International Association
for Cryptologic Research

We study the problem of certifying statistical claims over datasets contributed by multiple independent sources. In this setting, an untrusted server aggregates signed data records and publishes claims such as sums, averages, or rates, while any third party can verify that these claims are correct with respect to the authenticated input data, without needing access to the underlying records. A central challenge is to achieve public verifiability without requiring trust in the aggregator, while keeping both the proof size and the verification cost small enough for practical deployment. This problem is motivated by applications in which reliable and scalable certification of published statistics is essential, including official health and demographic reporting.

In this work, we present smklhs, a multi-key linearly homomorphic signature scheme for this setting. Compared to the state of the art, smklhs is the first practical construction to enjoy evaluated signatures of size logarithmic in the number of distinct signers involved in the computation, and else independent on the total number of input messages. We prove smklhs secure against fully adaptive adversaries in the random oracle and algebraic group models, under well-studied hardness assumptions in bilinear groups.

We implement our scheme using the high-performance pairing library RELIC and compare it with prior work. To demonstrate practicality, we consider a case study on authenticated mortality statistics related to the impact of COVID-19 in Spain. At the 128-bit security level, our experiments show that an authenticated claim covering a 180-day nationwide dataset with over 300,000 signed records generated by 190 distinct signers can be verified in approximately 22 seconds on a commodity desktop machine. These results indicate that our approach is fast, lightweight, and practical for real-world deployment.

We present a new algebraic modeling of the Supersingular Isogeny Problem as a system of multivariate polynomial equations, in the case where the elliptic curves are connected by an isogeny whose degree is a power of $2$ or $3$. This modeling relies on Renes formulas for elliptic curves in Montgomery form (degree $2$) or triangular form (degree $3$). We investigate several algebraic properties of these systems: we prove that they are zero-dimensional, compute the dimension of their highest degree part, and show that they are not in generic coordinates. Experimental results show that solving these systems via Gröbner basis techniques is significantly faster than solving the algebraic modeling with modular polynomials.

Bitslice implementations are widely adopted in lightweight cryptography (LWC) due to their efficiency and inherent resilience to side-channel attacks. However, this paper reveals that their decomposition of the S-box exposes critical vulnerabilities to the operation skip fault model. Unlike data corruption faults suffering from high-entropy diffusion, we identify that skipping bitwise operations induces strongly restricted differential patterns. To exploit this characteristic, we propose the Skip-induced Difference Distribution Table (SDDT), a framework mapping operation omissions to output differences. We validate this approach on the block cipher PIPO through practical experiments, successfully recovering the master key from deeper rounds with fewer faults than previously possible. Our findings underscore the fragility of bitslice designs against precise operation skip faults.

Hash-based low-degree tests and polynomial commitment schemes have become the cryptographic engine of a large fraction of deployed succinct-argument systems. Unlike pairing-based commitments such as KZG, they require no trusted setup, rely only on a collision-resistant hash, are plausibly post-quantum, and operate over any sufficiently large field, unlocking small fields whose arithmetic is fast on commodity hardware. Between 2017 and 2025 this design space evolved rapidly along two intertwined lineages: the Reed-Solomon proximity-test line (FRI, DEEP-FRI, STIR, WHIR) and the linear-code tensor-commitment line (Ligero, Brakedown), which Basefold and WHIR ultimately merge. Yet the primary sources report their guarantees under different, and frequently conflated, soundness regimes: unique decoding, the Johnson list-decoding bound, and (conjecturally) capacity. The folklore surrounding these schemes has drifted from what the papers actually prove.

