency of the internal modular multipliers. Typically, these multiplications are realized using Montgomery multipliers. A promising variant of this algorithm is LogJumps, which offers potential for parallelism and lower latency. This is achieved by reducing data dependencies within the Montgomery reduction. Yet, prior work has neither formalized nor explored a low-latency, hardware-friendly parallel realization of this method. We address this gap by formalizing parallelism in LogJumps and presenting the first practical, truly parallel LogJumps architecture for the BLS12-377 prime. Our modular multiplication design achieves up to 56% lower latency than the lowest-latency multiplier in the ZPRIZE 2022, while maintaining a 250 MHz frequency and throughput. Furthermore, we reduce the MSM latency by up to 1.85× using a full-point adder pipeline, while our logic consumption increases by only 1.32×.

Hints are a concept from side-channel analysis referring to small amounts of information that enable an adversary, via a potentially very efficient procedure, to extract the secret. We take this cryptanalytic concept and give it a constructive make-over.

We formalize a short $\Sigma$-protocol based on the famous Goldreich, Micali, Wigderson protocol, in which the responses are not of the full witness size, but are only small hints. The hints can be used to extract the full response. We show that under our formalization, these protocols preserve the security properties of $\Sigma$-protocols.

We instantiate a practical protocol using a group action from tensor isomorphism and an efficient extracting procedure borrowed from an attack by Narayanan et al. on the MEDS signature scheme. We derive a signature scheme, called miniMEDS, which demonstrates practically the benefits of our hint-based construction, allowing for 22%-24% reduction in signature size compared to the latest updated parameters of MEDS.

Fuzzy Labeled Private Set Intersection (FLPSI) lets a receiver learn the labels of enrolled records that are similar to its query, and nothing else. FLPSI can be built in several ways. Constructions based on a set-threshold reduction reach practical performance: a query matches a record when the two agree on a threshold number of components. These constructions delegate the private matching to an inner set-threshold kernel. We study its homomorphic form, which combines leveled-BFV homomorphic encryption (HE), a garbled circuit, and secret sharing to decide the match under encryption and release the record's label. We identify a composition gap in this kernel, an instance of a protocol-level problem: efficiency is bought with a per-trial false-accept probability, but one query runs a trial for every record, so the error compounds with the database size into the kernel's realization soundness error (RSE), the rate at which it accepts a query the plaintext matcher would reject. The RSE is a reliability property of the cryptographic matching layer, not the matcher's accuracy. On a spurious accept the kernel also returns a value the plaintext matcher would never produce. A sound kernel must contribute zero or negligible RSE of its own. We formalize this requirement as a composable security property, give a closed-form bound on the receiver's advantage, and close the gap with CSTPSI, a kernel that runs independent token rounds and raises the per-trial bound to a matching power. We prove CSTPSI secure in the semi-honest model. The closed-form bound sets the round count: two token rounds suffice for million-scale databases and three for billion-scale at the $10^{-6}$ engineering threshold. Our evaluation confirms the prediction. At a million records the baseline kernel's RSE reaches $100\%$ while CSTPSI holds it at $0$ in every measured configuration. CSTPSI decouples threshold-checking and upload costs from label size. For large labels at small to moderate scale it is more than $20\times$ faster than the baseline kernel, with up to $93\%$ less communication. It converges to the baseline only at the million-scale database size. Our implementation, with a one-command reproducibility harness, is publicly available.

Stateful hash-based signature schemes like LMS and XMSS are built on the Winternitz one-time signature. The effect of state reuse for these schemes has been shown to be disastrous [1][2]. This paper shows that the signer can mitigate this effect if a state is reused only once. This is achieved by repeating the randomized hashing step until a hash value with specific properties is found. Our results show that at least 80 bits of security can be achieved in 99% of the key reuses, an improvement of 49 bits. This requires the signer to repeat the randomized hashing step 1.4 million times on average. Slightly lower security can be reached with much less hashing.