We systematize this line of work. We organize the seven core schemes along a taxonomy of committed object, code class, and testing mechanism; we trace the evolutionary chain in which each scheme answers a concrete limitation of its predecessor; and we ground the theory in a survey of production zero-knowledge systems, showing how field choice and soundness regime jointly explain real engineering decisions, including a sumcheck-based multilinear prover reaching mainnet in 2026. We make two systematizing corrections. First, the DEEP folklore: the out-of-domain trick that survives in deployment (DEEP-ALI, on the constraint side) is distinct from the low-degree-test modification it is usually conflated with. That modification was superseded for FRI soundness by the Proximity Gaps analysis, which also proves Johnson-bound FRI soundness and is itself routinely misattributed to the original FRI paper. Second, and more consequential: the capacity-soundness conjectures on which nearly all deployed systems set their parameters had their strongest, up-to-capacity forms, including the mutual-correlated-agreement conjecture behind the newest schemes, disproved over large fields in late 2025. Soundness up to the Johnson bound is unaffected and the practical repricing is modest, but the discount the ecosystem had tacitly taken was, in its optimistic form, wrong. Our central thesis is that this proven-versus-conjectured soundness axis, not asymptotic query complexity, is the load-bearing and least-consistently-reported dimension of the design space, and the field has now had to reprice it.

Any signature scheme has to protect its secret key via some properly chosen, secret randomness. We show that, for the lattice signatures \textsf{HAWK}, Falcon and ML-DSA, even minimal leakage of this randomness suffices for secret key recovery.

In particular, leaking either the Hamming weight or a single bit of any randomness coordinate allows an attacker to infer the sign of that coordinate. This corresponds to learning $\textrm{sign}(\langle \mathbf b, \mathbf w \rangle)$, where $\mathbf b$ is the secret key and $\mathbf w$ is public. We model key recovery from such sign information as an instance of Learning a Halfspace. This well-studied problem from learning theory provides a rich solution machinery, which we adapt for the cryptanalysis of lattice-based signatures.

As a first main result, we resolve the open problem of recovering the secret key in \textsf{HAWK} from sign leakage. At the 128-bit security level and in the noise-free setting, we recover the secret key from only 30 signatures in 10 minutes.

As a second main result, we recover the secret key in Falcon via sign leakage from only 100 signatures in under a minute. In comparison to existing attacks, this reduces the number of required signatures by a factor of $250$.

As a third result, we show the first ML-DSA secret key recovery from sign leakage, which requires 190,000 signatures and completes within seconds. In comparison to existing ML-DSA attacks, we require a comparable amount of signatures, but utilize a less restrictive leakage model.

In addition, our attack is alarmingly noise-tolerant, succeeding with up to 35\% noise for \textsf{HAWK}, 30\% for Falcon, and 35\% for ML-DSA, albeit requiring significantly more signatures in the noisy case.

Multiplicative complexity have shown to be an important metric for efficient implementations in various contexts such as side-channel secure implementation and transciphering.

We introduce a generic framework based on conjugacy to reduce the multiplicative complexity of block ciphers. Our approach exploits the iterative structure of the block cipher to build alternative implementation based on conjugate round operations with overall smaller multiplicative complexity.

We apply this methodology to the Skinny family of block ciphers and derive optimized implementations for all versions. By carefully analyzing the interaction between the non-linear and linear layers, we construct an alternative implementation that reduces the number of multiplications. For Skinny64, we obtain a gain of 5.5 percent, while for Skinny128, the gain reaches 3 percent.

Worst-case to average-case reductions from lattice problems such as GapSVP and Bounded Distance Decoding (BDD) to the Learning with Errors (LWE) problem form the backbone of the security guarantees for lattice-based cryptography. However, these classic reductions are notoriously lossy: even assuming exponential hardness for worst-case lattice problems, they yield only subexponential lower bounds on the hardness of LWE. Recent work by Aggarwal, Leong, and Veliche (AMV, TCC'24) proposed a new perspective, quantifying hardness in terms of the \emph{maximum success probability} achievable by any efficient (PPT) algorithm, and provided nearly tight reductions for LWE in the polynomial-time regime. Nevertheless, their framework is inherently limited to polynomial-time adversaries, leaving open the question of how the tradeoff between running time and success probability for lattice problems governs the concrete security of LWE and SIS against powerful, time-rich adversaries.

In this work, we address this gap by systematically analyzing and tightly characterizing the time-success probability tradeoff for SVP and BDD, focusing on algorithms that exploit the fine-grained structure of slide-reduced bases. We present new blockwise guessing algorithms for SVP and BDD that utilize small-dimension SVP and CVP oracles; by leveraging the consecutive-product properties of Slide Reduction, we obtain the tightest known lower bounds on the success probability as a function of time. Assuming that we cannot do much better than this, we conjecture that no algorithm can outperform this tradeoff---for any subexponential time bound $T(n)=2^{o(n)}$, the success probability of solving worst-case SVP or BDD cannot exceed $2^{-\frac{n^2\log\log T(n)}{c\log T(n)}}$ for some constant $c>1$, up to polynomial factors.

Applying this conjecture, we derive sharply improved, modular worst-case to average-case reductions for LWE and SIS that are robust against all time-bounded adversaries, not just those restricted to polynomial time. Our results provide the first fine-grained, quantitative foundation for the bit-security of lattice-based cryptography across the full spectrum of adversarial resources, closing a key gap in both the theory and practice of cryptographic security reductions.

FrodoKEM, a key encapsulation mechanism based on the standard (unstructured) LWE assumption, is recommended as a conservative choice for post-quantum key exchange by agencies like BSI and ANSSI. As such, it has garnered substantial attention from an implementation security standpoint. In particular, several papers have looked into masking FrodoKEM, and, like for various other lattice-based cryptosystems, identified the Gaussian sampling operation as a major bottleneck. In FrodoKEM, it is carried out using a CDT-based sampler, which compares a uniformly random value in [0,1) (with fixed precision) to each of the probabilities in the cumulative distribution table of the target distribution.

Two recent works proposed masked gadgets at arbitrary order for that operation: one by Gérard and Guerreau (CASCADE 2026), which simply masks each of the comparisons with the table elements (using a ripple carry adder as the Boolean comparison circuit), and another by Eid et al. (TCHES 2026), that uses a novel approach based on a binary search tree, significantly reducing the number of masked comparisons for larger tables. Eid et al. also choose the Kogge-Stone adder as the basis for their comparison circuit.

In this paper, we provide an extensive analysis of the choices and trade-offs involved in masked CDT-based sampling, and propose several optimizations that further improve upon these previous works by a considerable margin. In particular, since FrodoKEM, like almost all the schemes that rely Gaussian sampling, generates hundreds of samples at a time, we find it beneficial to utilize approaches that lend themselves to a high degree of parallelization. This includes bitslicing (with which, importantly, the ripple carry adder has been proved optimal for comparisons), as well as techniques such as the use of algebraic normal form in masked multiplexers.

As a result, on an ARM Cortex-M4 STM32F4 target board, our companion implementation in pure C outperforms the hand-crafted assembly of Eid et al. (resp. Gérard-Guerreau) by a factor of around 2 (resp. 7 to 9) at masking order 1. The gap is even larger at higher order: we outperform the higher-order code of Eid et al. (in C with assembly for expensive gadgets) by a factor ranging from 5 at masking order 2 to 9 as masking order 8.

Multivariate interpolation arises in a wide range, including computer graphics, multi-secret sharing and secure multiparty computation. But its general representation is rarely discussed. In this note, a general representation for univariate interpolation and multivariate interpolation is formulated, which is helpful for multi-secret sharing illustrations and security arguments. The finding offers a new glimpse into the relation between Cramer rule and Lagrange interpolation formula.

Idempotent functions are an important class of Boolean functions, related to cryptography and coding theory.} This paper investigates $k$-idempotent functions, a natural generalization of {idempotent} functions. Based on two classes of Dillon-type bent functions proposed in {the paper ``New characterizations of Dillon-like hyperbent functions via Dickson polynomials", by Z. Tu, C. Li, X. Zeng, T. Helleseth and N. Li, 02 October 2025, Volume 38, article number 35, in Journal of Cryptology}, we establish the existence of $k$-idempotent bent functions {(that are not $l$-idempotents for $l