Secure Multi-Party Computation (MPC) enables collaborative analytics without exposing raw data. Yet, complex data retrieval operations in relational databases (i.e., relational queries) remain limited by scalability bottlenecks: oblivious operators must pad intermediate results to worst-case sizes to prevent information leakage, thereby inflating communication and computation costs. We propose Resizer, a lightweight operator that can be inserted transparently into relational query plans to bound intermediate result sizes while preserving rigorous privacy guarantees. Resizer reduces intermediate results from fully-oblivious to noisy size bounds that satisfy differential privacy (DP). We propose two Resizer variants, shuffle-based and sort-based, and provide a formal analysis of the privacy guarantees and security in the semi-honest model. We evaluate the Resizer variants in the ORQ framework under semi-honest and honest-majority assumptions using TPC-H benchmark queries, demonstrating that Resizer incurs negligible overhead while reducing data volume. In both LAN and WAN settings, complex queries achieve speedups compared with state-of-the-art oblivious baselines, confirming that Resizer reduces the padding bottleneck and enables scalable, privacy-preserving relational analytics.

In 2020, a coordinated law-enforcement effort infiltrated Encrochat, an end-to-end encrypted service provider, exfiltrating historical and real-time data and metadata over months. Encrochat was used extensively by organised crime, and the data from the operation was used as supporting evidence in over 6,000 arrests and related prosecutions across Europe. Encrochat's architecture was vertically integrated, with the company acting as both a device vendor and service provider; Encrochat sold modified Android smartphones with its own PKI and custom applications, including encrypted messaging based on the Signal protocol. In this work, we give the most detailed public account to date of Encrochat's infrastructure and how it was compromised.

HAWK is a signature scheme that was introduced in 2022, and uses the lattice isomorphism problem (LIP) as a basis for post-quantum cryptography. In this work, we describe a classical algorithm that recovers the HAWK secret key in probabilistic polynomial time, assuming four number-theoretic heuristics. The reduction from the rank-2 module-LIP instances underlying HAWK to nrdPIP (Eurocrypt '25) is central to our algorithm. At a high level, we first conjugate the HAWK public Gram matrix $G$ by a random lower-triangular unimodular matrix $U$ with `short' entries, forming a new Gram matrix $G':=U^\ast GU$, and then test whether the $\mathcal{O}$-nrdPIP instance attached to $G'$ is unusually easy. In particular, for a non-negligible proportion of such instances $G'$, one can use the Lenstra-Silverberg algorithm to solve the corresponding $\mathcal{O}$-nrdPIP instance using a subfield approach. By resampling $U$ until such an instance is uncovered and solved, which can be seen as `re-randomising' the $\mathcal{O}$-nrdPIP instance whilst fixing the corresponding module-LIP instance, we are then able to recover a valid HAWK private key. At the time of writing, we do not claim that HAWK is broken, as we have not yet verified these heuristics experimentally. On the other hand, these heuristics seem to be very plausible, and we hope to be able to verify this in the future with an implementation of our algorithm.

Folding schemes are gaining traction recently as they unlock practical instantiations of incrementally verifiable computation (IVC) and proof-carrying data (PCD). In particular, there has been a growing interest in folding schemes for high-degree relations, as these can efficiently arithmetize complex computations. While the landscape is vast, all lattice-based constructions such as Latticefold+, (Super)Neo, and Cyclo heavily rely on the sumcheck protocol. Sumcheck gives efficient proving times, but the verifier circuits become very large, partially because of the many random oracle invocations required. These hinder the efficiency of IVC and PCD instantiations, as the prover must prove the execution of the verifier circuit at every iteration.

We present ProtogaLattice, a new lattice-based folding scheme for general high-degree polynomial relations that drastically reduces the size of the verifier's circuits. We deviate from the sumcheck approach and instead take inspiration from Protostar [Bünz & Chen, Asiacrypt '23] and Protogalaxy [Eagen & Gabizon, '23], which fold witnesses using algebraic techniques in a constant number of rounds. Our contribution is threefold: (1) a novel technique to achieve PCD through Protogalaxy, which we find of interest also in the classical (i.e. pairing-based) setting, (2) a folding scheme that combines multiple instances of polynomial relations into accumulators, and (3) a bootstrapping protocol to reduce the norm of the witnesses underlying these accumulators. A full iteration of ProtogaLattice requires only four random oracle calls (not counting the overhead induced by the extra range proof used as a black-box). Our techniques open new directions towards building lattice-based proofs that support more expressive relations and that present smaller recursion overheads.