Exchanging data, assets and messages across various blockchain networks remains a challenge due to siloed blockchain ecosystems. Many interoperability solutions have addressed this challenge through bridges and relay chains. However, these solutions often reduce trust and privacy to achieve lower computational cost and delay. To address this gap, this paper prioritises trust and privacy while accepting increased computational cost and delay as a trade-off. We present the design and implementation of a Zero-Knowledge Proof (ZKP)-based prototype for privacy-preserving cross-chain verification in a Polkadot/Substrate-style environment. Circom and SnarkJS are used to generate Groth16 proofs off-chain, while a Rust verifier based on arkworks BN254 checks the proof in a Rust-based environment. After verification, the result is sent to a Substrate-style adapter. The prototype then records it, evaluates it through an interoperability decision layer, and tests it using an XCM-style simulation. The prototype demonstrates correct accept/reject behaviour: a valid proof is accepted, while a deliberately modified public input is rejected. Timing tests showed proof generation at 199 ms, SnarkJS valid-proof verification at 161 ms, tampered-proof rejection at 160 ms, and Rust Groth16 verification at 340 ms. The prototype successfully verified a SnarkJS-generated Groth16 proof in Rust, demonstrating a practical path from private proof generation to Polkadot-style interoperability control. A repeatability package containing selected proof artefacts, scripts, timing results, documentation, and demo commands supports independent review. The current XCM component remains a simulation; future work will extend the design into a full FRAME pallet and test live XCM dispatch.

The main objective of this paper is to acceler ate the post-processing of Quantum Key Distribution (QKD) using an energy-efficient pipelined architecture implemented on a Field-Programmable Gate Array (FPGA). The proposed architecture aims to improve processing speed while efficiently utilizing hardware resources. In addition, this work compares the proposed approach with existing approaches to demonstrate its performance and resource efficiency.

Private set operations (PSOs) let two parties compute set-theoretic functionalities on private inputs while revealing nothing beyond the prescribed output. While private set intersection (PSI) has become highly efficient, many other PSOs remain significantly more expensive. The most effective general framework for such tasks is based on reverse private membership test (RPMT), but even state-of-the-art RPMT constructions rely on heavy elliptic-curve-based primitives.

In this work, we propose a substantially faster RPMT protocol by replacing the elliptic-curve core with RLWE-based one. Our starting point is the Oblivious Key-Value Store (OKVS) based RPMT framework, whose direct adaptation to RLWE is obstructed by the batching structure of RLWE encryption. To address this, we introduce a batching-friendly variant of OKVS together with a homomorphic batched decoding procedure. We believe that this batching-friendly OKVS and its homomorphic decoding process may be of independent interest.

For a set size $2^{20}$, our RPMT-based PSO protocols take only about $3$ seconds over LAN network and $120$-$138$MB communication, whose running time is comparable to state-of-the-art PSI. Compared to state-of-the-art PSI-Cardinality and PSI-Card-SUM, this is up to \(13.0\times\) speedups. Compared to state-of-the-art PSU, this is up to \(3.0\times\) smaller communication while achieving comparable computational cost, which results in up to $3.9\times$ faster running time over WAN.

The Post-Quantum Cryptography Migration Interdisciplinary Lab (PQC-X) is a newly founded lab at XJTLU, led by Prof. Jintai DING, a globally recognized leader in Post-quantum Cryptography.

PQC-X invites applications for multiple fully funded PhD and Postdoctoral Research Fellow positions in the areas of post-quantum cryptography, advancing key technologies in post-quantum migration and facilitating their industry transfer.

Position Details

PhD Candidates: Open to applicants with a Bachelor’s or Master’s degree in a relevant field (students near completion are also encouraged to apply). A solid foundation in cryptography, mathematics, or computer science is required. Strong programming skills are a plus.
Postdoctoral Fellows: Applicants should hold a PhD in a related field (or near completion) and demonstrate a strong research track record, preferably with publications at leading IACR venues or security conferences.

Research topics include, but are not limited to:

Fundamental theoretical research covering multivariate-based, code-based, hash-based, isogeny-based and lattice-based cryptography.

Design new advanced post-quantum protocols.

AI-assisted post-quantum migration applications.

Efficient implementation technologies for autonomous and controllable post-quantum cryptographic hardware, software, and cloud services

Post-quantum cryptographic security protocol migration technologies for various industry information systems

Desired Qualifications

High motivation and ability to work both independently and collaboratively

Strong communication skills

Excellent academic writing and presentation abilities

How to Apply
Interested candidates should send their applications (including CV, academic transcripts and a brief statement of research interests) to [email protected]

Closing date for applications:

Contact: [email protected]

We are hiring three (3) researchers (post-doc or equivalent) for a project at the intersection of cryptography, agentic systems, and automated verifiable design.

Project: We are building an end-to-end framework that automates the specification, verification, and deployment of cryptographic protocols for multi-agent systems. LLM-driven agents explore the design space, synthesise protocols for specific security needs, and formally verify them (e.g. ProVerif, Lean) with machine-checkable proofs, exposed through the Verified Agentic Interaction Substrate (VAIS).

Details: School of Informatics, University of Edinburgh, UK. Salary: UoE Grade 7 (£41,064-48,822). Start: as soon as possible. Duration: 1 year, extension possible.

Essential

• Doctorate (or nearing completion) in Cryptography, Computer Science, Mathematics or related, specialising in applied/theoretical cryptography.
• Strong foundations in provable security (game- and simulation-based definitions).
• Familiarity with core cryptographic primitives and their security models (signatures, encryption, key exchange).
• Ability to reason formally about protocol composition.
• Track record of publications at recognised venues.

Desirable

• Hands-on experience with secure multi-party computation (MPC), including familiarity with function-to-protocol compilers such as SPDZ.
• Experience with zero-knowledge proof systems, including the design or use of ZK circuits and compatible compilers.
• Exposure to formal verification tools (e.g. ProVerif, CryptoVerif, Tamarin) or proof assistants (e.g. Lean), and an interest in bridging pen-and-paper proofs with machine-checkable ones.
• Programming skills for prototyping cryptographic tooling.
• Interest in AI/agentic systems and LLMs.

Closing date for applications:

Contact: Michele Ciampi ([email protected])

We now offer a new postdoctoral position in the field of Applied Cryptography and Privacy. The research is devoted to the broader area of privacy-preserving storage and computation outsourcing. Privacy-preserving computation outsourcing allows users to outsource computation tasks to a cloud server without revealing to the server anything about the user data or even what kind of computations the user is performing. The project will explore the applications of FHE (Fully Homomorphic Encryption) towards realizing such privacy-preserving systems. The position is funded through the Wallenberg AI, Autonomous Systems and Software Program (WASP). WASP is Sweden’s largest individual research program ever, a major national initiative for strategically motivated basic research, education, and faculty recruitment.

How to apply: Applications are to be submitted via the University’s recruitment system. Application link: https://lu.varbi.com/en/what:job/jobID:942295/

The application should include:

1. a CV including your educational qualifications, work experience, and a list of publications. The publications should mention all the co-authors (following the same author order as in the published version) and include DOIs or links to publicly accessible versions.
2. a personal letter justifying your interest in the position and how it matches your qualifications.
3. a research statement (no more than two pages).
4. The application should also include a degree certificate or equivalent and any other document to which you would like to draw attention (copies of grade transcripts, details of referees, letters of recommendation, etc.).
5. Contact details of at least two referees.

Application deadline: July 31, 2026.

Closing date for applications:

Contact: Debajyoti Das ([email protected])

More information: https://lu.varbi.com/en/what:job/jobID:942295/

The Foundational Cryptography group at IBM Research Zurich has an opening for a PhD position for research on cryptographic proof systems.

Position Details

-Funded for 4 years
-Possibility of joint supervision at EPFL
-Ideal start date late 2026 or early 2027

Research Project Overview

Cryptographic proof systems allow a prover to convince a verifier that a computation was performed correctly. These systems have applications in secure cloud computing, verifiable machine learning, and privacy-preserving technologies.

However, many proof systems require the prover to use significantly more time and memory than the original computation. The research will develop new proof systems with reduced time and memory overheads, making it practical to verify the integrity of large-scale computations efficiently.

Requirements

-MSc (or equivalent) in Computer Science or Mathematics (or another relevant field)

The ideal candidate would enjoy using a mixture of algebra, combinatorics, and probability to analyze and optimize algorithms. Strong background in one or more of the following areas is valuable:
-Cryptographic proof systems (zero-knowledge proofs, succinct arguments)
-Error-correcting codes and coding theory
-Streaming algorithms and memory-efficient computation
-Lightweight cryptography

Diversity & Work Environment

IBM is committed to fostering diversity and inclusion in the workplace. You will join an open, multicultural research environment that values different perspectives and supports flexible working arrangements. Our goal is to help all genders and backgrounds thrive professionally while maintaining a healthy work–life balance.

Closing date for applications:

Contact:

Please apply via https://www.zurich.ibm.com/careers/2026_022.html

If you have questions, please contact Jonathan Bootle at [email protected]

More information: https://www.zurich.ibm.com/careers/2026_022.html

The University of Oldenburg invites applications for a PhD student position in the Safety-Security-Interaction group, under the supervision of Prof. Dr. Andreas Peter and Dr. Federico Mazzone.

• Full-time position
• Start date: flexible, to be discussed with the applicant
• End date: 30 September 2030
• Research area: cryptography, privacy-enhancing technologies, and trustworthy AI, with a focus on applications to healthcare systems
• Possible research topics: homomorphic encryption, secure multi-party computation, differential privacy, secure collaborative machine learning, robustness, explainability, fairness, and auditability
• Position highlights:
• Goal of publishing at leading international conferences and journals in security, privacy, cryptography, and machine learning
• Full support for conference travel and international networking
• Young and growing research environment with close supervision
• Room to shape the PhD project according to the candidate’s interests
• Opportunities to collaborate with our many academic and non-academic partners
• Requirements:
• Master’s degree or equivalent in Computer Science, Mathematics, or a related field
• Strong background in cybersecurity and machine learning
• Good programming skills
• Excellent English level
• Application deadline: 31 July 2026

https://uol.de/en/job/wissenschaftlicher-mitarbeiterin-promotionsstelle-trustworthy-ai-1137

Closing date for applications:

Contact: Dr. Federico Mazzone ([email protected])

More information: https://uol.de/en/job/wissenschaftlicher-mitarbeiterin-promotionsstelle-trustworthy-ai-1137

FutureChips is a new postdoctoral program at Tampere University offering excellent researchers a 36-month fellowship in the field of next-generation semiconductor technologies. The fellows are given the opportunity to design their own research project addressing the program’s four interconnected semiconductor research areas: 1. Advanced materials, 2. Novel architectures, 3. Chip design, 4. Advanced packaging. Note: Hardware cryptography, secure processor architectures, chip security (attacks and countermeasures), and any novel security-related semiconductor research direction are within the scope of the program. The first call for applications (12 fellowships out of 20 total) will be open from July 1 to August 31, 2026. Fellows are expected to relocate to Tampere and to start their fellowship in July 2027. For more information: https://projects.tuni.fi/futurechips/

Closing date for applications:

Contact: For questions related to the security area, you may contact Markku-Juhani O. Saarinen: [email protected]

More information: https://projects.tuni.fi/futurechips/

In 2022, Cotan and Te{\c{s}}eleanu proposed an alternative RSA construction in which the modulus takes the form $N = pq$ and the exponents $(e,d)$ are linked through $ ed -1\equiv 0 \pmod{\psi_n(N)},\ n \geq 2, $ where $ \psi_n(N) = \frac{(p^n-1)(q^n-1)}{(p-1)(q-1)}. $ Their scheme was subsequently examined by Nitaj et al. at Africacrypt 2024, who demonstrated that the system becomes vulnerable when the secret exponent $d$ is less than $N^{0.292(n-1)}$. In the present work, we extend this line of cryptanalysis by developing a lattice-based technique targeting the same key congruence. Our approach succeeds in recovering the private parameters even for secret exponents greater than $N^{0.292(n-1)}$, thereby surpassing the previously known boundary. The factorization of $N$ is achieved in polynomial time, provided that its divisors $p$ and $q$ share a suitably portion of their least significant bits.